Page 1 12/28-Port Gigabit Ethernet Layer 2 Switch ECS4210-12P ECS4210-12T W e b M a n a g e m e n t G u i d e ECS4210-28P ECS4210-28T Software Release v1.0.0.24 www.edge-core.com...
Page 2 W e b M a n a g e m e n t G u i d e ECS4210-12P Layer 2 Managed PoE Switch with 8 10/100/1000BASE-T (RJ-45) PoE Ports, 2 10/100/1000BASE-T (RJ-45) Ports, and 2 Gigabit SFP Uplink Ports...
Page 3: How To Use This Guide
How to Use This Guide This guide includes detailed information on the switch software, including how to operate and use the management functions of the switch. To deploy this switch effectively and ensure trouble-free operation, you should first read the relevant sections in this guide so that you are familiar with all of its software features.
Page 4 How to Use This Guide Conventions The following conventions are used throughout this guide to show information: Note: Emphasizes important information or calls your attention to related features or instructions. Caution: Alerts you to a potential hazard that could cause loss of data, or damage the system or equipment.
Page 5 How to Use This Guide April 2013 Revision This is the first version of this guide. This guide is valid for software release v1.0.0.12. – 5 –...
Page 6 How to Use This Guide – 6 –...
Page 7: Table Of Contents
Contents How to Use This Guide Contents Figures Tables Section I Getting Started 1 Introduction Key Features Description of Software Features System Defaults 2 Using the Web Interface Connecting to the Web Interface Navigating the Web Browser Interface Home Page Configuration Options Panel Display Main Menu...
Page 8 Contents Managing System Files Copying Files via FTP/TFTP or HTTP Saving the Running Configuration to a Local File Setting The Start-Up File Showing System Files Automatic Operation Code Upgrade Setting the System Clock Setting the Time Manually Setting the SNTP Polling Interval Configuring NTP Configuring Time Servers Setting the Time Zone...
Page 9 Contents Traffic Segmentation Enabling Traffic Segmentation Configuring Uplink and Downlink Ports VLAN Trunking 5 VLAN Configuration IEEE 802.1Q VLANs Configuring VLAN Groups Adding Static Members to VLANs Configuring Dynamic VLAN Registration IEEE 802.1Q Tunneling Enabling QinQ Tunneling on the Switch Adding an Interface to a QinQ Tunnel Protocol VLANs Configuring Protocol VLAN Groups...
Page 10 Contents Configuring Multiple Spanning Trees Configuring Interface Settings for MSTP 8 Congestion Control Rate Limiting Storm Control Automatic Traffic Control Setting the ATC Timers Configuring ATC Thresholds and Responses 9 Class of Service Layer 2 Queue Settings Setting the Default Priority for Interfaces Selecting the Queue Mode Mapping CoS Values to Egress Queues Layer 3/4 Priority Settings...
Page 11 Contents Configuring AAA Authorization Configuring User Accounts Web Authentication Configuring Global Settings for Web Authentication Configuring Interface Settings for Web Authentication Network Access (MAC Address Authentication) Configuring Global Settings for Network Access Configuring Network Access for Ports Configuring Port Link Detection Configuring a MAC Address Filter Displaying Secure MAC Address Information Configuring HTTPS...
Page 12 Contents Displaying ARP Inspection Statistics Displaying the ARP Inspection Log Filtering IP Addresses for Management Access Configuring Port Security Configuring 802.1X Port Authentication Configuring 802.1X Global Settings Configuring Port Authenticator Settings for 802.1X Configuring Port Supplicant Settings for 802.1X Displaying 802.1X Statistics DoS Protection IP Source Guard Configuring Ports for IP Source Guard...
Page 13 Contents Simple Network Management Protocol Configuring Global Settings for SNMP Setting the Local Engine ID Specifying a Remote Engine ID Setting SNMPv3 Views Configuring SNMPv3 Groups Setting Community Access Strings Configuring Local SNMPv3 Users Configuring Remote SNMPv3 Users Specifying Trap Managers Creating SNMP Notification Logs Showing SNMP Statistics Remote Monitoring...
Page 14 Contents Showing the MTU for Responding Destinations 15 IP Services Domain Name Service Configuring General DNS Service Parameters Configuring a List of Domain Names Configuring a List of Name Servers Configuring Static DNS Host to Address Entries Displaying the DNS Cache Multicast Domain Name Service Dynamic Host Configuration Protocol Specifying A DHCP Client Identifier...
Page 15 Contents Configuring MVR Domain Settings Configuring MVR Group Address Profiles Configuring MVR Interface Status Assigning Static MVR Multicast Groups to Interfaces Displaying MVR Receiver Groups Displaying MVR Statistics Section III Appendices A Software Specifications Software Features Management Features Standards Management Information Bases B Troubleshooting Problems Accessing the Management Interface Using System Logs...
Page 16 Contents – 16 –...
Page 17: Figures
Figures Figure 1: Home Page Figure 2: Front Panel Indicators Figure 3: System Information Figure 4: General Switch Information Figure 5: Configuring Support for Jumbo Frames Figure 6: Displaying Bridge Extension Configuration Figure 7: Copy Firmware Figure 8: Saving the Running Configuration Figure 9: Setting Start-Up Files Figure 10: Displaying System Files Figure 11: Configuring Automatic Code Upgrade...
Page 18 Figures Figure 30: Configuring Connections by Port Range Figure 31: Displaying Port Information Figure 32: Configuring Local Port Mirroring Figure 33: Configuring Local Port Mirroring Figure 34: Displaying Local Port Mirror Sessions Figure 35: Configuring Remote Port Mirroring Figure 36: Configuring Remote Port Mirroring (Source) Figure 37: Configuring Remote Port Mirroring (Intermediate) Figure 38: Configuring Remote Port Mirroring (Destination) Figure 39: Showing Port Statistics (Table)
Page 19 Figures Figure 65: Configuring VLAN Trunking Figure 66: VLAN Compliant and VLAN Non-compliant Devices Figure 67: Using GVRP Figure 68: Creating Static VLANs Figure 69: Modifying Settings for Static VLANs Figure 70: Showing Static VLANs Figure 71: Configuring Static Members by VLAN Index Figure 72: Configuring Static VLAN Members by Interface Figure 73: Configuring Static VLAN Members by Interface Range Figure 74: Configuring Global Status of GVRP...
Page 20 Figures Figure 100: Showing the Source MAC Addresses to Mirror Figure 101: Configuring Extended MAC Security on a VLAN Figure 102: Configuring Extended MAC Security on a Port or Trunk Figure 103: STP Root Ports and Designated Ports Figure 104: MSTP Region, Internal Spanning Tree, Multiple Spanning Tree Figure 105: Common Internal Spanning Tree, Common Spanning Tree, Internal Spanning Tree Figure 106: Configuring Port Loopback Detection...
Page 21 Figures Figure 134: Setting the Trust Mode Figure 135: Configuring DSCP to DSCP Internal Mapping Figure 136: Showing DSCP to DSCP Internal Mapping Figure 137: Configuring CoS to DSCP Internal Mapping Figure 138: Showing CoS to DSCP Internal Mapping Figure 139: Configuring a Class Map Figure 140: Showing Class Maps Figure 141: Adding Rules to a Class Map Figure 142: Showing the Rules for a Class Map...
Page 22 Figures Figure 169: Configuring User Accounts Figure 170: Showing User Accounts Figure 171: Configuring Global Settings for Web Authentication Figure 172: Configuring Interface Settings for Web Authentication Figure 173: Configuring Global Settings for Network Access Figure 174: Configuring Interface Settings for Network Access Figure 175: Configuring Link Detection for Network Access Figure 176: Configuring a MAC Address Filter for Network Access Figure 177: Showing the MAC Address Filter Table for Network Access...
Page 23 Figures Figure 204: Configuring VLAN Settings for ARP Inspection Figure 205: Configuring Interface Settings for ARP Inspection Figure 206: Displaying Statistics for ARP Inspection Figure 207: Displaying the ARP Inspection Log Figure 208: Creating an IP Address Filter for Management Access Figure 209: Showing IP Addresses Authorized for Management Access Figure 210: Configuring Port Security Figure 211: Configuring Port Security...
Page 24 Figures Figure 239: Displaying LLDP Device Statistics (General) Figure 240: Displaying LLDP Device Statistics (Port) Figure 241: Showing the Switch’s PoE Budget Figure 242: Setting a Port’s PoE Budget Figure 243: Configuring Global Settings for SNMP Figure 244: Configuring the Local Engine ID for SNMP Figure 245: Configuring a Remote Engine ID for SNMP Figure 246: Showing Remote Engine IDs for SNMP Figure 247: Creating an SNMP View...
Page 25 Figures Figure 274: Showing Configured RMON Statistical Samples Figure 275: Showing Collected RMON Statistical Samples Figure 276: Configuring a Switch Cluster Figure 277: Configuring Cluster Members Figure 278: Showing Cluster Members Figure 279: Showing Cluster Candidates Figure 280: Managing a Cluster Member Figure 281: Pinging a Network Device Figure 282: Setting the ARP Timeout Figure 283: Displaying ARP Entries...
Page 26 Figures Figure 309: Multicast Filtering Concept Figure 310: Configuring General Settings for IGMP Snooping Figure 311: Configuring a Static Interface for a Multicast Router Figure 312: Showing Static Interfaces Attached a Multicast Router Figure 313: Showing Current Interfaces Attached a Multicast Router Figure 314: Assigning an Interface to a Multicast Service Figure 315: Showing Static Interfaces Assigned to a Multicast Service Figure 316: Configuring IGMP Snooping on an Interface...
Page 27 Figures Figure 344: Showing the MVR Group Address Profiles Assigned to a Domain Figure 345: Configuring Interface Settings for MVR Figure 346: Assigning Static MVR Groups to a Port Figure 347: Showing the Static MVR Groups Assigned to a Port Figure 348: Displaying MVR Receiver Groups Figure 349: Displaying MVR Statistics –...
Page 28 Figures – 28 –...
Page 29: Tables
Tables Table 1: Key Features Table 2: System Defaults Table 3: Web Page Configuration Buttons Table 4: Switch Main Menu Table 5: Port Statistics Table 6: LACP Port Counters Table 7: LACP Internal Configuration Information Table 8: LACP Remote Device Configuration Information Table 9: Traffic Segmentation Forwarding Table 10: MAC Address Isolation Matrix Table 11: Recommended STA Path Cost Range...
Page 30 Tables Table 30: Supported Notification Messages Table 31: Address Resolution Protocol Table 32: Show IPv6 Neighbors - display description Table 33: Show IPv6 Statistics - display description Table 34: Show MTU - display description Table 35: RADIUS Server AVPs Table 36: Troubleshooting Chart –...
Page 31: Section I
Section I Getting Started This section provides an overview of the switch, and introduces some basic concepts about network switches. It also describes the menu structure for the management interface. This section includes these chapters: ◆ "Introduction" on page 33 ◆...
Page 32 Section I | Getting Started – 32 –...
Page 33: Introduction
Introduction This switch provides a broad range of features for Layer 2 switching. It includes a management agent that allows you to configure the features listed in this manual. The default configuration can be used for most of the features provided by this switch.
Page 34: Description Of Software Features
Chapter 1 | Introduction Description of Software Features (Continued) Table 1: Key Features Feature Description IP Version 4 and 6 Supports IPv4 and IPv6 addressing, and management IEEE 802.1D Bridge Supports dynamic data switching and addresses learning Store-and-Forward Supported to ensure wire-speed switching while eliminating bad Switching frames Spanning Tree Algorithm...
Page 35 Chapter 1 | Introduction Description of Software Features authentication server to verify the client’s right to access the network via an authentication server (i.e., RADIUS or TACACS+ server). Other authentication options include HTTPS for secure management access via the web, SSH for secure management access over a Telnet-equivalent connection, SNMP Version 3, IP address filtering for SNMP/Telnet/web management access, and MAC address filtering and IP source guard also provide authenticated for port access.
Page 36 Chapter 1 | Introduction Description of Software Features MAC A A static address can be assigned to a specific interface on this switch. Static TATIC DDRESSES addresses are bound to the assigned interface and will not be moved. When a static address is seen on another interface, the address will be ignored and will not be written to the address table.
Page 37 Chapter 1 | Introduction Description of Software Features convergence than RSTP by limiting the size of each region, and prevents VLAN members from being segmented from the rest of the group (as sometimes occurs with IEEE 802.1D STP). The switch supports up to 256 VLANs. A Virtual LAN is a collection of network IRTUAL nodes that share the same collision domain regardless of their physical location or connection point in the network.
Page 38 Chapter 1 | Introduction Description of Software Features Differentiated Services (DiffServ) provides policy-based management mechanisms UALITY OF ERVICE used for prioritizing network resources to meet the requirements of specific traffic types on a per-hop basis. Each packet is classified upon entry into the network based on access lists, IP Precedence or DSCP values, or VLAN lists.
Page 39: System Defaults
Chapter 1 | Introduction System Defaults System Defaults The switch’s system defaults are provided in the configuration file “Factory_Default_Config.cfg.” To reset the switch defaults, this file should be set as the startup configuration file. The following table lists some of the basic system defaults. Table 2: System Defaults Function Parameter...
Page 40 Chapter 1 | Introduction System Defaults (Continued) Table 2: System Defaults Function Parameter Default SNMP SNMP Agent Enabled Community Strings “public” (read only) “private” (read/write) Traps Authentication traps: enabled Link-up-down events: enabled SNMP V3 View: defaultview Group: public (read only); private (read/write) Port Configuration Admin Status...
Page 41 Chapter 1 | Introduction System Defaults (Continued) Table 2: System Defaults Function Parameter Default IP Settings Management. VLAN VLAN 1 IP Address DHCP Subnet Mask 255.255.0.0 Default Gateway 0.0.0.0 DHCP Client: Disabled Proxy service Multicast DNS Enabled BOOTP Disabled Multicast Filtering IGMP Snooping (Layer 2) Snooping: Disabled Querier: Disabled...
Page 42 Chapter 1 | Introduction System Defaults – 42 –...
Page 43: Using The Web Interface
Using the Web Interface This switch provides an embedded HTTP web agent. Using a web browser you can configure the switch and view statistics to monitor network activity. The web agent can be accessed by any computer on the network using a standard web browser (Internet Explorer 6.x or above, or Mozilla Firefox 4.x or above).
Page 44: Navigating The Web Browser Interface
Figure 1: Home Page Note: This manual covers the ECS4210-12P and ECS4210-28P Gigabit Ethernet PoE switches, as well as the ECS4210-12T and ECS4210-28T Gigabit Ethernet switches. Other than the number of ports and support for PoE, there are no other significant differences.
Page 45: Configuration Options
| Using the Web Interface Navigating the Web Browser Interface You can open a connection to the vendor’s web site by clicking on the Edge-Core logo. Configuration Options Configurable parameters have a dialog box or a drop-down list. Once a configuration change has been made on a page, be sure to click on the Apply button to confirm the new setting.
Page 46: Panel Display
The web agent displays an image of the switch’s ports. The Mode can be set to display different information for the ports, including Active (i.e., up or down), Duplex (i.e., half or full duplex), or Flow Control (i.e., with or without flow control). Figure 2: Front Panel Indicators ECS4210-12P ECS4210-28P ECS4210-12T ECS4210-28T...
Page 47: Main Menu
Chapter 2 | Using the Web Interface Navigating the Web Browser Interface Main Menu Using the onboard web agent, you can define system parameters, manage and control the switch, and all its ports, or monitor network conditions. The following table briefly describes the selections available from this program. Table 4: Switch Main Menu Menu Description...
Page 48 Chapter 2 | Using the Web Interface Navigating the Web Browser Interface (Continued) Table 4: Switch Main Menu Menu Description Page Reset Restarts the switch immediately, at a specified time, after a specified delay, or at a periodic interval Interface Port General Configure by Port List...
Page 49 Chapter 2 | Using the Web Interface Navigating the Web Browser Interface (Continued) Table 4: Switch Main Menu Menu Description Page Internal Displays configuration settings and operational state for the local side of a link aggregation Neighbors Displays configuration settings and operational state for the remote side of a link aggregation Configure Trunk Show...
Page 50 Chapter 2 | Using the Web Interface Navigating the Web Browser Interface (Continued) Table 4: Switch Main Menu Menu Description Page Configure Interface Sets the tunnel mode for any participating interface Protocol Configure Protocol Creates a protocol group, specifying supported protocols Show Shows configured protocol groups Configure Interface...
Page 51 Chapter 2 | Using the Web Interface Navigating the Web Browser Interface (Continued) Table 4: Switch Main Menu Menu Description Page Extended MAC Security Configures the maximum number of MAC addresses that can be learned on an interface, the movable-static function which allows a static address to be moved to another interface, and the sticky-dynamic function which prevents dynamic address already learned elsewhere from being learned at a specified interface.
Page 52 Chapter 2 | Using the Web Interface Navigating the Web Browser Interface (Continued) Table 4: Switch Main Menu Menu Description Page Priority Default Priority Sets the default priority for each port or trunk Queue Sets queue mode for the switch; sets the service weight for each queue that will use a weighted or hybrid mode Trust Mode Selects IP Precedence, DSCP or CoS priority processing...
Page 53 Chapter 2 | Using the Web Interface Navigating the Web Browser Interface (Continued) Table 4: Switch Main Menu Menu Description Page Configure OUI Maps the OUI in the source MAC address of ingress packets to the VoIP device manufacturer Show Shows the OUI telephony list Configure Interface Configures VoIP traffic settings for ports, including the way in which a...
Page 54 Chapter 2 | Using the Web Interface Navigating the Web Browser Interface (Continued) Table 4: Switch Main Menu Menu Description Page User Accounts Configures user names, passwords, and access levels Show Shows authorized users Modify Modifies user attributes Web Authentication Allows authentication and access to the network when 802.1X or Network Access authentication are infeasible or impractical Configure Global...
Page 55 Chapter 2 | Using the Web Interface Navigating the Web Browser Interface (Continued) Table 4: Switch Main Menu Menu Description Page Access Control Lists Configure ACL Show TCAM Shows utilization parameters for TCAM Adds an ACL based on IP or MAC address filtering Show Shows the name and type of configured ACLs Add Rule...
Page 56 Chapter 2 | Using the Web Interface Navigating the Web Browser Interface (Continued) Table 4: Switch Main Menu Menu Description Page IP Source Guard Filters IP traffic based on static entries in the IP Source Guard table, or dynamic entries in the DHCP Snooping table Port Configuration Enables IP source guard and selects filter type per port Static Binding...
Page 57 Chapter 2 | Using the Web Interface Navigating the Web Browser Interface (Continued) Table 4: Switch Main Menu Menu Description Page Power over Ethernet Configure Global Displays the power budget for the switch Configure Interface Configures port power parameters SNMP Simple Network Management Protocol Configure Global Enables SNMP agent status, and sets related trap functions...
Page 58 Chapter 2 | Using the Web Interface Navigating the Web Browser Interface (Continued) Table 4: Switch Main Menu Menu Description Page RMON Remote Monitoring Configure Global Alarm Sets threshold bounds for a monitored variable Event Creates a response event for an alarm Show Alarm Shows all configured alarms...
Page 59 Chapter 2 | Using the Web Interface Navigating the Web Browser Interface (Continued) Table 4: Switch Main Menu Menu Description Page Configure Interface Configures IPv6 interface address using auto-configuration or link-local address, and sets related protocol settings Add IPv6 Address Adds an global unicast, EUI-64, or link-local IPv6 address to an interface Show IPv6 Address Show the IPv6 addresses assigned to an interface...
Page 60 Chapter 2 | Using the Web Interface Navigating the Web Browser Interface (Continued) Table 4: Switch Main Menu Menu Description Page Configure VLAN Enables DHCP snooping on a VLAN Configure Interface Sets the trust mode for an interface Show Information Displays the DHCP Snooping binding information Multicast IGMP Snooping...
Page 61 Chapter 2 | Using the Web Interface Navigating the Web Browser Interface (Continued) Table 4: Switch Main Menu Menu Description Page Show Port Statistics Shows statistics for protocol messages, number of active groups Show Trunk Statistics Shows statistics for protocol messages, number of active groups MLD Snooping General Enables multicast filtering;...
Page 62 Shows statistics for protocol messages and number of active groups Show Port Statistics Shows statistics for protocol messages and number of active groups Show Trunk Statistics Shows statistics for protocol messages and number of active groups * ECS4210-12P, ECS4210-28P – 62 –...
Page 63: Web Configuration
Section II Web Configuration This section describes the basic switch features, along with a detailed description of how to configure each feature via a web browser. This section includes these chapters: ◆ “Basic Management Tasks” on page 65 ◆ “Interface Configuration” on page 95 ◆...
Page 64 Section II | Web Configuration – 64 –...
Page 65: Basic Management Tasks
Basic Management Tasks This chapter describes the following topics: ◆ Displaying System Information – Provides basic system description, including contact information. ◆ Displaying Hardware/Software Versions – Shows the hardware version, power status, and firmware versions ◆ Configuring Support for Jumbo Frames –...
Page 66: Displaying System Information
◆ System Description – Brief description of device type. ◆ System Object ID – MIB II object ID for switch’s network management subsystem. (ECS4210-12P: 1.3.6.1.4.1.259.10.1.42.104, ECS4210-12T: 1.3.6.1.4.1.259.10.1.42.103, ECS4210-28T: 1.3.6.1.4.1.259.10.1.42.101, ECS4210-28P: 1.3.6.1.4.1.259.10.1.42.102) ◆ System Up Time – Length of time the management agent has been up.
Page 67: Displaying Hardware/Software Versions
Chapter 3 | Basic Management Tasks Displaying Hardware/Software Versions Figure 3: System Information Displaying Hardware/Software Versions Use the System > Switch page to display hardware/firmware version numbers for the main board and management software, as well as the power status of the system.
Page 68: Configuring Support For Jumbo Frames
Chapter 3 | Basic Management Tasks Configuring Support for Jumbo Frames Web Interface To view hardware and software version information. Click System, then Switch. Figure 4: General Switch Information Configuring Support for Jumbo Frames Use the System > Capability page to configure support for Layer 2 jumbo frames. The switch provides more efficient throughput for large sequential data transfers by supporting jumbo frames up to 10240 bytes for Gigabit Ethernet.
Page 69: Displaying Bridge Extension Capabilities
Chapter 3 | Basic Management Tasks Displaying Bridge Extension Capabilities Web Interface To configure support for jumbo frames: Click System, then Capability. Enable or disable support for jumbo frames. Click Apply. Figure 5: Configuring Support for Jumbo Frames Displaying Bridge Extension Capabilities Use the System >...
Page 70: Figure 6: Displaying Bridge Extension Configuration
Chapter 3 | Basic Management Tasks Displaying Bridge Extension Capabilities ◆ Configurable PVID Tagging – This switch allows you to override the default Port VLAN ID (PVID used in frame tags) and egress status (VLAN-Tagged or Untagged) on each port. (Refer to “VLAN Configuration”...
Page 71: Managing System Files
Chapter 3 | Basic Management Tasks Managing System Files Managing System Files This section describes how to upgrade the switch operating software or configuration files, and set the system start-up files. Copying Files via FTP/ Use the System > File (Copy) page to upload/download firmware or configuration TFTP or HTTP settings using FTP, TFTP or HTTP.
Page 72: Figure 7: Copy Firmware
Chapter 3 | Basic Management Tasks Managing System Files Note: Up to two copies of the system software (i.e., the runtime firmware) can be stored in the file directory on the switch. Note: The maximum number of user-defined configuration files is limited only by available flash memory space.
Page 73: Saving The Running Configuration To A Local File
Chapter 3 | Basic Management Tasks Managing System Files Saving the Running Use the System > File (Copy) page to save the current configuration settings to a local file on the switch. The configuration settings are not automatically saved by Configuration to a the system for subsequent use when the switch is rebooted.
Page 74: Setting The Start-Up File
Chapter 3 | Basic Management Tasks Managing System Files If you replaced a file currently used for startup and want to start using the new file, reboot the system via the System > Reset menu. Setting The Use the System > File (Set Start-Up) page to specify the firmware or configuration Start-Up File file to use for system initialization.
Page 75: Automatic Operation Code Upgrade
Chapter 3 | Basic Management Tasks Managing System Files To delete a file, mark it in the File List and click Delete. Figure 10: Displaying System Files Automatic Operation Use the System > File (Automatic Operation Code Upgrade) page to automatically Code Upgrade download an operation code file when a file newer than the currently installed one is discovered on the file server.
Page 76 Chapter 3 | Basic Management Tasks Managing System Files from the server even though ECS4210-SERIES.bix was requested). However, keep in mind that the file systems of many operating systems such as Unix and most Unix-like systems (FreeBSD, NetBSD, OpenBSD, and most Linux distributions, etc.) are case-sensitive, meaning that two files in the same directory, ecs4210-series.bix and ECS4210-SERIES.bix are considered to be unique files.
Page 77 Chapter 3 | Basic Management Tasks Managing System Files The following syntax must be observed: tftp://host[/filedir]/ tftp:// – Defines TFTP protocol for the server connection. ■ host – Defines the IP address of the TFTP server. Valid IP addresses consist of ■...
Page 78: Figure 11: Configuring Automatic Code Upgrade
Chapter 3 | Basic Management Tasks Managing System Files tftp://192.168.0.1/switches/opcode/ ■ The image file is in the “opcode” directory, which is within the “switches” parent directory, relative to the TFTP root. The following examples demonstrate the URL syntax for an FTP server at IP address 192.168.0.1 with various user name, password and file location options presented: ftp://192.168.0.1/...
Page 79: Setting The System Clock
Chapter 3 | Basic Management Tasks Setting the System Clock If a new image is found at the specified location, the following type of messages will be displayed during bootup. Automatic Upgrade is looking for a new image New image detected: current version 1.0.1.5; new version 1.1.2.0 Image upgrade in progress The switch will restart after upgrade succeeds Downloading new image...
Page 80: Setting The Sntp Polling Interval
Chapter 3 | Basic Management Tasks Setting the System Clock Web Interface To manually set the system clock: Click System, then Time. Select Configure General from the Step list. Select Manually from the Maintain Type list. Enter the time and date in the appropriate fields. Click Apply Figure 12: Manually Setting the System Clock Setting the SNTP...
Page 81: Configuring Ntp
Chapter 3 | Basic Management Tasks Setting the System Clock Click Apply Figure 13: Setting the Polling Interval for SNTP Configuring NTP Use the System > Time (Configure General - NTP) page to configure NTP authentication and show the polling interval at which the switch will query the specified time servers.
Page 82: Configuring Time Servers
Chapter 3 | Basic Management Tasks Setting the System Clock Figure 14: Configuring NTP Configuring Time Use the System > Time (Configure Time Server) pages to specify the IP address for Servers NTP/SNTP time servers, or to set the authentication key for NTP time servers. Specifying SNTP Time Servers Use the System >...
Page 83: Figure 16: Adding An Ntp Time Server
Chapter 3 | Basic Management Tasks Setting the System Clock Specifying NTP Time Servers Use the System > Time (Configure Time Server – Add NTP Server) page to add the IP address for up to 50 NTP time servers. Parameters The following parameters are displayed: ◆...
Page 84: Figure 17: Showing The Ntp Time Server List
Chapter 3 | Basic Management Tasks Setting the System Clock To show the list of configured NTP time servers: Click System, then Time. Select Configure Time Server from the Step list. Select Show NTP Server from the Action list. Figure 17: Showing the NTP Time Server List Specifying NTP Authentication Keys Use the System >...
Page 85: Setting The Time Zone
Chapter 3 | Basic Management Tasks Setting the System Clock Figure 18: Adding an NTP Authentication Key To show the list of configured NTP authentication keys: Click System, then Time. Select Configure Time Server from the Step list. Select Show NTP Authentication Key from the Action list. Figure 19: Showing the NTP Authentication Key List Setting the Time Zone Use the System >...
Page 86: Configuring The Console Port
Chapter 3 | Basic Management Tasks Configuring the Console Port Web Interface To set your local time zone: Click System, then Time. Select Configure Time Zone from the Action list. Set the offset for your time zone relative to the UTC in hours and minutes. Click Apply.
Page 87 Chapter 3 | Basic Management Tasks Configuring the Console Port ◆ Password Threshold – Sets the password intrusion threshold, which limits the number of failed logon attempts. When the logon attempt threshold is reached, the system interface becomes silent for a specified amount of time (set by the Silent Time parameter) before allowing the next logon attempt.
Page 88: Configuring Telnet Settings
Chapter 3 | Basic Management Tasks Configuring Telnet Settings Figure 21: Console Port Settings Configuring Telnet Settings Use the System > Telnet menu to configure parameters for accessing the CLI over a Telnet connection. You can access the onboard configuration program over the network using Telnet (i.e., a virtual terminal).
Page 89: Figure 22: Telnet Connection Settings
Chapter 3 | Basic Management Tasks Configuring Telnet Settings ◆ Password Threshold – Sets the password intrusion threshold, which limits the number of failed logon attempts. When the logon attempt threshold is reached, the system interface becomes silent for a specified amount of time (set by the Silent Time parameter) before allowing the next logon attempt.
Page 90: Displaying Cpu Utilization
Chapter 3 | Basic Management Tasks Displaying CPU Utilization Displaying CPU Utilization Use the System > CPU Utilization page to display information on CPU utilization. Parameters The following parameters are displayed: ◆ Time Interval – The interval at which to update the displayed utilization rate. (Options: 1, 5, 10, 30, 60 seconds;...
Page 91: Displaying Memory Utilization
Chapter 3 | Basic Management Tasks Displaying Memory Utilization Displaying Memory Utilization Use the System > Memory Status page to display memory utilization parameters. Parameters The following parameters are displayed: ◆ Free Size – The amount of memory currently free for use. ◆...
Page 92 Chapter 3 | Basic Management Tasks Resetting the System Parameters The following parameters are displayed: System Reload Information ◆ Reload Settings – Displays information on the next scheduled reload and selected reload mode as shown in the following example: “The switch will be rebooted at March 9 12:00:00 2012. Remaining Time: 0 days, 2 hours, 46 minutes, 5 seconds.
Page 93: Figure 25: Restarting The Switch (Immediately)
Chapter 3 | Basic Management Tasks Resetting the System Monthly - Day of the month at which to reload. (Range: 1-31) ■ Web Interface To restart the switch: Click System, then Reset. Select the required reload mode. For any option other than to reset immediately, fill in the required parameters Click Apply.
Page 94: Figure 26: Restarting The Switch (In)
Chapter 3 | Basic Management Tasks Resetting the System Figure 26: Restarting the Switch (In) Figure 27: Restarting the Switch (At) Figure 28: Restarting the Switch (Regularly) – 94 –...
Page 95: Interface Configuration
Interface Configuration This chapter describes the following topics: ◆ Port Configuration – Configures connection settings, including auto- negotiation, or manual setting of speed, duplex mode, and flow control. ◆ Local Port Mirroring – Sets the source and target ports for mirroring on the local switch.
Page 96 Chapter 4 | Interface Configuration Port Configuration mode, or flow control under auto-negotiation, the required operation modes must be specified in the capabilities list for an interface. ◆ The 1000BASE-T standard does not support forced mode. Auto-negotiation should always be used to establish a connection over any 1000BASE-T port or trunk.
Page 97: Configuring By Port Range
Chapter 4 | Interface Configuration Port Configuration ◆ Speed/Duplex – Allows you to manually set the port speed and duplex mode. (i.e., with auto-negotiation disabled) ◆ Flow Control – Allows automatic or manual selection of flow control. Web Interface To configure port connection parameters: Click Interface, Port, General.
Page 98: Displaying Connection Status
Chapter 4 | Interface Configuration Port Configuration Click Apply. Figure 30: Configuring Connections by Port Range Displaying Use the Interface > Port > General (Show Information) page to display the current connection status, including link state, speed/duplex mode, flow control, and auto- Connection Status negotiation.
Page 99: Configuring Local Port Mirroring
Chapter 4 | Interface Configuration Port Configuration Web Interface To display port connection parameters: Click Interface, Port, General. Select Show Information from the Action List. Figure 31: Displaying Port Information Configuring Use the Interface > Port > Mirror page to mirror traffic from any source port to a Local Port Mirroring target port for real-time analysis.
Page 100: Figure 33: Configuring Local Port Mirroring
Chapter 4 | Interface Configuration Port Configuration Mirroring” on page 173), the target port cannot be set to the same target ports as that used for port mirroring by this command. ◆ When traffic matches the rules for both port mirroring, and for mirroring of VLAN traffic or packets based on a MAC address, the matching packets will not be sent to target port specified for port mirroring.
Page 101: Configuring Remote Port Mirroring
Chapter 4 | Interface Configuration Port Configuration To display the configured mirror sessions: Click Interface, Port, Mirror. Select Show from the Action List. Figure 34: Displaying Local Port Mirror Sessions Configuring Use the Interface > RSPAN page to mirror traffic from remote switches for analysis Remote Port Mirroring at a destination port on the local switch.
Page 102 Chapter 4 | Interface Configuration Port Configuration ◆ Configuration Guidelines Take the following step to configure an RSPAN session: Use the VLAN Static List (see “Configuring VLAN Groups” on page 138) to reserve a VLAN for use by RSPAN (marking the “Remote VLAN” field on this page.
Page 103 Chapter 4 | Interface Configuration Port Configuration RSPAN uplink ports are enabled on the switch, 802.1X cannot be enabled globally. Port Security – If port security is enabled on any port, that port cannot be ■ set as an RSPAN uplink port, even though it can still be configured as an RSPAN source or destination port.
Page 104: Figure 36: Configuring Remote Port Mirroring (Source)
Chapter 4 | Interface Configuration Port Configuration ◆ Destination Port – Specifies the destination port to monitor the traffic mirrored from the source ports. Only one destination port can be configured on the same switch per session, but a destination port can be configured on more than one switch for the same session.
Page 105: Showing Port Or Trunk Statistics
Chapter 4 | Interface Configuration Port Configuration Figure 37: Configuring Remote Port Mirroring (Intermediate) Figure 38: Configuring Remote Port Mirroring (Destination) Showing Port or Trunk Use the Interface > Port/Trunk > Statistics or Chart page to display standard Statistics statistics on network traffic from the Interfaces Group and Ethernet-like MIBs, as well as a detailed breakdown of traffic based on the RMON MIB.
Page 106: Table 5: Port Statistics
Chapter 4 | Interface Configuration Port Configuration Parameters These parameters are displayed: Table 5: Port Statistics Parameter Description Interface Statistics Received Octets The total number of octets received on the interface, including framing characters. Transmitted Octets The total number of octets transmitted out of the interface, including framing characters.
Page 107 Chapter 4 | Interface Configuration Port Configuration (Continued) Table 5: Port Statistics Parameter Description Deferred Transmissions A count of frames for which the first transmission attempt on a particular interface is delayed because the medium was busy. Frames Too Long A count of frames received on a particular interface that exceed the maximum permitted frame size.
Page 108: Figure 39: Showing Port Statistics (Table)
Chapter 4 | Interface Configuration Port Configuration (Continued) Table 5: Port Statistics Parameter Description 65-127 Byte Packets The total number of packets (including bad packets) received and transmitted where the number of octets fall within the specified range 128-255 Byte Packets (excluding framing bits but including FCS octets).
Page 109: Figure 40: Showing Port Statistics (Chart)
Chapter 4 | Interface Configuration Port Configuration To show a chart of port statistics: Click Interface, Port, Chart. Select the statistics mode to display (Interface, Etherlike, RMON or All). If Interface, Etherlike, RMON statistics mode is chosen, select a port from the drop-down list.
Page 110: Performing Cable Diagnostics
Chapter 4 | Interface Configuration Port Configuration Performing Use the Interface > Port > Cable Test page to test the cable attached to a port. The cable test will check for any cable faults (short, open, etc.). If a fault is found, the Cable Diagnostics switch reports the length to the fault.
Page 111: Configuring Port Isolation
Chapter 4 | Interface Configuration Port Configuration Web Interface To test the cable attached to a port: Click Interface, Port, Cable Test. Click Test for any port to start the cable test. Figure 41: Performing Cable Tests Configuring Port Isolation can be used to restrict the traffic types or protocol types allowed to Port Isolation pass between specified ports.
Page 112: Figure 42: Enabling Port Isolation Globally
Chapter 4 | Interface Configuration Port Configuration Enable or disable port isolation as required. Click Apply. Figure 42: Enabling Port Isolation Globally Configuring Port Isolation Profiles Use the Interface > Port > Isolation (Configure Profile - Add) page to set the traffic type or protocol type to include in a profile.
Page 113: Figure 43: Configuring Port Isolation Profiles
Chapter 4 | Interface Configuration Port Configuration Figure 43: Configuring Port Isolation Profiles To display the configured settings for a profile: Click Interface, Port, Isolation. Se let Configure Profile from the Step list. Select Show from the Action list. Figure 44: Displaying Port Isolation Profiles Assigning Port Isolation Profiles Use the Interface >...
Page 114: Figure 45: Assigning Port Isolation Profiles
Chapter 4 | Interface Configuration Port Configuration ◆ When a profile is assigned to a port, any traffic attributes not defined in the profile are subject normal switching rules. Parameters These parameters are displayed: ◆ Profile ID – Profile identifier. (Range: 1-26) ◆...
Page 115: Trunk Configuration
Chapter 4 | Interface Configuration Trunk Configuration Trunk Configuration This section describes how to configure static and dynamic trunks. You can create multiple links between devices that work as one virtual, aggregate link. A port trunk offers a dramatic increase in bandwidth for network segments where bottlenecks exist, as well as providing a fault-tolerant link between two devices.
Page 116: Configuring A Static Trunk
Chapter 4 | Interface Configuration Trunk Configuration Configuring a Use the Interface > Trunk > Static pages to create a trunk, assign member ports, and configure the connection parameters. Static Trunk Figure 46: Configuring Static Trunks statically configured active links Command Usage ◆...
Page 117: Figure 47: Creating Static Trunks
Chapter 4 | Interface Configuration Trunk Configuration Figure 47: Creating Static Trunks To add member ports to a static trunk: Click Interface, Trunk, Static. Select Configure Trunk from the Step list. Select Add Member from the Action list. Select a trunk identifier. Set the unit and port for an additional trunk member.
Page 118: Configuring A Dynamic Trunk
Chapter 4 | Interface Configuration Trunk Configuration Figure 49: Configuring Connection Parameters for a Static Trunk To display trunk connection parameters: Click Interface, Trunk, Static. Select Configure General from the Step list. Select Show Information from the Action list. Figure 50: Showing Information for Static Trunks Configuring a Use the Interface >...
Page 119 Chapter 4 | Interface Configuration Trunk Configuration ◆ If the target switch has also enabled LACP on the connected ports, the trunk will be activated automatically. ◆ A trunk formed with another switch using LACP will automatically be assigned the next available trunk ID. ◆...
Page 120 Chapter 4 | Interface Configuration Trunk Configuration By default, the Actor Admin Key is determined by port's link speed, and copied to Oper Key. The Partner Admin Key is assigned to zero, and the Oper Key is set based upon LACP PDUs received from the Partner. ◆...
Page 121: Figure 52: Configuring The Lacp Aggregator Admin Key
Chapter 4 | Interface Configuration Trunk Configuration Figure 52: Configuring the LACP Aggregator Admin Key To enable LACP for a port: Click Interface, Trunk, Dynamic. Select Configure Aggregation Port from the Step list. Select Configure from the Action list. Click General. Enable LACP on the required ports.
Page 122: Figure 54: Configuring Lacp Parameters On A Port
Chapter 4 | Interface Configuration Trunk Configuration Configure the required settings. Click Apply. Figure 54: Configuring LACP Parameters on a Port To configure the connection parameters for a dynamic trunk: Click Interface, Trunk, Dynamic. Select Configure Trunk from the Step list. Select Configure from the Action list.
Page 123: Displaying Lacp Port Counters
Chapter 4 | Interface Configuration Trunk Configuration Figure 56: Displaying Connection Parameters for Dynamic Trunks To show the port members of dynamic trunks: Click Interface, Trunk, Dynamic. Select Configure General from the Step list. Select Show Member from the Action list. Figure 57: Showing Members of Dynamic Trunks Displaying LACP Use the Interface >...
Page 124: Displaying Lacp Settings And Status For The Local Side
Chapter 4 | Interface Configuration Trunk Configuration Web Interface To display LACP port counters: Click Interface, Trunk, Dynamic. Select Configure Aggregation Port from the Step list. Select Show Information from the Action list. Click Counters. Select a group member from the Port list. Figure 58: Displaying LACP Port Counters Displaying LACP Use the Interface >...
Page 125 Chapter 4 | Interface Configuration Trunk Configuration (Continued) Table 7: LACP Internal Configuration Information Parameter Description Admin State, Administrative or operational values of the actor’s state parameters: Oper State ◆ Expired – The actor’s receive machine is in the expired state; ◆...
Page 126: Displaying Lacp Settings And Status For The Remote Side
Chapter 4 | Interface Configuration Trunk Configuration Figure 59: Displaying LACP Port Internal Information Displaying LACP Use the Interface > Trunk > Dynamic (Configure Aggregation Port - Show Settings and Status for Information - Neighbors) page to display the configuration settings and operational state for the remote side of a link aggregation.
Page 127: Figure 60: Displaying Lacp Port Remote Information
Chapter 4 | Interface Configuration Trunk Configuration Web Interface To display LACP settings and status for the remote side: Click Interface, Trunk, Dynamic. Select Configure Aggregation Port from the Step list. Select Show Information from the Action list. Click Internal. Select a group member from the Port list.
Page 128: Traffic Segmentation
Chapter 4 | Interface Configuration Traffic Segmentation Traffic Segmentation If tighter security is required for passing traffic from different clients through downlink ports on the local network and over uplink ports to the service provider, port-based traffic segmentation can be used to isolate traffic for individual clients.
Page 129: Configuring Uplink And Downlink Ports
Chapter 4 | Interface Configuration Traffic Segmentation Figure 61: Enabling Traffic Segmentation Use the Interface > Traffic Segmentation (Configure Session) page to Configuring Uplink assign the downlink and uplink ports to use in the segmented group. Ports and Downlink Ports designated as downlink ports can not communicate with any other ports on the switch except for the uplink ports.
Page 130: Figure 62: Configuring Members For Traffic Segmentation
Chapter 4 | Interface Configuration Traffic Segmentation If a downlink port is not configured for the session, the assigned uplink ◆ ports will operate as normal ports. Parameters These parameters are displayed: Session ID – Traffic segmentation session. (Range: 1-4) ◆...
Page 131: Vlan Trunking
Chapter 4 | Interface Configuration VLAN Trunking To show the members of the traffic segmentation group: Click Interface, Traffic Segmentation. Select Configure Session from the Step list. Select Show from the Action list. Figure 63: Showing Traffic Segmentation Members VLAN Trunking Use the Interface >...
Page 132 Chapter 4 | Interface Configuration VLAN Trunking ◆ VLAN trunking is mutually exclusive with the “access” switchport mode (see “Adding Static Members to VLANs” on page 140). If VLAN trunking is enabled on an interface, then that interface cannot be set to access mode, and vice versa.
Page 133: Figure 65: Configuring Vlan Trunking
Chapter 4 | Interface Configuration VLAN Trunking Figure 65: Configuring VLAN Trunking – 133 –...
Page 134 Chapter 4 | Interface Configuration VLAN Trunking – 134 –...
Page 135: Vlan Configuration
VLAN Configuration This chapter includes the following topics: ◆ IEEE 802.1Q VLANs – Configures static and dynamic VLANs. ◆ IEEE 802.1Q Tunneling – Configures QinQ tunneling to maintain customer- specific VLAN and Layer 2 protocol configurations across a service provider network, even when different customers use the same internal VLAN IDs.
Page 136: Figure 66: Vlan Compliant And Vlan Non-Compliant Devices
Chapter 5 | VLAN Configuration IEEE 802.1Q VLANs This switch supports the following VLAN features: ◆ Up to 256 VLANs based on the IEEE 802.1Q standard ◆ Distributed VLAN learning across multiple switches using explicit or implicit tagging and GVRP protocol ◆...
Page 137 Chapter 5 | VLAN Configuration IEEE 802.1Q VLANs frame is tagged, the switch uses the tagged VLAN ID to identify the port broadcast domain of the frame. Port Overlapping – Port overlapping can be used to allow access to commonly shared network resources among different VLAN groups, such as file servers or printers.
Page 138: Configuring Vlan Groups
Chapter 5 | VLAN Configuration IEEE 802.1Q VLANs Figure 67: Using GVRP Port-based VLAN 10 11 15 16 Forwarding Tagged/Untagged Frames If you want to create a small port-based VLAN for devices attached directly to a single switch, you can assign ports to the same untagged VLAN. However, to participate in a VLAN group that crosses several switches, you should create a VLAN for that group and enable tagging on all ports.
Page 139: Figure 68: Creating Static Vlans
Chapter 5 | VLAN Configuration IEEE 802.1Q VLANs ◆ Remote VLAN – Reserves this VLAN for RSPAN (see “Configuring Remote Port Mirroring” on page 101). Modify ◆ VLAN ID – ID of configured VLAN (1-4094). ◆ VLAN Name – Name of the VLAN (1 to 32 characters). ◆...
Page 140: Adding Static Members To Vlans
Chapter 5 | VLAN Configuration IEEE 802.1Q VLANs To modify the configuration settings for VLAN groups: Click VLAN, Static. Select Modify from the Action list. Select the identifier of a configured VLAN. Modify the VLAN name or operational status as required. Click Apply.
Page 141 Chapter 5 | VLAN Configuration IEEE 802.1Q VLANs Parameters These parameters are displayed: Edit Member by VLAN ◆ VLAN – ID of configured VLAN (1-4094). ◆ Interface – Displays a list of ports or trunks. ◆ Port – Port Identifier. (Range: 1-12/28) ◆...
Page 142 Chapter 5 | VLAN Configuration IEEE 802.1Q VLANs If ingress filtering is enabled and a port receives frames tagged for VLANs ■ for which it is not a member, these frames will be discarded. Ingress filtering does not affect VLAN independent BPDU frames, such as ■...
Page 143: Figure 71: Configuring Static Members By Vlan Index
Chapter 5 | VLAN Configuration IEEE 802.1Q VLANs Web Interface To configure static members by the VLAN index: Click VLAN, Static. Select Edit Member by VLAN from the Action list. Set the Interface type to display as Port or Trunk. Modify the settings for any interface as required.
Page 144: Figure 72: Configuring Static Vlan Members By Interface
Chapter 5 | VLAN Configuration IEEE 802.1Q VLANs Figure 72: Configuring Static VLAN Members by Interface To configure static members by interface range: Click VLAN, Static. Select Edit Member by Interface Range from the Action list. Set the Interface type to display as Port or Trunk. Enter an interface range.
Page 145: Configuring Dynamic Vlan Registration
Chapter 5 | VLAN Configuration IEEE 802.1Q VLANs Configuring Dynamic Use the VLAN > Dynamic page to enable GVRP globally on the switch, or to enable GVRP and adjust the protocol timers per interface. VLAN Registration Parameters These parameters are displayed: Configure General ◆...
Page 146: Figure 74: Configuring Global Status Of Gvrp
Chapter 5 | VLAN Configuration IEEE 802.1Q VLANs Show Dynamic VLAN – Show VLAN VLAN ID – Identifier of a VLAN this switch has joined through GVRP. VLAN Name – Name of a VLAN this switch has joined through GVRP. Status –...
Page 147: Figure 75: Configuring Gvrp For An Interface
Chapter 5 | VLAN Configuration IEEE 802.1Q VLANs Figure 75: Configuring GVRP for an Interface To show the dynamic VLAN joined by this switch: Click VLAN, Dynamic. Select Show Dynamic VLAN from the Step list. Select Show VLAN from the Action list. Figure 76: Showing Dynamic VLANs Registered on the Switch To show the members of a dynamic VLAN: Click VLAN, Dynamic.
Page 148: Ieee 802.1Q Tunneling
Chapter 5 | VLAN Configuration IEEE 802.1Q Tunneling Figure 77: Showing the Members of a Dynamic VLAN IEEE 802.1Q Tunneling IEEE 802.1Q Tunneling (QinQ) is designed for service providers carrying traffic for multiple customers across their networks. QinQ tunneling is used to maintain customer-specific VLAN and Layer 2 protocol configurations even when different customers use the same internal VLAN IDs.
Page 149: Figure 78: Qinq Operational Concept
Chapter 5 | VLAN Configuration IEEE 802.1Q Tunneling When a double-tagged packet enters another trunk port in an intermediate or core switch in the service provider’s network, the outer tag is stripped for packet processing. When the packet exits another trunk port on the same core switch, the same SPVLAN tag is again added to the packet.
Page 150 Chapter 5 | VLAN Configuration IEEE 802.1Q Tunneling After packet classification through the switching process, the packet is written to memory with one tag (an outer tag) or with two tags (both an outer tag and inner tag). The switch sends the packet to the proper egress port. If the egress port is an untagged member of the SPVLAN, the outer tag will be stripped.
Page 151 Chapter 5 | VLAN Configuration IEEE 802.1Q Tunneling After packet classification, the packet is written to memory for processing as a single-tagged or double-tagged packet. The switch sends the packet to the proper egress port. If the egress port is an untagged member of the SPVLAN, the outer tag will be stripped.
Page 152: Enabling Qinq Tunneling On The Switch
Chapter 5 | VLAN Configuration IEEE 802.1Q Tunneling Configure the SPVLAN ID as the native VID on the QinQ tunnel access port (see “Adding Static Members to VLANs” on page 140). Configure the QinQ tunnel uplink port to Uplink mode (see “Adding an Interface to a QinQ Tunnel”...
Page 153: Adding An Interface To A Qinq Tunnel
Chapter 5 | VLAN Configuration IEEE 802.1Q Tunneling Click Apply. Figure 79: Enabling QinQ Tunneling Adding an Interface to Follow the guidelines in the preceding section to set up a QinQ tunnel on the a QinQ Tunnel switch. Then use the VLAN > Tunnel (Configure Interface) page to set the tunnel mode for any participating interface.
Page 154: Protocol Vlans
Chapter 5 | VLAN Configuration Protocol VLANs Web Interface To add an interface to a QinQ tunnel: Click VLAN, Tunnel. Select Configure Interface from the Step list. Set the mode for any tunnel access port to Access and the tunnel uplink port to Uplink.
Page 155: Configuring Protocol Vlan Groups
Chapter 5 | VLAN Configuration Protocol VLANs Create a protocol group for each of the protocols you want to assign to a VLAN using the Configure Protocol (Add) page. Then map the protocol for each interface to the appropriate VLAN using the Configure Interface (Add) page.
Page 156: Mapping Protocol Groups To Interfaces
Chapter 5 | VLAN Configuration Protocol VLANs Enter an identifier for the protocol group.] Click Apply. Figure 81: Configuring Protocol VLANs To configure a protocol group: Click VLAN, Protocol. Select Configure Protocol from the Step list. Select Show from the Action list. Figure 82: Displaying Protocol VLANs Mapping Protocol Use the VLAN >...
Page 157 Chapter 5 | VLAN Configuration Protocol VLANs ◆ When a frame enters a port that has been assigned to a protocol VLAN, it is processed in the following manner: If the frame is tagged, it will be processed according to the standard rules ■...
Page 158: Configuring Ip Subnet Vlans
Chapter 5 | VLAN Configuration Configuring IP Subnet VLANs Figure 83: Assigning Interfaces to Protocol VLANs To show the protocol groups mapped to a port or trunk: Click VLAN, Protocol. Select Configure Interface from the Step list. Select Show from the Action list. Select a port or trunk.
Page 159 Chapter 5 | VLAN Configuration Configuring IP Subnet VLANs Command Usage ◆ Each IP subnet can be mapped to only one VLAN ID. An IP subnet consists of an IP address and a mask. The specified VLAN need not be an existing VLAN. ◆...
Page 160: Configuring Mac-Based Vlans
Chapter 5 | VLAN Configuration Configuring MAC-based VLANs Figure 85: Configuring IP Subnet VLANs To show the configured IP subnet VLANs: Click VLAN, IP Subnet. Select Show from the Action list. Figure 86: Showing IP Subnet VLANs Configuring MAC-based VLANs Use the VLAN >...
Page 161: Figure 87: Configuring Mac-Based Vlans
Chapter 5 | VLAN Configuration Configuring MAC-based VLANs ◆ When MAC-based, IP subnet-based, and protocol-based VLANs are supported concurrently, priority is applied in this sequence, and then port-based VLANs last. Parameters These parameters are displayed: ◆ MAC Address – A source MAC address which is to be mapped to a specific VLAN.
Page 162: Configuring Vlan Mirroring
Chapter 5 | VLAN Configuration Configuring VLAN Mirroring To show the MAC addresses mapped to a VLAN: Click VLAN, MAC-Based. Select Show from the Action list. Figure 88: Showing MAC-Based VLANs Configuring VLAN Mirroring Use the VLAN > Mirror (Add) page to mirror traffic from one or more source VLANs to a target port for real-time analysis.
Page 163: Figure 89: Configuring Vlan Mirroring
Chapter 5 | VLAN Configuration Configuring VLAN Mirroring Parameters These parameters are displayed: ◆ Source VLAN – A VLAN whose traffic will be monitored. (Range: 1-4094) ◆ Target Port – The destination port that receives the mirrored traffic from the source VLAN.
Page 164 Chapter 5 | VLAN Configuration Configuring VLAN Mirroring – 164 –...
Page 165: Address Table Settings
Address Table Settings Switches store the addresses for all known devices. This information is used to pass traffic directly between the inbound and outbound ports. All the addresses learned by monitoring traffic are stored in the dynamic address table. You can also manually configure static addresses that are bound to a specific port.
Page 166: Figure 91: Configuring Static Mac Addresses
Chapter 6 | Address Table Settings Setting Static Addresses ◆ Static addresses will not be removed from the address table when a given interface link is down. ◆ A static address cannot be learned on another port until the address is removed from the table.
Page 167: Configuring Mac Address Isolation
Chapter 6 | Address Table Settings Configuring MAC Address Isolation To show the static addresses in MAC address table: Click MAC Address, Static. Select Configure Static Address from the Step list. Select Show from the Action list. Figure 92: Displaying Static MAC Addresses Configuring MAC Address Isolation Use the MAC Address >...
Page 168: Table 10: Mac Address Isolation Matrix
Chapter 6 | Address Table Settings Configuring MAC Address Isolation ◆ Packets are filtered or forwarded according to the isolation profiles shown in the following table. Table 10: MAC Address Isolation Matrix SA Profile DA Profile Promiscuous Isolated Community 1 Community 2 Promiscuous Forward...
Page 169: Figure 93: Setting Global Status For Mac Address Isolation
Chapter 6 | Address Table Settings Configuring MAC Address Isolation Web Interface To enable or disable MAC isolation globally on the switch: Click MAC Address, Static. Select Configure Global from the Step list. Set the MAC-Isolation Global Status. Enter Apply. Figure 93: Setting Global Status for MAC Address Isolation To assign static addresses to an isolation mode: Click MAC Address, Static.
Page 170: Changing The Aging Time
Chapter 6 | Address Table Settings Changing the Aging Time To show the static addresses assigned to an isolation mode: Click MAC Address, Static. Select Configure Static Address from the Step list. Select Show from the Action list. Figure 95: Displaying Interfaces Assigned a MAC Address Isolation Mode Changing the Aging Time Use the MAC Address >...
Page 171: Displaying The Dynamic Address Table
Chapter 6 | Address Table Settings Displaying the Dynamic Address Table Figure 96: Setting the Address Aging Time Displaying the Dynamic Address Table Use the MAC Address > Dynamic (Show Dynamic MAC) page to display the MAC addresses learned by monitoring the source address for traffic entering the switch. When the destination address for inbound traffic is found in the database, the packets intended for that address are forwarded directly to the associated port.
Page 172: Clearing The Dynamic Address Table
Chapter 6 | Address Table Settings Clearing the Dynamic Address Table Click Query. Figure 97: Displaying the Dynamic MAC Address Table Clearing the Dynamic Address Table Use the MAC Address > Dynamic (Clear Dynamic MAC) page to remove any learned entries from the forwarding database.
Page 173: Configuring Mac Address Mirroring
Chapter 6 | Address Table Settings Configuring MAC Address Mirroring Figure 98: Clearing Entries in the Dynamic MAC Address Table Configuring MAC Address Mirroring Use the MAC Address > Mirror (Add) page to mirror traffic matching a specified source address from any port on the switch to a target port for real-time analysis. You can then attach a logic analyzer or RMON probe to the target port and study the traffic crossing the source port in a completely unobtrusive manner.
Page 174: Figure 99: Mirroring Packets Based On The Source Mac Address
Chapter 6 | Address Table Settings Configuring MAC Address Mirroring Web Interface To mirror packets based on a MAC address: Click MAC Address, Mirror. Select Add from the Action list. Specify the source MAC address and destination port. Click Apply. Figure 99: Mirroring Packets Based on the Source MAC Address To show the MAC addresses to be mirrored: Click MAC Address, Mirror.
Page 175: Configuring Extended Mac Security
Chapter 6 | Address Table Settings Configuring Extended MAC Security Configuring Extended MAC Security Use the MAC Address > Extended MAC Security pages to configure the maximum number of MAC addresses that can be learned on an interface, the movable-static function which allows a static address to be moved to another interface, and the sticky-dynamic function which prevents dynamic address already learned elsewhere from being learned at a specified interface.
Page 176 Chapter 6 | Address Table Settings Configuring Extended MAC Security The movable-static function cannot be set for a port that is a member of a ■ static or dynamic trunk. When a trunk is formed, the trunk takes on the movable-static status of the first port to join the trunk.
Page 177: Figure 101: Configuring Extended Mac Security On A Vlan
Chapter 6 | Address Table Settings Configuring Extended MAC Security Make the required changes to the sticky-dynamic function, movable-static function, and maximum MAC count. Enable or disable trap messages for these features. Click Apply. Figure 101: Configuring Extended MAC Security on a VLAN Figure 102: Configuring Extended MAC Security on a Port or Trunk –...
Page 178 Chapter 6 | Address Table Settings Configuring Extended MAC Security – 178 –...
Page 179 Spanning Tree Algorithm This chapter describes the following basic topics: ◆ Loopback Detection – Configures detection and response to loopback BPDUs. ◆ Global Settings for STA – Configures global bridge settings for STP, RSTP and MSTP. ◆ Interface Settings for STA –...
Page 180: Figure 103: Stp Root Ports And Designated Ports
Chapter 7 | Spanning Tree Algorithm Overview ports, and disables all other ports. Network packets are therefore only forwarded between root ports and designated ports, eliminating any possible network loops. Figure 103: STP Root Ports and Designated Ports Designated Root Root Designated Port...
Page 181: Spanning Tree Algorithm Overview
Chapter 7 | Spanning Tree Algorithm Overview Figure 104: MSTP Region, Internal Spanning Tree, Multiple Spanning Tree An MST Region consists of a group of interconnected bridges that have the same MST Configuration Identifiers (including the Region Name, Revision Level and Configuration Digest –...
Page 182: Configuring Loopback Detection
Chapter 7 | Spanning Tree Algorithm Configuring Loopback Detection Configuring Loopback Detection Use the Spanning Tree > Loopback Detection page to configure loopback detection on an interface. When loopback detection is enabled and a port or trunk receives it’s own BPDU, the detection agent drops the loopback BPDU, sends an SNMP trap, and places the interface in discarding mode.
Page 183: Configuring Global Settings For Sta
Chapter 7 | Spanning Tree Algorithm Configuring Global Settings for STA If an interface is shut down due to a detected loopback, and the release mode is set to “Auto, ” the selected interface will be automatically enabled when the shutdown interval has expired.
Page 184 Chapter 7 | Spanning Tree Algorithm Configuring Global Settings for STA implemented on a network, the path between specific VLAN members may be inadvertently disabled to prevent network loops, thus isolating group members. When operating multiple VLANs, we recommend selecting the MSTP option.
Page 185 Chapter 7 | Spanning Tree Algorithm Configuring Global Settings for STA ◆ Priority – Bridge priority is used in selecting the root device, root port, and designated port. The device with the highest priority becomes the STA root device. However, if all devices have the same priority, the device with the lowest MAC address will then become the root device.
Page 186 Chapter 7 | Spanning Tree Algorithm Configuring Global Settings for STA ports (except for designated ports) should receive configuration messages at regular intervals. Any port that ages out STA information (provided in the last configuration message) becomes the designated port for the attached LAN. If it is a root port, a new root port is selected from among the device ports attached to the network.
Page 187: Figure 107: Configuring Global Settings For Sta (Stp)
Chapter 7 | Spanning Tree Algorithm Configuring Global Settings for STA Web Interface To configure global STA settings: Click Spanning Tree, STA. Select Configure Global from the Step list. Select Configure from the Action list. Modify any of the required attributes. Note that the parameters displayed for the spanning tree types (STP, RSTP, MSTP) varies as described in the preceding section.
Page 188: Figure 108: Configuring Global Settings For Sta (Rstp)
Chapter 7 | Spanning Tree Algorithm Configuring Global Settings for STA Figure 108: Configuring Global Settings for STA (RSTP) Figure 109: Configuring Global Settings for STA (MSTP) – 188 –...
Page 189: Displaying Global Settings For Sta
Chapter 7 | Spanning Tree Algorithm Displaying Global Settings for STA Displaying Global Settings for STA Use the Spanning Tree > STA (Configure Global - Show Information) page to display a summary of the current bridge STA information that applies to the entire switch. Parameters The parameters displayed are described in the preceding section, except for the following items:...
Page 190: Configuring Interface Settings For Sta
Chapter 7 | Spanning Tree Algorithm Configuring Interface Settings for STA Figure 110: Displaying Global Settings for STA Configuring Interface Settings for STA Use the Spanning Tree > STA (Configure Interface - Configure) page to configure RSTP and MSTP attributes for specific interfaces, including port priority, path cost, link type, and edge port.
Page 191: Table 11: Recommended Sta Path Cost Range
Chapter 7 | Spanning Tree Algorithm Configuring Interface Settings for STA ◆ Admin Path Cost – This parameter is used by the STA to determine the best path between devices. Therefore, lower values should be assigned to ports attached to faster media, and higher values assigned to ports with slower media.
Page 192 Chapter 7 | Spanning Tree Algorithm Configuring Interface Settings for STA ◆ Admin Edge Port – Since end nodes cannot cause forwarding loops, they can pass directly through to the spanning tree forwarding state. Specifying Edge Ports provides quicker convergence for devices such as workstations or servers, retains the current forwarding database to reduce the amount of frame flooding required to rebuild address tables during reconfiguration events, does not cause the spanning tree to initiate reconfiguration when the interface...
Page 193: Figure 111: Configuring Interface Settings For Sta
Chapter 7 | Spanning Tree Algorithm Configuring Interface Settings for STA ◆ Migration – If at any time the switch detects STP BPDUs, including Configuration or Topology Change Notification BPDUs, it will automatically set the selected interface to forced STP-compatible mode. However, you can also use the Protocol Migration button to manually re-check the appropriate BPDU format (RSTP or STP-compatible) to send on the selected interfaces.
Page 194: Displaying Interface Settings For Sta
Chapter 7 | Spanning Tree Algorithm Displaying Interface Settings for STA Displaying Interface Settings for STA Use the Spanning Tree > STA (Configure Interface - Show Information) page to display the current status of ports or trunks in the Spanning Tree. Parameters These parameters are displayed: ◆...
Page 195: Figure 112: Sta Port Roles
Chapter 7 | Spanning Tree Algorithm Displaying Interface Settings for STA ◆ Oper Path Cost – The contribution of this port to the path cost of paths towards the spanning tree root which include this port. ◆ Oper Link Type – The operational point-to-point status of the LAN segment attached to this interface.
Page 196: Configuring Multiple Spanning Trees
Chapter 7 | Spanning Tree Algorithm Configuring Multiple Spanning Trees Web Interface To display interface settings for STA: Click Spanning Tree, STA. Select Configure Interface from the Step list. Select Show Information from the Action list. Figure 113: Displaying Interface Settings for STA Configuring Multiple Spanning Trees Use the Spanning Tree >...
Page 197 Chapter 7 | Spanning Tree Algorithm Configuring Multiple Spanning Trees To use multiple spanning trees: Set the spanning tree type to MSTP (page 183). Enter the spanning tree priority for the selected MST instance on the Spanning Tree > MSTP (Configure Global - Add) page. Add the VLANs that will share this MSTI on the Spanning Tree >...
Page 198: Figure 114: Creating An Mst Instance
Chapter 7 | Spanning Tree Algorithm Configuring Multiple Spanning Trees Figure 114: Creating an MST Instance To show the MSTP instances: Click Spanning Tree, MSTP. Select Configure Global from the Step list. Select Show from the Action list. Figure 115: Displaying MST Instances To modify the priority for an MST instance: Click Spanning Tree, MSTP.
Page 199: Figure 116: Modifying The Priority For An Mst Instance
Chapter 7 | Spanning Tree Algorithm Configuring Multiple Spanning Trees Figure 116: Modifying the Priority for an MST Instance To display global settings for MSTP: Click Spanning Tree, MSTP. Select Configure Global from the Step list. Select Show Information from the Action list. Select an MST ID.
Page 200: Configuring Interface Settings For Mstp
Chapter 7 | Spanning Tree Algorithm Configuring Interface Settings for MSTP Figure 118: Adding a VLAN to an MST Instance To show the VLAN members of an MSTP instance: Click Spanning Tree, MSTP. Select Configure Global from the Step list. Select Show Member from the Action list.
Page 201 Chapter 7 | Spanning Tree Algorithm Configuring Interface Settings for MSTP Discarding – Port receives STA configuration messages, but does not ■ forward packets. Learning – Port has transmitted configuration messages for an interval set ■ by the Forward Delay parameter without receiving contradictory information.
Page 202: Figure 120: Configuring Mstp Interface Settings
Chapter 7 | Spanning Tree Algorithm Configuring Interface Settings for MSTP Figure 120: Configuring MSTP Interface Settings To display MSTP parameters for a port or trunk: Click Spanning Tree, MSTP. Select Configure Interface from the Step list. Select Show Information from the Action list. Figure 121: Displaying MSTP Interface Settings –...
Page 203: Congestion Control
Congestion Control The switch can set the maximum upload or download data transfer rate for any port. It can control traffic storms by setting a maximum threshold for broadcast traffic or multicast traffic. It can also set bounding thresholds for broadcast and multicast storms which can be used to automatically trigger rate limits or to shut down a port.
Page 204: Storm Control
Chapter 8 | Congestion Control Storm Control Web Interface To configure rate limits: Click Traffic, Rate Limit. Enable the Rate Limit Status for the required ports. Set the rate limit for the individual ports,. Click Apply. Figure 122: Configuring Rate Limits Storm Control Use the Traffic >...
Page 205 Chapter 8 | Congestion Control Storm Control one of these control types can be applied to a port. Enabling hardware-level storm control on a port will disable automatic storm control on that port. ◆ Rate limits set by this function are also used by automatic storm control when the control response is set to rate control on the Auto Traffic Control (Configure Interface) page.
Page 206: Automatic Traffic Control
Chapter 8 | Congestion Control Automatic Traffic Control Figure 123: Configuring Storm Control Automatic Traffic Control Use the Traffic > Auto Traffic Control pages to configure bounding thresholds for broadcast and multicast storms which can automatically trigger rate limits or shut down a port.
Page 207: Figure 125: Storm Control By Shutting Down A Port
Chapter 8 | Congestion Control Automatic Traffic Control ◆ Alarm Clear Threshold – The lower threshold beneath which a control response can be automatically terminated after the release timer expires. When ingress traffic falls below this threshold, ATC sends a Storm Alarm Clear Trap and logs it. ◆...
Page 208: Setting The Atc Timers
Chapter 8 | Congestion Control Automatic Traffic Control Setting the ATC Timers Use the Traffic > Congestion Control > Auto Traffic Control (Configure Global) page to set the time at which to apply the control response after ingress traffic has exceeded the upper threshold, and the time at which to release the control response after ingress traffic has fallen beneath the lower threshold.
Page 209: Configuring Atc Thresholds And Responses
Chapter 8 | Congestion Control Automatic Traffic Control Figure 126: Configuring ATC Timers Configuring ATC Use the Traffic > Congestion Control > Auto Traffic Control (Configure Interface) page to set the storm control mode (broadcast or multicast), the traffic thresholds, Thresholds and the control response, to automatically release a response of rate limiting, or to send Responses...
Page 210 Chapter 8 | Congestion Control Automatic Traffic Control ◆ Auto Release Control – Automatically stops a traffic control response of rate limiting when traffic falls below the alarm clear threshold and the release timer expires as illustrated in Figure 124 on page 206.
Page 211: Figure 127: Configuring Atc Interface Attributes
Chapter 8 | Congestion Control Automatic Traffic Control Web Interface To configure the response timers for automatic storm control: Click Traffic, Congestion Control, Automatic Storm Control. Select Configure Interface from the Step field. Enable or disable ATC as required, set the control response, specify whether or not to automatically release the control response of rate limiting, set the upper and lower thresholds, and specify which trap messages to send.
Page 212 Chapter 8 | Congestion Control Automatic Traffic Control – 212 –...
Page 213: Class Of Service
Class of Service Class of Service (CoS) allows you to specify which data packets have greater precedence when traffic is buffered in the switch due to congestion. This switch supports CoS with four priority queues for each port. Data packets in a port’s high- priority queue will be transmitted before those in the lower-priority queues.
Page 214: Selecting The Queue Mode
Chapter 9 | Class of Service Layer 2 Queue Settings ◆ If the output port is an untagged member of the associated VLAN, these frames are stripped of all VLAN tags prior to transmission. Parameters These parameters are displayed: ◆ Interface –...
Page 215 Chapter 9 | Class of Service Layer 2 Queue Settings the switch services each queue before moving on to the next queue. This prevents the head-of-line blocking that can occur with strict priority queuing. ◆ If Strict and WRR mode is selected, a combination of strict and weighted service is used as specified for each queue.
Page 216: Figure 129: Setting The Queue Mode (Strict)
Chapter 9 | Class of Service Layer 2 Queue Settings Web Interface To configure the queue mode: Click Traffic, Priority, Queue. Set the queue mode. If the weighted queue mode is selected, the queue weight can be modified if required. If the queue mode that uses a combination of strict and weighted queueing is selected, the queues which are serviced first must be specified by enabling strict mode parameter in the table.
Page 217: Mapping Cos Values To Egress Queues
Chapter 9 | Class of Service Layer 2 Queue Settings Figure 131: Setting the Queue Mode (Strict and WRR) Mapping CoS Values Use the Traffic > Priority > PHB to Queue page to specify the hardware output to Egress Queues queues to use based on the internal per-hop behavior value.
Page 218: Table 14: Cos Priority Levels
Chapter 9 | Class of Service Layer 2 Queue Settings The priority levels recommended in the IEEE 802.1p standard for various network applications are shown in Table 14. However, priority levels can be mapped to the switch’s output queues in any way that benefits application traffic for the network. Table 14: CoS Priority Levels Priority Level Traffic Type...
Page 219: Figure 132: Mapping Cos Values To Egress Queues
Chapter 9 | Class of Service Layer 2 Queue Settings Map an internal PHB to a hardware queue. Depending on how an ingress packet is processed internally based on its CoS value, and the assigned output queue, the mapping done on this page can effectively determine the service priority for different traffic classes.
Page 220: Layer 3/4 Priority Settings
Chapter 9 | Class of Service Layer 3/4 Priority Settings Layer 3/4 Priority Settings Mapping Layer 3/4 Priorities to CoS Values The switch supports several common methods of prioritizing layer 3/4 traffic to meet application requirements. Traffic priorities can be specified in the IP header of a frame, using the priority bits in the Type of Service (ToS) octet, or the number of the TCP/UDP port.
Page 221: Mapping Ingress Dscp Values To Internal Dscp Values
Chapter 9 | Class of Service Layer 3/4 Priority Settings Parameters These parameters are displayed: ◆ Interface – Specifies a port or trunk. ◆ Trust Mode CoS – Maps layer 3/4 priorities using Class of Service values. (This is the ■...
Page 222: Table 16: Default Mapping Of Dscp Values To Internal Phb/Drop Values
Chapter 9 | Class of Service Layer 3/4 Priority Settings ◆ This map is only used when the priority mapping mode is set to DSCP (see page 220), and the ingress packet type is IPv4. Any attempt to configure the DSCP mutation map will not be accepted by the switch, unless the trust mode has been set to DSCP.
Page 223: Figure 135: Configuring Dscp To Dscp Internal Mapping
Chapter 9 | Class of Service Layer 3/4 Priority Settings Web Interface To map DSCP values to internal PHB/drop precedence: Click Traffic, Priority, DSCP to DSCP. Select Configure from the Action list. Select a port. Set the PHB and drop precedence for any DSCP value. Click Apply.
Page 224: Mapping Cos Priorities To Internal Dscp Values
Chapter 9 | Class of Service Layer 3/4 Priority Settings Mapping CoS Use the Traffic > Priority > CoS to DSCP page to maps CoS/CFI values in incoming packets to per-hop behavior and drop precedence values for priority processing. Priorities to Internal DSCP Values Command Usage ◆...
Page 225: Figure 137: Configuring Cos To Dscp Internal Mapping
Chapter 9 | Class of Service Layer 3/4 Priority Settings Web Interface To map CoS/CFI values to internal PHB/drop precedence: Click Traffic, Priority, CoS to DSCP. Select Configure from the Action list. Select a port. Set the PHB and drop precedence for any of the CoS/CFI combinations. Click Apply.
Page 226 Chapter 9 | Class of Service Layer 3/4 Priority Settings – 226 –...
Page 227: Quality Of Service
Quality of Service This chapter describes the following tasks required to apply QoS policies: ◆ Class Map – Creates a map which identifies a specific class of traffic. ◆ Policy Map – Sets the boundary parameters used for monitoring inbound traffic, and the action to take for conforming and non-conforming traffic.
Page 228: Configuring A Class Map
Chapter 10 | Quality of Service Configuring a Class Map Command Usage To create a service policy for a specific category or ingress traffic, follow these steps: Use the Configure Class (Add) page to designate a class name for a specific category of traffic.
Page 229: Figure 139: Configuring A Class Map
Chapter 10 | Quality of Service Configuring a Class Map Add Rule ◆ Class Name – Name of the class map. ◆ Type – The criteria specified by the match command. (This field is set on the Add page.) ◆ ACL –...
Page 230: Figure 140: Showing Class Maps
Chapter 10 | Quality of Service Configuring a Class Map To show the configured class maps: Click Traffic, DiffServ. Select Configure Class from the Step list. Select Show from the Action list. Figure 140: Showing Class Maps To edit the rules for a class map: Click Traffic, DiffServ.
Page 231: Figure 141: Adding Rules To A Class Map
Chapter 10 | Quality of Service Configuring a Class Map Figure 141: Adding Rules to a Class Map To show the rules for a class map: Click Traffic, DiffServ. Select Configure Class from the Step list. Select Show Rule from the Action list. Figure 142: Showing the Rules for a Class Map –...
Page 232: Creating Qos Policies
Chapter 10 | Quality of Service Creating QoS Policies Creating QoS Policies Use the Traffic > DiffServ (Configure Policy) page to create a policy map that can be attached to multiple interfaces. A policy map is used to group one or more class map statements (page 228), modify service tagging, and enforce bandwidth...
Page 233 Chapter 10 | Quality of Service Creating QoS Policies ◆ The meter operates in one of two modes. In the color-blind mode, the meter assumes that the packet stream is uncolored. In color-aware mode the meter assumes that some preceding entity has pre-colored the incoming packet stream so that each packet is either green, yellow, or red.
Page 234 Chapter 10 | Quality of Service Creating QoS Policies (BP). Action may taken for traffic conforming to the maximum throughput, exceeding the maximum throughput, or exceeding the peak burst size. ◆ The PHB label is composed of five bits, three bits for per-hop behavior, and two bits for the color scheme used to control queue congestion.
Page 235 Chapter 10 | Quality of Service Creating QoS Policies which are green, yellow, or red. Refer to RFC 2698 for more information on other aspects of trTCM. Command Usage ◆ A policy map can contain 128 class statements that can be applied to the same interface (page 241).
Page 236 Chapter 10 | Quality of Service Creating QoS Policies Set IP DSCP – Configures the service provided to ingress traffic by setting ■ an IP DSCP value for a matching packet (as specified in rule settings for a class map). (Range: 0-63) PHB –...
Page 237 Chapter 10 | Quality of Service Creating QoS Policies The color modes include “Color-Blind” which assumes that the packet stream is uncolored, and “Color-Aware” which assumes that the incoming packets are pre-colored. The functional differences between these modes is described at the beginning of this section under “srTCM Police Meter. ” Committed Information Rate (CIR) –...
Page 238 Chapter 10 | Quality of Service Creating QoS Policies packets are pre-colored. The functional differences between these modes is described at the beginning of this section under “trTCM Police Meter. ” Committed Information Rate (CIR) – Rate in kilobits per second. ■...
Page 239: Figure 143: Configuring A Policy Map
Chapter 10 | Quality of Service Creating QoS Policies Select Add from the Action list. Enter a policy name. Enter a description. Click Add. Figure 143: Configuring a Policy Map To show the configured policy maps: Click Traffic, DiffServ. Select Configure Policy from the Step list. Select Show from the Action list.
Page 240: Figure 145: Adding Rules To A Policy Map
Chapter 10 | Quality of Service Creating QoS Policies options to define parameters such as the maximum throughput and burst rate. Then specify the action to take for conforming traffic, the action to tack for traffic in excess of the maximum rate but within the peak information rate, or the action to take for a policy violation.
Page 241: Attaching A Policy Map To A Port
Chapter 10 | Quality of Service Attaching a Policy Map to a Port Attaching a Policy Map to a Port Use the Traffic > DiffServ (Configure Interface) page to bind a policy map to an ingress port. Command Usage First define a class map, define a policy map, and then bind the service policy to the required interface.
Page 242: Figure 147: Attaching A Policy Map To A Port
Chapter 10 | Quality of Service Attaching a Policy Map to a Port Figure 147: Attaching a Policy Map to a Port – 242 –...
Page 243: Voip Traffic Configuration
VoIP Traffic Configuration This chapter covers the following topics: ◆ Global Settings – Enables VOIP globally, sets the Voice VLAN, and the aging time for attached ports. ◆ Telephony OUI List – Configures the list of phones to be treated as VOIP devices based on the specified Organization Unit Identifier (OUI).
Page 244: Configuring Voip Traffic
Chapter 11 | VoIP Traffic Configuration Configuring VoIP Traffic Configuring VoIP Traffic Use the Traffic > VoIP (Configure Global) page to configure the switch for VoIP traffic. First enable automatic detection of VoIP devices attached to the switch ports, then set the Voice VLAN ID for the network. The Voice VLAN aging time can also be set to remove a port from the Voice VLAN when VoIP traffic is no longer received on the port.
Page 245: Configuring Telephony Oui
Chapter 11 | VoIP Traffic Configuration Configuring Telephony OUI Figure 148: Configuring a Voice VLAN Configuring Telephony OUI VoIP devices attached to the switch can be identified by the vendor’s Organizational Unique Identifier (OUI) in the source MAC address of received packets.
Page 246: Configuring Voip Traffic Ports
Chapter 11 | VoIP Traffic Configuration Configuring VoIP Traffic Ports Click Apply. Figure 149: Configuring an OUI Telephony List To show the MAC OUI numbers used for VoIP equipment: Click Traffic, VoIP. Select Configure OUI from the Step list. Select Show from the Action list. Figure 150: Showing an OUI Telephony List Configuring VoIP Traffic Ports Use the Traffic >...
Page 247 Chapter 11 | VoIP Traffic Configuration Configuring VoIP Traffic Ports Parameters These parameters are displayed: ◆ Mode – Specifies if the port will be added to the Voice VLAN when VoIP traffic is detected. (Default: None) None – The Voice VLAN feature is disabled on the port. The port will not ■...
Page 248: Figure 151: Configuring Port Settings For A Voice Vlan
Chapter 11 | VoIP Traffic Configuration Configuring VoIP Traffic Ports Web Interface To configure VoIP traffic settings for a port: Click Traffic, VoIP. Select Configure Interface from the Step list. Configure any required changes to the VoIP settings each port. Click Apply.
Page 249: Security Measures
Security Measures You can configure this switch to authenticate users logging into the system for management access using local or remote authentication methods. Port-based authentication using IEEE 802.1X can also be configured to control either management access to the uplink ports or client access to the data ports. This switch provides secure network management access using the following options: ◆...
Page 250: Aaa Authorization And Accounting
Chapter 12 | Security Measures AAA Authorization and Accounting Note: The priority of execution for the filtering commands is Port Security, Port Authentication, Network Access, Web Authentication, Access Control Lists, IP Source Guard, and then DHCP Snooping. AAA Authorization and Accounting The authentication, authorization, and accounting (AAA) feature provides the main framework for configuring access control on the switch.
Page 251: Configuring Local/Remote Logon Authentication
Chapter 12 | Security Measures AAA Authorization and Accounting Define a method name for each service to which you want to apply accounting or authorization and specify the RADIUS or TACACS+ server groups to use. Apply the method names to port or line interfaces. Note: This guide assumes that RADIUS and TACACS+ servers have already been configured to support AAA.
Page 252: Configuring Remote Logon Authentication Servers
Chapter 12 | Security Measures AAA Authorization and Accounting Web Interface To configure the method(s) of controlling management access: Click Security, AAA, System Authentication. Specify the authentication sequence (i.e., one to three methods). Click Apply. Figure 152: Configuring the Authentication Sequence Configuring Remote Use the Security >...
Page 253 Chapter 12 | Security Measures AAA Authorization and Accounting Command Usage ◆ If a remote authentication server is used, you must specify the message exchange parameters for the remote authentication protocol. Both local and remote logon authentication control management access via the console port, web browser, or Telnet.
Page 254 Chapter 12 | Security Measures AAA Authorization and Accounting Authentication Key – Encryption key used to authenticate logon access ■ for client. Do not use blank spaces in the string. (Maximum length: 48 characters) Confirm Authentication Key – Re-type the string entered in the previous ■...
Page 255: Figure 154: Configuring Remote Authentication Server (Radius)
Chapter 12 | Security Measures AAA Authorization and Accounting When specifying the priority sequence for a sever, the server index must already be defined (see “Configuring Local/Remote Logon Authentication” on page 251). Web Interface To configure the parameters for RADIUS or TACACS+ authentication: Click Security, AAA, Server.
Page 256: Figure 155: Configuring Remote Authentication Server (Tacacs+)
Chapter 12 | Security Measures AAA Authorization and Accounting Figure 155: Configuring Remote Authentication Server (TACACS+) To configure the RADIUS or TACACS+ server groups to use for accounting and authorization: Click Security, AAA, Server. Select Configure Group from the Step list. Select Add from the Action list.
Page 257: Configuring Aaa Accounting
Chapter 12 | Security Measures AAA Authorization and Accounting To show the RADIUS or TACACS+ server groups used for accounting and authorization: Click Security, AAA, Server. Select Configure Group from the Step list. Select Show from the Action list. Figure 157: Showing AAA Server Groups Configuring AAA Use the Security >...
Page 258 Chapter 12 | Security Measures AAA Authorization and Accounting ◆ Method Name – Specifies an accounting method for service requests. The “default” methods are used for a requested service if no other methods have been defined. (Range: 1-64 characters) Note that the method name is only used to describe the accounting method configured on the specified RADIUS or TACACS+ servers.
Page 259: Figure 158: Configuring Global Settings For Aaa Accounting
Chapter 12 | Security Measures AAA Authorization and Accounting ◆ Accounting Type - Displays the accounting service. ◆ Interface - Displays the receive port number through which this user accessed the switch. ◆ Time Elapsed - Displays the length of time this entry has been active. Web Interface To configure global settings for AAA accounting: Click Security, AAA, Accounting.
Page 260: Figure 159: Configuring Aaa Accounting Methods
Chapter 12 | Security Measures AAA Authorization and Accounting Figure 159: Configuring AAA Accounting Methods To show the accounting method applied to various service types and the assigned server group: Click Security, AAA, Accounting. Select Configure Method from the Step list. Select Show from the Action list.
Page 261: Figure 161: Configuring Aaa Accounting Service For 802.1X Service
Chapter 12 | Security Measures AAA Authorization and Accounting Figure 161: Configuring AAA Accounting Service for 802.1X Service Figure 162: Configuring AAA Accounting Service for Exec Service To display a summary of the configured accounting methods and assigned server groups for specified service types: Click Security, AAA, Accounting.
Page 262: Configuring Aaa Authorization
Chapter 12 | Security Measures AAA Authorization and Accounting To display basic accounting information and statistics recorded for user sessions: Click Security, AAA, Accounting. Select Show Information from the Step list. Click Statistics. Figure 164: Displaying Statistics for AAA Accounting Sessions Configuring AAA Use the Security >...
Page 263: Figure 165: Configuring Aaa Authorization Methods
Chapter 12 | Security Measures AAA Authorization and Accounting Configure Service ◆ Console Method Name – Specifies a user defined method name to apply to console connections. ◆ VTY Method Name – Specifies a user defined method name to apply to Telnet connections.
Page 264: Figure 166: Showing Aaa Authorization Methods
Chapter 12 | Security Measures AAA Authorization and Accounting To show the authorization method applied to the EXEC service type and the assigned server group: Click Security, AAA, Authorization. Select Configure Method from the Step list. Select Show from the Action list. Figure 166: Showing AAA Authorization Methods To configure the authorization method applied to local console, Telnet, or SSH connections:...
Page 265: Configuring User Accounts
Chapter 12 | Security Measures Configuring User Accounts To display a the configured authorization method and assigned server groups for The Exec service type: Click Security, AAA, Authorization. Select Show Information from the Step list. Figure 168: Displaying the Applied AAA Authorization Method Configuring User Accounts Use the Security >...
Page 266: Figure 169: Configuring User Accounts
Chapter 12 | Security Measures Configuring User Accounts Encrypted Password – Encrypted password. ■ The encrypted password is required for compatibility with legacy password settings (i.e., plain text or encrypted) when reading the configuration file during system bootup. There is no need for you to manually configure encrypted passwords.
Page 267: Web Authentication
Chapter 12 | Security Measures Web Authentication Figure 170: Showing User Accounts Web Authentication Web authentication allows stations to authenticate and access the network in situations where 802.1X or Network Access authentication are infeasible or impractical. The web authentication feature allows unauthenticated hosts to request and receive a DHCP assigned IP address and perform DNS queries.
Page 268: Configuring Interface Settings For Web Authentication
Chapter 12 | Security Measures Web Authentication ◆ Quiet Period – Configures how long a host must wait to attempt authentication again after it has exceeded the maximum allowable failed login attempts. (Range: 1-180 seconds; Default: 60 seconds) ◆ Login Attempts – Configures the amount of times a supplicant may attempt and fail authentication before it must wait the configured quiet period.
Page 269: Figure 172: Configuring Interface Settings For Web Authentication
Chapter 12 | Security Measures Web Authentication ◆ Apply – Enables web authentication if the Status box is checked. ◆ Re-authenticate – Ends all authenticated web sessions for selected host IP addresses in the Authenticated Host List, and forces the users to re- authenticate.
Page 270: Network Access (Mac Address Authentication)
Chapter 12 | Security Measures Network Access (MAC Address Authentication) Network Access (MAC Address Authentication) Some devices connected to switch ports may not be able to support 802.1X authentication due to hardware or software limitations. This is often true for devices such as network printers, IP phones, and some wireless access points.
Page 271: Table 18: Dynamic Qos Profiles
Chapter 12 | Security Measures Network Access (MAC Address Authentication) Tunnel-Private-Group-ID = 1u,2t [VLAN ID list] ■ The VLAN identifier list is carried in the RADIUS “Tunnel-Private-Group-ID” attribute. The VLAN list can contain multiple VLAN identifiers in the format “1u,2t,3u” where “u” indicates an untagged VLAN and “t” a tagged VLAN. ◆...
Page 272: Configuring Global Settings For Network Access
Chapter 12 | Security Measures Network Access (MAC Address Authentication) ◆ Dynamic QoS assignment fails and the authentication result changes from success to failure when the following conditions occur: Illegal characters found in a profile value (for example, a non-digital ■...
Page 273: Configuring Network Access For Ports
Chapter 12 | Security Measures Network Access (MAC Address Authentication) Web Interface To configure aging status and reauthentication time for MAC address authentication: Click Security, Network Access. Select Configure Global from the Step list. Enable or disable aging for secure addresses, and modify the reauthentication time as required.
Page 274 Chapter 12 | Security Measures Network Access (MAC Address Authentication) authentication (including Network Access and IEEE 802.1X). (Range: 1-1024; Default: 1024) ◆ Guest VLAN – Specifies the VLAN to be assigned to the port when 802.1X Authentication fails. (Range: 0-4094, where 0 means disabled; Default: Disabled) The VLAN must already be created and active (see “Configuring VLAN Groups”...
Page 275: Configuring Port Link Detection
Chapter 12 | Security Measures Network Access (MAC Address Authentication) VLAN to use when MAC Authentication or 802.1X Authentication fails, and the dynamic VLAN and QoS assignments. Click Apply. Figure 174: Configuring Interface Settings for Network Access Configuring Port Link Use the Security >...
Page 276: Configuring A Mac Address Filter
Chapter 12 | Security Measures Network Access (MAC Address Authentication) Click the Link Detection button. Modify the link detection status, trigger condition, and the response for any port. Click Apply. Figure 175: Configuring Link Detection for Network Access Configuring a MAC Use the Security >...
Page 277: Figure 176: Configuring A Mac Address Filter For Network Access
Chapter 12 | Security Measures Network Access (MAC Address Authentication) Web Interface To add a MAC address filter for MAC authentication: Click Security, Network Access. Select Configure MAC Filter from the Step list. Select Add from the Action list. Enter a filter ID, MAC address, and optional mask. Click Apply.
Page 278: Displaying Secure Mac Address Information
Chapter 12 | Security Measures Network Access (MAC Address Authentication) Displaying Secure Use the Security > Network Access (Show Information) page to display the authenticated MAC addresses stored in the secure MAC address table. Information MAC Address on the secure MAC entries can be displayed and selected entries can be removed Information from the table.
Page 279: Configuring Https
Chapter 12 | Security Measures Configuring HTTPS Figure 178: Showing Addresses Authenticated for Network Access Configuring HTTPS You can configure the switch to enable the Secure Hypertext Transfer Protocol (HTTPS) over the Secure Socket Layer (SSL), providing secure access (i.e., an encrypted connection) to the switch’s web interface.
Page 280: Table 19: Https System Support
Chapter 12 | Security Measures Configuring HTTPS ◆ The following web browsers and operating systems currently support HTTPS: Table 19: HTTPS System Support Web Browser Operating System Internet Explorer 6.x or later Windows 98,Windows NT (with service pack 6a), Windows 2000, Windows XP, Windows Vista, Windows 7, Windows 8 Mozilla Firefox 4.x or later Windows 2000, Windows XP, Windows Vista, Windows 7,...
Page 281: Replacing The Default Secure-Site Certificate
Chapter 12 | Security Measures Configuring HTTPS Figure 179: Configuring HTTPS Replacing the Default Use the Security > HTTPS (Copy Certificate) page to replace the default secure-site Secure-site Certificate certificate. When you log onto the web interface using HTTPS (for secure access), a Secure Sockets Layer (SSL) certificate appears for the switch.
Page 282: Configuring The Secure Shell
Chapter 12 | Security Measures Configuring the Secure Shell ◆ Private Password – Password stored in the private key file. This password is used to verify authorization for certificate use, and is verified when downloading the certificate to the switch. ◆...
Page 283 Chapter 12 | Security Measures Configuring the Secure Shell Note: You need to install an SSH client on the management station to access the switch for management via the SSH protocol. Note: The switch supports both SSH Version 1.5 and 2.0 clients. Command Usage The SSH server on this switch supports both password and public key authentication.
Page 284 Chapter 12 | Security Measures Configuring the Secure Shell Set the Optional Parameters – On the SSH Settings page, configure the optional parameters, including the authentication timeout, the number of retries, and the server key size. Enable SSH Service – On the SSH Settings page, enable the SSH server on the switch.
Page 285: Configuring The Ssh Server
Chapter 12 | Security Measures Configuring the Secure Shell When the server receives this message, it checks whether the supplied key is acceptable for authentication, and if so, it then checks whether the signature is correct. If both checks succeed, the client is authenticated.
Page 286: Generating The Host Key Pair
Chapter 12 | Security Measures Configuring the Secure Shell Enable the SSH server. Adjust the authentication parameters as required. Click Apply. Figure 181: Configuring the SSH Server Generating the Use the Security > SSH (Configure Host Key - Generate) page to generate a host Host Key Pair public/private key pair used to provide secure communications between an SSH client and the switch.
Page 287: Figure 182: Generating The Ssh Host Key Pair
Chapter 12 | Security Measures Configuring the Secure Shell Web Interface To generate the SSH host key pair: Click Security, SSH. Select Configure Host Key from the Step list. Select Generate from the Action list. Select the host-key type from the drop-down box. Select the option to save the host key from memory to flash if required.
Page 288: Importing User Public Keys
Chapter 12 | Security Measures Configuring the Secure Shell Figure 183: Showing the SSH Host Key Pair Importing Use the Security > SSH (Configure User Key - Copy) page to upload a user’s public User Public Keys key to the switch. This public key must be stored on the switch for the user to be able to log in using the public key authentication mechanism.
Page 289: Figure 184: Copying The Ssh User's Public Key
Chapter 12 | Security Measures Configuring the Secure Shell Web Interface To copy the SSH user’s public key: Click Security, SSH. Select Configure User Key from the Step list. Select Copy from the Action list. Select the user name and the public-key type from the respective drop-down boxes, input the TFTP server IP address and the public key source file name.
Page 290: Access Control Lists
Chapter 12 | Security Measures Access Control Lists Figure 185: Showing the SSH User’s Public Key Access Control Lists Access Control Lists (ACL) provide packet filtering for IPv4 frames (based on address, protocol, Layer 4 protocol port number or TCP control code), IPv6 frames (based on address, DSCP traffic class, next header type, or any frames (based on MAC address or Ethernet type).
Page 291: Setting A Time Range
Chapter 12 | Security Measures Access Control Lists Auto ACE Compression is a software feature used to compress all the ACEs of an ACL to utilize hardware resources more efficiency. Without compression, one ACE would occupy a fixed number of entries in TCAM. So if one ACL includes 25 ACEs, the ACL would need (25 * n) entries in TCAM, where “n”...
Page 292: Figure 186: Setting The Name Of A Time Range
Chapter 12 | Security Measures Access Control Lists ◆ Mode Absolute – Specifies a specific time or time range. ■ Start/End – Specifies the hours, minutes, month, day, and year at which ■ to start or end. Periodic – Specifies a periodic interval. ■...
Page 293: Figure 187: Showing A List Of Time Ranges
Chapter 12 | Security Measures Access Control Lists Figure 187: Showing a List of Time Ranges To configure a rule for a time range: Click Security, ACL. Select Configure Time Range from the Step list. Select Add Rule from the Action list. Select the name of time range from the drop-down list.
Page 294: Showing Tcam Utilization
Chapter 12 | Security Measures Access Control Lists Figure 189: Showing the Rules Configured for a Time Range Showing Use the Security > ACL (Configure ACL - Show TCAM) page to show utilization TCAM Utilization parameters for TCAM (Ternary Content Addressable Memory), including the number policy control entries in use, the number of free entries, and the overall percentage of TCAM in use.
Page 295: Setting The Acl Name And Type
Chapter 12 | Security Measures Access Control Lists Web Interface To show information on TCAM utilization: Click Security, ACL. Select Configure ACL from the Step list. Select Show TCAM from the Action list. Figure 190: Showing TCAM Utilization Setting the ACL Use the Security >...
Page 296: Figure 191: Creating An Acl
Chapter 12 | Security Measures Access Control Lists Web Interface To configure the name and type of an ACL: Click Security, ACL. Select Configure ACL from the Step list. Select Add from the Action list. Fill in the ACL Name field, and select the ACL type. Click Apply.
Page 297: Configuring A Standard Ipv4 Acl
Chapter 12 | Security Measures Access Control Lists Configuring a Use the Security > ACL (Configure ACL - Add Rule - IP Standard) page to configure a Standard IPv4 ACL. Standard IPv4 ACL Parameters These parameters are displayed: ◆ Type – Selects the type of ACLs to show in the Name list. ◆...
Page 298: Configuring An Extended Ipv4 Acl
Chapter 12 | Security Measures Access Control Lists Figure 193: Configuring a Standard IPv4 ACL Configuring an Use the Security > ACL (Configure ACL - Add Rule - IP Extended) page to configure Extended IPv4 ACL an Extended IPv4 ACL. Parameters These parameters are displayed: ◆...
Page 299 Chapter 12 | Security Measures Access Control Lists ◆ Service Type – Packet priority settings based on the following criteria: ToS – Type of Service level. (Range: 0-15) ■ ■ Precedence – IP precedence level. (Range: 0-7) ■ DSCP – DSCP priority level. (Range: 0-63) ◆...
Page 300: Configuring A Standard Ipv6 Acl
Chapter 12 | Security Measures Access Control Lists Select the address type (Any, Host, or IP). If you select “Host, ” enter a specific address. If you select “IP, ” enter a subnet address and the mask for an address range. Set any other required criteria, such as service type, protocol type, or control code.
Page 301 Chapter 12 | Security Measures Access Control Lists ◆ Source IPv6 Address – An IPv6 source address or network class. The address must be formatted according to RFC 2373 “IPv6 Addressing Architecture, ” using 8 colon-separated 16-bit hexadecimal values. One double colon may be used in the address to indicate the appropriate number of zeros required to fill the undefined fields.
Page 302: Configuring An Extended Ipv6 Acl
Chapter 12 | Security Measures Access Control Lists Figure 195: Configuring a Standard IPv6 ACL Configuring an Use the Security > ACL (Configure ACL - Add Rule - IPv6 Extended) page to Extended IPv6 ACL configure an Extended IPv6 ACL. Parameters These parameters are displayed: ◆...
Page 303 Chapter 12 | Security Measures Access Control Lists ◆ Next Header – Identifies the type of header immediately following the IPv6 header. (Range: 0-255) Optional internet-layer information is encoded in separate headers that may be placed between the IPv6 header and the upper-layer header in a packet. There are a small number of such extension headers, each identified by a distinct Next Header value.
Page 304: Configuring A Mac Acl
Chapter 12 | Security Measures Access Control Lists Figure 196: Configuring an Extended IPv6 ACL Configuring a Use the Security > ACL (Configure ACL - Add Rule - MAC) page to configure a MAC ACL based on hardware addresses, packet format, and Ethernet type. MAC ACL Parameters These parameters are displayed:...
Page 305 Chapter 12 | Security Measures Access Control Lists Eth2 – Ethernet II packets. ■ LLC-other – LLC and other packets. ■ ■ SNAP – SNAP packets. ◆ VID – VLAN ID. (Range: 1-4094) ◆ VID Bit Mask – VLAN bit mask. (Range: 0-4095) ◆...
Page 306: Configuring An Arp Acl
Chapter 12 | Security Measures Access Control Lists Figure 197: Configuring a MAC ACL Configuring an Use the Security > ACL (Configure ACL - Add Rule - ARP) page to configure ACLs based on ARP message addresses. ARP Inspection can then use these ACLs to filter ARP ACL suspicious traffic (see “Configuring Global Settings for ARP Inspection”...
Page 307 Chapter 12 | Security Measures Access Control Lists ◆ Source/Destination MAC Address Type – Use “Any” to include all possible addresses, “Host” to indicate a specific MAC address, or “MAC” to specify an address range with the Address and Mask fields. (Options: Any, Host, MAC; Default: Any) ◆...
Page 308: Binding A Port To An Access Control List
Chapter 12 | Security Measures Access Control Lists Figure 198: Configuring a ARP ACL Binding a Port to an After configuring ACLs, use the Security > ACL (Configure Interface) page to bind Access Control List the ports that need to filter traffic to the appropriate ACLs. You can assign one IP access list and one MAC access list to any port.
Page 309: Configuring Acl Mirroring
Chapter 12 | Security Measures Access Control Lists Click Apply. Figure 199: Binding a Port to an ACL Configuring After configuring ACLs, use the Security > ACL (Configure Interface – Add Mirror) ACL Mirroring page to mirror traffic matching an ACL from one or more source ports to a target port for real-time analysis.
Page 310: Figure 200: Configuring Acl Mirroring
Chapter 12 | Security Measures Access Control Lists Web Interface To bind an ACL to a port: Click Security, ACL. Select Configure Interface from the Step list. Select Add Mirror from the Action list. Select a port. Select the name of an ACL from the ACL list. Click Apply.
Page 311: Showing Acl Hardware Counters
Chapter 12 | Security Measures Access Control Lists Showing ACL Use the Security > ACL > Configure Interface (Show Hardware Counters) page to show statistics for ACL hardware counters. Hardware Counters Parameters These parameters are displayed: ◆ Port – Port identifier. (Range: 1-12/28) ◆...
Page 312: Arp Inspection
Chapter 12 | Security Measures ARP Inspection ARP Inspection ARP Inspection is a security feature that validates the MAC Address bindings for Address Resolution Protocol packets. It provides protection against ARP traffic with invalid MAC-to-IP address bindings, which forms the basis for certain “man-in-the- middle”...
Page 313: Configuring Global Settings For Arp Inspection
Chapter 12 | Security Measures ARP Inspection Configuring Global Use the Security > ARP Inspection (Configure General) page to enable ARP inspection globally for the switch, to validate address information in each packet, Settings for ARP and configure logging. Inspection Command Usage ARP Inspection Validation ◆...
Page 314: Figure 203: Configuring Global Settings For Arp Inspection
Chapter 12 | Security Measures ARP Inspection Parameters These parameters are displayed: ◆ ARP Inspection Status – Enables ARP Inspection globally. (Default: Disabled) ◆ ARP Inspection Validation – Enables extended ARP Inspection Validation if any of the following options are enabled. (Default: Disabled) Dst-MAC –...
Page 315: Configuring Vlan Settings For Arp Inspection
Chapter 12 | Security Measures ARP Inspection Configuring VLAN Use the Security > ARP Inspection (Configure VLAN) page to enable ARP inspection for any VLAN and to specify the ARP ACL to use. Settings for ARP Inspection Command Usage ARP Inspection VLAN Filters (ACLs) ◆...
Page 316: Configuring Interface Settings For Arp Inspection
Chapter 12 | Security Measures ARP Inspection Web Interface To configure VLAN settings for ARP Inspection: Click Security, ARP Inspection. Select Configure VLAN from the Step list. Enable ARP inspection for the required VLANs, select an ARP ACL filter to check for configured addresses, and select the Static option to bypass checking the DHCP snooping bindings database if required.
Page 317: Displaying Arp Inspection Statistics
Chapter 12 | Security Measures ARP Inspection Web Interface To configure interface settings for ARP Inspection: Click Security, ARP Inspection. Select Configure Interface from the Step list. Specify any untrusted ports which require ARP inspection, and adjust the packet inspection rate. Click Apply.
Page 318: Displaying The Arp Inspection Log
Chapter 12 | Security Measures ARP Inspection (Continued) Table 20: ARP Inspection Statistics Parameter Description ARP packets dropped by Count of packets that failed the source MAC address test. additional validation (Src-MAC) ARP packets dropped by ARP Count of ARP packets that failed validation against ARP ACL rules. ACLs ARP packets dropped by DHCP Count of packets that failed validation against the DHCP Snooping...
Page 319: Filtering Ip Addresses For Management Access
Chapter 12 | Security Measures Filtering IP Addresses for Management Access (Continued) Table 21: ARP Inspection Log Parameter Description Dst. IP Address The destination IP address in the packet. Src. MAC Address The source MAC address in the packet. Dst. MAC Address The destination MAC address in the packet.
Page 320: Figure 208: Creating An Ip Address Filter For Management Access
Chapter 12 | Security Measures Filtering IP Addresses for Management Access ◆ When entering addresses for the same group (i.e., SNMP, web or Telnet), the switch will not accept overlapping address ranges. When entering addresses for different groups, the switch will accept overlapping address ranges. ◆...
Page 321: Configuring Port Security
Chapter 12 | Security Measures Configuring Port Security To show a list of IP addresses authorized for management access: Click Security, IP Filter. Select Show from the Action list. Figure 209: Showing IP Addresses Authorized for Management Access Configuring Port Security Use the Security >...
Page 322 Chapter 12 | Security Measures Configuring Port Security ◆ When the port security state is changed from enabled to disabled, all dynamically learned entries are cleared from the address table. ◆ If port security is enabled, and the maximum number of allowed addresses are set to a non-zero value, any device not in the address table that attempts to use the port will be prevented from accessing the switch.
Page 323: Configuring 802.1X Port Authentication
Chapter 12 | Security Measures Configuring 802.1X Port Authentication ◆ MAC Filter ID – The identifier for a MAC address filter. ◆ Last Intrusion MAC – The last unauthorized MAC address detected. ◆ Last Time Detected Intrusion MAC – The last time an unauthorized MAC address was detected.
Page 324: Figure 211: Configuring Port Security
Chapter 12 | Security Measures Configuring 802.1X Port Authentication an EAPOL response to the switch, which it forwards to the RADIUS server. The RADIUS server verifies the client identity and sends an access challenge back to the client. The EAP packet from the RADIUS server contains not only the challenge, but the authentication method to be used.
Page 325: Configuring 802.1X Global Settings
Chapter 12 | Security Measures Configuring 802.1X Port Authentication provided in Windows 8, Windows 7, Vista, and XP, and in Windows 2000 with Service Pack 4. To support these encryption methods in Windows 95 and 98, you can use the AEGIS dot1x client or other comparable client software) Configuring 802.1X Use the Security >...
Page 326: Configuring Port Authenticator Settings For 802.1X
Chapter 12 | Security Measures Configuring 802.1X Port Authentication Web Interface To configure global settings for 802.1X: Click Security, Port Authentication. Select Configure Global from the Step list. Enable 802.1X globally for the switch, and configure EAPOL Pass Through if required.
Page 327 Chapter 12 | Security Measures Configuring 802.1X Port Authentication remote authenticator (see “Configuring Port Supplicant Settings for 802.1X” on page 330). ◆ This switch can be configured to serve as the authenticator on selected ports by setting the Control Mode to Auto on this configuration page, and as a supplicant on other ports by the setting the control mode to Force-Authorized on this page and enabling the PAE supplicant on the Supplicant configuration page.
Page 328 Chapter 12 | Security Measures Configuring 802.1X Port Authentication In this mode, each host connected to a port needs to pass authentication. The number of hosts allowed access to a port operating in this mode is limited only by the available space in the secure address table (i.e., up to 1024 addresses).
Page 329 Chapter 12 | Security Measures Configuring 802.1X Port Authentication ◆ Intrusion Action – Sets the port’s response to a failed authentication. Block Traffic – Blocks all non-EAP traffic on the port. (This is the default ■ setting.) Guest VLAN – All traffic for the port is assigned to a guest VLAN. The guest ■...
Page 330: Configuring Port Supplicant Settings For 802.1X
Chapter 12 | Security Measures Configuring 802.1X Port Authentication Click Apply Figure 213: Configuring Interface Settings for 802.1X Port Authenticator Configuring Use the Security > Port Authentication (Configure Interface – Supplicant) page to configure 802.1X port settings for supplicant requests issued from a port to an Port Supplicant authenticator on another device.
Page 331 Chapter 12 | Security Measures Configuring 802.1X Port Authentication ◆ This switch can be configured to serve as the authenticator on selected ports by setting the Control Mode to Auto on the Authenticator configuration page, and as a supplicant on other ports by the setting the control mode to Force- Authorized on that configuration page and enabling the PAE supplicant on the Supplicant configuration page.
Page 332: Displaying 802.1X Statistics
Chapter 12 | Security Measures Configuring 802.1X Port Authentication Web Interface To configure port authenticator settings for 802.1X: Click Security, Port Authentication. Select Configure Interface from the Step list. Click Supplicant. Modify the supplicant settings for each port as required. Click Apply Figure 214: Configuring Interface Settings for 802.1X Port Supplicant Displaying...
Page 333 Chapter 12 | Security Measures Configuring 802.1X Port Authentication (Continued) Table 22: 802.1X Statistics Parameter Description Rx EAPOL Total The number of valid EAPOL frames of any type that have been received by this Authenticator. Rx Last EAPOLVer The protocol version number carried in the most recent EAPOL frame received by this Authenticator.
Page 334: Figure 215: Showing Statistics For 802.1X Port Authenticator
Chapter 12 | Security Measures Configuring 802.1X Port Authentication Web Interface To display port authenticator statistics for 802.1X: Click Security, Port Authentication. Select Show Statistics from the Step list. Click Authenticator. Figure 215: Showing Statistics for 802.1X Port Authenticator To display port supplicant statistics for 802.1X: Click Security, Port Authentication.
Page 335: Dos Protection
Chapter 12 | Security Measures DoS Protection Figure 216: Showing Statistics for 802.1X Port Supplicant DoS Protection Use the Security > DoS Protection page to protect against denial-of-service (DoS) attacks. A DoS attack is an attempt to block the services provided by a computer or network resource.
Page 336 Chapter 12 | Security Measures DoS Protection These packets may have any of the following attributes: ◆ Header length is less than 4 bytes ◆ Raw IP data length is less than header length * 4 ◆ Invalid Source IP Address – Protects against attacks in which hackers replace the source address in packets sent to the victim with an invalid source IP address to protect the identity of the sender or to mislead the receiver as to the origin and validity of sent data.
Page 337 Chapter 12 | Security Measures DoS Protection of attack is especially effective since the packets seem to come from different sources and thus making the perpetrators hard to trace. These packets may have any of the following attributes: ◆ Source IP address is ::1 ◆...
Page 338 Chapter 12 | Security Measures DoS Protection no flags. If the target's TCP port is closed, the target replies with a TCP RST (reset) packet. If the target TCP port is open, it simply discards the TCP NULL scan. ◆ SYN/FIN Scan –...
Page 339 Chapter 12 | Security Measures DoS Protection Protection for ICMP ◆ Smurf – Protects against smurf attacks in which a perpetrator generates a large amount of spoofed ICMP Echo Request traffic to the broadcast destination IP address (255.255.255.255), all of which uses a spoofed source address of the intended victim.
Page 340: Figure 217: Configuring Dos Protection
Chapter 12 | Security Measures DoS Protection Figure 217: Configuring DoS Protection – 340 –...
Page 341: Ip Source Guard
Chapter 12 | Security Measures IP Source Guard IP Source Guard IP Source Guard is a security feature that filters IP traffic on network interfaces based on manually configured entries in the IP Source Guard table, or dynamic entries in the DHCP Snooping table when enabled (see “DHCP Snooping”...
Page 342: Figure 218: Setting The Filter Type For Ip Source Guard
Chapter 12 | Security Measures IP Source Guard If IP source guard if enabled on an interface for which IP source bindings ■ have not yet been configured (neither by static configuration in the IP source guard binding table nor dynamically learned from DHCP snooping), the switch will drop all IP traffic on that port, except for DHCP packets.
Page 343: Configuring Static Bindings For Ip Source Guard
Chapter 12 | Security Measures IP Source Guard Configuring Use the Security > IP Source Guard > Static Configuration page to bind a static address to a port. Table entries include a MAC address, IP address, lease time, entry Static Bindings for type (Static, Dynamic), VLAN identifier, and port identifier.
Page 344: Displaying Information For Dynamic Ip Source Guard Bindings
Chapter 12 | Security Measures IP Source Guard Web Interface To configure static bindings for IP Source Guard: Click Security, IP Source Guard, Static Configuration. Select Add from the Action list. Enter the required bindings for each port. Click Apply Figure 219: Configuring Static Bindings for IP Source Guard To display static bindings for IP Source Guard: Click Security, IP Source Guard, Static Configuration.
Page 345: Figure 221: Showing The Ip Source Guard Binding Table
Chapter 12 | Security Measures IP Source Guard ◆ VLAN – ID of a configured VLAN (Range: 1-4094) ◆ MAC Address – A valid unicast MAC address. ◆ IP Address – A valid unicast IP address, including classful types A, B or C. Dynamic Binding List ◆...
Page 346: Dhcp Snooping
Chapter 12 | Security Measures DHCP Snooping DHCP Snooping The addresses assigned to DHCP clients on insecure ports can be carefully controlled using the dynamic bindings registered with DHCP Snooping (or using the static bindings configured with IP Source Guard). DHCP snooping allows a switch to protect a network from rogue DHCP servers or other devices which send port-related information to a DHCP server.
Page 347 Chapter 12 | Security Measures DHCP Snooping If the DHCP packet is from a client, such as a DISCOVER, REQUEST, ■ INFORM, DECLINE or RELEASE message, the packet is forwarded if MAC address verification is disabled. However, if MAC address verification is enabled, then the packet will only be forwarded if the client’s hardware address stored in the DHCP packet is the same as the source MAC address in the Ethernet header.
Page 348: Dhcp Snooping Global Configuration
Chapter 12 | Security Measures DHCP Snooping ◆ If DHCP Snooping Information Option 82 is enabled on the switch, information may be inserted into a DHCP request packet received over any VLAN (depending on DHCP snooping filtering rules). The information inserted into the relayed packets includes the circuit-id and remote-id, as well as the gateway Internet address.
Page 349: Dhcp Snooping Vlan Configuration
Chapter 12 | Security Measures DHCP Snooping ◆ DHCP Snooping Information Option Policy – Specifies how to handle DHCP client request packets which already contain Option 82 information. Drop – Drops the client’s request packet instead of relaying it. ■ Keep –...
Page 350: Configuring Ports For Dhcp Snooping
Chapter 12 | Security Measures DHCP Snooping ◆ When the DHCP snooping is globally disabled, DHCP snooping can still be configured for specific VLANs, but the changes will not take effect until DHCP snooping is globally re-enabled. ◆ When DHCP snooping is globally enabled, and DHCP snooping is then disabled on a VLAN, all dynamic bindings learned for this VLAN are removed from the binding table.
Page 351: Figure 224: Configuring The Port Mode For Dhcp Snooping
Chapter 12 | Security Measures DHCP Snooping ◆ When DHCP snooping is enabled both globally and on a VLAN, DHCP packet filtering will be performed on any untrusted ports within the VLAN. ◆ When an untrusted port is changed to a trusted port, all the dynamic DHCP snooping bindings associated with this port are removed.
Page 352: Displaying Dhcp Snooping Binding Information
Chapter 12 | Security Measures DHCP Snooping Displaying DHCP Use the IP Service > DHCP > Snooping (Show Information) page to display entries in the binding table. Snooping Binding Information Parameters These parameters are displayed: ◆ MAC Address – Physical address associated with the entry. ◆...
Page 353: Figure 225: Displaying The Binding Table For Dhcp Snooping
Chapter 12 | Security Measures DHCP Snooping Figure 225: Displaying the Binding Table for DHCP Snooping – 353 –...
Page 354 Chapter 12 | Security Measures DHCP Snooping – 354 –...
Page 355: Basic Administration Protocols
Up to 4096 log entries can be stored in the flash memory, with the oldest entries being overwritten first when the available log memory (256 kilobytes) has been exceeded. 6. ECS4210-12P, ECS4210-28P – 355 –...
Page 356: Table 23: Logging Levels
Chapter 13 | Basic Administration Protocols Configuring Event Logging The System Logs page allows you to configure and limit system messages that are logged to flash or RAM memory. The default is for event levels 0 to 3 to be logged to flash and levels 0 to 7 to be logged to RAM.
Page 357: Figure 226: Configuring Settings For System Memory Logs
Chapter 13 | Basic Administration Protocols Configuring Event Logging Web Interface To configure the logging of error messages to system memory: Click Administration, Log, System. Select Configure Global from the Step list. Enable or disable system logging, set the level of event messages to be logged to flash memory and RAM.
Page 358: Remote Log Configuration
Chapter 13 | Basic Administration Protocols Configuring Event Logging Figure 227: Showing Error Messages Logged to System Memory Remote Log Use the Administration > Log > Remote page to send log messages to syslog Configuration servers or other management stations. You can also limit the event messages sent to only those messages below a specified level.
Page 359: Link Layer Discovery Protocol
Chapter 13 | Basic Administration Protocols Link Layer Discovery Protocol Web Interface To configure the logging of error messages to remote servers: Click Administration, Log, Remote. Enable remote logging, specify the facility type to use for the syslog messages. and enter the IP address of the remote servers. Click Apply.
Page 360: Setting Lldp Timing Attributes
Chapter 13 | Basic Administration Protocols Link Layer Discovery Protocol Setting LLDP Use the Administration > LLDP (Configure Global) page to set attributes for general functions such as globally enabling LLDP on the switch, setting the message Timing Attributes ageout time, and setting the frequency for broadcasting general advertisements or reports about changes in the LLDP MIB.
Page 361: Configuring Lldp Interface Attributes
Chapter 13 | Basic Administration Protocols Link Layer Discovery Protocol any lldpRemTablesChange notification-events missed due to throttling or transmission loss. ◆ MED Fast Start Count – Configures the amount of LLDP MED Fast Start LLDPDUs to transmit during the activation process of the LLDP-MED Fast Start mechanism.
Page 362 Chapter 13 | Basic Administration Protocols Link Layer Discovery Protocol ◆ SNMP Notification – Enables the transmission of SNMP trap notifications about LLDP and LLDP-MED changes. (Default: Disabled) This option sends out SNMP trap notifications to designated target stations at the interval specified by the Notification Interval in the preceding section.
Page 363 Chapter 13 | Basic Administration Protocols Link Layer Discovery Protocol System Capabilities – The system capabilities identifies the primary ■ function(s) of the system and whether or not these primary functions are enabled. The information advertised by this TLV is described in IEEE 802.1AB.
Page 364 Chapter 13 | Basic Administration Protocols Link Layer Discovery Protocol ◆ MED TLVs – Configures general information included in the MED TLV field of advertised messages. Capabilities – This option advertises LLDP-MED TLV capabilities, allowing ■ Media Endpoint and Connectivity Devices to efficiently discover which LLDP-MED related TLVs are supported on the switch.
Page 365: Configuring Lldp Interface Civic-Address
Chapter 13 | Basic Administration Protocols Link Layer Discovery Protocol Set the LLDP transmit/receive mode, specify whether or not to send SNMP trap messages, and select the information to advertise in LLDP messages. Click Apply. Figure 230: Configuring LLDP Interface Attributes Configuring Use the Administration >...
Page 366: Figure 231: Configuring The Civic Address For An Lldp Interface
Chapter 13 | Basic Administration Protocols Link Layer Discovery Protocol (Continued) Table 24: LLDP MED Location CA Types CA Type Description CA Value Example Street suffix or type Avenue House number House number suffix Landmark or vanity address Tech Center Unit (apartment, suite) Apt 519 Floor...
Page 367: Displaying Lldp Local Device Information
Chapter 13 | Basic Administration Protocols Link Layer Discovery Protocol To show the physical location of the attached device: Click Administration, LLDP. Select Configure Interface from the Step list. Select Show CA-Type from the Action list. Select an interface from the Port or Trunk list. Figure 232: Showing the Civic Address for an LLDP Interface Displaying LLDP Local Use the Administration >...
Page 368: Table 26: System Capabilities
Chapter 13 | Basic Administration Protocols Link Layer Discovery Protocol ◆ Chassis ID – An octet string indicating the specific identifier for the particular chassis in this system. ◆ System Name – A string that indicates the system’s administratively assigned name (see “Displaying System Information”...
Page 369: Table 27: Port Id Subtype
Chapter 13 | Basic Administration Protocols Link Layer Discovery Protocol Interface Details The attributes listed below apply to both port and trunk interface types. When a trunk is listed, the descriptions apply to the first port of the trunk. ◆ Local Port/Trunk –...
Page 370: Figure 233: Displaying Local Device Information For Lldp (General)
Chapter 13 | Basic Administration Protocols Link Layer Discovery Protocol Figure 233: Displaying Local Device Information for LLDP (General) Figure 234: Displaying Local Device Information for LLDP (Port) Figure 235: Displaying Local Device Information for LLDP (Port Details) – 370 –...
Page 371: Displaying Lldp Remote Device Information
Chapter 13 | Basic Administration Protocols Link Layer Discovery Protocol Displaying LLDP Use the Administration > LLDP (Show Remote Device Information) page to display information about devices connected directly to the switch’s ports which are Remote Device advertising information through LLDP, or to display detailed information about an Information LLDP-enabled device connected to a specific port on the local switch.
Page 372: Table 28: Remote Port Auto-Negotiation Advertised Capability
Chapter 13 | Basic Administration Protocols Link Layer Discovery Protocol ◆ System Capabilities Supported – The capabilities that define the primary function(s) of the system. (See Table 26, "System Capabilities," on page 368.) ◆ System Capabilities Enabled – The primary function(s) of the system which are currently enabled.
Page 373 Chapter 13 | Basic Administration Protocols Link Layer Discovery Protocol (Continued) Table 28: Remote Port Auto-Negotiation Advertised Capability Capability 100BASE-TX full duplex mode 100BASE-T2 half duplex mode 100BASE-T2 full duplex mode PAUSE for full-duplex links Asymmetric PAUSE for full-duplex links Symmetric PAUSE for full-duplex links Asymmetric and Symmetric PAUSE for full-duplex links 1000BASE-X, -LX, -SX, -CX half duplex mode...
Page 374 Chapter 13 | Basic Administration Protocols Link Layer Discovery Protocol Port Details – 802.3 Extension Trunk Information ◆ Remote Link Aggregation Capable – Shows if the remote port is not in link aggregation state and/or it does not support link aggregation. ◆...
Page 375 Chapter 13 | Basic Administration Protocols Link Layer Discovery Protocol Port Details – Network Policy ◆ Application Type – The primary application(s) defined for this network policy: Voice ■ Voice Signaling ■ Guest Signaling ■ Guest Voice Signaling ■ Softphone Voice ■...
Page 376: Figure 236: Displaying Basic Lldp Information For A Remote Device (Port)
Chapter 13 | Basic Administration Protocols Link Layer Discovery Protocol ECS ELIN – Emergency Call Service Emergency Location Identification ■ Number supports traditional PSAP-based Emergency Call Service in North America. ◆ Country Code – The two-letter ISO 3166 country code in capital ASCII letters. (Example: DK, DE or US) ◆...
Page 377 Chapter 13 | Basic Administration Protocols Link Layer Discovery Protocol To display detailed LLDP information for a remote Interface: Click Administration, LLDP. Select Show Remote Device Information from the Step list. Select Port Details or Trunk Details. Select a port on this switch and the index for a remote device attached to this interface.
Page 378: Figure 237: Displaying Remote Device Information For Lldp (Port Details)
Chapter 13 | Basic Administration Protocols Link Layer Discovery Protocol Figure 237: Displaying Remote Device Information for LLDP (Port Details) – 378 –...
Page 379: Displaying Device Statistics
Chapter 13 | Basic Administration Protocols Link Layer Discovery Protocol Additional information displayed by an end-point device which advertises LLDP- MED TLVs is shown in the following figure. Figure 238: Displaying Remote Device Information for LLDP (End Node) Displaying Use the Administration > LLDP (Show Device Statistics) page to display statistics for Device Statistics LLDP-capable devices attached to the switch, and for LLDP protocol messages transmitted or received on all local interfaces.
Page 380: Figure 239: Displaying Lldp Device Statistics (General)
Chapter 13 | Basic Administration Protocols Link Layer Discovery Protocol Port/Trunk ◆ Frames Discarded – Number of frames discarded because they did not conform to the general validation rules as well as any specific usage rules defined for the particular TLV. ◆...
Page 381: Power Over Ethernet
Figure 240: Displaying LLDP Device Statistics (Port) Power over Ethernet The ECS4210-12P and ECS4210-28P can provide DC power to a wide range of connected devices, eliminating the need for an additional power source and cutting down on the amount of cables attached to each device. Once configured to supply power, an automatic detection process is initialized by the switch that is authenticated by a PoE signature from the connected device.
Page 382: Displaying The Switch's Overall Poe Power Budget
Chapter 13 | Basic Administration Protocols Power over Ethernet Displaying the Use the Administration > PoE (Configure Global) page to display the maximum PoE power budget for the switch (power available to all RJ-45 ports). The maximum Switch’s Overall power budget is fixed at the maximum available setting, which prevents overload PoE Power Budget conditions at the power source.
Page 383: Setting The Port Poe Power Budget
Chapter 13 | Basic Administration Protocols Power over Ethernet Setting The Port Use the Administration > PoE (Configure Interface) page to set the maximum power provided to a port. PoE Power Budget Command Usage ◆ This switch supports both the IEEE 802.3af PoE and IEEE 802.3at-2009 PoE Plus standards.
Page 384: Figure 242: Setting A Port's Poe Budget
Chapter 13 | Basic Administration Protocols Power over Ethernet Parameters These parameters are displayed: ◆ Port – The port number on the switch. ◆ Admin Status – Enables PoE power on a port. Power is automatically supplied when a device is detected on a port, providing that the power demanded does not exceed the switch or port power budget.
Page 385: Simple Network Management Protocol
Chapter 13 | Basic Administration Protocols Simple Network Management Protocol Simple Network Management Protocol Simple Network Management Protocol (SNMP) is a communication protocol designed specifically for managing devices on a network. Equipment commonly managed with SNMP includes switches, routers and host computers. SNMP is typically used to configure these devices for proper operation in a network environment, as well as to monitor them to evaluate performance or detect potential problems.
Page 386: Table 29: Snmpv3 Security Models And Levels
Chapter 13 | Basic Administration Protocols Simple Network Management Protocol Table 29: SNMPv3 Security Models and Levels Model Level Group Read View Write View Notify View Security noAuthNoPriv public defaultview none none Community string only (read only) noAuthNoPriv private defaultview defaultview none Community string only...
Page 387: Configuring Global Settings For Snmp
Chapter 13 | Basic Administration Protocols Simple Network Management Protocol Use the Administration > SNMP (Configure Engine) page to change the local engine ID. If you want to change the default engine ID, it must be changed before configuring other parameters. Use the Administration >...
Page 388: Setting The Local Engine Id
Chapter 13 | Basic Administration Protocols Simple Network Management Protocol Figure 243: Configuring Global Settings for SNMP Setting the Use the Administration > SNMP (Configure Engine - Set Engine ID) page to change Local Engine ID the local engine ID. An SNMPv3 engine is an independent SNMP agent that resides on the switch.
Page 389: Specifying A Remote Engine Id
Chapter 13 | Basic Administration Protocols Simple Network Management Protocol Figure 244: Configuring the Local Engine ID for SNMP Specifying a Use the Administration > SNMP (Configure Engine - Add Remote Engine) page to Remote Engine ID configure a engine ID for a remote management station. To allow management access from an SNMPv3 user on a remote device, you must first specify the engine identifier for the SNMP agent on the remote device where the user resides.
Page 390: Setting Snmpv3 Views
Chapter 13 | Basic Administration Protocols Simple Network Management Protocol Figure 245: Configuring a Remote Engine ID for SNMP To show the remote SNMP engine IDs: Click Administration, SNMP. Select Configure Engine from the Step list. Select Show Remote Engine from the Action list. Figure 246: Showing Remote Engine IDs for SNMP Setting SNMPv3 Views Use the Administration >...
Page 391: Figure 247: Creating An Snmp View
Chapter 13 | Basic Administration Protocols Simple Network Management Protocol Add OID Subtree ◆ View Name – Lists the SNMP views configured in the Add View page. (Range: 1-32 characters). ◆ OID Subtree – Adds an additional object identifier of a branch within the MIB tree to the selected View.
Page 392: Figure 248: Showing Snmp Views
Chapter 13 | Basic Administration Protocols Simple Network Management Protocol Figure 248: Showing SNMP Views To add an object identifier to an existing SNMP view of the switch’s MIB database: Click Administration, SNMP. Select Configure View from the Step list. Select Add OID Subtree from the Action list.
Page 393: Configuring Snmpv3 Groups
Chapter 13 | Basic Administration Protocols Simple Network Management Protocol Figure 250: Showing the OID Subtree Configured for SNMP Views Configuring Use the Administration > SNMP (Configure Group) page to add an SNMPv3 group SNMPv3 Groups which can be used to set the access policy for its assigned users, restricting them to specific read, write, and notify views.
Page 394 Chapter 13 | Basic Administration Protocols Simple Network Management Protocol Table 30: Supported Notification Messages Model Level Group RFC 1493 Traps newRoot 1.3.6.1.2.1.17.0.1 The newRoot trap indicates that the sending agent has become the new root of the Spanning Tree; the trap is sent by a bridge soon after its election as the new root, e.g., upon expiration of the Topology Change Timer immediately subsequent to...
Page 395 Chapter 13 | Basic Administration Protocols Simple Network Management Protocol (Continued) Table 30: Supported Notification Messages Model Level Group Private Traps swPowerStatusChangeTrap 1.3.6.1.4.1.259.6.10.112.2.1.0.1 This trap is sent when the power state changes. swPortSecurityTrap 1.3.6.1.4.1.259.10.1.112.2.1.0.36 This trap is sent when the port is being intruded.
Page 396 1. These are legacy notifications and therefore must be enabled in conjunction with the corresponding traps on the SNMP Configuration menu. 2. The MIB OID for ECS4210-12P is 1.3.6.1.4.1.259.10.1.42.104 ECS4210-12T is 1.3.6.1.4.1.259.10.1.42.103 ECS4210-28T is 1.3.6.1.4.1.259.10.1.42.101 ECS4210-28P is 1.3.6.1.4.1.259.10.1.42.102...
Page 397: Figure 251: Creating An Snmp Group
Chapter 13 | Basic Administration Protocols Simple Network Management Protocol Web Interface To configure an SNMP group: Click Administration, SNMP. Select Configure Group from the Step list. Select Add from the Action list. Enter a group name, assign a security model and level, and then select read, write, and notify views.
Page 398: Setting Community Access Strings
Chapter 13 | Basic Administration Protocols Simple Network Management Protocol Setting Community Use the Administration > SNMP (Configure User - Add Community) page to configure up to five community strings authorized for management access by Access Strings clients using SNMP v1 and v2c. For security reasons, you should consider removing the default strings.
Page 399: Configuring Local Snmpv3 Users
Chapter 13 | Basic Administration Protocols Simple Network Management Protocol Select Show Community from the Action list. Figure 254: Showing Community Access Strings Configuring Use the Administration > SNMP (Configure User - Add SNMPv3 Local User) page to authorize management access for SNMPv3 clients, or to identify the source of Local SNMPv3 Users SNMPv3 trap messages sent from the local switch.
Page 400: Figure 255: Configuring Local Snmpv3 Users
Chapter 13 | Basic Administration Protocols Simple Network Management Protocol ◆ Privacy Protocol – The encryption algorithm use for data privacy; only 56-bit DES is currently available. ◆ Privacy Password – A minimum of eight plain text characters is required. Web Interface To configure a local SNMPv3 user: Click Administration, SNMP.
Page 401: Configuring Remote Snmpv3 Users
Chapter 13 | Basic Administration Protocols Simple Network Management Protocol Figure 256: Showing Local SNMPv3 Users Configuring Use the Administration > SNMP (Configure User - Add SNMPv3 Remote User) page to identify the source of SNMPv3 inform messages sent from the local switch. Each Remote SNMPv3 Users SNMPv3 user is defined by a unique name.
Page 402: Figure 257: Configuring Remote Snmpv3 Users
Chapter 13 | Basic Administration Protocols Simple Network Management Protocol ◆ Authentication Protocol – The method used for user authentication. (Options: MD5, SHA; Default: MD5) ◆ Authentication Password – A minimum of eight plain text characters is required. ◆ Privacy Protocol – The encryption algorithm use for data privacy; only 56-bit DES is currently available.
Page 403: Specifying Trap Managers
Chapter 13 | Basic Administration Protocols Simple Network Management Protocol To show remote SNMPv3 users: Click Administration, SNMP. Select Configure User from the Step list. Select Show SNMPv3 Remote User from the Action list. Figure 258: Showing Remote SNMPv3 Users Specifying Use the Administration >...
Page 404 Chapter 13 | Basic Administration Protocols Simple Network Management Protocol Create a local SNMPv3 user to use in the message exchange process (page 399). If the user specified in the notification configuration page does not exist, an SNMPv3 group will be automatically created using the name of the specified local user, and default settings for the read, write, and notify view.
Page 405 Chapter 13 | Basic Administration Protocols Simple Network Management Protocol Retry times – The maximum number of times to resend an inform ■ message if the recipient does not acknowledge receipt. (Range: 0-255; Default: 3) ◆ Community String – Specifies a valid community string for the new notification manager entry.
Page 406: Figure 259: Configuring Trap Managers (Snmpv1)
Chapter 13 | Basic Administration Protocols Simple Network Management Protocol ◆ Security Level – When notification version 3 is selected, you must specify one of the following security levels. (Default: noAuthNoPriv) noAuthNoPriv – There is no authentication or encryption used in SNMP ■...
Page 407: Creating Snmp Notification Logs
Chapter 13 | Basic Administration Protocols Simple Network Management Protocol Figure 261: Configuring Trap Managers (SNMPv3) To show configured notification managers: Click Administration, SNMP. Select Configure Trap from the Step list. Select Show from the Action list. Figure 262: Showing Notification Managers Creating SNMP Use the Administration >...
Page 408 Chapter 13 | Basic Administration Protocols Simple Network Management Protocol ◆ Given the service provided by the NLM, individual MIBs can now bear less responsibility to record transient information associated with an event against the possibility that the Notification message is lost, and applications can poll the log to verify that they have not missed any important Notifications.
Page 409: Showing Snmp Statistics
Chapter 13 | Basic Administration Protocols Simple Network Management Protocol Figure 263: Creating SNMP Notification Logs To show configured SNMP notification logs: Click Administration, SNMP. Select Configure Notify Filter from the Step list. Select Show from the Action list. Figure 264: Showing SNMP Notification Logs Showing Use the Administration >...
Page 410 Chapter 13 | Basic Administration Protocols Simple Network Management Protocol ◆ Encoding errors – The total number of ASN.1 or BER errors encountered by the SNMP entity when decoding received SNMP messages. ◆ Number of requested variables – The total number of MIB objects which have been retrieved successfully by the SNMP protocol entity as the result of receiving valid SNMP Get-Request and Get-Next PDUs.
Page 411: Remote Monitoring
Chapter 13 | Basic Administration Protocols Remote Monitoring Web Interface To show SNMP statistics: Click Administration, SNMP. Select Show Statistics from the Step list. Figure 265: Showing SNMP Statistics Remote Monitoring Remote Monitoring allows a remote device to collect information or respond to specified events on an independent basis.
Page 412: Configuring Rmon Alarms
Chapter 13 | Basic Administration Protocols Remote Monitoring Configuring Use the Administration > RMON (Configure Global - Add - Alarm) page to define specific criteria that will generate response events. Alarms can be set to test data RMON Alarms over any specified time interval, and can monitor absolute or changing values (such as a statistical counter reaching a specific value, or a statistic changing by a certain amount over the set interval).
Page 413: Figure 266: Configuring An Rmon Alarm
Chapter 13 | Basic Administration Protocols Remote Monitoring event will not be generated until the sampled value has risen above the falling threshold, reaches the rising threshold, and again moves back down to the failing threshold. (Range: 0-2147483647) ◆ Falling Event Index – The index of the event to use if an alarm is triggered by monitored variables reaching or crossing below the falling threshold.
Page 414: Configuring Rmon Events
Chapter 13 | Basic Administration Protocols Remote Monitoring To show configured RMON alarms: Click Administration, RMON. Select Configure Global from the Step list. Select Show from the Action list. Click Alarm. Figure 267: Showing Configured RMON Alarms Configuring Use the Administration > RMON (Configure Global - Add - Event) page to set the action to take when an alarm is triggered.
Page 415: Figure 268: Configuring An Rmon Event
Chapter 13 | Basic Administration Protocols Remote Monitoring Log – Generates an RMON log entry when the event is triggered. Log ■ messages are processed based on the current configuration settings for event logging (see “System Log Configuration” on page 355).
Page 416: Configuring Rmon History Samples
Chapter 13 | Basic Administration Protocols Remote Monitoring To show configured RMON events: Click Administration, RMON. Select Configure Global from the Step list. Select Show from the Action list. Click Event. Figure 269: Showing Configured RMON Events Configuring RMON Use the Administration > RMON (Configure Interface - Add - History) page to collect statistics on a physical interface to monitor network utilization, packet types, and History Samples errors.
Page 417: Figure 270: Configuring An Rmon History Sample
Chapter 13 | Basic Administration Protocols Remote Monitoring example, if control entry 15 is assigned to port 5, this index entry will be removed from the Show and Show Details page for port 8. Parameters These parameters are displayed: ◆ Port –...
Page 418: Figure 271: Showing Configured Rmon History Samples
Chapter 13 | Basic Administration Protocols Remote Monitoring To show configured RMON history samples: Click Administration, RMON. Select Configure Interface from the Step list. Select Show from the Action list. Select a port from the list. Click History. Figure 271: Showing Configured RMON History Samples To show collected RMON history samples: Click Administration, RMON.
Page 419: Configuring Rmon Statistical Samples
Chapter 13 | Basic Administration Protocols Remote Monitoring Configuring RMON Use the Administration > RMON (Configure Interface - Add - Statistics) page to collect statistics on a port, which can subsequently be used to monitor the network Statistical Samples for common errors and overall traffic rates. Command Usage ◆...
Page 420: Figure 273: Configuring An Rmon Statistical Sample
Chapter 13 | Basic Administration Protocols Remote Monitoring Figure 273: Configuring an RMON Statistical Sample To show configured RMON statistical samples: Click Administration, RMON. Select Configure Interface from the Step list. Select Show from the Action list. Select a port from the list. Click Statistics.
Page 421: Switch Clustering
Chapter 13 | Basic Administration Protocols Switch Clustering Figure 275: Showing Collected RMON Statistical Samples Switch Clustering Switch clustering is a method of grouping switches together to enable centralized management through a single unit. Switches that support clustering can be grouped together regardless of physical location or switch type, as long as they are connected to the same local network.
Page 422: Configuring General Settings For Clusters
Chapter 13 | Basic Administration Protocols Switch Clustering ◆ After the Commander and Members have been configured, any switch in the cluster can be managed from the web agent by choosing the desired Member ID from the Show Member page. Configuring General Use the Administration >...
Page 423: Cluster Member Configuration
Chapter 13 | Basic Administration Protocols Switch Clustering Figure 276: Configuring a Switch Cluster Cluster Member Use the Administration > Cluster (Configure Member - Add) page to add Candidate Configuration switches to the cluster as Members. Parameters These parameters are displayed: ◆...
Page 424: Figure 277: Configuring Cluster Members
Chapter 13 | Basic Administration Protocols Switch Clustering Figure 277: Configuring Cluster Members To show the cluster members: Click Administration, Cluster. Select Configure Member from the Step list. Select Show from the Action list. Figure 278: Showing Cluster Members To show cluster candidates: Click Administration, Cluster.
Page 425: Managing Cluster Members
Chapter 13 | Basic Administration Protocols Switch Clustering Managing Use the Administration > Cluster (Show Member) page to manage another switch in the cluster. Cluster Members Parameters These parameters are displayed: Member ID – The ID number of the Member switch. (Range: 1-36) Role –...
Page 426 Chapter 13 | Basic Administration Protocols Switch Clustering – 426 –...
Page 427: Ip Configuration
IP Configuration This chapter describes how to configure an IP interface for management access to the switch over the network. This switch supports both IP Version 4 and Version 6, and can be managed simultaneously through either of these address types. You can manually configure a specific IPv4 or IPv6 address, or direct the switch to obtain an IPv4 address using Auto IP, or from a BOOTP or DHCP server when it is powered on.
Page 428: Figure 281: Pinging A Network Device
Chapter 14 | IP Configuration Using the Ping Function Command Usage ◆ Use the ping command to see if another site on the network can be reached. ◆ The following are some results of the ping command: Normal response - The normal response occurs in one to ten seconds, ■...
Page 429: Address Resolution Protocol
Chapter 14 | IP Configuration Address Resolution Protocol Address Resolution Protocol The switch uses Address Resolution Protocol (ARP) to forward traffic from one hop to the next. ARP is used to map an IP address to a physical layer (i.e., MAC) address. When an IP frame is received by this switch (or any standards-based switch/router), it first looks up the MAC address corresponding to the destination IP address in the ARP cache.
Page 430: Displaying Arp Entries
Chapter 14 | IP Configuration Address Resolution Protocol The aging time determines how long dynamic entries remain in the cache. If the timeout is too short, the switch may tie up resources by repeating ARP requests for addresses recently flushed from the table. When a ARP entry expires, it is deleted from the cache and an ARP request packet is sent to re-establish the MAC address.
Page 431: Setting The Switch's Ip Address (Ip Version 4)
Chapter 14 | IP Configuration Setting the Switch’s IP Address (IP Version 4) Setting the Switch’s IP Address (IP Version 4) Use the System > IP page to configure an IPv4 address for management access over the network. This switch supports both IPv4 and IPv6, and can be managed through either of these address types.
Page 432: Figure 284: Configuring A Static Ipv4 Address
Chapter 14 | IP Configuration Setting the Switch’s IP Address (IP Version 4) ◆ IP Address – Address of the VLAN to which the management station is attached. Valid IP addresses consist of four numbers, 0 to 255, separated by periods.
Page 433: Figure 285: Configuring An Auto Ip Address
Chapter 14 | IP Configuration Setting the Switch’s IP Address (IP Version 4) Figure 285: Configuring an Auto IP Address To obtain an dynamic address through DHCP/BOOTP for the switch: Click System, IP. Select the VLAN through which the management station is attached, set the IP Address Mode to “DHCP”...
Page 434: Setting The Switch's Ip Address (Ip Version 6)
Chapter 14 | IP Configuration Setting the Switch’s IP Address (IP Version 6) segment, you will lose management access to the switch. In this case, you can reboot the switch or submit a client request to restart DHCP service via the CLI. If the address assigned by DHCP is no longer functioning, you will not be able to renew the IP settings via the web interface.
Page 435: Configuring Ipv6 Interface Settings
Chapter 14 | IP Configuration Setting the Switch’s IP Address (IP Version 6) Web Interface To configure an IPv6 default gateway for the switch: Click IP, IPv6 Configuration. Select Configure Global from the Action list. Enter the IPv6 default gateway. Click Apply.
Page 436 Chapter 14 | IP Configuration Setting the Switch’s IP Address (IP Version 6) Parameters These parameters are displayed: VLAN Mode ◆ VLAN – ID of a configured VLAN which is to be used for management access. By default, all ports on the switch are members of VLAN 1. However, the management station can be attached to a port belonging to any VLAN, as long as that VLAN has been assigned an IP address.
Page 437 Chapter 14 | IP Configuration Setting the Switch’s IP Address (IP Version 6) IPv6 must be enabled on an interface before the MTU can be set. If an IPv6 ■ address has not been assigned to the switch, “N/A” is displayed in the MTU field.
Page 438 Chapter 14 | IP Configuration Setting the Switch’s IP Address (IP Version 6) switch may also attempt to acquire other non-address configuration information (such as a default gateway) when DHCPv6 is restarted. Prior to submitting a client request to a DHCPv6 server, the switch should be configured with a link-local address using the Address Autoconfig option.
Page 439: Figure 288: Configuring General Settings For An Ipv6 Interface
Chapter 14 | IP Configuration Setting the Switch’s IP Address (IP Version 6) on the selected interface. Set the MTU size, the maximum number of duplicate address detection messages, the neighbor solicitation message interval, and the remote node reachable time. Click Apply.
Page 440: Configuring An Ipv6 Address
Chapter 14 | IP Configuration Setting the Switch’s IP Address (IP Version 6) Configuring an Use the IP > IPv6 Configuration (Add IPv6 Address) page to configure an IPv6 interface for management access over the network. IPv6 Address Command Usage ◆...
Page 441 Chapter 14 | IP Configuration Setting the Switch’s IP Address (IP Version 6) Parameters These parameters are displayed: ◆ VLAN – ID of a configured VLAN which is to be used for management access. By default, all ports on the switch are members of VLAN 1. However, the management station can be attached to a port belonging to any VLAN, as long as that VLAN has been assigned an IP address.
Page 442: Showing Ipv6 Addresses
Chapter 14 | IP Configuration Setting the Switch’s IP Address (IP Version 6) Link Local – Configures an IPv6 link-local address. ■ The address prefix must be in the range of FE80~FEBF. ■ ■ You can configure only one link-local address per interface. ■...
Page 443: Figure 291: Showing Configured Ipv6 Addresses
Chapter 14 | IP Configuration Setting the Switch’s IP Address (IP Version 6) In addition to the unicast addresses assigned to an interface, a host is also required to listen to the all-nodes multicast addresses FF01::1 (interface-local scope) and FF02::1 (link-local scope). FF01::1/16 is the transient interface-local multicast address for all attached IPv6 nodes, and FF02::1/16 is the link-local multicast address for all attached IPv6 nodes.
Page 444: Showing The Ipv6 Neighbor Cache
Chapter 14 | IP Configuration Setting the Switch’s IP Address (IP Version 6) Showing the IPv6 Use the IP > IPv6 Configuration (Show IPv6 Neighbor Cache) page to display the IPv6 addresses detected for neighbor devices. Neighbor Cache Parameters These parameters are displayed: Table 32: Show IPv6 Neighbors - display description Field Description...
Page 445: Showing Ipv6 Statistics
Chapter 14 | IP Configuration Setting the Switch’s IP Address (IP Version 6) Web Interface To show neighboring IPv6 devices: Click IP, IPv6 Configuration. Select Show IPv6 Neighbors from the Action list. Figure 292: Showing IPv6 Neighbors Showing Use the IP > IPv6 Configuration (Show Statistics) page to display statistics about IPv6 Statistics IPv6 traffic passing through this switch.
Page 446: Table 33: Show Ipv6 Statistics - Display Description
Chapter 14 | IP Configuration Setting the Switch’s IP Address (IP Version 6) Parameters These parameters are displayed: Table 33: Show IPv6 Statistics - display description Field Description IPv6 Statistics IPv6 Received Total The total number of input datagrams received by the interface, including those received in error.
Page 447 Chapter 14 | IP Configuration Setting the Switch’s IP Address (IP Version 6) (Continued) Table 33: Show IPv6 Statistics - display description Field Description IPv6 Transmitted Forwards Datagrams The number of output datagrams which this entity received and forwarded to their final destinations. In entities which do not act as IPv6 routers, this counter will include only those packets which were Source- Routed via this entity, and the Source-Route processing was successful.
Page 448 Chapter 14 | IP Configuration Setting the Switch’s IP Address (IP Version 6) (Continued) Table 33: Show IPv6 Statistics - display description Field Description Neighbor Advertisement The number of ICMP Neighbor Advertisement messages received by Messages the interface. Redirect Messages The number of Redirect messages received by the interface.
Page 449: Figure 293: Showing Ipv6 Statistics (Ipv6)
Chapter 14 | IP Configuration Setting the Switch’s IP Address (IP Version 6) (Continued) Table 33: Show IPv6 Statistics - display description Field Description Other Errors The number of received UDP datagrams that could not be delivered for reasons other than the lack of an application at the destination port. Output The total number of UDP datagrams sent from this entity.
Page 450: Figure 294: Showing Ipv6 Statistics (Icmpv6)
Chapter 14 | IP Configuration Setting the Switch’s IP Address (IP Version 6) Figure 294: Showing IPv6 Statistics (ICMPv6) Figure 295: Showing IPv6 Statistics (UDP) – 450 –...
Page 451: Showing The Mtu For Responding Destinations
Chapter 14 | IP Configuration Setting the Switch’s IP Address (IP Version 6) Showing the MTU Use the IP > IPv6 Configuration (Show MTU) page to display the maximum transmission unit (MTU) cache for destinations that have returned an ICMP packet- for Responding too-big message along with an acceptable MTU to this switch.
Page 452 Chapter 14 | IP Configuration Setting the Switch’s IP Address (IP Version 6) – 452 –...
Page 453: Ip Services
IP Services This chapter describes how to configure Domain Name Service (DNS) on this switch. For information on DHCP snooping which is included in this folder, see “DHCP Snooping” on page 346. This chapter provides information on the following IP services, including: ◆...
Page 454: Configuring A List Of Domain Names
Chapter 15 | IP Services Domain Name Service Parameters These parameters are displayed: ◆ Domain Lookup – Enables DNS host name-to-address translation. (Default: Disabled) ◆ Default Domain Name – Defines the default domain name appended to incomplete host names. Do not include the initial dot that separates the host name from the domain name.
Page 455: Figure 298: Configuring A List Of Domain Names For Dns
Chapter 15 | IP Services Domain Name Service checking with the specified name servers for a match (see “Configuring a List of Name Servers” on page 456). Parameters These parameters are displayed: Domain Name – Name of the host. Do not include the initial dot that separates the host name from the domain name.
Page 456: Configuring A List Of Name Servers
Chapter 15 | IP Services Domain Name Service Configuring a List of Use the IP Service > DNS - General (Add Name Server) page to configure a list of name servers to be tried in sequential order. Name Servers Command Usage ◆...
Page 457: Configuring Static Dns Host To Address Entries
Chapter 15 | IP Services Domain Name Service Figure 301: Showing the List of Name Servers for DNS Configuring Use the IP Service > DNS - Static Host Table (Add) page to manually configure static Static DNS Host to entries in the DNS table that are used to map domain names to IP addresses. Address Entries Command Usage ◆...
Page 458: Displaying The Dns Cache
Chapter 15 | IP Services Domain Name Service To show static entries in the DNS table: Click IP Service, DNS, Static Host Table. Select Show from the Action list. Figure 303: Showing Static Entries in the DNS Table Displaying the Use the IP Service >...
Page 459: Multicast Domain Name Service
Chapter 15 | IP Services Multicast Domain Name Service Web Interface To display entries in the DNS cache: Click IP Service, DNS, Cache. Figure 304: Showing Entries in the DNS Cache Multicast Domain Name Service Use the IP Service > Multicast DNS page to enable multicast DNS host name-to- address mapping on the local network without the need for a dedicated DNS server.
Page 460: Dynamic Host Configuration Protocol
Chapter 15 | IP Services Dynamic Host Configuration Protocol Parameters These parameters are displayed: ◆ Multicast DNS Status – Enables multicast DNS host name-to-address mapping on the local network. (Default: Enabled) Web Interface To configure multicast DNS: Click IP Service, Multicast DNS. Mark the check box to enable or disable mDNS as required Click Apply.
Page 461: Configuring Dhcp Relay Option
Chapter 15 | IP Services Dynamic Host Configuration Protocol Parameters These parameters are displayed: ◆ VLAN – ID of configured VLAN. ◆ Vendor Class ID – The following options are supported when the check box is marked to enable this feature. ◆...
Page 462: Figure 307: Layer 2 Dhcp Relay Service
Chapter 15 | IP Services Dynamic Host Configuration Protocol ◆ The DHCP Relay Information Option Fields are the Option 82 circuit identification fields (CID – including VLAN ID, stack unit, and port). These fields identify the requesting device by indicating the interface through which the relay agent received the request.
Page 463 Chapter 15 | IP Services Dynamic Host Configuration Protocol management VLAN or a non-management VLAN, it will add option 82 relay information and the relay agent’s address to the DHCP request packet, and then unicast it to the DHCP server. If a DHCP relay server has been set on the switch, when the switch receives ■...
Page 464 Chapter 15 | IP Services Dynamic Host Configuration Protocol A DHCP relay server has been set on the switch, when the switch receives a ■ DHCP request packet with a non-zero relay agent address field (that is not the address of this switch). A DHCP relay server has been set on the switch, when the switch receives ■...
Page 465: Figure 308: Configuring Dhcp Relay Information Option 82 Service
Chapter 15 | IP Services Dynamic Host Configuration Protocol ◆ Server IP Address – Addresses of DHCP servers or relay servers to be used by the switch’s DHCP relay agent in order of preference. Web Interface To configure DHCP relay service: Click IP Service, DHCP, Relay Option 82.
Page 466 Chapter 15 | IP Services Dynamic Host Configuration Protocol – 466 –...
Page 467: Multicast Filtering
Multicast Filtering This chapter describes how to configure the following multicast services: ◆ IGMP – Configuring snooping and query parameters. ◆ Filtering and Throttling – Filtering specified multicast service, or throttling the maximum of multicast groups allowed on an interface. ◆...
Page 468: Layer 2 Igmp (Snooping And Query)
Chapter 16 | Multicast Filtering Layer 2 IGMP (Snooping and Query) This switch can use Internet Group Management Protocol (IGMP) to filter multicast traffic. IGMP Snooping can be used to passively monitor or “snoop” on exchanges between attached hosts and an IGMP-enabled device, most commonly a multicast router.
Page 469 Chapter 16 | Multicast Filtering Layer 2 IGMP (Snooping and Query) Note: When the switch is configured to use IGMPv3 snooping, the snooping version may be downgraded to version 2 or version 1, depending on the version of the IGMP query packets detected on each VLAN. Note: IGMP snooping will not function unless a multicast router port is enabled on the switch.
Page 470: Configuring Igmp Snooping And Query Parameters
Chapter 16 | Multicast Filtering Layer 2 IGMP (Snooping and Query) Configuring IGMP Use the Multicast > IGMP Snooping > General page to configure the switch to forward multicast traffic intelligently. Based on the IGMP query and report Snooping and Query messages, the switch forwards multicast traffic only to the ports that request it.
Page 471 Chapter 16 | Multicast Filtering Layer 2 IGMP (Snooping and Query) When proxy reporting is enabled with this command, the switch performs “IGMP Snooping with Proxy Reporting” (as defined in DSL Forum TR-101, April 2006), including last leave, and query suppression. Last leave sends out a proxy query when the last member leaves a multicast group, and query suppression means that specific queries are not forwarded from an upstream multicast router to hosts downstream from this device.
Page 472 Chapter 16 | Multicast Filtering Layer 2 IGMP (Snooping and Query) multicast router receives this solicitation, it immediately issues an IGMP general query. A query solicitation can be sent whenever the switch notices a topology change, even if it is not the root bridge in spanning tree. ◆...
Page 473: Specifying Static Interfaces For A Multicast Router
Chapter 16 | Multicast Filtering Layer 2 IGMP (Snooping and Query) This attribute configures the IGMP report/query version used by IGMP snooping. Versions 1 - 3 are all supported, and versions 2 and 3 are backward compatible, so the switch can operate with other devices, regardless of the snooping version employed.
Page 474 Chapter 16 | Multicast Filtering Layer 2 IGMP (Snooping and Query) Command Usage IGMP Snooping must be enabled globally on the switch (see “Configuring IGMP Snooping and Query Parameters” on page 470) before a multicast router port can take effect. Parameters These parameters are displayed: Add Static Multicast Router...
Page 475: Figure 311: Configuring A Static Interface For A Multicast Router
Chapter 16 | Multicast Filtering Layer 2 IGMP (Snooping and Query) Figure 311: Configuring a Static Interface for a Multicast Router To show the static interfaces attached to a multicast router: Click Multicast, IGMP Snooping, Multicast Router. Select Show Static Multicast Router from the Action list. Select the VLAN for which to display this information.
Page 476: Assigning Interfaces To Multicast Services
Chapter 16 | Multicast Filtering Layer 2 IGMP (Snooping and Query) Figure 313: Showing Current Interfaces Attached a Multicast Router Assigning Interfaces Use the Multicast > IGMP Snooping > IGMP Member (Add Static Member) page to to Multicast Services statically assign a multicast service to an interface. Multicast filtering can be dynamically configured using IGMP Snooping and IGMP Query messages (see “Configuring IGMP Snooping and Query Parameters”...
Page 477: Figure 314: Assigning An Interface To A Multicast Service
Chapter 16 | Multicast Filtering Layer 2 IGMP (Snooping and Query) Select the VLAN that will propagate the multicast service, specify the interface attached to a multicast service (through an IGMP-enabled switch or multicast router), and enter the multicast IP address. Click Apply.
Page 478: Setting Igmp Snooping Status Per Interface
Chapter 16 | Multicast Filtering Layer 2 IGMP (Snooping and Query) Setting IGMP Use the Multicast > IGMP Snooping > Interface (Configure VLAN) page to configure IGMP snooping attributes for a VLAN. To configure snooping globally, refer to Snooping Status “Configuring IGMP Snooping and Query Parameters”...
Page 479 Chapter 16 | Multicast Filtering Layer 2 IGMP (Snooping and Query) ◆ Multicast Router Termination – These messages are sent when a router stops IP multicast routing functions on an interface. Termination messages are sent by multicast routers when: Multicast forwarding is disabled on an interface. ■...
Page 480 Chapter 16 | Multicast Filtering Layer 2 IGMP (Snooping and Query) If immediate leave is not used, a multicast router (or querier) will send a group- specific query message when an IGMPv2 group leave message is received. The router/querier stops forwarding traffic for that group only if no host replies to the query within the specified time out period.
Page 481 Chapter 16 | Multicast Filtering Layer 2 IGMP (Snooping and Query) message received from a downstream host in report and leave messages sent upstream from the multicast router port. ◆ Interface Version – Sets the protocol version for compatibility with other devices on the network.
Page 482: Figure 316: Configuring Igmp Snooping On An Interface
Chapter 16 | Multicast Filtering Layer 2 IGMP (Snooping and Query) ◆ Proxy Query Address – A static source address for locally generated query and report messages used by IGMP Proxy Reporting. (Range: Any valid IP unicast address; Default: 0.0.0.0) IGMP Snooping uses a null IP address of 0.0.0.0 for the source of IGMP query messages which are proxied to downstream hosts to indicate that it is not the elected querier, but is only proxying these messages as defined in RFC 4541.
Page 483: Filtering Multicast Data At Interfaces
Chapter 16 | Multicast Filtering Layer 2 IGMP (Snooping and Query) To show the interface settings for IGMP snooping: Click Multicast, IGMP Snooping, Interface. Select Show VLAN Information from the Action list. Figure 317: Showing Interface Settings for IGMP Snooping Filtering Multicast Use the Multicast >...
Page 484: Displaying Multicast Groups Discovered By Igmp Snooping
Chapter 16 | Multicast Filtering Layer 2 IGMP (Snooping and Query) The attribute value pairs configured on the RADIUS server are shown below. Table 35: RADIUS Server AVPs Attribute Name AVP Type Entry USER_NAME User MAC address USER_PASSWORD User MAC address NAS_IP_ADDRESS Switch IP NAS_PORT...
Page 485: Displaying Igmp Snooping Statistics
Chapter 16 | Multicast Filtering Layer 2 IGMP (Snooping and Query) ◆ Group Address – IP multicast group address with subscribers directly attached or downstream from the switch, or a static multicast group assigned to this interface. ◆ Interface – A downstream port or trunk that is receiving traffic for the specified multicast group.
Page 486 Chapter 16 | Multicast Filtering Layer 2 IGMP (Snooping and Query) ◆ Trunk – Trunk identifier. (Range: 1-8/12) Query Statistics ◆ Querier IP Address – The IP address of the querier on this interface. ◆ Querier Expire Time – The time after which this querier is assumed to have expired.
Page 487: Figure 320: Displaying Igmp Snooping Statistics - Query
Chapter 16 | Multicast Filtering Layer 2 IGMP (Snooping and Query) ◆ G(-S)-S Query – The number of group specific or group-and-source specific query messages sent from this interface. Web Interface To display statistics for IGMP snooping query-related messages: Click Multicast, IGMP Snooping, Statistics. Select Show Query Statistics from the Action list.
Page 488: Figure 321: Displaying Igmp Snooping Statistics - Vlan
Chapter 16 | Multicast Filtering Layer 2 IGMP (Snooping and Query) Figure 321: Displaying IGMP Snooping Statistics – VLAN To display IGMP snooping protocol-related statistics for a port: Click Multicast, IGMP Snooping, Statistics. Select Show Port Statistics from the Action list. Select a Port.
Page 489: Filtering And Throttling Igmp Groups
Chapter 16 | Multicast Filtering Filtering and Throttling IGMP Groups Filtering and Throttling IGMP Groups In certain switch applications, the administrator may want to control the multicast services that are available to end users. For example, an IP/TV service based on a specific subscription plan.
Page 490: Configuring Igmp Filter Profiles
Chapter 16 | Multicast Filtering Filtering and Throttling IGMP Groups Figure 323: Enabling IGMP Filtering and Throttling Configuring IGMP Use the Multicast > IGMP Snooping > Filter (Configure Profile – Add) page to create an IGMP profile and set its access mode. Then use the (Add Multicast Group Range) Filter Profiles page to configure the multicast groups to filter.
Page 491: Figure 324: Creating An Igmp Filtering Profile
Chapter 16 | Multicast Filtering Filtering and Throttling IGMP Groups Select Add from the Action list. Enter the number for a profile, and set its access mode. Click Apply. Figure 324: Creating an IGMP Filtering Profile To show the IGMP filter profiles: Click Multicast, IGMP Snooping, Filter.
Page 492: Configuring Igmp Filtering And Throttling For Interfaces
Chapter 16 | Multicast Filtering Filtering and Throttling IGMP Groups Figure 326: Adding Multicast Groups to an IGMP Filtering Profile To show the multicast groups configured for an IGMP filter profile: Click Multicast, IGMP Snooping, Filter. Select Configure Profile from the Step list. Select Show Multicast Group Range from the Action list.
Page 493: Figure 328: Configuring Igmp Filtering And Throttling Interface Settings
Chapter 16 | Multicast Filtering Filtering and Throttling IGMP Groups Parameters These parameters are displayed: ◆ Interface – Port or trunk identifier. An IGMP profile or throttling setting can be applied to a port or trunk. When ports are configured as trunk members, the trunk uses the settings applied to the first port member in the trunk.
Page 494: Mld Snooping (Snooping And Query For Ipv6)
Chapter 16 | Multicast Filtering MLD Snooping (Snooping and Query for IPv6) MLD Snooping (Snooping and Query for IPv6) Multicast Listener Discovery (MLD) snooping operates on IPv6 traffic and performs a similar function to IGMP snooping for IPv4. That is, MLD snooping dynamically configures switch ports to limit IPv6 multicast traffic so that it is forwarded only to ports with users that want to receive it.
Page 495: Figure 329: Configuring General Settings For Mld Snooping
Chapter 16 | Multicast Filtering MLD Snooping (Snooping and Query for IPv6) An MLD general query message is sent by the switch at the interval specified by this attribute. When this message is received by downstream hosts, all receivers build an MLD report for the multicast groups they have joined. ◆...
Page 496: Setting Immediate Leave Status For Mld Snooping Per Interface
Chapter 16 | Multicast Filtering MLD Snooping (Snooping and Query for IPv6) Setting Immediate Use the Multicast > MLD Snooping > Interface page to configure Immediate Leave status for a VLAN. Leave Status for MLD Snooping per Interface Parameters These parameters are displayed: ◆...
Page 497: Figure 331: Configuring A Static Interface For An Ipv6 Multicast Router
Chapter 16 | Multicast Filtering MLD Snooping (Snooping and Query for IPv6) Command Usage MLD Snooping must be enabled globally on the switch (see “Configuring MLD Snooping and Query Parameters” on page 494) before a multicast router port can take effect. Parameters These parameters are displayed: ◆...
Page 498: Assigning Interfaces To Ipv6 Multicast Services
Chapter 16 | Multicast Filtering MLD Snooping (Snooping and Query for IPv6) Figure 332: Showing Static Interfaces Attached an IPv6 Multicast Router To show all the interfaces attached to a multicast router: Click Multicast, MLD Snooping, Multicast Router. Select Current Multicast Router from the Action list. Select the VLAN for which to display this information.
Page 499: Figure 334: Assigning An Interface To An Ipv6 Multicast Service
Chapter 16 | Multicast Filtering MLD Snooping (Snooping and Query for IPv6) Parameters These parameters are displayed: ◆ VLAN – Specifies the VLAN which is to propagate the multicast service. (Range: 1-4094) ◆ Multicast IPv6 Address – The IP address for a specific multicast service. ◆...
Page 500: Figure 335: Showing Static Interfaces Assigned To An Ipv6 Multicast Service
Chapter 16 | Multicast Filtering MLD Snooping (Snooping and Query for IPv6) To show the static interfaces assigned to an IPv6 multicast service: Click Multicast, MLD Snooping, MLD Member. Select Show Static Member from the Action list. Select the VLAN for which to display this information. Figure 335: Showing Static Interfaces Assigned to an IPv6 Multicast Service To display information about all IPv6 multicast groups, MLD Snooping or multicast routing must first be enabled on the switch.
Page 501: Showing Mld Snooping Groups And Source List
Chapter 16 | Multicast Filtering MLD Snooping (Snooping and Query for IPv6) Showing MLD Use the Multicast > MLD Snooping > Group Information page to display known multicast groups, member ports, the means by which each group was learned, and Snooping Groups the corresponding source list.
Page 502: Multicast Vlan Registration
Chapter 16 | Multicast Filtering Multicast VLAN Registration Figure 337: Showing IPv6 Multicast Services and Corresponding Sources Multicast VLAN Registration Multicast VLAN Registration (MVR) is a protocol that controls access to a single network-wide VLAN most commonly used for transmitting multicast traffic (such as television channels or video-on-demand) across a service provider’s network.
Page 503: Figure 338: Mvr Concept
Chapter 16 | Multicast Filtering Multicast VLAN Registration Figure 338: MVR Concept Multicast Router Satellite Services Service Network Multicast Server Source Layer 2 Switch Port Receiver Ports Set-top Box Set-top Box Command Usage ◆ General Configuration Guidelines for MVR: Enable MVR globally on the switch, select the MVR VLAN, and add the multicast groups that will stream traffic to attached hosts (see “Configuring MVR Domain Settings”...
Page 504: Configuring Mvr Global Settings
Chapter 16 | Multicast Filtering Multicast VLAN Registration Configuring MVR Use the Multicast > MVR (Configure Global) page to configure proxy switching and the robustness variable. Global Settings Parameters These parameters are displayed: ◆ Proxy Switching – Configures MVR proxy switching, where the source port acts as a host, and the receiver port acts as an MVR router with querier service enabled.
Page 505: Figure 339: Configuring Global Settings For Mvr
Chapter 16 | Multicast Filtering Multicast VLAN Registration ◆ Proxy Query Interval – Configures the interval at which the receiver port sends out general queries. (Range: 2-31744 seconds; Default: 125 seconds) This parameter sets the general query interval at which active receiver ■...
Page 506: Configuring Mvr Domain Settings
Chapter 16 | Multicast Filtering Multicast VLAN Registration Configuring MVR Use the Multicast > MVR (Configure Domain) page to enable MVR globally on the switch, select the VLAN that will serve as the sole channel for common multicast Domain Settings streams supported by the service provider.
Page 507: Configuring Mvr Group Address Profiles
Chapter 16 | Multicast Filtering Multicast VLAN Registration Figure 340: Configuring Domain Settings for MVR Configuring MVR Use the Multicast > MVR (Configure Profile and Associate Profile) pages to assign Group Address the multicast group address for required services to one or more MVR domains. Profiles Command Usage ◆...
Page 508: Figure 341: Configuring An Mvr Group Address Profile
Chapter 16 | Multicast Filtering Multicast VLAN Registration ◆ Profile Name – The name of a profile to be assigned to this domain. (Range: 1-21 characters) Web Interface To configure an MVR group address profile: Click Multicast, MVR. Select Configure Profile from the Step list. Select Add from the Action list.
Page 509: Figure 343: Assigning An Mvr Group Address Profile To A Domain
Chapter 16 | Multicast Filtering Multicast VLAN Registration To assign an MVR group address profile to a domain: Click Multicast, MVR. Select Associate Profile from the Step list. Select Add from the Action list. Select a domain from the scroll-down list, and enter the name of a group profile.
Page 510: Configuring Mvr Interface Status
Chapter 16 | Multicast Filtering Multicast VLAN Registration Configuring MVR Use the Multicast > MVR (Configure Interface) page to configure each interface that participates in the MVR protocol as a source port or receiver port. If you are sure Interface Status that only one subscriber attached to an interface is receiving multicast services, you can enable the immediate leave function.
Page 511 Chapter 16 | Multicast Filtering Multicast VLAN Registration Source – An uplink port that can send and receive multicast data for the ■ groups assigned to the MVR VLAN. Note that the source port must be manually configured as a member of the MVR VLAN (see “Adding Static Members to VLANs”...
Page 512: Assigning Static Mvr Multicast Groups To Interfaces
Chapter 16 | Multicast Filtering Multicast VLAN Registration Figure 345: Configuring Interface Settings for MVR Assigning Static MVR Use the Multicast > MVR (Configure Static Group Member) page to statically bind Multicast Groups to multicast groups to a port which will receive long-term multicast streams associated with a stable set of hosts.
Page 513: Figure 346: Assigning Static Mvr Groups To A Port
Chapter 16 | Multicast Filtering Multicast VLAN Registration Web Interface To assign a static MVR group to a port: Click Multicast, MVR. Select Configure Static Group Member from the Step list. Select Add from the Action list. Select an MVR domain. Select a VLAN and port member to receive the multicast stream, and then enter the multicast group address.
Page 514: Displaying Mvr Receiver Groups
Chapter 16 | Multicast Filtering Multicast VLAN Registration Figure 347: Showing the Static MVR Groups Assigned to a Port Displaying MVR Use the Multicast > MVR (Show Member) page to show the multicast groups either statically or dynamically assigned to the MVR receiver groups on each interface. Receiver Groups Parameters These parameters are displayed:...
Page 515: Displaying Mvr Statistics
Chapter 16 | Multicast Filtering Multicast VLAN Registration Figure 348: Displaying MVR Receiver Groups Displaying MVR Use the Multicast > MVR > Show Statistics pages to display MVR protocol-related statistics for the specified interface. Statistics Parameters These parameters are displayed: ◆...
Page 516 Chapter 16 | Multicast Filtering Multicast VLAN Registration VLAN, Port, and Trunk Statistics Input Statistics ◆ Report – The number of IGMP membership reports received on this interface. ◆ Leave – The number of leave messages received on this interface. ◆...
Page 517: Figure 349: Displaying Mvr Statistics - Query
Chapter 16 | Multicast Filtering Multicast VLAN Registration Web Interface To display statistics for MVR query-related messages: Click Multicast, MVR. Select Show Statistics from the Step list. Select Show Query Statistics from the Action list. Select an MVR domain. Figure 349: Displaying MVR Statistics – Query –...
Page 518: Figure 350: Displaying Mvr Statistics - Vlan
Chapter 16 | Multicast Filtering Multicast VLAN Registration To display MVR protocol-related statistics for a VLAN: Click Multicast, MVR. Select Show Statistics from the Step list. Select Show VLAN Statistics from the Action list. Select an MVR domain. Select a VLAN. Figure 350: Displaying MVR Statistics –...
Page 519: Figure 351: Displaying Mvr Statistics - Port
Chapter 16 | Multicast Filtering Multicast VLAN Registration To display MVR protocol-related statistics for a port: Click Multicast, MVR. Select Show Statistics from the Step list. Select Show Port Statistics from the Action list. Select an MVR domain. Select a Port. Figure 351: Displaying MVR Statistics –...
Page 520 Chapter 16 | Multicast Filtering Multicast VLAN Registration – 520 –...
Page 521: Appendices
Section III Appendices This section provides additional information and includes these items: ◆ “Software Specifications” on page 523 ◆ “Troubleshooting” on page 527 ◆ “License Information” on page 529 – 521 –...
Page 522 Section III | Appendices – 522 –...
Page 523: A Software Specifications
Software Specifications Software Features Management Local, RADIUS, TACACS+, Port Authentication (802.1X), HTTPS, SSH, Port Security, IP Filter, DHCP Snooping Authentication Client Access Control Access Control Lists (512 rules), Port Authentication (802.1X), MAC Authentication, Port Security, DHCP Snooping, IP Source Guard Port Configuration 1000BASE-T: 10/100 Mbps at half/full duplex, 1000 Mbps at full duplex 1000BASE-SX/LX/LH - 1000 Mbps at full duplex (SFP)
Page 524: Management Features
Appendix A | Software Specifications Management Features VLAN Support Up to 256 groups; port-based, protocol-based, tagged (802.1Q), private VLANs, voice VLANs, IP subnet, MAC-based, GVRP for automatic VLAN learning Class of Service Supports four levels of priority Strict, Shaped Deficit Weighted Round Robin, or strict-WRR queuing Layer 3/4 priority mapping: IP DSCP Quality of Service DiffServ (IPv4/v6) supports class maps, policy maps, and service policies...
Page 525: Standards
Appendix A | Software Specifications Standards Standards IEEE 802.1AB Link Layer Discovery Protocol IEEE 802.1D-2004 Spanning Tree Algorithm and traffic priorities Spanning Tree Protocol Rapid Spanning Tree Protocol Multiple Spanning Tree Protocol IEEE 802.1p Priority tags IEEE 802.1Q VLAN IEEE 802.1v Protocol-based VLANs IEEE 802.1X Port Authentication IEEE 802.3-2005 Ethernet, Fast Ethernet, Gigabit Ethernet...
Page 526 Appendix A | Software Specifications Management Information Bases Extensible SNMP Agents MIB (RFC 2742) Forwarding Table MIB (RFC 2096) IGMP MIB (RFC 2933) Interface Group MIB (RFC 2233) Interfaces Evolution MIB (RFC 2863) IP Multicasting related MIBs IPV6-MIB (RFC 2065) IPV6-ICMP-MIB (RFC 2066) IPV6-TCP-MIB (RFC 2052) IPV6-UDP-MIB (RFC2054)
Page 527: B Troubleshooting
Troubleshooting Problems Accessing the Management Interface Table 36: Troubleshooting Chart Symptom Action ◆ Cannot connect using Be sure the switch is powered up. Telnet, web browser, or ◆ Check network cabling between the management station and the SNMP software switch. ◆...
Page 528: Using System Logs
Appendix B | Troubleshooting Using System Logs Using System Logs If a fault does occur, refer to the Installation Guide to ensure that the problem you encountered is actually caused by the switch. If the problem appears to be caused by the switch, follow these steps: Enable logging.
Page 529: C License Information
License Information This product includes copyrighted third-party software subject to the terms of the GNU General Public License (GPL), GNU Lesser General Public License (LGPL), or other related free software licenses. The GPL code used in this product is distributed WITHOUT ANY WARRANTY and is subject to the copyrights of one or more authors.
Page 530 Appendix C | License Information The GNU General Public License GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program"...
Page 531 Appendix C | License Information The GNU General Public License Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange;...
Page 532 Appendix C | License Information The GNU General Public License If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded.
Page 533: Glossary
Glossary Access Control List. ACLs can limit network traffic and restrict access to certain users or devices by checking each packet for certain IP or MAC (i.e., Layer 2) information. Address Resolution Protocol converts between IP addresses and MAC (hardware) addresses. ARP is used to locate the MAC address corresponding to a given IP address.
Page 534 Glossary Domain Name Service. A system used for translating host names for network nodes into IP addresses. DSCP Differentiated Services Code Point Service. DSCP uses a six-bit tag to provide for up to 64 different forwarding behaviors. Based on network policies, different kinds of traffic can be marked for different kinds of forwarding.
Page 535 Glossary IEEE 802.1D Specifies a general method for the operation of MAC bridges, including the Spanning Tree Protocol. IEEE 802.1Q VLAN Tagging—Defines Ethernet frame tags which carry VLAN information. It allows switches to assign endstations to different virtual LANs, and defines a standard way for VLANs to communicate across switched networks.
Page 536 Glossary IGMP Snooping Listening to IGMP Query and IGMP Report packets transferred between IP Multicast Routers and IP Multicast host groups to identify IP Multicast group members. In-Band Management Management of the network from a station attached directly to the network. IP Multicast Filtering A process whereby this switch can pass multicast traffic along to participating hosts.
Page 537 Glossary Multicast Router Discovery is a A protocol used by IGMP snooping and multicast routing devices to discover which interfaces are attached to multicast routers. This process allows IGMP-enabled devices to determine where to send multicast source and group membership messages. Multicast Switching A process whereby the switch filters incoming multicast frames for services for which no attached host has registered, or forwards them to all ports contained within the designated...
Page 538 Glossary RADIUS Remote Authentication Dial-in User Service. RA is a logon authentication protocol that DIUS uses software running on a central server to control access to RADIUS-compliant devices on the network. RMON Remote Monitoring. RMON provides comprehensive network monitoring capabilities. It eliminates the polling required in standard SNMP, and can set alarms on a variety of traffic conditions, including specific error types.
Page 539 Glossary TFTP Trivial File Transfer Protocol. A TCP/IP protocol commonly used for software downloads. User Datagram Protocol. UD provides a datagram mode for packet-switched communications. It uses IP as the underlying transport mechanism to provide access to IP- like services. UDP packets are delivered just like IP packets – connection-less datagrams that may be discarded before reaching their targets.
Page 540 Glossary – 540 –...
Page 541: Index
Index Numerics address table 165 address isolation 167 802.1Q tunnel 148 aging time 170 access 153 aging time, displaying 170 configuration, guidelines 151 aging time, setting 170 configuration, limitations 151 movable static 175 description 148 sticky dynamic 175 ethernet type 152 interface configuration 153 ACL 306 mode selection 153...
Page 542 Index guard 192 policy selection 349 ignoring superior BPDUs 191 specifying trusted interfaces 350 selecting protocol based on message format 193 verifying MAC addresses 348 shut down port on receipt 192 VLAN configuration 350 bridge extension capabilities, displaying 69 DHCPv4 snooping broadcast storm, threshold 204 option 82 information, circuit-id 351 Differentiated Code Point Service See DSCP...
Page 543 Index DSA encryption 286 HTTPS, secure server 279 DSCP 220 enabling 220 mapping to internal values 221 IEEE 802.1D 179 DSCP ingress map, drop precedence 222 IEEE 802.1s 179 DSCP to PHB/drop precedence 222 IEEE 802.1w 179 dynamic addresses IEEE 802.1X 323 clearing 172 IGMP displaying 171...
Page 544 Index version exclusive 472 version for interface, setting 481 LACP version, setting 472 configuration 118 with proxy reporting 469 group attributes, configuring 121 immediate leave, IGMP snooping 479 group members, configuring 119 immediate leave, MLD snooping 496 local parameters 124 importing user public keys 288 partner parameters 126 ingress filtering 141...
Page 545 Index RADIUS client 253 multicast filtering 467 RADIUS server 253 enabling IGMP snooping 470 sequence 251 enabling IGMP snooping per interface 478 settings 252 enabling MLD snooping 494 TACACS+ client 252 router configuration 473 TACACS+ server 252 multicast groups 477 logon authentication, settings 254 displaying 477 loopback detection, STA 182...
Page 546 Index proxy reporting, IGMP snooping 480 public key 282 passwords PVID, port native VLAN 141 administrator setting 265 path cost 195 method 185 STA 191 QinQ Tunneling See 802.1Q tunnel peak burst size, QoS policy 237 QoS 227 peak information rate, QoS policy 237 configuration guidelines 228 per-hop behavior, DSCP ingress map 222 configuring 227...
Page 547 Index RSA encryption 286 detecting loopbacks 182 RSTP 179 edge port 192 global settings, configuring 183 forward delay 186 global settings, displaying 189 global settings, configuring 183 interface settings, configuring 190 global settings, displaying 189 interface settings, displaying 194 hello time 185 interface settings, configuring 190 interface settings, displaying 194 link type 191...
Page 548 Index time zone, setting 85 displaying port members by VLAN index 143 time, setting 79 dynamic assignment 274 TPID 152 egress mode 141 traffic segmentation 128 ingress filtering 141 assigning ports 128 interface configuration 140 enabling 128 IP subnet-based 158 sessions, assigning ports 130 MAC-based 160 sessions, creating 129...
Page 550 ECS4210-12P 149100000219A ECS4210-12T 149100000241A ECS4210-28P 149100000217H ECS4210-28T 149100000217H E032014/ST-R03...

This manual is also suitable for:

Ecs4210-12t Ecs4210-28p Ecs4210-28t

Edge-Core ECS4210-12P Web Management Manual

How to Use this Guide

Contents

Figures

Tables

Section I

Getting Started

1 Introduction

2 Using the Web Interface

Web Configuration

3 Basic Management Tasks

4 Interface Configuration

5 VLAN Configuration

6 Address Table Settings

7 Spanning Tree Algorithm Overview

8 Congestion Control

9 Class of Service

10 Quality of Service

11 Voip Traffic Configuration

12 Security Measures

Quick Links

Related Manuals for Edge-Core ECS4210-12P

Summary of Contents for Edge-Core ECS4210-12P