What each command does, two or three examples you can type into the sandbox, what changed between AOS-CX 10.15 and 10.18, and where the sandbox fakes hardware instead of reproducing it. Every example is run through the sandbox before this page is built, and every release line comes from the command lists I pulled off the Switch Simulator for each release. The same notes show up beside the terminal as you type.
configure terminalEverything that changes the switch starts here. The prompt grows (config) and stays until you type end. Unique abbreviations work: conf t is the same thing.
In every release here, 10.15 to 10.18.
configure terminalhostname access-01endconf tvlan 10endendLeaves whatever context you are in and drops you at the exec prompt. exit goes up one level; end goes all the way.
In every release here, 10.15 to 10.18.
configure terminalinterface 1/1/1endconfigure terminalvlan 10exitendGoes withconfigure terminal
hostname <WORD>Sets the name in the prompt, in LLDP and in logs. Letters, digits, dots and dashes, no spaces.
In every release here, 10.15 to 10.18.
hostname access-01hostname idf2-sw1write memoryCopies the running configuration to the startup configuration so it survives a reboot. copy running-config startup-config does the same.
In every release here, 10.15 to 10.18.
write memorycopy running-config startup-configGoes withshow startup-config
show running-configThe whole active configuration. Add interface 1/1/5 to see one port's block. Pipe it to cut it down: | begin, | include.
In every release here, 10.15 to 10.18.
show running-configshow running-config interface 1/1/5show running-config | begin "port-access role"Goes withshow startup-configshow checkpoint
show startup-configThe saved configuration, the one a reboot loads. If it differs from the running config, something has not been saved yet, on purpose or not.
In every release here, 10.15 to 10.18.
show startup-configcheckpoint diff startup-config running-configGoes withwrite memoryshow running-config
show versionThe AOS-CX release and build. The first two letters say the platform: ML for the 6200, FL for the 6300. The release picker in the sandbox changes what this says.
In every release here, 10.15 to 10.18.
show versionshow version | include VersionGoes withshow system
show systemProduct name and part number, serial, base MAC, uptime and CPU. The part number is how you tell a 6200F 12-port from a 24-port when nobody wrote it down.
In every release here, 10.15 to 10.18.
show systemshow system | include Productno pageTurns off paging for this session, so long output scrolls instead of stopping every screen. Every script and screen capture should start with it.
In every release here, 10.15 to 10.18.
no pagepage 40copy running-config checkpoint <WORD>Saves the running config under a name. If the running config is identical to a checkpoint that exists, 10.18 refuses with An identical checkpoint already exists.
In every release here, 10.15 to 10.18.
copy running-config checkpoint before-changeshow checkpointcheckpoint rollback <WORD>Replaces the running config with the checkpoint. It does not ask. checkpoint diff checkpoint <name> running-config shows the difference first, and that is worth doing.
In every release here, 10.15 to 10.18.
copy running-config checkpoint before-changecheckpoint rollback before-changecheckpoint rollback startup-configGoes withcopy running-config checkpoint <WORD>show checkpoint
show checkpointEvery checkpoint, newest first, with the startup config among them by date. show checkpoint <name> prints one. There is no show checkpoint list on 10.18: the box reads list as a checkpoint name.
In every release here, 10.15 to 10.18.
show checkpointshow checkpoint before-changecheckpoint diff <from> <to>Compares any two of running-config, startup-config and checkpoint <name> as a unified diff: a line starting with a plus is only in the second, one starting with a minus only in the first. No difference in configs. means they match. Worth running before every rollback.
In every release here, 10.15 to 10.18.
copy running-config checkpoint before-changecheckpoint diff checkpoint before-change running-configcheckpoint diff startup-config running-configvlan <1-4094>Creates the VLAN and enters its context. Name it there. A port cannot use a VLAN that does not exist.
In every release here, 10.15 to 10.18.
vlan 10name STAFFvlan 30name VOICEvoiceGoes withshow vlanname <WORD>
name <WORD>Shows in show vlan and in LLDP. One word here; the box takes a longer line too.
In every release here, 10.15 to 10.18.
vlan 20name PRINTERSvlan 99name AP-MGMTvoiceTells LLDP-MED this VLAN carries voice. Phones that speak LLDP-MED learn it from the network policy the switch sends on ports that tag it: VLAN, priority 6, DSCP 46 with nothing else configured.
In every release here, 10.15 to 10.18.
vlan 30voiceshow vlan voiceshow vlanEvery VLAN, up or down, and which ports carry it. Down with no_member_port means no port is in it; no_member_forwarding means ports are in it but none is up. A role a client holds adds its VLANs to that port here.
In every release here, 10.15 to 10.18.
show vlanshow vlan 30show vlan | include VOICEinterface <IFNAME>Enters one port (1/1/5) or a range (1/1/1-1/1/8). Member/slot/port: 1/1/5 is member 1, slot 1, port 5.
In every release here, 10.15 to 10.18.
interface 1/1/5description printerinterface 1/1/1-1/1/8no shutdownshutdownAdmin down. no shutdown turns it back on and also clears an error-disabled port. A port nobody configured may be shut: show interface brief says Administratively down.
In every release here, 10.15 to 10.18.
interface 1/1/11shutdowninterface 1/1/8no shutdowndescription <LINE>Free text on the port, shown in show interface brief and LLDP.
In every release here, 10.15 to 10.18.
interface 1/1/7description desk 7, pair 3-6 open at 23 minterface lag 1description uplink to coreno routingA routed port takes an ip address; a switched port takes VLANs. no routing makes it switched. Some platforms (and the Switch Simulator) start every port routed, so check before you assign a VLAN.
In every release here, 10.15 to 10.18.
interface 1/1/1no routingvlan access 10interface 1/1/12routingip address 203.0.113.129/25vlan access <1-4094>Makes the port an access port in that VLAN. The VLAN has to exist.
In every release here, 10.15 to 10.18.
interface 1/1/5vlan access 20interface 1/1/1-1/1/4vlan access 10vlan trunk allowed <VLIST>Makes the port a trunk and adds VLANs to its allowed list. It adds: vlan trunk allowed 10 then vlan trunk allowed 20 leaves 10,20, as the lab switch did. no vlan trunk allowed 10 takes one out.
In every release here, 10.15 to 10.18.
interface 1/1/3vlan trunk native 10vlan trunk allowed 10,30interface lag 1vlan trunk allowed 10,20,30Goes withvlan trunk native <1-4094>
vlan trunk native <1-4094>The VLAN whose frames cross the trunk untagged. On a phone port it is the PC's data VLAN; the phone tags voice.
In every release here, 10.15 to 10.18.
interface 1/1/3vlan trunk native 10vlan trunk allowed 30interface 1/1/13vlan trunk native 99vlan trunk allowed 10,20,99speed autospeed auto offers every speed the port can do; speed auto 1g 2.5g offers only those; speed 1000-full fixes it and turns auto-negotiation off. Since 10.09 the CLI hides speeds the hardware lacks.
In every release here, 10.15 to 10.18.
interface 1/1/1speed autointerface 1/1/1speed auto 1g 2.5g 5ginterface 1/1/2no speedGoes withshow interface <PORT> physicaldiag cable-diagnostic test <PORT>
show interface briefNative VLAN, mode, enabled, up or down, why it is down, speed and description. Read the Reason column first.
In every release here, 10.15 to 10.18.
show interface briefshow interface brief | include downshow interface <PORT>State, why it is down (State information), VLANs and counters. Blocked by Port Access Security means the link is up but no client has authenticated.
In every release here, 10.15 to 10.18.
show interface 1/1/5show interface 1/1/5 | include Stateshow interface <PORT> physicalLink and admin state, the speed it runs at next to what it is configured to allow, flow control, PoE draw.
In every release here, 10.15 to 10.18.
show interface 1/1/1 physicalshow interface physicalshow mac-address-tableLearned MACs by VLAN and port. port-access-security means the MAC was learned through port-access. Filter by vlan or interface, or pipe it.
In every release here, 10.15 to 10.18.
show mac-address-tableshow mac-address-table interface 1/1/6show mac-address-table | include 53:4cinterface lag <1-256>Creates lagN and enters it. On 10.18 a new LAG is administratively down: nothing forms until no shutdown.
In every release here, 10.15 to 10.18.
interface lag 1no shutdownno routingvlan trunk allowed 10,20lacp mode activelag <1-256>Makes the port a member. Its VLAN settings come from the LAG from then on.
In every release here, 10.15 to 10.18.
interface 1/1/13-1/1/14lag 1lacp mode <active|passive>active sends LACPDUs; passive only answers. Two passive ends never form a LAG. Without lacp mode the LAG is static: no LACP at all.
In every release here, 10.15 to 10.18.
interface lag 1lacp mode activeinterface lag 1lacp mode passivelacp rate <fast|slow>Asks the partner for a short timeout: a dead link is noticed in about three seconds instead of ninety. The S in PSFNCD is the partner asking for the same.
In every release here, 10.15 to 10.18.
interface lag 1lacp rate fastinterface lag 1no lacp rateshow lacp interfacesActor and partner state per member. ALFNCD is what you want: Active, Long timeout, aggregable, in sync, collecting, distributing. An empty partner line means nothing is talking back.
In every release here, 10.15 to 10.18.
show lacp interfacesshow lacp interfaces 1/1/13show lacp aggregatesMembers, heartbeat rate, hash and mode per LAG.
In every release here, 10.15 to 10.18.
show lacp aggregatesshow interface lag 1spanning-treeMSTP by default. Without it an accidental loop takes the VLAN down. mode rpvst switches to Rapid PVST+.
In every release here, 10.15 to 10.18.
spanning-treespanning-treespanning-tree priority 4spanning-tree port-type admin-edgeA port where only end devices live: it forwards at once instead of waiting through listening and learning.
In every release here, 10.15 to 10.18.
interface 1/1/1-1/1/12spanning-tree port-type admin-edgeGoes withspanning-tree bpdu-guard
spanning-tree bpdu-guardA BPDU arriving on the port error-disables it. Pair it with admin-edge on every access port. no shutdown brings it back once the switch is gone.
In every release here, 10.15 to 10.18.
interface 1/1/1-1/1/12spanning-tree bpdu-guardloop-protectSends probes and error-disables the port if one comes back, which catches a loop through an unmanaged switch that drops BPDUs.
In every release here, 10.15 to 10.18.
interface 1/1/1-1/1/12loop-protectshow spanning-treeWho is root, which port leads there, and each port's role and state.
In every release here, 10.15 to 10.18.
show spanning-treeshow spanning-tree | include Rootlldp med network-policyOn by default. On a port that tags a voice VLAN the switch sends LLDP-MED network policy, but only after it has heard the endpoint's own LLDP-MED TLVs. no lldp med network-policy stops it.
In every release here, 10.15 to 10.18.
interface 1/1/3lldp med network-policyinterface 1/1/3no lldp med network-policyGoes withvoice
lldp <transmit|receive>LLDP sends and listens on every port by default. no lldp transmit and no lldp receive turn each half off.
In every release here, 10.15 to 10.18.
interface 1/1/9no lldp transmitinterface 1/1/9lldp transmitlldp receiveshow lldp neighbor-infoThe LLDP table: port, chassis, remote port, name. Give a port for the full record: capabilities, power it asks for, LLDP-MED class and network policy.
In every release here, 10.15 to 10.18.
show lldp neighbor-infoshow lldp neighbor-info 1/1/3show lldp neighbor-info | include CAMradius-server host <A.B.C.D> key plaintext <WORD>Defines a RADIUS server and the shared secret. The running config shows the key as ciphertext. A wrong key looks like a dead server: the server drops the request and the switch times out.
In every release here, 10.15 to 10.18.
radius-server host 192.0.2.10 key plaintext cppm-lab-keyradius-server host 192.0.2.11 key plaintext cppm-lab-key vrf mgmtaaa group server radius <WORD>Port-access points at a group, not a server. Servers are tried in priority order; entered without a priority they number themselves in the order you add them.
In every release here, 10.15 to 10.18.
aaa group server radius CLEARPASSserver 192.0.2.10server 192.0.2.11aaa group server radius CLEARPASSserver 192.0.2.11 priority 1show radius-serverEach server with its ports and VRF. A star in front means the switch has marked it unreachable.
In every release here, 10.15 to 10.18.
show radius-servershow radius-server detailshow radius-server statistics authenticationCounters per server. Timeouts climbing with no accepts usually means the shared secret. show radius-server statistics on its own is incomplete on 10.18.
In every release here, 10.15 to 10.18.
show radius-server statistics authenticationshow radius-server statistics authentication | include Timeoutsradius dyn-authorization enableLets ClearPass change or end a session after the fact (RFC 5176). On 10.18 that is two pieces: enable it, and name each server allowed to send with radius dyn-authorization client. Without the client line requests are dropped and counted as invalid client addresses.
In every release here, 10.15 to 10.18.
radius dyn-authorization enableradius dyn-authorization client 192.0.2.10 secret-key plaintext cppm-lab-keyGoes withshow radius dyn-authorization
show radius dyn-authorizationWhether dynamic authorization is on, the port (3799), the invalid-address counters, and per client the CoA and disconnect requests, ACKs and NAKs.
In every release here, 10.15 to 10.18.
show radius dyn-authorizationaaa authentication port-access dot1x authenticatorGlobal switch for 802.1X plus the RADIUS group it uses. It needs enable here and on each port: either one off and nothing authenticates.
In every release here, 10.15 to 10.18.
aaa authentication port-access dot1x authenticatorradius server-group CLEARPASSenableinterface 1/1/1-1/1/8aaa authentication port-access dot1x authenticatorenableGoes withaaa authentication port-access mac-authshow port-access clients
aaa authentication port-access mac-authThe same pattern as 802.1X: a global block with the group and enable, and enable per port. The switch sends the MAC as username and password, 00005e005305 style by default.
In every release here, 10.15 to 10.18.
aaa authentication port-access mac-authradius server-group CLEARPASSenableinterface 1/1/5aaa authentication port-access mac-authenableaaa authentication port-access client-limit <1-256>One by default. A PC behind a phone needs two, or a multi-domain port. Only clients that got in take a place.
In every release here, 10.15 to 10.18.
interface 1/1/3aaa authentication port-access client-limit 2aaa authentication port-access auth-precedence <order>dot1x then mac-auth is the default. A device with no supplicant waits out the 802.1X timeout before MAC auth starts; mac-auth first is faster for printers and slower for laptops.
In every release here, 10.15 to 10.18.
interface 1/1/5aaa authentication port-access auth-precedence mac-auth dot1xinterface 1/1/1aaa authentication port-access auth-precedence dot1x mac-authaaa authentication port-access critical-role <WORD>If every RADIUS server times out, clients get this role instead of nothing. reject-role is the same for a reject.
In every release here, 10.15 to 10.18.
interface 1/1/1aaa authentication port-access critical-role QUARANTINEinterface 1/1/1aaa authentication port-access reject-role GUESTaaa authentication port-access auth-mode multi-domainOne voice device and one data device (client-limit multi-domain raises the data count). The voice device is whoever holds a role with device-traffic-class voice.
In every release here, 10.15 to 10.18.
interface 1/1/6aaa authentication port-access auth-mode multi-domaininterface 1/1/6aaa authentication port-access client-limit multi-domain 2Goes withdevice-traffic-class voiceaaa authentication port-access allow-lldp-bpdu
aaa authentication port-access allow-lldp-bpduA port-access port drops LLDP from a client that has not authenticated. A phone that never authenticates is then invisible to LLDP, its device profile never matches, and it gets no voice VLAN. This lets LLDP through. Found the hard way on the lab switch on 2026-09-28.
In every release here, 10.15 to 10.18.
interface 1/1/6aaa authentication port-access allow-lldp-bpduport-access role <WORD>What a client gets once it is in: an access VLAN, or a native VLAN and a tagged list, and more on 10.18. RADIUS names the role; the switch must have it or the client fails authorization.
In every release here, 10.15 to 10.18.
port-access role EMPLOYEEvlan access 10port-access role AP-TRUNKvlan trunk native 99vlan trunk allowed 10,20,99Goes withshow port-access role
device-traffic-class voiceOn a multi-domain port the client holding this role is the voice device. Pair it with a native data VLAN and the voice VLAN tagged.
In every release here, 10.15 to 10.18.
port-access role VOICEdevice-traffic-class voicevlan trunk native 10vlan trunk allowed 30show port-access clientsOne line per client: port, name, role, VLAN, and four flags: how it got in (1x, ma, dp), mode (c, d, m), device type (d, v) and status (s, f, p). --|c|-|f is a failure. Add detail for the history, interface, mac or role to filter.
In every release here, 10.15 to 10.18.
show port-access clientsshow port-access clients interface 1/1/6 detailshow port-access clients onboarding-method device-profileshow aaa authentication port-access interface all client-statusThe authentication and authorization blocks for every client, without VLAN and MACsec detail.
In every release here, 10.15 to 10.18.
show aaa authentication port-access interface all client-statusshow aaa authentication port-access interface 1/1/1 client-statusshow port-access roleEach local role: VLANs, device type, gateway zone. show port-access role name X for one.
In every release here, 10.15 to 10.18.
show port-access roleshow port-access role name VOICEport-access reauthenticate interface <IFNAME>10.18 has no clear port-access clients. To start clients over: reauthenticate a port, or log one off by MAC, port or role.
In every release here, 10.15 to 10.18.
port-access reauthenticate interface 1/1/1port-access log-off client mac 00:00:5e:00:53:01port-access log-off client role GUESTport-access fallback-role <WORD>The role a client gets when nothing else gives it one. With no authentication on the port that is everything plugged in: with a gateway zone in the role, that is port-based tunnelling.
In every release here, 10.15 to 10.18.
interface 1/1/4port-access fallback-role PBT-IOTgateway-zone zone <WORD> gateway-role <WORD>Clients in this role are tunnelled to the gateway cluster of the zone, where the gateway role applies. That is user-based tunnelling when RADIUS assigns the role, port-based when a port's fallback role does.
In every release here, 10.15 to 10.18.
port-access role TUNNEL-EMPLOYEEgateway-zone zone CAMPUS gateway-role authenticatedport-access role PBT-IOTgateway-zone zone CAMPUS gateway-role iotGoes withubt zone <WORD> vrf <WORD>port-access fallback-role <WORD>
ubt-client-vlan <1-4094>In local-vlan mode (what show ubt reports) this is the reserved VLAN all tunnelled client traffic uses to reach the gateway. Create it first and use it for nothing else, as HPE's guide says.
In every release here, 10.15 to 10.18.
vlan 666name UBT-TRANSPORTexitubt-client-vlan 666Goes withubt zone <WORD> vrf <WORD>
ubt zone <WORD> vrf <WORD>A zone names the gateway cluster: primary and backup controller addresses, reached in a VRF, and enable. show ubt says whether it is up.
In every release here, 10.15 to 10.18.
ubt zone CAMPUS vrf defaultprimary-controller ip 192.0.2.50backup-controller ip 192.0.2.51enableshow ubtEach zone's controllers, VLAN, admin and operational state. brief is one line per zone; users all lists who is tunnelled.
In every release here, 10.15 to 10.18.
show ubtshow ubt briefshow ubt users allport-access lldp-group <WORD>Ordered match and ignore rules; the first rule a neighbour hits decides. sysname is exact, sys-desc matches if the description contains the word (proved on the lab switch), vendor-oui plus type matches a TLV. Rules without seq number themselves 10, 20, 30.
In every release here, 10.15 to 10.18.
port-access lldp-group APSmatch sys-desc AP-515port-access lldp-group LLDP-MED-ENDPOINTSseq 10 match vendor-oui 0012bb type 1port-access lldp-group COREmatch sysname core1Goes withport-access device-profile <WORD>
port-access device-profile <WORD>Ties an LLDP group to a role, then enable. Works on a port with no port-access at all; on a port-access port it applies when 802.1X and MAC auth do not get the device in. The client shows as dp.
In every release here, 10.15 to 10.18.
port-access device-profile APSassociate lldp-group APSassociate role AP-TRUNKenableGoes withshow port-access device-profile
show port-access device-profileThe profiles and their state. interface all lists each matched neighbour with its profile, group, role and whether it applied.
In every release here, 10.15 to 10.18.
show port-access device-profileshow port-access device-profile interface allinterface vlan <1-4094>A switch virtual interface: the switch's own address in that VLAN, up only when a port in the VLAN is up.
In every release here, 10.15 to 10.18.
interface vlan 10ip address 192.0.2.1/24ip route <A.B.C.D/M> <A.B.C.D>Prefix and next hop. The default route is 0.0.0.0/0.
In every release here, 10.15 to 10.18.
ip route 0.0.0.0/0 203.0.113.1ip route 198.51.100.0/24 203.0.113.1router ospf <1-63>The process, its router-id and areas. Interfaces join with ip ospf <process> area <area>. Both ends of a link must agree on the area.
In every release here, 10.15 to 10.18.
router ospf 1router-id 203.0.113.2area 0.0.0.0exitinterface vlan 100ip ospf 1 area 0.0.0.0show ip routeConnected (C), local (L), static (S) and OSPF (O) routes with next hop and interface.
In every release here, 10.15 to 10.18.
show ip routeshow ip ospf neighborsping 198.51.100.10vsf member <1-8>Virtual Switching Framework: pre-provision a member by part number and name the ports that form its stack links. A member's links are its own ports, 2/1/x for member 2. Member 1 is the switch you are on. vsf secondary-member picks the standby; without it there is none.
Not in the Switch Simulator's command set for 10.15 to 10.18. Syntax from HPE's guides.
vsf member 2type jl725alink 1 2/1/27exitvsf secondary-member 2vsf member 1link 1 1/1/16Goes withshow vsf
show vsfEach member with its role (conductor, standby, member), status and part number. show vsf link lists the stack links and whether they are up.
Not in the Switch Simulator's command set for 10.15 to 10.18. Syntax from HPE's guides.
show vsfshow vsf linkdebug <portaccess|radius|lldp> <what>Writes port-access events to the debug buffer, the default destination. debug radius all and debug lldp event add those modules. show debug lists what is on; no debug all turns it off.
In every release here, 10.15 to 10.18.
debug portaccess alldebug lldp eventshow debug buffer module portaccessshow debug buffer module lldp | include 1/1/6Goes withshow debug buffer
show debug bufferEverything logged, oldest first. module portaccess, radius or lldp narrows it; a pipe narrows it further.
In every release here, 10.15 to 10.18.
show debug buffershow debug buffer module portaccess | include DEVICEPROFILEclear debug bufferdiag cable-diagnostic test <PORT>A TDR test on a copper port: per pair good, open or short, the cable length or the distance to the fault. It drops the link while it runs and asks first. show prints the result; clear forgets it.
In every release here, 10.15 to 10.18.
diag cable-diagnostic test 1/1/7diag cable-diagnostic show 1/1/7diag cable-diagnostic clear 1/1/7sim rest post /rest/v10.18/loginsim rest is a laptop calling the REST API: log in, then GET, POST, PATCH or DELETE under /rest/v10.18, and POST /rest/v10.18/cli for AnyCLI, which runs only the exact commands GET /rest/v10.18/cli/commands lists. Each answer names its CLI twin.
A sandbox command, not a switch command.
sim rest post /rest/v10.18/loginsim rest get /rest/v10.18/system/vlans?depth=2&attributes=id,namesim rest post /rest/v10.18/cli {"cmd":"show vlan"}sim connect <DEV>The sandbox talking, not the switch. sim connect and sim disconnect plug bench devices in and out, sim coa has the fake ClearPass send a change of authorization, sim release picks the AOS-CX release, sim status shows what is plugged in.
A sandbox command, not a switch command.
sim statussim connect phonesim release 10.16Nothing matches that. Try a shorter word.
