Page 1 Lenovo RackSwitch G8264CS Application Guide For Lenovo Enterprise Network Operating System 8.4...
Page 2 Note: Before using this information and the product it supports, read the general information in the Safety information and Environmental Notices and User Guide documents on the Lenovo Documentation CD and the Warranty Information document that comes with the product. First Edition (September 2016) © Copyright Lenovo 2017 Portions © Copyright IBM Corporation 2014. LIMITED AND RESTRICTED RIGHTS NOTICE: If data or software is delivered pursuant a General Services Administration “GSA” contract, use, reproduction, or disclosure is subject to restrictions set forth in Contract No. GS‐35F‐05925. Lenovo and the Lenovo logo are trademarks of Lenovo in the United States, other countries, or both.
Page 3: Table Of Contents
Configuring Strict Mode . . . . . . . . . . . . . . . . . . . . . . .57 Configuring No‐Prompt Mode . . . . . . . . . . . . . . . . . . . .57 SSL/TLS Version Limitation . . . . . . . . . . . . . . . . . . . . .57 Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . .57 Chapter 2. Initial Setup ..... . 59 Information Needed for Setup . . . . . . . . . . . . . . . . . . . . . .60 © Copyright Lenovo 2017...
Page 4 Default Setup Options . . . . . . . . . . . . . . . . . . . . . . . . . 61 Stopping and Restarting Setup Manually . . . . . . . . . . . . . . . . . 62 Stopping Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Restarting Setup . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Setup Part 1: Basic System Configuration . . . . . . . . . . . . . . . . . 63 Setup Part 2: Port Configuration . . . . . . . . . . . . . . . . . . . . . 65 Setup Part 3: VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . 67 Setup Part 4: IP Configuration . . . . . . . . . . . . . . . . . . . . . . 68 IP Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Loopback Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . 69 Using Loopback Interfaces for Source IP Addresses . . . . . . . . . 69 Loopback Interface Limitations . . . . . . . . . . . . . . . . . . 70 Default Gateways . . . . . . . . . . . . . . . . . . . . . . . . . . 70 IP Routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 Setup Part 5: Final Steps . . . . . . . . . . . . . . . . . . . . . . . . . 72 Optional Setup for Telnet Support . . . . . . . . . . . . . . . . . . . . 73 Chapter 3.
Page 5 Chapter 7. Access Control Lists ....117 Summary of Packet Classifiers . . . . . . . . . . . . . . . . . . . . . 118 Summary of ACL Actions . . . . . . . . . . . . . . . . . . . . . . . 119 Assigning Individual ACLs to a Port . . . . . . . . . . . . . . . . . . 120 ACL Order of Precedence . . . . . . . . . . . . . . . . . . . . . . . 120 ACL Metering and Re‐Marking . . . . . . . . . . . . . . . . . . . . . 120 Metering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 Re‐Marking . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 © Copyright Lenovo 2017 Contents...
Page 6 ACL Port Mirroring. . . . . . . . . . . . . . . . . . . . . . . . . . 122 Viewing ACL Statistics . . . . . . . . . . . . . . . . . . . . . . . . 122 ACL Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Enabling ACL Logging . . . . . . . . . . . . . . . . . . . . . . 123 Logged Information . . . . . . . . . . . . . . . . . . . . . . . . 123 Rate Limiting Behavior . . . . . . . . . . . . . . . . . . . . . . 124 Log Interval . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 ACL Logging Limitations . . . . . . . . . . . . . . . . . . . . . 124 ACL Configuration Examples . . . . . . . . . . . . . . . . . . . . . 125 ACL Example 1 . . . . . . . . . . . . . . . . . . . . . . . . . . 125 ACL Example 2 . . . . . . . . . . . . . . . . . . . . . . . . . . 125 ACL Example 3 . . . . . . . . . . . . . . . . . . . . . . . . . . 126 ACL Example 4 . . . . . . . . . . . . . . . . . . . . . . . . . . 126 ACL Example 5 . . . . . . . . . . . . . . . . . . . . . . . . . . 126 ACL Example 6 . . . . . . . . . . . . . . . . . . . . . . . . . . 127 VLAN Maps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...
Page 7 MSTP Configuration Guidelines . . . . . . . . . . . . . . . . . . 182 MSTP Configuration Examples . . . . . . . . . . . . . . . . . . . 182 MSTP Example 1 . . . . . . . . . . . . . . . . . . . . . . . 182 MSTP Example 2 . . . . . . . . . . . . . . . . . . . . . . . 183 Port Type and Link Type . . . . . . . . . . . . . . . . . . . . . . . 185 Edge/Portfast Port. . . . . . . . . . . . . . . . . . . . . . . . . 185 Link Type . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185 Chapter 11. Virtual Link Aggregation Groups ... . 187 VLAG Capacities . . . . . . . . . . . . . . . . . . . . . . . . . . . 190 VLAGs versus Port LAGs . . . . . . . . . . . . . . . . . . . . . . . 190 © Copyright Lenovo 2017 Contents...
Page 8 Configuring VLAGs . . . . . . . . . . . . . . . . . . . . . . . . . 192 Basic VLAG Configuration . . . . . . . . . . . . . . . . . . . . . 193 Configuring the ISL . . . . . . . . . . . . . . . . . . . . . . 193 Configuring the VLAG. . . . . . . . . . . . . . . . . . . . . 194 VLAG Configuration ‐ VLANs Mapped to MSTI . . . . . . . . . 196 VLAGs with VRRP . . . . . . . . . . . . . . . . . . . . . . . . 200 Task 1: Configure VLAG Peer 1 . . . . . . . . . . . . . . . . . 200 Task 2: Configure VLAG Peer 2 . . . . . . . . . . . . . . . . . 203 Two‐tier vLAGs with VRRP . . . . . . . . . . . . . . . . . . . . 206 vLAG Peer Gateway . . . . . . . . . . . . . . . . . . . . . . . 207 Configuring VLAGs in Multiple Layers . . . . . . . . . . . . . . . 207 Task 1: Configure Layer 2/3 border switches. . . . . . . . . . . . 208 Task 2: Configure switches in the Layer 2 region. . . . . . . . . . 208 VLAG with PIM . . . . . . . . . . . . . . . . . . . . . . . . . . . 210 Traffic Forwarding . . . . . . . . . . . . . . . . . . . . . . . . 210 Health Check. . . . . . . . . . . . . . . . . . . . . . . . . . . ...
Page 9 Master Recovery . . . . . . . . . . . . . . . . . . . . . . . 256 No Backup . . . . . . . . . . . . . . . . . . . . . . . . . . 257 Stack Member Identification . . . . . . . . . . . . . . . . . . . . 257 Configuring a Stack . . . . . . . . . . . . . . . . . . . . . . . . . . 258 Configuration Overview . . . . . . . . . . . . . . . . . . . . . . 258 Best Configuration Practices . . . . . . . . . . . . . . . . . . . . 258 Stacking VLANs. . . . . . . . . . . . . . . . . . . . . . . . 259 Configuring Each Switch for the Stack . . . . . . . . . . . . . . . . 259 Additional Master Configuration . . . . . . . . . . . . . . . . . . 261 Viewing Stack Connections . . . . . . . . . . . . . . . . . . . 261 Binding Members to the Stack . . . . . . . . . . . . . . . . . . 262 Assigning a Stack Backup Switch . . . . . . . . . . . . . . . . 262 Managing the Stack . . . . . . . . . . . . . . . . . . . . . . . . . . 263 Accessing the Master Switch CLI . . . . . . . . . . . . . . . . . . 263 Rebooting Stacked Switches via the Master . . . . . . . . . . . . . . 263 Upgrading Software in an Existing Stack. . . . . . . . . . . . . . . . . 265 Replacing or Removing Stacked Switches . . . . . . . . . . . . . . . . 267 Removing a Switch from the Stack. . . . . . . . . . . . . . . . . . 267 Installing the New Switch or Healing the Topology . . . . . . . . . . 267 Binding the New Switch to the Stack. . . . . . . . . . . . . . . . . 269 Performing a Rolling Reload or Upgrade . . . . . . . . . . . . . . . 269 Starting a Rolling Reload . . . . . . . . . . . . . . . . . . . . 269 Starting a Rolling Upgrade . . . . . . . . . . . . . . . . . . . 270 Saving Syslog Messages . . . . . . . . . . . . . . . . . . . . . . . . 271 © Copyright Lenovo 2017 Contents...
Page 10 ISCLI Stacking Commands . . . . . . . . . . . . . . . . . . . . . . 273 Chapter 16. VMready ..... . 275 VE Capacity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276 Defining Server Ports . . . . . . . . . . . . . . . . . . . . . . . . . 276 VM Group Types . . . . . . . . . . . . . . . . . . . . . . . . . . . 276 Local VM Groups . . . . . . . . . . . . . . . . . . . . . . . . . . 277 Distributed VM Groups . . . . . . . . . . . . . . . . . . . . . . . . ...
Page 11 Chapter 18. Fibre Channel ....327 Ethernet vs. Fibre Channel . . . . . . . . . . . . . . . . . . . . . . . 328 Supported Switch Roles . . . . . . . . . . . . . . . . . . . . . . . . 329 FCoE Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . 329 NPV Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . 329 Full‐Fabric FC/FCoE Switch . . . . . . . . . . . . . . . . . . . . 329 Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . 330 © Copyright Lenovo 2017 Contents...
Page 12 Implementing Fibre Channel. . . . . . . . . . . . . . . . . . . . . . 331 Port Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . 331 Fibre Channel VLANs . . . . . . . . . . . . . . . . . . . . . . . 332 Port Membership . . . . . . . . . . . . . . . . . . . . . . . . . 332 Switching Mode . . . . . . . . . . . . . . . . . . . . . . . . . 333 NPV Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . 333 NPV Port Traffic Mapping . . . . . . . . . . . . . . . . . . . 333 NPV Manual Disruptive Load‐Balancing . . . . . . . . . . . . . 334 Full Fabric Zoning . . . . . . . . . . . . . . . . . . . . . . . . 334 Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335 Zonesets . . . . . . . . . . . . . . . . . . . . . . . . . . . 336 Defining Zoning . . . . . . . . . . . . . . . . . . . . . . . 336 Activating a Zoneset . . . . . . . . . . . . . . . . . . . . . . 338 E_Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . 338 Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . 339 Optimized FCoE Traffic Flow . . . . . . . . . . . . . . . . . . ...
Page 13 Using a Dynamic Key Policy . . . . . . . . . . . . . . . . . . . . 400 Chapter 25. Routing Information Protocol ....401 Distance Vector Protocol . . . . . . . . . . . . . . . . . . . . . . . . 402 Stability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 402 Routing Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . 402 RIPv1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 403 RIPv2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 403 RIPv2 in RIPv1 Compatibility Mode. . . . . . . . . . . . . . . . . . . 403 RIP Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404 RIP Configuration Example . . . . . . . . . . . . . . . . . . . . . . 405 © Copyright Lenovo 2017 Contents...
Page 14 Chapter 26. Internet Group Management Protocol ..407 IGMP Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 408 How IGMP Works . . . . . . . . . . . . . . . . . . . . . . . . . . 409 IGMP Capacity and Default Values . . . . . . . . . . . . . . . . . . . 410 IGMP Snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . 412 IGMP Querier . . . . . . . . . . . . . . . . . . . . . . . . . . 412 Querier Election . . . . . . . . . . . . . . . . . . . . . . . . . 412 IGMP Groups . . . . . . . . . . . . . . . . . . . . . . . . . . 413 IGMPv3 Snooping . . . . . . . . . . . . . . . . . . . . . . . . 413 IGMP Snooping Configuration Guidelines . . . . . . . . . . . . . . 415 IGMP Snooping Configuration Example . . . . . . . . . . . . . . . 416 Advanced Configuration Example: IGMP Snooping . . . . . . . . . . ...
Page 15 The Shortest Path First Tree . . . . . . . . . . . . . . . . . . . . 472 Internal Versus External Routing . . . . . . . . . . . . . . . . . . 472 OSPFv2 Implementation in Enterprise NOS . . . . . . . . . . . . . . . 473 Configurable Parameters . . . . . . . . . . . . . . . . . . . . . . 473 Defining Areas . . . . . . . . . . . . . . . . . . . . . . . . . . 474 Assigning the Area Index . . . . . . . . . . . . . . . . . . . . 474 Using the Area ID to Assign the OSPF Area Number . . . . . . . . 475 Attaching an Area to a Network . . . . . . . . . . . . . . . . . 475 Interface Cost . . . . . . . . . . . . . . . . . . . . . . . . . . . 476 Electing the Designated Router and Backup . . . . . . . . . . . . . 476 Summarizing Routes . . . . . . . . . . . . . . . . . . . . . . . 476 Default Routes . . . . . . . . . . . . . . . . . . . . . . . . . . 477 Virtual Links . . . . . . . . . . . . . . . . . . . . . . . . . . . 477 Router ID . . . . . . . . . . . . . . . . . . . . . . . . . . . . 478 Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . 479 Configuring Plain Text OSPF Passwords . . . . . . . . . . . . . 480 Configuring MD5 Authentication . . . . . . . . . . . . . . . . 480 Host Routes for Load Balancing . . . . . . . . . . . . . . . . . . . 481 Loopback Interfaces in OSPF . . . . . . . . . . . . . . . . . . . . 482 OSPF Features Not Supported in This Release. . . . . . . . . . . . . 482 © Copyright Lenovo 2017 Contents...
Page 16 OSPFv2 Configuration Examples . . . . . . . . . . . . . . . . . . . . 483 Example 1: Simple OSPF Domain . . . . . . . . . . . . . . . . . . 484 Example 2: Virtual Links . . . . . . . . . . . . . . . . . . . . . . 486 Configuring OSPF for a Virtual Link on Switch #1 . . . . . . . . . 486 Configuring OSPF for a Virtual Link on Switch #2 . . . . . . . . . 487 Other Virtual Link Options . . . . . . . . . . . . . . . . . . . 489 Example 3: Summarizing Routes . . . . . . . . . . . . . . . . . . 490 Verifying OSPF Configuration . . . . . . . . . . . . . . . . . . . 491 OSPFv3 Implementation in Enterprise NOS . . . . . . . . . . . . . . . 492 OSPFv3 Differences from OSPFv2. . . . . . . . . . . . . . . . . . 492 OSPFv3 Requires IPv6 Interfaces . . . . . . . . . . . . . . . . 492 OSPFv3 Uses Independent Command Paths . . . . . . . . . . . 492 OSPFv3 Identifies Neighbors by Router ID . . . . . . . . . . . . 493 Other Internal Improvements . . . . . . . . . . . . . . . . . . 493 OSPFv3 Limitations . . . . . . . . . . . . . . . . . . . . . . . . 493 OSPFv3 Configuration Example . . . . . . . . . . . . . . . . . . ...
Page 17 Chapter 34. Link Layer Discovery Protocol ... . . 537 LLDP Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 538 Enabling or Disabling LLDP . . . . . . . . . . . . . . . . . . . . . . 539 Global LLDP Setting . . . . . . . . . . . . . . . . . . . . . . . . 539 Transmit and Receive Control . . . . . . . . . . . . . . . . . . . 539 LLDP Transmit Features . . . . . . . . . . . . . . . . . . . . . . . . 540 Scheduled Interval . . . . . . . . . . . . . . . . . . . . . . . . 540 Minimum Interval. . . . . . . . . . . . . . . . . . . . . . . . . 540 Time‐to‐Live for Transmitted Information . . . . . . . . . . . . . . 541 Trap Notifications . . . . . . . . . . . . . . . . . . . . . . . . . 541 Changing the LLDP Transmit State . . . . . . . . . . . . . . . . . 542 Types of Information Transmitted . . . . . . . . . . . . . . . . . . 542 © Copyright Lenovo 2017 Contents...
Page 18 LLDP Receive Features . . . . . . . . . . . . . . . . . . . . . . . . 544 Types of Information Received . . . . . . . . . . . . . . . . . . . 544 Viewing Remote Device Information . . . . . . . . . . . . . . . . 544 Time‐to‐Live for Received Information . . . . . . . . . . . . . . . 546 LLDP Example Configuration . . . . . . . . . . . . . . . . . . . . . 548 Chapter 35. Simple Network Management Protocol..549 SNMP Version 1 & Version 2. . . . . . . . . . . . . . . . . . . . . . 549 SNMP Version 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . 550 Default Configuration . . . . . . . . . . . . . . . . . . . . . . . 550 User Configuration Example . . . . . . . . . . . . . . . . . . . . 551 Configuring SNMP Trap Hosts . . . . . . . . . . . . . . . . . . . . . 552 SNMPv1 Trap Host . . . . . . . . . . . . . . . . . . . . . . . . ...
Page 19 People’s Republic of China Class A electronic emission statement . . . . . . 627 Taiwan Class A compliance statement . . . . . . . . . . . . . . . . . . 628 Index ......629 © Copyright Lenovo 2017 Contents...
Page 20 G8264CS Application Guide for ENOS 8.4...
Page 21: Preface
Preface This Application Guide describes how to configure and use the Lenovo Enterprise Network Operating System 8.4 software on the RackSwitch G8264CS (referred to as G8264CS throughout this document). For documentation on installing the switch physically, see the Installation Guide for your G8264CS. © Copyright Lenovo 2017...
Page 22: Who Should Use This Guide
Who Should Use This Guide This guide is intended for network installers and system administrators engaged in configuring and maintaining a network. The administrator should be familiar with Ethernet concepts, IP addressing, Spanning Tree Protocol, and SNMP configuration parameters. G8264CS Application Guide for ENOS 8.4...
Page 23: What You'll Find In This Guide
5, “Authentication & Authorization Protocols,” describes different secure administration for remote administrators. This includes using Remote Authentication Dial‐in User Service (RADIUS), as well as TACACS+ and LDAP.  Chapter 6, “802.1X Port‐Based Network Access Control,” describes how to authenticate devices attached to a LAN port that has point‐to‐point connection characteristics. This feature prevents access to ports that fail authentication and authorization and provides security to ports of the G8264CS that connect to blade servers.  Chapter 7, “Access Control Lists,” describes how to use filters to permit or deny specific types of traffic, based on a variety of source, destination, and packet attributes.  Chapter 37, “Secure Input/Output Module,” describes which protocols can be enabled. This feature allows secured traffic and secured authentication management. Part 3: Switch Basics Chapter 8, “VLANs,” describes how to configure Virtual Local Area Networks  (VLANs) for creating separate network segments, including how to use VLAN tagging for devices that use multiple VLANs. This chapter also describes Protocol‐based VLANs, and Private VLANs.  Chapter 9, “Ports and Link Aggregation,” describes how to group multiple physical ports together to aggregate the bandwidth between large‐scale network devices. © Copyright Lenovo 2017 Preface...
Page 24  Chapter 11, “Virtual Link Aggregation Groups,” describes using Virtual Link Aggregation Groups (VLAGs) to form LAGs spanning multiple VLAG‐capable aggregator switches.  Chapter 10, “Spanning Tree Protocols,” discusses how Spanning Tree Protocol (STP) configures the network so that the switch selects the most efficient path when multiple paths exist. Covers Rapid Spanning Tree Protocol (RSTP), Per‐VLAN Rapid Spanning Tree (PVRST), and Multiple Spanning Tree Protocol (MSTP).  Chapter 12, “Quality of Service,” discusses Quality of Service (QoS) features, including IP filtering using Access Control Lists (ACLs), Differentiated Services, and IEEE 802.1p priority values. Part 4: Advanced Switching Features  Chapter 13, “Virtualization,” provides an overview of allocating resources based on the logical needs of the data center, rather than on the strict, physical nature of components.  Chapter 14, “Virtual NICs,” discusses using virtual NIC (vNIC) technology to divide NICs into multiple logical, independent instances.  Chapter 16, “VMready,” discusses virtual machine (VM) support on the G8264CS.  Chapter 17, “FCoE and CEE,” discusses using various Converged Enhanced Ethernet (CEE) features such as Priority‐based Flow Control (PFC), Enhanced Transmission Selection (ETS), and FIP Snooping for solutions such as Fibre Channel over Ethernet (FCoE).
Page 25 Part 6: High Availability Fundamentals  Chapter 31, “Basic Redundancy,” describes how the G8264CS supports redundancy through LAGs and hotlinks.  Chapter 32, “Layer 2 Failover,” describes how the G8264CS supports high‐availability network topologies using Layer 2 Failover.  Chapter 33, “Virtual Router Redundancy Protocol,” describes how the G8264CS supports high‐availability network topologies using Virtual Router Redundancy Protocol (VRRP). Part 7: Network Management  Chapter 34, “Link Layer Discovery Protocol,” describes how Link Layer Discovery Protocol helps neighboring network devices learn about each others’ ports and capabilities.  Chapter 35, “Simple Network Management Protocol,” describes how to configure the switch for management through an SNMP client.  Chapter 36, “Service Location Protocol,” describes the Service Location Protocol (SLP) that allows the switch to provide dynamic directory services. © Copyright Lenovo 2017 Preface...
Page 26 Part 8: Monitoring Chapter 38, “Remote Monitoring,” describes how to configure the RMON agent  on the switch, so that the switch can exchange network monitoring data.  Chapter 39, “sFlow, described how to use the embedded sFlow agent for sampling network traffic and providing continuous monitoring information to a central sFlow analyzer. Chapter 40, “Port Mirroring,” discusses tools how copy selected port traffic to a  monitor port for network analysis. Part 9: Appendices Appendix A, “Glossary,” describes common terms and concepts used  throughout this guide.  Appendix C, “Getting help and technical assistance,” provides details on where to go for additional information about Lenovo and Lenovo products.  Appendix D, “Notices,” contains safety and environmental notices. G8264CS Application Guide for ENOS 8.4...
Page 27: Additional References
Additional References Additional information about installing and configuring the G8264CS is available in the following guides:  RackSwitch G8264CS Installation Guide Lenovo RackSwitch G8264CS ISCLI Command Reference for Lenovo Enterprise  Network Operating System 8.4  Lenovo RackSwitch G8264CS Release Notes for Lenovo Enterprise Network Operating System 8.4 © Copyright Lenovo 2017 Preface...
Page 28: Typographic Conventions
Typographic Conventions The following table describes the typographic styles used in this book. Table 1. Typographic Conventions Typeface or Meaning Example Symbol ABC123 This type is used for names of View the readme.txt file. commands, files, and directories used within the text. Main# It also depicts on‐screen computer output and prompts. ABC123 Main# sys This bold type appears in command examples. It shows text that must be typed in exactly as shown. <ABC123> This italicized type appears in To establish a Telnet session, command examples as a enter: host# telnet <IP address> parameter placeholder. Replace the indicated text with the appropriate real name or value when using the command. Do not type the brackets. This also shows book titles, ...
Page 30 G8264CS Application Guide for ENOS 8.4...
Page 31: Chapter 1. Switch Administration
Chapter 1. Switch Administration Your RackSwitch G8264CS (G8264CS) is ready to perform basic switching functions right out of the box. Some of the more advanced features, however, require some administrative configuration before they can be used effectively. The extensive Lenovo Enterprise Network Operating System switching software included in the G8264CS provides a variety of options for accessing the switch to perform configuration, and to view switch information and statistics. This chapter discusses the various methods that can be used to administer the switch. © Copyright Lenovo 2017...
Page 32: Administration Interfaces
Administration Interfaces Enterprise NOS provides a variety of user‐interfaces for administration. These interfaces vary in character and in the methods used to access them: some are text‐based, and some are graphical; some are available by default, and some require configuration; some can be accessed by local connection to the switch, and others are accessed remotely using various client applications. For example, administration can be performed using any of the following:  A built‐in, text‐based command‐line interface and menu system for access via serial‐port connection or an optional Telnet or SSH session  The built‐in Browser‐Based Interface (BBI) available using a standard web‐browser  SNMP support for access through network management software such as IBM Director or HP OpenView The specific interface chosen for an administrative session depends on user preferences, as well as the switch configuration and the available client tools. In all cases, administration requires that the switch hardware is properly installed and turned on. (see the RackSwitch G8264CS Installation Guide). Command Line Interface The Industry Standard Command Line Interface (ISCLI) provides a simple, direct method for switch administration. Using a basic terminal, you can issue commands that allow you to view detailed information and statistics about the switch, and to perform any necessary configuration and switch software maintenance. You can establish a connection to the ISCLI in any of the following ways: Serial connection via the serial port on the G8264CS (this option is always avail‐  able)  Telnet connection over the network  SSH connection over the network G8264CS Application Guide for ENOS 8.4...
Page 33: Establishing A Connection
RS 8264CS(config-ip-if)# ip netmask <IPv4 subnet mask> RS 8264CS(config-ip-if)# enable RS 8264CS(config-ip-if)# exit 4. Configure the appropriate default gateway. IP gateway 4 is required for IF 128. RS 8264CS(config)# ip gateway 4 address <default gateway IPv4 address> RS 8264CS(config)# ip gateway 4 enable Once you configure a management IP address for your switch, you can connect to a management port and use the Telnet program from an external management station to access and control the switch. The management port provides out‐of‐band management. © Copyright Lenovo 2017 Chapter 1: Switch Administration...
Page 34: Using The Switch Data Ports
Using the Switch Data Ports You also can configure in‐band management through any of the switch data ports. To allow in‐band management, use the following procedure: 1. Log on to the switch. 2. Enter IP interface mode. RS 8264CS> enable RS 8264CS# configure terminal RS 8264CS(config)# interface ip <IP interface number> Interface 128 is reserved for out‐of‐band management (see “Using the Note: Switch Management Ports” on page 33). 3. Configure the management IP interface/mask.  IPv4: RS 8264CS(config-ip-if)# ip address <management interface IPv4 address> RS 8264CS(config-ip-if)# ip netmask <IPv4 subnet mask> ...
Page 35: Using Telnet
27. Using Telnet A Telnet connection offers the convenience of accessing the switch from a workstation connected to the network. Telnet access provides the same options for user and administrator access as those available through the console port. By default, Telnet access is enabled. Use the following commands to disable or re‐enable Telnet access: RS 8264CS(config)# [no] access telnet enable Once the switch is configured with an IP address and gateway, you can use Telnet to access switch administration from any workstation connected to the management network. To establish a Telnet connection with the switch, run the Telnet program on your workstation and issue the following Telnet command: telnet <switch IPv4 or IPv6 address> You will then be prompted to enter a password as explained “Switch Login Levels” on page Two attempts are allowed to log in to the switch. After the second unsuccessful attempt, the Telnet client is disconnected via TCP session closure. Using Secure Shell Although a remote network administrator can manage the configuration of a G8264CS via Telnet, this method does not provide a secure connection. The Secure Shell (SSH) protocol enables you to securely log into another device over a network © Copyright Lenovo 2017 Chapter 1: Switch Administration...
Page 36: Using Ssh With Password Authentication
The supported SSH encryption and authentication methods are:  Server Host Authentication: Client RSA‐authenticates the switch when starting each connection  Key Exchange: ecdh‐sha2‐nistp521, ecdh‐sha2‐nistp384, ecdh‐sha2‐nistp256, ecdh‐sha2‐nistp224, ecdh‐sha2‐nistp192, rsa2048‐sha256, rsa1024‐sha1, diffie‐hellman‐group‐exchange‐sha256, diffie‐hellman‐group‐exchange‐sha1, diffie‐hellman‐group14‐sha1, diffie‐hellman‐group1‐sha1  Encryption: aes128‐ctr, aes128‐cbc, rijndael128‐cbc, blowfish‐cbc,3des‐cbc, arcfour256, arcfour128, arcfour  MAC: hmac‐sha1, hmac‐sha1‐96, hmac‐md5, hmac‐md5‐96 User Authentication: Local password authentication, public key authentication,  RADIUS, TACACS+ Lenovo Enterprise Network Operating System implements the SSH version 2.0 standard and is confirmed to work with SSH version 2.0‐compliant clients such as the following:  OpenSSH_5.4p1 for Linux Secure CRT Version 5.0.2 (build 1021)   Putty SSH release 0.60 Using SSH with Password Authentication By default, the SSH feature is disabled. Once the IP parameters are configured and the SSH service is enabled, you can access the command line interface using an SSH connection. To establish an SSH connection with the switch, run the SSH program on your workstation by issuing the SSH command, followed by the switch IPv4 or IPv6 address: # ssh <switch IP address>...
Page 37: Using Ssh With Public Key Authentication
Username of the public key: admin Confirm download operation (y/n) ? y Notes: When prompted to input a username, a valid user account name must be  entered. If no username is entered, the key is stored on the switch, and can be assigned to a user account later.  A user account can have up to 100 public keys set up on the switch. 3. Configure a maximum number of 3 failed public key authentication attempts before the system reverts to password‐based authentication: RS 8264CS(config)# ssh maxauthattempts 3 Once the public key is configured on the switch, the client can use SSH to login from a system where the private key pair is set up: # ssh <switch IP address> © Copyright Lenovo 2017 Chapter 1: Switch Administration...
Page 38: Using A Web Browser
Using a Web Browser The switch provides a Browser‐Based Interface (BBI) for accessing the common configuration, management, and operation features of the G8264CS through your Web browser. By default, BBI access via HTTP is enabled on the switch. You can also access the BBI directly from an open Web browser window. Enter the URL using the IP address of the switch interface (for example, http://<IPv4 or IPv6 address>). Configuring HTTP Access to the BBI By default, BBI access via HTTP is enabled on the switch. To disable or re‐enable HTTP access to the switch BBI, use the following commands: (Enable HTTP access) RS 8264CS(config)# access http enable ‐or‐ (Disable HTTP access) RS 8264CS(config)# no access http enable The default HTTP web server port to access the BBI is port 80. However, you can change the default Web server port with the following command: RS 8264CS(config)# access http port <TCP port number> To access the BBI from a workstation, open a Web browser window and type in the ...
Page 39: Browser-Based Interface Summary
Country Name (2 letter code) [US]: State or Province Name (full name) [CA]: Locality Name (eg, city) [Santa Clara]: Organization Name (eg, company) [Lenovo Networking Operating System]: Organizational Unit Name (eg, section) [Network Engineering]: Common Name (eg, YOUR name) [0.0.0.0]:...
Page 40: Using Simple Network Management Protocol
Using Simple Network Management Protocol ENOS provides Simple Network Management Protocol (SNMP) version 1, version 2, and version 3 support for access through any network management software, such as IBM Director or HP‐OpenView. Note: SNMP read and write functions are enabled by default. For best security practices, if SNMP is not needed for your network, it is recommended that you disable these functions prior to connecting the switch to the network. To access the SNMP agent on the G8264CS, the read and write community strings on the SNMP manager must be configured to match those on the switch. The default read community string on the switch is public and the default write community string is private. The read and write community strings on the switch can be configured using the following commands: RS 8264CS(config)# snmp-server read-community <1‐32 characters> ‐and‐ RS 8264CS(config)# snmp-server write-community <1‐32 characters> The SNMP manager must be able to reach any one of the IP interfaces on the switch. For the SNMP manager to receive the SNMPv1 traps sent out by the SNMP agent on the switch, configure the trap host on the switch with the following commands: RS 8264CS(config)# snmp-server trap-source <trap source IP interface> RS 8264CS(config)# snmp-server host <IPv4 address> <trap host community string> To restrict SNMP access to specific IPv4 subnets, use the following commands: RS 8264CS(config)# access management-network <IPv4 address> <subnet mask> snmp-ro ‐and‐...
Page 41: Bootp/Dhcp Client Ip Address Services
IPv4 address for the client. The switch then forwards this reply back to the client. DHCP is described in RFC 2131, and the DHCP relay agent supported on the G8264CS is described in RFC 1542. DHCP uses UDP as its transport protocol. The client sends messages to the server on port 67 and the server sends messages to the client on port 68. BOOTP and DHCP relay are collectively configured using the BOOTP commands and menus on the G8264CS. DHCP Host Name Configuration The G8264CS supports DHCP host name configuration as described in RFC 2132, option 12. DHCP host name configuration is enabled by default. Host name can be manually configured using the following command: RS 8264CS(config)# hostname <name> If the host name is manually configured, the switch does not replace it with the host name received from the DHCP server. After the host name is configured on the switch, if DHCP or DHCP host name configuration is disabled, the switch retains the host name. The switch prompt displays the host name. Host name configuration can be enabled or disabled using the following command: RS 8264CS(config)# [no] system dhcp hostname © Copyright Lenovo 2017 Chapter 1: Switch Administration...
Page 42: Dhcp Syslog Server
DHCP SYSLOG Server During switch startup, if the switch fails to get the configuration file, a message can be recorded in the SYSLOG server. The G8264CS supports requesting of a SYSLOG server IP address from the DHCP server as described in RFC 2132, option 7. DHCP SYSLOG server request option is enabled by default. Manually configured SYSLOG server takes priority over DHCP SYSLOG server. Up to two SYSLOG server addresses received from the DHCP server can be used. The SYSLOG server can be learnt over a management port or a data port. Use the RS 8264CS# show logging command to view the SYSLOG server address. DHCP SYSLOG server address option can be enabled/disabled using the following command: RS 8264CS(config)# [no] system dhcp syslog Global BOOTP Relay Agent Configuration To enable the G8264CS to be a BOOTP (or DHCP) forwarder, enable the BOOTP relay feature, configure up to four global BOOTP server IPv4 addresses on the switch, and enable BOOTP relay on the interface(s) on which the client requests are expected. Generally, it is best to configure BOOTP for the switch IP interface that is closest to the client, so that the BOOTP server knows from which IPv4 subnet the newly allocated IPv4 address will come. In the G8264CS implementation, there are no primary or secondary BOOTP servers. The client request is forwarded to all the global BOOTP servers configured on the switch (if no domain‐specific servers are configured). The use of multiple servers provides failover redundancy. However, no health checking is supported. 1.
Page 43: Domain-Specific Bootp Relay Agent Configuration
RS 8264CS(config)# ip bootp-relay server <1‐5> address <IP address> DHCP Snooping DHCP snooping provides security by filtering untrusted DHCP packets and by building and maintaining a DHCP snooping binding table. This feature is applicable only to IPv4 and only works in non‐stacking mode. An untrusted interface is a port that is configured to receive packets from outside the network or firewall. A trusted interface receives packets only from within the network. By default, all DHCP ports are untrusted. The DHCP snooping binding table contains the MAC address, IP address, lease time, binding type, VLAN number, and port number that correspond to the local untrusted interface on the switch; it does not contain information regarding hosts interconnected with a trusted interface. By default, DHCP snooping is disabled on all VLANs. You can enable DHCP snooping on one or more VLANs. You must enable DHCP snooping globally. To enable this feature, enter the following commands: RS 8264CS(config)# ip dhcp snooping vlan <vlan number(s)> RS 8264CS(config)# ip dhcp snooping © Copyright Lenovo 2017 Chapter 1: Switch Administration...
Page 44 Following is an example of DHCP snooping configuration, where the DHCP server and client are in VLAN 100, and the server connects using port 24. RS 8264CS(config)# ip dhcp snooping vlan 100 RS 8264CS(config)# ip dhcp snooping RS 8264CS(config)# interface port 24 RS 8264CS(config-if)# ip dhcp snooping trust(Optional; Set port as trusted) RS 8264CS(config-if)# ip dhcp snooping information option-insert (Optional; add DHCP option 82) RS 8264CS(config-if)# ip dhcp snooping limit rate 100 (Optional; Set DHCP packet rate) G8264CS Application Guide for ENOS 8.4...
Page 45: Easy Connect Wizard
The wizard can be canceled anytime by pressing Ctrl+C. Select which of the following features you want enabled: #Configure Basic system (yes/no)? #Configure Transparent mode (yes/no)? #Configure Switch Redundant mode (yes/no)? © Copyright Lenovo 2017 Chapter 1: Switch Administration...
Page 46: Basic System Mode Configuration Example
Basic System Mode Configuration Example This example shows the parameters available for configuration in Basic System mode: RS 8264CS# easyconnect Configure Basic system (yes/no)? y Please enter "none" for no hostname. Enter hostname(Default: None)? host Please enter "dhcp" for dhcp IP. Select management IP address (Current: 10.241.13.32)? Enter management netmask(Current: 255.255.255.128)? Enter management gateway:(Current: 10.241.13.1)? Pending switch port configuration: Hostname: host...
Page 47: Redundant Mode Configuration Example
Select Uplink Ports (Static Defaults: 17-24)? The following Uplink ports will be enabled: Uplink ports(1G/10G): 17-24 Select Downlink Ports (Static Defaults: 25-64)? The following Downlink ports will be enabled: Downlink ports(1G/10G): 25-64 © Copyright Lenovo 2017 Chapter 1: Switch Administration...
Page 48 Please enter "none" for no hostname. Enter hostname(Default: Primary VLAG)? Please enter "none" for no gateway. Enter management gateway:(Default: 0.0.0.0)? Pending switch configuration: vLAG switch type: Primary ISL Ports: 1-16 vLAG TierID: vLAG Peer IP: 1.1.1.2 Uplink Ports: 17-24 Downlink Ports: 25-64 Disabled Ports: empty...
Page 49: Switch Login Levels
Table 2. User Access Levels ‐ Default Settings User Password Description and Tasks Performed Status Account user user The User has no direct responsibility for Disabled switch management. He or she can view all switch status information and statistics, but cannot make any configuration changes to the switch. oper oper The Operator manages all functions of the Disabled switch. The Operator can reset ports, except the management ports. admin admin The superuser Administrator has complete Enabled access to all menus, information, and configuration commands on the G8264CS, including the ability to change both the user and administrator passwords. © Copyright Lenovo 2017 Chapter 1: Switch Administration...
Page 50 Note: Access to each user level (except admin account) can be disabled by setting the password to an empty value. To disable admin account, use the command no access user administrator-enable. The Admin account can be disabled only if there is at least one user account enabled and configured with administrator privilege. G8264CS Application Guide for ENOS 8.4...
Page 51: Setup Vs. The Command Line
Setup vs. the Command Line Once the administrator password is verified, you are given complete access to the switch. If the switch is still set to its factory default configuration, you will need to run Setup (see Chapter 2, “Initial Setup”), a utility designed to help you through the first‐time configuration process. If the switch has already been configured, the command line is displayed instead. © Copyright Lenovo 2017 Chapter 1: Switch Administration...
Page 52: Idle Disconnect
Idle Disconnect By default, the switch will disconnect your Telnet session after 10 minutes of inactivity. This function is controlled by the idle timeout parameter, which can be set from 0 to 60 minutes, where 0 means the session will never timeout. Use the following command to set the idle timeout value: RS 8264CS(config)# system idle <0‐60> G8264CS Application Guide for ENOS 8.4...
Page 53: Boot Strict Mode
The current configuration, if any, is saved in a location external to the switch. When the switch reboots, both the startup and running configuration are lost.  Only protocols/algorithms compliant with NIST SP 800‐131A specification are used/enabled on the switch. Please see the NIST SP 800‐131A publication for details. The following table lists the acceptable protocols and algorithms: Table 3. Acceptable Protocols and Algorithms Protocol/Function Strict Mode Algorithm Compatibility Mode Algorithm BGP does not comply with NIST SP Acceptable 800‐131A specification. When in strict mode, BGP is disabled. How‐ ever, it can be enabled, if required. Certificate RSA‐2048 RSA 2048 Generation SHA‐256 SHA 256 Certificate RSA 2048 or higher Acceptance SHA 224 or higher SHA, SHA2 © Copyright Lenovo 2017 Chapter 1: Switch Administration...
Page 54 Table 3. Acceptable Protocols and Algorithms (continued) Protocol/Function Strict Mode Algorithm Compatibility Mode Algorithm HTTPS TLS 1.2 only TLS 1.0, 1.1, 1.2 See “Acceptable Cipher Suites” on See “Acceptable Cipher Suites” page 56; on page 56; Key Exchange DH Group 24 DH group 1, 2, 5, 14, 24 Encryption 3DES, AES‐128‐CBC 3DES, AES‐128‐CBC Integrity HMAC‐SHA1 HMAC‐SHA1, HMAC‐MD5 IPSec HMAC‐SHA1 HMAC‐SHA1, HMAC‐MD5 3DES, AES‐128‐CBC, HMAC‐SHA1 3DES, AES‐128‐CBC, HMAC‐SHA1, HMAC‐MD5 LDAP LDAP does not comply with NIST Acceptable SP 800‐131A specification. When in strict mode, LDAP is disabled. However, it can be enabled, if required.
Page 55 DIFFIE‐HELLMAN‐GROUP‐EX ANGE‐SHA1 CHANGE‐SHA256 DIFFIE‐HELLMAN‐GROUP‐EX CHANGE‐SHA1 DIFFIE‐HELLMAN‐GROUP14‐S DIFFIE‐HELLMAN‐GROUP1‐S Encryption AES128‐CTR AES128‐CTR AES128‐CBC AES128‐CBC 3DES‐CBC RIJNDAEL128‐CBC BLOWFISH‐CBC 3DES‐CBC ARCFOUR256 ARCFOUR128 ARCFOUR HMAC‐SHA1 HMAC‐SHA1 HMAC‐SHA1‐96 HMAC‐SHA1‐96 HMAC‐MD5 HMAC‐MD5‐96 TACACS+ TACACS+ does not comply with Acceptable NIST SP 800‐131A specification. When in strict mode, TACACS+ is disabled. However, it can be enabled, if required. © Copyright Lenovo 2017 Chapter 1: Switch Administration...
Page 56: Acceptable Cipher Suites
Acceptable Cipher Suites The following cipher suites are acceptable (listed in the order of preference) when the RackSwitch G8264CS is in compatibility mode: Table 4. List of Acceptable Cipher Suites in Compatibility Mode Cipher ID Key Authenti- Encryption MAC Cipher Name Exchange cation 0xC027 ECDHE AES_128_ SHA256 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA2 0xC013 ECDHE AES_128_ SHA1 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 0xC012 ECDHE 3DES SHA1 SSL_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 0xC011 ECDHE SHA1 SSL_ECDHE_RSA_WITH_RC4_128_SHA 0x002F AES_128_ SHA1 TLS_RSA_WITH_AES_128_CBC_SHA 0x003C AES_128_...
Page 57: Configuring Strict Mode
You must reboot the switch for the boot strict mode enable/disable to take effect. Configuring No-Prompt Mode If you expect to administer the switch using SNSC or another browser‐based interface, you need to turn off confirmation prompts. To accomplish this, use the command: RS 8264CS(config)# [no] terminal dont-ask In no‐prompt mode, confirmation prompts are disabled for this and future sessions. SSL/TLS Version Limitation Each of the following successive encryption protocol versions provide more security and less compatibility: SSLv3, TLS1.0, TLS1.1, TLS1.2. When negotiating the encryption protocol during the SSL handshake, the switch will accept, by default, the latest (and most secure) protocol version supported by the client equipment. To enforce a minimal level of security acceptable for the connections, use the following command: RS 8264CS(config)# ssl minimum-version {ssl|tls10|tls11|tls12} Limitations In Enterprise NOS 8.4, consider the following limitation/restrictions if you need to operate the switch in boot strict mode: © Copyright Lenovo 2017 Chapter 1: Switch Administration...
Page 58  Power ITEs and High‐Availability features do not comply with NIST SP 800‐131A specification.  The G8264CS will not discover Platform agents/Common agents that are not in strict mode. Web browsers that do not use TLS 1.2 cannot be used.   Limited functions of the switch managing Windows will be available. G8264CS Application Guide for ENOS 8.4...
Page 59: Chapter 2. Initial Setup
Chapter 2. Initial Setup To help with the initial process of configuring your switch, the Lenovo Enterprise Network Operating System software includes a Setup utility. The Setup utility prompts you step‐by‐step to enter all the necessary information for basic configuration of the switch. Setup can be activated manually from the command line interface any time after login. © Copyright Lenovo 2017...
Page 60: Information Needed For Setup
Information Needed for Setup Setup requests the following information:  Basic system information Date & time  Whether to use Spanning Tree Group or not   Optional configuration for each port Speed, duplex, flow control, and negotiation mode (as appropriate)  Whether to use VLAN trunk mode/tagging or not (as appropriate)  Optional configuration for each VLAN  Name of VLAN  Which ports are included in the VLAN   Optional configuration of IP parameters IP address/mask and VLAN for each IP interface  IP addresses for default gateway  Whether IP forwarding is enabled or not  G8264CS Application Guide for ENOS 8.4...
Page 61: Default Setup Options
Default Setup Options You need to run the Setup utility to change the factory default settings. To accomplish this: 1. Connect to the switch. After connecting, the login prompt appears. Enter Password: 2. Enter admin as the default administrator password. 3. Start the Setup utility: RS 8264CS# setup Follow the instructions provided by the Setup utility. © Copyright Lenovo 2017 Chapter 2: Initial Setup...
Page 62: Stopping And Restarting Setup Manually
Stopping and Restarting Setup Manually Follow these instructions to manually stop and start the Setup utility. Stopping Setup To abort the Setup utility, press <Ctrl‐C> during any Setup question. When you abort Setup, the system will prompt: Would you like to run from top again? [y/n] Enter n to abort Setup, or y to restart the Setup program at the beginning. Restarting Setup You can restart the Setup utility manually at any time by entering the following command at the administrator prompt: RS 8264CS(config)# setup G8264CS Application Guide for ENOS 8.4...
Page 63: Setup Part 1: Basic System Configuration
4. Enter the day of the current date at the prompt: Enter day [3]: Enter the date as a number from 1 to 31. To keep the current day, press <Enter>. The system displays the date and time settings: System clock set to 18:55:36 Wed Jan 28, 2009. 5. Enter the hour of the current system time at the prompt: System Time: Enter hour in 24-hour format [18]: Enter the hour as a number from 00 to 23. To keep the current hour, press <Enter>. 6. Enter the minute of the current time at the prompt: Enter minutes [55]: © Copyright Lenovo 2017 Chapter 2: Initial Setup...
Page 64 Enter the minute as a number from 00 to 59. To keep the current minute, press <Enter>. 7. Enter the seconds of the current time at the prompt: Enter seconds [37]: Enter the seconds as a number from 00 to 59. To keep the current second, press <Enter>. The system then displays the date and time settings: System clock set to 8:55:36 Wed Jan 28, 2009. 8. Turn Spanning Tree Protocol on or off at the prompt: Spanning Tree: Current Spanning Tree Group 1 setting: ON Turn Spanning Tree Group 1 OFF? [y/n] Enter y to turn off Spanning Tree, or enter n to leave Spanning Tree on. G8264CS Application Guide for ENOS 8.4...
Page 65: Setup Part 2: Port Configuration
5. If configuring VLANs, enable or disable VLAN trunk mode/tagging for the port. If you have selected to configure VLANs back in Part 1, the system prompts: Port VLAN tagging/trunk mode config (tagged/trunk mode port can be a member of multiple VLANs) Current VLAN tagging/trunk mode support: disabled Enter new VLAN tagging/trunk mode support [d/e]: © Copyright Lenovo 2017 Chapter 2: Initial Setup...
Page 66 Enter d to disable VLAN trunk mode/tagging for the port or enter e to enable VLAN tagging for the port. To keep the current setting, press <Enter>. 6. The system prompts you to configure the next port: Enter port (INT1-14, MGT1-2, EXT1-64, MGT): When you are through configuring ports, press <Enter> without specifying any port. Otherwise, repeat the steps in this section. G8264CS Application Guide for ENOS 8.4...
Page 67: Setup Part 3: Vlans
Enter each port, by port number or port alias, and confirm placement of the port into this VLAN. When you are finished adding ports to this VLAN, press <Enter> without specifying any port. 4. Configure Spanning Tree Group membership for the VLAN: Spanning Tree Group membership: Enter new Spanning Tree Group index [1-127]: 5. The system prompts you to configure the next VLAN: VLAN Config: Enter VLAN number from 2 to 4094, NULL at end: Repeat the steps in this section until all VLANs have been configured. When all VLANs have been configured, press <Enter> without specifying any VLAN. © Copyright Lenovo 2017 Chapter 2: Initial Setup...
Page 68: Setup Part 4: Ip Configuration
Setup Part 4: IP Configuration The system prompts for IPv4 parameters. Although the switch supports both IPv4 and IPv6 networks, the Setup utility permits only IPv4 configuration. For IPv6 configuration, see Chapter 23, “Internet Protocol Version 6.” IP Interfaces IP interfaces are used for defining the networks to which the switch belongs. Up to 126 IP interfaces can be configured on the RackSwitch G8264CS (G8264CS). The IP address assigned to each IP interface provides the switch with an IP presence on your network. No two IP interfaces can be on the same IP network. The interfaces can be used for connecting to the switch for remote configuration, and for routing between subnets and VLANs (if used). Note: IP interface 128 is reserved for out‐of‐band switch management. 1. Select the IP interface to configure, or skip interface configuration at the prompt: IP Config: IP interfaces: Enter interface number: (1-126) If you wish to configure individual IP interfaces, enter the number of the IP interface you wish to configure. To skip IP interface configuration, press <Enter> without typing an interface number and go to “Default Gateways” on page 70. 2. For the specified IP interface, enter the IP address in IPv4 dotted decimal notation: Current IP address: 0.0.0.0 Enter new IP address: To keep the current setting, press <Enter>.
Page 69: Loopback Interfaces
RS 8264CS(config-ip-loopback)# exit Using Loopback Interfaces for Source IP Addresses The switch can use loopback interfaces to set the source IP addresses for a variety of protocols. This assists in server security, as the server for each protocol can be configured to accept protocol packets only from the expected loopback address block. It may also make is easier to locate or process protocol information, since packets have the source IP address of the loopback interface, rather than numerous egress interfaces. Configured loopback interfaces can be applied to the following protocols:  Syslogs RS 8264CS(config)# logging source-interface loopback <1‐5> SNMP traps  RS 8264CS(config)# snmp-server trap-source loopback <1‐5> © Copyright Lenovo 2017 Chapter 2: Initial Setup...
Page 70: Loopback Interface Limitations
 RADIUS RS 8264CS(config)# ip radius source-interface loopback <1‐5>  TACACS+ RS 8264CS(config)# ip tacacs source-interface loopback <1‐5>  RS 8264CS(config)# ntp source loopback <1‐5> Loopback Interface Limitations ARP is not supported. Loopback interfaces will ignore ARP requests.   Loopback interfaces cannot be assigned to a VLAN. Default Gateways To set up a default gateway: 1. At the prompt, select an IP default gateway for configuration, or skip default gateway configuration: IP default gateways: Enter default gateway number: (1-4) Enter the number for the IP default gateway to be configured. To skip default ...
Page 71 This part of the Setup program prompts you to configure the various routing parameters. At the prompt, enable or disable forwarding for IP Routing: Enable IP forwarding? [y/n] Enter y to enable IP forwarding. To disable IP forwarding, enter n. To keep the current setting, press <Enter>. © Copyright Lenovo 2017 Chapter 2: Initial Setup...
Page 72: Setup Part 5: Final Steps
Setup Part 5: Final Steps 1. When prompted, decide whether to restart Setup or continue: Would you like to run from top again? [y/n] Enter y to restart the Setup utility from the beginning, or n to continue. 2. When prompted, decide whether you wish to review the configuration changes: Review the changes made? [y/n] Enter y to review the changes made during this session of the Setup utility. Enter n to continue without reviewing the changes. We recommend that you review the changes. 3. Next, decide whether to apply the changes at the prompt: Apply the changes? [y/n] Enter y to apply the changes, or n to continue without applying. Changes are normally applied. 4. At the prompt, decide whether to make the changes permanent: Save changes to flash? [y/n] Enter y to save the changes to flash. Enter n to continue without saving the ...
Page 73: Optional Setup For Telnet Support
Optional Setup for Telnet Support Note: This step is optional. Perform this procedure only if you are planning on connecting to the G8264CS through a remote Telnet connection. Telnet is enabled by default. To change the setting, use the following command: RS 8264CS(config)# no access telnet © Copyright Lenovo 2017 Chapter 2: Initial Setup...
Page 74 G8264CS Application Guide for ENOS 8.4...
Page 75: Chapter 3. Switch Software Management
Chapter 3. Switch Software Management The switch software image is the executable code running on the G8264CS. A version of the image comes pre‐installed on the device. As new versions of the image are released, you can upgrade the software running on your switch. To get the latest version of software supported for your G8264CS, go to the following website: http://www.lenovo.com/support/ To determine the software version currently used on the switch, use the following switch command: RS 8264CS# show boot The typical upgrade process for the software image consists of the following steps:  Load a new software image and boot image onto an FTP, SFTP or TFTP server on your network.  Transfer the new images to your switch. Specify the new software image as the one which will be loaded into switch  memory the next time a switch reset occurs.  Reset the switch. For instructions on the typical upgrade process using the ENOS ISCLI, USB, or BBI, see “Loading New Software to Your Switch” on page CAUTION: Although the typical upgrade process is all that is necessary in most cases, upgrading from (or reverting to) some versions of Lenovo Enterprise Network Operating System requires special steps prior to or after the software installation process. Please be sure to follow all applicable instructions in the release notes document for the specific software release to ensure that your switch continues to operate as expected after installing new software. © Copyright Lenovo 2017...
Page 76: Loading New Software To Your Switch
Loading New Software to Your Switch The G8264CS can store up to two different switch software images (called image1 and image2) as well as special boot software (called boot). When you load new software, you must specify where it is placed: either into image1, image2, or boot. For example, if your active image is currently loaded into image1, you would probably load the new image software into image2. This lets you test the new software and reload the original active image (stored in image1), if needed. CAUTION: When you upgrade the switch software image, always load the new boot image and the new software image before you reset the switch. If you do not load a new boot image, your switch might not boot properly (To recover, see “Recovering from a Failed Software Upgrade” on page 80). To load a new software image to your switch, you will need the following:  The image and boot software loaded on an FTP, SFTP or TFTP server on your net‐ work. Note: Be sure to download both the new boot file and the new image file.  The hostname or IP address of the FTP, SFTP or TFTP server Note: The DNS parameters must be configured if specifying hostnames. The name of the new system image.  When the software requirements are met, use one of the following procedures to download the new software to your switch. You can use the ISCLI, USB, or the BBI to download and activate new software. Loading Software via the ISCLI 1. In Privileged EXEC mode, enter the following command: Router# copy {tftp|ftp|sftp} {image1|image2|boot-image} 2.
Page 77: Loading Software Via Bbi
FTP server  TFTP server  SFTP server  Local computer After you log onto the BBI, perform the following steps to load a software image: 1. Click the Configure context tab in the toolbar. 2. In the Navigation Window, select System > Config/Image Control. The Switch Image and Configuration Management page appears. 3. If you are loading software from your computer (HTTP client), skip this step and go to the next. Otherwise, if you are loading software from an FTP, SFTP, or TFTP server, enter the server’s information in the FTP, SFTP, or TFTP Settings section. 4. In the Image Settings section, select the image version you want to replace (Image for Transfer). If you are loading software from an FTP, SFTP, or TFTP server, enter the file  name and click Get Image. If you are loading software from your computer, click Browse.   In the File Upload Dialog, select the file and click OK. Then click Download via Browser. Once the image has loaded, the page refreshes to show the new software. © Copyright Lenovo 2017 Chapter 3: Switch Software Management...
Page 78: Usb Options
USB Options You can insert a USB drive into the USB port on the G8264CS and use it to work with switch image and configuration files. You can boot the switch using files located on the USB drive, or copy files to and from the USB drive. To safely remove the USB drive, first use the following command to un‐mount the USB file system: system usb-eject Command mode: Global configuration USB Boot USB Boot allows you to boot the switch with a software image file, boot file, or configuration file that resides on a USB drive inserted into the USB port. Use the following command to enable or disable USB Boot: [no] boot usbboot enable Command mode: Global configuration When enabled, when the switch is reset/reloaded, it checks the USB port. If a USB drive is inserted into the port, the switch checks the root directory on the USB drive for software and image files. If a valid file is present, the switch loads the file and boots using the file. Note: The following file types are supported: FAT32, NTFS (read‐only), EXT2, and EXT3. The following list describes the valid file names, and describes the switch behavior when it recognizes them. The file names must be exactly as shown, or the switch will not recognize them. RSG8264_Boot.img  The switch replaces the current boot image with the new image, and boots with the new image. RSG8264_OS.img  The switch boots with the new software image. The existing images are not affected. RSG8264_replace1_OS.img  The switch replaces the current software image1 with the new image, and boots ...
Page 79: Usb Copy
(Privileged EXEC mode): usbcopy tousb <filename> {boot|image1|active|syslog|crashdump} In this example, the active configuration file is copied to a directory on the USB drive: G8264CS(config)# usbcopy tousb a_folder/myconfig.cfg active Copy from USB Use the following command to copy a file from the USB drive to the switch: usbcopy fromusb <filename> {boot|image1|active} In this example, the active configuration file is copied from a directory on the USB drive: G8264CS(config)# usbcopy fromusb a_folder/myconfig.cfg active The new file replaces the current file. Note: Do not use two consecutive dot characters ( .. ). Do not use a slash character ( / ) to begin a filename. © Copyright Lenovo 2017 Chapter 3: Switch Software Management...
Page 80: The Boot Management Menu
The Boot Management Menu The Boot Management menu allows you to switch the software image, reset the switch to factory defaults, or to recover from a failed software download. You can interrupt the boot process and enter the Boot Management menu from the serial console port. When the system displays Memory Test, press <Shift B>. The Boot Management menu appears. Resetting the System ... Memory Test ........ Boot Management Menu I - Change booting image C - Change configuration block Q - Reboot E - Exit Please choose your menu option: Current boot image is 1.
Page 81 Please select one of the following options: T) Configure networking and tftp download an image X) Use xmodem 1K to serial download an image R) Reboot E) Exit  If you choose option X (Xmodem serial download), go to Step  If you choose option T (TFTP download), go to Step © Copyright Lenovo 2017 Chapter 3: Switch Software Management...
Page 82 5. Xmodem download: When you see the following message, change the Serial Port characteristics to 115200 bps: Change the baud rate to 115200 bps and hit the <ENTER> key before initiating the download. a. Press <Enter> to set the system into download accept mode. When the readiness meter displays (a series of “C” characters), start XModem on your terminal emulator. b. When you see the following message, change the Serial Port characteristics to 9600 bps: Change the baud rate back to 9600 bps, hit the <ESC> key. c. When you see the following prompt, enter the image number where you want to install the new software and press <Enter>: ...
Page 83: Recovering From A Failed Boot Image
R) Reboot E) Exit 7. Image recovery is complete. Perform one of the following steps:  Press r to reboot the switch. Press e to exit the Boot Management menu   Press the Escape key (<Esc>) to re‐display the Boot Management menu. Recovering from a Failed Boot Image Use the following procedure to recover from a failed boot image upgrade. 1. Connect a PC to the serial port of the switch. 2. Open a terminal emulator program that supports Xmodem download (for example, HyperTerminal, CRT, PuTTY) and select the following serial port characteristics:  Speed: 9600 bps  Data Bits: 8  Stop Bits: 1 © Copyright Lenovo 2017 Chapter 3: Switch Software Management...
Page 84  Parity: None  Flow Control: None 3. Boot the switch and access the Boot Management menu by pressing <Shift B> while the Memory Test is in progress and the dots are being displayed. 4. Select X for Xmodem download. The following appears: Perform xmodem download To download an image use 1K Xmodem at 115200 bps. 5. When you see the following message, change the Serial Port characteristics to 115200 bps: Change the baud rate to 115200 bps and hit the <ENTER> key before initiating the download. a.
Page 86 G8264CS Application Guide for ENOS 8.4...
Page 87: Chapter 4. Securing Administration
Chapter 4. Securing Administration Secure switch management is needed for environments that perform significant management functions across the Internet. Common functions for secured management are described in the following sections:  “Secure Shell and Secure Copy” on page 88  “End User Access Control” on page 93 Note: SNMP read and write functions are enabled by default. For best security practices, if SNMP is not needed for your network, it is recommended that you disable these functions prior to connecting the switch to the network (see Chapter 35, “Simple Network Management Protocol). © Copyright Lenovo 2017...
Page 88: Secure Shell And Secure Copy
Identifying the administrator using Name/Password  Authentication of remote administrators  Authorization of remote administrators  Determining the permitted actions and customizing service for individual administrators  Encryption of management messages Encrypting messages between the remote administrator and switch   Secure copy support Lenovo Enterprise Network Operating System implements the SSH version 2.0 standard and is confirmed to work with SSH version 2.0‐compliant clients such as the following:  OpenSSH_5.4p1 for Linux  Secure CRT Version 5.0.2 (build 1021)  Putty SSH release 0.60 Configuring SSH/SCP Features on the Switch SSH and SCP features are disabled by default. To change the SSH/SCP settings, using the following procedures. Note: To use SCP, you must first enable SSH. To Enable or Disable the SSH Feature Begin a Telnet session from the console port and enter the following command:...
Page 89: To Enable Or Disable Scp Apply And Save
>> ssh [-4|-6] <login name>@<switch IP address> Note: The -4 option (the default) specifies that an IPv4 switch address will be used. The -6 option specifies IPv6. Example: >> ssh scpadmin@205.178.15.157 To Copy the Switch Configuration File to the SCP Host Syntax: >> scp [-4|-6] <username>@<switch IP address>:getcfg <local filename> Example: >> scp scpadmin@205.178.15.157:getcfg ad4.cfg © Copyright Lenovo 2017 Chapter 4: Securing Administration...
Page 90: To Load A Switch Configuration File From The Scp Host
To Load a Switch Configuration File from the SCP Host Syntax: >> scp [-4|-6] <local filename> <username>@<switch IP address>:putcfg Example: >> scp ad4.cfg scpadmin@205.178.15.157:putcfg To Apply and Save the Configuration When loading a configuration file to the switch, the apply and save commands are still required for the configuration commands to take effect. The apply and save commands may be entered manually on the switch, or by using SCP commands. Syntax: >> scp [-4|-6] <local filename> <username>@<switch IP address>:putcfg_apply >> scp [-4|-6] <local filename> <username>@<switch IP address>:putcfg_apply_save Example: >>...
Page 91: To Load Switch Configuration Files From The Scp Host
Local password authentication, RADIUS Generating RSA Host Key for SSH Access To support the SSH host feature, an RSA host key is required. The host key is 2048 bits and is used to identify the G8264CS. To configure RSA host key, first connect to the G8264CS through the console port (commands are not available via external Telnet connection), and enter the following command to generate it manually. RS 8264CS(config)# ssh generate-host-key When the switch reboots, it will retrieve the host key from the FLASH memory. Note: The switch will perform only one session of key/cipher generation at a time. Thus, an SSH/SCP client will not be able to log in if the switch is performing key generation at that time. Also, key generation will fail if an SSH/SCP client is logging in at that time. SSH/SCP Integration with Radius Authentication SSH/SCP is integrated with RADIUS authentication. After the RADIUS server is enabled on the switch, all subsequent SSH authentication requests will be redirected to the specified RADIUS servers for authentication. The redirection is transparent to the SSH clients. © Copyright Lenovo 2017 Chapter 4: Securing Administration...
Page 92: Ssh/Scp Integration With Tacacs+ Authentication
SSH/SCP Integration with TACACS+ Authentication SSH/SCP is integrated with TACACS+ authentication. After the TACACS+ server is enabled on the switch, all subsequent SSH authentication requests will be redirected to the specified TACACS+ servers for authentication. The redirection is transparent to the SSH clients. G8264CS Application Guide for ENOS 8.4...
Page 93: End User Access Control
 Passwords for end users can be up to 128 characters in length for TACACS, RADIUS, Telnet, SSH, Console, and Web access. Strong Passwords The administrator can require use of Strong Passwords for users to access the G8264CS. Strong Passwords enhance security because they make password guessing more difficult. The following rules apply when Strong Passwords are enabled:  Minimum length: 8 characters; maximum length: 64 characters  Must contain at least one uppercase alphabet  Must contain at least one lowercase alphabet  Must contain at least one number  Must contain at least one special character: Supported special characters: ! “ # % & ‘ ( ) ; < = >> ? [\] * + , ‐ . / : ^ _ { | } ~  Cannot be same as the username When strong password is enabled, users can still access the switch using the old password but will be advised to change to a strong password at log‐in. Strong password requirement can be enabled using the following command: RS 8264CS(config)# access user strong-password enable © Copyright Lenovo 2017 Chapter 4: Securing Administration...
Page 94: User Access Control
The administrator can choose the number of days allowed before each password expires. When a strong password expires, the user is allowed to log in one last time (last time) to change the password. A warning provides advance notice for users to change the password. User Access Control The end‐user access control commands allow you to configure end‐user accounts. Setting up User IDs Up to 20 user IDs can be configured. Use the following commands to define any user name and set the user password at the resulting prompts: RS 8264CS(config)# access user 1 name <1‐64 characters> RS 8264CS(config)# access user 1 password Changing user1 password; validation required: Enter current admin password: <current administrator password> Enter new user1 password: <new user password> Re-enter new user1 password: <new user password>...
Page 95: Re-Enabling Locked Accounts
, ena, cos user , password valid, online 2 sessions Logging into an End User Account Once an end user account is configured and enabled, the user can login to the switch using the username/password combination. The level of switch access is determined by the COS established for the end user account. Password Fix-Up Mode Password Fix‐Up Mode enables admin user account recovery if administrator access is lost. A user must connect to the switch over the serial console and log in using the “ForgetMe!” password. This enables the admin account if disabled and a new administrator password can be entered. To disable the Password Fix‐Up functionality, use the following command: RS 8264CS(config)# no access user password-recovery © Copyright Lenovo 2017 Chapter 4: Securing Administration...
Page 96 G8264CS Application Guide for ENOS 8.4...
Page 97: Chapter 5. Authentication & Authorization Protocols
Chapter 5. Authentication & Authorization Protocols Secure switch management is needed for environments that perform significant management functions across the Internet. The following are some of the functions for secured IPv4 management and device access:  “RADIUS Authentication and Authorization” on page 98  “TACACS+ Authentication” on page 102  “LDAP Authentication and Authorization” on page 106 Note: Lenovo Enterprise Network Operating System 8.4 does not support IPv6 for RADIUS, TACACS+ or LDAP. © Copyright Lenovo 2017...
Page 98: Radius Authentication And Authorization
RADIUS Authentication and Authorization Enterprise NOS supports the RADIUS (Remote Authentication Dial‐in User Service) method to authenticate and authorize remote administrators for managing the switch. This method is based on a client/server model. The Remote Access Server (RAS)—the switch—is a client to the back‐end database server. A remote user (the remote administrator) interacts only with the RAS, not the back‐end server and database. RADIUS authentication consists of the following components:  A protocol with a frame format that utilizes UDP over IP (based on RFC 2138 and 2866) A centralized server that stores all the user authorization information   A client: in this case, the switch The G8264CS—acting as the RADIUS client—communicates to the RADIUS server to authenticate and authorize a remote administrator using the protocol definitions specified in RFC 2138 and 2866. Transactions between the client and the RADIUS server are authenticated using a shared key that is not sent over the network. In addition, the remote administrator passwords are sent encrypted between the RADIUS client (the switch) and the back‐end RADIUS server. How RADIUS Authentication Works The RADIUS authentication process follows these steps: 1. A remote administrator connects to the switch and provides a user name and password. 2. Using Authentication/Authorization protocol, the switch sends request to authentication server. 3. The authentication server checks the request against the user ID database. 4. Using RADIUS protocol, the authentication server instructs the switch to grant or deny administrative access. Configuring RADIUS on the Switch Use the following procedure to configure Radius authentication on your switch. ...
Page 99 RS 8264CS(config)# radius-server secondary-host 10.10.1.2 key <1‐32 character secret> 3. If desired, you may change the default UDP port number used to listen to RADIUS. The well‐known port for RADIUS is 1812. RS 8264CS(config)# radius-server port <UDP port number> 4. Configure the number retry attempts for contacting the RADIUS server, and the timeout period. RS 8264CS(config)# radius-server retransmit 3 RS 8264CS(config)# radius-server timeout 5 © Copyright Lenovo 2017 Chapter 5: Authentication & Authorization Protocols...
Page 100: Radius Authentication Features In Enterprise Nos
RADIUS Authentication Features in Enterprise NOS ENOS supports the following RADIUS authentication features:  Supports RADIUS client on the switch, based on the protocol definitions in RFC 2138 and RFC 2866.  Allows RADIUS secret password up to 32 bytes and less than 16 octets. Supports secondary authentication server so that when the primary authentication  server is unreachable, the switch can send client authentication requests to the secondary authentication server. Use the following command to show the currently active RADIUS authentication server: RS 8264CS# show radius-server  Supports user‐configurable RADIUS server retry and time‐out values: Time‐out value = 1‐10 seconds  Retries = 1‐3  The switch will time out if it does not receive a response from the RADIUS server in 1‐3 retries. The switch will also automatically retry connecting to the RADIUS server before it declares the server down. Supports user‐configurable RADIUS application port. The default is UDP port  1645. UDP port 1812, based on RFC 2138, is also supported.  Allows network administrator to define privileges for one or more specific users to access the switch at the RADIUS user database. Switch User Accounts The user accounts listed in Table 6 can be defined in the RADIUS server dictionary ...
Page 101: Radius Attributes For Enterprise Nos User Privileges
 Backdoor is enabled: The switch acts like it is connecting via console.  Secure backdoor is enabled: You must enter the username: noradius. The switch checks if RADIUS server is reachable. If it is reachable, then you must authenticate via remote authentication server. Only if RADIUS server is not reachable, you will be prompted for local user/password to be authenticated against these local credentials. All user privileges, other than those assigned to the Administrator, have to be defined in the RADIUS dictionary. RADIUS attribute 6 which is built into all RADIUS servers defines the administrator. The file name of the dictionary is RADIUS vendor‐dependent. The following RADIUS attributes are defined for G8264CS user privileges levels: Table 7. Enterprise NOS‐proprietary Attributes for RADIUS User Name/Access User-Service-Type Value User Vendor‐supplied Operator Vendor‐supplied Admin Vendor‐supplied 6 © Copyright Lenovo 2017 Chapter 5: Authentication & Authorization Protocols...
Page 102: Tacacs+ Authentication
TACACS+ Authentication ENOS supports authentication and authorization with networks using the Cisco Systems TACACS+ protocol. The G8264CS functions as the Network Access Server (NAS) by interacting with the remote client and initiating authentication and authorization sessions with the TACACS+ access server. The remote user is defined as someone requiring management access to the G8264CS either through a data port or management port. TACACS+ offers the following advantages over RADIUS:  TACACS+ uses TCP‐based connection‐oriented transport; whereas RADIUS is UDP‐based. TCP offers a connection‐oriented transport, while UDP offers best‐effort delivery. RADIUS requires additional programmable variables such as re‐transmit attempts and time‐outs to compensate for best‐effort transport, but it lacks the level of built‐in support that a TCP transport offers.  TACACS+ offers full packet encryption whereas RADIUS offers password‐only encryption in authentication requests.  TACACS+ separates authentication, authorization and accounting. How TACACS+ Authentication Works TACACS+ works much in the same way as RADIUS authentication as described on page 1. Remote administrator connects to the switch and provides user name and password. 2. Using Authentication/Authorization protocol, the switch sends request to authentication server. 3. Authentication server checks the request against the user ID database. 4. Using TACACS+ protocol, the authentication server instructs the switch to grant or deny administrative access. During a session, if additional authorization checking is needed, the switch checks with a TACACS+ server to determine if the user is granted permission to use a particular command. G8264CS Application Guide for ENOS 8.4...
Page 103: Tacacs+ Authentication Features In Enterprise Nos
RS 8264CS(config)# tacacs-server privilege-mapping Table 9. Alternate TACACS+ Authorization Levels ENOS User Access Level TACACS+ level user 0 ‐ 1 oper 6 ‐ 8 admin 14 ‐ 15 If the remote user is successfully authenticated by the authentication server, the switch verifies the privileges of the remote user and authorizes the appropriate access. The administrator has an option to allow secure backdoor access via Telnet/SSH. Secure backdoor provides switch access when the TACACS+ servers cannot be reached. You always can access the switch via the console port, by using notacacs and the administrator password, whether secure backdoor is enabled or not. Note: To obtain the TACACS+ backdoor password for your G8264CS, contact Technical Support. © Copyright Lenovo 2017 Chapter 5: Authentication & Authorization Protocols...
Page 104: Accounting
Accounting Accounting is the action of recording a userʹs activities on the device for the purposes of billing and/or security. It follows the authentication and authorization actions. If the authentication and authorization is not performed via TACACS+, there are no TACACS+ accounting messages sent out. You can use TACACS+ to record and track software login access, configuration changes, and interactive commands. The G8264CS supports the following TACACS+ accounting attributes:  protocol (console/Telnet/SSH/HTTP/HTTPS)  start_time  stop_time  elapsed_time  disc_cause Note: When using the Browser‐Based Interface, the TACACS+ Accounting Stop records are sent only if the Logout button on the browser is clicked. Command Authorization and Logging When TACACS+ Command Authorization is enabled, ENOS configuration commands are sent to the TACACS+ server for authorization. Use the following command to enable TACACS+ Command Authorization: RS 8264CS(config)# tacacs-server command-authorization When TACACS+ Command Logging is enabled, ENOS configuration commands are logged on the TACACS+ server. Use the following command to enable TACACS+ Command Logging: RS 8264CS(config)# tacacs-server command-logging The following examples illustrate the format of ENOS commands sent to the TACACS+ server: ...
Page 105: Tacacs+ Password Change
RS 8264CS(config)# tacacs-server secondary-host 10.10.1.2 key <1‐32 character secret> 3. If desired, you may change the default TCP port number used to listen to TACACS+. The well‐known port for TACACS+ is 49. RS 8264CS(config)# tacacs-server port <TCP port number> 4. Configure the number of retry attempts, and the timeout period. RS 8264CS(config)# tacacs-server retransmit 3 RS 8264CS(config)# tacacs-server timeout 5 © Copyright Lenovo 2017 Chapter 5: Authentication & Authorization Protocols...
Page 106: Ldap Authentication And Authorization
LDAP Authentication and Authorization ENOS supports the LDAP (Lightweight Directory Access Protocol) method to authenticate and authorize remote administrators to manage the switch. LDAP is based on a client/server model. The switch acts as a client to the LDAP server. A remote user (the remote administrator) interacts only with the switch, not the back‐end server and database. LDAP authentication consists of the following components: A protocol with a frame format that utilizes TCP over IP   A centralized server that stores all the user authorization information A client: in this case, the switch  Each entry in the LDAP server is referenced by its Distinguished Name (DN). The DN consists of the user‐account name concatenated with the LDAP domain name. If the user‐account name is John, the following is an example DN: uid=John,ou=people,dc=domain,dc=com Configuring the LDAP Server G8264CS user groups and user accounts must reside within the same domain. On the LDAP server, configure the domain to include G8264CS user groups and user accounts, as follows: User Accounts:  Use the uid attribute to define each individual user account. If a custom attribute is used to define individual users, it must also be configured on the switch. User Groups:  Use the members attribute in the groupOfNames object class to create the user groups. The first word of the common name for each user group must be equal to the user group names defined in the G8264CS, as follows: admin  oper  user ...
Page 107 The well‐known port for LDAP is 389. RS 8264CS(config)# ldap-server port <1‐65000> 4. Configure the number of retry attempts for contacting the LDAP server, and the timeout period. RS 8264CS(config)# ldap-server retransmit 3 RS 8264CS(config)# ldap-server timeout 10 5. You may change the default LDAP attribute (uid) or add a custom attribute. For instance, Microsoft’s Active Directory requires the cn attribute. RS 8264CS(config)# ldap-server attribute username <128 alpha‐numeric characters> © Copyright Lenovo 2017 Chapter 5: Authentication & Authorization Protocols...
Page 108 G8264CS Application Guide for ENOS 8.4...
Page 109: Chapter 6. 802.1X Port-Based Network Access Control
Chapter 6. 802.1X Port-Based Network Access Control Port‐Based Network Access control provides a means of authenticating and authorizing devices attached to a LAN port that has point‐to‐point connection characteristics. It prevents access to ports that fail authentication and authorization. This feature provides security to ports of the RackSwitch G8264CS (G8264CS) that connect to blade servers. The following topics are discussed in this section:  “Extensible Authentication Protocol over LAN” on page 110  “EAPoL Authentication Process” on page 111  “EAPoL Port States” on page 113  “Guest VLAN” on page 113  “Supported RADIUS Attributes” on page 114  “EAPoL Configuration Guidelines” on page 116 © Copyright Lenovo 2017...
Page 110: Extensible Authentication Protocol Over Lan
Extensible Authentication Protocol over LAN Lenovo Enterprise Network Operating System can provide user‐level security for its ports using the IEEE 802.1X protocol, which is a more secure alternative to other methods of port‐based network access control. Any device attached to an 802.1X‐enabled port that fails authentication is prevented access to the network and denied services offered through that port. The 802.1X standard describes port‐based network access control using Extensible Authentication Protocol over LAN (EAPoL). EAPoL provides a means of authenticating and authorizing devices attached to a LAN port that has point‐to‐point connection characteristics and of preventing access to that port in cases of authentication and authorization failures. EAPoL is a client‐server protocol that has the following components: Supplicant or Client  The Supplicant is a device that requests network access and provides the required credentials (user name and password) to the Authenticator and the Authenticator Server.  Authenticator The Authenticator enforces authentication and controls access to the network. The Authenticator grants network access based on the information provided by the Supplicant and the response from the Authentication Server. The Authenticator acts as an intermediary between the Supplicant and the Authentication Server: requesting identity information from the client, forwarding that information to the Authentication Server for validation, relaying the server’s responses to the client, and authorizing network access based on the results of the authentication exchange. The G8264CS acts as an Authenticator.  Authentication Server The Authentication Server validates the credentials provided by the Supplicant to determine if the Authenticator ought to grant access to the network. The Authentication Server may be co‐located with the Authenticator. The G8264CS relies on external RADIUS servers for authentication. Upon a successful authentication of the client by the server, the 802.1X‐controlled port transitions from unauthorized to authorized state, and the client is allowed ...
Page 111: Eapol Authentication Process
802.1x Client Server EAPOL Lenovo Switch RADIUS-EAP Authenticator Ethernet (RADIUS Client) UDP/IP Port Unauthorized EAPOL-Start EAP-Request (Credentials) EAP-Response (Credentials) Radius-Access-Request Radius-Access-Challenge EAP-Request (Credentials) EAP-Response (Credentials) Radius-Access-Request Radius-Access-Accept EAP-Success Port Authorized © Copyright Lenovo 2017 Chapter 6: 802.1X Port-Based Network Access Control...
Page 112: Eapol Message Exchange
EAPoL Message Exchange During authentication, EAPOL messages are exchanged between the client and the G8264CS authenticator, while RADIUS‐EAP messages are exchanged between the G8264CS authenticator and the RADIUS server. Authentication is initiated by one of the following methods:  The G8264CS authenticator sends an EAP‐Request/Identity packet to the client  The client sends an EAPOL‐Start frame to the G8264CS authenticator, which responds with an EAP‐Request/Identity frame. The client confirms its identity by sending an EAP‐Response/Identity frame to the G8264CS authenticator, which forwards the frame encapsulated in a RADIUS packet to the server. The RADIUS authentication server chooses an EAP‐supported authentication algorithm to verify the client’s identity, and sends an EAP‐Request packet to the client via the G8264CS authenticator. The client then replies to the RADIUS server with an EAP‐Response containing its credentials. Upon a successful authentication of the client by the server, the 802.1X‐controlled port transitions from unauthorized to authorized state, and the client is allowed full access to services through the controlled port. When the client later sends an EAPOL‐Logoff message to the G8264CS authenticator, the port transitions from authorized to unauthorized state. If a client that does not support 802.1X connects to an 802.1X‐controlled port, the G8264CS authenticator requests the clientʹs identity when it detects a change in the operational state of the port. The client does not respond to the request, and the port remains in the unauthorized state. Note: When an 802.1X‐enabled client connects to a port that is not 802.1X‐controlled, the client initiates the authentication process by sending an EAPOL‐Start frame. When no response is received, the client retransmits the request for a fixed number of times. If no response is received, the client assumes the port is in authorized state, and begins sending frames, even if the port is unauthorized. G8264CS Application Guide for ENOS 8.4...
Page 113: Eapol Port States
 Force Unauthorized You can configure this state that denies all access to the port.  Force Authorized You can configure this state that allows full access to the port. Use the 802.1X global configuration commands (dot1x) to configure 802.1X authentication for all ports in the switch. Use the 802.1X port commands to configure a single port. Guest VLAN The guest VLAN provides limited access to unauthenticated ports. The guest VLAN can be configured using the following commands: dot1x guest-vlan ? RS 8264CS(config)# Client ports that have not received an EAPOL response are placed into the Guest VLAN, if one is configured on the switch. Once the port is authenticated, it is moved from the Guest VLAN to its configured VLAN. When Guest VLAN enabled, the following considerations apply while a port is in the unauthenticated state:  The port is placed in the guest VLAN.  The Port VLAN ID (PVID) is changed to the Guest VLAN ID.  Port tagging is disabled on the port. © Copyright Lenovo 2017 Chapter 6: 802.1X Port-Based Network Access Control...
Page 114: Supported Radius Attributes
Supported RADIUS Attributes The 802.1X Authenticator relies on external RADIUS servers for authentication with EAP. Table 10 lists the RADIUS attributes that are supported as part of RADIUS‐EAP authentication based on the guidelines specified in Annex D of the 802.1X standard and RFC 3580. Table 10. Support for RADIUS Attributes # Attribute Attribute Value A-R A-A A-C A-R 1 User‐Name The value of the Type‐Data field 0‐1 from the supplicant’s EAP‐Response/ Identity message. If the Identity is unknown (for example, Type‐Data field is zero bytes in length), this attribute will have the same value as the Calling‐Station‐Id. 4 NAS‐IP‐Address IPv4 address of the authenticator used for Radius communication. 5 NAS‐Port Port number of the authenticator port to which the supplicant is attached. 24 State Server‐specific value. This is sent ...
Page 115 80 Message‐ Always present whenever an Authenticator EAP‐Message attribute is also included. Used to integrity‐protect a packet. 87 NAS‐Port‐ID Name assigned to the authenticator port, e.g. Server1_Port3 Legend: RADIUS Packet Types: A‐R (Access‐Request), A‐A (Access‐Accept), A‐C (Access‐Challenge), A‐R (Access‐Reject) RADIUS Attribute Support:  This attribute MUST NOT be present in a packet. Zero or more instances of this attribute MAY be present in a packet.   0‐1 Zero or one instance of this attribute MAY be present in a packet. Exactly one instance of this attribute MUST be present in a packet.   One or more of these attributes MUST be present. © Copyright Lenovo 2017 Chapter 6: 802.1X Port-Based Network Access Control...
Page 116: Eapol Configuration Guidelines
EAPoL Configuration Guidelines When configuring EAPoL, consider the following guidelines:  The 802.1X port‐based authentication is currently supported only in point‐to‐point configurations, that is, with a single supplicant connected to an 802.1X‐enabled switch port.  When 802.1X is enabled, a port has to be in the authorized state before any other Layer 2 feature can be operationally enabled. For example, the STG state of a port is operationally disabled while the port is in the unauthorized state.  The 802.1X supplicant capability is not supported. Therefore, none of its ports can successfully connect to an 802.1X‐enabled port of another device, such as another switch, that acts as an authenticator, unless access control on the remote port is disabled or is configured in forced‐authorized mode. For example, if a G8264CS is connected to another G8264CS, and if 802.1X is enabled on both switches, the two connected ports must be configured in force‐authorized mode.  Unsupported 802.1X attributes include Service‐Type, Session‐Timeout, and Termination‐Action.  RADIUS accounting service for 802.1X‐authenticated devices or users is not currently supported.  Configuration changes performed using SNMP and the standard 802.1X MIB will take effect immediately. G8264CS Application Guide for ENOS 8.4...
Page 117: Chapter 7. Access Control Lists
Chapter 7. Access Control Lists Access Control Lists (ACLs) are filters that permit or deny traffic for security purposes. They can also be used with QoS to classify and segment traffic to provide different levels of service to different traffic types. Each filter defines the conditions that must match for inclusion in the filter, and also the actions that are performed when a match is made. Lenovo Enterprise Network Operating System 8.4 supports the following ACLs:  IPv4 ACLs Up to 256 ACLs are supported for networks that use IPv4 addressing. IPv4 ACLs are configured using the following ISCLI command path: RS 8264CS(config)# access-control list <IPv4 ACL number> ? IPv6 ACLs  Up to 128 ACLs are supported for networks that use IPv6 addressing. IPv6 ACLs are configured using the following ISCLI command path: RS 8264CS(config)# access-control list6 <IPv6 ACL number> ?  VLAN Maps (VMaps) Up to 128 VLAN Maps are supported for attaching filters to VLANs rather than ports. See “VLAN Maps” on page 128 for details. © Copyright Lenovo 2017...
Page 118: Summary Of Packet Classifiers
Summary of Packet Classifiers ACLs allow you to classify packets according to a variety of content in the packet header (such as the source address, destination address, source port number, destination port number, and others). Once classified, packet flows can be identified for more processing. IPv4 ACLs, IPv6 ACLs, and VMaps allow you to classify packets based on the following packet attributes: Ethernet header options (for IPv4 ACLs and VMaps only)  Source MAC address  Destination MAC address  VLAN number and mask  Ethernet type (ARP, IP, IPv6, MPLS, RARP, etc.)  Ethernet Priority (the IEEE 802.1p Priority)  IPv4 header options (for IPv4 ACLs and VMaps only)  Source IPv4 address and subnet mask  Destination IPv4 address and subnet mask  Type of Service value  IP protocol number or name as shown in Table  Table 11. Well‐Known Protocol Types Number Protocol Name icmp igmp ospf vrrp IPv6 header options (for IPv6 ACLs only)
Page 119: Summary Of Acl Actions
0x0010 0x0008 0x0004 0x0002 0x0001  Packet format (for IPv4 ACLs and VMaps only) Ethernet format (eth2, SNAP, LLC)  Ethernet tagging format  IP format (IPv4, IPv6)   Egress port packets (for all ACLs) Summary of ACL Actions Once classified using ACLs, the identified packet flows can be processed differently. For each ACL, an action can be assigned. The action determines how the switch treats packets that match the classifiers assigned to the ACL. G8264CS ACL actions include the following:  Pass or Drop the packet  Re‐mark the packet with a new DiffServ Code Point (DSCP)  Re‐mark the 802.1p field Set the COS queue  © Copyright Lenovo 2017 Chapter 7: Access Control Lists...
Page 120: Assigning Individual Acls To A Port
Assigning Individual ACLs to a Port Once you configure an ACL, you must assign the ACL to the appropriate ports. Each port can accept multiple ACLs, and each ACL can be applied for multiple ports. ACLs can be assigned individually. To assign an individual ACLs to a port, use the following IP Interface Mode commands: RS 8264CS(config)# interface port <port> RS 8264CS(config-if)# access-control list <IPv4 ACL number> RS 8264CS(config-if)# access-control list6 <IPv6 ACL number> When multiple ACLs are assigned to a port, higher‐priority ACLs are considered first, and their action takes precedence over lower‐priority ACLs. ACL order of precedence is discussed in the next section. ACL Order of Precedence When multiple ACLs are assigned to a port, they are evaluated in numeric sequence, based on the ACL number. Lower‐numbered ACLs take precedence over higher‐numbered ACLs. For example, ACL 1 (if assigned to the port) is evaluated first and has top priority. If multiple ACLs match the port traffic, only the action of the one with the lowest ACL number is applied. The others are ignored. If no assigned ACL matches the port traffic, no ACL action is applied. ACL Metering and Re-Marking You can define a profile for the aggregate traffic flowing through the G8264CS by ...
Page 121: Metering
Metering QoS metering provides different levels of service to data streams through user‐configurable parameters. A meter is used to measure the traffic stream against a traffic profile which you create. Thus, creating meters yields In‐Profile and Out‐of‐Profile traffic for each ACL, as follows:  In‐Profile—If there is no meter configured or if the packet conforms to the meter, the packet is classified as In‐Profile.  Out‐of‐Profile—If a meter is configured and the packet does not conform to the meter (exceeds the committed rate or maximum burst rate of the meter), the packet is classified as Out‐of‐Profile. Using meters, you set a Committed Rate in Kbps. All traffic within this Committed Rate is in‐profile. Additionally, you can set a Maximum Burst Size that specifies an allowed data burst larger than the Committed Rate for a brief period. These parameters define the In‐Profile traffic. Meters keep the sorted packets within certain parameters. You can configure a meter on an ACL, and perform actions on metered traffic, such as packet re‐marking. Re-Marking Re‐marking allows for the treatment of packets to be reset based on new network specifications or desired levels of service. You can configure the ACL to re‐mark a packet as follows:  Change the DSCP value of a packet, used to specify the service level that traffic receives.  Change the 802.1p priority of a packet. © Copyright Lenovo 2017 Chapter 7: Access Control Lists...
Page 122: Acl Port Mirroring
ACL Port Mirroring For IPv4 ACLs and VMaps, packets that match the filter can be mirrored to another switch port for network diagnosis and monitoring. The source port for the mirrored packets cannot be a portchannel, but may be a member of a portchannel. The destination port to which packets are mirrored must be a physical port. The action (permit, drop, etc.) of the ACL or VMap must be configured before assigning it to a port. Use the following commands to add mirroring to an ACL:  For IPv4 ACLs: RS 8264CS(config)# access-control list <ACL number> mirror port <destination port> The ACL must be also assigned to it target ports as usual (see “Assigning Individual ACLs to a Port” on page 120).  For VMaps (see “VLAN Maps” on page 128): RS 8264CS(config)# access-control vmap <VMap number> mirror port <monitor destination port> See the configuration example on page 129. Viewing ACL Statistics ACL statistics display how many packets have “hit” (matched) each ACL. Use ...
Page 123: Acl Logging
 TCP/UDP port number  ACL action  Number of packets logged  For example: Sep 27 4:25:38 DUT3 NOTICE ACL-LOG: %MAC ACCESS LOG: list ACL-MAC-12-IN permitted tcp 1.1.1.2 (0) (12, 00:ff:d7:66:74:62) -> 200.0.1.2 (0) (00:18:73:ee:a7:c6), 32 packets. © Copyright Lenovo 2017 Chapter 7: Access Control Lists...
Page 124: Rate Limiting Behavior
Rate Limiting Behavior Because ACL logging can be CPU‐intensive, logging is rate‐limited. By default, the switch will log only 10 matching packets per second. This pool is shared by all log‐enabled ACLs. The global rate limit can be changed as follows: RS 8264CS(config)# access-control log rate-limit <1‐1000> Where the limit is specified in packets per second. Log Interval For each log‐enabled ACL, the first packet that matches the ACL initiates an immediate message in the system log. Beyond that, additional matches are subject to the log interval. By default, the switch will buffer ACL log messages for a period of 300 seconds. At the end of that interval, all messages in the buffer are written to the system log. The global interval value can be changed as follows: RS 8264CS(config)# access-control log interval <5‐600> Where the interval rate is specified in seconds. In any given interval, packets that have identical log information are condensed into a single message. However, the packet count shown in the ACL log message represents only the logged messages, which due to rate‐limiting, may be significantly less than the number of packets actually matched by the ACL. Also, the switch is limited to 64 different ACL log messages in any interval. Once the threshold is reached, the oldest message will be discarded in favor of the new message, and an overflow message will be added to the system log. ACL Logging Limitations ACL logging reserves packet queue 1 for internal use. Features that allow remapping packet queues (such as CoPP) may not behave as expected if other packet flows are reconfigured to use queue 1. G8264CS Application Guide for ENOS 8.4...
Page 125: Acl Configuration Examples
RS 8264CS(config)# access-control list 2 ipv4 destination-ip-address 200.20.2.2 255.255.255.255 RS 8264CS(config)# access-control list 2 action deny 2. Add ACL 2 to port 2. RS 8264CS(config)# interface port 2 RS 8264CS(config-if)# access-control list 2 RS 8264CS(config-if)# exit © Copyright Lenovo 2017 Chapter 7: Access Control Lists...
Page 126: Acl Example 3
ACL Example 3 Use this configuration to block traffic from a specific IPv6 source address. All traffic that ingresses in port 2 with source IP from class 2001:0:0:5:0:0:0:2/128 is denied. 1. Configure an Access Control List. RS 8264CS(config)# access-control list6 3 ipv6 source-address 2001:0:0:5:0:0:0:2 128 RS 8264CS(config)# access-control list6 3 action deny 2. Add ACL 2 to port 2. RS 8264CS(config)# interface port 2 RS 8264CS(config-if)# access-control list6 3 RS 8264CS(config-if)# exit ACL Example 4 Use this configuration to deny all ARP packets that ingress a port.
Page 127: Acl Example 6
100.10.1.0 255.255.255.0 RS 8264CS(config)# access-control list 4 egress-port 3 RS 8264CS(config)# access-control list 4 action deny 2. Add ACL 4 to port 1. RS 8264CS(config)# interface port 1 RS 8264CS(config-if)# access-control list 4 RS 8264CS(config-if)# exit © Copyright Lenovo 2017 Chapter 7: Access Control Lists...
Page 128: Vlan Maps
VLAN Maps A VLAN map (VMap) is an ACL that can be assigned to a VLAN or VM group rather than to a switch port as with IPv4 ACLs. This is particularly useful in a virtualized environment where traffic filtering and metering policies must follow virtual machines (VMs) as they migrate between hypervisors. Note: VLAN maps for VM groups are not supported simultaneously on the same ports as vNICs (see Chapter 14, “Virtual NICs”). The G8264CS supports up to 128 VMaps. Individual VMap filters are configured in the same fashion as IPv4 ACLs, except that VLANs cannot be specified as a filtering criteria (unnecessary, since the VMap are assigned to a specific VLAN or associated with a VM group VLAN). VMaps are configured using the following ISCLI configuration command path: RS 8264CS(config)# access-control vmap <VMap ID> ? action Set filter action egress-port Set to filter for packets egressing this port ethernet Ethernet header options ipv4 IP version 4 header options meter ACL metering configuration mirror...
Page 129 RS 8264CS(config)# access-control vmap 21 packet-format ethernet ethernet-type2 RS 8264CS(config)# access-control vmap 21 mirror port 4 RS 8264CS(config)# access-control vmap 21 action permit RS 8264CS(config)# vlan 3 RS 8264CS(config-vlan)# vmap 21 serverports © Copyright Lenovo 2017 Chapter 7: Access Control Lists...
Page 130: Using Storm Control Filters
Using Storm Control Filters Excessive transmission of broadcast or multicast traffic can result in a network storm. A network storm can overwhelm your network with constant broadcast or multicast traffic, and degrade network performance. Common symptoms of a network storm are denial‐of‐service (DoS) attacks, slow network response times, and network operations timing out. The G8264CS provides filters that can limit the number of the following packet types transmitted by switch ports:  Broadcast packets  Multicast packets  Unknown unicast packets (destination lookup failure) Unicast packets whose destination MAC address is not in the Forwarding Database are unknown unicasts. When an unknown unicast is encountered, the switch handles it like a broadcast packet and floods it to all other ports in the VLAN (broadcast domain). A high rate of unknown unicast traffic can have the same negative effects as a broadcast storm. Configure broadcast filters on each port that requires broadcast storm control. Set a threshold that defines the total number of broadcast packets transmitted (0‐2097151), in packets per second. When the threshold is reached, no more packets of the specified type are transmitted. To filter broadcast packets on a port, use the following commands: RS 8264CS(config)# interface port 1 RS 8264CS(config-if)# storm-control broadcast level rate <packets per second> To filter multicast packets on a port, use the following commands: ...
Page 131: Part 3: Switch Basics
Part 3: Switch Basics This section discusses basic switching functions:  VLANs  Port Aggregation  Spanning Tree Protocols (Spanning Tree Groups, Rapid Spanning Tree Protocol, and Multiple Spanning Tree Protocol)  Virtual Link Aggregation Groups  Quality of Service © Copyright Lenovo 2017...
Page 132 G8264CS Application Guide for ENOS 8.4...
Page 133: Chapter 8. Vlans
Chapter 8. VLANs This chapter describes network design and topology considerations for using Virtual Local Area Networks (VLANs). VLANs commonly are used to split up groups of network

Lenovo RackSwitch G8264CS Application Manual

Chapter 1. Switch Administration

Chapter 2. Initial Setup

Chapter 3. Switch Software Management

Chapter 4. Securing Administration

Chapter 5. Authentication & Authorization Protocols

Chapter 6. 802.1X Port-Based Network Access Control

Chapter 7. Access Control Lists

Chapter 8. Vlans

Chapter 9. Ports and Link Aggregation

Chapter 10. Spanning Tree Protocols

Chapter 11. Virtual Link Aggregation Groups

Chapter 12. Quality of Service

Chapter 13. Virtualization

Chapter 14. Virtual Nics

Chapter 15. Stacking

Quick Links

Troubleshooting

Related Manuals for Lenovo RackSwitch G8264CS

Summary of Contents for Lenovo RackSwitch G8264CS