In the last two posts, we looked at the basic settings of the AOS-CX switch family and how to check the entered commands.
This time, we will learn about the commands required for switch maintenance.
already ACSA Training ContentWhile writing, I have informed you of the commands required for maintenance.
However, today I will explain more with a focus on CLI commands.
Checkpoint
A checkpoint is a snapshot of a switch's running configuration and associated metadata, with the following characteristics:.
- Checkpoints can be used to apply the switch configuration stored in the checkpoint whenever needed.
(e.g. revert to a previous clean configuration) - Checkpoints can also be applied to other switches on the same platform.
- Multiple checkpoints can be stored on a single switch.
AOS-CX switches support two types of checkpoints:.
System-generated checkpoints
System-generated checkpoints are automatically created by default.
Whenever there is a configuration change, the switch starts a timeout counter (default 300 seconds).
Each time you make further configuration changes, the switch's timeout counter is restarted.
When the timeout expires without any additional configuration changes, the switch creates a new checkpoint.
The names of checkpoints generated by the system are prefixed with CPC. A timestamp in the following format is appended.
System checkpoints can be applied using the checkpoint rollback feature or the copy command.
You can create up to 32 checkpoints, and any more will replace the oldest checkpoint.
User-generated checkpoints
A user checkpoint can be created at any time as long as there is only one configuration difference since the last checkpoint was created.
You can create it at any time as long as there is only one configuration difference.
Checkpoints can be applied to the running or startup configuration of a switch.
All user-generated checkpoints, like system checkpoints, include a timestamp that identifies when the checkpoint was created.
You can also create up to 32 user-generated checkpoints.
CLI commands
switch# show checkpoint
NAME TYPE WRITER DATE(YYYY/MM/DD) IMAGE VERSION Switch1-bkup-1 latest User 2024-04-22T23:46:29Z FL.10.13.0001AV CPC20240422232201_switch1_6300 checkpoint System 2024-04-22T23:22:01Z FL.10.13.0001AV CPC20240422231116_switch1_6300 checkpoint System 2024-04-22T23:11:16Z FL.10.13.0001AV CPC20240422230707_switch1_6300 checkpoint System 2024-04-22T23:07:07Z FL.10.13.0001AV CPC20240422195632_switch1_6300 checkpoint System 2024-04-22T19:56:32Z FL.10.13.0001AV CPC20240422195351_switch1_6300 checkpoint System 2024-04-22T19:53:51Z FL.10.13.0001AV CPC20240308010234_switch1_6300 checkpoint System 2024-03-08T01:02:34Z FL.10.13.0001AV startup-config-backup checkpoint System 2024-02-10T19:11:31Z FL.10.13.0001AV CPC20231205201456_6300-bot_6300 checkpoint System 2023-12-05T20:14:56Z FL.10.13.0001AV CPC20231108200026_6300-bot_6300 checkpoint System 2023-11-08T20:00:26Z FL.10.13.0001AV CPC20231006230246_6300-bot_6300 checkpoint System 2023-10-06T23:02:46Z FL.10.13.0001AV startup-config startup User 2023-10-06T22:38:18Z FL.10.13.0001AV UBT checkpoint User 2021-10-27T14:33:08Z FL.10.08.0001 OSPF checkpoint User 2021-08-09T21:09:53Z FL.10.07.0004
AOS-CX can identify and show the differences between checkpoints.
First, let's create a checkpoint for the currently running Config.
switch(config)# copy running-config checkpoint Switch1-bkup-1
Copying configuration: [Success]Let's modify the vlan and mtu values on interface 1/1/25.
switch(config-if)# int 1/1/25
switch(config-if)# switch(config-if)# vlan access 40
switch(config-if)# mtu 9189Now, if we compare it with the checkpoint we created, we can see the differences as + (added items) and - (deleted items).
switch(config)# checkpoint diff checkpoint Switch1-bkup-1 running-config
--- /tmp/Switch1-bkup-11713830420784
+++ /tmp/running-config1713830421975 @@ -256,8 +256,9 @@ interface 1/1/25 no shutdown
+ mtu 9198 no routing
- vlan access 1
+ vlan access 40Additionally, it provides a rollback feature that allows you to revert to a created checkpoint point.
switch# show run int 1/1/25
interface 1/1/25 no shutdown mtu 9198 no routing vlan access 40 exitswitch# checkpoint rollback Switch1-bkup-1
Copying configuration: [Success]switch# show run int 1/1/25
interface 1/1/25 no shutdown no routing vlan access 1 exitBackup and reset
backup
When operating a switch, you may need to back up and store the configuration to a remote server or repository.
AOS-CX can back up its configuration to a remote server via sftp, tftp, or scp protocols. Alternatively, you can save it to a USB drive.
To retrieve and restore the backed up config data later, it must be saved in JSON format.
switch# copy running-config tftp://192.168.1.10/backup_cfg json vrf mgmt
% Total % Received % 10340 0 1313k --:--:-- --:--:-- --:--:-- 1313kFactory default
To reset the switch to factory defaults, use the erase all command.
To execute the initialization command, you must connect via the console port. This will ensure that the connection is not lost after initialization.
switch# erase all zeroize
This will securely erase all customer data and reset the switch to factory defaults. This will initiate a reboot and render the switch unavailable until the zeroization is complete. This should take several minutes to one hour to complete. Continue (y/n)? y
The system is going down for zeroizationThe erase command can also take other options besides zeronize.
switch# erase ?
all Erase all customer data except the secure mode setting checkpoint Checkpoint information core-dump Erase daemon or kernel core-dump license Installed software license startup-config Contents of startup configurationLogging
Event logging records events generated by daemons, processes, and plugins running within the switch software.
Event logging captures event logs in the system journal by updating journal fields and metadata.
The logging command can be executed with several options.
switch# show logging ?
-a Display event logs from previous and current boots -c Display event logs for specified event category -d Display event logs for specified daemon -e Display event logs for specified event IDs -i Event logs for specified vsf member -m Display event logs for specified vsf role -n Display the specified number of event logs -r Display event logs reverse order (most recent first) -s Display event logs as per specified severityYou can check the currently saved system logs with various option values.
If you want to sort by most recent, use the -r option.
switch# show logging -r
--------------------------------------------------- Event logs from current boot -------------- 2024-04-22T17:15:05.272301-07:00 switch1 hpe-routing[4554]: Event|9501|LOG_INFO|CDTR|1|EVPN EVI: 41 created 2024-04-22T17:15:05.272136-07:00 switch1 hpe-routing[4554]: Event|9502|LOG_INFO|CDTR|1|EVPN EVI: 41 deleted 2024-04-22T17:15:03.258933-07:00 switch1 hpe-config[1069769]: Event|6801|LOG_INFO|AMM|-|Copying configs from: checkpoint Switch1-bkup-1 to: running-configIf you want to filter on a specific severity level, use the -s option.
switch# show logging -r -s err
--------------------------------------------------- Event logs from current boot ------------------------------------ 2024-04-22T17:14:00.220327-07:00 switch1 hpe-config[1068432]: Event|6802|LOG_ERR|AMM|-|Error while copying configs. Error: Checkpoint Switch1-bkup doesn't exist 2024-04-22T13:02:55.838508-07:00 switch1 port-accessd[4582]: Event|10509|LOG_ERR|CDTR|1|Client limit exceeded on port 1/1/3, caused by an unauthenticated client 00:0c:29:4b:be:a8 2024-04-22T13:02:55.531091-07:00 switch1 port-accessd[4582]: Event|10509|LOG_ERR|CDTR|1|Client limit exceeded on port 1/1/3, caused by an unauthenticated client 70:10:6f:95:84:80 2024-04-22T13:02:54.831263-07:00 switch1 port-accessd[4582]: Event|10509|LOG_ERR|CDTR|1|Client limit exceeded on port 1/1/3, caused by an unauthenticated client 00:0c:29:4b:be:a8You can use the clear command to delete specific log events.
switch# clear events
switch# show logging -r
--------------------------------------------------- Event logs from current boot --------------------------------------------------- No event has been logged in the systemTerminal Monitoring
The terminal monitoring feature is used to dynamically display real-time logs of specific events through a VTYSH session.
These logs are only displayed on SSH sessions and can be filtered by log type, severity, keywords, etc.
The terminal monitor runs in synchronous mode, meaning that when the user enters a command, the log display is paused until the command execution is complete.
This will prevent the log from appearing between other CLI outputs or while the user is typing.
switch1# sho terminal-monitor
Terminal-monitor is disabled switch1# terminal-monitor ?
filter Specify the filter for the log notify Specify the type of log notification (Default:event) severity Specify the severity of the log (Default:info) switch# terminal-monitor notify ?
all Displays both event and debug logs debug Displays only the debug logs event Displays only the event logs (Default) switch# terminal-monitor notify debug
Terminal-monitor is enabled successfully switch# sho terminal-monitor
Terminal-monitor is enabled ------------------------------------------------------- Notify | Severity | Filter ------------------------------------------------------- debug info Nil -------------------------------------------------------switch(config-if)# 2024-05-06T17:24:24.577037+0000 intfd[817] Event|403|LOG_INFO|UKWN|1|Link status for interface 1/1/19 is up at 100 Mbps 2024-05-06T17:24:24.608354+0000 hpe-mstpd[3875] Event|2012|LOG_INFO|CDTR|1|CIST - Topology Change generated on port 1/1/19 going in to forwarding 2024-05-06T17:24:29.722770+0000 lldpd[3569] Event|104|LOG_INFO|CDTR|1|LLDP neighbor 00:0e:c6:06:4b:8d added on 1/1/19Debugging
If you have a problem with your switch and need to get technical support, you may need to save the current state.
The show tech command will display all the detailed information that can be displayed using the show command.
If you do not define any separate parameters here, all switch functions and information will be displayed.
switch# show tech resources local-file
show tech output collection for feature resources is in progress... Done Show Tech output stored in local-file. Please use 'copy show-tech local-file' to copy-out this file.To effectively diagnose various problems, you can use the copy command to copy various types of data for further analysis.
You can save the data to a target such as TFTP, SFTP, or local USB with the copy command.
The saved file will be sent to our technical support team for troubleshooting and more accurate analysis.
switch# copy show-tech local-file tftp://10.10.1.102/resource
% Total % Received % 331k --:--:-- --:--:-- --:--:-- 331kYou can enable debug logging by name for each module or submodule and optionally filter it based on specific criteria.
The no form of this command disables debug logging.
Debug output can be sent to syslog, a file, the console, or a buffer (default).
Each target can be specified with various options, such as the severity or module to monitor.
switch# debug destination syslog severity alert
switch# debug destination console severity info
switch# debug destination file severity warning
switch# debug destination buffer severity errPoE (Power over Ethernet)
Some models of AOS-CX switches support PoE functionality.
The PoE capacity of each switch varies depending on the model and PSU (Power Supply Unit).
Always-on PoE
Always-on PoE feature Provides the ability to continue powering the switch even during a soft reboot.do.
This feature is enabled by default and is assigned at the switch or slot (for chassis-based switches) level.
switch(config)# power-over-ethernet always-onQuick-PoE
Quick-PoE feature As soon as the switch undergoes a cold reboot, it provides power to the connected power devices.This is a function that does this.
By default, the Quick-PoE feature is disabled.
switch(config)# power-over-ethernet quick-poe 1/1The Quick-PoE feature is enabled at the switch or slot level and requires PoE to be enabled on all ports on the switch or slot.
PoE cannot be disabled while Quick-PoE feature is enabled.
switch(config-if)# int 1/1/19
switch(config-if)# no power-over-ethernet
Interface PoE cannot be disabled when Quick PoE is enabled.Check PoE information
AOS-CX access switches provide PoE functionality using common CLI commands.
The PoE capacity of each switch varies depending on the installed PSU capacity and switch model, and you can check the currently available power capacity using the show command.
switch(config-if)# show power-over-ethernet ?
IFRANGE Interface name (eg 1/1/1) IFRANGE Interface range(eg 1/1/1-1/1/10) brief Show information in one-line summary format member Show PoE information of specified stack memberswitch(config-if)# show power-over-ethernet
System Power Status for member 1 PoE Power Status : No redundancy Operational Power Status : No redundancy Total Available Power : 1440.00 W Total Failover Pwr Avl : 740.00 W Total Redundancy Power : 0.00 W Total Power Drawn : 36.82 W Total Power Reserved : 40.10 W Total Remaining Power : 1399.90 W Trap Threshold : 80 % Trap Enabled : Yes Always-on PoE Enabled : 1/1 Quick PoE Enabled : 1/1 Internal Power: Total Power PS (Watts) Status ----- ------------ --------------------- 1/1 1050 OK 1/2 1050 OKThe brief command allows you to see a summary screen of the entire interface.
switch(config-if)# show power-over-ethernet brief
Member 1 Power Status Available: 1440.00 W Reserved: 43.10 W Remaining: 1396.90 W Always-on PoE Enabled:1/1 Quick PoE Enabled:1/1 PoE Pwr Power Pre-std Alloc PSE Pwr PD Pwr PoE Port PD Cls Type Port Ena Priority Detect Act Rsrvd Draw Status Sign -------- --- -------- ------- ------------- ------- ------ ------------- ------ --- ---- 1/1/1 Yes low Off usage 0.0 W 0.0 W searching N/AN/AN/A 1/1/2 Yes low Off usage 0.0 W 0.0 W searching N/AN/AN/A 1/1/3 Yes low Off usage 0.0 W 0.0 W searching N/AN/AN/A 1/1/4 Yes low Off usage 0.0 W 0.0 W searching N/AN/AN/A 1/1/5 Yes low Off usage 0.0 W 0.0 W searching N/AN/AN/A 1/1/6 Yes low Off usage 9.3 W 8.6 W delivering N/A 4 2 1/1/7 Yes low Off usage 0.0 W 0.0 W searching N/AN/AN/A 1/1/8 Yes low Off usage 0.0 W 0.0 W searching N/AN/AN/A 1/1/9 Yes low Off lldp-dot3 7.5 W 7.0 W delivering N/A 4 2 1/1/10 Yes low Off usage 0.0 W 0.0 W searching N/AN/AN/A 1/1/11 Yes low Off lldp-dot3 11.8 W 10.7 W delivering N/A 4 2You can also check the PoE status of a specific interface.
switch(config-if)# show power-over-ethernet 1/1/11
Status and Configuration Information for port 1/1/11 Power Enable : Yes PD signature : N/A PoE Port Status : delivering PD Type : Type2 Alloc-by Configured : usage Alloc-by Actual : lldp-dot3 User Profile Priority : N/A Port Config Priority : Low Port Priority : low Pre-std Detect : Disabled PD Requested Class : Class4 PSE Assigned Class : Class4 Fault Status : None User set Assigned Class : class4 PD Class Override : Disabled Power Pairs Configured : alt-a Power Pairs Applied : alt-a PoE Counter Information Over Current Cnt : 0 MPS Absent Cnt : 0 Power Denied Cnt : 0 Short Cnt : 0 Power Information PSE Voltage : 56.74 V PSE Reserved power : 11.80 W PD Current Draw : 0.19 A PD Power Draw : 10.67 W PD Average Power Draw: 10.89 W PD Peak Power Draw: 10.89 W LLDP Information MED Override : Disabled MED Priority : Unknown PSE TLV Configured : dot3/med PSE TLV Sent Type : dot3 PD TLV Sent Type : dot3 PSE Allocated Power Value: 23.30 W PD Requested Power Value : 23.30 WYou can use the brief command to view a summary of a specific interface.
switch(config-if)# show power-over-ethernet 1/1/11 brief
Member 1 Power Status Available: 1440.00 W Reserved: 43.10 W Remaining: 1396.90 W Always-on PoE Enabled: 1/1 Quick PoE Enabled: 1/1 PoE Pwr Power Pre-std Alloc PSE Pwr PD Pwr PoE Port PD Cls Type Port Ena Priority Detect Act Rsrvd Draw Status Sign -------- --- -------- ------- ------------- ------- ------ ------------- ------ --- -- 1/1/11 Yes low Off lldp-dot3 11.8 W 10.7 W delivering N/A 4 2In this post, we looked at various information needed to operate the switch and how to troubleshoot it.
When operating a network, it is important to know how to configure it, but it is more important to operate it safely and stably.
The most essential things to create a stable network operating environment are backup and logging.
Let's review and master each command so you can quickly take action before problems escalate and keep your network running!
