Digisol DG-FS4552 User Manual
  1. Manuals
  2. Brands
  3. Digisol Manuals
  4. Network Router
  5. DG-FS4552
  6. User manual

Digisol DG-FS4552 User Manual

Hide thumbs
1
2
3
4
5
6
Table Of Contents
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
Table of Contents

Advertisement

Quick Links

Download this manual
MUSTANG 4000 Managed Switch Series
DG-FS4528
DG-FS4552
L2/4 Fast Ethernet Switch

User Manual

V1.0.2
2012-01-03
As our product undergoes continuous development the specifications are subject to change without prior notice

Advertisement

Table of Contents
loading
Need help?

Need help?

Do you have a question about the DG-FS4552 and is the answer not in the manual?

Questions and answers

Subscribe to Our Youtube Channel

Related Manuals for Digisol DG-FS4552

Summary of Contents for Digisol DG-FS4552

  • Page 1: User Manual

    MUSTANG 4000 Managed Switch Series DG-FS4528 DG-FS4552 L2/4 Fast Ethernet Switch User Manual V1.0.2 2012-01-03 As our product undergoes continuous development the specifications are subject to change without prior notice...
  • Page 2 COPYRIGHT Copyright © 2010 by SNSL. All rights reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language or computer language, in any form or by any means, electronic, mechanical, magnetic, optical, chemical, manual or otherwise, without the prior written permission of SNSL.
  • Page 3 User Manual DG-FS4528/52 L2/4 Fast Ethernet Switch Layer 2 Standalone Switch with 24/48 10/100BASE-TX (RJ-45) Ports, and 4 Combination Gigabit (RJ-45/SFP) Ports...
  • Page 4 DG-FS4528 DG-FS4552 E102010-CS-R01 F1.3.4.0 149100000106A...

  • Page 5: About This Guide

    Also, as part of the switch’s software, there is an online web-based help that describes all management related features. Revision History This section summarizes the changes in each revision of this guide. January 2011Revision This is the second revision of this guide. This guide is valid for software release v1.3.4.0. www.digisol.com...
  • Page 6 About This Guide www.digisol.com...

  • Page 7: Table Of Contents

    3-13 Displaying System Information 3-13 Displaying Switch Hardware/Software Versions 3-15 Displaying Bridge Extension Capabilities 3-17 Setting the Switch’s IP Address 3-18 Manual Configuration 3-19 Using DHCP/BOOTP 3-20 Enabling Jumbo Frames 3-21 Managing Firmware 3-22 Automatic Operation Code Upgrade 3-22 www.digisol.com...
  • Page 8 Configuring AAA RADIUS Group Settings 3-77 Configuring AAA TACACS+ Group Settings 3-78 Configuring AAA Accounting 3-78 AAA Accounting Update 3-80 AAA Accounting 802.1X Port Settings 3-81 AAA Accounting Exec Command Privileges 3-82 AAA Accounting Exec Settings 3-83 AAA Accounting Summary 3-83 www.digisol.com viii...
  • Page 9 DG-FS4552 User Manual Authorization Settings 3-85 Authorization EXEC Settings 3-86 Authorization Summary 3-87 Configuring HTTPS 3-88 Replacing the Default Secure-site Certificate 3-89 Configuring the Secure Shell 3-90 Generating the Host Key Pair 3-93 Importing User Public Keys 3-95 Configuring the SSH Server 3-97 Configuring 802.1X Port Authentication...
  • Page 10 Configuring Interface Settings for MSTP 3-211 VLAN Configuration 3-212 IEEE 802.1Q VLANs 3-212 Enabling or Disabling GVRP (Global Setting) 3-215 Displaying Basic VLAN Information 3-216 Displaying Current VLANs 3-217 Creating VLANs 3-218 Adding Static Members to VLANs (VLAN Index) 3-220 www.digisol.com...
  • Page 11 DG-FS4552 User Manual Adding Static Members to VLANs (Port Index) 3-222 Configuring VLAN Behavior for Interfaces 3-223 Configuring IEEE 802.1Q Tunneling 3-225 Enabling QinQ Tunneling on the Switch 3-229 Adding an Interface to a QinQ Tunnel 3-230 Traffic Segmentation 3-232...
  • Page 12 Displaying Information on Cluster Members 3-314 Cluster Candidate Information 3-315 UPnP 3-316 UPnP Configuration 3-317 Chapter 4: Command Line Interface Using the Command Line Interface Accessing the CLI Console Connection Telnet Connection Entering Commands Keywords and Arguments Minimum Abbreviation Command Completion www.digisol.com...
  • Page 13 DG-FS4552 User Manual Getting Help on Commands Showing Commands Partial Keyword Lookup Negating the Effect of Commands Using Command History Understanding Command Modes Exec Commands Configuration Commands Command Line Processing Command Groups 4-10 General Commands 4-11 enable 4-12 disable 4-12...
  • Page 14 4-60 clear log 4-60 show logging 4-61 show log 4-62 SMTP Alert Commands 4-63 logging sendmail host 4-63 logging sendmail level 4-64 logging sendmail source-email 4-64 logging sendmail destination-email 4-65 logging sendmail 4-65 show logging sendmail 4-65 www.digisol.com...
  • Page 15 DG-FS4552 User Manual Time Commands 4-67 sntp client 4-68 sntp server 4-69 sntp poll 4-69 show sntp 4-70 ntp client 4-70 ntp server 4-71 ntp authenticate 4-72 ntp authentication-key 4-73 show ntp 4-74 clock timezone-predefined 4-74 clock timezone 4-75 clock summer-time (date)
  • Page 16 4-120 tacacs-server key 4-121 tacacs-server retransmit 4-121 tacacs-server timeout 4-122 show tacacs-server 4-122 AAA Commands 4-123 aaa group server 4-123 server 4-124 aaa accounting dot1x 4-125 aaa accounting exec 4-126 aaa accounting commands 4-127 aaa accounting update 4-128 www.digisol.com...
  • Page 17 DG-FS4552 User Manual accounting dot1x 4-128 accounting exec 4-129 accounting commands 4-129 aaa authorization exec 4-130 authorization exec 4-131 show accounting 4-131 Web Server Commands 4-132 ip http port 4-132 ip http server 4-133 ip http secure-server 4-133 ip http secure-port...
  • Page 18 4-184 ip dhcp snooping database flash 4-184 clear ip dhcp snooping database flash 4-185 show ip dhcp snooping 4-185 show ip dhcp snooping binding 4-185 IP Source Guard Commands 4-186 ip source-guard 4-186 ip source-guard binding 4-188 www.digisol.com xviii...
  • Page 19 DG-FS4552 User Manual show ip source-guard 4-189 show ip source-guard binding 4-189 ARP Inspection Commands 4-190 ip arp inspection 4-190 ip arp inspection vlan 4-191 ip arp inspection filter 4-192 ip arp inspection validate 4-193 ip arp inspection log-buffer logs...
  • Page 20 4-246 show auto-traffic-control 4-246 show auto-traffic-control interface 4-247 Link Aggregation Commands 4-248 channel-group 4-249 lacp 4-250 lacp system-priority 4-251 lacp admin-key (Ethernet Interface) 4-252 lacp admin-key (Port Channel) 4-253 lacp port-priority 4-254 lacp active/passive 4-255 show lacp 4-255 www.digisol.com...
  • Page 21 DG-FS4552 User Manual Mirror Port Commands 4-260 port monitor 4-260 show port monitor 4-261 Rate Limit Commands 4-263 rate-limit 4-263 Address Table Commands 4-264 mac-address-table static 4-264 clear mac-address-table dynamic 4-265 show mac-address-table 4-266 mac-address-table aging-time 4-267 show mac-address-table aging-time...
  • Page 22 4-318 switchport private-vlan host-association 4-319 switchport private-vlan mapping 4-320 show vlan private-vlan 4-320 Configuring Protocol-based VLANs 4-321 protocol-vlan protocol-group (Configuring Groups) 4-322 protocol-vlan protocol-group (Configuring VLANs) 4-322 show protocol-vlan protocol-group 4-323 show protocol-vlan protocol-group-vid 4-324 www.digisol.com xxii...
  • Page 23 DG-FS4552 User Manual Configuring IP Subnet VLANs 4-324 subnet-vlan 4-325 show subnet-vlan 4-325 Configuring MAC Based VLANs 4-326 mac-vlan 4-326 show mac-vlan 4-327 Configuring Voice VLANs 4-328 voice vlan 4-328 voice vlan aging 4-329 voice vlan mac-address 4-330 switchport voice vlan...
  • Page 24 IGMP Query Commands (Layer 2) 4-379 ip igmp snooping querier 4-380 ip igmp snooping query-count 4-380 ip igmp snooping query-interval 4-381 ip igmp snooping query-max-response-time 4-381 ip igmp snooping router-port-expire-time 4-382 Static Multicast Routing Commands 4-383 ip igmp snooping vlan mrouter 4-383 www.digisol.com xxiv...
  • Page 25 DG-FS4552 User Manual show ip igmp snooping mrouter 4-384 IGMP Filtering and Throttling Commands 4-385 ip igmp filter (Global Configuration) 4-385 ip igmp profile 4-386 permit, deny 4-386 range 4-387 ip igmp filter (Interface Configuration) 4-387 ip igmp max-groups 4-388...
  • Page 26 Contents Appendix B: Troubleshooting Problems Accessing the Management Interface Using System Logs Glossary Index www.digisol.com xxvi...
  • Page 27 4-57 Table 4-15 Logging Levels 4-58 Table 4-16 show logging flash/ram - display description 4-61 Table 4-17 SMTP Alert Commands 4-63 Table 4-18 Time Commands 4-67 Table 4-19 Predefined Summer-Time Parameters 4-77 Table 4-20 Switch Cluster Commands 4-80 www.digisol.com xxvii...
  • Page 28 - display description 4-259 Table 4-63 Mirror Port Commands 4-260 Table 4-64 Rate Limit Commands 4-263 Table 4-65 Address Table Commands 4-264 Table 4-66 Spanning Tree Commands 4-268 Table 4-69 Default STA Path Costs 4-280 www.digisol.com xxviii...
  • Page 29 DG-FS4552 User Manual Table 4-70 VLAN Command Groups 4-293 Table 4-71 GVRP and Bridge Extension Commands 4-294 Table 4-72 Editing VLAN Groups 4-298 Table 4-73 Configuring VLAN Interfaces 4-300 Table 4-74 Show VLAN Commands 4-307 Table 4-75 IEEE 802.1Q Tunneling Commands...
  • Page 30 Tables www.digisol.com...
  • Page 31 Configuring SNMPv3 Groups 3-63 Figure 3-37 Configuring SNMPv3 Views 3-64 Figure 3-38 sFlow Global Configuration 3-67 Figure 3-39 sFlow Port Configuration 3-69 Figure 3-40 Access Levels 3-71 Figure 3-41 Authentication Settings 3-74 Figure 3-42 Encryption Key Settings 3-76 www.digisol.com xxxi...
  • Page 32 Configuring ARP Inspection 3-140 Figure 3-83 Displaying Statistics for ARP Inspection 3-142 Figure 3-84 DHCP Snooping Configuration 3-144 Figure 3-85 DHCP Snooping VLAN Configuration 3-145 Figure 3-86 DHCP Snooping Information Option Configuration 3-147 Figure 3-87 DHCP Snooping Port Configuration 3-148 www.digisol.com xxxii...
  • Page 33 DG-FS4552 User Manual Figure 3-88 DHCP Snooping Binding Information 3-149 Figure 3-89 IP Source Guard Port Configuration 3-151 Figure 3-90 Static IP Source Guard Binding Configuration 3-153 Figure 3-91 Dynamic IP Source Guard Binding Information 3-154 Figure 3-92 Displaying Port/Trunk Information...
  • Page 34 3-301 Figure 3-173 MVR Group Member Configuration 3-302 Figure 3-174 MVR Receiver VLAN Configuration 3-303 Figure 3-175 MVR Receiver Group Address Table 3-304 Figure 3-176 Static MVR Receiver Group Member Configuration 3-305 Figure 3-177 DNS General Configuration 3-307 www.digisol.com xxxiv...
  • Page 35 DG-FS4552 User Manual Figure 3-178 DNS Static Host Table 3-309 Figure 3-179 DNS Cache 3-310 Figure 3-180 Cluster Member Choice 3-311 Figure 3-181 Cluster Configuration 3-312 Figure 3-182 Cluster Member Configuration 3-313 Figure 3-183 Cluster Member Information 3-314 Figure 3-184...
  • Page 36 Figures www.digisol.com xxxvi...

  • Page 37: Chapter 1: Introduction

    Up to 8K MAC addresses in the forwarding table IEEE 802.1D Bridge Supports dynamic data switching and addresses learning Store-and-Forward Switching Supported to ensure wire-speed switching while eliminating bad frames Spanning Tree Algorithm Supports standard STP, Rapid Spanning Tree Protocol (RSTP), and Multiple Spanning Trees (MSTP) www.digisol.com...

  • Page 38: Description Of Software Features

    SSH for secure management access over a Telnet-equivalent connection, SNMP Version 3, IP address filtering for SNMP/web/Telnet management access. MAC address filtering and IP source guard also provide authenticated port access. While DHCP snooping is provided to prevent malicious attacks from insecure ports. www.digisol.com...
  • Page 39 DG-FS4552 User Manual Access Control Lists – ACLs provide packet filtering for IPv4 frames (based on address, protocol, Layer 4 protocol port number or TCP control code), IPv6 frames (based on address, next header type, or flow label), or any frames (based on MAC address or Ethernet type).
  • Page 40 • Eliminate broadcast storms which severely degrade performance in a flat network. • Simplify network management for node changes/moves by remotely configuring VLAN membership for any port, rather than having to manually change the network connection. • Provide data security by restricting all traffic to the originating VLAN. www.digisol.com...
  • Page 41 DG-FS4552 User Manual • Use private VLANs to restrict traffic to pass only between data ports and the uplink ports, thereby isolating adjacent ports within the same VLAN, and allowing you to limit the total number of VLANs that need to be configured.

  • Page 42: System Defaults

    Web Authentication Disabled MAC Authentication Disabled HTTPS Enabled Disabled Port Security Disabled IP Filtering Disabled DHCP Snooping Disabled IP Source Guard Disabled (all ports) Web Management HTTP Server Enabled HTTP Port Number HTTP Secure Server Enabled HTTP Secure Port Number www.digisol.com...
  • Page 43 DG-FS4552 User Manual Table 1-2 System Defaults (Continued) Function Parameter Default SNMP SNMP Agent Enabled Community Strings “public” (read only) “private” (read/write) Traps Authentication traps: enabled Link-up-down events: enabled SNMP V3 View: defaultview Group: public (read only); private (read/write) Port Configuration...
  • Page 44 Disabled System Log Status Enabled Messages Logged Levels 0-7 (all) Messages Logged to Flash Levels 0-3 SMTP Email Alerts Event Handler Enabled (but no server defined) SNTP Clock Synchronization Disabled Clock Synchronization Disabled Switch Clustering Status Enabled Commander Disabled www.digisol.com...

  • Page 45: Chapter 2: Initial Configuration

    • Enable GVRP automatic VLAN registration • Configure IGMP multicast filtering • Upload and download system firmware via FTP/TFTP • Upload and download switch configuration files via FTP/TFTP • Configure Spanning Tree parameters • Configure Class of Service (CoS) priority queuing www.digisol.com...

  • Page 46: Required Connections

    For a description of how to use the CLI, see “Using the Command Line Interface” on page 4-1. For a list of all the CLI commands and detailed information on using the CLI, refer to “Command Groups” on page 4-10. www.digisol.com...

  • Page 47: Remote Connections

    DG-FS4552 User Manual Remote Connections Prior to accessing the switch’s onboard agent via a network connection, you must first configure it with a valid IP address, subnet mask, and default gateway using a console connection, DHCP or BOOTP protocol. The IP address for this switch is obtained via DHCP by default. To manually configure this address or enable dynamic address assignment via DHCP or BOOTP, see “Setting an IP Address”...

  • Page 48: Setting Passwords

    Press <Enter>. Note: ‘0’ specifies a password in plain text, ‘7’ specifies a password in encrypted form. Username: admin Password: CLI session with the DG-FS4552 is opened. To end the CLI session, enter [Exit]. Console#configure Console(config)#username guest password 0 [password]...

  • Page 49: Dynamic Configuration

    DG-FS4552 User Manual Before you can assign an IP address to the switch, you must obtain the following information from your network administrator: • IP address for the switch • Default gateway for the network • Network mask for this network To assign an IP address to the switch, complete the following steps: From the Global Configuration mode prompt, type “interface vlan 1”...

  • Page 50: Enabling Snmp Management Access

    Community strings are used to control management access to SNMP version 1 and 2c stations, as well as to authorize SNMP stations to receive trap messages from the switch. You therefore need to assign community strings to specified users, and set the access level. www.digisol.com...

  • Page 51: Trap Receivers

    DG-FS4552 User Manual The default strings are: • public - with read-only access. Authorized management stations are only able to retrieve MIB objects. • private - with read/write access. Authorized management stations are able to both retrieve and modify MIB objects.

  • Page 52: Configuring Access For Snmp Version 3 Clients

    • Operation Code — System software that is executed after boot-up, also known as run-time code. This code runs the switch operations and provides the CLI and web management interfaces. See “Managing Firmware” on page 3-21 for more information. www.digisol.com...

  • Page 53: Saving Configuration Settings

    DG-FS4552 User Manual • Diagnostic Code — Software that is run during system boot-up, also known as POST (Power On Self-Test). Due to the size limit of the flash memory, the switch supports only two operation code files. However, you can have as many diagnostic code files and configuration files as available flash memory space allows.
  • Page 54 Initial Configuration Enter the name of the start-up file. Press <Enter>. Console#copy running-config startup-config 4-37 Startup configuration file name []: startup \Write to FLASH Programming. \Write to FLASH finish. Success. Console# 2-10 www.digisol.com...

  • Page 55: Chapter 3: Configuring The Switch

    (i.e., enable Admin Edge Port) to improve the switch’s response time to management commands issued through the web interface. See “Configuring Interface Settings for STA” on page 3-201. www.digisol.com...

  • Page 56: Navigating The Web Browser Interface

    The home page displays the Main Menu on the left side of the screen and System Information on the right side. The Main Menu links are used to navigate to other menus, and display configuration parameters and statistics. Figure 3-1 Home Page www.digisol.com...

  • Page 57: Configuration Options

    DG-FS4552 User Manual Configuration Options Configurable parameters have a dialog box or a drop-down list. Once a configuration change has been made on a page, be sure to click on the Apply button to confirm the new setting. The following table summarizes the web page configuration buttons.

  • Page 58: Main Menu

    3-39 Reset Restarts the switch 3-41 SNTP Simple Network Time Protocol 3-42 Current Time Manually sets the current time 3-43 Configuration Configures SNTP and NTP client settings, including broadcast 3-43 mode, authentication parameters or a specified list of servers www.digisol.com...
  • Page 59 DG-FS4552 User Manual Table 3-2 Main Menu (Continued) Menu Description Page Time Zone Sets the local time zone for the system clock 3-46 Summer Time Configures summer time settings 3-47 SNMP Simple Network Management Protocol 3-49 Configuration Configures community strings and related trap functions...
  • Page 60 Displays Network Access statistics sorted by various attributes 3-121 MAC Filter Configuration Filters Network Access authentication by MAC address 3-122 Access Control Lists 3-124 Configuration Configures packet filtering based on IP or MAC addresses 3-124 Port Binding Binds a port to the specified ACL 3-135 www.digisol.com...
  • Page 61 DG-FS4552 User Manual Table 3-2 Main Menu (Continued) Menu Description Page ARP Inspection Validates the MAC-to-IP address bindings in ARP packets 3-136 Configuration Enables inspection globally and per VLAN, specifies ACL filter 3-124 containing address bindings, configures validation of additional...
  • Page 62 Shows the current port members of each VLAN and whether or 3-217 not the port is tagged or untagged Static List Used to create or remove VLAN groups 3-218 Static Table Modifies the settings for an existing VLAN 3-220 www.digisol.com...
  • Page 63 DG-FS4552 User Manual Table 3-2 Main Menu (Continued) Menu Description Page Static Membership by Port Configures membership type for interfaces, including tagged, 3-222 untagged or forbidden Port Configuration Specifies default PVID and VLAN attributes 3-223 Trunk Configuration Specifies default trunk VID and VLAN attributes 3-223 802.1Q Tunnel...
  • Page 64 3-271 Service Policy Applies a policy map defined to an ingress port 3-274 VoIP Traffic Setting 3-275 Configuration VoIP Traffic Setting Configuration 3-275 Port Configuration Configures VoIP Traffic Settings for ports 3-276 OUI Configuration Defines OUI settings 3-278 3-10 www.digisol.com...
  • Page 65 DG-FS4552 User Manual Table 3-2 Main Menu (Continued) Menu Description Page IGMP Snooping 3-281 IGMP Configuration Enables multicast filtering; configures parameters for multicast 3-282 query IGMP Immediate Leave Configures immediate leave for multicast services no longer 3-284 required Multicast Router Port...
  • Page 66 Member Configuration Adds switch Members to the cluster 3-313 Member Information Displays cluster Member switch information 3-314 Candidate Information Displays network Candidate switch information 3-315 UPNP Universal Plug and Play 3-316 Configuration Enables UPNP and defines timeout values 3-317 3-12 www.digisol.com...

  • Page 67: Basic Configuration

    DG-FS4552 User Manual Basic Configuration This section describes the basic functions required to set up management access to the switch, display or upgrade operating software, or reset the system. Displaying System Information You can easily identify the system by displaying the device name, location and contact information.

  • Page 68: Figure 3-3 System Information

    Console(config)#snmp-server location WC 9 4-91 Console(config)#snmp-server contact Ted 4-90 Console(config)#exit Console#show system 4-33 System Description: DG-FS4552 System OID String: 1.3.6.1.4.1.36293.1.1.1.5 System Information System Up Time: 0 days, 0 hours, 38 minutes, and 44.16 seconds System Name : R&D 5 System Location...

  • Page 69: Displaying Switch Hardware/Software Versions

    DG-FS4552 User Manual Displaying Switch Hardware/Software Versions Use the Switch Information page to display hardware/firmware version numbers for the main board and management software, as well as the power status of the system. Field Attributes Main Board • Serial Number – The serial number of the switch.
  • Page 70 Hardware Version: Chip Device ID: Marvell 98DX106-B0, 88E6095[F] EPLD Version: 0.05 Number of Ports: Main Power Status: Redundant Power Status: Not present Agent (Master) Unit ID: Loader Version: 1.0.2.0 Boot ROM Version: 1.2.0.1 Operation Code Version: 1.3.4.0 Console# 3-16 www.digisol.com...

  • Page 71: Displaying Bridge Extension Capabilities

    DG-FS4552 User Manual Displaying Bridge Extension Capabilities The Bridge MIB includes extensions for managed devices that support Multicast Filtering, Traffic Classes, and Virtual LANs. You can access these extensions to display default settings for the key variables. Field Attributes • Extended Multicast Filtering Services – This switch does not support the filtering of individual multicast addresses based on GMRP (GARP Multicast Registration Protocol).

  • Page 72: Setting The Switch's Ip Address

    • Gateway IP Address – IP address of the gateway router between this device and • management stations that exist on other network segments. (Default: 0.0.0.0) • MAC Address – The physical layer address for this switch. • Restart DHCP – Requests a new IP address from the DHCP server. 3-18 www.digisol.com...

  • Page 73: Manual Configuration

    DG-FS4552 User Manual Manual Configuration Web – Click System, IP Configuration. Select the VLAN through which the management station is attached, set the IP Address Mode to “Static,” enter the IP address, subnet mask and gateway, then click Apply. Figure 3-6 Manual IP Configuration CLI –...

  • Page 74: Using Dhcp/Bootp

    Web – If the address assigned by DHCP is no longer functioning, you will not be able to renew the IP settings via the web interface. You can only restart DHCP service via the web interface if the current address is still available. 3-20 www.digisol.com...

  • Page 75: Enabling Jumbo Frames

    DG-FS4552 User Manual CLI – Enter the following command to restart DHCP service. Console#ip dhcp restart 4-408 Console# Enabling Jumbo Frames The switch provides more efficient throughput for large sequential data transfers by supporting jumbo frames up to 10 KB for the Gigabit Ethernet ports. Compared to standard Ethernet frames that run only up to 1.5 KB, using jumbo frames...

  • Page 76: Automatic Operation Code Upgrade

    0 to 255, separated by periods. • The path to the directory must also be defined. If the file is stored in the root directory for the FTP/TFTP service, then use the “/” to indicate this (e.g., ftp://192.168.0.1/). 3-22 www.digisol.com...
  • Page 77 DG-FS4552 User Manual • The file name must not be included in the upgrade file location URL. The file name of the code stored on the remote server must be DG-FS4552.bix (using upper case and lower case letters exactly as indicated here).
  • Page 78 Configuring the Switch slash (“/”). The DG-FS4552.bix filename must not be included since it is automatically appended by the switch. (Options: ftp, tftp) The following syntax must be observed: tftp://host[/filedir]/ tftp:// – Defines TFTP protocol for the server connection. host – Defines the IP address of the TFTP server. Valid IP addresses consist of four numbers, 0 to 255, separated by periods.

  • Page 79: Figure 3-9 Configuring Automatic Code Upgrade

    DG-FS4552 User Manual - ftp://192.168.0.1/ The user name and password are empty, so “anonymous” will be the user name and the password will be blank. The image file is in the FTP root directory. - ftp://switches:upgrade@192.168.0.1/ The user name is “switches” and the password is “upgrade”. The image file is in the FTP root.

  • Page 80: Downloading System Software From A Server

    If you download to a new destination file, go to the System/File/Set Start-Up menu, mark the operation code file used at startup, and click Apply. To start the new firmware, reboot the system via the System/Reset menu. Figure 3-11 Setting the Startup Code 3-26 www.digisol.com...

  • Page 81: Saving Or Restoring Configuration Settings

    DG-FS4552 User Manual To delete a file, select System, File, Delete. Select the file name from the given list by checking the tick box and click Apply. Note that t he file currently designated as the startup code cannot be deleted.
  • Page 82 • FTP (port 21) and TFTP (port 69) are both supported. • The server’s location must be specified as a valid IPv4 IP address. DNS hostnames are not recognized. Valid IP addresses consist of four numbers, 0 to 255, separated by periods. 3-28 www.digisol.com...

  • Page 83: Downloading Configuration Settings From A Server

    DG-FS4552 User Manual Downloading Configuration Settings from a Server You can download the configuration file under a new file name and then set it as the startup file, or you can specify the current startup configuration file as the destination file to directly replace it.

  • Page 84: Uploading And Downloading Files Using Http

    FTP/TFTP server is 127 characters or 31 characters for files on the switch. (Valid characters: A-Z, a-z, 0-9, “.”, “-”, “_”) • Destination File Name – Select an existing file on the switch to overwrite, or specify a new file name. 3-30 www.digisol.com...

  • Page 85: Console Port Settings

    DG-FS4552 User Manual Web – To upload files using HTTP: Click System, File Management, HTTP Upgrade. Select “opcode” or “config” as the file type and then use the Browse button to locate the file on the local web management station. Specify the name of a file on the switch to overwrite or specify a new file name, then click Apply.
  • Page 86 (Default: No password) • Login – Enables password checking at login. You can select authentication by a single global password as configured for the Password parameter, or by passwords set up for specific user-name accounts. (Default: Local) CLI only. 3-32 www.digisol.com...

  • Page 87: Figure 3-17 Console Port Settings

    DG-FS4552 User Manual Web – Click System, Line, Console. Specify the console port connection parameters as required, then click Apply. Figure 3-17 Console Port Settings CLI – Enter Line Configuration mode for the console, then specify the connection parameters as required. To display the current console port settings, use the show line command from the Normal Exec level.

  • Page 88: Telnet Settings

    (Default: No password) • Login – Enables password checking at login. You can select authentication by a single global password as configured for the Password parameter, or by passwords set up for specific user-name accounts. (Default: Local) CLI only. 3-34 www.digisol.com...

  • Page 89: Figure 3-18 Enabling Telnet

    DG-FS4552 User Manual Web – Click System, Line, Telnet. Specify the connection parameters for Telnet access, then click Apply. Figure 3-18 Enabling Telnet CLI – Enter Line Configuration mode for a virtual terminal, then specify the connection parameters as required. To display the current virtual terminal settings, use the show line command from the Normal Exec level.

  • Page 90: Configuring Event Logging

    For example, if level 7 is specified, all messages from level 0 to level 7 will be logged to RAM. (Range: 0-7, Default: 7) Note: The Flash Level must be equal to or less than the RAM Level. 3-36 www.digisol.com...

  • Page 91: Remote Log Configuration

    DG-FS4552 User Manual Web – Click System, Log, System Logs. Specify System Log Status, set the level of event messages to be logged to RAM and flash memory, then click Apply. Figure 3-19 System Logs CLI – Enable system logging and then specify the level of messages to be logged to RAM and flash memory.

  • Page 92: Figure 3-20 Remote Logs

    Enabled REMOTELOG facility type: local use 7 REMOTELOG level type: Warning conditions REMOTELOG server ip address: 192.168.1.15 REMOTELOG server ip address: 0.0.0.0 REMOTELOG server ip address: 0.0.0.0 REMOTELOG server ip address: 0.0.0.0 REMOTELOG server ip address: 0.0.0.0 Console# 3-38 www.digisol.com...

  • Page 93: Displaying Log Messages

    DG-FS4552 User Manual Displaying Log Messages The Logs page allows you to scroll through the logged system and event messages. The switch can store up to 2048 log entries in temporary random access memory (RAM; i.e., memory flushed on power reset) and up to 4096 entries in permanent flash memory.

  • Page 94: Figure 3-22 Enabling And Configuring Smtp

    List, type the new IP address in the SMTP Server field and click Add. To delete an IP address, click the entry in the Server IP List and click Remove. Specify up to five email addresses to receive the alert messages, and click Apply. Figure 3-22 Enabling and Configuring SMTP 3-40 www.digisol.com...

  • Page 95: Resetting The System

    DG-FS4552 User Manual CLI – Enter the IP address of at least one SMTP server, set the syslog severity level to trigger an email message, and specify the switch (source) and up to five recipient (destination) email addresses. Enable SMTP with the logging sendmail command to complete the configuration.

  • Page 96: Setting The System Clock

    When the SNTP client is enabled, the switch periodically sends a request for a time update to a configured time server. You can configure up to three time server IP addresses. The switch will attempt to poll each server in the configured sequence. 3-42 www.digisol.com...

  • Page 97: Setting The Time Manually

    DG-FS4552 User Manual Setting the Time Manually You can set the system time on the switch manually without using SNTP. Command Attributes • Hours – Sets the hour. (Range: 0-23; Default: 0) • Minutes – Sets the minute value. (Range: 0-59; Default: 0) •...

  • Page 98: Configuring Ntp

    NTP servers. (Default: Disabled) • NTP Server – Sets the IP address for an NTP server to be polled. The switch requests an update from all configured servers, then determines the most accurate time update from the responses received. 3-44 www.digisol.com...

  • Page 99: Figure 3-26 Ntp Client Configuration

    DG-FS4552 User Manual • Version – Specifies the NTP version supported by the server. (Range: 1-3; Default: 3) • Authenticate Key – Specifies the number of the key in the NTP Authentication Key List to use for authentication with the configured server. The authentication key must match the key configured on the NTP server.

  • Page 100: Setting The Time Zone

    - Name – Assigns a name to the time zone. (Range: 1-29 characters) - Hours (0-13) – The number of hours before/after UTC. The maximum value before UTC is 12. The maximum value after UTC is 13. - Minutes (0-59) – The number of minutes before/after UTC. 3-46 www.digisol.com...

  • Page 101: Configuring Summer Time

    DG-FS4552 User Manual Web – Select SNTP, Clock Time Zone. Set the offset for your time zone relative to the UTC using either a predefined or custom definition, and click Apply. Figure 3-27 Setting the System Clock CLI - This example shows how to set the time zone for the system clock using one of the predefined time zone configurations.
  • Page 102 • Offset – Summer-time offset from the regular time zone, in minutes. (Range: 0-99 minutes) • From – Start time for summer-time offset. • To – End time for summer-time offset. 3-48 www.digisol.com...

  • Page 103: Simple Network Management Protocol

    DG-FS4552 User Manual Web – Select SNTP, Summer Time. Select one of the configuration modes, configure the relevant attributes, enable summer time status, and click Apply. Figure 3-28 Summer Time CLI - This example configures summer time to take effect for a predefined zone.
  • Page 104 MD5 or SHA algorithms and data privacy using DES 56-bit encryption Note: The predefined default groups and view can be deleted from the system. You can then define customized groups and views for the SNMP clients that require access. 3-50 www.digisol.com...

  • Page 105: Enabling The Snmp Agent

    DG-FS4552 User Manual Enabling the SNMP Agent Enables SNMPv3 service for all management clients (i.e., versions 1, 2c, 3). Command Attributes SNMP Agent Status – Enables SNMP on the switch. Web – Click SNMP, Agent Status. Enable the SNMP Agent by marking the Enabled checkbox, and click Apply.

  • Page 106: Specifying Trap Managers And Trap Types

    However, note that informs consume more system resources because they must be kept in memory until a response is received. Informs also add to network traffic. You should consider these effects when deciding whether to issue notifications as traps or informs. 3-52 www.digisol.com...
  • Page 107 DG-FS4552 User Manual To send an inform to a SNMPv2c host, complete these steps: 1. Enable the SNMP agent (page 3-51). 2. Enable trap informs as described in the following pages. 3. Create a view with the required notification messages (page 3-64).

  • Page 108: Figure 3-31 Configuring Ip Trap Managers

    Console(config)#snmp-server host 192.168.1.19 private version 2c 4-92 Console(config)#snmp-server enable traps 4-94 These are legacy notifications and therefore when used for SNMP Version 3 hosts, they must be enabled in conjunction with the corresponding entries in the Notification View (page 3-64). 3-54 www.digisol.com...

  • Page 109: Configuring Snmpv3 Management Access

    DG-FS4552 User Manual Configuring SNMPv3 Management Access To configure SNMPv3 management access to the switch, follow these steps: 1. If you want to change the default engine ID, it must be changed first before configuring other parameters. 2. Specify read and write access views for the switch MIB tree.

  • Page 110: Specifying A Remote Engine Id

    Figure 3-33 Setting a Remote Engine ID CLI – This example specifies a remote SNMPv3 engine ID. Console(config)#snmp-server engine-id remote 54321 192.168.1.19 4-95 Console(config)#exit Console#show snmp engine-id 4-96 Local SNMP engineID: 8000002a8000000000e8666672 Local SNMP engineBoots: 1 Remote SNMP engineID IP address 80000000030004e2b316c54321 192.168.1.19 Console# 3-56 www.digisol.com...

  • Page 111: Configuring Snmpv3 Users

    DG-FS4552 User Manual Configuring SNMPv3 Users Each SNMPv3 user is defined by a unique name. Users must be configured with a specific security level and assigned to a group. The SNMPv3 group restricts users to a specific read, write, and notify view.

  • Page 112: Figure 3-34 Configuring Snmpv3 Users

    Console(config)#snmp-server user chris group r&d v3 auth md5 greenpeace priv des56 einstien 4-100 Console(config)#exit Console#show snmp user 4-101 EngineId: 80000034030001f488f5200000 User Name: chris Authentication Protocol: md5 Privacy Protocol: des56 Storage Type: nonvolatile Row Status: active Console# 3-58 www.digisol.com...

  • Page 113: Configuring Remote Snmpv3 Users

    DG-FS4552 User Manual Configuring Remote SNMPv3 Users Each SNMPv3 user is defined by a unique name. Users must be configured with a specific security level and assigned to a group. The SNMPv3 group restricts users to a specific read, write, and notify view.

  • Page 114: Figure 3-35 Configuring Remote Snmpv3 Users

    192.168.1.19 v3 auth md5 greenpeace priv des56 einstien 4-100 Console(config)#exit Console#show snmp user 4-101 No user exist SNMP remote user EngineId: 80000000030004e2b316c54321 User Name: mark Authentication Protocol: none Privacy Protocol: none Storage Type: nonvolatile Row Status: active Console# 3-60 www.digisol.com...

  • Page 115: Configuring Snmpv3 Groups

    DG-FS4552 User Manual Configuring SNMPv3 Groups An SNMPv3 group sets the access policy for its assigned users, restricting them to specific read, write, and notify views. You can use the pre-defined default groups or create new groups to map a set of SNMP users to SNMP views.
  • Page 116 1.3.6.1.4.1.36293.1.1.1.5.2.1.0.4 This trap is sent when an incorrect IP address is rejected by the IP Filter. * These are legacy notifications and therefore must be enabled in conjunction with the corresponding traps on the SNMP Configuration menu. 3-62 www.digisol.com...

  • Page 117: Figure 3-36 Configuring Snmpv3 Groups

    DG-FS4552 User Manual Web – Click SNMP, SNMPv3, Groups. Click New to configure a new group. In the New Group page, define a name, assign a security model and level, and then select read, write, and notify views. Click Add to save the new group and return to the Groups list.

  • Page 118: Setting Snmpv3 Views

    Views list. For a specific view, click on View OID Subtrees to display the current configuration, or click on Edit OID Subtrees to make changes to the view settings. To delete a view, check the box next to the view name, then click Delete. Figure 3-37 Configuring SNMPv3 Views 3-64 www.digisol.com...

  • Page 119: Sampling Traffic Flows

    DG-FS4552 User Manual CLI – Use the snmp-server view command to configure a new view. This example view includes the MIB-2 interfaces table, and the wildcard mask selects all index entries. Console(config)#snmp-server view ifEntry.a 1.3.6.1.2.1.2.2.1.1.* included 4-96 Console(config)#exit Console#show snmp view 4-97 View Name: ifEntry.a...

  • Page 120: Configuring Sflow Global Parameters

    Table 3-5 sFlow Groups and Port Members Port Members Group DG-FS4552 1, 2, 3, 4, 5, 6, 7, 8 9, 10, 11, 12, 13, 14, 15, 16 17, 18, 19, 20, 21, 22, 23, 24 25, 26, 27, 28, 29, 30, 31, 32...

  • Page 121: Figure 3-38 Sflow Global Configuration

    DG-FS4552 User Manual Web – Click sFlow, Configuration. Set the global status for flow sampling, the ports or port groups to be sampled, the sampling rate, and then click Apply. Figure 3-38 sFlow Global Configuration CLI – This example enables sFlow globally, and then enables sampling and sets the sampling rate for Port 1 (which effectively configures the same sFlow settings for all port members in Group 1).

  • Page 122: Configuring Sflow Port Parameters

    • Flow Interval – The interval at which the sFlow process adds counter values to the sample datagram. An interval of 0 seconds effectively disables this feature. (Range: 0-10000000 seconds; Default: 0 seconds) Sampling must be disabled by setting the time out to 0 before these fields can be configured. 3-68 www.digisol.com...

  • Page 123: Figure 3-39 Sflow Port Configuration

    DG-FS4552 User Manual Web – Click sFlow, Port Configuration. Set the parameters for flow Collector, the reset timeout, the payload, and flow interval. Then click Apply. Figure 3-39 sFlow Port Configuration CLI – This example enables sFlow globally, and then enables sampling and sets the sampling rate for Port 1 (which effectively configures the same sFlow settings for all port members in Group 1).

  • Page 124: User Authentication

    - Password – Specifies the user password. (Range: 0-8 characters plain text, case sensitive) • Change Password – Sets a new password for the specified user name. For other methods of controlling client access, see “General Security Measures” on page 3-109. 3-70 www.digisol.com...

  • Page 125: Figure 3-40 Access Levels

    DG-FS4552 User Manual • Add/Remove – Adds or removes an account from the list. Web – Click Security, User Accounts. To configure a new user account, specify a user name, select the user’s access level, then enter a password and confirm it.

  • Page 126: Configuring Local/Remote Logon Authentication

    (3) Local, the user name and password on the RADIUS server is verified first. If the RADIUS server is not available, then authentication is attempted using the TACACS+ server, and finally the local user name and password is checked. 3-72 www.digisol.com...
  • Page 127 DG-FS4552 User Manual Command Attributes • Authentication – Select the authentication, or authentication sequence required: - Local – User authentication is performed only locally by the switch. - Radius – User authentication is performed using a RADIUS server only. - TACACS – User authentication is performed using a TACACS+ server only.

  • Page 128: Figure 3-41 Authentication Settings

    Console#show radius-server 4-119 Global Settings: Authentication Port: Accounting Port: 1813 Retransmit Times: Request Timeout: Server 1: Server IP Address: 192.168.1.25 Authentication Port: Accounting Port: 1813 Retransmit Times: Request Timeout: Radius server group: Group Name Member Index --------------------- ------------- radius 3-74 www.digisol.com...

  • Page 129: Configuring Encryption Keys

    DG-FS4552 User Manual Console#configure Console(config)#authentication login tacacs 4-113 Console(config)#tacacs-server 1 host 10.20.30.40 4-120 Console(config)#tacacs-server port 200 4-120 Console(config)#tacacs-server retransmit 5 4-121 Console(config)#tacacs-server timeout 10 4-122 Console(config)#tacacs-server key green 4-121 Console#show tacacs-server 4-122 Remote TACACS+ server configuration: Global Settings: Server Port Number:...

  • Page 130: Aaa Authorization And Accounting

    If at any point a pass or fail is returned, the process stops. The switch supports the following AAA features: • Accounting for IEEE 802.1X authenticated users that access the network through the switch. 3-76 www.digisol.com...

  • Page 131: Configuring Aaa Radius Group Settings

    DG-FS4552 User Manual • Accounting for users that access management interfaces on the switch through the console and Telnet. • Accounting for commands that users enter at specific CLI privilege levels. • Authorization of users that access management interfaces on the switch through the console and Telnet.

  • Page 132: Configuring Aaa Tacacs+ Group Settings

    AAA accounting is a feature that enables the accounting of requested services for billing or security purposes. Command Attributes • Method Name – Specifies an accounting method for service requests. The “default” methods are used for a requested service if no other methods have been defined. (Range: 1-255 characters) 3-78 www.digisol.com...

  • Page 133: Figure 3-45 Aaa Accounting Settings

    DG-FS4552 User Manual The method name is only used to describe the accounting method(s) configured on the specified accounting servers, and do not actually send any information to the servers about the methods to use. • Service Request – Specifies the service as either 802.1X (user accounting) or Exec (administrative accounting for local console, Telnet, or SSH connections).

  • Page 134: Aaa Accounting Update

    Web – Click Security, AAA, Accounting, Periodic Update. Enter the required update interval and click Apply. Figure 3-46 AAA Accounting Update CLI – This example sets the periodic accounting update interval at 10 minutes. Console(config)#aaa accounting update periodic 10 4-128 Console(config)# 3-80 www.digisol.com...

  • Page 135: Aaa Accounting 802.1X Port Settings

    DG-FS4552 User Manual AAA Accounting 802.1X Port Settings This feature applies the specified accounting method to an interface. Command Attributes • Port/Trunk - Specifies a port or trunk number. • Method Name - Specifies a user defined method name to apply to the interface.

  • Page 136: Aaa Accounting Exec Command Privileges

    Telnet privilege levels. Click Apply. Figure 3-48 AAA Accounting Exec Command Privileges CLI – Specify the accounting method to use for console and Telnet privilege levels. Console(config)#line console 4-45 Console(config-line)#accounting commands 15 tps-method 4-129 Console(config-line)#exit Console(config)#line vty Console(config-line)#accounting commands 15 tps-method Console(config-line)# 3-82 www.digisol.com...

  • Page 137: Aaa Accounting Exec Settings

    DG-FS4552 User Manual AAA Accounting Exec Settings This feature specifies a method name to apply to console and Telnet connections. Command Attributes Method Name - Specifies a user defined method name to apply to console and Telnet connections. Web – Click Security, AAA, Accounting, Exec Settings. Enter a defined method name for console and Telnet connections, and click Apply.

  • Page 138: Figure 3-50 Aaa Accounting Summary

    Configuring the Switch Web – Click Security, AAA, Summary. Figure 3-50 AAA Accounting Summary 3-84 www.digisol.com...

  • Page 139: Authorization Settings

    DG-FS4552 User Manual CLI – Use the following command to display the currently applied accounting methods, and registered users. Console#show accounting 4-131 Accounting Type : dot1x Method List : default Group List : radius Interface Method List : tps-method Group List...

  • Page 140: Authorization Exec Settings

    Method Name - Specifies a user-defined method name to apply to console and Telnet connections. Web – Click Security, AAA, Authorization, Exec Settings. Enter a defined method name for console and Telnet connections, and click Apply. Figure 3-52 AAA Authorization Exec Settings 3-86 www.digisol.com...

  • Page 141: Authorization Summary

    DG-FS4552 User Manual CLI – Specify the authorization method to use for Console and Telnet interfaces. Console(config)#line console 4-45 Console(config-line)#authorization exec tps-auth 4-131 Console(config-line)#exit Console(config)#line vty Console(config-line)#authorization exec tps-auth Console(config-line)# Authorization Summary The Authorization Summary displays the configured authorization methods and the interfaces to which they are applied.

  • Page 142: Configuring Https

    • Change HTTPS Port Number – Specifies the UDP port number used for HTTPS connection to the switch’s web interface. (Default: Port 443) Copy HTTPS Certificate For more information on this function, see “Replacing the Default Secure-site Certificate” on page 3-89. 3-88 www.digisol.com...

  • Page 143: Replacing The Default Secure-Site Certificate

    DG-FS4552 User Manual Web – Click Security, HTTPS Settings. Enable HTTPS and specify the port number, then click Apply. Figure 3-54 HTTPS Settings CLI – This example enables the HTTP secure server and modifies the port number. Console(config)#ip http secure-server...

  • Page 144: Configuring The Secure Shell

    SSH also encrypts all data transfers passing between the switch and SSH-enabled management station clients, and ensures that data traveling over the network arrives unaltered. 3-90 www.digisol.com...
  • Page 145 DG-FS4552 User Manual Notes: 1. You need to install an SSH client on the management station to access the switch for management via the SSH protocol. The switch supports both SSH Version 1.5 and 2.0 clients. Command Usage The SSH server on this switch supports both password and public key authentication.
  • Page 146 If both checks succeed, the client is authenticated. Note: The SSH server supports up to four client sessions. The maximum number of client sessions includes both current Telnet sessions and SSH sessions. 3-92 www.digisol.com...

  • Page 147: Generating The Host Key Pair

    DG-FS4552 User Manual Generating the Host Key Pair A host public/private key pair is used to provide secure communications between an SSH client and the switch. After generating this key pair, you must provide the host public key to SSH clients and import the client’s public key to the switch as described in the section “Importing User Public Keys”...

  • Page 148: Figure 3-56 Ssh Host-Key Settings

    Console#ip ssh crypto host-key generate 4-138 Console#ip ssh save host-key 4-138 Console#show public-key host 4-138 Host: RSA: 1024 65537 127250922544926402131336514546131189679055192360076028653006761 82409690947448320102524878965977592168322225584652387791546479807396314033 86925793105105765212243052807865885485789272602937866089236841423275912127 60325919683697053439336438445223335188287173896894511729290510813919642025 190932104328579045764891 DSA: ssh-dss AAAAB3NzaC1kc3MAAACBAN6zwIqCqDb3869jYVXlME1sHL0EcE/Re6hlasfEthIwmj hLY4O0jqJZpcEQUgCfYlum0Y2uoLka+Py9ieGWQ8f2gobUZKIICuKg6vjO9XTs7XKc05xfzkBi KviDa+2OrIz6UK+6vFOgvUDFedlnixYTVo+h5v8r0ea2rpnO6DkZAAAAFQCNZn/x17dwpW8RrV DQnSWw4Qk+6QAAAIEAptkGeB6B5hwagH4gUOCY6i1TmrmSiJgfwO9OqRPUMbCAkCC+uzxatOo7 drnIZypMx+Sx5RUdMGgKS+9ywsa1cWqHeFY5ilc3lDCNBueeLykZzVS+RS+azTKIk/zrJh8GLG Nq375R55yRxFvmcGIn/Q7IphPqyJ3o9MK8LFDfmJEAAACAL8A6tESiswP2OFqX7VGoEbzVDSOI RTMFy3iUXtvGyQAOVSy67Mfc3lMtgqPRUOYXDiwIBp5NXgilCg5z7VqbmRm28mWc5a//f8TUAg PNWKV6W0hqmshQdotVzDR1e+XKNTZj0uTwWfjO5Kytdn4MdoTHgrbl/DMdAfjnte8MZZs= Console# 3-94 www.digisol.com...

  • Page 149: Importing User Public Keys

    DG-FS4552 User Manual Importing User Public Keys A user’s Public Key must be uploaded to the switch in order for the user to be able to log in using the public key authentication mechanism. If the user’s public key does not exist on the switch, SSH will revert to the interactive password authentication mechanism to complete authentication.

  • Page 150: Figure 3-57 Ssh User Public-Key Settings

    Web – Click Security, SSH, SSH User Public-Key Settings. Select the user name and the public-key type from the respective drop-down boxes, input the TFTP server IP address and the public key source file name, and then click Copy Public Key. Figure 3-57 SSH User Public-Key Settings 3-96 www.digisol.com...

  • Page 151: Configuring The Ssh Server

    DG-FS4552 User Manual CLI – This example imports an SSHv2 DSA public key for the user admin and then displays admin’s imported public keys. 4-37 Console#copy tftp public-key TFTP server IP address: 192.168.1.254 Choose public key type: 1. RSA: 2. DSA: <1-2>: 2 Source file name: admin-ssh2-dsa-pub.key...

  • Page 152: Figure 3-58 Ssh Server Settings

    Console#show ip ssh 4-142 SSH Enabled - version 2.0 Negotiation timeout: 120 secs; Authentication retries: 5 Server key size: 512 bits Console#show ssh 4-143 Connection Version State Username Encryption Session-Started admin ctos aes128-cbc-hmac-md5 stoc aes128-cbc-hmac-md5 Console#disconnect 0 4-55 Console# 3-98 www.digisol.com...

  • Page 153: Configuring 802.1X Port Authentication

    DG-FS4552 User Manual Configuring 802.1X Port Authentication Network switches can provide open and easy access to network resources by simply attaching a client PC. Although this automatic configuration and access is a desirable feature, it also allows unauthorized personnel to easily intrude and possibly gain access to sensitive network data.

  • Page 154: Displaying 802.1X Global Settings

    4-152 Global 802.1X Parameters system-auth-control: enable 802.1X Port Summary Port Name Status Operation Mode Mode Authorized disabled Single-Host ForceAuthorized disabled Single-Host ForceAuthorized 802.1X Port Details 802.1X is disabled on port 1/1 802.1X is disabled on port 1/28 Console# 3-100 www.digisol.com...

  • Page 155: Configuring 802.1X Global Settings

    DG-FS4552 User Manual Configuring 802.1X Global Settings The 802.1X protocol provides port authentication. The 802.1X protocol must be enabled globally for the switch system before port settings are active. Command Attributes 802.1X System Authentication Control – Sets the global setting for 802.1X.
  • Page 156 - No – Connected client is not authorized. - Blank – Displays nothing when dot1x is disabled on a port. • Supplicant – Indicates the MAC address of a connected client. • Trunk – Indicates if the port is configured as a trunk port. 3-102 www.digisol.com...

  • Page 157: Figure 3-61 802.1X Port Configuration

    DG-FS4552 User Manual Web – Click Security, 802.1X, Port Configuration. Modify the parameters required, and click Apply. Figure 3-61 802.1X Port Configuration www.digisol.com 3-103...
  • Page 158 Max count Port-control Auto Supplicant 00-24-8C-0f-fa-dc Current Identifier Intrusion action Guest VLAN Authenticator State Machine State Authenticated Reauth Count Backend State Machine State Idle Request Count Identifier(Server) Reauthentication State Machine State Initialize 802.1X is disabled on port 1/52 Console# 3-104 www.digisol.com...

  • Page 159: Displaying 802.1X Statistics

    DG-FS4552 User Manual Displaying 802.1X Statistics This switch can display statistics for dot1x protocol exchanges for any port. Table 3-6 802.1X Statistics Parameter Description Rx EAPOL Start The number of EAPOL Start frames that have been received by this Authenticator.

  • Page 160: Figure 3-62 Displaying 802.1X Port Statistics

    CLI – This example displays the 802.1X statistics for port 4. Console#show dot1x statistics interface ethernet 1/4 4-152 Eth 1/4 Rx: EAPOL EAPOL EAPOL EAPOL Start Logoff Invalid Total Resp/Id Resp/Oth LenError 1007 Last Last EAPOLVer EAPOLSrc 00-24-8C-0f-34-DE Tx: EAPOL Total Req/Id Req/Oth 2017 1005 Console# 3-106 www.digisol.com...

  • Page 161: Filtering Ip Addresses For Management Access

    DG-FS4552 User Manual Filtering IP Addresses for Management Access You can create a list of up to 16 IP addresses or IP address groups that are allowed management access to the switch through the web interface, SNMP, or Telnet. Command Usage •...

  • Page 162: Figure 3-63 Creating An Ip Filter List

    Console(config)#management snmp-client 10.1.2.3 4-155 Console(config)#end Console#show management all-client Management IP Filter HTTP-Client: Start IP address End IP address ----------------------------------------------- SNMP-Client: Start IP address End IP address ----------------------------------------------- 1. 10.1.2.3 10.1.2.3 TELNET-Client: Start IP address End IP address ----------------------------------------------- Console# 3-108 www.digisol.com...

  • Page 163: General Security Measures

    DG-FS4552 User Manual General Security Measures This switch supports many methods of segregating traffic for clients attached to each of the data ports, and for ensuring that only authorized clients gain access to the network. Private VLANs and port-based authentication using IEEE 802.1X are commonly used for these purposes.

  • Page 164: Configuring Port Security

    • Max MAC Count – The maximum number of MAC addresses that can be learned on a port. (Range: 0 - 1024, where 0 means disabled) • Trunk – Trunk number if port is a member (page 3-161 and 3-162). 3-110 www.digisol.com...

  • Page 165: Web Authentication

    DG-FS4552 User Manual Web – Click Security, Port Security. Set the action to take when an invalid address is detected on a port, mark the checkbox in the Status column to enable security for a port, set the maximum number of MAC addresses allowed on a port, and click Apply.

  • Page 166: Configuring Web Authentication

    Console(config)#web-auth system-auth-control 4-175 Console(config)#web-auth session-timeout 1800 4-174 Console(config)#web-auth quiet-period 20 4-174 Console(config)#web-auth login-attempts 2 4-173 Console(config)#end Console#show web-auth 4-177 Global Web-Auth Parameters System Auth Control : Enabled Session Timeout : 1800 Quiet Period : 20 Max Login Attempts Console# 3-112 www.digisol.com...

  • Page 167: Configuring Web Authentication For Ports

    DG-FS4552 User Manual Configuring Web Authentication for Ports Web authentication is configured on a per-port basis. The following parameters are associated with each port. Command Attributes • Port – Indicates the port being configured • Status – Configures the web authentication status for the port.

  • Page 168: Displaying Web Authentication Port Information

    • Interface – Indicates the Ethernet port to query. • Host IP – Indicates the IP address of the host selected for re-authentication. • Re-authenticate – Ends all web authentication sessions connected to the port and forces the users to re-authenticate. 3-114 www.digisol.com...

  • Page 169: Network Access (Mac Address Authentication)

    DG-FS4552 User Manual Web – Click Security, Web Authentication, Re-authentication. Figure 3-68 Web Authentication Port Re-authentication CLI – This example forces the re-authentication of all hosts connected to port 1/5. Console#web-auth re-authenticate interface ethernet 1/5 4-176 Failed to reauth. Console#...

  • Page 170: Table 3-7 Dynamic Qos Profiles

    • When authentication is successful, the dynamic QoS information may not be passed from the RADIUS server due to one of the following conditions (authentication result remains unchanged): - The Filter-ID attribute cannot be found to carry the user profile. 3-116 www.digisol.com...

  • Page 171: Configuring The Mac Authentication Reauthentication Time

    DG-FS4552 User Manual - The Filter-ID attribute is empty. - The Filter-ID attribute format for dynamic QoS assignment is unrecognizable (can not recognize the whole Filter-ID attribute). • Dynamic QoS assignment fails and the authentication result changes from success to failure when the following conditions occur: - Illegal characters found in a profile value (for example, a non-digital character in an 802.1p profile value).

  • Page 172: Configuring Mac Authentication For Ports

    Authentication or 802.1X Authentication fails. (Default: Disabled; Range: 1 to 4092) The VLAN must already be created and active (see “Creating VLANs” on page 3-218). Also, when used with 802.1X authentication, intrusion action must be set for “Guest VLAN” (see “Configuring Port Settings for 802.1X” on page 3-101). 3-118 www.digisol.com...

  • Page 173: Figure 3-70 Network Access Port Configuration

    DG-FS4552 User Manual • Dynamic VLAN – Enables dynamic VLAN assignment for an authenticated port. When enabled, any VLAN identifiers returned by the RADIUS server are applied to the port, providing the VLANs have already been created on the switch. (GVRP is not used to create the VLANs.) (Default: Enabled)

  • Page 174: Configuring Port Link Detection

    - Trap – An SNMP trap is sent. - Trap and Shutdown – An SNMP trap is sent and the port is shut down. - Shutdown – The port is shut down. • Trunk – Indicates if the port is a trunk member. 3-120 www.digisol.com...

  • Page 175: Displaying Secure Mac Address Information

    DG-FS4552 User Manual Web – Click Security, Network Access, Port Link Detection Configuration. Modify the Status, Condition and Action. Click Apply. Figure 3-71 Network Access Port Link Detection Configuration CLI – This example configures Port Link Detection to send an SNMP trap for all link events on port 1.

  • Page 176: Mac Filter Configuration

    Command Usage • Specified MAC addresses are exempt from authentication. • Up to 64 filter tables can be defined. • There is no limitation on the number of entries used in a filter table. 3-122 www.digisol.com...

  • Page 177: Figure 3-73 Network Access Mac Filter Configuration

    DG-FS4552 User Manual Command Attributes • Filter ID (1-64) - top - ALL – Displays all configured MAC filter tables. - Filter ID – Displays all entries associated with the specified MAC Filter ID. - Query – Displays all entries in the specified table(s).

  • Page 178: Access Control Lists

    For a detailed description of this feature, refer to the access-list rule-mode command (page 4-199). The default setting only permits extended rules, storing any standard rules entered through the web or command line interface in extended rule format. 3-124 www.digisol.com...

  • Page 179: Setting The Acl Name And Type

    DG-FS4552 User Manual Setting the ACL Name and Type Use the ACL Configuration page to designate the name and type of an ACL. Command Attributes • Name – Name of the ACL. (Maximum length: 15 characters) • Type – The following filter modes are supported: - IP Standard: IPv4 ACL mode filters packets based on the source IPv4 address.

  • Page 180: Configuring A Standard Ipv4 Acl

    Figure 3-75 ACL Configuration - Standard IPv4 CLI – This example configures one permit rule for the specific address 10.1.1.21 and another rule for the address range 168.92.16.x – 168.92.31.x using a bitmask. Console(config-std-acl)#permit host 10.1.1.21 4-201 Console(config-std-acl)#permit 168.92.16.0 255.255.240.0 Console(config-std-acl)# 3-126 www.digisol.com...

  • Page 181: Configuring An Extended Ipv4 Acl

    DG-FS4552 User Manual Configuring an Extended IPv4 ACL Command Attributes • Action – An ACL can contain any combination of permit or deny rules. • Source/Destination Address Type – Specifies the source or destination IP address. Use “Any” to include all possible addresses, “Host” to specify a specific host address in the Address field, or “IP”...

  • Page 182: Figure 3-76 Acl Configuration - Extended Ipv4

    (3) Permit all TCP packets from class C addresses 192.168.1.0 with the TCP control code set to “SYN.” Console(config-ext-acl)#permit 10.7.1.1 255.255.255.0 any 4-202 Console(config-ext-acl)#permit tcp 192.168.1.0 255.255.255.0 any destination-port 80 Console(config-ext-acl)#permit tcp 192.168.1.0 255.255.255.0 any control-flag 2 2 Console(config-std-acl)# 3-128 www.digisol.com...

  • Page 183: Configuring A Standard Ipv6 Acl

    DG-FS4552 User Manual Configuring a Standard IPv6 ACL Command Attributes • Action – An ACL can contain any combination of permit or deny rules. • Source Address Type – Specifies the source IP address. Use “Any” to include all possible addresses, “Host” to specify a specific host address in the Address field, or “IPv6-prefix”...

  • Page 184: Configuring An Extended Ipv6 Acl

    Web – Specify the action (i.e., Permit or Deny). Select the address type (Any or IPv6-prefix). If you select “IPv6-prefix,” enter a subnet address and prefix length. Set any other required criteria. Then click Add. Figure 3-78 ACL Configuration - Extended IPv6 3-130 www.digisol.com...

  • Page 185: Configuring A Mac Acl

    DG-FS4552 User Manual CLI – This example adds three rules: (1) Accepts any incoming packets for the destination 2009:DB9:2229::79/8. (2) Allows packets to any destination address when the DSCP value is 5. Console(config-ext-ipv6-acl)#permit 2009:DB9:2229::79/8 4-208 Console(config-ext-ipv6-acl)#permit any dscp 5 Console(config-ext-ipv6-acl)#...

  • Page 186: Figure 3-79 Acl Configuration - Mac

    CLI – This example configures one permit rule for all source mac addresses to communicate with all destination mac addresses on VLAN 12, and another permit rule for source mac address to communicate with all destination mac addresses. Console(config-mac-acl)#permit any any vid 12 4095 4-215 Console(config-mac-acl)#permit host 00-11-22-33-44-55 any Console(config-mac-acl)# 3-132 www.digisol.com...

  • Page 187: Configuring An Arp Acl

    DG-FS4552 User Manual Configuring an ARP ACL Use this page to configure ACLs based on ARP message addresses. ARP Inspection can then use these ACLs to filter suspicious traffic (see “Configuring ARP Inspection” on page 3-136). Command Attributes • Action – An ACL can contain any combination of permit or deny rules.

  • Page 188: Figure 3-80 Acl Configuration - Arp

    Add. Figure 3-80 ACL Configuration - ARP CLI – This rule permits packets from any source IP and MAC address to the destination subnet address 192.168.0.0. Console(config-arp-acl)#permit response ip any 192.168.0.0 255.255.0.0 mac 4-212 any any Console(config-arp-acl)# 3-134 www.digisol.com...

  • Page 189: Binding A Port To An Access Control List

    DG-FS4552 User Manual Binding a Port to an Access Control List After configuring the Access Control Lists (ACL), you can bind the ports that need to filter traffic to the appropriate ACLs. You can assign one IP/IPv6 access list and one MAC access list to any port.

  • Page 190: Arp Inspection

    - When ARP Inspection is enabled globally, all ARP request and reply packets on inspection-enabled VLANs are redirected to the CPU and their switching behavior handled by the ARP Inspection engine. - If ARP Inspection is disabled globally, then it becomes inactive for all VLANs, including those where inspection is enabled. 3-136 www.digisol.com...
  • Page 191 DG-FS4552 User Manual - When ARP Inspection is disabled, all ARP request and reply packets will bypass the ARP Inspection engine and their switching behavior will match that of all other packets. - Disabling and then re-enabling global ARP Inspection will not affect the ARP Inspection configuration of any VLANs.
  • Page 192 ARP Inspection and bypasses validation against the DHCP Snooping Bindings database. When an ARP ACL is selected, but static mode is not selected, the switch first performs ARP Inspection and then validation against the DHCP Snooping Bindings database. (Default: Disabled) 3-138 www.digisol.com...
  • Page 193 DG-FS4552 User Manual • ARP Inspection Validation – Enables extended ARP Inspection Validation if any of the following options are enabled. (Default: Disabled) - Dst-MAC – Validates the destination MAC address in the Ethernet header against the target MAC address in the body of ARP responses.

  • Page 194: Figure 3-82 Configuring Arp Inspection

    Log Message Number : 10 Need Additional Validation(s) : Yes Additional Validation Type : Destination MAC address Console#show ip arp inspection interface ethernet 1/1 4-196 Port Number Trust Status Limit Rate (pps) ------------- -------------------- ------------------------------ Eth 1/1 untrusted Console# 3-140 www.digisol.com...

  • Page 195: Displaying Arp Inspection Port Information

    DG-FS4552 User Manual Displaying ARP Inspection Port Information Use the ARP Inspection Port Information page to display a list of trusted ports and statistics about the number of ARP packets processed, or dropped for various reasons. Command Attributes • Trusted Port List – Displays all ports configured as trusted.

  • Page 196: Figure 3-83 Displaying Statistics For Arp Inspection

    ARP packets dropped by additional validation (source MAC address) ARP packets dropped by additional validation (destination MAC address): 0 ARP packets dropped by additional validation (IP address) ARP packets dropped by ARP ACLs ARP packets dropped by DHCP snooping Console# 3-142 www.digisol.com...

  • Page 197: Dhcp Snooping

    DG-FS4552 User Manual DHCP Snooping The addresses assigned to DHCP clients on insecure ports can be carefully controlled using the dynamic bindings registered with DHCP Snooping (or using the static bindings configured with IP Source Guard). DHCP snooping allows a switch to protect a network from rogue DHCP servers or other devices which send port-related information to a DHCP server.

  • Page 198: Dhcp Snooping Configuration

    Web – Click DHCP Snooping, Configuration. Select the required options and click Apply. Figure 3-84 DHCP Snooping Configuration CLI – This example first enables DHCP Snooping, and then enables DHCP Snooping MAC-Address Verification. Console(config)#ip dhcp snooping 4-179 Console(config)#ip dhcp snooping verify mac-address 4-182 Console(config)# 3-144 www.digisol.com...

  • Page 199: Dhcp Snooping Vlan Configuration

    DG-FS4552 User Manual DHCP Snooping VLAN Configuration Use the DHCP Snooping VLAN Configuration page to enable or disable DHCP snooping on specific VLANs. Command Usage • When DHCP snooping is enabled globally on the switch, and enabled on the specified VLAN, DHCP packet filtering will be performed on any untrusted ports within the VLAN.

  • Page 200: Dhcp Snooping Information Option Configuration

    - Replace – Replaces the Option 82 information in the client’s request with information about the relay agent itself, inserts the relay agent’s address (when DHCP snooping is enabled), and forwards the packets to trusted ports. (This is the default policy.) 3-146 www.digisol.com...

  • Page 201: Configuring Ports For Dhcp Snooping

    DG-FS4552 User Manual Web – Click DHCP Snooping, Information Option Configuration. Figure 3-86 DHCP Snooping Information Option Configuration CLI – This example enables DHCP Snooping Information Option, and sets the policy as replace Console(config)#ip dhcp snooping information option 4-183 Console(config)#ip dhcp snooping information policy replace...

  • Page 202: Figure 3-87 Dhcp Snooping Port Configuration

    Global DHCP Snooping status: disable DHCP Snooping Information Option Status: disable DHCP Snooping Information Policy: replace DHCP Snooping is configured on the following VLANs: Verify Source Mac-Address: enable Interface Trusted ---------- ---------- Eth 1/1 Eth 1/2 Eth 1/3 Eth 1/4 Eth 1/5 3-148 www.digisol.com...

  • Page 203: Displaying Dhcp Snooping Binding Information

    DG-FS4552 User Manual Displaying DHCP Snooping Binding Information Binding table entries can be displayed on the Binding Information page. Command Attributes • Store DHCP snooping binding entries to flash. – Writes all dynamically learned snooping entries to flash memory. This function can be used to store the currently learned dynamic DHCP snooping entries to flash memory.

  • Page 204: Ip Source Guard

    - If IP source guard if enabled on an interface for which IP source bindings have not yet been configured (neither by static configuration in the IP source guard binding table nor dynamically learned from DHCP snooping), the switch will drop all IP traffic on that port, except for DHCP packets. 3-150 www.digisol.com...

  • Page 205: Figure 3-89 Ip Source Guard Port Configuration

    DG-FS4552 User Manual Command Attributes • Filter Type – Configures the switch to filter inbound traffic based source IP address, or source IP address and corresponding MAC address. (Default: None) • None – Disables IP source guard filtering on the port.

  • Page 206: Configuring Static Binding For Ip Source Guard

    • Port – The port to which a static entry is bound. (Range: 1-52) • VLAN ID – ID of a configured VLAN (Range: 1-4094) • MAC Address – A valid unicast MAC address. • IP Address – A valid unicast IP address, including classful types A, B or C. 3-152 www.digisol.com...

  • Page 207: Figure 3-90 Static Ip Source Guard Binding Configuration

    DG-FS4552 User Manual Web – Click IP Source Guard, Static Configuration. Select the VLAN and port to which the entry will be bound, enter the MAC address and associated IP address, then click Add. Figure 3-90 Static IP Source Guard Binding Configuration CLI –...

  • Page 208: Displaying Information For Dynamic Ip Source Guard Bindings

    CLI – This example shows how to configure a static source-guard binding on port 5 4-189 Console#show ip source-guard binding MacAddress IpAddress Lease(sec) Type VLAN Interface ----------------- --------------- ---------- -------------------- ---- -------- 11-22-33-44-55-66 192.168.0.99 0 Static 1 Eth 1/5 Console# 3-154 www.digisol.com...

  • Page 209: Port Configuration

    DG-FS4552 User Manual Port Configuration Displaying Connection Status You can use the Port Information or Trunk Information pages to display the current connection status, including link state, speed/duplex mode, flow control, and auto-negotiation. Field Attributes (Web) • Name – Interface label.
  • Page 210 • Media Type – Shows the forced or preferred port type to use for combination ports 49-52. (Display options: copper forced, SFP forced, SFP preferred auto) • Giga PHY Mode – Shows the master/slave configuration mode used by negotiate a 1000BASE-T full duplex connection for a link pair. 3-156 www.digisol.com...

  • Page 211: Configuring Interface Connections

    DG-FS4552 User Manual Current Status: • Link Status – Indicates if the link is up or down. • Port Operation Status – Provides detailed information on port state. (Displayed only when the link is up.) • Operation Speed-duplex – Shows the current speed and duplex mode.
  • Page 212 - FC - Flow control can eliminate frame loss by “blocking” traffic from end stations or segments connected directly to the switch when its buffers fill. When enabled, back pressure is used for half-duplex operation and IEEE 802.3-2005 (formally IEEE 802.3x) for full-duplex operation. 3-158 www.digisol.com...

  • Page 213: Figure 3-93 Port/Trunk Configuration

    DG-FS4552 User Manual Avoid using flow control on a port connected to a hub unless it is actually required to solve a problem. Otherwise back pressure jamming signals may degrade overall performance for the segment attached to the hub. (Default: Autonegotiation enabled; Advertised capabilities for 100BASE-TX –...

  • Page 214: Creating Trunk Groups

    • All the ports in a trunk have to be treated as a whole when moved from/to, added or deleted from a VLAN. • STP, VLAN, and IGMP settings can only be made for the entire trunk. 3-160 www.digisol.com...

  • Page 215: Statically Configuring A Trunk

    DG-FS4552 User Manual Statically Configuring a Trunk Command Usage • When configuring static trunks, you may not be statically able to link switches of different types, configured depending on the manufacturer’s implementation. However, note that the static trunks on this switch are Cisco EtherChannel compatible.

  • Page 216: Enabling Lacp On Selected Ports

    LACP enabled, the additional ports will be placed in standby mode, and will only be enabled if one of the active links fails. • All ports on both ends of an LACP trunk must be configured for full duplex, and auto-negotiation. 3-162 www.digisol.com...

  • Page 217: Figure 3-95 Lacp Trunk Configuration

    DG-FS4552 User Manual • Trunks dynamically established through LACP will also be shown in the Member List on the Trunk Membership menu (see page 3-161). Command Attributes • Member List (Current) – Shows configured trunks (Port). • New – Includes entry fields for creating new trunks.

  • Page 218: Configuring Parameters For Lacp Group Members

    This identifier is used to indicate a specific LAG during LACP negotiations with other systems. • Admin Key – The LACP administration key must be set to the same value for ports that belong to the same LAG. (Range: 0-65535; Default: 1) 3-164 www.digisol.com...

  • Page 219: Figure 3-96 Lacp Port Configuration

    DG-FS4552 User Manual • Port Priority – If a link goes down, LACP port priority is used to select a backup link. (Range: 0-65535; Default: 32768) Set Port Partner – This menu sets the remote side of an aggregate link; i.e., the ports on the attached device.

  • Page 220: Configuring Parameters For Lacp Groups

    0), this key is set to the same value as the port admin key used by the interfaces that joined the group. Note that when the LAG is no longer used, the port channel admin key is reset to 0. 3-166 www.digisol.com...

  • Page 221: Displaying Lacp Port Counters

    DG-FS4552 User Manual Web – Click Port, LACP, Aggregator. Set the Admin Key for the required LACP group, and click Apply. Figure 3-97 LACP Aggregation Group Configuration CLI – The following example sets the LACP admin key for port channel 1.

  • Page 222: Displaying Lacp Settings And Status For The Local Side

    Current administrative value of the key for the aggregation port. LACPDUs Interval Number of seconds before invalidating received LACPDU information. LACP System Priority LACP system priority assigned to this port channel. LACP Port Priority LACP port priority assigned to this interface within the channel group. 3-168 www.digisol.com...

  • Page 223: Figure 3-99 Lacp - Port Internal Information

    DG-FS4552 User Manual Table 3-9 LACP Internal Configuration Information (Continued) Field Description Admin State, Administrative or operational values of the actor’s state parameters: Oper State • Expired – The actor’s receive machine is in the expired state; • Defaulted – The actor’s receive machine is using defaulted operational partner information, administratively configured for the partner.

  • Page 224: Displaying Lacp Settings And Status For The Remote Side

    Current administrative value of the Key for the protocol partner. Oper Key Current operational value of the Key for the protocol partner. Admin State Administrative values of the partner’s state parameters. (See preceding table.) Oper State Operational values of the partner’s state parameters. (See preceding table.) 3-170 www.digisol.com...

  • Page 225: Figure 3-100 Lacp - Port Neighbors Information

    DG-FS4552 User Manual Web – Click Port, LACP, Port Neighbors Information. Select a port channel to display the corresponding information. Figure 3-100 LACP - Port Neighbors Information CLI – The following example displays the LACP configuration settings and operational state for the remote side of port channel 1.

  • Page 226: Setting Broadcast Storm Thresholds

    • Threshold – Threshold level as a rate; i.e., kilobits per second. (Range: 64-100000 kilobits per second for Fast Ethernet ports; 64-1000000 kilobits per second for Gigabit ports; Default: 64 kilobits per second) • Trunk – Shows if a port is a trunk member. 3-172 www.digisol.com...

  • Page 227: Figure 3-101 Port Broadcast Control

    DG-FS4552 User Manual Web – Click Port, Port/Trunk Broadcast Control. Set the threshold, mark the Enabled field for the desired interface and click Apply. Figure 3-101 Port Broadcast Control CLI – Specify any interface, and then enter the threshold. The following disables broadcast storm control for port 1, and then sets broadcast suppression at 500 kilobits per second for port 2.

  • Page 228: Setting Multicast Storm Thresholds

    • Threshold – Threshold as percentage of port bandwidth. (Range: 64-100000 kilobits per second for Fast Ethernet ports; 64-1000000 kilobits per second for Gigabit ports; Default: 64 kilobits per second) • Trunk – Shows if port is a trunk member. 3-174 www.digisol.com...

  • Page 229: Setting Unknown Unicast Storm Thresholds

    DG-FS4552 User Manual Web – Click Configuration, Port, Port Multicast Control or Trunk Multicast Control. Check the Enabled box for any interface, set the threshold, and click Apply. Figure 3-102 Port Multicast Control CLI – Specify any interface, and then enter the threshold. The following example sets the multicast threshold at 600 packets per second for port 1.

  • Page 230: Figure 3-103 Port Unknown Unicast Control

    Figure 3-103 Port Unknown Unicast Control CLI – Specify any interface, and then enter the threshold. The following example sets the unknown unicast threshold at 900 packets per second for port 1. 4-220 Console(config)#interface ethernet 1/1 4-227 Console(config-if)#switchport unknown-unicast packet-rate 900 Console(config-if)# 3-176 www.digisol.com...

  • Page 231: Configuring Port Mirroring

    DG-FS4552 User Manual Configuring Port Mirroring You can mirror traffic from any source port to a target port for real-time analysis. You can then attach a logic analyzer or RMON probe to the target port and study the traffic crossing the...

  • Page 232: Configuring Mac Address Mirroring

    CLI – Use the interface command to select the monitor port, then use the port monitor command to specify the source MAC address to be mirrored. Console(config)#interface ethernet 1/1 4-220 Console(config-if)#port monitor mac-address 11-22-33-44-55-66 4-260 Console(config-if)#port monitor mac-address 11-22-33-44-55-77 4-260 Console(config-if)# 3-178 www.digisol.com...

  • Page 233: Configuring Rate Limits

    DG-FS4552 User Manual Configuring Rate Limits This function allows the network manager to control the maximum rate for traffic received or transmitted on an interface. Rate limiting is configured on interfaces at the edge of a network to limit traffic into or out of the network. Packets that exceed the acceptable amount of traffic are dropped.

  • Page 234: Showing Port Statistics

    Transmit Broadcast Packets The total number of packets that higher-level protocols requested be transmitted, and which were addressed to a broadcast address at this sub-layer, including those that were discarded or not sent. 3-180 www.digisol.com...
  • Page 235 DG-FS4552 User Manual Table 3-11 Port Statistics (Continued) Parameter Description Transmit Discarded Packets The number of outbound packets which were chosen to be discarded even though no errors had been detected to prevent their being transmitted. One possible reason for discarding such a packet could be to free up buffer space.
  • Page 236 The total number of frames (including bad packets) received and transmitted where the number of octets fall within the specified range 128-255 Byte Frames (excluding framing bits but including FCS octets). 256-511 Byte Frames 512-1023 Byte Frames 1024-1518 Byte Frames 1519-1536 Byte Frames 3-182 www.digisol.com...

  • Page 237: Figure 3-107 Port Statistics

    DG-FS4552 User Manual Web – Click Port, Port Statistics. Select the required interface, and click Query. You can also use the Refresh button at the bottom of the page to update the screen. Figure 3-107 Port Statistics www.digisol.com 3-183...
  • Page 238 Packet size <= 64 octets: 25568, Packet size 65 to 127 octets: 1616 Packet size 128 to 255 octets: 1249, Packet size 256 to 511 octets: 1449 Packet size 512 to 1023 octets: 802, Packet size 1024 to 1518 octets: 871 Console# 3-184 www.digisol.com...

  • Page 239: Address Table Settings

    DG-FS4552 User Manual Address Table Settings Switches store the addresses for all known devices. This information is used to pass traffic directly between the inbound and outbound ports. All the addresses learned by monitoring traffic are stored in the dynamic address table. You can also manually configure static addresses that are bound to a specific port.

  • Page 240: Displaying The Address Table

    Web – Click Address Table, Dynamic Addresses. Specify the search type (i.e., mark the Interface, MAC Address, or VLAN checkbox), select the method of sorting the displayed addresses, and then click Query. Figure 3-109 Configuring a Dynamic Address Table 3-186 www.digisol.com...

  • Page 241: Changing The Aging Time

    DG-FS4552 User Manual CLI – This example also displays the address table entries for port 1. Console#show mac-address-table interface ethernet 1/1 4-266 Interface MAC Address VLAN Type --------- ----------------- ---- ----------------- Eth 1/ 1 00-11-22-33-44-55 1 Delete-on-reset Eth 1/ 1 00-55-44-33-22-11...

  • Page 242: Spanning Tree Algorithm Configuration

    3-188 www.digisol.com...
  • Page 243 DG-FS4552 User Manual MSTP – When using STP or RSTP, it may be difficult to maintain a stable path between all VLAN members. Frequent changes in the tree structure can easily isolate some of the group members. MSTP (which is based on RSTP for fast convergence) is designed to support independent spanning trees based on VLAN groups.

  • Page 244: Configuring Port And Trunk Loopback Detection

    (Default: Auto) • Release – Allows a port to be manually released from discard mode. This is only available if the port is configured for manual release mode. • Trunk – Indicates if this port is a trunk member. 3-190 www.digisol.com...

  • Page 245: Displaying Global Settings For Sta

    DG-FS4552 User Manual Web – Click Spanning Tree, Port Loopback Detection or Trunk Loopback Detection. Modify the required attributes, then click Apply. Figure 3-111 Configuring Port Loopback Detection CLI – This command enables loopback detection for port 1/5, configures automatic release-mode, and enables SNMP trap notification for detected loopback BPDUs.
  • Page 246 In addition, each port needs time to listen for conflicting information that would make it return to a discarding state; otherwise, temporary data loops might result. • Max Hops – The max number of hop counts for the MST region. 3-192 www.digisol.com...

  • Page 247: Figure 3-112 Displaying Spanning Tree Information

    DG-FS4552 User Manual • Remaining Hops – The remaining number of hop counts for the MST instance. • Transmission Limit – The minimum interval between the transmission of consecutive RSTP/MSTP BPDUs. • Path Cost Method – The path cost is used to determine the best path between devices.

  • Page 248: Configuring Global Settings For Sta

    RSTP set to STP forced compatibility mode). - RSTP: Rapid Spanning Tree (IEEE 802.1w); RSTP is the default. - MSTP: Multiple Spanning Tree (IEEE 802.1s); 10. STP and RSTP BPDUs are transmitted as untagged frames, and will cross any VLAN boundaries. 3-194 www.digisol.com...
  • Page 249 DG-FS4552 User Manual • Priority – Bridge priority is used in selecting the root device, root port, and designated port. The device with the highest priority becomes the STA root device. However, if all devices have the same priority, the device with the lowest MAC address will then become the root device.
  • Page 250 • Maximum Hop Count – The maximum number of hops allowed in the MST region before a BPDU is discarded. (Range: 1-40; Default: 20) 11. The MST name and revision number are both required to uniquely identify an MST region. 3-196 www.digisol.com...

  • Page 251: Figure 3-113 Configuring Spanning Tree

    DG-FS4552 User Manual Web – Click Spanning Tree, STA, Configuration. Modify the required attributes, and click Apply. Figure 3-113 Configuring Spanning Tree www.digisol.com 3-197...

  • Page 252: Displaying Interface Settings For Sta

    Spanning Tree configuration. The slower the media, the higher the cost. • Designated Bridge – The bridge priority and MAC address of the device through which this port must communicate to reach the root of the Spanning Tree. 3-198 www.digisol.com...
  • Page 253 DG-FS4552 User Manual • Designated Port – The port priority and number of the port on the designated bridging device through which this switch must communicate with the root of the Spanning Tree. • Oper Path Cost – The contribution of this port to the path cost of paths towards the spanning tree root which include this port.

  • Page 254: Figure 3-114 Displaying Spanning Tree Port Information

    - Auto – The switch automatically determines if the interface is attached to a point-to-point link or to shared media. Web – Click Spanning Tree, STA, Port Information or STA Trunk Information. Figure 3-114 Displaying Spanning Tree Port Information 3-200 www.digisol.com...

  • Page 255: Configuring Interface Settings For Sta

    DG-FS4552 User Manual CLI – This example shows the STA attributes for port 5. Console#show spanning-tree ethernet 1/5 4-291 1/ 5 information -------------------------------------------------------------- Admin Status: Enabled Role: Disabled State: Discarding Admin Path Cost: Oper Path Cost: 100000 Priority: Designated Cost:...

  • Page 256: Table 3-12 Recommended Sta Path Cost Range

    Table 3-13 Recommended STA Path Costs Port Type Link Type IEEE 802.1D-1998 IEEE 802.1w-2001 Ethernet Half Duplex 2,000,000 Full Duplex 1,999,999 Trunk 1,000,000 12. Refer to “Configuring Global Settings for STA” on page 3-194 for information on setting the path cost method. 3-202 www.digisol.com...

  • Page 257: Table 3-14 Default Sta Path Costs

    DG-FS4552 User Manual Table 3-13 Recommended STA Path Costs Port Type Link Type IEEE 802.1D-1998 IEEE 802.1w-2001 Fast Ethernet Half Duplex 200,000 Full Duplex 100,000 Trunk 50,000 Gigabit Ethernet Full Duplex 10,000 Trunk 5,000 Table 3-14 Default STA Path Costs...

  • Page 258: Spanning Tree Edge Port Configuration

    - Auto – The port will be automatically configured as an edge port if the edge delay time expires without receiving any RSTP or MSTP BPDUs. Note that edge delay time (802.1D-2004 17.20.4) equals the protocol migration time if a port's 3-204 www.digisol.com...

  • Page 259: Figure 3-116 Configuring Edge Port Parameters

    DG-FS4552 User Manual link type is point-to-point; otherwise it equals the spanning-tree’s maximum age (see “Configuring Global Settings for STA” on page 3-194). An interface cannot function as an edge port under the following conditions: - If spanning tree mode is set to STP (page 3-194), edge-port mode can be manually enabled or set to auto, but will have no effect.

  • Page 260: Configuring Multiple Spanning Trees

    • VLAN ID – VLAN to assign to this selected MST instance. (Range: 1-4094) The other global attributes are described under “Displaying Global Settings for STA,” page 3-191. The attributes displayed by the CLI for individual interfaces are described under “Displaying Interface Settings for STA,” page 3-198 3-206 www.digisol.com...

  • Page 261: Figure 3-117 Configuring Multiple Spanning Trees

    DG-FS4552 User Manual Web – Click Spanning Tree, MSTP, VLAN Configuration. Select an instance identifier from the list, set the instance priority, and click Apply. To add the VLAN members to an MSTI instance, enter the instance identifier, the VLAN identifier, and click Add.
  • Page 262 Auto Oper Link Type: Point-to-point Flooding Behavior: Enabled Spanning Tree Status: Enabled Loopback Detection Status: Enabled Loopback Detection Release Mode:Auto Loopback Detection Trap: Disabled Admin Root Guard: Disabled Oper Root Guard: Disabled BPDU Guard: Disabled BPDU Filtering: Disabled 3-208 www.digisol.com...

  • Page 263: Displaying Interface Settings For Mstp

    DG-FS4552 User Manual Displaying Interface Settings for MSTP The MSTP Port Information and MSTP Trunk Information pages display the current status of ports and trunks in the selected MST instance. Command Attributes MST Instance ID – Instance identifier to configure. (Range: 0-4094; Default: 0) Note: The other attributes are described under “Displaying Interface Settings for STA”...
  • Page 264 Auto Oper Link Type: Point-to-point Flooding Behavior: Enabled Spanning Tree Status: Enabled Loopback Detection Status: Enabled Loopback Detection Release Mode:Auto Loopback Detection Trap: Disabled Admin Root Guard: Disabled Oper Root Guard: Disabled BPDU Guard: Disabled BPDU Filtering: Disabled 3-210 www.digisol.com...

  • Page 265: Configuring Interface Settings For Mstp

    DG-FS4552 User Manual Configuring Interface Settings for MSTP You can configure the STA interface settings for an MST Instance using the MSTP Port Configuration and MSTP Trunk Configuration pages. Field Attributes The following attributes are read-only and cannot be changed: •...

  • Page 266: Vlan Configuration

    IP addresses or IP subnets. VLANs inherently provide a high level of network security since traffic must pass through a configured Layer 3 link to reach a different VLAN. 3-212 www.digisol.com...

  • Page 267: Assigning Ports To Vlans

    DG-FS4552 User Manual This switch supports the following VLAN features: • Up to 255 VLANs based on the IEEE 802.1Q standard • Distributed VLAN learning across multiple switches using explicit or implicit tagging and GVRP protocol • Port overlapping, allowing a port to participate in multiple VLANs •...
  • Page 268 VLANs for the switch ports connected to these devices (as described in “Adding Static Members to VLANs (VLAN Index)” on page 3-220). But you can still enable GVRP on these edge switches, as well as on the core switches in the network. Port-based VLAN 10 11 15 16 3-214 www.digisol.com...

  • Page 269: Enabling Or Disabling Gvrp (Global Setting)

    DG-FS4552 User Manual Forwarding Tagged/Untagged Frames If you want to create a small port-based VLAN for devices attached directly to a single switch, you can assign ports to the same untagged VLAN. However, to participate in a VLAN group that crosses several switches, you should create a VLAN for that group and enable tagging on all ports.

  • Page 270: Displaying Basic Vlan Information

    Max Support VLAN Numbers: Max Support VLAN ID: 4094 Extended Multicast Filtering Services: No Static Entry Individual Port: VLAN Learning: Configurable PVID Tagging: Local VLAN Capable: Traffic Classes: Enabled Global GVRP Status: Disabled GMRP: Disabled Console# 13. Web Only. 3-216 www.digisol.com...

  • Page 271: Displaying Current Vlans

    DG-FS4552 User Manual Displaying Current VLANs The VLAN Current Table shows the current port members of each VLAN and whether or not the port supports VLAN tagging. Ports assigned to a large VLAN group that crosses several switches should use VLAN tagging. However, if you just want to create a small port-based VLAN for one or two switches, you can disable tagging.

  • Page 272: Creating Vlans

    • Add – Adds a new VLAN group to the current list. • Remove – Removes a VLAN group from the current list. If any port is assigned to this group as untagged, it will be reassigned to VLAN group 1 as untagged. 3-218 www.digisol.com...

  • Page 273: Figure 3-123 Configuring A Vlan Static List

    DG-FS4552 User Manual Web – Click VLAN, 802.1Q VLAN, Static List. To create a new VLAN, enter the VLAN ID and VLAN name, mark the Enable checkbox to activate the VLAN, and then click Add. Figure 3-123 Configuring a VLAN Static List CLI –...

  • Page 274: Adding Static Members To Vlans (Vlan Index)

    VLAN will not be transmitted by the interface. - Trunk Member – Indicates if a port is a member of a trunk. To add a trunk to the selected VLAN, use the last table on the VLAN Static Table page. 3-220 www.digisol.com...

  • Page 275: Figure 3-124 Configuring A Vlan Static Table

    DG-FS4552 User Manual Web – Click VLAN, 802.1Q VLAN, Static Table. Select a VLAN ID from the scroll-down list. Modify the VLAN name and status if required. Select the membership type by marking the appropriate radio button in the list of ports or trunks.

  • Page 276: Adding Static Members To Vlans (Port Index)

    CLI – This example adds Port 3 to VLAN 1 as a tagged port, and removes Port 3 from VLAN 2. Console(config)#interface ethernet 1/3 4-220 Console(config-if)#switchport allowed vlan add 1 tagged 4-304 Console(config-if)#switchport allowed vlan remove 2 Console(config-if)# 3-222 www.digisol.com...

  • Page 277: Configuring Vlan Behavior For Interfaces

    DG-FS4552 User Manual Configuring VLAN Behavior for Interfaces You can configure VLAN behavior for specific interfaces, including the default VLAN identifier (PVID), accepted frame types, ingress filtering, GVRP status, and GARP timers. Command Usage • GVRP – GARP VLAN Registration Protocol defines a way for switches to exchange VLAN information in order to automatically register VLAN members on interfaces across the network.

  • Page 278: Figure 3-126 Configuring Vlans Per Port

    VLAN, use the last table on the VLAN Static Table page. Web – Click VLAN, 802.1Q VLAN, Port Configuration or Trunk Configuration. Fill in the required settings for each interface, click Apply. Figure 3-126 Configuring VLANs per Port 3-224 www.digisol.com...

  • Page 279: Configuring Ieee 802.1Q Tunneling

    DG-FS4552 User Manual CLI – This example sets port 3 to accept only tagged frames, assigns PVID 3 as the native VLAN ID, enables GVRP, sets the GARP timers, and then sets the switchport mode to hybrid. Console(config)#interface ethernet 1/3...
  • Page 280 3. After packet classification through the switching process, the packet is written to memory with one tag (an outer tag) or with two tags (both an outer tag and inner tag). 4. The switch sends the packet to the proper egress port. 3-226 www.digisol.com...
  • Page 281 DG-FS4552 User Manual 5. If the egress port is an untagged member of the SPVLAN, the outer tag will be stripped. If it is a tagged member, the outgoing packets will have two tags. Layer 2 Flow for Packets Coming into a Tunnel Uplink Port An uplink port receives one of the following packets: •...
  • Page 282 7. Configure the QinQ tunnel uplink port to 802.1Q Tunnel Uplink mode (see “Adding an Interface to a QinQ Tunnel” on page 3-230). 8. Configure the QinQ tunnel uplink port to join the SPVLAN as a tagged member (see “Adding Static Members to VLANs (VLAN Index)” on page 3-220). 3-228 www.digisol.com...

  • Page 283: Enabling Qinq Tunneling On The Switch

    DG-FS4552 User Manual Enabling QinQ Tunneling on the Switch The switch can be configured to operate in normal VLAN mode or IEEE 802.1Q (QinQ) tunneling mode which is used for passing Layer 2 traffic across a service provider’s metropolitan area network. You can also globally set the Tag Protocol Identifier (TPID) value of the tunnel port if the attached client is using a nonstandard 2-byte ethertype to identify 802.1Q tagged frames.

  • Page 284: Adding An Interface To A Qinq Tunnel

    • 802.1Q Tunnel Uplink – Configures IEEE 802.1Q tunneling (QinQ) for an uplink port to another device within the service provider network. • Trunk Member – Shows if a port is a member or a trunk. 3-230 www.digisol.com...

  • Page 285: Figure 3-128 Tunnel Port Configuration

    DG-FS4552 User Manual Web – Click VLAN, 802.1Q VLAN, 802.1Q Tunnel Configuration or Tunnel Trunk Configuration. Set the mode for a tunnel access port to 802.1Q Tunnel and a tunnel uplink port to 802.1Q Tunnel Uplink. Click Apply. Figure 3-128 Tunnel Port Configuration CLI –...

  • Page 286: Traffic Segmentation

    CLI – This example enables traffic segmentation and allows traffic to be forwarded across the uplink ports assigned to different client sessions. 4-312 Console(config)#pvlan 4-315 Console(config)#pvlan up-to-up forwarding Console(config)#exit 4-315 Console#show pvlan Private VLAN Status Enabled Uplink-to-Uplink Mode : Forwarding Session Uplink Ports Downlink Ports --------- ------------------------------ ----------------------------- Console# 3-232 www.digisol.com...

  • Page 287: Configuring Traffic Segmentation Sessions

    DG-FS4552 User Manual Configuring Traffic Segmentation Sessions Use the Traffic Segmentation Session Configuration page to create a client session, and assign the downlink and uplink ports to service the traffic associated with each session. Command Attributes • Session ID – Traffic segmentation session. (Range: 1-15) •...

  • Page 288: Private Vlans

    • Primary VLAN – The VLAN with which the selected VLAN ID is associated. A primary VLAN displays its own ID, and a community VLAN displays the associated primary VLAN. • Ports List – The list of ports (and assigned port type) in the selected private VLAN. 3-234 www.digisol.com...

  • Page 289: Configuring Private Vlans

    DG-FS4552 User Manual Web – Click VLAN, Private VLAN, Information. Select the desired port from the VLAN ID drop-down menu. Figure 3-131 Private VLAN Information CLI – This example shows the switch configured with primary VLAN 5 and secondary VLAN 6. Port 3 has been configured as a promiscuous port and mapped to VLAN 5, while ports 4 and 5 have been configured as a host ports and are associated with VLAN 6.

  • Page 290: Associating Vlans

    VLANs in the Non-Association list box, and click Add to associate these entries with the selected primary VLAN. (A community VLAN can only be associated with one primary VLAN.) Figure 3-133 Private VLAN Association 3-236 www.digisol.com...

  • Page 291: Displaying Private Vlan Interface Information

    DG-FS4552 User Manual CLI – This example associates community VLANs 6 and 7 with primary VLAN 5. Console(config)#vlan database 4-298 Console(config-vlan)#private-vlan 5 association 6 4-318 Console(config-vlan)#private-vlan 5 association 7 4-318 Console(config)# Displaying Private VLAN Interface Information Use the Private VLAN Port Information and Private VLAN Trunk Information menus to display the interfaces associated with private VLANs.

  • Page 292: Configuring Private Vlan Interfaces

    • Community VLAN – A community VLAN conveys traffic between community ports, and from community ports to their designated promiscuous ports. Set PVLAN Port Type to “Host,” and then specify the associated Community VLAN. • Trunk – The trunk identifier. (Port Information only) 3-238 www.digisol.com...

  • Page 293: Protocol Vlans

    DG-FS4552 User Manual Web – Click VLAN, Private VLAN, Port Configuration or Trunk Configuration. Set the PVLAN Port Type for each port that will join a private VLAN. Assign promiscuous ports to a primary VLAN. Assign host ports to a community VLAN. After all the ports have been configured, click Apply.

  • Page 294: Configuring Protocol Vlan Groups

    Alternately, the switch can be power-cycled, however all unsaved configuration changes will be lost. Web – Click VLAN, Protocol VLAN, Configuration. Enter a protocol group ID, frame type and protocol type, then click Apply. Figure 3-136 Protocol VLAN Configuration 3-240 www.digisol.com...

  • Page 295: Mapping Protocols To Vlans

    DG-FS4552 User Manual CLI – This example creates protocol group 1 for Ethernet frames using the IP protocol, and group 2 for Ethernet frames using the ARP protocol. Console(config)#protocol-vlan protocol-group 1 4-322 add frame-type ethernet protocol-type ip Console(config)#protocol-vlan protocol-group 2...

  • Page 296: Configuring Vlan Mirroring

    • Target Port – The destination port that receives the mirrored traffic from the source VLAN. (Range: 1-52) Web – Click VLAN, VLAN Mirror Configuration. Select the source VLAN, select a target port that is not a member of the source VLAN, and click Apply. Figure 3-138 VLAN Mirror Configuration 3-242 www.digisol.com...

  • Page 297: Configuring Ip Subnet Vlans

    DG-FS4552 User Manual CLI – This example mirrors all traffic entering VLAN 1 to port 28. Console(config)#interface ethernet 1/1 4-220 Console(config-if)#port monitor vlan 1 4-260 Console(config-if)# Configuring IP Subnet VLANs When using port-based classification, all untagged frames received by a port are classified as belonging to the VLAN whose VID (PVID) is associated with that port.

  • Page 298: Configuring Mac-Based Vlans

    • MAC Address – A source MAC address which is to be mapped to a specific VLAN. The MAC address must be specified in the format xx-xx-xx-xx-xx-xx. • VLAN ID – VLAN to which ingress traffic matching the specified source MAC address is forwarded. (Range: 1-4094) 3-244 www.digisol.com...

  • Page 299: Link Layer Discovery Protocol

    DG-FS4552 User Manual Web – Click VLAN, MAC-based VLAN, Configuration. Enter the MAC address, the VLAN to which matching frames will be forwarded, and then click Apply. Figure 3-140 MAC-based VLAN Configuration CLI – This example maps all traffic matching the specified address to VLAN 2.
  • Page 300 • MED Fast Start Count – Configures the amount of LLDP MED Fast Start LLDPDUs to transmit during the activation process of the LLDP-MED Fast Start mechanism. (Range: 1-10 packets; Default: 4 packets) 3-246 www.digisol.com...

  • Page 301: Configuring Lldp Interface Attributes

    DG-FS4552 User Manual The MED Fast Start Count parameter is part of the timer which ensures that the LLDP-MED Fast Start mechanism is active for the port. LLDP-MED Fast Start is critical to the timely startup of LLDP, and therefore integral to the rapid availability of Emergency Call Service.
  • Page 302 VLAN TLV that indicates the VLAN identifier (VID) associated with the management address reported by this TLV. - System Name – The system name is taken from the sysName object in RFC 3418, which contains the system’s administratively assigned name. To 3-248 www.digisol.com...

  • Page 303: Figure 3-142 Lldp Port Configuration

    DG-FS4552 User Manual configure the system name, see “Displaying System Information” on page 3-13. - System Capabilities – The system capabilities identifies the primary function(s) of the system and whether or not these primary functions are enabled. The information advertised by this TLV is described in IEEE 802.1AB.

  • Page 304: Displaying Lldp Local Device Information

    IfAlias (IETF RFC 2863) Port component EntPhysicalAlias when entPhysicalClass has a value ‘port(10)’ or ‘backplane(4)’ (IETF RFC 2737) MAC address MAC address (IEEE Std 802-2001) Network address networkAddress Interface name ifName (IETF RFC 2863) Locally assigned locally assigned 3-250 www.digisol.com...
  • Page 305 DG-FS4552 User Manual • Chassis ID – An octet string indicating the specific identifier for the particular chassis in this system. • System Name – An string that indicates the system’s administratively assigned name (see “Displaying System Information” on page 3-13).

  • Page 306: Table 3-16 System Capabilities

    4-354 LLDP Local System Information Chassis Type : MAC Address Chassis ID : 00-17-7C-0A-E2-F1 System Name System Description : DG-FS4552 System Capabilities Support : Bridge System Capabilities Enable : Bridge Management Address : 192.168.0.101 (IPv4) LLDP Port Information Interface |PortID Type...

  • Page 307: Displaying Lldp Remote Port Information

    DG-FS4552 User Manual Displaying LLDP Remote Port Information Use the LLDP Remote Port/Trunk Information screen to display information about devices connected directly to the switch’s ports which are advertising information through LLDP. Field Attributes • Local Port – The local port to which a remote LLDP-capable device is attached.

  • Page 308: Table 3-17 Port Id Subtype

    (See Table 3-16, “System Capabilities,” on page 3-251.) • Management Address – The IPv4 address of the remote device. If no management address is available, the address should be the MAC address for the CPU or for the port sending this advertisement. 3-254 www.digisol.com...

  • Page 309: Figure 3-145 Lldp Remote Information Details

    DG-FS4552 User Manual Web – Click LLDP, Remote Information Details. Select an interface from the drop down lists, and click Query. Figure 3-145 LLDP Remote Information Details CLI – This example displays LLDP information for an LLDP-enabled remote device attached to a specific port on this switch.

  • Page 310: Displaying Device Statistics

    • Num Frames Discarded – Number of frames discarded because they did not conform to the general validation rules as well as any specific usage rules defined for the particular TLV. Web – Click LLDP, Device Statistics. Figure 3-146 LLDP Device Statistics 3-256 www.digisol.com...

  • Page 311: Displaying Detailed Device Statistics

    DG-FS4552 User Manual CLI – This example displays LLDP statistics received from all LLDP-enabled remote devices connected directly to this switch. switch#show lldp info statistics 4-356 LLDP Device Statistics Neighbor Entries List Last Updated : 2450279 seconds New Neighbor Entries Count...

  • Page 312: Figure 3-147 Lldp Device Statistics Details

    1/1 4-356 LLDP Port Statistics Detail PortName : Eth 1/1 Frames Discarded Frames Invalid Frames Received : 12 Frames Sent : 13 TLVs Unrecognized : 0 TLVs Discarded Neighbor Ageouts switch# 3-258 www.digisol.com...

  • Page 313: Class Of Service Configuration

    DG-FS4552 User Manual Class of Service Configuration Class of Service (CoS) allows you to specify which data packets have greater precedence when traffic is buffered in the switch due to congestion. This switch supports CoS with four priority queues for each port. Data packets in a port’s high-priority queue will be transmitted before those in the lower-priority queues.

  • Page 314: Figure 3-148 Port Priority Configuration

    Acceptable Frame Type: All frames Native VLAN: Priority for Untagged Traffic: 5 GVRP Status: Disabled Allowed VLAN: 1(u),4093(t), Forbidden VLAN: Private-VLAN Mode: NONE Private-VLAN host-association: NONE Private-VLAN Mapping: NONE 802.1Q-tunnel Status: Disable 802.1Q-tunnel Mode: NORMAL 802.1Q-tunnel TPID: 8100(Hex) Console# 3-260 www.digisol.com...

  • Page 315: Mapping Cos Values To Egress Queues

    DG-FS4552 User Manual Mapping CoS Values to Egress Queues This switch processes Class of Service (CoS) priority tagged traffic by using four priority queues for each port, with service schedules based on strict or Weighted Round Robin (WRR). Up to eight separate traffic priorities are defined in IEEE 802.1p.

  • Page 316: Selecting The Queue Mode

    Thus, a queue weighted 8 will be allowed to transmit up to 8 packets, after which the next lower priority queue will be serviced according to it’s weighting. This prevents the head-of-line blocking that can occur with strict priority queuing. 3-262 www.digisol.com...

  • Page 317: Displaying The Service Weight For Traffic Classes

    DG-FS4552 User Manual Command Attributes • WRR - Weighted Round-Robin shares bandwidth at the egress ports by using scheduling weights with default values of 1, 2, 4, 8 for queues 0 through 3, respectively. (This is the default selection.) • Strict - Services the egress queues in sequential order, transmitting all traffic in the higher priority queues before servicing lower priority queues.

  • Page 318: Figure 3-151 Displaying Queue Scheduling

    Web – Click Priority, Queue Scheduling. Figure 3-151 Displaying Queue Scheduling CLI – The following example shows how to display the WRR weights assigned to each of the priority queues. Console#show queue bandwidth 4-360 Queue ID Weight -------- ------ Console 3-264 www.digisol.com...

  • Page 319: Layer 3/4 Priority Settings

    DG-FS4552 User Manual Layer 3/4 Priority Settings Mapping Layer 3/4 Priorities to CoS Values This switch supports one method of prioritizing layer 3/4 traffic to meet application requirements. Traffic priorities can be specified in the IP header of a frame, using the priority bits in the Type of Service (ToS) octet or the number of the TCP/UDP port.

  • Page 320: Mapping Dscp Priority

    • DSCP Priority Table – Shows the DSCP Priority to CoS map. • Class of Service Value – Maps a CoS value to the selected DSCP Priority value. Note that “0” represents low priority and “7” represent high priority. Note: IP DSCP settings apply to all interfaces. 3-266 www.digisol.com...

  • Page 321: Figure 3-153 Mapping Ip Dscp Priority Values

    DG-FS4552 User Manual Web – Click Priority, IP DSCP Priority. Select an entry from the DSCP table, enter a value in the Class of Service Value field, then click Apply. Figure 3-153 Mapping IP DSCP Priority Values CLI – The following example globally enables DSCP Priority service on the switch, maps DSCP value 0 to CoS value 1 (on port 1), and then displays the DSCP Priority settings.

  • Page 322: Quality Of Service

    DSCP service level for traffic exceeding the specified rate. 5. Use the “Service Policy” to assign a policy map to a specific interface. 3-268 www.digisol.com...

  • Page 323: Configuring A Class Map

    DG-FS4552 User Manual Configuring a Class Map A class map is used for matching packets to a specified class. Command Usage • To configure a Class Map, follow these steps: - Open the Class Map page, and click Add Class.

  • Page 324: Figure 3-154 Configuring Class Maps

    • Remove – Deletes the selected criteria from the class. Web – Click QoS, DiffServ, then click Add Class to create a new class, or Edit Rules to change the rules of an existing class. Figure 3-154 Configuring Class Maps 3-270 www.digisol.com...

  • Page 325: Creating Qos Policies

    DG-FS4552 User Manual CLI - This example creates a class map call “rd_class,” and sets it to match packets marked for DSCP service value 3. 4-366 Console(config)#class-map rd_class match-any 4-367 Console(config-cmap)#match ip dscp 3 Console(config-cmap)# Creating QoS Policies This function creates a policy map that can be attached to multiple interfaces.
  • Page 326 DSCP service level will be reduced. - Set – Decreases DSCP priority for out of conformance traffic. (Range: 0-63). - Drop – Drops out of conformance traffic. • Add – Adds the specified criteria to the policy map. 3-272 www.digisol.com...

  • Page 327: Figure 3-155 Configuring Policy Maps

    DG-FS4552 User Manual Web – Click QoS, DiffServ, Policy Map to display the list of existing policy maps. To add a new policy map click Add Policy. To configure the policy rule settings click Edit Classes. Figure 3-155 Configuring Policy Maps www.digisol.com...

  • Page 328: Attaching A Policy Map To Ingress Queues

    Policy Map for a port from the scroll-down box, then click Apply. Figure 3-156 Service Policy Settings CLI - This example applies a service policy to an ingress interface. 4-372 Console(config)#interface ethernet 1/5 4-372 Console(config-if)#service-policy input rd_policy#3 Console(config-if)# 3-274 www.digisol.com...

  • Page 329: Voip Traffic Configuration

    DG-FS4552 User Manual VoIP Traffic Configuration When IP telephony is deployed in an enterprise network, it is recommended to isolate the Voice over IP (VoIP) network traffic from other data traffic. Traffic isolation can provide higher voice quality by preventing excessive packet delays, packet loss, and jitter.

  • Page 330: Configuring Voip Traffic Ports

    • OUI – Traffic from VoIP devices is detected by the Organizationally Unique Identifier (OUI) of the source MAC address. OUI numbers are assigned to manufacturers and form the first three octets of a device MAC address. MAC 3-276 www.digisol.com...

  • Page 331: Figure 3-158 Voip Traffic Port Configuration

    DG-FS4552 User Manual address OUI numbers must be configured in the Telephony OUI list so that the switch recognizes the traffic as being from a VoIP device. • 802.1ab – Uses LLDP to discover VoIP devices attached to the port. LLDP checks that the “telephone bit”...

  • Page 332: Configuring Telephony Oui

    FF-FF-FF-00-00-00 identifies all devices with the same OUI (the first three octets). Other masks restrict the MAC address range. Selecting FF-FF-FF-FF-FF-FF specifies a single MAC address. (Default: FF-FF-FF-00-00-00) • Description – User-defined text that identifies the VoIP devices. 3-278 www.digisol.com...

  • Page 333: Figure 3-159 Telephony Oui List

    DG-FS4552 User Manual Web – Click QoS, VoIP Traffic Setting, OUI Configuration. Enter a MAC address that specifies the OUI for VoIP devices in the network. Select a mask from the pull-down list to define a MAC address range. Enter a description for the devices, then click Add.

  • Page 334: Multicast Filtering

    (VLAN). You can also configure a single network-wide multicast VLAN shared by hosts residing in other standard or private VLAN groups, preserving security and data isolation (see “Multicast VLAN Registration” on page 3-295). 3-280 www.digisol.com...

  • Page 335: Layer 2 Igmp (Snooping And Query)

    DG-FS4552 User Manual Layer 2 IGMP (Snooping and Query) IGMP Snooping and Query – If multicast routing is not supported on other switches in your network, you can use IGMP Snooping and Query (page 3-282) to monitor IGMP service requests passing between multicast clients and servers, and dynamically configure the switch ports which need to forward multicast traffic.

  • Page 336: Configuring Igmp Snooping And Query Parameters

    When the conditions in the preceding item all apply, except that the receiving port is a router port, then the switch will not send a GS-query, but will immediately start the last member query timer for that port. 3-282 www.digisol.com...

  • Page 337: Figure 3-160 Igmp Configuration

    DG-FS4552 User Manual Command Attributes • IGMP Status — When enabled, the switch will monitor network traffic to determine which hosts want to receive multicast traffic. This is also referred to as IGMP Snooping. (Default: Enabled) • Act as IGMP Querier — When enabled, the switch can serve as the Querier, which is responsible for asking hosts if they want to receive multicast traffic.

  • Page 338: Enabling Igmp Immediate Leave

    • Immediate leave does not apply to a port if the switch has learned that a multicast router is attached to it. • Immediate leave can improve bandwidth usage for a network which frequently experiences many IGMP host add and leave requests. 3-284 www.digisol.com...

  • Page 339: Figure 3-161 Igmp Immediate Leave

    DG-FS4552 User Manual Command Attributes • VLAN ID – VLAN Identifier. (Range: 1-4094). • Immediate Leave – Sets the status for immediate leave on the specified VLAN. (Default: Disabled) Web – Click IGMP Snooping, IGMP Immediate Leave. Select the VLAN interface to configure, set the status for immediate leave, and click Apply.

  • Page 340: Displaying Interfaces Attached To A Multicast Router

    CLI – This example shows that Port 11 has been statically configured as a port attached to a multicast router. Console#show ip igmp snooping mrouter vlan 1 4-384 VLAN M'cast Router Port Type ---- ------------------ ------- Eth 1/11 Static Console# 3-286 www.digisol.com...

  • Page 341: Specifying Static Interfaces For A Multicast Router

    DG-FS4552 User Manual Specifying Static Interfaces for a Multicast Router Depending on your network connections, IGMP snooping may not always be able to locate the IGMP querier. Therefore, if the IGMP querier is a known multicast router/ switch connected over the network to an interface (port or trunk) on your switch, you can manually configure the interface (and a specified VLAN) to join all the current multicast groups supported by the attached router.

  • Page 342: Displaying Port Members Of Multicast Services

    The Type field shows if this entry was learned dynamically or was statically configured. Console#show mac-address-table multicast vlan 1 4-379 VLAN M'cast IP addr. Member ports Type ---- --------------- ------------ ------- 224.1.1.12 Eth1/12 USER 224.1.2.3 Eth1/12 IGMP Console# 3-288 www.digisol.com...

  • Page 343: Assigning Ports To Multicast Services

    DG-FS4552 User Manual Assigning Ports to Multicast Services Multicast filtering can be dynamically configured using IGMP Snooping and IGMP Query messages as described in “Configuring IGMP snooping and Query Parameters” on page 3-133. For certain applications that require tighter control, you may need to statically configure a multicast service on the switch.

  • Page 344: Igmp Filtering And Throttling

    To implement IGMP filtering and throttling on the switch, you must first enable the feature globally and create IGMP profile numbers. Command Attributes • IGMP Filter – Enables IGMP filtering and throttling globally for the switch. (Default: Disabled) • IGMP Profile – Creates IGMP profile numbers. (Range: 1-4294967295) 3-290 www.digisol.com...

  • Page 345: Configuring Igmp Filter Profiles

    DG-FS4552 User Manual Web – Click IGMP Snooping, IGMP Filter Configuration. Create a profile group by entering a number in the text box and clicking Add. Enable the IGMP filter status, then click Apply. Figure 3-166 Enabling IGMP Filtering and Throttling CLI –...

  • Page 346: Figure 3-167 Igmp Profile Configuration

    “permit” and then specifying a range of multicast groups that a user can join. The current profile configuration is then displayed. Console(config)#ip igmp profile 19 4-386 Console(config-igmp-profile)#permit 4-386 Console(config-igmp-profile)#range 239.1.2.3 4-387 Console(config-igmp-profile)#range 239.2.3.1 239.2.3.200 Console(config-igmp-profile)#end Console#show ip igmp profile 19 4-390 IGMP Profile 19 permit range 239.1.2.3 239.1.2.3 range 239.2.3.1 239.2.3.200 Console# 3-292 www.digisol.com...

  • Page 347: Configuring Igmp Filtering And Throttling For Interfaces

    DG-FS4552 User Manual Configuring IGMP Filtering and Throttling for Interfaces Once you have configured IGMP profiles, you can assign them to interfaces on the switch. Also you can set the IGMP throttling number to limit the number of multicast groups an interface can join at the same time.

  • Page 348: Figure 3-168 Igmp Filter And Throttling Port Configuration

    IGMP Profile 19 permit range 239.1.2.3 239.1.2.3 range 239.2.3.1 239.2.3.200 Console#show ip igmp throttle interface ethernet 1/1 4-390 Information of Eth 1/1 status : TRUE action : deny max multicast groups : 64 current multicast groups: 0 Console# 3-294 www.digisol.com...

  • Page 349: Multicast Vlan Registration

    DG-FS4552 User Manual Multicast VLAN Registration Multicast VLAN Registration (MVR) is a protocol that controls access to a single network-wide VLAN most commonly used for transmitting multicast traffic (such as television channels or video-on-demand) across a service provider’s network. Any multicast traffic entering an MVR VLAN is sent to all attached subscribers.

  • Page 350: Configuring Global Mvr Settings

    The IP address range of 224.0.0.0 to 239.255.255.255 is used for multicast streams. MVR group addresses cannot fall within the reserved IP multicast address range of 224.0.0.x. • Count – The number of contiguous MVR group addresses. (Range: 1-255; Default: 0) 3-296 www.digisol.com...

  • Page 351: Figure 3-169 Mvr Global Configuration

    DG-FS4552 User Manual Web – Click MVR, Configuration. Enable MVR globally on the switch, select the MVR VLAN, add the multicast groups that will stream traffic to attached hosts, and then click Apply. Figure 3-169 MVR Global Configuration CLI – This example first enables IGMP snooping, enables MVR globally, and then configures a range of MVR group addresses.

  • Page 352: Displaying Mvr Interface Status

    CLI – This example shows information about interfaces attached to the MVR VLAN. Console#show mvr interface 4-396 Port Type Status Immediate Leave ------- -------- ------------- --------------- eth1/1 SOURCE ACTIVE/UP Disable eth1/2 RECEIVER ACTIVE/UP Disable Console# 18. Port Information only. 3-298 www.digisol.com...

  • Page 353: Displaying Port Members Of Multicast Groups

    DG-FS4552 User Manual Displaying Port Members of Multicast Groups You can display the multicast groups assigned to the MVR VLAN either through IGMP snooping or static configuration. Field Attributes • Group IP – Multicast groups assigned to the MVR VLAN.

  • Page 354: Configuring Mvr Interface Status

    MVR VLAN. Any port configured as an receiver port will be dynamically added to the MVR VLAN when it forwards an IGMP report or join message from an attached host requesting any of the designated multicast services supported by the MVR VLAN. 3-300 www.digisol.com...

  • Page 355: Figure 3-172 Mvr Port Configuration

    DG-FS4552 User Manual - Non-MVR – An interface that does not participate in the MVR VLAN. (This is the default type.) • Immediate Leave – Configures the switch to immediately remove an interface from a multicast stream as soon as it receives a leave message for that group.

  • Page 356: Assigning Static Multicast Groups To Interfaces

    Add or Remove button to modify the Member list. Figure 3-173 MVR Group Member Configuration CLI – This example statically assigns a multicast group to a receiver port. Console(config)#interface ethernet 1/2 Console(config-if)#mvr group 228.1.23.1 4-394 Console(config-if)# 3-302 www.digisol.com...

  • Page 357: Configuring Mvr Receiver Vlan And Group Addresses

    DG-FS4552 User Manual Configuring MVR Receiver VLAN and Group Addresses Multicast traffic forwarded to subscribers is normally stripped of frame tags to prevent hosts from discovering the identity of the MVR VLAN. An MVR Receiver VLAN and the multicast services supported by this VLAN can be configured to hide the MVR VLAN, while allowing multicast traffic with frame tags to be forwarded to subscribers.

  • Page 358: Displaying Mvr Receiver Groups

    CLI – This example shows the interfaces which have joined MVR receiver groups, and the status of MVR traffic for each group. 4-396 Console#show mvr receiver-group members MVR Group IP Status Members ---------------- -------- ------- 224.0.1.1 ACTIVE eth1/5 224.0.2.2 INACTIVE None Console# 3-304 www.digisol.com...

  • Page 359: Configuring Static Mvr Receiver Group Members

    DG-FS4552 User Manual Configuring Static MVR Receiver Group Members You can statically assign a multicast reciever group to the selected interface using the Receiver Group Member Configuration page. Field Attributes • Interface – Indicates a port or trunk. • Group Address List – Multicast receiver groups assigned to the selected interface.

  • Page 360: Domain Name Service

    • Name Server List – Specifies the address of one or more domain name servers to use for name-to-address resolution. (Range: 1-6 IP addresses) 20. Do not include the initial dot that separates the host name from the domain name. 3-306 www.digisol.com...

  • Page 361: Figure 3-177 Dns General Configuration

    DG-FS4552 User Manual Web – Select DNS, General Configuration. Set the default domain name or list of domain names, specify one or more name servers to use to use for address resolution, enable domain lookup status, and click Apply. Figure 3-177 DNS General Configuration CLI - This example sets a default domain name and a domain list.

  • Page 362: Configuring Static Dns Host To Address Entries

    Field Attributes • Host Name – Name of a host device that is mapped to one or more IP addresses. (Range: 1-64 characters) • IP Address – Internet address(es) associated with a host name. (Range: 1-8 addresses) 3-308 www.digisol.com...
  • Page 363 DG-FS4552 User Manual Web – Select DNS, Static Host Table. Enter a host name and one or more corresponding addresses, then click Apply. Figure 3-178 DNS Static Host Table CLI - This example maps two address to a host name, and then configures an alias host name for the same addresses.

  • Page 364: Displaying The Dns Cache

    CLI - This example displays all the resource records learned from the designated name servers. 4-405 Console#show dns cache FLAG TYPE DOMAIN Address www.times.com 199.239.136.200 Address a1116.x.akamai.net 61.213.189.120 Address a1116.x.akamai.net 61.213.189.104 CNAME graphics8.nytimes.com POINTER TO:2 CNAME graphics478.nytimes.com.edgesui 19 POINTER TO:2 Console# 3-310 www.digisol.com...

  • Page 365: Switch Clustering

    DG-FS4552 User Manual Switch Clustering IP Clustering is a method of grouping switches together to enable centralized management through a single unit. Switches that support clustering can be grouped together regardless of physical location or switch type, as long as they are connected to the same local network.
  • Page 366 Commander, and then configures the cluster IP pool. Console(config)#cluster 4-81 Console(config)#cluster commander 4-81 Console(config)#cluster ip-pool 10.2.3.4 4-82 Console(config)#exit Console#show cluster 4-84 Role: commander Interval heartbeat: Heartbeat loss count: 3 Number of Members: Number of Candidates: 0 Console# 3-312 www.digisol.com...

  • Page 367: Cluster Member Configuration

    DG-FS4552 User Manual Cluster Member Configuration Adds Candidate switches to the cluster as Members. Command Attributes • Member ID – Specify a Member ID number for the selected Candidate switch. (Range: 1-36) • MAC Address – Select a discovered switch MAC address from the Candidate Table, or enter a specific MAC address of a known switch.

  • Page 368: Displaying Information On Cluster Members

    Web – Click Cluster, Member Information. Figure 3-183 Cluster Member Information CLI – This example shows information about cluster Member switches. Vty-0#show cluster members 4-84 Cluster Members: Role: Active member IP Address: 10.254.254.2 MAC Address: 00-17-7c-0a-e2-f1 Description: DG-FS4552 Vty-0# 3-314 www.digisol.com...

  • Page 369: Cluster Candidate Information

    DG-FS4552 User Manual Cluster Candidate Information Use the Cluster Candidate Information page to display information about discovered switches in the network that are already cluster Members or are available to become cluster Members. Command Attributes • Role – Indicates the current status of Candidate switches in the network.

  • Page 370: Upnp

    UPnP under Windows XP, open My Network Places in the Explore file manager. An entry for “DG-FS4552” will appear in the list of discovered devices. Double-click on this entry to access the switch’s web management interface. Or right-click on the entry and select “Properties”...

  • Page 371: Upnp Configuration

    DG-FS4552 User Manual UPnP Configuration Use the UPnP Configuration page to enable or disable UPnP, and to set advertisement and time out values. Command Attributes • UPNP Status – Enables/disables UPnP on the device. (Default: Disabled) • Advertising Duration – This sets the duration of which a device will advertise its status to the control point.
  • Page 372 Configuring the Switch 3-318 www.digisol.com...

  • Page 373: Chapter 4: Command Line Interface

    When finished, exit the session with the “quit” or “exit” command. After connecting to the system through the console port, the login screen displays: User Access Verification Username: admin Password: CLI session with the DG-FS4552 is opened. To end the CLI session, enter [Exit]. Console# www.digisol.com...

  • Page 374: Telnet Connection

    When finished, exit the session with the “quit” or “exit” command. After entering the Telnet command, the login screen displays: Username: admin Password: CLI session with the DG-FS4552 is opened. To end the CLI session, enter [Exit]. Vty-0# Note: You can open up to four sessions to the device via Telnet.

  • Page 375: Entering Commands

    DG-FS4552 User Manual Entering Commands This section describes how to enter CLI commands. Keywords and Arguments A CLI command is a series of keywords and arguments. Keywords identify a command, and arguments specify configuration parameters. For example, in the command “show interfaces status ethernet 1/5,” show interfaces and status are keywords, ethernet is an argument that specifies the interface type, and 1/5 specifies the unit/port.

  • Page 376: Showing Commands

    RADIUS server information reload Shows the reload settings running-config Information on the running configuration sflow Shows the sflow information snmp Simple Network Management Protocol statistics sntp Simple Network Time Protocol configuration spanning-tree Spanning-tree configuration Secure shell server connections www.digisol.com...

  • Page 377: Partial Keyword Lookup

    DG-FS4552 User Manual startup-config Startup system configuration subnet-vlan IP subnet-based VLAN information system System information tacacs-server TACACS server settings tech-support Technical information upnp UPnP settings users Information about terminal lines version System hardware and software versions vlan Virtual LAN settings...

  • Page 378: Understanding Command Modes

    “super” (page 4-110). To enter Privileged Exec mode, enter the following user names and passwords: Username: admin Password: [admin login password] CLI session with the DG-FS4552 is opened. To end the CLI session, enter [Exit]. Console# www.digisol.com...

  • Page 379: Configuration Commands

    DG-FS4552 User Manual Username: guest Password: [guest login password] CLI session with the DG-FS4552 is opened. To end the CLI session, enter [Exit]. Console>enable Password: [privileged level password] Console# Configuration Commands Configuration commands are privileged level commands used to modify switch settings.

  • Page 380: Table 4-2 Configuration Modes

    Server Group aaa group server {radius | tacacs+} Console(config-sg-radius) 4-123 Console(config-sg-tacacs+) VLAN vlan database Console(config-vlan) 4-298 For example, you can use the following commands to enter interface configuration mode, and then return to Privileged Exec mode Console(config)#interface ethernet 1/5 Console(config-if)#exit Console(config)# www.digisol.com...

  • Page 381: Command Line Processing

    DG-FS4552 User Manual Command Line Processing Commands are not case sensitive. You can abbreviate commands and parameters as long as they contain enough letters to differentiate them from any other currently available commands or parameters. You can use the Tab key to complete partial commands, or enter a partial command followed by the “?”...

  • Page 382: Command Groups

    Configures LLDP settings to enable information discovery about 4-335 neighbor devices Protocol Class of Service Sets port priority for untagged frames, selects strict priority or weighted 4-357 round robin, relative weight for each priority queue, also sets priority for DSCP 4-10 www.digisol.com...

  • Page 383: General Commands

    DG-FS4552 User Manual Table 4-4 Command Groups (Continued) Command Group Description Page Quality of Service Configures Differentiated Services classification criteria and service 4-365 policies Multicast Filtering Configures IGMP multicast filtering, query parameters, specifies ports 4-374 attached to a multicast router, and enables multicast VLAN registration...

  • Page 384: Enable

    Ethernet statistics. To gain access to all commands, you must use the privileged mode. See “Understanding Command Modes” on page 4-6. Command Mode Privileged Exec Command Usage The “>” character is appended to the end of the prompt to indicate that the system is in normal access mode. 4-12 www.digisol.com...

  • Page 385: Configure

    DG-FS4552 User Manual Example Console#disable Console> Related Commands enable (4-12) configure This command activates Global Configuration mode. You must enter this mode to modify any settings on the switch. You must also enter Global Configuration mode prior to enabling some of the other configuration modes, including Interface Configuration, Line Configuration, and VLAN Database Configuration, and Multiple Spanning Tree Configuration.

  • Page 386: Reload (Privileged Exec)

    - minute - The minute at which to reload. (Range: 0-59) - month - The month at which to reload. (january ... december) - day - The day of the month at which to reload. (Range: 1-31) - year - The year at which to reload. (Range: 2001-2050) 4-14 www.digisol.com...
  • Page 387 DG-FS4552 User Manual • reload in - An interval after which to reload the switch. - hours - The number of hours, combined with the minutes, before the switch resets. (Range: 0-576) - minutes - The number of minutes, combined with the hours, before the switch resets.

  • Page 388: Show Reload

    This command returns to Privileged Exec mode. Command Mode Global Configuration, Interface Configuration, Line Configuration, VLAN Database Configuration, and Multiple Spanning Tree Configuration Example This example shows how to return to the Privileged Exec mode from the Interface Configuration mode: Console(config-if)#end Console# 4-16 www.digisol.com...

  • Page 389: Exit

    DG-FS4552 User Manual exit This command returns to the previous configuration mode or exit the configuration program. Command Mode Example This example shows how to return to the Privileged Exec mode from the Global Configuration mode, and then quit the CLI session:...

  • Page 390: System Management Commands

    This command specifies or modifies the host name for this device. Use the no form to restore the default host name. Syntax hostname name no hostname name - The name of this host. (Maximum length: 255 characters) Default Setting None Command Mode Global Configuration 4-18 www.digisol.com...

  • Page 391: Banner Information Commands

    DG-FS4552 User Manual Example Console(config)#hostname RD#1 Console(config)# Banner Information Commands These commands are used to configure and manage administrative information about the switch, its exact data center location, details of the electrical and network circuits that supply the switch, as well as contact information for the network administrator and system manager.

  • Page 392: Banner Configure

    The delete and left-arrow keys terminate the script. The use of the backspace key during script mode is not supported. If, for example, a mistake is made in the company name, it can be corrected with the banner configure company command. 4-20 www.digisol.com...

  • Page 393: Banner Configure Company

    DG-FS4552 User Manual Example Console(config)#banner configure Company: DIGISOL Responsible department: R&D Dept Name and telephone to Contact the management people Manager1 name: Sr. Network Admin phone number: 123-555-1212 Manager2 name: Jr. Network Admin phone number: 123-555-1213 Manager3 name: Night-shift Net Admin / Janitor phone number: 123-555-1214 The physical location of the equipment.

  • Page 394: Banner Configure Dc-Power-Info

    Command Line Interface Example Console(config)#banner configure company DIGISOL Console(config)# banner configure dc-power-info This command is use to configure DC power information displayed in the banner. Use the no form to restore the default setting. Syntax banner configure dc-power-info floor floor-id row row-id rack rack-id...

  • Page 395: Banner Configure Equipment-Info

    DG-FS4552 User Manual Default Setting None Command Mode Global Configuration Command Usage Input strings cannot contain spaces. The banner configure department command interprets spaces as data input boundaries. The use of underscores ( _ ) or other unobtrusive non-letter characters is suggested for situations where white space is necessary for clarity.

  • Page 396: Banner Configure Equipment-Location

    Command Line Interface Example Console(config)#banner configure equipment-info manufacturer-id DG-FS4552 floor 3 row 10 rack 15 shelf-rack 12 manufacturer DIGISOL Console(config)# banner configure equipment-location This command is used to configure the equipment location information displayed in the banner. Use the no form to restore the default setting.

  • Page 397: Banner Configure Lp-Number

    DG-FS4552 User Manual Command Mode Global Configuration Command Usage Input strings cannot contain spaces. The banner configure ip-lan command interprets spaces as data input boundaries. The use of underscores ( _ ) or other unobtrusive non-letter characters is suggested for situations where white space is necessary for clarity.

  • Page 398: Banner Configure Manager-Info

    This command is used to configure the mux information displayed in the banner. Use the no form to restore the default setting. Syntax banner configure mux muxinfo no banner configure mux muxinfo - The circuit and PVC to which the switch is connected. (Maximum length: 32 characters) 4-26 www.digisol.com...

  • Page 399: Banner Configure Note

    DG-FS4552 User Manual Default Setting None Command Mode Global Configuration Command Usage Input strings cannot contain spaces. The banner configure mux command interprets spaces as data input boundaries. The use of underscores ( _ ) or other unobtrusive non-letter characters is suggested for situations where white space is necessary for clarity.

  • Page 400: Show Banner

    Steve - 123-555-9876 Lamar - 123-555-3322 Station's information: 710_Network_Path,Indianapolis DIGISOL - DG-FS4552 Floor / Row / Rack / Sub-Rack 7 / 10 / 15 / 6 DC power supply: Power Source A: Floor / Row / Rack / Electrical circuit 3 / 15 / 24 / 48V-id_3.15.24.2...

  • Page 401: System Status Commands

    DG-FS4552 User Manual System Status Commands This section describes commands used to display system information. Table 4-9 System Status Commands Command Function Mode Page show startup-config Displays the contents of the configuration file (stored in flash 4-29 memory) that is used to start up the system...

  • Page 402: Show Running-Config

    Command Usage • Use this command in conjunction with the show startup-config command to compare the information in running memory to the information stored in non-volatile memory. • This command displays settings for key command modes. Each mode group 4-30 www.digisol.com...
  • Page 403 DG-FS4552 User Manual is separated by “!” symbols, and includes the configuration mode command, and corresponding commands. This command displays the following information: - Switch’s MAC address - SNTP server settings - SNMP community strings - Users (names and access levels)
  • Page 404 1 ip address dhcp interface vlan 4093 interface ethernet 1/1 switchport allowed vlan add 1 untagged switchport allowed vlan add 4093 tagged line console silent-time 0 line VTY Console# Related Commands show startup-config (4-29) 4-32 www.digisol.com...

  • Page 405: Show System

    DG-FS4552 User Manual show system This command displays system information. Command Mode Normal Exec, Privileged Exec Command Usage • For a description of the items shown by this command, refer to “Displaying System Information” on page 3-13. • The POST results should all display “PASS.” If any POST test indicates “FAIL,”...

  • Page 406: Show Version

    Hardware Version: Chip Device ID: Marvell 98DX106-B0, 88E6095[F] EPLD Version: 0.05 Number of Ports: Main Power Status: Redundant Power Status: Not present Agent (Master) Unit ID: Loader Version: 1.0.2.0 Boot ROM Version: 1.2.0.1 Operation Code Version: 1.3.4.0 Console# 4-34 www.digisol.com...

  • Page 407: Frame Size Commands

    DG-FS4552 User Manual Frame Size Commands This section describes commands used to configure the Ethernet frame size on the switch. Table 4-10 Frame Size Commands Command Function Mode Page jumbo frame Enables support for jumbo frames 4-35 jumbo frame This command enables support for jumbo frames. Use the no form to disable it.

  • Page 408: File Management Commands

    Automatic Code Upgrade Commands upgrade opcode auto Automatically upgrades the current image when a new 4-42 version is detected on the indicated server upgrade opcode path Specifies an FTP/TFTP server and directory in which the new 4-43 opcode is stored 4-36 www.digisol.com...

  • Page 409: Copy

    DG-FS4552 User Manual copy This command moves (uploads/downloads) a code image or configuration file between the switch’s flash memory and an FTP/TFTP server. It can also download a diagnostics file or loader file from an FTP/TFTP server. When you save the system code or configuration settings to a file on an FTP/TFTP server, that file can later be downloaded to the switch to restore system operation.
  • Page 410 Destination file name: startup.01 TFTP completed. Success. Console# The following example shows how to copy the running configuration to a startup file. Console#copy running-config file destination file name: startup Write to FLASH Programming. \Write to FLASH finish. Success. Console# 4-38 www.digisol.com...
  • Page 411 DG-FS4552 User Manual The following example shows how to download a configuration file: Console#copy tftp startup-config TFTP server ip address: 10.1.0.99 Source configuration file name: startup.01 Startup configuration file name [startup]: Write to FLASH Programming. \Write to FLASH finish. Success.

  • Page 412: Delete

    • opcode - Run-time operation code image file. • filename - Name of the configuration file or code image. Default Setting None Command Mode Privileged Exec Command Usage • If you enter the command dir without any parameters, the system displays all files. 4-40 www.digisol.com...

  • Page 413: Whichboot

    DG-FS4552 User Manual • File information is shown below: Table 4-12 File Directory Information Column Heading Description File name The name of the file. File type File types: Boot-Rom, Operation Code, and Config file. Startup Shows if this file is used when the system is started.

  • Page 414: Boot System

    This command automatically upgrades the current operational code when a new version is detected on the server indicated by the upgrade opcode path command. Use the no form of this command to restore the default setting. Syntax [no] upgrade opcode auto Default Setting Disabled Command Mode Global Configuration 4-42 www.digisol.com...

  • Page 415: Upgrade Opcode Path

    1. It will search for a new version of the image at the location specified by upgrade opcode path command (page 4-43). The name for the new image stored on the FTP/TFTP server must be DG-FS4552.bix. If the switch detects a code version newer than the one currently in use, it will download the new image.

  • Page 416: Line Commands

    • The name for the new image stored on the FTP/TFTP server must be DG-FS4552.bix. However, note that file name is not to be included in this command. • When specifying a TFTP server, the following syntax must be used, where filedir indicates the path to the directory containing the new image: tftp://192.168.0.1[/filedir]/...

  • Page 417: Line

    DG-FS4552 User Manual Table 4-13 Line Commands (Continued) Command Function Mode Page exec-timeout Sets the interval that the command interpreter waits until user 4-48 input is detected password-thresh Sets the password intrusion threshold, which limits the number 4-49 of failed logon attempts...

  • Page 418: Login

    Normal Exec (NE) mode. • This command controls login authentication via the switch itself. To configure user names and passwords for remote authentication servers, you must use the RADIUS or TACACS software installed on those servers. Example Console(config-line)#login local Console(config-line)# 4-46 www.digisol.com...

  • Page 419: Password

    DG-FS4552 User Manual Related Commands username (4-109) password (4-47) password This command specifies the password for a line. Use the no form to remove the password. Syntax password {0 | 7} password no password • {0 | 7} - 0 means plain password, 7 means encrypted password •...

  • Page 420: Timeout Login Response

    This command sets the interval that the system waits until user input is detected. Use the no form to restore the default. Syntax exec-timeout [seconds] no exec-timeout seconds - Integer that specifies the number of seconds. (Range: 0-65535 seconds; 0: no timeout) Default Setting 10 minutes 4-48 www.digisol.com...

  • Page 421: Password-Thresh

    DG-FS4552 User Manual Command Mode Line Configuration Command Usage • If user input is detected within the timeout interval, the session is kept open; otherwise the session is terminated. • This command applies to both the local console and Telnet connections.

  • Page 422: Silent-Time

    Use the no form to restore the default value. Syntax databits {7 | 8} no databits • 7 - Seven data bits per character. • 8 - Eight data bits per character. Default Setting 8 data bits per character Command Mode Line Configuration 4-50 www.digisol.com...

  • Page 423: Parity

    DG-FS4552 User Manual Command Usage The databits command can be used to mask the high bit on input from devices that generate 7 data bits with parity. If parity is being generated, specify 7 data bits per character. If no parity is required, specify 8 data bits per character.

  • Page 424: Speed

    Syntax stopbits {1 | 2} • 1 - One stop bit • 2 - Two stop bits Default Setting 1 stop bit Command Mode Line Configuration Example To specify 2 stop bits, enter this command: Console(config-line)#stopbits 2 Console(config-line)# 4-52 www.digisol.com...

  • Page 425: Terminal Length

    DG-FS4552 User Manual terminal length This command sets the number of lines displayed on a terminal. Use the no form to restore the default setting. Syntax terminal length screen-length no terminal length screen-length – The number of lines displayed on a terminal.

  • Page 426: Terminal Escape-Character

    • vt-102 – VT102 Default Setting VT100 Command Mode Privileged Exec Command Usage This command specifies the terminal type connected to the console port, or the terminal emulation type used by a computer connected to the console port. 4-54 www.digisol.com...

  • Page 427: Terminal History

    DG-FS4552 User Manual Example Console#terminal terminal-type vt-102 Console# terminal history This command configures parameters for storing previously entered commands. Use the no form to restore the default setting. Syntax terminal history [size number-of-lines] no terminal history [size] Default Setting Enabled...

  • Page 428: Show Line

    Terminal type: VT100 Console Configuration: Password Threshold: 3 times Interactive Timeout: 65535 sec Login Timeout: Disabled Silent Time: Disabled Baudrate: 9600 Databits: Parity: None Stopbits: VTY Configuration: Password Threshold: 3 times Interactive Timeout: 600 sec Login Timeout: 300 sec 4-56 www.digisol.com...

  • Page 429: Event Logging Commands

    DG-FS4552 User Manual Event Logging Commands Table 4-14 Event Logging Commands Command Function Mode Page logging on Controls logging of error messages 4-57 logging history Limits syslog messages saved to switch memory based on 4-58 severity logging host Adds a syslog server host IP address that will receive logging...

  • Page 430: Logging History

    RAM: debugging (level 7 - 0) Command Mode Global Configuration Command Usage The message level specified for flash memory must be a higher priority (i.e., numerically lower) than that specified for RAM. Example Console(config)#logging history ram 0 Console(config)# 4-58 www.digisol.com...

  • Page 431: Logging Host

    DG-FS4552 User Manual logging host This command adds a syslog server host IP address that will receive logging messages. Use the no form to remove a syslog server host. Syntax [no] logging host host-ip-address host-ip-address - The IP address of a syslog server.

  • Page 432: Logging Trap

    • flash - Event history stored in flash memory (i.e., permanent memory). • ram - Event history stored in temporary RAM (i.e., memory flushed on power reset). Default Setting Flash and RAM Command Mode Privileged Exec Example Console#clear log Console# 4-60 www.digisol.com...

  • Page 433: Show Logging

    DG-FS4552 User Manual Related Commands show log (4-62) show logging This command displays the configuration settings for logging messages to local switch memory, to an SMTP event handler, or to a remote syslog server. Syntax show logging {flash | ram | sendmail} •...

  • Page 434: Show Log

    6, module: 6, function: 1, and event no.: 1 [2] 00:00:50 2001-01-01 "STA topology change notification." level: 6, module: 6, function: 1, and event no.: 1 [1] 00:00:48 2001-01-01 "VLAN 1 link-up notification." level: 6, module: 6, function: 1, and event no.: 1 Console# 4-62 www.digisol.com...

  • Page 435: Smtp Alert Commands

    DG-FS4552 User Manual SMTP Alert Commands These commands configure SMTP event handling, and forwarding of alert messages to the specified SMTP servers and email recipients. Table 4-17 SMTP Alert Commands Command Function Mode Page logging sendmail host SMTP servers to receive alert messages...

  • Page 436: Logging Sendmail Level

    Global Configuration Command Usage You may use an symbolic email address that identifies the switch, or the address of an administrator responsible for the switch. Example This example will set the source email john@acme.com. Console(config)#logging sendmail source-email john@acme.com Console(config)# 4-64 www.digisol.com...

  • Page 437: Logging Sendmail Destination-Email

    DG-FS4552 User Manual logging sendmail destination-email This command specifies the email recipients of alert messages. Use the no form to remove a recipient. Syntax [no] logging sendmail destination-email email-address email-address - The source email address used in alert messages. (Range: 1-41 characters)
  • Page 438 Command Line Interface Example Console#show logging sendmail SMTP servers ----------------------------------------------- 1. 192.168.1.200 SMTP Minimum Severity Level: 4 SMTP destination email addresses ----------------------------------------------- 1. geoff@acme.com SMTP Source Email Address: john@acme.com SMTP status: Enabled Console# 4-66 www.digisol.com...

  • Page 439: Time Commands

    DG-FS4552 User Manual Time Commands The system clock can be dynamically set by polling a set of specified time servers (NTP or SNTP). Maintaining an accurate time on the switch enables the system log to record meaningful dates and times for event entries. If the clock is not set, the switch will only record the time from the factory default set at the last bootup.

  • Page 440: Sntp Client

    Console(config)#end Console#show sntp Current time: Dec 23 02:52:44 2002 Poll interval: 60 Current mode: unicast SNTP status: Enabled SNTP server: 10.1.0.19 0.0.0.0 0.0.0.0 Current server: 10.1.0.19 Console# Related Commands sntp server (4-69) sntp poll (4-69) show sntp (4-70) 4-68 www.digisol.com...

  • Page 441: Sntp Server

    DG-FS4552 User Manual sntp server This command sets the IP address of the servers to which SNTP time requests are issued. Use the this command with no arguments to clear all time servers from the current list. Syntax sntp server [ip1 [ip2 [ip3]]] ip - IP address of a time server (NTP or SNTP).

  • Page 442: Show Sntp

    • The time acquired from time servers is used to record accurate dates and times for log events. Without NTP, the switch only records the time starting from the factory default set at the last bootup (i.e., 00:00:00, Jan. 1, 2001). 4-70 www.digisol.com...

  • Page 443: Ntp Server

    DG-FS4552 User Manual • This command enables client time requests to time servers specified via the ntp servers command. It issues time synchronization requests based on the interval set via the ntp poll command. Example Console(config)#ntp client Console(config)# Related Commands...

  • Page 444: Ntp Authenticate

    NTP servers and clients. The key numbers and key values must match on both the server and client. Example Console(config)#ntp authenticate Console(config)# Related Commands ntp authentication-key (4-73) 4-72 www.digisol.com...

  • Page 445: Ntp Authentication-Key

    DG-FS4552 User Manual ntp authentication-key This command configures authentication keys and key numbers to use when NTP authentication is enabled. Use the no form of the command to clear a specific authentication key or all keys from the current list.

  • Page 446: Show Ntp

    GMT-Greenwich-Mean-Time; GMT+0100 - GMT+1300) • city - Select the city associated with the chosen GMT offset. After the offset has been entered, use the tab-complete function to display the available city options. Default Setting GMT-Greenwich-Mean-Time-Dublin,Edinburgh,Lisbon,London Command Mode Global Configuration 4-74 www.digisol.com...

  • Page 447: Clock Timezone

    DG-FS4552 User Manual Command Usage This command sets the local time zone relative to the Coordinated Universal Time (UTC, formerly Greenwich Mean Time or GMT), based on the earth’s prime meridian, zero degrees longitude. To display a time corresponding to your local time, you must indicate the number of hours and minutes your time zone is east (before) or west (after) of UTC.

  • Page 448: Clock Summer-Time (Date)

    • This command sets the summer-time time zone relative to the currently configured time zone. To specify a time corresponding to your local time when summer time is in effect, you must indicate the number of minutes your summer-time time zone deviates from your regular time zone. 4-76 www.digisol.com...

  • Page 449: Clock Summer-Time (Predefined)

    DG-FS4552 User Manual Example Console(config)#clock summer-time DEST date april 1 2007 23 23 april 23 2007 23 23 60 Console(config)# Related Commands show sntp (4-70) clock summer-time (predefined) This command configures the summer time (daylight savings time) status and settings for the switch using predefined configurations for several major regions of the world.

  • Page 450: Clock Summer-Time (Recurring)

    • e-hour - The hour when summer time will end. (Range: 0-23 hours) • e-minute - The minute when summer time will end. (Range: 0-59 minutes) • offset - Summer-time offset from the regular time zone, in minutes. (Range: 0-99 minutes) Default Setting Disabled 4-78 www.digisol.com...

  • Page 451: Calendar Set

    DG-FS4552 User Manual Command Mode Global Configuration Command Usage • In some countries or regions, clocks are adjusted through the summer months so that afternoons have more daylight and mornings have less. This is known as Summer Time, or Daylight Savings Time (DST). Typically, clocks are adjusted forward one hour at the start of spring and then adjusted backward in autumn.

  • Page 452: Show Calendar

    IP address, while the Commander manages Member switches using the cluster’s “internal” IP addresses. • Once a switch has been configured to be a cluster Commander, it automatically discovers other cluster-enabled switches in the network. These “Candidate” 4-80 www.digisol.com...

  • Page 453: Cluster

    DG-FS4552 User Manual switches only become cluster Members when manually selected by the administrator through the management station. Note: Cluster Member switches can be managed either through a Telnet connection to the Commander, or through a web management connection to the Commander.

  • Page 454: Cluster Ip-Pool

    Members and are used for communication between Member switches and the Commander • You cannot change the cluster IP pool when the switch is currently in Commander mode. Commander mode must first be disabled. Example Console(config)#cluster ip-pool 10.2.3.4 Console(config)# 4-82 www.digisol.com...

  • Page 455: Cluster Member

    Commander is not supported. There is no need to enter the username and password for access to the • Member switch CLI Example Vty-0#rcommand id 1 CLI session with the DG-FS4552 is opened. To end the CLI session, enter [Exit]. Vty-0# www.digisol.com 4-83...

  • Page 456: Show Cluster

    Example Console#show cluster members Cluster Members: Role: Active member IP Address: 10.254.254.2 MAC Address: 00-17-7c-0a-e2-f1 Description: DG-FS4552 Console# show cluster candidates This command shows the discovered Candidate switches in the network. Command Mode Privileged Exec Example Console#show cluster candidates Cluster Candidates:...

  • Page 457: Upnp Device

    DG-FS4552 User Manual The commands described in this section allow the switch to advertise itself as a UPnP compliant device. When discovered by a host device, basic information about this switch can be displayed, and the web management interface accessed.

  • Page 458: Upnp Device Advertise Duration

    In the following example, the device advertise duration is set to 200 seconds. Console(config)#upnp device advertise duration 200 Console(config)# Related Commands upnp device ttl (4-85) show upnp This command displays the UPnP management status and time out settings. Command Mode Privileged Exec 4-86 www.digisol.com...

  • Page 459: Snmp Commands

    DG-FS4552 User Manual Example Console#show upnp UPnP global settings: Status: Enabled Advertise duration: TTL: Console# SNMP Commands Controls access to this switch from management stations using the Simple Network Management Protocol (SNMP), as well as the error types sent to trap managers.

  • Page 460: Snmp-Server

    This command enables the SNMPv3 engine and services for all management clients (i.e., versions 1, 2c, 3). Use the no form to disable the server. Syntax [no] snmp-server Default Setting Enabled Command Mode Global Configuration Example Console(config)#snmp-server Console(config)# 4-88 www.digisol.com...

  • Page 461: Show Snmp

    DG-FS4552 User Manual show snmp This command can be used to check the status of SNMP communications. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage This command provides information on the community access strings, counter information for SNMP input and output protocol data units, and whether or not SNMP logging has been enabled with the snmp-server enable traps command.

  • Page 462: Snmp-Server Community

    This command sets the system contact string. Use the no form to remove the system contact information. Syntax snmp-server contact string no snmp-server contact string - String that describes the system contact information. (Maximum length: 255 characters) Default Setting None Command Mode Global Configuration Example Console(config)#snmp-server contact Paul Console(config)# 4-90 www.digisol.com...

  • Page 463: Snmp-Server Location

    DG-FS4552 User Manual Related Commands snmp-server location (4-91) snmp-server location This command sets the system location string. Use the no form to remove the location string. Syntax snmp-server location text no snmp-server location text - String that describes the system location.

  • Page 464: Snmp-Server Host

    • If you do not enter an snmp-server host command, no notifications are sent. In order to configure the switch to send SNMP notifications, you must enter at least one snmp-server host command. In order to enable multiple hosts, you must issue a separate snmp-server host command for each host. 4-92 www.digisol.com...
  • Page 465 DG-FS4552 User Manual • The snmp-server host command is used in conjunction with the snmp-server enable traps command. Use the snmp-server enable traps command to enable the sending of traps or informs and to specify which SNMP notifications are sent globally. For a host to receive notifications, at least one snmp-server enable traps command and the snmp-server host command for that host must be enabled.

  • Page 466: Snmp-Server Enable Traps

    SNMP Version 3 hosts, they must be enabled in conjunction with the corresponding entries in the Notify View assigned by the snmp-server group command (page 4-98). Example Console(config)#snmp-server enable traps link-up-down Console(config)# Related Commands snmp-server host (4-92) 4-94 www.digisol.com...

  • Page 467: Snmp-Server Engine-Id

    DG-FS4552 User Manual snmp-server engine-id This command configures an identification string for the SNMPv3 engine. Use the no form to restore the default. Syntax snmp-server engine-id {local | remote {ip-address}} engineid-string no snmp-server engine-id {local | remote {ip-address}} • local - Specifies the SNMP engine on this switch.

  • Page 468: Show Snmp Engine-Id

    OID string. (Refer to the examples.) • included - Defines an included view. • excluded - Defines an excluded view. Default Setting defaultview (includes access to the entire MIB tree) Command Mode Global Configuration 4-96 www.digisol.com...

  • Page 469: Show Snmp View

    DG-FS4552 User Manual Command Usage Command Usage • Views are used in the snmp-server group command to restrict user access to specified portions of the MIB tree. • The predefined view “defaultview” includes access to the entire MIB tree. Examples This view includes MIB-2.

  • Page 470: Snmp-Server Group

    • Note that the authentication, link-up and link-down messages are legacy traps and must therefore be enabled in conjunction with the snmp-server enable traps command (page 4-94). Example Console(config)#snmp-server group r&d v3 auth write daily Console(config)# 21. No view is defined. 22. Maps to the defaultview. 4-98 www.digisol.com...

  • Page 471: Show Snmp Group

    DG-FS4552 User Manual show snmp group Four default groups are provided – SNMPv1 read-only access and read/write access, and SNMPv2c read-only access and read/write access. Command Mode Privileged Exec Example Console#show snmp group Group Name: r&d Security Model: v3 Read View: defaultview...

  • Page 472: Snmp-Server User

    • priv des56 - Uses SNMPv3 with privacy with DES56 encryption. • priv-password - Privacy password. Enter as plain text if the encrypted option is not used. Otherwise, enter an encrypted password. Default Setting None Command Mode Global Configuration 4-100 www.digisol.com...

  • Page 473: Show Snmp User

    DG-FS4552 User Manual Command Usage • The SNMP engine ID is used to compute the authentication/privacy digests from the password. You should therefore configure the engine ID with the snmp-server engine-id command before using this configuration command. • Before you configure a remote user, use the snmp-server engine-id command (page 4-95) to specify the engine ID for the remote device where the user resides.

  • Page 474: Flow Sampling Commands

    Shows the global and interface settings for the sFlow process PE 4-107 * Due to the switch’s hardware design, these commands can only be enabled for specific port groups (1-8, 9-16, 17-24, 25-32, 33-48). However, sampling for each of the Gigabit combination ports (49-52) can be controlled individually. 4-102 www.digisol.com...

  • Page 475: Sflow

    DG-FS4552 User Manual sflow This command enables sFlow globally for the switch. Use the no form to disable this feature. Syntax [no] sflow Default Setting Disabled Command Mode Global Configuration Command Usage Flow sampling must be enabled globally on the switch, as well as for those ports where it is required (see the sflow source command on page 4-103).

  • Page 476: Sflow Sample

    - The interval at which the sFlow process adds counter values to the sample datagram. (Range: 0-10000000 seconds, where 0 disables this feature) Default Setting Disabled Command Mode Interface Configuration (Ethernet) Example This example sets the polling interval to 10 seconds. Console(config)#interface ethernet 1/9 Console(config-if)#sflow polling-interval 10 Console(config-if)# 4-104 www.digisol.com...

  • Page 477: Sflow Owner

    DG-FS4552 User Manual sflow owner This command configures the name of the receiver (i.e., sFlow Collector). Use the no form to remove this name. Syntax sflow owner name no sflow owner name - The name of the receiver. (Range: 1-256 characters)

  • Page 478: Sflow Destination

    This command configures the maximum size of the sFlow datagram header. Use the no form to restore the default setting. Syntax sflow max-header-size max-header-size no max-header-size max-header-size - The maximum size of the sFlow datagram header. (Range: 64-256 bytes) Default Setting 128 bytes Command Mode Interface Configuration (Ethernet) 4-106 www.digisol.com...

  • Page 479: Sflow Max-Datagram-Size

    DG-FS4552 User Manual Example Console(config)#interface ethernet 1/9 Console(config-if)#sflow max-header-size 256 Console(config-if)# sflow max-datagram-size This command configures the maximum size of the sFlow datagram payload. Use the no form to restore the default setting. Syntax sflow max-datagram-size max-datagram-size no max-datagram-size max-datagram-size - The maximum size of the sFlow datagram payload.

  • Page 480: Authentication Commands

    Enables management access via Telnet 4-135 Secure Shell Provides a secure replacement for Telnet 4-136 Port Authentication Configures host authentication on specific ports using 802.1X 4-145 Management IP Filter Configures IP addresses that are allowed management access 4-155 4-108 www.digisol.com...

  • Page 481: User Account And Privilege Level Commands

    DG-FS4552 User Manual User Account and Privilege Level Commands The basic commands required for management access are listed in this section. This switch also includes other options for password checking via the console or a Telnet connection (page 4-44), user authentication via a remote authentication server (page 4-108), and host access authentication for specific ports (page 4-145).

  • Page 482: Enable Password

    • You cannot set a null password. You will have to enter a password to change the command mode from Normal Exec to Privileged Exec with the enable command (page 4-12). • The encrypted password is required for compatibility with legacy password 4-110 www.digisol.com...

  • Page 483: Privilege

    DG-FS4552 User Manual settings (i.e., plain text or encrypted) when reading the configuration file during system bootup or when downloading the configuration file from an FTP/ TFTP server. There is no need for you to manually configure encrypted passwords. Example...

  • Page 484: Privilege Rerun

    - Displays the privilege level for all commands modified by the privilege command. Command Mode Privileged Exec Example This example shows the privilege level for any command modified by the privilege command. Console#show privilege command privilege line all level 0 accounting privilege exec level 15 ping Console(config)# 4-112 www.digisol.com...

  • Page 485: Authentication Sequence

    DG-FS4552 User Manual Authentication Sequence Three authentication methods can be specified to authenticate users logging into the system for management access. The commands in this section can be used to define the authentication method and sequence. Table 4-30 Authentication Sequence...

  • Page 486: Authentication Enable

    TACACS+ server. If the TACACS+ server is not available, the local user name and password is checked. Example Console(config)#authentication enable radius Console(config)# Related Commands enable password - sets the password for changing command modes (4-110) 4-114 www.digisol.com...

  • Page 487: Radius Client

    DG-FS4552 User Manual RADIUS Client Remote Authentication Dial-in User Service (RADIUS) is a logon authentication protocol that uses software running on a central server to control access to RADIUS-aware devices on the network. An authentication server contains a database of multiple user name/password pairs with associated privilege levels for each user or group that require management access to a switch.

  • Page 488: Radius-Server Acct-Port

    Use the no form to restore the default. Syntax radius-server auth-port port-number no radius-server auth-port port-number - RADIUS server UDP port used for authentication messages. (Range: 1-65535) Default Setting 1812 Command Mode Global Configuration Example Console(config)#radius-server port 181 Console(config)# 4-116 www.digisol.com...

  • Page 489: Radius-Server Key

    DG-FS4552 User Manual radius-server key This command sets the RADIUS encryption key. Use the no form to restore the default. Syntax radius-server key key-string no radius-server key key-string - Encryption key used to authenticate logon access for client. Do not use blank spaces in the string. (Maximum length: 48 characters)

  • Page 490: Radius-Server Timeout

    RADIUS server. Use the no form to restore the default. Syntax radius-server timeout number-of-seconds no radius-server timeout number-of-seconds - Number of seconds the switch waits for a reply before resending a request. (Range: 1-65535) Default Setting Command Mode Global Configuration Example Console(config)#radius-server timeout 10 Console(config)# 4-118 www.digisol.com...

  • Page 491: Show Radius-Server

    DG-FS4552 User Manual show radius-server This command displays the current settings for the RADIUS server. Default Setting None Command Mode Privileged Exec Example Console#show radius-server Remote RADIUS Server Configuration: Global Settings: Authentication Port : 1812 Accounting Port : 1813 Retransmit Times...

  • Page 492: Tacacs-Server Host

    This command specifies the TACACS+ server network port. Use the no form to restore the default. Syntax tacacs-server port port-number no tacacs-server port port-number - TACACS+ server TCP port used for authentication messages. (Range: 1-65535) Default Setting Command Mode Global Configuration 4-120 www.digisol.com...

  • Page 493: Tacacs-Server Key

    DG-FS4552 User Manual Example Console(config)#tacacs-server port 181 Console(config)# tacacs-server key This command sets the TACACS+ encryption key. Use the no form to restore the default. Syntax tacacs-server key key-string no tacacs-server key key-string - Encryption key used to authenticate logon access for the client.

  • Page 494: Tacacs-Server Timeout

    Communication Key with TACACS+ Server: Server Port Number: Retransmit Times Request Times Server 1: Server IP address: 1.2.3.4 Communication key with TACACS+ server: ***** Server port number: Retransmit Times Request Times Tacacs server group: Group Name Member Index --------------------- ------------- tacacs+ Console# 4-122 www.digisol.com...

  • Page 495: Aaa Commands

    DG-FS4552 User Manual AAA Commands The Authentication, authorization, and accounting (AAA) feature provides the main framework for configuring access control on the switch. The AAA functions require the use of configured RADIUS or TACACS+ servers in the network. Table 4-33 AAA Commands...

  • Page 496: Server

    (see page 4-115). • When specifying the index for a TACACS+ server, that server index must already be defined by the tacacs-server host command (see page 4-120). Example Console(config)#aaa group server radius tps Console(config-sg-radius)#server 10.2.68.120 Console(config-sg-radius)# 4-124 www.digisol.com...

  • Page 497: Aaa Accounting Dot1X

    DG-FS4552 User Manual aaa accounting dot1x This command enables the accounting of requested 802.1X services for network access. Use the no form to disable the accounting service. Syntax aaa accounting dot1x {default | method-name} start-stop group {radius | tacacs+ |server-group} no aaa accounting dot1x {default | method-name} •...

  • Page 498: Aaa Accounting Exec

    • Note that the default and method-name fields are only used to describe the accounting method(s) configured on the specified RADIUS or TACACS+ servers, and do not actually send any information to the servers about the methods to use. Example Console(config)#aaa accounting exec default start-stop group tacacs+ Console(config)# 4-126 www.digisol.com...

  • Page 499: Aaa Accounting Commands

    DG-FS4552 User Manual aaa accounting commands This command enables the accounting of Exec mode commands. Use the no form to disable the accounting service. Syntax aaa accounting commands level {default | method-name} start-stop group {tacacs+ |server-group} no aaa accounting commands level {default | method-name} •...

  • Page 500: Aaa Accounting Update

    • default - Specifies the default method list created with the aaa accounting dot1x command (page 4-125). • list-name - Specifies a method list created with the aaa accounting dot1x command. Default Setting None Command Mode Interface Configuration 4-128 www.digisol.com...

  • Page 501: Accounting Exec

    DG-FS4552 User Manual Example Console(config)#interface ethernet 1/2 Console(config-if)#accounting dot1x tps Console(config-if)# accounting exec This command applies an accounting method to local console or Telnet connections. Use the no form to disable accounting on the line. Syntax accounting exec {default | list-name} no accounting exec •...

  • Page 502: Aaa Authorization Exec

    • If this command is issued without a specified named method, the default method list is applied to all interfaces or lines (where this authorization type applies), except those that have a named method explicitly defined. Example Console(config)#aaa authorization exec default group tacacs+ Console(config)# 4-130 www.digisol.com...

  • Page 503: Authorization Exec

    DG-FS4552 User Manual authorization exec This command applies an authorization method to local console or Telnet connections. Use the no form to disable authorization on the line. Syntax authorization exec {default | list-name} no authorization exec • default - Specifies the default method list created with the aaa authorization exec command (page 4-130).

  • Page 504: Web Server Commands

    Use the no form to use the default port. Syntax ip http port port-number no ip http port port-number - The TCP port to be used by the browser interface. (Range: 1-65535) Default Setting Command Mode Global Configuration 4-132 www.digisol.com...

  • Page 505: Ip Http Server

    DG-FS4552 User Manual Example Console(config)#ip http port 769 Console(config)# Related Commands ip http server (4-133) ip http server This command allows this device to be monitored or configured from a browser. Use the no form to disable this function. Syntax...

  • Page 506: Ip Http Secure-Port

    This command specifies the UDP port number used for HTTPS connection to the switch’s web interface. Use the no form to restore the default port. Syntax ip http secure-port port-number no ip http secure-port port-number – The UDP port used for HTTPS. (Range: 1-65535) Default Setting Command Mode Global Configuration 4-134 www.digisol.com...

  • Page 507: Telnet Server Commands

    DG-FS4552 User Manual Command Usage • You cannot configure the HTTP and HTTPS servers to use the same port. • If you change the HTTPS port number, clients attempting to connect to the HTTPS server must specify the port number in the URL, in this format:...

  • Page 508: Secure Shell Commands

    Generate a Host Key Pair – Use the ip ssh crypto host-key generate command to create a host public/private key pair. Provide Host Public Key to Clients – Many SSH client programs automatically import the host public key during the initial connection setup with the switch. 4-136 www.digisol.com...
  • Page 509 DG-FS4552 User Manual Otherwise, you need to manually create a known hosts file on the management station and place the host public key in it. An entry for a public key in the known hosts file would appear similar to the following example: 10.1.0.54 1024 35 15684995401867669259333946775054617325313674890836547254...

  • Page 510: Ip Ssh Server

    DES (56-bit) or 3DES (168-bit) for data encryption. • You must generate the host key before enabling the SSH server. Example Console#ip ssh crypto host-key generate dsa Console#configure Console(config)#ip ssh server Console(config)# 4-138 www.digisol.com...

  • Page 511: Ip Ssh Timeout

    DG-FS4552 User Manual Related Commands ip ssh crypto host-key generate (4-141) show ssh (4-143) ip ssh timeout This command configures the timeout for the SSH server. Use the no form to restore the default setting. Syntax ip ssh timeout seconds no ip ssh timeout seconds –...

  • Page 512: Ip Ssh Server-Key Size

    • username – Name of an SSH user. (Range: 1-8 characters) • dsa – DSA public key type. • rsa – RSA public key type. Default Setting Deletes both the DSA and RSA key. Command Mode Privileged Exec 4-140 www.digisol.com...

  • Page 513: Ip Ssh Crypto Host-Key Generate

    DG-FS4552 User Manual Example Console#delete public-key admin dsa Console# ip ssh crypto host-key generate This command generates the host key pair (i.e., public and private). Syntax ip ssh crypto host-key generate [dsa | rsa] • dsa – DSA (Version 2) key type.

  • Page 514: Ip Ssh Save Host-Key

    Privileged Exec Example Console#ip ssh save host-key dsa Console# Related Commands ip ssh crypto host-key generate (4-141) show ip ssh This command displays the connection settings used when authenticating client access to the SSH server. Command Mode Privileged Exec 4-142 www.digisol.com...

  • Page 515: Show Ssh

    DG-FS4552 User Manual Example Console#show ip ssh SSH Enabled - version 1.99 Negotiation timeout: 120 secs; Authentication retries: 3 Server key size: 768 bits Console# show ssh This command displays the current SSH server connections. Command Mode Privileged Exec Example...

  • Page 516: Show Public-Key

    SSH is based on the Digital Signature Standard (DSS), and the last string is the encoded modulus. Example Console#show public-key host Host: RSA: 1024 35 1568499540186766925933394677505461732531367489083654725415020245593199868 5443583616519999233297817660658309586108259132128902337654680172627257141 3428762941301196195566782595664104869574278881462065194174677298486546861 5717739390164779355942303577413098022737087794545240839717526463580581767 16709574804776117 DSA: ssh-dss AAAB3NzaC1kc3MAAACBAPWKZTPbsRIB8ydEXcxM3dyV/yrDbKStIlnzD/Dg0h2Hxc YV44sXZ2JXhamLK6P8bvuiyacWbUW/a4PAtp1KMSdqsKeh3hKoA3vRRSy1N2XFfAKxl5fwFfv JlPdOkFgzLGMinvSNYQwiQXbKTBH0Z4mUZpE85PWxDZMaCNBPjBrRAAAAFQChb4vsdfQGNIjw bvwrNLaQ77isiwAAAIEAsy5YWDC99ebYHNRj5kh47wY4i8cZvH+/p9cnrfwFTMU01VFDly3IR 2G395NLy5Qd7ZDxfA9mCOfT/yyEfbobMJZi8oGCstSNOxrZZVnMqWrTYfdrKX7YKBw/Kjw6Bm iFq7O+jAhf1Dg45loAc27s6TLdtny1wRq/ow2eTCD5nekAAACBAJ8rMccXTxHLFAczWS7EjOy DbsloBfPuSAb4oAsyjKXKVYNLQkTLZfcFRu41bS2KV5LAwecsigF/+DjKGWtPNIQqabKgYCw2 o/dVzX4Gg+yqdTlYmGA7fHGm8ARGeiG4ssFKy4Z6DmYPXFum1Yg0fhLwuHpOSKdxT3kk475S7 Console# 4-144 www.digisol.com...

  • Page 517: 802.1X Port Authentication

    DG-FS4552 User Manual 802.1X Port Authentication The switch supports IEEE 802.1X (dot1x) port-based access control that prevents unauthorized access to the network by requiring users to first submit credentials for authentication. Client authentication is controlled centrally by a RADIUS server using EAP (Extensible Authentication Protocol).

  • Page 518: Dot1X Default

    RADIUS server. Clients that are not dot1x-aware will be denied access. • force-authorized – Configures the port to grant access to all clients, either dot1x-aware or otherwise. • force-unauthorized – Configures the port to deny access to all clients, either dot1x-aware or otherwise. 4-146 www.digisol.com...

  • Page 519: Dot1X Operation-Mode

    DG-FS4552 User Manual Default force-authorized Command Mode Interface Configuration Command Usage • 802.1X port authentication and port security cannot be configured together on the same port. Only one of these security mechanisms can be applied. • 802.1X port authentication cannot be configured on trunk ports. In other words, a static trunk or dynamically configured trunk cannot be set to auto or force-unauthorized mode.

  • Page 520: Dot1X Re-Authenticate

    Only if re-authentication fails is the port blocked or the user assigned to the Guest VLAN (see dot1x intrusion-action on page 4-151). Example Console#dot1x re-authenticate Console# 4-148 www.digisol.com...

  • Page 521: Dot1X Re-Authentication

    DG-FS4552 User Manual dot1x re-authentication This command enables periodic re-authentication globally for all ports. Use the no form to disable re-authentication. Syntax [no] dot1x re-authentication Command Mode Interface Configuration Command Usage • The re-authentication process verifies the connected client’s user ID and password on the RADIUS server.

  • Page 522: Dot1X Timeout Re-Authperiod

    Syntax dot1x timeout tx-period seconds no dot1x timeout tx-period seconds - The number of seconds. (Range: 1-65535) Default 30 seconds Command Mode Interface Configuration Example Console(config)#interface eth 1/2 Console(config-if)#dot1x timeout tx-period 300 Console(config-if)# 4-150 www.digisol.com...

  • Page 523: Dot1X Timeout Supp-Timeout

    DG-FS4552 User Manual dot1x timeout supp-timeout This command sets the time that an interface on the switch waits for a response to an EAP request from a client before re-transmitting an EAP packet. Use the no form to reset to the default value.

  • Page 524: Show Dot1X

    – Time a port waits after Max Request Count is exceeded before attempting to acquire a new client (page 4-149). - tx-period – Time a port waits during authentication session before re-transmitting EAP packet (page 4-150). - supplicant-timeout – Supplicant timeout. 4-152 www.digisol.com...
  • Page 525 DG-FS4552 User Manual - server-timeout – Server timeout. - reauth-max – Maximum number of reauthentication attempts. - max-req – Maximum number of times a port will retransmit an EAP request/identity packet to the client before it times out the authentication session (page 4-146).
  • Page 526 Status Authorized Operation mode Single-Host Max count Port-control Auto Supplicant 00-24-8C-0f-fa-dc Current Identifier Intrusion action Guest VLAN Authenticator State Machine State Authenticated Reauth Count Backend State Machine State Idle Request Count Identifier(Server) Reauthentication State Machine State Initialize 4-154 www.digisol.com...

  • Page 527: Management Ip Filter Commands

    DG-FS4552 User Manual Management IP Filter Commands This section describes commands used to configure IP management access to the switch. Table 4-40 IP Filter Commands Command Function Mode Page management Configures IP addresses that are allowed management access GC 4-155...

  • Page 528: Show Management

    End IP address ----------------------------------------------- 1. 192.168.1.19 192.168.1.19 2. 192.168.1.25 192.168.1.30 SNMP-Client: Start IP address End IP address ----------------------------------------------- 1. 192.168.1.19 192.168.1.19 2. 192.168.1.25 192.168.1.30 TELNET-Client: Start IP address End IP address ----------------------------------------------- 1. 192.168.1.19 192.168.1.19 2. 192.168.1.25 192.168.1.30 Console# 4-156 www.digisol.com...

  • Page 529: General Security Measures

    DG-FS4552 User Manual General Security Measures This switch supports many methods of segregating traffic for clients attached to each of the data ports, and for ensuring that only authorized clients gain access to the network. Private VLANs and port-based authentication using IEEE 802.1X are commonly used for these purposes.

  • Page 530: Port Security Commands

    - address-count - The maximum number of MAC addresses that can be learned on a port. (Range: 0 - 1024, where 0 means disabled) Default Setting • Status: Disabled • Action: None • Maximum Addresses: 0 Command Mode Interface Configuration (Ethernet) 4-158 www.digisol.com...
  • Page 531 DG-FS4552 User Manual Command Usage • If you enable port security, the switch stops learning new MAC addresses on the specified port when it has reached a configured maximum number. Only incoming traffic with source addresses already stored in the dynamic or static address table will be accepted.

  • Page 532: Table 4-43 Network Access

    Displays the MAC authentication settings for port 4-170 interfaces show network-access Displays information for entries in the secure MAC 4-171 mac-address-table address table show network-access Displays information for entries in the MAC filter tables 4-172 mac-filter 4-160 www.digisol.com...

  • Page 533: Network-Access Aging

    DG-FS4552 User Manual network-access aging Use this command to enable aging for authenticated MAC addresses stored in the secure MAC address table. Use the no form of this command to disable address aging. Syntax [no] network-access aging Default Setting Disabled...

  • Page 534: Network-Access Port-Mac-Filter

    Use the no form of this command to restore the default. Syntax network-access max-mac-count count no network-access max-mac-count count - The maximum number of authenticated MAC addresses allowed. (Range: 1 to 2048; 0 for unlimited) 4-162 www.digisol.com...

  • Page 535: Network-Access Mode

    DG-FS4552 User Manual Default Setting 2048 Command Mode Interface Configuration Command Usage The maximum number of MAC addresses per port is 2048, and the maximum number of secure MAC addresses supported for the switch system is 1024. When the limit is reached, all new MAC addresses are treated as authentication failures.

  • Page 536: Mac-Authentication Reauth-Time

    • The reauthentication time is a global setting and applies to all ports. • When the reauthentication time expires for a secure MAC address it is reauthenticated with the RADIUS server. During the reauthentication process traffic through the port remains unaffected. Example Console(config)#mac-authentication reauth-time 300 Console(config)# 4-164 www.digisol.com...

  • Page 537: Mac-Authentication Intrusion-Action

    DG-FS4552 User Manual mac-authentication intrusion-action Use this command to configure the port response to a host MAC authentication failure. Use the no form of this command to restore the default. Syntax mac-authentication intrusion-action [block traffic | pass traffic] no mac-authentication intrusion-action...

  • Page 538: Network-Access Dynamic-Vlan

    Use this command to assign all traffic on a port to a guest VLAN when network access (MAC authentication) or 802.1X authentication is rejected. Use the no form of this command to disable guest VLAN assignment. Syntax network-access guest-vlan vlan-id no network-access guest-vlan vlan-id - VLAN ID (Range: 1-4094) Default Setting Disabled 4-166 www.digisol.com...

  • Page 539: Table 4-44 Dynamic Qos Profiles

    DG-FS4552 User Manual Command Mode Interface Configuration Command Usage • The VLAN to be used as the guest VLAN must be defined and set as active (“vlan database” on page 4-298). • When used with 802.1X authentication, the intrusion-action must be set for ‘guest-vlan’...

  • Page 540: Network-Access Link-Detection

    SNMP trap, or both. Use the no form of this command to disable this feature. Syntax network-access link-detection link-down action [shutdown | trap | trap-and-shutdown] no network-access link-detection Default Setting Disabled Command Mode Interface Configuration 4-168 www.digisol.com...

  • Page 541: Network-Access Link-Detection Link-Up

    DG-FS4552 User Manual Example Console(config)#interface ethernet 1/1 Console(config-if)#network-access link-detection link-down action trap Console(config-if)# network-access link-detection link-up Use this command to detect link-up events. When detected, the switch can shut down the port, send an SNMP trap, or both. Use the no form of this command to disable this feature.

  • Page 542: Clear Network-Access

    [interface interface] interface - Specifies a port interface. ethernet unit/port • unit - This is unit 1. • port - Port number. (Range: 1-52) Default Setting Displays the settings for all interfaces. Command Mode Privileged Exec 4-170 www.digisol.com...

  • Page 543: Show Network-Access Mac-Address-Table

    DG-FS4552 User Manual Example Console#show network-access interface ethernet 1/1 Global secure port information Reauthentication Time : 1800 -------------------------------------------------- -------------------------------------------------- Port : 1/1 MAC Authentication : Disabled MAC Authentication Intrusion action : Block traffic MAC Authentication Maximum MAC Counts : 1024...

  • Page 544: Show Network-Access Mac-Filter

    [filter-id] filter-id - Specifies a MAC address filter table. (Range: 1-64) Default Setting Displays all filters. Command Mode Privileged Exec Example Console#sh network-access mac-filter Filter ID MAC Address MAC Mask --------- ----------------- ----------------- 1 00-00-01-02-03-08 FF-FF-FF-FF-FF-FF Console# 4-172 www.digisol.com...

  • Page 545: Table 4-45 Web Authentication

    DG-FS4552 User Manual Web Authentication Web authentication allows stations to authenticate and access the network in situations where 802.1X or Network Access authentication are infeasible or impractical. The web authentication feature allows unauthenticated hosts to request and receive a DHCP assigned IP address and perform DNS queries. All other traffic, except for HTTP protocol traffic, is blocked.

  • Page 546: Web-Auth Quiet-Period

    Use the no form to restore the default. Syntax web-auth session-timeout timeout no web-auth session timeout timeout - The amount of time that an authenticated session remains valid. (Range: 300-3600 seconds) Default Setting 3600 seconds 4-174 www.digisol.com...

  • Page 547: Web-Auth System-Auth-Control

    DG-FS4552 User Manual Command Mode Global Configuration Example Console(config)#web-auth session-timeout 1800 Console(config)# web-auth system-auth-control This command globally enables web authentication for the switch. Use the no form to restore the default. Syntax [no] web-auth system-auth-control Default Setting Disabled Command Mode...

  • Page 548: Web-Auth Re-Authenticate (Port)

    - unit - This is unit 1. - port - Port number. (Range: 1-52) • ip - IPv4 formatted IP address Default Setting None Command Mode Privileged Exec Example Console#web-auth re-authenticate interface ethernet 1/2 192.168.1.5 Failed to reauth port. Console# 4-176 www.digisol.com...

  • Page 549: Show Web-Auth

    DG-FS4552 User Manual show web-auth This command displays global web authentication parameters. Command Mode Privileged Exec Example Console#show web-auth Global Web-Auth Parameters System Auth Control : Enabled Session Timeout : 3600 Quiet Period : 60 Max Login Attempts Console# show web-auth interface This command displays interface-specific web authentication parameters and statistics.

  • Page 550: Table 4-46 Dhcp Snooping Commands

    Removes all dynamically learned snooping entries from flash 4-185 database flash memory. show ip dhcp snooping Shows the DHCP snooping configuration settings 4-185 show ip dhcp snooping Shows the DHCP snooping binding table entries 4-185 binding 4-178 www.digisol.com...

  • Page 551: Ip Dhcp Snooping

    DG-FS4552 User Manual ip dhcp snooping This command enables DHCP snooping globally. Use the no form to restore the default setting. Syntax [no] ip dhcp snooping Default Setting Disabled Command Mode Global Configuration Command Usage • Network traffic may be disrupted when malicious DHCP messages are received from an outside source.

  • Page 552: Ip Dhcp Snooping Vlan

    - ID of a configured VLAN (Range: 1-4094) Default Setting Disabled Command Mode Global Configuration Command Usage • When DHCP snooping enabled globally using the ip dhcp snooping command (page 4-179), and enabled on a VLAN with this command, DHCP 4-180 www.digisol.com...

  • Page 553: Ip Dhcp Snooping Trust

    DG-FS4552 User Manual packet filtering will be performed on any untrusted ports within the VLAN as specified by the ip dhcp snooping trust command (page 4-181). • When the DHCP snooping is globally disabled, DHCP snooping can still be configured for specific VLANs, but the changes will not take effect until DHCP snooping is globally re-enabled.

  • Page 554: Ip Dhcp Snooping Verify Mac-Address

    Ethernet header of the packet is not same as the client’s hardware address in the DHCP packet, the packet is dropped. Example This example enables MAC address verification. Console(config)#ip dhcp snooping verify mac-address Console(config)# Related Commands ip dhcp snooping (4-179) ip dhcp snooping vlan (4-180) ip dhcp snooping trust (4-181) 4-182 www.digisol.com...

  • Page 555: Ip Dhcp Snooping Information Option

    DG-FS4552 User Manual ip dhcp snooping information option This command enables the DHCP Option 82 information relay for the switch. Use the no form to disable this function. Syntax [no] ip dhcp snooping information option Default Setting Disabled Command Mode...

  • Page 556: Ip Dhcp Snooping Information Policy

    These entries will be restored to the snooping table when the switch is reset. However, note that the lease time shown for a dynamic entry that has been restored from flash memory will no longer be valid. Example Console(config)#ip dhcp snooping database flash Console(config)# 4-184 www.digisol.com...

  • Page 557: Clear Ip Dhcp Snooping Database Flash

    DG-FS4552 User Manual clear ip dhcp snooping database flash This command removes all dynamically learned snooping entries from flash memory. Command Mode Privileged Exec Example Console(config)#ip dhcp snooping database flash Console(config)# show ip dhcp snooping This command shows the DHCP snooping configuration settings.

  • Page 558: Table 4-47 Ip Source Guard Commands

    Use the “sip-mac” option to check these same parameters, plus the source MAC address. Use the no source guard command to disable this function on the selected port. 4-186 www.digisol.com...
  • Page 559 DG-FS4552 User Manual • When enabled, traffic is filtered based upon dynamic entries learned via DHCP snooping, or static addresses configured in the source guard binding table. • Table entries include a MAC address, IP address, lease time, entry type (Static-IP-SG-Binding, Dynamic-DHCP-Binding, VLAN identifier, and port identifier.

  • Page 560: Ip Source-Guard Binding

    IP source guard binding. Example This example configures a static source-guard binding on port 5. Console(config)#ip source-guard binding 11-22-33-44-55-66 vlan 1 192.168.0.99 interface ethernet 1/5 Console(config-if)# 4-188 www.digisol.com...

  • Page 561: Show Ip Source-Guard

    DG-FS4552 User Manual Related Commands ip source-guard (4-186) ip dhcp snooping (4-179) ip dhcp snooping vlan (4-180) show ip source-guard This command shows whether source guard is enabled or disabled on each interface. Command Mode Privileged Exec Example Console#show ip source-guard...

  • Page 562: Table 4-48 Arp Inspection Commands

    Shows statistics about the number of ARP packets processed, 4-198 statistics or dropped for various reasons ip arp inspection This command enables ARP Inspection globally on the switch. Use the no form to disable this function. Syntax [no] ip arp inspection Default Setting Disabled 4-190 www.digisol.com...

  • Page 563: Ip Arp Inspection Vlan

    DG-FS4552 User Manual Command Mode Global Configuration Command Usage • When ARP Inspection is enabled globally with this command, it becomes active only on those VLANs where it has been enabled with the ip arp inspection vlan command (page 4-191).

  • Page 564: Ip Arp Inspection Filter

    • If static mode is enabled, the switch compares ARP packets to the specified ARP ACLs. Packets matching an IP-to-MAC address binding in a permit or deny rule are processed accordingly. Packets not matching any of the ACL rules are dropped. Address bindings in the DHCP snooping database are not checked. 4-192 www.digisol.com...

  • Page 565: Ip Arp Inspection Validate

    DG-FS4552 User Manual • If static mode is not enabled, packets are first validated against the specified ARP ACL. Packets matching a deny rule are dropped. All remaining packets are validated against the address bindings in the DHCP snooping database.

  • Page 566: Ip Arp Inspection Log-Buffer Logs

    • The switch generates a system message on a rate-controlled basis determined by the seconds values. After the system message is generated, all entries are cleared from the log buffer. Example Console(config)#ip arp inspection log-buffer logs 1 interval 10 Console(config)# 4-194 www.digisol.com...

  • Page 567: Ip Arp Inspection Trust

    DG-FS4552 User Manual ip arp inspection trust This command sets a port as trusted, and thus exempted from ARP Inspection. Use the no form to restore the default setting. Syntax [no] ip arp inspection trust Default Setting Untrusted Command Mode...

  • Page 568: Show Ip Arp Inspection Configuration

    • unit - Stack unit. (Range: 1) • port - Port number. (Range: 1-52) Command Mode Privileged Exec Example Console#show ip arp inspection interface ethernet 1/1 Port Number Trust Status Limit Rate (pps) ------------- -------------------- ------------------------------ Eth 1/1 trusted Console# 4-196 www.digisol.com...

  • Page 569: Show Ip Arp Inspection Vlan

    DG-FS4552 User Manual show ip arp inspection vlan This command shows the configuration settings for VLANs, including ARP Inspection status, the ARP ACL name, and if the DHCP Snooping database is used after ARP ACL validation is completed. Syntax show ip arp inspection vlan [vlan-id | vlan-range] •...

  • Page 570: Table 4-49 Access Control Lists

    ARP ACLs Configures ACLs based on ARP messages addresses 4-210 MAC ACLs Configures ACLs based on hardware addresses, packet format, and 4-214 Ethernet type ACL Information Displays ACLs and associated rules; shows ACLs assigned to each port 4-218 4-198 www.digisol.com...

  • Page 571: Table 4-50 Ipv4 Acl Commands

    DG-FS4552 User Manual IPv4 ACLs The commands in this section configure ACLs based on IP addresses, TCP/UDP port number, protocol type, and TCP control code. To configure IP ACLs, first create an access list containing the required permit or deny rules, and then bind the access list to one or more ports.

  • Page 572: Access-List Ip

    • To remove a rule, use the no permit or no deny command followed by the exact text of a previously configured rule. • An ACL can contain up to 100 rules. Example Console(config)#access-list ip standard david Console(config-std-acl)# 4-200 www.digisol.com...

  • Page 573: Permit, Deny (Standard Ipv4 Acl)

    DG-FS4552 User Manual Related Commands permit, deny 4-201 ip access-group (4-204) show ip access-list (4-204) permit, deny (Standard IPv4 ACL) This command adds a rule to a Standard IPv4 ACL. The rule sets a filter condition for packets emanating from the specified source. Use the no form to remove a rule.

  • Page 574: Permit, Deny (Extended Ipv4 Acl)

    • control-flags – Decimal number (representing a bit string) that specifies flag bits in byte 14 of the TCP header. (Range: 0-63) • flag-bitmask – Decimal number representing the code bits to match. Default Setting None Command Mode Extended IPv4 ACL 23. Includes TCP, UDP or other protocol types. 4-202 www.digisol.com...
  • Page 575 DG-FS4552 User Manual Command Usage • All new rules are appended to the end of the list. • Address bitmasks are similar to a subnet mask, containing four integers from 0 to 255, each separated by a period. The binary mask uses 1 bits to indicate “match”...

  • Page 576: Show Ip Access-List

    • A port can only be bound to one ACL. • If a port is already bound to an ACL and you bind it to a different ACL, the switch will replace the old binding with the new one. 4-204 www.digisol.com...

  • Page 577: Show Ip Access-Group

    DG-FS4552 User Manual Example Console(config)#int eth 1/25 Console(config-if)#ip access-group david in Console(config-if)# Related Commands show ip access-list (4-204) show ip access-group This command shows the ports assigned to IPv4 ACLs. Command Mode Privileged Exec Example Console#show ip access-group Interface ethernet 1/25...

  • Page 578: Access-List Ipv6

    • To remove a rule, use the no permit or no deny command followed by the exact text of a previously configured rule. • An ACL can contain up to 64 rules. Example Console(config)#access-list ipv6 standard david Console(config-std-ipv6-acl)# Related Commands permit, deny (4-207) ipv6 access-group (4-209) show ipv6 access-list (4-209) 4-206 www.digisol.com...

  • Page 579: Permit, Deny (Standard Ipv6 Acl)

    DG-FS4552 User Manual permit, deny (Standard IPv6 ACL) This command adds a rule to a Standard IPv6 ACL. The rule sets a filter condition for packets emanating from the specified source. Use the no form to remove a rule. Syntax...

  • Page 580: Permit, Deny (Extended Ipv6 Acl)

    All new rules are appended to the end of the list. Example This example accepts any incoming packets if the destination address is 2009:DB9:2229::79/8. Console(config-ext-ipv6-acl)#permit 2009:DB9:2229::79/8 Console(config-ext-ipv6-acl)# This allows packets to any destination address when the DSCP value is 5. Console(config-ext-ipv6-acl)#permit any dscp 5 Console(config-ext-ipv6-acl)# 4-208 www.digisol.com...

  • Page 581: Show Ipv6 Access-List

    DG-FS4552 User Manual Related Commands access-list ipv6 (4-206) show ipv6 access-list This command displays the rules for configured IPv6 ACLs. Syntax show ip access-list {standard | extended} [acl-name] • standard – Specifies a standard IPv6 ACL. • extended – Specifies an extended IPv6 ACL.

  • Page 582: Table 4-52 Arp Acl Commands

    Creates a ARP ACL and enters configuration mode 4-211 permit, deny Filters packets matching a specified source or destination ARP-ACL 4-212 address in ARP messages show arp access-list Displays the rules for configured ARP ACLs 4-213 4-210 www.digisol.com...

  • Page 583: Access-List Arp

    DG-FS4552 User Manual access-list arp This command adds an ARP access list and enters ARP ACL configuration mode. Use the no form to remove the specified ACL. Syntax [no] access-list arp acl-name acl-name – Name of the ACL. (Maximum length: 16 characters)

  • Page 584: Permit, Deny (Arp Acl)

    This rule permits packets from any source IP and MAC address to the destination subnet address 192.168.0.0. Console(config-arp-acl)#$permit response ip any 192.168.0.0 255.255.0.0 mac any any Console(config-mac-acl)# 24. For all bitmasks, binary “1” means care and “0” means ignore. 4-212 www.digisol.com...

  • Page 585: Show Arp Access-List

    DG-FS4552 User Manual Related Commands access-list arp (4-211) show arp access-list This command displays the rules for configured ARP ACLs. Syntax show arp access-list [acl-name] acl-name – Name of the ACL. (Maximum length: 16 characters) Command Mode Privileged Exec Example...

  • Page 586: Table 4-53 Mac Acl Commands

    • To remove a rule, use the no permit or no deny command followed by the exact text of a previously configured rule. • An ACL can contain up to 64 rules. Example Console(config)#access-list mac jerry Console(config-mac-acl)# Related Commands permit, deny (4-215) mac access-group (4-217) show mac access-list (4-216) 4-214 www.digisol.com...

  • Page 587: Permit, Deny (Mac Acl)

    DG-FS4552 User Manual permit, deny (MAC ACL) This command adds a rule to a MAC ACL. The rule filters packets matching a specified MAC source or destination address (i.e., physical layer address), or Ethernet protocol type. Use the no form to remove a rule.

  • Page 588: Show Mac Access-List

    [acl-name] acl-name – Name of the ACL. (Maximum length: 16 characters) Command Mode Privileged Exec Example Console#show mac access-list MAC access-list jerry: permit any 00-e0-29-94-34-de ethertype 0800 Console# Related Commands permit, deny 4-215 mac access-group (4-217) 4-216 www.digisol.com...

  • Page 589: Mac Access-Group

    DG-FS4552 User Manual mac access-group This command binds a port to a MAC ACL. Use the no form to remove the port. Syntax mac access-group acl-name in • acl-name – Name of the ACL. (Maximum length: 16 characters) • in – Indicates that this list applies to ingress packets.

  • Page 590: Table 4-54 Acl Information

    2 2 permit any any Console# show access-group This command shows the port assignments of ACLs. Command Mode Privileged Executive Example Console#show access-group Interface ethernet 1/1 IP access-list jerry in Interface ethernet 1/28 IP access-list jerry in Console# 4-218 www.digisol.com...

  • Page 591: Table 4-55 Interface Commands

    DG-FS4552 User Manual Interface Commands These commands are used to display or set communication parameters for an Ethernet port, aggregated link, or VLAN. Table 4-55 Interface Commands Command Function Mode Page interface Configures an interface type and enters interface configuration...

  • Page 592: Interface

    This command adds a description to an interface. Use the no form to remove the description. Syntax description string no description string - Comment or a description to help you remember what is attached to this interface. (Range: 1-64 characters) Default Setting None Command Mode Interface Configuration (Ethernet, Port Channel) 4-220 www.digisol.com...

  • Page 593: Speed-Duplex

    DG-FS4552 User Manual Command Usage The description is displayed by the show interfaces status command (page 4-229) and in the running-configuration file. An example of the value which a network manager might store in this object is the name of the manufacturer, and the product name.

  • Page 594: Negotiation

    • If autonegotiation is disabled, auto-MDI/MDI-X pin signal configuration will also be disabled for the RJ-45 ports. Example The following example configures port 11 to use autonegotiation. Console(config)#interface ethernet 1/11 Console(config-if)#negotiation Console(config-if)# Related Commands capabilities (4-223) speed-duplex (4-221) 4-222 www.digisol.com...

  • Page 595: Capabilities

    DG-FS4552 User Manual capabilities This command advertises the port capabilities of a given interface during autonegotiation. Use the no form with parameters to remove an advertised capability, or the no form without parameters to restore the default values. Syntax [no] capabilities {1000full | 100full | 100half | 10full | 10half | flowcontrol | symmetric} •...

  • Page 596: Flowcontrol

    Otherwise back pressure jamming signals may degrade overall performance for the segment attached to the hub. Example The following example enables flow control on port 5. Console(config)#interface ethernet 1/5 Console(config-if)#flowcontrol Console(config-if)#no negotiation Console(config-if)# Related Commands negotiation (4-222) capabilities (flowcontrol, symmetric) (4-223) 4-224 www.digisol.com...

  • Page 597: Media-Type

    DG-FS4552 User Manual media-type This command forces the port type selected for combination ports 49-52. Use the no form to restore the default mode. Syntax media-type mode no media-type mode • copper-forced - Always uses the built-in RJ-45 port. • sfp-forced - Always uses the SFP port (even if module not installed).

  • Page 598: Shutdown

    This command allows you to disable a port due to abnormal behavior (e.g., excessive collisions), and then reenable it after the problem has been resolved. You may also want to disable a port for security reasons. Example The following example disables port 5. Console(config)#interface ethernet 1/5 Console(config-if)#shutdown Console(config-if)# 4-226 www.digisol.com...

  • Page 599: Switchport Packet-Rate

    DG-FS4552 User Manual switchport packet-rate This command configures broadcast, multicast and unknown unicast storm control. Use the no form to restore the default setting. Syntax switchport {broadcast | multicast | unicast} packet-rate rate no switchport {broadcast | multicast | unicast} •...

  • Page 600: Clear Counters

    The following example clears statistics on port 5. Console#clear counters ethernet 1/5 Console# show interfaces brief This command displays a summary of key information, including operational status, native VLAN ID, default priority, speed/duplex mode, and port type for all ports. Command Mode Privileged Exec 4-228 www.digisol.com...

  • Page 601: Show Interfaces Status

    DG-FS4552 User Manual Example Console#show interfaces brief Console#sh interfaces brief Interface Name Status PVID Pri Speed/Duplex Type Trunk --------- ------------------ -------- ---- --- ------------- ------------ ----- Eth 1/ 1 0 Auto-100full 100TX None Eth 1/ 2 Down 0 Auto 100TX...

  • Page 602: Show Interfaces Counters

    [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1) - port - Port number. (Range: 1-52) • port-channel channel-id (Range: 1-8) Default Setting Shows the counters for all interfaces. Command Mode Normal Exec, Privileged Exec 4-230 www.digisol.com...

  • Page 603: Show Interfaces Switchport

    DG-FS4552 User Manual Command Usage If no interface is specified, information on all interfaces is displayed. For a description of the items displayed by this command, see “Showing Port Statistics” on page 3-180. Example Console#show interfaces counters ethernet 1/7 Ethernet 1/7...

  • Page 604: Interfaces Switchport Statistics

    Shows if ingress filtering is enabled or disabled (page 4-302). Note: Ingress filtering is always enabled. Acceptable Frame Type Shows if acceptable VLAN frames include all types or tagged frames only (page 4-302). Native VLAN Indicates the default Port VLAN ID (page 4-303). 4-232 www.digisol.com...

  • Page 605: Table 4-57 Atc Commands

    DG-FS4552 User Manual Table 4-56 Interfaces Switchport Statistics (Continued) Field Description Priority for untagged traffic Indicates the default priority for untagged frames (page 4-357). GVRP Status Shows if GARP VLAN Registration Protocol is enabled or disabled (page 4-295). Allowed VLAN Shows the VLANs this interface has joined, where “(u)”...
  • Page 606 Shows interface configuration settings and storm control 4-247 interface status for the specified port * Enabling automatic storm control on a port will disable hardware-level storm control on the same port if configured by the switchport packet-rate command (page 4-227). 4-234 www.digisol.com...
  • Page 607 DG-FS4552 User Manual Usage Guidelines ATC includes storm control for broadcast or multicast traffic. The control response for either of these traffic types is the same, as shown in the following diagrams. Storm control by limiting the traffic rate: Traffic without storm control...

  • Page 608: Auto-Traffic-Control Apply-Timer

    • multicast - Specifies automatic storm control for multicast traffic. • seconds - The interval after the upper threshold has been exceeded at which to apply the control response. (Range: 1-300 seconds) Default Setting 300 seconds Command Mode Global Configuration 4-236 www.digisol.com...

  • Page 609: Auto-Traffic-Control Release-Timer

    DG-FS4552 User Manual Command Usage After the apply timer expires, a control action may be triggered as specified by the auto-traffic-control action command (page 4-240) and a trap message sent as specified by the snmp-server enable port-traps atc broadcast-control-apply command (page 4-244) or snmp-server enable port-traps atc multicast-control-apply command (page 4-245).

  • Page 610: Auto-Traffic-Control

    • multicast - Specifies automatic storm control for multicast traffic. • threshold - The upper threshold for ingress traffic beyond which a storm control response is triggered after the apply timer expires. (Range: 1-255 kilo-packets per second seconds) 4-238 www.digisol.com...

  • Page 611: Auto-Traffic-Control Alarm-Clear-Threshold

    DG-FS4552 User Manual Default Setting 128 kilo-packets per seconds Command Mode Interface Configuration (Ethernet) Command Usage • Once the upper threshold is exceeded, a trap message may be sent if configured by the snmp-server enable port-traps atc broadcast-alarm-fire command (page 4-242) or snmp-server enable port-traps atc multicast-alarm-fire command (page 4-243).

  • Page 612: Auto-Traffic-Control Action

    (page 4-239). • shutdown - If a control response is triggered, the port is administratively disabled. A port disabled by automatic traffic control can only be manually re-enabled. Default Setting rate-control Command Mode Interface Configuration (Ethernet) 4-240 www.digisol.com...

  • Page 613: Auto-Traffic-Control Control-Release

    DG-FS4552 User Manual Command Usage • When the upper threshold is exceeded and the apply timer expires, a control response will be triggered based on this command. • When the control response is set to rate limiting by this command, the rate limits are determined by the auto-traffic-control alarm-clear-threshold command (page 4-239).

  • Page 614: Auto-Traffic-Control Auto-Control-Release

    Use the no form to disable this trap. Syntax [no] snmp-server enable port-traps atc broadcast-alarm-fire Default Setting Disabled Command Mode Interface Configuration (Ethernet) Example Console(config)#interface ethernet 1/1 Console(config-if)#snmp-server enable port-traps atc broadcast-alarm-fire Console(config-if)# Related Commands auto-traffic-control alarm-fire-threshold (4-238) 4-242 www.digisol.com...

  • Page 615: Snmp-Server Enable Port-Traps Atc Multicast-Alarm-Fire

    DG-FS4552 User Manual snmp-server enable port-traps atc multicast-alarm-fire This command sends a trap when multicast traffic exceeds the upper threshold for automatic storm control. Use the no form to disable this trap. Syntax [no] snmp-server enable port-traps atc multicast-alarm-fire Default Setting...

  • Page 616: Snmp-Server Enable Port-Traps Atc Multicast-Alarm-Clear

    Use the no form to disable this trap. Syntax [no] snmp-server enable port-traps atc broadcast-control-apply Default Setting Disabled Command Mode Interface Configuration (Ethernet) Example Console(config)#interface ethernet 1/1 Console(config-if)#snmp-server enable port-traps atc broadcast-control-apply Console(config-if)# Related Commands auto-traffic-control alarm-fire-threshold (4-238) auto-traffic-control apply-timer (4-236) 4-244 www.digisol.com...

  • Page 617: Snmp-Server Enable Port-Traps Atc Multicast-Control-Apply

    DG-FS4552 User Manual snmp-server enable port-traps atc multicast-control-apply This command sends a trap when multicast traffic exceeds the upper threshold for automatic storm control and the apply timer expires. Use the no form to disable this trap. Syntax [no] snmp-server enable port-traps atc multicast-control-apply...

  • Page 618: Snmp-Server Enable Port-Traps Atc Multicast-Control-Release

    This command shows global configuration settings for automatic storm control. Command Mode Privileged Exec Example Console#show auto-traffic-control Storm-control: Broadcast Apply-timer (sec) : 300 release-timer (sec) : 900 Storm-control: Multicast Apply-timer(sec) : 300 release-timer(sec) : 900 Console# 4-246 www.digisol.com...

  • Page 619: Show Auto-Traffic-Control Interface

    DG-FS4552 User Manual show auto-traffic-control interface This command shows interface configuration settings and storm control status for the specified port. Syntax show auto-traffic-control interface [interface] interface ethernet unit/port - unit - Stack unit. (Range: 1) - port - Port number. (Range: 1-52)

  • Page 620: Table 4-58 Link Aggregation Commands

    (Ports 49-52) can also be trunked together, including those of different media types. • All the ports in a trunk have to be treated as a whole when moved from/to, added or deleted from a VLAN via the specified port-channel. 4-248 www.digisol.com...

  • Page 621: Channel-Group

    DG-FS4552 User Manual • STP, VLAN, and IGMP settings can only be made for the entire trunk via the specified port-channel. Dynamically Creating a Port Channel – Ports assigned to a common port channel must meet the following criteria: • Ports must have the same LACP system priority.

  • Page 622: Lacp

    • If more than eight ports attached to the same target switch have LACP enabled, the additional ports will be placed in standby mode, and will only be enabled if one of the active links fails. 4-250 www.digisol.com...

  • Page 623: Lacp System-Priority

    DG-FS4552 User Manual Example The following shows LACP enabled on ports 11-13. Because LACP has also been enabled on the ports at the other end of the links, the show interfaces status port-channel 1 command shows that Trunk 1 has been established.

  • Page 624: Lacp Admin-Key (Ethernet Interface)

    (i.e., it has the null value of 0), this key is set to the same value as the port admin key (lacp admin key - Ethernet Interface) used by the interfaces that joined the group. 4-252 www.digisol.com...

  • Page 625: Lacp Admin-Key (Port Channel)

    DG-FS4552 User Manual • Once the remote side of a link has been established, LACP operational settings are already in use on that side. Configuring LACP settings for the partner only applies to its administrative state, not its operational state, and will only take effect the next time an aggregate link is established with the partner.

  • Page 626: Lacp Port-Priority

    Configuring LACP settings for the partner only applies to its administrative state, not its operational state, and will only take effect the next time an aggregate link is established with the partner. Example Console(config)#interface ethernet 1/5 Console(config-if)#lacp actor port-priority 128 4-254 www.digisol.com...

  • Page 627: Lacp Active/Passive

    DG-FS4552 User Manual lacp active/passive This command configures active or passive LACP initiation mode. Use the no form to restore the default setting. Syntax lacp {actor | partner} {active | passive} no lacp {actor | partner} • actor - The local side of an aggregate link.

  • Page 628: Table 4-59 Show Lacp Counters - Display Description

    Protocols group MAC Address, but do not carry the Slow Protocols Ethernet Type. LACPDUs Illegal Pkts Number of frames that carry the Slow Protocols Ethernet Type value, but contain a badly formed PDU or an illegal value of Protocol Subtype. 4-256 www.digisol.com...

  • Page 629: Show Lacp Internal - Display Description

    DG-FS4552 User Manual Console#show lacp 1 internal Port channel : 1 ------------------------------------------------------------------------- Oper Key : 4 Admin Key : 0 Eth 1/1 ------------------------------------------------------------------------- LACPDUs Internal : 30 sec LACP System Priority : 32768 LACP Port Priority : 32768 Admin Key : 4...

  • Page 630: Table 4-61 Show Lacp Neighbors - Display Description

    Current administrative value of the Key for the protocol partner. Oper Key Current operational value of the Key for the protocol partner. Admin State Administrative values of the partner’s state parameters. (See preceding table.) Oper State Operational values of the partner’s state parameters. (See preceding table.) 4-258 www.digisol.com...

  • Page 631: Show Lacp Sysid - Display Description

    DG-FS4552 User Manual Console#show lacp sysid Port Channel System Priority System MAC Address ------------------------------------------------------------------------- 32768 00-17-7C-0A-E2-F1 32768 00-17-7C-0A-E2-F1 32768 00-17-7C-0A-E2-F1 32768 00-17-7C-0A-E2-F1 Console# Table 4-62 show lacp sysid - display description Field Description Channel group A link aggregation group configured on this switch.

  • Page 632: Table 4-63 Mirror Port Commands

    • Set the destination port by specifying an Ethernet interface with the interface configuration command, and then use the port monitor command to specify the source of the traffic to mirror. 4-260 www.digisol.com...

  • Page 633: Show Port Monitor

    DG-FS4552 User Manual • When mirroring traffic from a port, the mirror port and monitor port speeds should match, otherwise traffic may be dropped from the monitor port. When mirroring traffic from a VLAN, traffic may also be dropped under heavy loads.
  • Page 634 Command Line Interface Example The following shows mirroring configured from port 6 to port 11: Console(config)#interface ethernet 1/11 Console(config-if)#port monitor ethernet 1/6 rx Console(config-if)#end Console#show port monitor Port Mirroring ------------------------------------- Destination port(listen port):Eth1/11 Source port(monitored port) :Eth1/6 Mode Console# 4-262 www.digisol.com...

  • Page 635: Table 4-64 Rate Limit Commands

    DG-FS4552 User Manual Rate Limit Commands This function allows the network manager to control the maximum rate for traffic transmitted or received on an interface. Rate limiting is configured on interfaces at the edge of a network to limit traffic into the network. Packets that exceed the acceptable amount of traffic are dropped.

  • Page 636: Table 4-65 Address Table Commands

    • vlan-id - VLAN ID (Range: 1-4094) • action - - delete-on-reset - Assignment lasts until the switch is reset. - permanent - Assignment is permanent. Default Setting No static addresses are defined. The default mode is permanent. Command Mode Global Configuration 4-264 www.digisol.com...

  • Page 637: Clear Mac-Address-Table Dynamic

    DG-FS4552 User Manual Command Usage The static address for a host device can be assigned to a specific port within a specific VLAN. Use this command to add static addresses to the MAC Address Table. Static addresses have the following characteristics: •...

  • Page 638: Show Mac-Address-Table

    00-00-00-00-00-00 means an exact match, and a mask of FF-FF-FF-FF-FF-FF means “any.” • The maximum number of address entries is 8191. Example Console#show mac-address-table Interface Mac Address Vlan Type --------- ----------------- ---- ----------------- Eth 1/1 00-11-22-33-44-55 Delete-on-reset Trunk 2 00-11-22-55-44-33 Learned Console# 4-266 www.digisol.com...

  • Page 639: Mac-Address-Table Aging-Time

    DG-FS4552 User Manual mac-address-table aging-time This command sets the aging time for entries in the address table. Use the no form to restore the default aging time. Syntax mac-address-table aging-time seconds no mac-address-table aging-time seconds - Aging time. (Range: 10-30000 seconds; 0 to disable aging)

  • Page 640: Table 4-66 Spanning Tree Commands

    Floods BPDUs to other ports when global spanning tree is 4-284 port-bpdu-flooding disabled spanning-tree root-guard Prevents a designated port from passing superior BPDUs IC 4-285 spanning-tree link-type Configures the link type for RSTP/MSTP 4-286 spanning-tree Enables BPDU loopback detection for a port 4-286 loopback-detection 4-268 www.digisol.com...

  • Page 641: Spanning-Tree

    DG-FS4552 User Manual Table 4-66 Spanning Tree Commands (Continued) Command Function Mode Page spanning-tree Configures loopback release mode for a port 4-287 loopback-detection release-mode spanning-tree Enables BPDU loopback SNMP trap notification for a port IC 4-288 loopback-detection trap spanning-tree mst cost...

  • Page 642: Spanning-Tree Mode

    - A spanning tree instance can exist only on bridges that have compatible VLAN instance assignments. - Be careful when switching between spanning tree modes. Changing modes stops all spanning-tree instances for the previous mode and restarts the system in the new mode, temporarily disrupting user traffic. 4-270 www.digisol.com...

  • Page 643: Spanning-Tree Forward-Time

    DG-FS4552 User Manual Example The following example configures the switch to use Rapid Spanning Tree: Console(config)#spanning-tree mode rstp Console(config)# spanning-tree forward-time This command configures the spanning tree bridge forward time globally for this switch. Use the no form to restore the default.

  • Page 644: Spanning-Tree Max-Age

    LAN. If it is a root port, a new root port is selected from among the device ports attached to the network. Example Console(config)#spanning-tree max-age 40 Console(config)# Related Commands spanning-tree forward-time (4-271) spanning-tree hello-time (4-271) 4-272 www.digisol.com...

  • Page 645: Spanning-Tree Priority

    DG-FS4552 User Manual spanning-tree priority This command configures the spanning tree priority globally for this switch. Use the no form to restore the default. Syntax spanning-tree priority priority no spanning-tree priority priority - Priority of the bridge. (Range – 0-61440, in steps of 4096; Options: 0, 4096, 8192, 12288,...

  • Page 646: Spanning-Tree Pathcost Method

    This command configures the minimum interval between the transmission of consecutive RSTP/MSTP BPDUs. Use the no form to restore the default. Syntax spanning-tree transmission-limit count no spanning-tree transmission-limit count - The transmission limit in seconds. (Range: 1-10) Default Setting 4-274 www.digisol.com...

  • Page 647: Spanning-Tree Mst-Configuration

    DG-FS4552 User Manual Command Mode Global Configuration Command Usage This command limits the maximum transmission rate for BPDUs. Example Console(config)#spanning-tree transmission-limit 4 Console(config)# spanning-tree mst-configuration This command changes to Multiple Spanning Tree (MST) configuration mode. Default Setting • No VLANs are mapped to any MST instance.

  • Page 648: Mst Priority

    MAC address will then become the root device. • You can set this switch to act as the MSTI root device by specifying a priority of 0, or as the MSTI alternate device by specifying a priority of 16384. 4-276 www.digisol.com...

  • Page 649: Name

    DG-FS4552 User Manual Example Console(config-mstp)#mst 1 priority 4096 Console(config-mstp)# name This command configures the name for the multiple spanning tree region in which this switch is located. Use the no form to clear the name. Syntax name name name - Name of the spanning tree.

  • Page 650: Max-Hops

    Example Console(config-mstp)#max-hops 30 Console(config-mstp)# spanning-tree spanning-disabled This command disables the spanning tree algorithm for the specified interface. Use the no form to reenable the spanning tree algorithm for the specified interface. Syntax [no] spanning-tree spanning-disabled 4-278 www.digisol.com...

  • Page 651: Spanning-Tree Cost

    DG-FS4552 User Manual Default Setting Enabled Command Mode Interface Configuration (Ethernet, Port Channel) Example This example disables the spanning tree algorithm for port 5. Console(config)#interface ethernet 1/5 Console(config-if)#spanning-tree spanning-disabled Console(config-if)# spanning-tree cost This command configures the spanning tree path cost for the specified interface.

  • Page 652: Spanning-Tree Port-Priority

    This command configures the priority for the specified interface. Use the no form to restore the default. Syntax spanning-tree port-priority priority no spanning-tree port-priority priority - The priority for a port. (Range: 0-240, in steps of 16) Default Setting 4-280 www.digisol.com...

  • Page 653: Spanning-Tree Edge-Port

    DG-FS4552 User Manual Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • This command defines the priority for the use of a port in the Spanning Tree Algorithm. If the path cost for all ports on a switch are the same, the port with the highest priority (that is, lowest value) will be configured as an active link in the spanning tree.

  • Page 654: Spanning-Tree Portfast

    Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • This command is used to enable/disable the fast spanning-tree mode for the selected port. In this mode, ports skip the Discarding and Learning states, and proceed straight to Forwarding. 4-282 www.digisol.com...

  • Page 655: Spanning-Tree Bpdu-Filter

    DG-FS4552 User Manual • Since end-nodes cannot cause forwarding loops, they can be passed through the spanning tree state changes more quickly than allowed by standard convergence time. Fast forwarding can achieve quicker convergence for end-node workstations and servers, and also overcome other STA related timeout problems.

  • Page 656: Spanning-Tree Bpdu-Guard

    (4-278) spanning-tree port-bpdu-flooding This command floods BPDUs to other ports when spanning tree is disabled globally or disabled on a specific port. Use the no form to restore the default setting. Syntax [no] spanning-tree port-bpdu-flooding Default Setting Enabled 4-284 www.digisol.com...

  • Page 657: Spanning-Tree Root-Guard

    DG-FS4552 User Manual Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • When enabled, BPDUs are flooded to all other ports on the switch or to all other ports within the receiving port’s native VLAN as specified by the spanning-tree system-bpdu-flooding command (page 4-273).

  • Page 658: Spanning-Tree Link-Type

    Console(config-if)#spanning-tree link-type point-to-point Console(config-if)# spanning-tree loopback-detection This command enables the detection and response to Spanning Tree loopback BPDU packets on the port. Use the no form to disable this feature. Syntax spanning-tree loopback-detection no spanning-tree loopback-detection Default Setting Enabled 4-286 www.digisol.com...

  • Page 659: Spanning-Tree Loopback-Detection Release-Mode

    DG-FS4552 User Manual Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • If Port Loopback Detection is not enabled and a port receives it’s own BPDU, then the port will drop the loopback BPDU according to IEEE Standard 802.1W-2001 9.3.4 (Note 1).

  • Page 660: Spanning-Tree Loopback-Detection Trap

    IEEE 8021w standard exceeds 65,535, the default is set to 65,535. The default path costs are listed in Table 4-69 on page 4-280. 28. Use the spanning-tree pathcost method command on page 4-274 to set the path cost method. 4-288 www.digisol.com...

  • Page 661: Spanning-Tree Mst Port-Priority

    DG-FS4552 User Manual Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • Each spanning-tree instance is associated with a unique set of VLAN IDs. • This command is used by the multiple spanning-tree algorithm to determine the best path between devices. Therefore, lower values should be assigned to interfaces attached to faster media, and higher values assigned to interfaces with slower media.

  • Page 662: Spanning-Tree Protocol-Migration

    STP-compatible mode. However, you can also use the spanning-tree protocol-migration command at any time to manually re-check the appropriate BPDU format to send on the selected interfaces (i.e., RSTP or STP-compatible). Example Console#spanning-tree protocol-migration eth 1/5 Console# 4-290 www.digisol.com...

  • Page 663: Show Spanning-Tree

    DG-FS4552 User Manual show spanning-tree This command shows the configuration for the common spanning tree (CST) or for an instance within the multiple spanning tree (MST). Syntax show spanning-tree [interface | mst instance-id] • interface • ethernet unit/port - unit - Stack unit. (Range: 1) - port - Port number.
  • Page 664 Designated Root: 32768.0.00177C0AE2F1 Designated Bridge: 32768.0.00177C0AE2F1 Fast Forwarding: Enabled Forward Transitions: Admin Edge Port: Enabled Oper Edge Port: Enabled Admin Link Type: Auto Oper Link Type: Point-to-point Flooding Behavior: Enabled Spanning Tree Status: Enabled Spanning Tree Status: enable 4-292 www.digisol.com...

  • Page 665: Show Spanning-Tree Mst Configuration

    DG-FS4552 User Manual show spanning-tree mst configuration This command shows the configuration of the multiple spanning tree. Command Mode Privileged Exec Example Console#show spanning-tree mst configuration Mstp Configuration Information -------------------------------------------------------------- Configuration name: R&D Revision level:0 Instance Vlans -------------------------------------------------------------- 1,3-4094 Console#...

  • Page 666: Gvrp And Bridge Extension Commands

    GVRP defines a way for switches to exchange VLAN information in order to register VLAN members on ports across the network. This function should be enabled to permit automatic VLAN registration, and to support VLANs which extend beyond the local switch. Example Console(config)#bridge-ext gvrp Console(config)# 4-294 www.digisol.com...

  • Page 667: Show Bridge-Ext

    DG-FS4552 User Manual show bridge-ext This command shows the configuration for bridge extension commands. Default Setting None Command Mode Privileged Exec Command Usage See “Displaying Basic VLAN Information” on page 3-216 and “Displaying Bridge Extension Capabilities” on page 3-17 for a description of the displayed items.

  • Page 668: Show Gvrp Configuration

    • {join | leave | leaveall} - Which timer to set. • timer-value - Value of timer. Ranges: join: 20-1000 centiseconds leave: 60-3000 centiseconds leaveall: 500-18000 centiseconds Default Setting • join: 20 centiseconds • leave: 60 centiseconds • leaveall: 1000 centiseconds Command Mode Interface Configuration (Ethernet, Port Channel) 4-296 www.digisol.com...

  • Page 669: Show Garp Timer

    DG-FS4552 User Manual Command Usage • Group Address Registration Protocol is used by GVRP and GMRP to register or deregister client attributes for client services within a bridged LAN. The default values for the GARP timers are independent of the media access method or data rate.

  • Page 670: Table 4-72 Editing Vlan Groups

    VLAN. The results of these commands are written to the running-configuration file, and you can display this file by entering the show running-config command. Example Console(config)#vlan database Console(config-vlan)# Related Commands show vlan (4-307) 4-298 www.digisol.com...

  • Page 671: Vlan

    DG-FS4552 User Manual vlan This command configures a VLAN. Use the no form to restore the default settings or delete a VLAN. Syntax vlan vlan-id [name vlan-name] media ethernet [state {active | suspend}] no vlan vlan-id [name | state] • vlan-id - ID of configured VLAN. (Range: 1-4094, no leading zeroes) •...

  • Page 672: Configuring Vlan Interfaces

    Global Configuration Example The following example shows how to set the interface configuration mode to VLAN 1, and then assign an IP address to the VLAN: Console(config)#interface vlan 1 Console(config-if)#ip address 192.168.1.254 255.255.255.0 Console(config-if)# Related Commands shutdown (4-226) 4-300 www.digisol.com...

  • Page 673: Switchport Mode

    DG-FS4552 User Manual switchport mode This command configures the VLAN membership mode for a port. Use the no form to restore the default. Syntax switchport mode {access | hybrid | trunk | private-vlan} no switchport mode • access - Specifies an access VLAN interface. The port transmits and receives untagged frames only.

  • Page 674: Switchport Acceptable-Frame-Types

    Related Commands switchport mode (4-301) switchport ingress-filtering This command enables ingress filtering for an interface. Syntax [no] switchport ingress-filtering Default Setting Enabled Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • Ingress filtering only affects tagged frames. 4-302 www.digisol.com...

  • Page 675: Switchport Native Vlan

    DG-FS4552 User Manual • If ingress filtering is disabled and a port receives frames tagged for VLANs for which it is not a member, these frames will be flooded to all other ports (except for those VLANs explicitly forbidden on this port).

  • Page 676: Switchport Allowed Vlan

    VLAN is automatically removed from the forbidden list for that interface. Example The following example shows how to add VLANs 1, 2, 5 and 6 to the allowed list as tagged VLANs for port 1: Console(config)#interface ethernet 1/1 Console(config-if)#switchport allowed vlan add 1,2,5,6 tagged Console(config-if)# 4-304 www.digisol.com...

  • Page 677: Switchport Forbidden Vlan

    DG-FS4552 User Manual switchport forbidden vlan This command configures forbidden VLANs. Use the no form to remove the list of forbidden VLANs. Syntax switchport forbidden vlan {add vlan-list | remove vlan-list} no switchport forbidden vlan • add vlan-list - List of VLAN identifiers to add.
  • Page 678 VLAN trunking will still be effectively enabled for the unknown VLAN). Example The following example enables VLAN trunking on ports 27 and 28 to establish a path across the switch for unknown VLAN groups: Console(config)#interface ethernet 1/27 Console(config-if)#vlan-trunking Console(config-if)#interface ethernet 1/28 Console(config-if)#vlan-trunking Console(config-if)# 4-306 www.digisol.com...

  • Page 679: Table 4-74 Show Vlan Commands

    DG-FS4552 User Manual Displaying VLAN Information Table 4-74 Show VLAN Commands Command Function Mode Page show vlan Shows VLAN information NE, PE 4-307 show interfaces status vlan Displays status for the specified VLAN interface NE, PE 4-229 show interfaces switchport...

  • Page 680: Table 4-75 Ieee 802.1Q Tunneling Commands

    Displays port QinQ operational status 4-231 General Configuration Guidelines for QinQ Configure the switch to QinQ mode (dot1q-tunnel system-tunnel-control, page 4-309). Create a SPVLAN (vlan, page 4-299). Configure the QinQ tunnel access port to dot1Q-tunnel access mode (switchport dot1q-tunnel mode, page 4-310). 4-308 www.digisol.com...

  • Page 681: Dot1Q-Tunnel System-Tunnel-Control

    DG-FS4552 User Manual Set the Tag Protocol Identifier (TPID) value of the tunnel access port. This step is required if the attached client is using a nonstandard 2-byte ethertype to identify 802.1Q tagged frames. The standard ethertype value is 0x8100. (See switchport dot1q-tunnel tpid, page 4-311.)
  • Page 682 VLAN indicated by the inner tag. If no inner tag is found, the packet is passed onto the native VLAN defined for the uplink port. Example Console(config)#interface ethernet 1/1 Console(config-if)#switchport dot1q-tunnel mode access Console(config-if)# Related Commands show dot1q-tunnel (4-311) show interfaces switchport (4-231) 4-310 www.digisol.com...

  • Page 683: Switchport Dot1Q-Tunnel Tpid

    DG-FS4552 User Manual switchport dot1q-tunnel tpid This command sets the Tag Protocol Identifier (TPID) value of a tunnel port. Use the no form to restore the default setting. Syntax switchport dot1q-tunnel tpid tpid no switchport dot1q-tunnel tpid tpid – Sets the ethertype value for 802.1Q encapsulation. This identifier is used to select a nonstandard 2-byte ethertype to identify 802.1Q tagged...

  • Page 684: Configuring Port-Based Traffic Segmentation

    Specifies whether or not traffic can be forwarded between 4-315 uplink ports assigned to different client sessions show pvlan Displays the traffic segmentation configuration settings 4-315 pvlan This command enables port-based traffic segmentation. Use the no form to disable this feature. Syntax [no] pvlan Default Setting 4-312 www.digisol.com...

  • Page 685: Pvlan Uplink/Downlink

    DG-FS4552 User Manual Disabled Command Mode Global Configuration Command Usage • When traffic segmentation is enabled, the forwarding state for the uplink and downlink ports assigned to different client sessions is shown below. Table 4-77 Traffic Segmentation Forwarding Destination Session #1...

  • Page 686: Pvlan Session

    • Use this command to create a new traffic-segmentation client session. • Using the no form of this command will remove any assigned uplink or downlink ports, restoring these interfaces to normal operating mode. Example Console(config)#pvlan session 1 Console(config)# 4-314 www.digisol.com...

  • Page 687: Pvlan Up-To-Up

    DG-FS4552 User Manual pvlan up-to-up This command specifies whether or not traffic can be forwarded between uplink ports assigned to different client sessions. Use the no form to restore the default. Syntax [no] pvlan up-to-up {blocking | forwarding} • blocking – Blocks traffic between uplink ports assigned to different sessions.

  • Page 688: Configuring Private Vlans

    (i.e., having access to all ports in the primary VLAN) or host (i.e., community port). Use the switchport private-vlan host-association command to assign a port to a community VLAN. Use the switchport private-vlan mapping command to assign a port to a primary VLAN. 4-316 www.digisol.com...

  • Page 689: Private-Vlan

    DG-FS4552 User Manual Use the show vlan private-vlan command to verify your configuration settings. private-vlan Use this command to create a primary or community private VLAN. Use the no form to remove the specified private VLAN. Syntax private-vlan vlan-id {community | primary} no private-vlan vlan-id •...

  • Page 690: Private Vlan Association

    • host – This port type can subsequently be assigned to a community VLAN. • promiscuous – This port type can communicate with all other promiscuous ports in the same primary VLAN, as well as with all the ports in the associated secondary VLANs. Default Setting Normal VLAN 4-318 www.digisol.com...

  • Page 691: Switchport Private-Vlan Host-Association

    DG-FS4552 User Manual Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage To assign a promiscuous port to a primary VLAN, use the switchport private-vlan mapping command. To assign a host port to a community VLAN, use the private-vlan host association command.

  • Page 692: Switchport Private-Vlan Mapping

    [community | primary] • community – Displays all community VLANs, along with their associated primary VLAN and assigned host interfaces. • primary – Displays all primary VLANs, along with any assigned promiscuous interfaces. Default Setting None Command Mode Privileged Executive 4-320 www.digisol.com...

  • Page 693: Table 4-79 Protocol-Based Vlan Commands

    DG-FS4552 User Manual Example Console#show vlan private-vlan Primary Secondary Type Interfaces -------- ----------- ---------- ------------------------------ primary Eth1/ 3 community Eth1/ 4 Eth1/ 5 Console# Configuring Protocol-based VLANs The network devices required to support multiple protocols cannot be easily grouped into a common VLAN. This may require non-standard devices to pass traffic between different VLANs in order to encompass all the devices participating in a specific protocol.

  • Page 694: Protocol-Vlan Protocol-Group (Configuring Groups)

    • vlan-id - VLAN to which matching protocol traffic is forwarded. (Range: 1-4094) Default Setting No protocol groups are mapped to any VLANs. Command Mode Global Configuration 29. SNAP frame types are not supported by this switch due to hardware limitations. 4-322 www.digisol.com...

  • Page 695: Show Protocol-Vlan Protocol-Group

    DG-FS4552 User Manual Command Usage • When creating a protocol-based VLAN, do not assign interfaces to the protocol VLAN via any of the standard VLAN commands. If you assign interfaces using any of the other VLAN commands (such as vlan on page 4-299), the switch will admit traffic of any protocol type into the associated VLAN.

  • Page 696: Table 4-80 Ip Subnet Vlan Commands

    If no IP subnet is matched, the untagged frames are classified as belonging to the receiving port’s VLAN ID (PVID). Table 4-80 IP Subnet VLAN Commands Command Function Mode Page subnet-vlan Defines the IP Subnet VLANs 4-325 show subnet-vlan Displays IP Subnet VLAN settings 4-325 4-324 www.digisol.com...

  • Page 697: Subnet-Vlan

    DG-FS4552 User Manual subnet-vlan This command configures IP Subnet VLAN assignments. Use the no form to remove an IP subnet-to-VLAN assignment. Syntax subnet-vlan subnet ip-address mask vlan vlan-id no subnet-vlan subnet {ip-address mask | all} • ip-address – The IP address that defines the subnet. Valid IP addresses consist of four decimal numbers, 0 to 255, separated by periods.

  • Page 698: Table 4-81 Ip Subnet Vlan Commands

    • mac-address – The source MAC address to be matched. Configured MAC addresses can only be unicast addresses. The MAC address must be specified in the format xx-xx-xx-xx-xx-xx or xxxxxxxxxxxx. • vlan-id – VLAN to which the matching source MAC address traffic is forwarded. (Range: 1-4094) Default Setting None 4-326 www.digisol.com...

  • Page 699: Show Mac-Vlan

    DG-FS4552 User Manual Command Mode Global Configuration Command Usage • The MAC-to-VLAN mapping applies to all ports on the switch. • Source MAC addresses can be mapped to only one VLAN ID. • Configured MAC addresses cannot be broadcast or multicast addresses.

  • Page 700: Configuring Voice Vlans

    This is best achieved by assigning all VoIP traffic to a single VLAN. • VoIP traffic can be detected on switch ports by using the source MAC address of packets, or by using LLDP (IEEE 802.1AB) to discover connected VoIP 4-328 www.digisol.com...

  • Page 701: Voice Vlan Aging

    DG-FS4552 User Manual devices. When VoIP traffic is detected on a configured port, the switch automatically assigns the port as a tagged member of the Voice VLAN. • Only one Voice VLAN is supported and it must already be created on the switch before it can be specified as the Voice VLAN.

  • Page 702: Voice Vlan Mac-Address

    OUI (the first three octets). Other masks restrict the MAC address range. Selecting FF-FF-FF-FF-FF-FF specifies a single MAC address. Example The following example adds a MAC OUI to the OUI Telephony list. Console(config)#voice vlan mac-address 00-12-34-56-78-90 mask ff-ff-ff-00-00-00 description A new phone Console(config)# 4-330 www.digisol.com...

  • Page 703: Switchport Voice Vlan

    DG-FS4552 User Manual switchport voice vlan This command specifies the Voice VLAN mode for ports. Use the no form to disable the Voice VLAN feature on the port. Syntax switchport voice vlan {manual | auto} no switchport voice vlan • manual - The Voice VLAN feature is enabled on the port, but the port must be manually added to the Voice VLAN.

  • Page 704: Switchport Voice Vlan Security

    • When enabled, be sure the MAC address ranges for VoIP devices are configured in the Telephony OUI list (voice vlan mac-address, page 4-330). Example The following example enables security filtering on port 1. Console(config)#interface ethernet 1/1 Console(config-if)#switchport voice vlan security Console(config-if)# 4-332 www.digisol.com...

  • Page 705: Switchport Voice Vlan Priority

    DG-FS4552 User Manual switchport voice vlan priority This command specifies a CoS priority for VoIP traffic on a port. Use the no form to restore the default priority on a port. Syntax switchport voice vlan priority priority-value no switchport voice vlan priority •...
  • Page 706 Eth 1/ 7 Disabled Disabled OUI Eth 1/ 8 Disabled Disabled OUI Eth 1/ 9 Disabled Disabled OUI Eth 1/10 Disabled Disabled OUI Console#show voice vlan oui OUIAddress Mask Description 00-12-34-56-78-9A FF-FF-FF-00-00-00 old phones 00-11-22-33-44-55 FF-FF-FF-00-00-00 new phones 00-98-76-54-32-10 FF-FF-FF-FF-FF-FF Chris' phone Console# 4-334 www.digisol.com...

  • Page 707: Table 4-83 Lldp Commands

    DG-FS4552 User Manual LLDP Commands Link Layer Discovery Protocol (LLDP) is used to discover basic information about neighboring devices on the local broadcast domain. LLDP is a Layer 2 protocol that uses periodic broadcasts to advertise information about the sending device.
  • Page 708 Shows LLDP global and interface-specific configuration 4-355 remote-device settings for remote devices show lldp info Shows statistical counters for all LLDP-enabled interfaces 4-356 statistics * Vendor-specific options may or may not be advertised by neighboring devices. 4-336 www.digisol.com...

  • Page 709: Lldp

    DG-FS4552 User Manual lldp This command enables LLDP globally on the switch. Use the no form to disable LLDP. Syntax [no] lldp Default Setting Enabled Command Mode Global Configuration Example Console(config)#lldp Console(config)# lldp holdtime-multiplier This command configures the time-to-live (TTL) value sent in LLDP advertisements.

  • Page 710: Lldp Medfaststartcount

    • This parameter only applies to SNMP applications which use data stored in the LLDP MIB for network monitoring or management. • Information about changes in LLDP neighbors that occur between SNMP notifications is not transmitted. Only state changes that exist at the time of a 4-338 www.digisol.com...

  • Page 711: Lldp Refresh-Interval

    DG-FS4552 User Manual notification are included in the transmission. An SNMP agent should therefore periodically check the value of lldpStatsRemTableLastChangeTime to detect any lldpRemTablesChange notification-events missed due to throttling or transmission loss. Example Console(config)#lldp notification-interval 30 Console(config)# lldp refresh-interval This command configures the periodic transmit interval for LLDP advertisements.

  • Page 712: Lldp Tx-Delay

    LLDP MIB objects, and to increase the probability that multiple, rather than single changes, are reported in each transmission. • This attribute must comply with the following rule:  (4 * tx-delay)  refresh-interval Example Console(config)#lldp tx-delay 10 Console(config)# 4-340 www.digisol.com...

  • Page 713: Lldp Admin-Status

    DG-FS4552 User Manual lldp admin-status This command enables LLDP transmit, receive, or transmit and receive mode on the specified port. Use the no form to disable this feature. Syntax lldp admin-status {rx-only | tx-only | tx-rx} no lldp admin-status • rx-only - Only receive LLDP PDUs.

  • Page 714: Lldp Mednotification

    An SNMP agent should therefore periodically check the value of lldpStatsRemTableLastChangeTime to detect any lldpRemTablesChange notification-events missed due to throttling or transmission loss. Example Console(config)#interface ethernet 1/1 Console(config-if)#lldp mednotification Console(config-if)# 4-342 www.digisol.com...

  • Page 715: Lldp Basic-Tlv Management-Ip-Address

    DG-FS4552 User Manual lldp basic-tlv management-ip-address This command configures an LLDP-enabled port to advertise the management address for this device. Use the no form to disable this feature. Syntax [no] lldp basic-tlv management-ip-address Default Setting Enabled Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage •...

  • Page 716: Lldp Basic-Tlv System-Capabilities

    Example Console(config)#interface ethernet 1/1 Console(config-if)#lldp basic-tlv system-capabilities Console(config-if)# lldp basic-tlv system-description This command configures an LLDP-enabled port to advertise the system description. Use the no form to disable this feature. Syntax [no] lldp basic-tlv system-description Default Setting Enabled 4-344 www.digisol.com...

  • Page 717: Lldp Basic-Tlv System-Name

    DG-FS4552 User Manual Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage The system description is taken from the sysDescr object in RFC 3418, which includes the full name and version identification of the system's hardware type, software operating system, and networking software.

  • Page 718: Lldp Dot1-Tlv Proto-Vid

    This command configures an LLDP-enabled port to advertise its default VLAN ID. Use the no form to disable this feature. Syntax [no] lldp dot1-tlv pvid Default Setting Enabled Command Mode Interface Configuration (Ethernet, Port Channel) 4-346 www.digisol.com...

  • Page 719: Lldp Dot1-Tlv Vlan-Name

    DG-FS4552 User Manual Command Usage The port’s default VLAN identifier (PVID) indicates the VLAN with which untagged or priority-tagged frames are associated (see “switchport native vlan” on page 4-303). Example Console(config)#interface ethernet 1/1 Console(config-if)#no lldp dot1-tlv pvid Console(config-if)# lldp dot1-tlv vlan-name This command configures an LLDP-enabled port to advertise its VLAN name.

  • Page 720: Lldp Dot3-Tlv Mac-Phy

    This command configures an LLDP-enabled port to advertise its maximum frame size. Use the no form to disable this feature. Syntax [no] lldp dot3-tlv max-frame Default Setting Enabled Command Mode Interface Configuration (Ethernet, Port Channel) 4-348 www.digisol.com...

  • Page 721: Lldp Dot3-Tlv Poe

    DG-FS4552 User Manual Command Usage Refer to “Frame Size Commands” on page 4-35 for information on configuring the maximum frame size for this switch. Example Console(config)#interface ethernet 1/1 Console(config-if)#lldp dot3-tlv max-frame Console(config-if)# lldp dot3-tlv poe This command configures an LLDP-enabled port to advertise its Power-over-Ethernet (PoE) capabilities.

  • Page 722: Lldp Medtlv Inventory

    This command configures an LLDP-MED-enabled port to advertise its location identification details. Use the no form to disable this feature. Syntax medtlv location [no] lldp Default Setting Enabled Command Mode Interface Configuration (Ethernet, Port Channel) 4-350 www.digisol.com...

  • Page 723: Lldp Medtlv Med-Cap

    DG-FS4552 User Manual Command Usage This option advertises location identification details. Example Console(config)#interface ethernet 1/1 Console(config-if)#lldp medtlv location Console(config-if)# lldp medtlv med-cap This command configures an LLDP-MED-enabled port to advertise its Media Endpoint Device capabilities. Use the no form to disable this feature.

  • Page 724: Show Lldp Config

    [detail interface] • detail - Shows configuration summary. • interface • ethernet unit/port - unit - Stack unit. (Range: 1) - port - Port number. (Range: 1-52) • port-channel channel-id (Range: 1-8) Command Mode Privileged Exec 4-352 www.digisol.com...
  • Page 725 DG-FS4552 User Manual Example Console#show lldp config LLDP Global Configuation LLDP Enable : Yes LLDP Transmit interval : 30 LLDP Hold Time Multiplier LLDP Delay Interval LLDP Reinit Delay LLDP Notification Interval : 5 LLDP MED fast start counts : 4...

  • Page 726: Show Lldp Info Local-Device

    Console#show lldp info local-device LLDP Local System Information Chassis Type : MAC Address Chassis ID : 00-17-7C-0A-E2-F1 System Name System Description : DG-FS4552 System Capabilities Support : Bridge System Capabilities Enable : Bridge Management Address : 192.168.0.101 (IPv4) LLDP Port Information...

  • Page 727: Show Lldp Info Remote-Device

    DG-FS4552 User Manual show lldp info remote-device This command shows LLDP global and interface-specific configuration settings for remote devices attached to an LLDP-enabled port. Syntax show lldp info remote-device [detail interface] • detail - Shows detailed information. • interface • ethernet unit/port - unit - Stack unit.

  • Page 728: Show Lldp Info Statistics

    Eth 1/5 switch#show lldp info statistics detail ethernet 1/1 LLDP Port Statistics Detail PortName : Eth 1/1 Frames Discarded Frames Invalid Frames Received : 12 Frames Sent : 13 TLVs Unrecognized : 0 TLVs Discarded Neighbor Ageouts switch# 4-356 www.digisol.com...

  • Page 729: Table 4-84 Priority Commands

    DG-FS4552 User Manual Class of Service Commands The commands described in this section allow you to specify which data packets have greater precedence when traffic is buffered in the switch due to congestion. This switch supports CoS with four priority queues for each port. Data packets in a port’s high-priority queue will be transmitted before those in the lower-priority...

  • Page 730: Switchport Priority Default

    • The default priority applies for an untagged frame received on a port set to accept all frame types (i.e, receives both untagged and tagged frames). This priority does not apply to IEEE 802.1Q VLAN tagged frames. If the incoming 4-358 www.digisol.com...

  • Page 731: Table 4-86 Default Cos Values To Egress Queues

    DG-FS4552 User Manual frame is an IEEE 802.1Q VLAN tagged frame, the IEEE 802.1p User Priority bits will be used. • This switch provides eight priority queues for each port. It is configured to use Weighted Round Robin by default, which can be viewed with the show queue bandwidth command.

  • Page 732: Show Queue Mode

    Default Setting None Command Mode Privileged Exec Example Console#show queue mode Queue mode: wrr Console# show queue bandwidth This command displays the weighted round-robin (WRR) bandwidth allocation for the four priority queues. Default Setting None Command Mode Privileged Exec 4-360 www.digisol.com...

  • Page 733: Show Queue Cos-Map

    DG-FS4552 User Manual Example Console#show queue bandwidth Queue ID Weight -------- ------ Console# show queue cos-map This command shows the class of service priority map. Syntax show queue cos-map [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1) - port - Port number.

  • Page 734: Table 4-87 Priority Commands (Layer 3 And 4)

    This command sets IP DSCP priority (i.e., Differentiated Services Code Point priority). Use the no form to restore the default table. Syntax map ip dscp dscp-value cos cos-value no map ip dscp • dscp-value - 8-bit DSCP value. (Range: 0-63) • cos-value - Class-of-Service value (Range: 0-7) 4-362 www.digisol.com...

  • Page 735: Table 4-88 Ip Dscp To Cos Vales

    DG-FS4552 User Manual Default Setting The DSCP default values are defined in the following table. Note that all the DSCP values that are not specified are mapped to CoS value 0. Table 4-88 IP DSCP to CoS Vales IP DSCP Value...

  • Page 736: Show Map Ip Dscp

    --------- ---- --- Eth 1/ 1 Eth 1/ 1 Eth 1/ 1 Eth 1/ 1 Eth 1/ 1 Eth 1/ 1 Eth 1/ 1 Console# Related Commands map ip dscp (Global Configuration) (4-362) map ip dscp (Interface Configuration) (4-362) 4-364 www.digisol.com...

  • Page 737: Table 4-89 Quality Of Service Commands

    DG-FS4552 User Manual Quality of Service Commands The commands described in this section are used to configure Differentiated Services (DiffServ) classification criteria and service policies. You can classify traffic based on access lists, IP Precedence or DSCP values, or VLANs. Using access lists allows you select traffic based on Layer 2, Layer 3, or Layer 4 information contained in each packet.

  • Page 738: Class-Map

    Example This example creates a class map call “rd-class,” and sets it to match packets marked for DSCP service value 3: Console(config)#class-map rd-class match-any Console(config-cmap)#match ip dscp 3 Console(config-cmap)# Related Commands show class map (4-372) 4-366 www.digisol.com...

  • Page 739: Match

    DG-FS4552 User Manual match This command defines the criteria used to classify traffic. Use the no form to delete the matching criteria. Syntax [no] match {access-list acl-name | ip dscp dscp | ip precedence ip-precedence | vlan vlan} • acl-name - Name of the access control list. Any type of ACL can be specified, including standard or extended IP ACLs and MAC ACLs.

  • Page 740: Rename

    This command specifies the description of a class map or policy map. Syntax description string string - Description of the class map or policy map. (Range: 1-64 characters) Command Mode Class Map Configuration Policy Map Configuration Example Console(config)#class-map rd-class#1 Console(config-cmap)#description matches packets marked for DSCP service value 3 Console(config-cmap)# 4-368 www.digisol.com...

  • Page 741: Policy-Map

    DG-FS4552 User Manual policy-map This command creates a policy map that can be attached to multiple interfaces, and enters Policy Map configuration mode. Use the no form to delete a policy map. Syntax [no] policy-map policy-map-name policy-map-name - Name of the policy map. (Range: 1-16 characters)
  • Page 742 This example creates a policy called “rd-policy,” uses the class command to specify the previously defined “rd-class,” uses the set command to classify the service that incoming packets will receive, and then uses the police command to limit the 4-370 www.digisol.com...

  • Page 743: Police

    DG-FS4552 User Manual average bandwidth to 100,000 Kbps, the burst rate to 1522 bytes, and configure the response to drop any violating packets. Console(config)#policy-map rd-policy Console(config-pmap)#class rd-class Console(config-pmap-c)#set ip dscp 3 Console(config-pmap-c)#police 100000 1522 exceed-action drop Console(config-pmap-c)# police This command defines an policer for classified traffic based on the metered flow rate.

  • Page 744: Service-Policy

    This command displays the QoS class maps which define matching criteria used for classifying traffic. Syntax show class-map [class-map-name] class-map-name - Name of the class map. (Range: 1-16 characters) Default Setting Displays all class maps. Command Mode Privileged Exec 4-372 www.digisol.com...

  • Page 745: Show Policy-Map

    DG-FS4552 User Manual Example Console#show class-map Class Map match-any rd-class#1 Match ip dscp 3 Class Map match-any rd-class#2 Match ip precedence 5 Class Map match-any rd-class#3 Match vlan 1 Console# show policy-map This command displays the QoS policy maps which define classification criteria for incoming traffic, and may include policers for bandwidth limitations.

  • Page 746: Multicast Filtering Commands

    Adds an interface as a member of a multicast group 4-375 ip igmp snooping version Configures the IGMP version for snooping 4-376 ip igmp snooping Enables IGMP leave proxy on the switch 4-377 leave-proxy ip igmp snooping Enables IGMP immediate leave for a VLAN interface 4-377 immediate-leave 4-374 www.digisol.com...

  • Page 747: Table 4-91 Igmp Snooping Commands

    DG-FS4552 User Manual Table 4-91 IGMP Snooping Commands (Continued) Command Function Mode Page show ip igmp snooping Shows the IGMP snooping and query configuration 4-377 show mac-address-table Shows the IGMP snooping MAC multicast list 4-379 multicast ip igmp snooping This command enables IGMP snooping on this switch. Use the no form to disable it.

  • Page 748: Ip Igmp Snooping Version

    • Some commands are only enabled for IGMPv2 and/or v3, including ip igmp snooping querier, ip igmp snooping query-max-response-time, ip igmp snooping query-interval, and ip igmp snooping immediate leave. Example The following configures the switch to use IGMP Version 1: Console(config)#ip igmp snooping version 1 Console(config)# 4-376 www.digisol.com...

  • Page 749: Ip Igmp Snooping Leave-Proxy

    DG-FS4552 User Manual ip igmp snooping leave-proxy This command enables IGMP leave proxy on the switch. Use the no form to disable the feature. Syntax [no] ip igmp snooping leave-proxy Default Setting Disabled Command Mode Global Configuration Command Usage • This function is only effective if IGMP snooping is enabled.

  • Page 750: Show Ip Igmp Snooping

    Querier status: Enabled Leave proxy status: Disabled Query count: Query interval: 100 sec Query max response time: 20 sec Router port expire time: 300 sec Immediate Leave Processing: Disabled on all VLAN IGMP snooping version: Version 2 Console# 4-378 www.digisol.com...

  • Page 751: Table 4-92 Igmp Query Commands (Layer 2)

    DG-FS4552 User Manual show mac-address-table multicast This command shows known multicast addresses. Syntax show mac-address-table multicast [vlan vlan-id] [user | igmp-snooping] • vlan-id - VLAN ID (1 to 4092) • user - Display only the user-configured multicast entries. • igmp-snooping - Display only entries learned through IGMP snooping.

  • Page 752: Ip Igmp Snooping Querier

    If the countdown finishes, and the client still has not responded, then that client is considered to have left the multicast group. 4-380 www.digisol.com...

  • Page 753: Ip Igmp Snooping Query-Interval

    DG-FS4552 User Manual Example The following shows how to configure the query count to 10: Console(config)#ip igmp snooping query-count 10 Console(config)# Related Commands ip igmp snooping query-max-response-time (4-381) ip igmp snooping query-interval This command configures the query interval. Use the no form to restore the default.

  • Page 754: Ip Igmp Snooping Router-Port-Expire-Time

    The switch must use IGMPv2/v3 snooping for this command to take effect. Example The following shows how to configure the default timeout to 300 seconds: Console(config)#ip igmp snooping router-port-expire-time 300 Console(config)# Related Commands ip igmp snooping version (4-376) 4-382 www.digisol.com...

  • Page 755: Table 4-93 Static Multicast Routing Commands

    DG-FS4552 User Manual Static Multicast Routing Commands This section describes commands used to configure static multicast routing on the switch. Table 4-93 Static Multicast Routing Commands Command Function Mode Page ip igmp snooping vlan mrouter Adds a multicast router port...

  • Page 756: Show Ip Igmp Snooping Mrouter

    Example The following shows that port 11 in VLAN 1 is attached to a multicast router: Console#show ip igmp snooping mrouter vlan 1 VLAN M'cast Router Ports Type ---- ------------------- ------- Eth 1/11 Static Eth 1/12 Static Console# 4-384 www.digisol.com...

  • Page 757: Table 4-94 Igmp Filtering And Throttling Commands

    DG-FS4552 User Manual IGMP Filtering and Throttling Commands In certain switch applications, the administrator may want to control the multicast services that are available to end users. For example, an IP/TV service based on a specific subscription plan. The IGMP filtering feature fulfills this requirement by restricting access to specified multicast services on a switch port, and IGMP throttling limits the number of simultaneous multicast groups a port can join.

  • Page 758: Ip Igmp Profile

    • Each profile has only one access mode; either permit or deny. • When the access mode is set to permit, IGMP join reports are processed when a multicast group falls within the controlled range. When the access 4-386 www.digisol.com...

  • Page 759: Range

    DG-FS4552 User Manual mode is set to deny, IGMP join reports are only processed when a multicast group is not in the controlled range. Example Console(config)#ip igmp profile 19 Console(config-igmp-profile)#permit Console(config-igmp-profile)# range This command specifies multicast group addresses for a profile. Use the no form to delete addresses from a profile.

  • Page 760: Ip Igmp Max-Groups

    • IGMP throttling can also be set on a trunk interface. When ports are configured as trunk members, the trunk uses the throttling settings of the first port member in the trunk. Example Console(config)#interface ethernet 1/1 Console(config-if)#ip igmp max-groups 10 Console(config-if)# 4-388 www.digisol.com...

  • Page 761: Ip Igmp Max-Groups Action

    DG-FS4552 User Manual ip igmp max-groups action This command sets the IGMP throttling action for an interface on the switch. Syntax ip igmp max-groups action {replace | deny} • replace - The new multicast group replaces an existing group. • deny - The new multicast group join report is dropped.

  • Page 762: Show Ip Igmp Profile

    This command displays the interface settings for IGMP throttling. Syntax show ip igmp throttle interface [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1) - port - Port number. (Range: 1-52) • port-channel channel-id (Range: 1-8) 4-390 www.digisol.com...

  • Page 763: Table 4-95 Multicast Vlan Registration Commands

    DG-FS4552 User Manual Default Setting None Command Mode Privileged Exec Command Usage Using this command without specifying an interface displays all interfaces. Example Console#show ip igmp throttle interface ethernet 1/1 1/1 Information Status : TRUE Action : Deny Max Multicast Groups : 32...

  • Page 764: Mvr (Global Configuration)

    MVR group addresses cannot fall within the reserved IP multicast address range of 224.0.0.x. • MVR source ports can be configured as members of the MVR VLAN using the switchport allowed vlan command (page 4-304) and switchport native 4-392 www.digisol.com...
  • Page 765 DG-FS4552 User Manual vlan command (page 4-303), but MVR receiver ports should not be statically configured as members of this VLAN. • IGMP snooping must be enabled to a allow a subscriber to dynamically join or leave an MVR group (see ip igmp snooping on page 4-375). Note that only IGMP version 2 or 3 hosts can issue multicast join or leave messages.

  • Page 766: Mvr (Interface Configuration)

    • One or more interfaces may be configured as MVR source ports. A source port is able to both receive and send data for multicast groups which it has joined through IGMP snooping or which have been statically assigned using the group keyword. 4-394 www.digisol.com...

  • Page 767: Mvr Immediate

    DG-FS4552 User Manual • The IP address range from 224.0.0.0 to 239.255.255.255 is used for multicast streams. MVR group addresses cannot fall within the reserved IP multicast address range of 224.0.0.x. • IGMP snooping must be enabled to allow a subscriber to dynamically join or leave an MVR group (see ip igmp snooping on page 4-375).

  • Page 768: Show Mvr

    MVR. Use the interface keyword to display information about interfaces attached to the MVR VLAN, the members keyword to display information about multicast groups assigned to the MVR VLAN, or the receiver-group members keyword to display information about multicast groups assigned to the MVR Receiver VLAN. 4-396 www.digisol.com...

  • Page 769: Table 4-96 Show Mvr - Display Description

    DG-FS4552 User Manual Example The following shows the global MVR settings: Console#show mvr MVR Status:enable MVR running status:TRUE MVR multicast vlan:1 MVR Max Multicast Groups:255 MVR Current multicast groups:10 MVR Receiver VLAN:3 MVR Supported Receiver Multicast Groups:5 MVR Used Receiver Multicast Groups:1...

  • Page 770: Table 4-98 Show Mvr Members - Display Description

    The following shows the interfaces which have joined MVR receiver groups, and the status of MVR traffic for each group: Console#show mvr receiver-group members MVR Group IP Status Members ---------------- -------- ------- 224.0.0.1 ACTIVE eth1/1 224.0.0.2 INACTIVE None 224.0.1.1 INACTIVE None 224.0.1.2 INACTIVE None 224.0.1.3 INACTIVE None Console# 4-398 www.digisol.com...

  • Page 771: Table 4-100 Dns Commands

    DG-FS4552 User Manual Table 4-99 show mvr receiver members - display description Field Description MVR Group IP Multicast groups assigned to the MVR Receiver VLAN. Status Shows whether or not the there are active subscribers for this multicast group. Note that this field will also display “ACTIVE”...

  • Page 772: Clear Host

    • name - Name of the host. (Range: 1-64 characters) • * - Removes all entries. Default Setting None Command Mode Privileged Exec Example This example clears all static entries from the DNS table. Console(config)#clear host * Console(config)# 4-400 www.digisol.com...

  • Page 773: Ip Domain-Name

    DG-FS4552 User Manual ip domain-name This command defines the default domain name appended to incomplete host names (i.e., host names passed from a client that are not formatted with dotted notation). Use the no form to remove the current domain name.

  • Page 774: Ip Name-Server

    • server-address2 … server-address6 - IP address of additional domain-name servers. Default Setting None Command Mode Global Configuration Command Usage The listed name servers are queried in the specified sequence until a response is received, or the end of the list is reached with no response. 4-402 www.digisol.com...

  • Page 775: Ip Domain-Lookup

    DG-FS4552 User Manual Example This example adds two domain-name servers to the list and then displays the list. Console(config)#ip domain-server 192.168.1.55 10.1.0.55 Console(config)#end Console#show dns Domain Lookup Status: DNS disabled Default Domain Name: .sample.com Domain Name List: .sample.com.jp .sample.com.uk Name Server List: 192.168.1.55...

  • Page 776: Show Hosts

    This command displays the configuration of the DNS service. Command Mode Privileged Exec Example Console#show dns Domain Lookup Status: DNS enabled Default Domain Name: sample.com Domain Name List: sample.com.jp sample.com.uk Name Server List: 192.168.1.55 10.1.0.55 Console# 4-404 www.digisol.com...

  • Page 777: Table 4-101 Show Dns Cache - Display Description

    DG-FS4552 User Manual show dns cache This command displays entries in the DNS cache. Command Mode Privileged Exec Example Console#show dns cache FLAG TYPE DOMAIN Address www.times.com 199.239.136.200 Address a1116.x.akamai.net 61.213.189.120 Address a1116.x.akamai.net 61.213.189.104 CNAME graphics8.nytimes.com POINTER TO:2 CNAME graphics478.nytimes.com.edgesui 19...

  • Page 778: Ip Interface Commands

    You can manually configure a specific IP address, or direct the device to obtain an address from a BOOTP or DHCP server. Valid IP addresses consist of four numbers, 0 to 255, separated by periods. Anything outside this format will not be accepted by the configuration program. 4-406 www.digisol.com...

  • Page 779: Ip Default-Gateway

    DG-FS4552 User Manual • If you select the bootp or dhcp option, IP is enabled but will not function until a BOOTP or DHCP reply has been received. Requests will be broadcast periodically by this device in an effort to learn its IP address. (BOOTP and DHCP values can include the IP address, default gateway, and subnet mask).

  • Page 780: Ip Dhcp Restart

    This command displays the settings of an IP interface. Default Setting All interfaces Command Mode Normal Exec, Privileged Exec Example Console#show ip interface IP Address and Netmask: 192.168.1.54 255.255.255.0 on VLAN 1, Address Mode: User specified. Console# 4-408 www.digisol.com...

  • Page 781: Show Ip Redirects

    DG-FS4552 User Manual Related Commands show ip redirects (4-409) show ip redirects This command shows the default gateway configured for this device. Command Mode Privileged Exec Example Console#show ip redirects IP default gateway 10.1.0.254 Console# Related Commands ip default-gateway (4-407) show arp This command displays the Address Resolution Protocol cache.
  • Page 782 10 ms Ping statistics for 10.1.0.9: 5 packets transmitted, 5 packets received (100%), 0 packets lost (0%) Approximate round trip times: Minimum = 10 ms, Maximum = 20 ms, Average = 10 ms Console# Related Commands interface (4-220) 4-410 www.digisol.com...

  • Page 783: Appendix A: Software Specifications

    Up to 255 groups; port-based or tagged (802.1Q), Private VLANs, Protocol-based, IP-subnet and MAC-based Class of Service Supports 4 levels of priority Strict or Weighted Round Robin queueing CoS configured by VLAN tag or port Layer 3/4 priority mapping: IP DSCP www.digisol.com...

  • Page 784: Management Features

    IEEE 802.1AB Link Layer Discovery Protocol IEEE 802.1D-2004 Spanning Tree Algorithm and traffic priorities Spanning Tree Protocol Multiple Spanning Tree Protocol Rapid Spanning Tree Protocol IEEE 802.1p Priority tags IEEE 802.1Q VLAN IEEE 802.1v Protocol-based VLANs IEEE 802.1X Port Authentication www.digisol.com...

  • Page 785: Management Information Bases

    DG-FS4552 User Manual IEEE 802.3-2005 Ethernet, Fast Ethernet, Gigabit Ethernet Link Aggregation Control Protocol (LACP) Full-duplex flow control (ISO/IEC 8802-3) IEEE 802.3ac VLAN tagging DHCP Client (RFC 2131) DHCP Options (RFC 2132) FTP (RFC 959) HTTPS IGMP (RFC 1112) IGMPv2 (RFC 2236)
  • Page 786 SNMP-MPD MIB (RFC 3412) SNMP Target MIB, SNMP Notification MIB (RFC 3413) SNMP User-Based SM MIB (RFC 3414) SNMP View Based ACM MIB (RFC 3415) TACACS+ Authentication Client MIB TCP MIB (RFC 2012) Trap (RFC 1215) UDP MIB (RFC 2013) www.digisol.com...

  • Page 787: Table B-1 Troubleshooting Chart

    8 data bits, 1 stop bit, no parity, and 9600 bps. serial port connection • Check that the null-modem serial cable conforms to the pin-out connections provided in the Installation Guide. Forgot or lost the password • Contact your local distributor. www.digisol.com...

  • Page 788: Using System Logs

    Repeat the sequence of commands or other actions that lead up to the error. Make a list of the commands or circumstances that led to the fault. Also make a list of any error messages displayed. Contact your distributor’s service engineer. For example: Console(config)#logging on Console(config)#logging history flash 7 Console(config)#snmp-server host 192.168.1.23 www.digisol.com...
  • Page 789 Dynamic Host Control Protocol (DHCP) Provides a framework for passing configuration information to hosts on a TCP/IP network. DHCP is based on the Bootstrap Protocol (BOOTP), adding the capability of automatic allocation of reusable network addresses and additional configuration options. www.digisol.com Glossary-1...
  • Page 790 Generic Multicast Registration Protocol (GMRP) GMRP allows network devices to register end stations with multicast groups. GMRP requires that any participating network devices or end stations comply with the IEEE 802.1p standard. Group Attribute Registration Protocol (GARP) See Generic Attribute Registration Protocol. Glossary-2 www.digisol.com...
  • Page 791 DG-FS4552 User Manual IEEE 802.1D Specifies a general method for the operation of MAC bridges, including the Spanning Tree Protocol. IEEE 802.1Q VLAN Tagging—Defines Ethernet frame tags which carry VLAN information. It allows switches to assign endstations to different virtual LANs, and defines a standard way for VLANs to communicate across switched networks.
  • Page 792 MD5 Message-Digest Algorithm An algorithm that is used to create digital signatures. It is intended for use with 32 bit machines and is safer than the MD4 algorithm, which has been broken. MD5 is a Glossary-4 www.digisol.com...
  • Page 793 DG-FS4552 User Manual one-way hash function, meaning that it takes a message and converts it into a fixed string of digits, also called a message digest. Multicast Switching A process whereby the switch filters incoming multicast frames for services for which no attached host has registered, or forwards them to all ports contained within the designated multicast VLAN group.
  • Page 794 Simple Mail Transfer Protocol (SMTP) A standard host-to-host mail transport protocol that operates over TCP, port 25. Simple Network Management Protocol (SNMP) The application protocol in the Internet suite of protocols which offers network management services. Glossary-6 www.digisol.com...
  • Page 795 DG-FS4552 User Manual Simple Network Time Protocol (SNTP) SNTP allows a device to set its internal clock based on periodic updates from a Network Time Protocol (NTP) server. Updates can be requested from a specific NTP server, or can be received via broadcasts sent by NTP servers.
  • Page 796 Glossary XModem A protocol used to transfer files between devices. Data is grouped in 128-byte blocks and error-corrected. Glossary-8 www.digisol.com...
  • Page 797 BOOTP 3-20, 4-406 acceptable frame type 3-223, 4-302 BPDU 3-188 Access Control List See ACL filter 3-205, 4-283 ACL 3-124, 4-198 flooding when STA disabled on ARP 3-133, 4-210 VLAN 3-195, 4-284 binding to a port 3-135, 4-204 www.digisol.com Index-1...
  • Page 798 VoIP devices 3-276 dynamic VLAN assignment 3-115, DHCP 3-20, 4-406 3-119, 4-166 client 3-18, 4-406 dynamic configuration 2-5 DHCP snooping edge port, STA 3-200, 3-204, 4-281 enabling 3-144, 4-179 encryption global configuration 3-144, 4-179 DSA 3-93, 3-95, 4-141 www.digisol.com Index-2...
  • Page 799 DG-FS4552 User Manual RSA 3-93, 3-95, 4-141 filter, parameters 3-291 event logging 3-36, 4-57 filtering & throttling 3-290, 4-385 exec command privileges, filtering & throttling, configuring accounting 3-82, 4-129 profile 4-386, 4-387 exec settings filtering & throttling, creating accounting 3-83, 4-129...
  • Page 800 3-209, LLDP-MED 3-245, 4-335 4-291 notification, status 3-249, 4-342 path cost 3-211, 4-288 TLV 3-249, 4-335 multicast filtering 3-280, 4-374 TLV, extended PoE 3-249, 4-349 multicast groups 3-288, 4-379 TLV, inventory 3-249, 4-350 displaying 3-288, 4-379 www.digisol.com Index-4...
  • Page 801 DG-FS4552 User Manual static 3-288, 4-375, 4-377, 4-379 port authentication 3-99, 4-145 multicast services port priority configuring 3-289, 4-375, 4-377 configuring 3-259, 4-357 displaying 3-288, 4-379 default ingress 3-259, 4-358 multicast storm, threshold 3-174, STA 3-200, 4-280 4-227 port security, configuring 3-110, 4-158...
  • Page 802 3-200, 3-203, 3-206, 3-209, sFlow 4-286 flow configuration 3-68, loopback detection 3-190, 4-286 4-103–4-107 MSTP path cost 3-211, 4-288 port groups, source 3-66, 4-103 MSTP settings, configuring 3-211, target device 3-68, 4-106 4-275–4-278 path cost 3-192, 3-200, 4-279 www.digisol.com Index-6...
  • Page 803 DG-FS4552 User Manual path cost method 3-196, 4-274 sessions, creating 3-233, 4-314 port priority 3-200, 4-280 uplink-to-uplink, blocking 3-232, port/trunk loopback detection 3-190, 4-315 4-286 uplink-to-uplink, forwarding 3-232, protocol migration 3-203, 4-290 4-315 transmission limit 3-196, 4-274 trap manager 2-7, 3-52, 4-92...
  • Page 804 3-276, ports, re-authenticating 3-114, 4-331–4-333 4-176 identifying client devices 3-278, web interface 4-330 access requirements 3-1 VoIP traffic 3-275, 4-328 configuration buttons 3-3 ports, configuring 3-276, home page 3-2 4-331–4-333 menu list 3-4 panel display 3-3 www.digisol.com Index-8...

This manual is also suitable for:

Dg-fs4528

Table of Contents