Management Software AT-S63 Menus Interface User’s Guide AT-9400 Series Layer 2+ Gigabit Ethernet Switches Version 1.2.0 613-50570-00 Rev.
Copyright © 2005 Allied Telesyn, Inc. All rights reserved. No part of this publication may be reproduced without prior written permission from Allied Telesyn, Inc. Microsoft and Internet Explorer are registered trademarks of Microsoft Corporation. Netscape Navigator is a registered trademark of Netscape Communications Corporation. All other product names, company names, logos or other designations mentioned herein are trademarks or registered trademarks of their respective owners. Allied Telesyn, Inc.
Contents Preface ............................................................................................................................................................ 25 How This Guide is Organized........................................................................................................................... 26 Document Conventions ....................................................................................................................................
Contents Configuring the Telnet Server ........................................................................................................................... 73 Setting the Baud Rate of the Serial Terminal Port ............................................................................................ 74 Pinging a Remote System ................................................................................................................................
AT-S63 Management Software Menus Interface User’s Guide Managing LACP Port Trunks.......................................................................................................................... 166 Enabling or Disabling LACP..................................................................................................................... 166 Setting the LACP System Priority ............................................................................................................
Contents Chapter 12: File Downloads and Uploads .................................................................................................229 Downloading the AT-S63 Image File onto a Switch........................................................................................230 Guidelines.................................................................................................................................................230 Downloading the AT-S63 Image from a Local Management Session ...
AT-S63 Management Software Menus Interface User’s Guide Mapping CoS Priorities to Egress Queues ..................................................................................................... 330 Configuring Egress Scheduling ...................................................................................................................... 332 Displaying Port CoS Priorities ........................................................................................................................
Contents Chapter 20: MLD Snooping .........................................................................................................................403 MLD Snooping Overview ................................................................................................................................404 Configuring MLD Snooping .............................................................................................................................405 Enabling or Disabling MLD Snooping .........
AT-S63 Management Software Menus Interface User’s Guide Displaying SNMPv3 Table Menus .................................................................................................................. 515 Displaying the Display SNMPv3 User Table Menu .................................................................................. 515 Displaying the Display SNMPv3 View Table Menu..................................................................................
Contents Displaying the MSTP Port Configuration ........................................................................................................590 Displaying the MSTP Port State .....................................................................................................................592 Resetting MSTP to the Defaults......................................................................................................................595 Section VI: Virtual LANs .........................
AT-S63 Management Software Menus Interface User’s Guide Chapter 28: Protected Ports VLANs .......................................................................................................... 671 Protected Ports VLAN Overview .................................................................................................................... 672 Protected Ports VLAN Guidelines ............................................................................................................
Contents Section VIII: Management Security ......................................................................749 Chapter 32: Web Server ..............................................................................................................................751 Web Server Overview .....................................................................................................................................752 Supported Protocols ................................................................
AT-S63 Management Software Menus Interface User’s Guide Chapter 35: Secure Shell (SSH) ................................................................................................................. 815 SSH Overview ................................................................................................................................................ 816 Support for SSH ................................................................................................................................
Contents SNMP Default Settings ...................................................................................................................................875 SNTP Default Settings ....................................................................................................................................876 Spanning Tree (STP, RSTP, and MSTP) Default Settings .............................................................................877 Spanning Tree Switch Settings .......................
Figures Chapter 2: Starting a Management Session ............................................................................................... 43 Figure 1: Connecting the Management Cable to the RJ-45 Serial Terminal Port.................................................................44 Figure 2: CLI Prompt ............................................................................................................................................................45 Figure 3: Main Menu.....................
Figures Chapter 8: Static and LACP Port Trunks ................................................................................................... 147 Figure 39: Static Port Trunk Example .................................................................................................................................148 Figure 40: Example of Multiple Aggregators for Multiple Aggregate Trunks.......................................................................
AT-S63 Management Software Menus Interface User’s Guide Chapter 14: Classifiers................................................................................................................................ 283 Figure 85: User Priority and VLAN Fields within an Ethernet Frame..................................................................................286 Figure 86: ToS field in an IP Header ...............................................................................................................
Figures Chapter 19: IGMP Snooping ....................................................................................................................... 391 Figure 137: Advanced Configuration Menu ........................................................................................................................394 Figure 138: IGMP Snooping Configuration Menu ...............................................................................................................
AT-S63 Management Software Menus Interface User’s Guide Chapter 24: Multiple Spanning Tree Protocol........................................................................................... 553 Figure 188: VLAN Fragmentation with STP or RSTP.........................................................................................................556 Figure 189: MSTP Example of Two Spanning Tree Instances ..........................................................................................
Figures Chapter 29: MAC Address-based VLANs .................................................................................................. 687 Figure 238: Example of a MAC Address-based VLAN Spanning Switches........................................................................691 Figure 239: MAC Based VLANs Menu ...............................................................................................................................697 Figure 240: Delete VLAN Menu ..............................
AT-S63 Management Software Menus Interface User’s Guide Chapter 36: TACACS+ and RADIUS Protocols ......................................................................................... 825 Figure 284: Authentication Configuration Menu .................................................................................................................830 Figure 285: TACACS+ Client Configuration Menu .............................................................................................................
Figures 22
Tables Table 1: New Features in AT-S63 Version 1.2.0 .................................................................................................................30 Table 2: File Extensions and File Types ............................................................................................................................205 Table 3: AT-S63 Modules ..................................................................................................................................................
Tables 24
Preface This guide contains instructions on how to configure and maintain an AT-9400 Series Layer 2+ Gigabit Ethernet switch using the menus interface in the AT-S63 management software. For instructions on how to manage the switch from the command line interface or web browser interface, refer to the AT-S63 Management Software Command Line Interface User’s Guide or the AT-S63 Management Software Web Browser Interface User’s Guide. The guides are available from the Allied Telesyn web site.
Preface How This Guide is Organized This guide is organized into the following sections Section I: Basic Operations The chapters in this section explain how to start a management session and perform basic tasks including configuring the IP configuration of a switch, port parameters, SNMPv1 and SNMPv2c, enhanced stacking, trunking and mirroring, and viewing Ethernet statistics.
AT-S63 Management Software Menus Interface User’s Guide Document Conventions This document uses the following conventions: Note Notes provide additional information. Caution Cautions inform you that performing or omitting a specific action may result in equipment damage or loss of data. Warning Warnings inform you that performing or omitting a specific action may result in bodily injury.
Preface Where to Find Web-based Guides The installation and user guides for all Allied Telesyn products are available in portable document format (PDF) on our web site at www.alliedtelesyn.com. You can view the documents online or download them onto a local workstation or server.
AT-S63 Management Software Menus Interface User’s Guide Contacting Allied Telesyn This section provides Allied Telesyn contact information for technical support as well as sales and corporate information. Online Support You can request technical support online by accessing the Allied Telesyn Knowledge Base: http://kb.alliedtelesyn.com. You can use the Knowledge Base to submit questions to our technical support staff and review answers to previously asked questions.
Preface New Features in AT-S63 Version 1.2.0 Table 1 lists the new features in version 1.2.0 of the AT-S63 management software. Table 1. New Features in AT-S63 Version 1.2.0 Change Chapter and Procedure MAC Address Table Added new parameters to the CLI commands for displaying and deleting specific types of MAC addresses in the MAC address table. The new parameters are: STATIC, STATICUNICAST, and, STATICMULTICAST for displaying and deleting static unicast and multicast MAC addresses.
AT-S63 Management Software Menus Interface User’s Guide Table 1. New Features in AT-S63 Version 1.2.0 (Continued) Change Chapter and Procedure Quality of Service - Policies Added the following new parameters to QoS policies: ToS, Move ToS to Priority, and Move Priority to ToS, as defined above. Send to Mirror Port parameter for copying traffic to a destination mirror port.
Preface 32
Chapter 1 Overview This chapter describes the AT-S63 software functions, the methods you can use to access the software, and the management access levels.
Chapter 1: Overview Management Overview The AT-S63 management software allows you to monitor and adjust the operating parameters of an AT-9400 Series switch and includes the following features: Basic operations such as configuring port and switch parameters, enhanced stacking, SNMPv1 and v2c, trunking, and mirroring Advanced operations including file uploads and downloads, event logging, traffic classifiers, access control lists, denial of service defense, Quality of Service (QoS), Class of Service
AT-S63 Management Software Menus Interface User’s Guide The following sections in this chapter briefly describe each type of management session.
Chapter 1: Overview Local Connection You establish a local connection with an AT-9400 Series switch when you use the RJ-45 to RS-232 management cable included with the switch to connect a terminal or a PC with a terminal emulator program to the terminal port on the switch. The terminal port is located on the front panel of the AT-9400 Series switch. This type of connection is referred to as “local” because you must be physically close to the switch, such as in the wiring closet where the switch is located.
AT-S63 Management Software Menus Interface User’s Guide Remote Connection You can use any management station on your network that has the Telnet application to manage an AT-9400 Series switch. This is referred to as a remote connection. To establish a remote connection to a switch, there must be at least one enhanced stacking switch in the subnet to which you assigned an IP address. Only one switch in a subnet needs to have an IP address.
Chapter 1: Overview Note Third-party network management applications such as HP OpenView cannot use the enhanced stacking feature of AT-S63. Therefore, you must assign an IP address to each switch that you want to manage with one of these applications.
AT-S63 Management Software Menus Interface User’s Guide Management Access Levels There are two levels of management access in the AT-S63 management software: manager and operator. When you log in as a manager, you can view and configure all of a switch’s operating parameters. When you log in as an operator, you can only view the operating parameters; you cannot change any values.
Chapter 1: Overview 40 Section I: Basic Features
Section I Basic Operations The chapters in this section provide information and procedures for basic switch setup using the AT-S63 management software.
Section I: Basic Operations
Chapter 2 Starting a Management Session This chapter contains procedures for starting a management session on the switch using a local or remote connection.
Chapter 2: Starting a Management Session Starting a Local Management Session To establish a local connection, you use the terminal port on the front panel of the AT-9400 Series switch, as explained in “Local Connection” on page 36. When you make the connection and start the AT-S63 menus interface, you start a local management session. A switch does not need an IP address to be managed through a local management session.
AT-S63 Management Software Menus Interface User’s Guide 3. Configure the terminal or terminal emulation program as follows: Baud rate: 9600 to 115200 bps Data bits: 8 Parity: None Stop bits: 1 Flow control: None Note The port settings are for a DEC VT100 or ANSI terminal, or an equivalent terminal emulator program. 4. Press Enter. You are prompted for a user name and password. 5. To configure the switch settings, enter “manager” as the user name.
Chapter 2: Starting a Management Session The Main Menu is shown in Figure 3. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Main Menu 1 2 3 4 5 6 7 8 - Port Configuration VLAN Configuration Spanning Tree Configuration MAC Address Tables System Administration Advanced Configuration Security and Services Enhanced Stacking C - Command Line Interface Q - Quit Enter your selection? Figure 3.
AT-S63 Management Software Menus Interface User’s Guide Starting a Remote Management Session You can use the Telnet application from any workstation on your network to connect to an AT-9400 Series switch, as described in “Remote Connection” on page 37. When you make the connection and start the AT-S63 menus interface, you start a remote management session. To manage a switch using remote connection, it must have an IP address or be part of an enhanced stack.
Chapter 2: Starting a Management Session For information about the command line interface, refer to the AT-S63 Management Software Command Line Interface User’s Guide. 4. To use the menus interface, type menu and press Return. The Main Menu is shown in Figure 3 on page 46. To select a menu item, type the corresponding letter or number. To return to the command line interface, type C. When you press the Esc key or type the letter R in a submenu, the previous menu is redisplayed.
AT-S63 Management Software Menus Interface User’s Guide Saving Your Parameter Changes When you make a change to a switch parameter, the change is, in most cases, immediately activated on the switch as soon as you enter it. However, most parameter changes are initially saved only to temporary memory in the switch and will be lost the next time you reset or power cycle the unit. To permanently save your changes, you must select the S Save Configuration Changes option from the Main Menu.
Chapter 2: Starting a Management Session Ports 23R and 24R on the AT-9424T/GB, AT-9424T/SP, and AT-9424Ti/SP Series Switches This section applies to the twisted pair ports 23R and 24R and the SFP and GBIC slots on the AT-9424T/GB, AT-9424T/SP, and AT-9424Ti/SP Series switches. Note the following when configuring these ports: 50 Twisted pair ports 23R and 24R change to the redundant status mode when an SFP or GBIC module is installed and establishes a link with its end node.
Chapter 3 Basic Switch Parameters This chapter contains a variety of information and procedures for basic switch setup.
Chapter 3: Basic Switch Parameters When Does a Switch Need an IP Address? One of the tasks of building or expanding a network is deciding which managed switches need to be assigned a unique IP address. The rule was that a managed switch needed an IP address if you wanted to manage it remotely, such as with the Telnet application. However, if a network contained many managed switches, assigning each one an IP address was often cumbersome and time consuming.
AT-S63 Management Software Menus Interface User’s Guide How Do You Assign an IP Address? There are two ways that a switch can obtain an IP address. The first way is for you to assign the IP configuration information manually. The procedure for this is explained in “Configuring the IP Address, Switch Name, and Other Basic Parameters” on page 54. You can initially assign an IP address to a switch only through a local management session.
Chapter 3: Basic Switch Parameters Configuring the IP Address, Switch Name, and Other Basic Parameters The procedure in this section explains how to manually assign an IP address, subnet mask, and gateway address to the switch from a local or Telnet management session. (If you want the switch to obtain its IP configuration from a DHCP or BOOTP server on your network, go to the procedure “Activating the BOOTP or DHCP Client Software” on page 57.
AT-S63 Management Software Menus Interface User’s Guide The System Configuration menu is shown in Figure 5. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 System Configuration 1 2 3 4 5 6 7 8 - BOOTP/DHCP ............. IP Address ............. Subnet Mask ............ Default Gateway ........ System Name ............ Location ............... Administrator .......... Configure System Time Disabled 0.0.0.0 0.0.0.0 0.0.0.
Chapter 3: Basic Switch Parameters address must be entered in the format: xxx.xxx.xxx.xxx. The default value is 0.0.0.0. 5 - System Name This parameter specifies a name for the switch (for example, Sales Ethernet switch). The name is displayed at the top of the AT-S63 management menus and pages. The name can be from 1 to 39 characters. The name can include spaces and special characters, such as exclamation points and asterisks. The default is no name. This parameter is optional.
AT-S63 Management Software Menus Interface User’s Guide Activating the BOOTP or DHCP Client Software The BOOTP and DHCP protocols were developed to simplify network management. They are used to automatically assign IP configuration information to the devices on your network, such as an IP address, subnet mask, and a default gateway address. The AT-9400 Series switch contains the client software for these protocols and can obtain its IP configuration information from a BOOTP or DHCP server on your network.
Chapter 3: Basic Switch Parameters The following prompt is displayed: DHCP/BOOTP/DISABLE: (1-DHCP, 2-BOOTP, 3-DISABLE): 4. Type 1 to enable DHCP, 2 to enable BOOTP, or 3 to disable the services and press Return. The default is disabled. Note If you activated BOOTP or DHCP, the switch immediately begins to query the network for a BOOTP or DHCP server. The switch continues to query the network for its IP configuration until it receives a response.
AT-S63 Management Software Menus Interface User’s Guide Displaying the AT-9400 Series Switch Hardware and Software Information To display information about the switch hardware and software, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2. From the System Administration menu, type 1 to select System Information. The System Information menu is shown in Figure 6.
Chapter 3: Basic Switch Parameters Model Name Model name of the AT-9400 Series switch. You cannot change this setting. Subnet Mask Subnet mask assigned to the switch. To change the subnet mask, see “Configuring the IP Address, Switch Name, and Other Basic Parameters” on page 54. Serial Number Serial number of the switch. You cannot change this setting. Gateway Gateway assigned to the switch. To change the gateway, see “Configuring the IP Address, Switch Name, and Other Basic Parameters” on page 54.
AT-S63 Management Software Menus Interface User’s Guide Rebooting a Switch This procedure reboots the switch. Note Any configuration changes not saved are lost after the switch reboots. To save your configuration changes, return to the Main Menu and type S to select Save Configuration Changes. To reboot the switch, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2.
Chapter 3: Basic Switch Parameters 3. From the System Utilities menu, type 5 to select Reboot the switch. The following prompt is displayed: The switch is about to reboot. Do you want to proceed? [Yes/No] -> 4. Type Y to reboot the switch or N to cancel the procedure. Caution The switch does not forward traffic while it reloads its operating software, a process that takes approximately 20 seconds to complete. Some packet traffic may be lost.
AT-S63 Management Software Menus Interface User’s Guide Changing the Manager and Operator Passwords There are two levels of management access on an AT-94xx switch: manager and operator. When you log in as manager, you can view and configure all of a switch’s operating parameters. When you log in as an operator, you can only view the operating parameters; you cannot change any values.
Chapter 3: Basic Switch Parameters 3. From the Authentication Configuration menu, type 5 to select Passwords Configuration. The Passwords Configuration menu is shown in Figure 9. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Passwords Configuration 1 - Set Manager Password 2 - Set Operator Password R - Return to Previous Menu Enter your selection? Figure 9. Passwords Configuration Menu 4.
AT-S63 Management Software Menus Interface User’s Guide 9. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. Resetting the Manager Password If you change the manager password from the default and lose or forget it, you can reset the password. Note the following about this feature: You must perform this procedure from a local management session.
Chapter 3: Basic Switch Parameters management session. You must use the new password the next time you log on to the switch at the start of a management session.
AT-S63 Management Software Menus Interface User’s Guide Setting the System Time This procedure explains how to set the switch’s date and time. Setting the system time is important if you configured the switch to send traps to your management stations. Traps from a switch where the time has not been set do not contain the correct date and time. Therefore, it becomes difficult for you to determine when the events represented by the traps occurred.
Chapter 3: Basic Switch Parameters The Configure System Time menu is shown in Figure 10. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Configure System Time 1 2 3 4 5 6 7 - System Time ................... SNTP Status ................... SNTP Server ................... UTC Offset .................... Daylight Savings Time (DST) ... Poll Interval ................. Last Delta .................... 00:00:00 on 01-Jan-1970 Disabled 0.0.0.
AT-S63 Management Software Menus Interface User’s Guide 3. From the System Configuration menu, type 8 to select Configure System Time. The Configure System Time menu is shown in Figure 10 on page 68. 4. Type 3 to select SNTP Server to enter the IP address of an SNTP server. Note If the switch is obtaining its IP address and subnet mask from a DHCP server, you can configure the DHCP server to provide the switch with an IP address of an NTP or SNTP server.
Chapter 3: Basic Switch Parameters Note The switch does not set DST automatically. If the switch is in a locale that uses DST, you must remember to enable this in April when DST begins and disable it in October when DST ends. If the switch is in a locale that does not use DST, this option should be set to disabled all the time. 10. Type 6 to select Poll Interval to specify the time interval between queries to the SNTP server.
AT-S63 Management Software Menus Interface User’s Guide Configuring the Console Startup Mode You can configure the AT-S63 management software to display either the Main Menu or the command line interface prompt whenever you start a local or Telnet management session. The default is the command line interface. To change the console startup mode, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2.
Chapter 3: Basic Switch Parameters Configuring the Console Timer The AT-S63 management software uses the console timer, also referred to as the console disconnect interval, to automatically end inactive local and remote management sessions. A management session is automatically ended if the management software does not detect any activity from a local or remote management station after the console timer has expired.
AT-S63 Management Software Menus Interface User’s Guide Configuring the Telnet Server This procedure describes how to enable and disable the Telnet server on the switch. You might disable the server to prevent individuals from managing the switch with a Telnet application or if you intend to use the Secure Shell (SSH) protocol. This procedure also explains how to toggle the Telnet server on the switch so that is adds a NULL character after each CR.
Chapter 3: Basic Switch Parameters Setting the Baud Rate of the Serial Terminal Port The default baud rate of the RJ-45 type serial terminal port on the switch is 9600 bps. To change the baud rate, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2. From the System Administration menu, type 3 to select Console (Serial/Telnet) Configuration.
AT-S63 Management Software Menus Interface User’s Guide Pinging a Remote System You can instruct the switch to ping a remote device on your network. This procedure is useful in determining whether a valid link exists between the switch and another device. Note To perform this procedure, the switch must have an IP address. To instruct the switch to ping a network device, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration.
Chapter 3: Basic Switch Parameters Returning the AT-S63 Management Software to the Factory Default Values The procedure in this section returns all AT-S63 management software parameters to the default values. Please note the following before you perform this procedure: Returning all parameter settings to their default values also deletes any port-based or tagged VLANs you created on the switch. This procedure does not delete files from the AT-S63 file system.
AT-S63 Management Software Menus Interface User’s Guide If you respond with yes, the following prompt is displayed: Do you want to reset static IP, Subnet and Gateway? [Yes/No] -> 5. If you type Y for yes, all switch parameters including the IP address, subnet mask, and gateway address are changed to the default values. If you type N for no, all switch parameters excluding the IP address, subnet mask, and gateway address are changed to the default values.
Chapter 3: Basic Switch Parameters Displaying System Hardware Information You can view information about the system hardware, including details about the fans and temperature settings. To display the system hardware information, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2.
AT-S63 Management Software Menus Interface User’s Guide The System Hardware Information menu provides the following information: System 1.25 V Power System 1.8V Power System 2.5 V Power System 3.3 V Power System 5 V Power System 12 V Power The current voltage of the six power supplies in the switch. System Temperature (Celsius) The overall system temperature. System Fan Speed The system fan speed. Main PSU RPS The status of the main power supply unit (PSU) and the redundant power supply (RPS).
Chapter 3: Basic Switch Parameters Displaying Uplink Port Information To display the information about the GBIC or SFP transceivers installed in the uplink ports, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2. From the System Administration menu, type 1 to select System Information The System Information menu is shown in Figure 6 on page 59. 3.
AT-S63 Management Software Menus Interface User’s Guide 4. Type the number corresponding to the slot where the transceiver is identified as “Present” to view detailed information about that transceiver. The information displayed depends upon the transceiver vendor and whether the slot contains an SFP or a GBIC transceiver. The GBIC/SFP Information menu (page 1) is displayed. Figure 14 shows some possible fields for an SFP.
Chapter 3: Basic Switch Parameters The GBIC/SFP Information menu (page 2) is displayed. Figure 15 shows some possible fields of information. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 GBIC/SFP 2 Information Vendor Name ............................ Vendor OUI ............................. Vendor Part Number ..................... Vendor Product Revision ................ Vendor Serial Number ................... Upper Bit Rate Margin ..................
Chapter 4 Enhanced Stacking This chapter explains the enhanced stacking feature.
Chapter 4: Enhanced Stacking Enhanced Stacking Overview The enhanced stacking feature can make it easier for you to manage the AT-9400 Series switches in your network. It offers the following benefits: Enhanced Stacking Guidelines You can manage up to 24 switches from one local or remote management session. This eliminates the need of having to initiate a separate management session with each switch in your network. The switches can share the same IP address.
AT-S63 Management Software Menus Interface User’s Guide There are three basic tasks to implementing this feature on your network: You must select a switch in each subnet of your network to function as the master switch of the enhanced stack for that subnet. The master switch can be any switch that supports enhanced stacking, such as an AT-8000 Series, AT-8400 Series, AT-8500 Series, or AT-9400 Series switch.
Chapter 4: Enhanced Stacking Figure 16 is an example of the enhanced stacking feature. Master 1 IP Address 149.32.11.
AT-S63 Management Software Menus Interface User’s Guide Setting a Switch’s Enhanced Stacking Status The enhanced stacking status of the switch can be master switch, slave switch, or unavailable. Each status is described below: Master switch - A master switch of a stack can be used to manage all the other switches in a subnet. After you establish a local or remote management session with the master switch, you can access and manage all the switches in the subnet.
Chapter 4: Enhanced Stacking The Enhanced Stacking menu is shown in Figure 17. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Enhanced Stacking 1 - Switch State-(M)aster/(S)lave/(U)navailable.... Master 2 - Stacking Services R - Return to Previous Menu Enter your selection? Figure 17. Enhanced Stacking Menu The menu displays the current status of the switch at the end of selection “1 - Switch State.
AT-S63 Management Software Menus Interface User’s Guide Selecting a Switch in an Enhanced Stack Before you perform a procedure on a switch in an enhanced stack, you should first check to be sure that you are performing it on the correct switch. If you assigned system names to your switches, this should be easy. The name of the switch being managed is always displayed at the top of every management menu.
Chapter 4: Enhanced Stacking 3. From the Stacking Services menu, type 1 to select Get/Refresh List of Switches. The master switch polls the subnet for all slave and master switches that are a part of the enhanced stack and displays a list of the switches in the Stacking Services menu, as shown in the example in Figure 19.
AT-S63 Management Software Menus Interface User’s Guide 5. Type the number of the switch in the list you want to manage. A prompt is displayed if the switch has been assigned a password. 6. Enter the appropriate username and password for the switch. The Main Menu of the selected switch is displayed. You now can manage the switch. Any management tasks you perform effect only the selected switch.
Chapter 4: Enhanced Stacking Returning to the Master Switch When you have finished managing a slave switch, return to the Main Menu of the slave switch and type Q for Quit. This returns you to the Stacking Services menu. After you see that menu, you are again addressing the master switch from which you started the management session. You can either select another switch in the list to manage or, if you want to manage the master switch, type R twice to return to the master switch’s Main Menu.
AT-S63 Management Software Menus Interface User’s Guide Displaying the Enhanced Stacking Status To view the stacking status of a switch in a stack, perform the following procedure: 1. From the Main Menu, type 8 to select Enhanced Stacking. The Enhanced Stacking menu is shown in Figure 20. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Enhanced Stacking 1 - Switch State-(M)aster/(S)lave/(U)navailable....
Chapter 4: Enhanced Stacking 94 Section I: Basic Operations
Chapter 5 SNMPv1 and SNMPv2c This chapter explains how to activate SNMP management on the switch and how to create, modify, and delete SNMPv1 and SNMPv2c community strings.
Chapter 5: SNMPv1 and SNMPv2c SNMPv1 and SNMPv2c Overview The Simple Network Management Program (SNMP) is another way for you to manage the switch. This type of management involves viewing and changing the management information base (MIB) objects on the device using an SNMP application program. The AT-S63 management software supports SNMPv1, SNMPv2c, and SNMPv3. This chapter explains how to configure the switch’s software for SNMPv1 and SNMPv2c.
AT-S63 Management Software Menus Interface User’s Guide string with an access mode of Read can only be used to view but not change the MIB objects on a switch. A community string with a Read/Write access can be used to both view the MIB objects and change them. Operating Status A community string can be enabled or disabled. When disabled, no one can use it to access the switch. You might disable a community string if you suspect someone is using it for unauthorized access to the device.
Chapter 5: SNMPv1 and SNMPv2c Default SNMP Community Strings 98 The AT-S63 management software provides two default community strings: public and private. The public string has an access mode of just Read and the private string has an access mode of Read/Write. If you activate SNMP management on the switch, you should delete or disable the private community string, which is a standard community string in the industry, or change its status from open to closed to prevent unauthorized changes to the switch.
AT-S63 Management Software Menus Interface User’s Guide Enabling or Disabling SNMP Management To enable or disable SNMP management for the switch, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2. From the System Administration menu, type 5 to select SNMP Configuration. The SNMP Configuration menu is shown in Figure 21.
Chapter 5: SNMPv1 and SNMPv2c Setting the Authentication Failure Trap As mentioned in the SNMP Overview section in this chapter, a trap is a message sent by the switch to a management workstation or server to signal an operating event, such as when the device is reset. An authentication failure trap is similar to other the traps. It too signals an operating event on the switch. But this trap is somewhat special because it relates to SNMP management.
AT-S63 Management Software Menus Interface User’s Guide Creating an SNMP Community String To create a new SNMP community string, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2. From the System Administration menu, type 5 to select SNMP Configuration. The SNMP Configuration menu is shown in Figure 21 on page 99. 3.
Chapter 5: SNMPv1 and SNMPv2c The following prompt is displayed: Enter Access Mode [R-Read Only, W-Read/Write]: 6. Specify the access mode for the new SNMP community string. If you specify Read, the community string will only allow you to view the MIB objects on the switch. If you specify Read/Write, the community string will allow you to both view and change the SNMP MIB objects on the switch. The following prompt is displayed: Enter Open Access Status [Y-Yes, N-No]: 7. Specify the open access status.
AT-S63 Management Software Menus Interface User’s Guide 11. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes.
Chapter 5: SNMPv1 and SNMPv2c Modifying a Community String To modify a community string, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2. From the System Administration menu, type 5 to select SNMP Configuration. The SNMP Configuration menu is shown in Figure 21 on page 99. 3. From the SNMP Configuration menu, type 3 to select Configure SNMPv1 &SNMPv2c Community.
AT-S63 Management Software Menus Interface User’s Guide The menu options are described below: 1 - Add Attributes to Community If a community string has a closed access mode, you can use this selection to add new IP addresses of management workstations that can use the string. You can also use this option to add IP addresses of new trap receivers. To use this option, do the following: a. From the Modify SNMP Community menu, type 1 to select Add Attributes to Community.
Chapter 5: SNMPv1 and SNMPv2c Enter SNMP Manager IP Addr: c. If you want to remove the IP address of a management workstation from the community string, enter the IP address at the prompt. Otherwise, just press Return. This prompt is displayed: Enter Trap Receiver IP Addr: d. If you want to remove the IP address of a trap receiver from the community string, enter the IP address at the prompt. Otherwise, just press Return. e. After making changes, type R until you return to the Main Menu.
AT-S63 Management Software Menus Interface User’s Guide Enter Community Status [E-Enable, D-Disable]: c. Type E to enable the community string or D to disable it. This confirmation prompt is displayed: Do you want to change Community Status? (Y/N): [Yes/No] -> d. Type Y to change the string’s status or N to cancel the change. e. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes.
Chapter 5: SNMPv1 and SNMPv2c Deleting a Community String To delete an SNMPv1 or SNMPv2c community string, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2. From the System Administration menu, type 5 to select SNMP Configuration. The SNMP Configuration menu is shown in Figure 21 on page 99. 3. From the SNMP Configuration menu, type 3 to select Configure SNMPv1 &SNMPv2c Community.
AT-S63 Management Software Menus Interface User’s Guide Displaying the SNMP Community Strings To display the attributes of all the SNMP community strings on the switch, use the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2. From the System Administration menu, type 5 to select SNMP Configuration. The SNMP Configuration menu is shown in Figure 21 on page 99. 3.
Chapter 5: SNMPv1 and SNMPv2c 110 Section I: Basic Operations
Chapter 6 Port Parameters This chapter contains the procedures for viewing and changing the parameter settings for the individual ports on a switch, and contains the following procedures: Section I: Basic Operations “Configuring Port Parameters” on page 112 “Configuring Head of Line Blocking” on page 117 “Configuring Flow Control and Back Pressure” on page 119 “Configuring Port Filtering” on page 121 “Setting Up Rate Limiting” on page 123 “Resetting a Port” on page 125 “Forcin
Chapter 6: Port Parameters Configuring Port Parameters To configure the most basic parameter settings for a port, perform the following procedure: 1. From the Main Menu, type 1 to select Port Configuration. The Port Configuration menu is shown in Figure 25.
AT-S63 Management Software Menus Interface User’s Guide The Port Configuration menu is shown in Figure 26. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Port Configuration Configuring Port 11 0 1 2 3 4 5 6 X F D - Description ........................ Status ............................. HOL Blocking Prevention Threshold .. Flow Control Filtering Rate Limiting Negotiation ........................
Chapter 6: Port Parameters You might also want to disable a port that is not being used to secure it from unauthorized connections. Possible settings for this parameter are: Enabled - The port receives and forwards packets. This is the default setting. Disabled - The port does not receive or forward packets. Note Option 2, HOL Blocking Prevention, is described in “Configuring Head of Line Blocking” on page 117.
AT-S63 Management Software Menus Interface User’s Guide To avoid this problem when connecting an end node with a fixed duplex mode of full-duplex to a switch port, disable AutoNegotiation on the port and set the port’s speed and duplex mode manually. When a twisted pair port is set to Auto-Negotiation, the MDI/MDI-X setting for the port is locked at auto-MDI/MDI-X. The switch automatically determines the correct MDI/MDI-X setting. You cannot set MDI/MDI-X manually.
Chapter 6: Port Parameters When a port is using Auto-Negotiation to set its speed and duplex mode, the only available setting for this item is Auto. The port automatically sets its MDI/MDI-X setting. If you disable Auto-Negotiation on a port and set a port’s speed and duplex mode manually, the auto-MDI/MDI-X feature is also disabled. A port where autonegotiation has been disabled defaults to MDI-X.
AT-S63 Management Software Menus Interface User’s Guide Configuring Head of Line Blocking Head of line (HOL) blocking is a problem that occurs when a port on a switch becomes oversubscribed. An oversubscribed port is receiving more packets from other switch ports than it can transmit in a timely manner. An oversubscribed port can prevent other ports from forwarding packets to each other because ingress packets on a port are buffered in a First In, First Out (FIFO) manner.
Chapter 6: Port Parameters other ports to discard packets destined for port D. Port A drops the D packets, enabling it to once again forward packets to port C. The number that you enter for this value represents cells. A cell is 128 bytes. The range is 0 to 8191 cells. The default is 682. To set up head of line blocking, perform the following procedure: 1. From the Main Menu, type 1 to select Port Configuration. The Port Configuration menu is shown in Figure 25 on page 112. 2.
AT-S63 Management Software Menus Interface User’s Guide Configuring Flow Control and Back Pressure A switch port uses flow control to control the flow of ingress packets from its end node when operating in full-duplex mode. A port using flow control issues a special frame, referred to as a PAUSE frame, as specified in the IEEE 802.3x standard, to stop the transmission of data from an end node. When a port needs to stop an end node from transmitting data, it issues this frame.
Chapter 6: Port Parameters 4. From the Port Configuration menu, type 3 to select Flow Control. The Flow Control menu is shown in Figure 28. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Flow Control Configuring Port 11 1 - Flow Control (Full-Duplex) Status .... Disabled 2 - Flow Control Threshold ............... 7935 cells 3 - Back Pressure (Half-Duplex) Status ... Disabled 4 - Back Pressure Threshold ..............
AT-S63 Management Software Menus Interface User’s Guide Configuring Port Filtering If the performance of your network is affected by heavy traffic, you can use these parameters to restrict ingress and egress broadcast packets as well as unknown unicast and multicast packets forwarded by a port. Activating this feature on a port causes the port to discard all packets of the type you specified.
Chapter 6: Port Parameters 5. From the Filtering menu, type 1 to toggle Unknown Unicast Ingress Filtering between Disabled and Enabled. 6. Type 2 to toggle Unknown Unicast Egress Filtering between Disabled and Enabled. 7. Type 3 to toggle Unknown Multicast Ingress Filtering between Disabled and Enabled. 8. Type 4 to toggle Unknown Multicast Egress Filtering between Disabled and Enabled. 9. Type 5 to toggle Broadcast Ingress Filtering between Disabled and Enabled. 10.
AT-S63 Management Software Menus Interface User’s Guide Setting Up Rate Limiting The rate limiting feature allows you to set the maximum number of ingress packets the port accepts each second. Packets exceeding the threshold are discarded. You can enable rate limiting and set a rate independently for unknown unicast, multicast, and broadcast packets. To set rate limiting, perform the following procedure: 1. From the Main Menu, type 1 to select Port Configuration.
Chapter 6: Port Parameters The following prompt is displayed: Enter the Rate Limit (packets/second):[0 to 262143]-> 7. Enter a number for the rate limit. 8. Type 3 to toggle Multicast Rate Limiting Status between Enabled and Disabled. 9. Type 2 to select Multicast Rate. The following prompt is displayed: Enter the Rate Limit (packets/second):[0 to 262143]-> 10. Enter a number for the rate limit. 11. Type 3 to toggle Multicast Rate Limiting Status between Enabled and Disabled. 12.
AT-S63 Management Software Menus Interface User’s Guide Resetting a Port Resetting a port is useful in situations where a port is having problems establishing a valid connection to its end node. Resetting a port does not change any of its parameter settings. To reset a port, perform the following procedure: 1. From the Main Menu, type 1 to select Port Configuration. The Port Configuration menu is shown in Figure 25 on page 112. 2. From the Port Configuration menu, type 1 to select Port Configuration.
Chapter 6: Port Parameters Forcing Port Renegotiation Port renegotiation prompts a port operating in Auto-Negotiation to renegotiate its speed and duplex mode with its end node. This option is useful if you believe that a port and end node are not operating at the same speed and duplex mode. To force port renegotiation, perform the following procedure: 1. From the Main Menu, type 1 to select Port Configuration. The Port Configuration menu is shown in Figure 25 on page 112. 2.
AT-S63 Management Software Menus Interface User’s Guide Resetting the Port Configuration to the Defaults You can return the parameters settings of a port to the default values. To reset a port’s settings to the default settings, perform the following procedure: 1. From the Main Menu, type 1 to select Port Configuration. The Port Configuration menu is shown in Figure 25 on page 112. 2. From the Port Configuration menu, type 1 to select Port Configuration.
Chapter 6: Port Parameters Displaying Port Statistics To display Ethernet port statistics, perform the following procedure: 1. From the Main Menu, type 1 to select Port Configuration. The Port Configuration menu is shown in Figure 25 on page 112. 2. From the Port Configuration menu, type 3 to select Port Statistics. The Port Statistics menu is shown in Figure 31.
AT-S63 Management Software Menus Interface User’s Guide The Display Port Statistics menu is shown in Figure 32. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Display Port Statistics Port 6 Bytes Rx ......... Frames Rx ........ Bcast Frames Rx... Mcast Frames Rx .. Frames 64 ........ Frames 128-255 ... Frames 512-1023 .. CRC Error ........ No. of Rx Errors . UnderSize Frames . Fragments ........ Frames 1519-1522 .
Chapter 6: Port Parameters Frames 64 Frames 65-127 Frames 128-255 Frames 256-511 Frames 512-1023 Frames 1024-1518 Frames 1519-1522 Number of frames transmitted from the port, grouped by size. CRC Error Number of frames with a cyclic redundancy check (CRC) error but with the proper length (64-1518 bytes) received on the port. Jabber Number of occurrences of corrupted data or useless signals appearing on the port. No. of Rx Errors Number of receive errors. No. of Tx Errors Number of transmit errors.
AT-S63 Management Software Menus Interface User’s Guide Clearing Port Statistics To clear the Ethernet port statistics and reset them to “0”, perform the following procedure: 1. From the Main Menu, type 1 to select Port Configuration. The Port Configuration menu is shown in Figure 25 on page 112. 2. From the Port Configuration menu, type 3 to select Port Statistics. The Port Statistics menu is shown in Figure 31 on page 128. 3. Type 2 to select Clear Statistics.
Chapter 6: Port Parameters Displaying Port Status To display the current status of the ports on the switch, perform the following procedure: 1. From the Main Menu, type 1 to select Port Configuration. The Port Configuration menu is shown in Figure 25 on page 112. 2. From the Port Configuration menu, type 2 to select Port Status. An example of the Port Status menu is shown in Figure 33.
AT-S63 Management Software Menus Interface User’s Guide Up - Indicates that a valid link exists between the port and the end node. Down - Indicates that the port and the end node have not established a valid link. Neg The status of Auto-Negotiation on the port. Possible values are: Auto - Indicates that the port is using Auto-Negotiation to set operating speed and duplex mode. Manual - Indicates that the operating speed and duplex mode have been set manually. MDIO The operating configuration of the port.
Chapter 6: Port Parameters 134 Section I: Basic Operations
Chapter 7 MAC Address Table This chapter contains the procedures for viewing the static and dynamic MAC address table. It also explains how to add static MAC addresses to the table.
Chapter 7: MAC Address Table MAC Address Overview The AT-9400 Series switch contains a MAC address table with a storage capacity of 16,000 entries. The switch uses the table to store the MAC addresses of the network nodes connected to its ports, along with the port number on which each address was learned. The switch learns the MAC addresses of the end nodes by examining the source address of each packet received on a port.
AT-S63 Management Software Menus Interface User’s Guide MAC address table from becoming filled with addresses of nodes that are no longer active. The period of time that the switch waits before purging an inactive dynamic MAC address is called the aging time. This value is adjustable on the AT-9400 Series switch. The default value is 300 seconds (5 minutes). For instructions on changing the aging timer, refer to “Changing the Aging Time” on page 146.
Chapter 7: MAC Address Table Displaying the MAC Address Tables The AT-S63 management software has two menu selections for displaying the MAC addresses of a switch. One selection displays the static and dynamic unicast MAC addresses while the other displays the static and dynamic multicast addresses. To display the MAC address tables, perform the following procedure: 1. From the Main Menu, type 4 to select MAC Address Tables. The MAC Address Tables menu is shown in Figure 34.
AT-S63 Management Software Menus Interface User’s Guide Choose one of the following display types. 1 - Display All This selection displays all dynamic addresses learned on the ports of the switch and all static addresses that have been assigned to the ports. An example of a unicast MAC address table is shown in Figure 36.
Chapter 7: MAC Address Table An example of a multicast MAC address table is shown in Figure 37. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Display All Page 1 Total Number of MCAST MAC Addresses: 1 MAC Address VLANID Type Port Maps (U:Untagged T:Tagged) ---------------------------------------------------------------01:00:51:00:00:01 1 Static U:1-4 T: U - Update Display R - Return to Previous Menu Enter your selection? Figure 37.
AT-S63 Management Software Menus Interface User’s Guide 5 - Display Specified MAC This selection displays the port number on which a MAC address was assigned or learned. If you want to know on which port a particular MAC address was learned, you can display the MAC address table and scroll through the list looking for the MAC address. But if the switch is part of a large network, finding the address could prove difficult.
Chapter 7: MAC Address Table Adding Static Unicast and Multicast MAC Addresses This section contains the procedure for adding static unicast and multicast MAC addresses to the switch. You can assign up to 255 static addresses per port on an AT-9400 Series switch. To add a static MAC address, perform the following procedure: 1. From the Main Menu, type 4 to select MAC Address Tables. The MAC Address Tables menu is shown in Figure 34 on page 138. 2.
AT-S63 Management Software Menus Interface User’s Guide 5. Enter the number of the port on the switch where you want to assign the static address. If you are adding a static unicast address, you can specify only one port. If you are entering a static multicast address, you must specify the port when the multicast application is located as well as the ports where the host nodes are connected.
Chapter 7: MAC Address Table Deleting Unicast and Multicast MAC Addresses To delete a dynamic or static unicast or multicast address from the MAC address table, perform the following procedure: 1. From the Main Menu, type 4 to select MAC Address Tables. The MAC Address Tables menu is shown in Figure 34 on page 138. 2. From the MAC Address Tables menu, type 2 to select MAC Addresses Configuration. The MAC Addresses Configuration menu is shown in Figure 38 on page 142. 3.
AT-S63 Management Software Menus Interface User’s Guide Deleting All Dynamic MAC Addresses To delete all dynamic unicast and multicast MAC address from the MAC address table, perform the following procedure: 1. From the Main Menu, type 4 to select MAC Address Tables. The MAC Address Tables menu is shown in Figure 34 on page 138. 2. From the MAC Address Tables menu, type 2 to select MAC Addresses Configuration. The MAC Addresses Configuration menu is shown in Figure 38 on page 142. 3.
Chapter 7: MAC Address Table Changing the Aging Time The switch uses the aging time to delete inactive dynamic MAC addresses from the MAC address table. When the switch detects that no packets have been sent to or received from a particular MAC address in the table after the period specified by the aging time, the switch deletes the address. This prevents the table from becoming full of addresses of nodes that are no longer active. The default setting for the aging time is 300 seconds (5 minutes).
Chapter 8 Static and LACP Port Trunks This chapter contains the procedures for creating, modifying, and deleting static and LACP port trunks.
Chapter 8: Static and LACP Port Trunks Port Trunk Overview A port trunk is an economical way for you to increase the bandwidth between the Ethernet switch and another networking device, such as a network server, router, workstation, or another Ethernet switch. A port trunk is a group of ports that have been grouped together to function as one logical path.
AT-S63 Management Software Menus Interface User’s Guide manufacturer. For this reason static trunks are typically employed only between devices from the same vendor. That is not to say that an Allied Telesyn layer 2 managed switch cannot form a static trunk with a device from another manufacturer. But there is the possibility that the implementations of static trunking on the two devices might not be compatible. Also note that a static trunk does not provide for redundancy or link backup.
Chapter 8: Static and LACP Port Trunks LACP Trunk Overview The ports of a static trunk must be untagged members of the same VLAN. A trunk cannot consist of untagged ports from different VLANs. The switch selects the lowest numbered port in the trunk to handle broadcast packets and packets of unknown destination. For example, a trunk of ports 11 to 15 would use port 11 for broadcast packets. An LACP (Link Aggregation Control Protocol) trunk is another type of port trunk.
AT-S63 Management Software Menus Interface User’s Guide However, it does continue to send LACPDU packets. If it begins to receive LACPDU packets, it automatically transitions to an active or standby mode as part of an aggregate trunk. If a switch is to support more than one aggregate trunk, it may be necessary to place each trunk in a separate aggregator, while in other cases you may be able to create just one aggregator and let the switch discern the individual aggregate trunks for you, automatically.
Chapter 8: Static and LACP Port Trunks Caution The example cited here illustrates a loop in a network. Avoid network loops to prevent broadcast storms. If the aggregate trunks go to different devices, you can create one aggregator and let the AT-9400 Series switch form the trunks for you automatically. This is illustrated in Figure 41. The ports of the two aggregate trunks on the AT-9400 Series switch are members of the same aggregator.
AT-S63 Management Software Menus Interface User’s Guide LACP System Priority It is possible for two devices interconnected by an aggregate trunk to encounter a conflict when they form a trunk. For example, the two devices might not support the same number of active ports in an aggregate trunk or might not agree on which ports are to be active and which are to be in standby.
Chapter 8: Static and LACP Port Trunks in an aggregate trunk. For example, if both 802.3ad-compliant devices support up to eight active ports and there are a total of ten ports in the trunk, the eight ports with the lowest priority settings are designated as the active ports, and the others are placed in standby mode. If an active link goes down on a active port, the standby port with the highest priority is automatically activated to take its place.
AT-S63 Management Software Menus Interface User’s Guide LACP Trunk Guidelines Following are the guidelines for creating aggregators: Section I: Basic Features LACP must be activated on both the switch and the other device. The other device must be 802.3ad-compliant. An aggregator can consist of any number of ports. The AT-9400 Series switch supports up to eight active ports in an aggregate trunk at a time. The switch supports a maximum of three aggregate trunks.
Chapter 8: Static and LACP Port Trunks Load Distribution Methods When creating a new aggregator, you can specify either a name for the aggregator or an adminkey, but not both. If you specify a name, the adminkey is based on the operator key of the lowest numbered port in the aggregator. If you specify an adminkey, the default name is DEFAULT_AGG followed by the port number of the lowest numbered port in the aggregator.
AT-S63 Management Software Menus Interface User’s Guide As an example, assume you created a static or LACP aggregate trunk of Ports 7 to 14 on a switch. The table below shows the mappings of the switch ports to the possible values of the last three bits of a MAC or IP address.
Chapter 8: Static and LACP Port Trunks The load distribution methods assume that the final three bits of the source and/or destination addresses of the packets from the network nodes are varied enough to support adequate distribution of the packets over the trunk ports. A lack of variation can result in one or more ports in a trunk being used more than others, with the potential loss of a trunk’s efficiency and performance.
AT-S63 Management Software Menus Interface User’s Guide Managing Static Port Trunks The following procedures explain how to create, modify, and delete static port trunks: “Creating a Static Port Trunk,” next “Modifying a Static Port Trunk” on page 162 “Deleting a Static Port Trunk” on page 164 For background information, refer to “Static Port Trunk Overview” on page 148. Creating a Static Port Trunk This section contains the procedure for creating a static port trunk on a switch.
Chapter 8: Static and LACP Port Trunks The Port Trunking and LACP menu is shown in Figure 42. Allied Telesyn Ethernet Switch AT-9400 Series - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Port Trunking and LACP 1 - Static Port Trunking 2 - LACP Configuration R - Return to Previous Menu Enter your selection? Figure 42. Port Trunking and LACP Menu 3. From the Port Trunking and LACP menu, type 1 to select Static Port Trunking. The Static Port Trunking menu is shown in Figure 43.
AT-S63 Management Software Menus Interface User’s Guide The Create Trunk menu is shown in Figure 44. Allied Telesyn Ethernet Switch AT-9400 Series - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Create Trunk 1 2 3 4 - Trunk Trunk Trunk Trunk ID ......... 1 Name ....... Method ..... SRC/DST MAC Ports ...... C - Create Trunk R - Return to Previous Menu Enter your selection? Figure 44. Create Trunk Menu 5. Configure the following parameters as necessary: 1 - Trunk ID Specifies the trunk ID.
Chapter 8: Static and LACP Port Trunks 6. Type C to select Create Trunk. The port trunk is now active on the switch. 7. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. 8. Configure the ports on the remote switch for port trunking. 9. Connect the cables to the ports of the trunk on the switch. The port trunk is ready for network operations.
AT-S63 Management Software Menus Interface User’s Guide 3. From the Port Trunking and LACP menu, type 1 to select Static Port Trunking. The Static Port Trunking menu is shown in Figure 43 on page 160. 4. Type M to select Modify Trunk. The following prompt is displayed: Enter Trunk ID: [1 to 6] -> 5. Enter the ID number of the trunk you want to modify. The Modify Trunk menu is displayed. The menu displays the operating specifications of the selected trunk. An example is shown in Figure 45.
Chapter 8: Static and LACP Port Trunks SRC/DST MAC - Source address /destination MAC address SRC IP - Source IP address trunking DST IP - Destination IP address trunking SRC/DST IP - Source address /destination IP address The default is SRC/DST MAC. For background information, refer to “Load Distribution Methods” on page 156. 4 - Port Range Specifies the ports of the trunk. A trunk can contain up to eight ports.
AT-S63 Management Software Menus Interface User’s Guide The following prompt is displayed: Enter Trunk ID: [1 to 6] -> 5. Enter the ID number of the trunk to be deleted. The following prompt is displayed: Are you sure you want to delete this trunk (Y/N) [Yes/No] -> 6. Type Y for yes to delete the port trunk or N for no to cancel this procedure. The port trunk is deleted from the switch. 7. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes.
Chapter 8: Static and LACP Port Trunks Managing LACP Port Trunks The following procedures explain how to create and manage LACP trunks: “Enabling or Disabling LACP,” next “Setting the LACP System Priority” on page 167 “Creating an Aggregator” on page 168 “Modifying an Aggregator” on page 171 “Deleting an Aggregator” on page 173 “Configuring LACP Port Parameters” on page 174 “Displaying LACP Port and Aggregator Status” on page 175 For background information, refer to “LACP Trunk
AT-S63 Management Software Menus Interface User’s Guide The LACP (IEEE 8023ad) Configuration menu is shown in Figure 46. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 LACP (IEEE 802.3ad) Configuration 1 2 3 4 5 6 7 8 - LACP Status ................ Disabled Priority ...................
Chapter 8: Static and LACP Port Trunks 4. Type 2 to select Priority. The following prompt is displayed: Enter Priority [0x1 - 0xFFFF]: [0x1 to 0xffff] -> 0x 5. Enter the new value is hexadecimal. The range is 1 to FFFF. The lower the value, the higher the priority. The prefix “0x” indicates that the number is hexadecimal. The new priority value takes effect immediately on the switch. 6. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes.
AT-S63 Management Software Menus Interface User’s Guide The Create LACP (IEEE 8023ad) Aggregator menu is shown in Figure 47. Allied Telesyn Ethernet Switch AT-9400 Series - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Create LACP (IEEE 802.3ad) Aggregator 1 2 3 4 C - Aggregator .................. Adminkey .................... 0x0000 Distribution Mode ........... SRC/DST MAC Port Range .................. Create Aggregator R - Return to Previous Menu Enter your selection? Figure 47.
Chapter 8: Static and LACP Port Trunks 3 - Distribution Mode Sets the load distribution method. Possible settings are: SRC MAC - Source MAC address DST MAC - Destination MAC address SRC/DST MAC - Source address /destination MAC address SRC IP - Source IP address trunking DST IP - Destination IP address trunking SRC/DST IP - Source address /destination IP address The default is SRC/DST MAC. For background information, refer to “Load Distribution Methods” on page 156.
AT-S63 Management Software Menus Interface User’s Guide Modifying an Aggregator This procedure explains how to modify an aggregator. You can change an aggregator’s name, adminkey, or load distribution method. You can also use this procedure to add or remove ports. To modify an aggregator, you need to know its name or adminkey key. It is recommended that you review the section “LACP Trunk Guidelines” on page 155 before modifying an aggregator.
Chapter 8: Static and LACP Port Trunks The Modify LACP (IEEE 8023ad) Aggregator menu is shown in Figure 48. Allied Telesyn Ethernet Switch AT-9400 Series - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Modify LACP (IEEE 802.3ad) Aggregator 1 2 3 4 M - Aggregator .................. Adminkey .................... 0x0000 Distribution Mode ........... SRC/DST MAC Port Range .................. Modify Aggregator R - Return to Previous Menu Enter your selection? Figure 48.
AT-S63 Management Software Menus Interface User’s Guide SRC IP - Source IP address trunking DST IP - Destination IP address trunking SRC/DST IP - Source address /destination IP address The default is SRC/DST MAC. For background information, refer to “Load Distribution Methods” on page 156. 4 - Port Range Specifies the aggregator ports. An aggregator can contain any number of ports on the switch.
Chapter 8: Static and LACP Port Trunks The following prompt is displayed: Enter Aggregator Name [Max up to 20 alphanumeric characters]: 5. Enter the name of the aggregator you want to delete. The name is case-sensitive. You can delete only one aggregator at a time. Are you sure you want to delete this aggregator (Y/N) [Yes/No] -> 6. Type Y to delete the aggregator or N to cancel the procedure. If you entered Yes, the aggregator is deleted.
AT-S63 Management Software Menus Interface User’s Guide The Modify LACP (IEEE 8023ad) Aggregator menu is shown in Figure 49. Allied Telesyn Ethernet Switch AT-9400 Series - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 LACP (IEEE 802.3ad) Port Configuration 1 2 3 4 M - Port Number ................. 0 Adminkey .................... 0x0000 Priority .................... 0x0000 Aggregator .................. Modify Port R - Return to Previous Menu Enter your selection? Figure 49.
Chapter 8: Static and LACP Port Trunks 3. Type 2 to select LACP Configuration. The LACP (IEEE 8023ad) Configuration menu is shown in Figure 46 on page 167. 4. To view port status, type 7 to select Show LACP Port Status. To view aggregator status, type 8 to select Show LACP Aggregator Status. Figure 50 is an example of the LACP (IEEE 802.3ad) Port Status menu. The information in this window is for viewing purposes only. For definitions, refer to the IEEE 802.3ad standard.
AT-S63 Management Software Menus Interface User’s Guide Figure 51 is an example of the LACP (IEEE 802.3ad) Aggregator Status menu. The information is for viewing purposes only. Allied Telesyn Ethernet Switch AT-9400 Series - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 LACP (IEEE 802.3ad) Aggregator Status Aggregator #1 ................. Adminkey ...................... Oper Key....................... Speed ......................... Ports in LAGID ................ Aggregated Port ...............
Chapter 8: Static and LACP Port Trunks 178 Section I: Basic Features
Chapter 9 Port Mirroring This chapter contains the procedures for creating and deleting a port mirror.
Chapter 9: Port Mirroring Port Mirroring Overview The port mirroring feature allows you to unobtrusively monitor the traffic being received and transmitted on one or more ports on a switch by having the traffic copied to another switch port. You can connect a network analyzer to the port where the traffic is being copied and monitor the traffic on the other ports without impacting network performance or speed. The port(s) whose traffic you want to mirror is called the source port(s).
AT-S63 Management Software Menus Interface User’s Guide Creating a Port Mirror To create a port mirror, perform the following procedure: 1. From the Main Menu, type 1 to select Port Configuration. The Port Configuration menu is shown in Figure 25 on page 112. 2. From the Port Configuration menu, type 6 to select Port Mirroring. The Port Mirroring menu is shown in Figure 52. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Port Mirroring 1 - Enable/Disable .....
Chapter 9: Port Mirroring 5. Type 2 to select Mirror-To (Destination) Port. The following prompt is displayed: Mirror-To Port (0-24): 6. Enter the number of the port that functions as the destination port. This is the port where the traffic from the source ports will be copied to and where the network analyzer will be located. You can specify only one destination port. 7. If you want to mirror the ingress (received) traffic on one or more ports, type 3 to select Ingress(Rx) Mirror (Source Ports.
AT-S63 Management Software Menus Interface User’s Guide Disabling a Port Mirror To delete a port mirror, perform the following procedure: 1. From the Main Menu, type 1 to select Port Configuration. The Port Configuration menu is shown in Figure 25 on page 112. 2. From the Port Configuration menu, type 6 to select Port Mirroring. The Port Mirroring menu is shown in Figure 53 on page 181. 3. From the Port Mirroring Menu, type 1 to select Enable/Disable. The following prompt is displayed.
Chapter 9: Port Mirroring Modifying a Port Mirror To modify the port mirror, perform the following procedure: 1. From the Main Menu, type 1 to select Port Configuration. The Port Configuration menu is shown in Figure 25 on page 112. 2. From the Port Configuration menu, type 6 to select Port Mirroring. The Port Mirroring menu is shown in Figure 53 on page 181. 3. Type 2 to select Mirror-To (Destination) Port. The following prompt is displayed: Mirror-To Port (01-24): 4.
AT-S63 Management Software Menus Interface User’s Guide Displaying the Port Mirror To display the port mirror, perform the following procedure: 1. From the Main Menu, type 1 to select Port Configuration. The Port Configuration menu is shown in Figure 25 on page 112. 2. From the Port Configuration menu, type 6 to select Port Mirroring. The Port Mirroring menu is shown in Figure 54.
Chapter 9: Port Mirroring 186 Section I: Basic Operations
Chapter 10 Networking Stack The AT-S63 management software allows you to perform a few basic functions on the switch’s TCP/IP stack. The functions include viewing the switch’s Address Resolution Protocol (ARP) table and routing table. The switch uses these tables when performing a management function that requires interaction with another network device.
Chapter 10: Networking Stack Managing the Address Resolution Protocol (ARP) Table The switch has an Address Resolution Protocol (ARP) table for storing IP addresses of network devices and their corresponding MAC addresses. The switch uses the table whenever you issue a management command that requires the switch’s AT-S63 management software to interact with another device on the network.
AT-S63 Management Software Menus Interface User’s Guide Note The switch does not use the ARP table to move packets through its switching matrix. The switch refers to the table only when performing a management function that involves interaction with another network node. Displaying the ARP Table To display the ARP table, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2.
Chapter 10: Networking Stack The Display ARP Table menu is shown in Figure 56. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Display ARP Table Interface IP Address MAC Address Type --------------------------------------------------------loopback 127.0.0.1 00:00:00:00:00:00 PERMANENT eth0 149.22.22.22 00:30:84:32:8A:5B TEMPORARY eth0 149.22.22.1 00:30:84:32:12:42 TEMPORARY eth0 149.22.22.101 00:30:84:32:8A:1B TEMPORARY eth0 149.22.22.
AT-S63 Management Software Menus Interface User’s Guide Deleting an ARP Table Entry To remove a dynamic ARP entry from the ARP cache, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2. From the System Administration menu, type 9 to select System Utilities. The System Utilities menu is shown in Figure 7 on page 61. 3. From the System Utilities menu, type 6 to select Networking Stack.
Chapter 10: Networking Stack Note No confirmation prompt is displayed. All entries in the ARP table are immediately deleted, with the exception of the “loopback” entry, which cannot be deleted. The switch begins to add new entries to the table as it performs new management functions in conjunction with other network devices. 5. Return to the Main Menu. Setting the ARP Cache Timeout Inactive temporary entries in the ARP table are timed out according to the ARP cache timeout value.
AT-S63 Management Software Menus Interface User’s Guide Displaying the Route Table The routing table is used by the switch when a remote node specified in a management command is not on the same physical network as the switch. The table contains the IP address of the next hop to reaching the remote network or device. For example, the switch might refer to the table if you instructed it to download a new AT-S63 image file from a network server that was on a different physical network.
Chapter 10: Networking Stack The information in this menu is for viewing purposes only. The Display Route Table menu contains the following columns of information. Destination The IP address of a destination network, subnetwork, or end node. Mask A filter used to designate the active part of the destination IP address. A binary 1 in the mask indicates an active bit in the address while a binary 0 indicates that the corresponding bit in the address is not.
AT-S63 Management Software Menus Interface User’s Guide Displaying the TCP Connections The TCP connections table lists the active Telnet, SSH, and web browser management sessions on a switch and includes the IP addresses of the management stations. You can use the table to determine the number of remote, active management sessions open on a switch, as well as identify the management stations. To display the TCP connections table, perform the following procedure: 1.
Chapter 10: Networking Stack This menu is for viewing purposes only. The Display TCP Connections menu contains the following information: Total Number of TCP Listening sockets The number of active listening sockets. There can be a maximum of three listening sockets. One is for the Telnet server, another for SSH, and the last for the web browser server. If a server is disabled, its listening socket does not appear in the table.
AT-S63 Management Software Menus Interface User’s Guide the remote TCP, or an acknowledgment of the connection termination request previously sent. FIN-WAIT-2 - Waiting for a connection termination request from the remote TCP. CLOSE-WAIT - Waiting for a connection termination request from the local user. CLOSING - Waiting for a connection termination request acknowledgment from the remote TCP.
Chapter 10: Networking Stack Deleting a TCP Connection This procedure explains how you can use the TCP connections table to end a Telnet, SSH, or web browser management session on a switch. This procedure is useful if a manager forgot to log out after ending a session or if you suspect that an unauthorized person is accessing the switch’s management software.
AT-S63 Management Software Menus Interface User’s Guide Displaying the TCP Global Information The TCP Global Information table displays TCP status and statistics. To view the table, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2. From the System Administration menu, type 9 to select System Utilities. The System Utilities menu is shown in Figure 7 on page 61. 3.
Chapter 10: Networking Stack Max connections The maximum number of TCP connections allowed. Active Opens The number of active TCP opens. Active opens initiate connections. Passive Opens The number of TCP passive opens. Passive opens are issued to wait for a connection from another host. Attempt Fails The number of failed connection attempts. Established Resets The number of connections established but have not been reset. Current Established The number of current connections.
Section II Advanced Operations The chapters in this section contain overview information on some of the advanced features of the AT-9400 Series switch. The chapters also contain procedures for configuring these features using the AT-S63 management software.
Section II: Advanced Operations
Chapter 11 File System The chapter describes the AT-S63 file system, and how you can copy, rename, and delete system files from the file system or from a compact flash card. This chapter also explains how you can use the file system to select which boot configuration file you want the switch to use the next time the device is reset or power cycled.
Chapter 11: File System File System Overview The AT-S63 management software has a file system for storing system files. The file system is a part of flash memory in the switch. You can view a list of files as well as copy, rename, and delete files. For those AT-9400 Series switches that support a compact flash memory card, you can perform the same functions on the files stored on a flash card, as well as copy files between the switch’s file system and a flash card.
AT-S63 Management Software Menus Interface User’s Guide File Naming Conventions The flash memory file system is a flat file system—directories are not supported. However, directories are supported on compact flash cards. In both types of storage, files are uniquely identified by a file name in the following format: filename.ext where: filename is a descriptive name for the file, and may be one to sixteen characters in length.
Chapter 11: File System 28*.cfg Specifying the File Location When you work with files on a switch that supports a compact flash card, the default file location for file system operations is flash memory. You can use the Copy File, Rename File, Delete File, View File, and List Files selections on the File Operations menu (see Figure 61 on page 208) to work with files in flash memory or on a compact flash card by specifying the file location.
AT-S63 Management Software Menus Interface User’s Guide Working with Boot Configuration Files A boot configuration file contains the series of commands that are needed to recreate the current or a specific configuration of the switch when the unit is power cycled or reset. The commands in the file recreate all the VLANs, port settings, spanning tree settings, port trunks, port mirrors, and so forth. A switch can contain multiple boot configuration files, but only one can be active on a switch at a time.
Chapter 11: File System “Selecting the Active Boot Configuration File for the Switch” on page 210 Creating a Boot Configuration File To create a boot configuration file that contains the switch’s current configuration, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown Figure 4 on page 54. 2. From the System Administration menu, type 9 to select System Utilities.
AT-S63 Management Software Menus Interface User’s Guide 4. From the File Operations menu, type 3 to select Create Configuration File. The following prompt is displayed: Enter the file name: 5. Enter a file name for the new boot configuration file. When entering a file name, observe the following: Be sure to include the “.cfg” extension. The file name can be up to 16 alphanumeric characters. Spaces are allowed. See “File Naming Conventions” on page 205.
Chapter 11: File System Note Only the active boot configuration file is changed when you select the Save Configuration Changes option in the Main Menu. No other boot configuration files that are stored on the switch are altered. Selecting the Active Boot Configuration File for the Switch You have now created the boot configuration file, made the necessary changes to the switch’s parameter settings, and saved the changes.
AT-S63 Management Software Menus Interface User’s Guide switch will not allow you to save any further configuration changes until you reinsert the flash card or specify another active boot configuration file. Additionally, if you reset the switch after removing a flash card that contains the switch’s active boot configuration file, the management software uses the switch’s default settings. To select the active boot configuration file for the switch, perform the following procedure: 1.
Chapter 11: File System 6. Do one of the following: Viewing a Boot Configuration File To reconfigure the switch using the parameter settings in the newly selected active boot configuration file, reset or power cycle the switch. For instructions, refer to “Rebooting a Switch” on page 61. To overwrite the settings in the configuration file with the switch’s current settings, return to the Main Menu and type S to select Save Configuration Changes.
AT-S63 Management Software Menus Interface User’s Guide The contents of the boot configuration file are displayed in the View File menu. An example is shown in Figure 62. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 View File Viewing file “mydefault.
Chapter 11: File System The following are several guidelines for editing a boot configuration file: 214 The text editor must be able to store the file as ASCII text. Do not use special formatting codes, such as boldface or italics. The boot configuration file must contain AT-S63 command line commands. You enter the commands you want the switch to perform when reset or power cycled. For a description of the commands, refer to the AT-S63 Management Software Command Line Interface User’s Guide.
AT-S63 Management Software Menus Interface User’s Guide Copying a System File This procedure is used to create copies of files stored in a switch’s file system or on a flash memory card. For instance, you might perform this procedure to create a copy of a configuration file so that you have a backup copy. You can also use this procedure is to copy files between a switch’s file system and a flash memory card.
Chapter 11: File System The following prompt is displayed: Enter the destination file name: 6. Enter the new file name. If you want to place the copy on a compact flash card, precede the filename with “cflash:”. You can enter a file name of up to 16 alphanumeric characters, followed by a 3 letter extension. You must keep the same extension as the original file. If the file is located on a compact flash card, precede the filename with “cflash:” The following message is displayed: Please wait...
AT-S63 Management Software Menus Interface User’s Guide Renaming a System File This procedure is used to rename files in a system’s file system or a compact flash card. Before renaming a file, note the following: To rename a file on a compact flash card, you must first change to the directory where the file is stored. This procedure does not allow you to specify a directory path. For instructions, refer to “Changing the Current Flash Card Directory” on page 227.
Chapter 11: File System 6. Enter the new name for the file. You can enter a file name of up to 16 alphanumeric characters, followed by a 3 letter extension. You must keep the same extension. If the file is located on a compact flash card, precede the filename with “cflash:” The following message is displayed: Please wait... Press any key ... Press any key to return to the File Operations menu.
AT-S63 Management Software Menus Interface User’s Guide Deleting a System File This procedure is used to delete files from a system’s flash memory or a compact flash card. Before deleting a file, note the following: Deleting the active boot configuration file and then resetting the switch returns the unit to its default parameter settings, unless you save the current configuration or select another active boot configuration file.
Chapter 11: File System Displaying System Files Use this procedure to display a list of the system files currently stored either in the flash memory of the switch or on a compact flash card. For information about shortcuts for specifying file names, see “File Naming Conventions” on page 205.
AT-S63 Management Software Menus Interface User’s Guide To display a list of the files that begin with the letter t, enter: t*.* An example of this display is shown in Figure 63. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 List Files File Name Device Size (Bytes) Last Modified ------------------------------------------------------------default.cfg flash 805 01/10/2002 12:01:16 boot.cfg flash 1249 10/24/2003 16:50:40 newcfg.
Chapter 11: File System Listing Files on the Compact Flash Card To view the files on the compact flash card, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown Figure 4 on page 54. 2. From the System Administration menu, type 9 to select System Utilities. The System Utilities menu is shown in Figure 7 on page 61. 3. From the System Utilities menu, type 1 to select File Operations.
AT-S63 Management Software Menus Interface User’s Guide Working with Flash Memory An AT-9400 Series switch contains flash memory where the file system, which contains files such as the configuration file, and event log are stored. Displaying Information about the Flash Memory To display information about the flash memory, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown Figure 4 on page 54. 2.
Chapter 11: File System Caution When you format the flash memory, ALL files including the active configuration file are lost. This includes encryption keys, certificates, configuration files, and all other special files. To remove selected files, use the procedure in “Deleting a System File” on page 219. To format the flash memory, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2.
AT-S63 Management Software Menus Interface User’s Guide Working with the Compact Flash Card Some AT-9400 Series switches contain a compact flash card slot, into which you can put a compact flash card. You can then copy files such as configuration files onto the compact flash card, take the card to other switches that have compact flash card slots, and copy files from the compact flash card to that switch through a local connection.
Chapter 11: File System Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Display Compact Flash Information Compact Flash: -----------------------------------------------------Current Directory: \ Number of files ......... 0 Number of directories ... 1 Bytes used .............. 0 Card Information: Hardware detected ....... Serial Number ........... Size .................... Used .................... Free ....................
AT-S63 Management Software Menus Interface User’s Guide Used The amount of space that is currently used. Free The amount of space that is free. Changing the Current Flash Card Directory To change the current directory on a compact flash card, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown Figure 4 on page 54. 2. From the System Administration menu, type 9 to select System Utilities.
Chapter 11: File System 228 Section II: Advanced Operations
Chapter 12 File Downloads and Uploads This chapter contains the procedures for downloading a new AT-S63 image file onto the switch. This chapter also contains the procedures for uploading and downloading system files, such as a boot configuration file, from the file system in the switch.
Chapter 12: File Downloads and Uploads Downloading the AT-S63 Image File onto a Switch This section contains the following two procedures: “Downloading the AT-S63 Image from a Local Management Session” on page 231 “Downloading the AT-S63 Image from a Remote Management Session” on page 236 These procedures explain how to download a new version of the AT-S63 image file onto a switch from a local management session using either Xmodem or TFTP, or from a remote management session (i.
AT-S63 Management Software Menus Interface User’s Guide The following guidelines apply to an Xmodem download: Xmodem can only download the image file onto the switch where you started the local management session. You cannot use Xmodem to download a new image file to a switch accessed through enhanced stacking. The new AT-S63 image file must be stored on the computer or terminal connected to the RS232 terminal port on the switch.
Chapter 12: File Downloads and Uploads The Downloads and Uploads menu is shown in Figure 68. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Downloads and Uploads 1 - Download Application Image/BootLoader 2 - Upload Application Image/BootLoader 3 - Download a File 4 - Upload a File R - Return to Previous Menu Enter your selection? Figure 68. Downloads and Uploads Menu 5.
AT-S63 Management Software Menus Interface User’s Guide After receiving the file, the switch compares the version numbers of the new image file that you just downloaded against the file already in the application block on the switch. If the new image file has an earlier or the same version number as the file in the switch’s application block, it cancels the update process.
Chapter 12: File Downloads and Uploads 10. From the HyperTerminal main window, select Send File from the Transfer menu, as shown in Figure 69. Figure 69. HyperTerminal Window The Send File window is shown in Figure 70. Figure 70. Send File Window 11. Click Browse and specify the location and file to be downloaded onto the switch. 12. Click in the Protocol field and select as the transfer protocol either Xmodem or, for a faster download, 1K Xmodem. 13. Click Send.
AT-S63 Management Software Menus Interface User’s Guide The software immediately begins downloading onto the switch. The Xmodem File Send window in Figure 71 displays the current status of the software download. The download process takes several minutes to complete. Figure 71. XModem File Send Window After receiving the file, the switch compares the version numbers of the new image file that you just downloaded against the file already in the application block on the switch.
Chapter 12: File Downloads and Uploads Downloading the AT-S63 Image from a Remote Management Session Review “Guidelines” on page 230 before performing the following download procedure. To download a new AT-S62 image file into the application block portion of the switch’s flash memory, making it the active image file on the switch, from a remote management session (i.e, Telnet or SSH) using TFTP, perform the following procedure: 1.
AT-S63 Management Software Menus Interface User’s Guide The following message is displayed: Getting the file from Remote TFTP Server - Please wait ... 8. If you have not already done so, start the TFTP server software. After the switch has downloaded the image file, the following message is displayed: File received successfully! After receiving the file, the switch compares the version numbers of the new image file that you just downloaded against the file already in the application block on the switch.
Chapter 12: File Downloads and Uploads Uploading the AT-S63 Image File Switch to Switch The procedure in this section uploads an AT-S63 software image from a master AT-9400 Series switch to another AT-9400 Series switch. This procedure is useful in networks that contain a large number of AT-9400 Series switches.
AT-S63 Management Software Menus Interface User’s Guide To upload the AT-S63 management software image from a master switch to other switches in the same enhanced stack, perform the following procedure: 1. From the Main Menu, type 8 to select Enhanced Stacking. The Enhanced Stacking menu is shown in Figure 17 on page 88. 2. From the Enhanced Stacking menu, type 2 to select Stacking Services. Note The “2 - Stacking Services” selection is only available on a master switch.
Chapter 12: File Downloads and Uploads 7. If you answer Yes to this prompt, the management software prompts you with a confirmation message before upgrading a switch. If you answer No, the management software does not display a confirmation prompt before uploading the image file. The management software begins the upload. The management software notifies you when the upload is complete. After receiving the file, a switch compares the version numbers of the new and existing image files.
AT-S63 Management Software Menus Interface User’s Guide Uploading an AT-S63 Configuration File Switch to Switch This procedure explains how to upload a boot configuration file on a master AT-9400 Series switch to another AT-9400 Series switch in an enhanced stack. This procedure provides you with an easy way of distributing a configuration file to different switches that are to share a similar configuration.
Chapter 12: File Downloads and Uploads Caution This procedure causes the switch to reset. Some network traffic may be lost. To upload a boot configuration file on the master switch to another switch in an enhanced stack, perform the following procedure: 1. From the Main Menu, type 8 to select Enhanced Stacking. The Enhanced Stacking menu is shown in Figure 17 on page 88. 2. From the Enhanced Stacking menu, type 2 to select Stacking Services.
AT-S63 Management Software Menus Interface User’s Guide After you have entered a name, the following prompt is displayed: Enter the list of switches -> 7. Enter the number (Num column in the menu) of the AT-9400 Series switch where you want to upload the configuration file. You can specify more than one switch at a time (for example, 2,4,5). Note You can upload an AT-9400 Series configuration file only onto other AT-9400 Series switches.
Chapter 12: File Downloads and Uploads Downloading a System File This section contains the following two procedures: “Downloading a System File from a Local Management Session” on page 245 “Downloading a System File from a Remote Management Session” on page 249 Both procedures are used to download files into a switch’s file system. One procedure downloads files from a local management using either Xmodem or TFTP, and the other explains how to do it from a remote management session using TFTP.
AT-S63 Management Software Menus Interface User’s Guide You must use TFTP to download files from a remote management session. If the switch supports a flash memory card, you can use these procedures to download a file to the card rather than the switch’s file system. To download a file to a flash memory card, you should first change to the directory where you want to store the file on the card. This procedure does not accept a directory path.
Chapter 12: File Downloads and Uploads 3. From the System Utilities menu, type 2 to select Downloads and Uploads. The Downloads and Uploads menu is shown in Figure 68 on page 232. 4. From the Downloads and Uploads menu, type 3 to select Download a File. The following prompt is displayed: Download Method/Protocol [X-Xmodem, T-TFTP]: 5. To download a system file using Xmodem, go to Step 6. To download a file using TFTP, do the following: a. Type T.
AT-S63 Management Software Menus Interface User’s Guide f. If you downloaded a configuration file and want to make it the active boot file on the switch, refer to “Setting the Active Boot Configuration File” on page 210. If you downloaded a CA certificate, refer to “Adding a Certificate to the Database” on page 797. This completes the procedure for downloading a file into the switch’s file system or flash memory card from a local management session using TFTP. 6.
Chapter 12: File Downloads and Uploads 10. From the HyperTerminal main window, select Send File from the Transfer menu, as shown in Figure 72. Figure 72. HyperTerminal Window The Send File window is shown in Figure 73. Figure 73. Send File Window 11. Click Browse and specify the location and system file to be downloaded onto the switch. 12. Click in the Protocol field and select as the transfer protocol either Xmodem or, for a faster download, 1K XModem. 13. Click Send.
AT-S63 Management Software Menus Interface User’s Guide The file immediately begins downloading onto the switch. The Xmodem File Send window in Figure 74 displays the current status of the download. Figure 74. XModem File Send Window The download is complete when the Downloads and Uploads menu is redisplayed. 14. If you downloaded a configuration file and want to make it the active boot file on the switch, refer to “Setting the Active Boot Configuration File” on page 210.
Chapter 12: File Downloads and Uploads The System Utilities menu is shown in Figure 7 on page 61. 4. From the System Utilities menu, type 2 to select Downloads and Uploads. The Downloads and Uploads menu is shown in Figure 68 on page 232. 5. From the Downloads and Uploads menu, type 3 to select Download a File. The following prompt is displayed: Only TFTP downloads are available for a Telnet access TFTP Server IP address: 6. Enter the IP address of the TFTP server.
AT-S63 Management Software Menus Interface User’s Guide This completes the procedure for downloading a file into the switch’s file system or flash memory card from a remote management session using TFTP.
Chapter 12: File Downloads and Uploads Uploading a System File This section contains the following two procedures: “Uploading a System File from a Local Management Session” on page 253 “Uploading a System File from a Remote Management Session” on page 256 These procedures explain how to upload files from a switch’s file system to your management workstation or a TFTP server. One procedure explains how to perform the upload from a local management using either Xmodem or TFTP.
AT-S63 Management Software Menus Interface User’s Guide To upload a public key, you must first export it from the key database into the switch’s file system. For instructions, refer to “Exporting an Encryption Key” on page 773. Public keys have the file name extension “.key.” You cannot upload an encryption key pair. Key pairs have the file name extension “.ukf.” (The prohibition against uploading an encryption key pair is to prevent an unauthorized individual from obtaining the private key.
Chapter 12: File Downloads and Uploads The following prompt is displayed: Upload Method/Protocol [X-Xmodem, T-TFTP]: 6. To upload a system file using Xmodem, go to Step 7. To upload a file using TFTP, do the following: a. Type T. The following prompt is displayed: TFTP Server IP address: b. Enter the IP address of the TFTP server. The following prompt is displayed: Remote File Name: c. Enter a name for the file for when it is stored on the TFTP server.
AT-S63 Management Software Menus Interface User’s Guide 8. Enter the name of the system file on the switch that you want to upload to your computer. You can specify only one file. You cannot use wildcards in the file name. If the file is stored on a flash memory card, precede the name with “cflash:”. The following prompt is displayed: You are going to invoke the Xmodem download utility. Do you wish to continue? [Yes/No] Note: Please select 1K Xmodem protocol for faster download.
Chapter 12: File Downloads and Uploads The Receive File window is shown in Figure 76. Figure 76. Receive File Window 12. Click Browse and specify the location on your computer where you want the system file stored. 13. Click in the Protocol field and select as the transfer protocol either Xmodem or, for a faster download, 1K XModem. 14. Click Receive. 15. When prompted, enter a name for the file. This is the name given the file when it is stored on your workstation.
AT-S63 Management Software Menus Interface User’s Guide 4. From the System Utilities menu, type 2 to select Downloads and Uploads. The Downloads and Uploads menu is shown in Figure 68 on page 232. 5. From the Downloads and Uploads menu, type 4 to select Upload a File. The following prompt is displayed: Only TFTP uploads are available for a Telnet access TFTP Server IP address: 6. Enter the IP address of the TFTP server. The following prompt is displayed: Remote File Name: 7.
Chapter 12: File Downloads and Uploads 258 Section II: Advanced Operations
Chapter 13 Event Logs and Syslog Servers This chapter describes the event logs that allow you to view information about switch activity, and how to configure the switch to send the events to a syslog server.
Chapter 13: Event Logs and Syslog Servers Event Log Overview A managed switch is a complex piece of computer equipment that includes both hardware and software. Multiple software features operate simultaneously, interoperating with each other and processing large amounts of network traffic. It is often difficult to determine exactly what is happening when a switch appears not to be operating normally, or what happened when the problem occurred.
AT-S63 Management Software Menus Interface User’s Guide Note The event logs, even when disabled, log all AT-S63 initialization events that occur when the switch is reset or power cycled. Any switch events that occur after AT-S63 initialization are entered into the logs only if you enable the event log feature. The default setting for the event log feature is enabled.
Chapter 13: Event Logs and Syslog Servers Working with the Event Logs This section contains the following procedures: Enabling or Disabling the Event Logs “Enabling or Disabling the Event Logs,” next “Displaying an Event Log” on page 264 “Modifying the Event Log Full Action” on page 270 “Clearing an Event Log” on page 271 “Saving an Event Log to a File” on page 271 This procedure explains how to enable or disable the event logs on the switch.
AT-S63 Management Software Menus Interface User’s Guide The Event Log menu is shown in Figure 77. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Event Log 1 2 3 4 5 6 - Event Logging .......... Display Output ......... Display Order .......... Display Mode ........... Display Severity ....... Display Module .........
Chapter 13: Event Logs and Syslog Servers Displaying an Event Log Each time that you want to view an event log, you must choose how and what you want displayed. Event log settings are not saved. To specify the type of events you want to view in an event log, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2. From the System Administration menu, type 8 to select Event Log.
AT-S63 Management Software Menus Interface User’s Guide 6. To display events of a selected severity, type 5 to select Display Severity. The following prompt is displayed: Enter Severity levels to display (ALL, E - Error, W Warning, I - Information, D - Debug) -> The possible options are: ALL All messages of the following types are displayed. This is the default. E - Error Only error messages are displayed. Error messages indicate that the switch operation is severely impaired.
Chapter 13: Event Logs and Syslog Servers Table 3 shows the list of modules. Table 3.
AT-S63 Management Software Menus Interface User’s Guide Table 3. AT-S63 Modules (Continued) Module Name Description RTC Real time clock SNMP SNMP SSH Secure Shell protocol SSL Secure Sockets Layer protocol STP Spanning Tree, Rapid Spanning, and Multiple Spanning Tree protocols SYSTEM Hardware status; Manager and Operator log in and log off events.
Chapter 13: Event Logs and Syslog Servers The events are displayed in a table. The columns in the table shown in normal display mode are described below: S (Severity) The event’s severity. The severity codes and their corresponding severity level and description are shown in Table 4. Table 4. Event Severity Levels Severity Code Severity Level E Error Switch operation is severely impaired. W Warning An issue that may require network manager attention.
AT-S63 Management Software Menus Interface User’s Guide When you display the events in full mode, more information is included. Figure 79 shows the same portion of the event log in Figure 78 on page 267 but displayed in full mode. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Event Log S Date Time EventID Source File:Line Number Event -------------------------------------------------------------------------I 02/24/04 12:31:02 323003 atissh.
Chapter 13: Event Logs and Syslog Servers Modifying the Event Log Full Action This procedure explains how to control what the logs are to do when they reach the maximum capacity of 4,000 events for the temporary log and 2,000 events for the permanent log. There are two options. The first is to have the switch delete the oldest entries in a log as it adds new entries. The second is to have the switch stop adding entries, so as to preserve the existing log contents.
AT-S63 Management Software Menus Interface User’s Guide Clearing an Event Log You can clear the events from an event log so that the log starts fresh. To clear an event log, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2. From the System Administration menu, type 8 to select Event Log. The Event Log menu is shown in Figure 77 on page 263. 3.
Chapter 13: Event Logs and Syslog Servers The following message is displayed: Saving log to file. When the save process is complete, the word “Complete” is displayed, followed by another prompt: Press any key to continue. 7. Press any key. The log file is saved in the switch’s file system as an ASCII file. 8. To view the log file, type R to return to the System Administration menu. 9. From the System Administration menu, type 9 to select System Utilities.
AT-S63 Management Software Menus Interface User’s Guide A sample log file saved in full mode is shown in Figure 80. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 View File Viewing file “second.log” -------------------------------------------------------------I 02/24/04 12:31:02 323003 atissh.c:518 ssh: SSH server disabled I 02/24/04 12:31:02 073001 garpmain.c:259 garp: GARP initialized I 02/24/04 12:31:02 103001 trunkapp.
Chapter 13: Event Logs and Syslog Servers Configuring Log Outputs As explained in “Event Log Overview” on page 260, there are two methods for viewing the events generated by the switch. One approach is to display one of the switch’s event logs. The drawback to this method is that you must establish a management session with the switch before you can view the logs and you can view the log of only one switch at a time.
AT-S63 Management Software Menus Interface User’s Guide Creating a Log Output Definition To create a log output definition, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2. From the System Administration menu, type 8 to select Event Log. The Event Log menu is shown in Figure 77 on page 263. 3. From the Event Log menu, type L to select Configure Log Outputs.
Chapter 13: Event Logs and Syslog Servers The Syslog Output Configuration menu is displayed, as shown in Figure 82. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Syslog Output Configuration 1 2 3 4 5 6 7 - Output ID ................ Server IP Address ........ Message Generation ....... Message Format ........... Facility Level ........... Event Severity ........... Event Module ............. 0.0.0.
AT-S63 Management Software Menus Interface User’s Guide 11. Type 4 to toggle Message Format between the following options: Normal Sends the severity, module, and description for each event. Extended Sends the same information as Normal along with the date, time, and switch’s IP address. This is the default. 12. Type 5 to select Facility Level.
Chapter 13: Event Logs and Syslog Servers Table 5. Applicable RFC 3164 Numerical Code and AT-S63 Module Mappings (Continued) Numerical Code RFC 3164 Facility AT-S63 Module 9 Clock daemon Time- based modules: - TIME (system time and SNTP) - RTC 22 Local use 6 Physical interface and data link modules: - PCFG - PMIRR - PTRUNK - STP - VLAN 23 Local use 7 SYSTEM events related to major exceptions. 16 Local use 0 All other modules and events.
AT-S63 Management Software Menus Interface User’s Guide Table 6. Numerical Code and Facility Level Mappings (Continued) Numerical Code Facility Level Setting 20 LOCAL4 21 LOCAL5 22 LOCAL6 23 LOCAL7 For example, selecting LOCAL2 as the facility level assigns the numerical code of 18 to all events sent by the switch to the syslog server. 13. To include events of a selected severity, type 6 to select Event Severity.
Chapter 13: Event Logs and Syslog Servers 15. Enter a list of modules separated by a comma—for example, “system, stp, ptrunk.” 16. Type C to create the log output you defined. The switch immediately adds the new syslog server definition to the Configure Log Outputs menu and begins to send events to the sever, if you enabled the definition when you created it. An example of the menu with a new syslog server definition is shown in Figure 83.
AT-S63 Management Software Menus Interface User’s Guide The following prompt is displayed: Enter output ID to modify [0 to 20] -> 5. Enter the number of the log output that you want to modify. The Syslog Output Configuration menu is displayed, as shown in Figure 82 on page 276. 6. Refer to “Creating a Log Output Definition” on page 275 for information about the menu selections. 7. When you complete the modifications, type M to select Modify Log Output.
Chapter 13: Event Logs and Syslog Servers 7. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. Displaying the Log Output Definition Details To view the settings of a log output definition you have already created, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2. From the System Administration menu, type 8 to select Event Log.
Chapter 14 Classifiers This chapter explains classifiers and how you can create classifiers to define traffic flows.
Chapter 14: Classifiers Classifier Overview A classifier defines a traffic flow. A traffic flow consists of packets that share one or more characteristics. A traffic flow can range from being very broad to very specific. An example of the former might be all IP traffic while an example of the latter could be packets with specific source and destination MAC addresses. A classifier contains a set of criteria you configure to match the traffic flow you want the classifier to define.
AT-S63 Management Software Menus Interface User’s Guide is dictated by the QoS policy, as explained in Chapter 17, “Quality of Service” on page 337. In summary, a classifier is a list of variables that define a traffic flow. You apply a classifier to an ACL or a QoS policy to define the traffic flow you want the ACL or QoS policy to affect or control. Classifier Criteria The components of a classifier are defined in the following subsections.
Chapter 14: Classifiers Preamble Destination Address Source Address Type/ Length 64 bits 48 bits 48 bits 16 bits Tag Protocol Identifier 16 bits User Priority CFI 3 bits 1 bit Frame Data CRC 368 to 12000 bits 32 bits VLAN Identifier 12 bits Figure 85. User Priority and VLAN Fields within an Ethernet Frame You can identify a traffic flow of tagged packets using the user priority value.
AT-S63 Management Software Menus Interface User’s Guide If you choose to specify a protocol by its number, you can enter the value in decimal or hexadecimal format. If you choose the latter, precede the number with the prefix “0x”. IP ToS (Type of Service) (Layer 3) Type of Service (ToS) is a standard field in IP packets. It is used by applications to indicate the priority and Quality of Service for a frame. The range of the value is 0 to 7. The location of the field is shown in Figure 86.
Chapter 14: Classifiers IP Protocol (Layer 3) You can define a traffic flow by the following Layer 3 protocols: TCP UDP ICMP IGMP IP protocol number If you choose to specify a Layer 3 protocol by its number, you can enter the value in decimal or hexadecimal format. It you choose the latter, precede the number with the prefix “0x”. Source IP Addresses (Layer 3) Source IP Mask (Layer 3) You can define a traffic flow by the source IP address contained in IP packets.
AT-S63 Management Software Menus Interface User’s Guide TCP Source Ports (Layer 4) TCP Destination Ports (Layer 4) A traffic flow can be identified by a source and/or destination TCP port number contained within the header of an IP frame. Observe the following guidelines when using these criteria: The Protocol variable must be left blank or set to IP. The IP Protocol variable must be left blank or set to TCP. A classifier cannot contain criteria for both TCP and UDP ports.
Chapter 14: Classifiers Classifier Guidelines 290 Follow these guidelines when creating a classifier: Each classifier represents a separate traffic flow. The variables within a classifier are linked by AND. The more variables specified within a classifier, the more specific it becomes in terms of the flow you are defining.
AT-S63 Management Software Menus Interface User’s Guide Creating a Classifier This section contains the procedure for creating a classifier. As explained in “Classifier Overview” on page 284, a classifier contains a series of variables for defining a traffic flow. This same procedure is used whether the classifier is intended for an ACL or a QoS policy. To create a classifier, perform the following procedure 1. From the Main Menu, type 7 to select Security and Services.
Chapter 14: Classifiers The Classifier Configuration menu is shown in Figure 88. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Classifier Configuration 1 2 3 4 - Create Classifier Modify Classifier Destroy Classifier Show Classifiers P - Purge Classifiers R - Return to Previous Menu Enter your selection? Figure 88. Classifier Configuration Menu 3. From the Classifier Configuration menu, type 1 to select Create Classifier.
AT-S63 Management Software Menus Interface User’s Guide This is the first page of the classifier variables. To view the remaining variables, type N to select Next Page. The Create Classifier menu (page 2) is shown in Figure 90. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Create Classifier 11 12 13 14 15 16 17 18 19 20 E C P U R - - IP Protocol: ... Src IP Addr: ... Src IP Mask: ... Dst IP Addr: ... Dst IP Mask: ... TCP Src Port: .. TCP Dst Port: ..
Chapter 14: Classifiers Refer to “Classifier Overview” on page 284 for definitions of the variables. 7. Repeat steps 5 and 6 to adjust any other variables necessary to define the traffic flow for this classifier. 8. After configuring the necessary variables, type C to select Create Classifier. The switch creates the classifier. If any of the settings are incompatible, the system displays an error message.
AT-S63 Management Software Menus Interface User’s Guide Modifying a Classifier In order to modify a classifier, you need to know its ID number. If you are unsure of the ID number of the classifier you want to modify, refer to “Displaying Classifiers” on page 299. You cannot modify a classifier if it belongs to an ACL or QoS policy that has already been assigned to a port. You must first remove the port assignments from the ACL or policy before you can modify the classifier.
Chapter 14: Classifiers 7. To modify other classifiers, repeat this process starting with step 3. 8. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. 9. To add the modified classifier to an ACL, refer to “Creating an ACL” on page 311 or “Modifying an ACL” on page 314. To add it to a QoS policy, refer to “Managing Flow Groups” on page 352.
AT-S63 Management Software Menus Interface User’s Guide Deleting a Classifier This procedure deletes a classifier from the switch. To delete a classifier, you need to know its ID number. If you are unsure of the ID number of the classifier you want to delete, refer to “Displaying Classifiers” on page 299. Note You cannot delete a classifier if it belongs to an ACL or QoS policy.You must first remove the classifier from its ACL or policy assignments before you can delete it.
Chapter 14: Classifiers Deleting All Classifiers This procedure deletes all classifiers from the switch. To delete individual classifiers, refer to “Deleting a Classifier” on page 297. Note You cannot delete all classifiers if any of them belong to an ACL or QoS policy.You must first remove all classifiers from their ACL and policy assignments before performing this procedure. To delete all classifiers from the switch, perform the following procedure: 1.
AT-S63 Management Software Menus Interface User’s Guide Displaying Classifiers To display the classifiers on a switch, do the following: 1. From the Main Menu, type 7 to select Security and Services. The Security and Services menu is shown in Figure 87 on page 291. 2. From the Security and Services menu, type 1 to select Classifier Configuration. The Classifier Configuration menu is shown in Figure 88 on page 292. 3. From the Classifier Configuration menu, type 4 to select Show Classifiers.
Chapter 14: Classifiers for the classifier. An active ACL or QoS policy has been assigned to a switch port while an inactive ACL or policy has not been assigned to a port. If this number is 0 (zero), the classifier has not been assigned to any ACLs or policies. Number of Active Associations The number of active ACLs and QoS policy assignments for the classifier. An active ACL or policy has been assigned to a switch port.
AT-S63 Management Software Menus Interface User’s Guide The second page of the Display Classifier Details menu is shown in Figure 93. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Display Classifier Details 11 12 13 14 15 16 17 18 19 - Src Src Dst Dst TCP TCP UDP UDP TCP IP Addr: ... IP Mask: ... IP Addr: ... IP Mask: ... Src Port: .. Dst Port: .. Src Port: .. Dst Port: .. Flags: .....
Chapter 14: Classifiers 302 Section II: Advanced Operations
Chapter 15 Access Control Lists This chapter explains access control lists (ACL) and how you can use this feature to improve network security and performance.
Chapter 15: Access Control Lists Access Control List (ACL) Overview An ACL is a tool for managing network traffic. You can use this feature to control which ingress packets a port will accept and which it will reject. One of the benefits of this feature is that it can add to network security. An ACL can protect parts of a network from unauthorized access by allowing only permitted traffic to enter the port.
AT-S63 Management Software Menus Interface User’s Guide Here is an overview of how the process works. 1. When an ingress packet arrives on a port, it is checked against the criteria in the classifiers of all the ACLs, both permit and deny, assigned to the port. 2. If the packet matches the criteria of a permit ACL, the port immediately accepts it, even if the packet also matches a deny ACL assigned to the same port, because a permit ACL always overrides a deny ACL. 3.
Chapter 15: Access Control Lists Examples A classifier can be assigned to multiple ACLs. However, a classifier cannot be assigned more than once to a port. Put another way, ACLs that have the same classifier cannot be assigned to the same port. The switch can store up to 64 ACLs. This section contains several examples of ACLs. In this example, port 4 has been assigned one ACL, a deny ACL for the subnet 149.11.11.0. This ACL prevents the port from accepting any traffic originating from that subnet.
AT-S63 Management Software Menus Interface User’s Guide To deny traffic from several subnets on the same port, you can create multiple classifiers and apply them to the same ACL. This example denies traffic on port 4 from three subnets using three classifiers, one for each subnet, assigned to the same ACL. Create Classifier 01 - Classifier ID: ..... 22 02 - Description: ...... 149.11.11 flow . . 12 - Src IP Addr: ..... 149.11.11.0 13 - Src IP Mask: .... 255.255.255.
Chapter 15: Access Control Lists You can achieve the same result by assigning each classifier to a different ACL and assigning the ACLs to the same port, as in this example, again for port 4. Create Access Control Lists (ACL) 1 - ACL ID ................. 4 2 - Description .......... 149.11.11-deny 3 - Action .................. Deny 4 - Classifier List ...... 22 5 - Port List .............. 4 Create Access Control Lists (ACL) 1 - ACL ID ................. 22 2 - Description .......... 149.22.22.
AT-S63 Management Software Menus Interface User’s Guide In this example, the traffic on ports 14 and 15 is restricted to packets from the source subnet 149.44.44.0. All other IP traffic is denied. Classifier ID 11, which specifies the traffic flow to be permitted by the ports, is assigned to an ACL with an action of permit. Classifier ID 17 specifies all IP traffic and is assigned to an ACL whose action is deny. Since a permit ACL overrides a deny ACL, the port will accept the traffic from the 149.44.44.
Chapter 15: Access Control Lists The next example limits the ingress traffic on port 17 to IP packets from the subnet 149.22.11.0 and a Type of Service setting of 6, destined to the end node with the IP address 149.22.22.22. All other IP traffic and ARP packets are prohibited. Create Classifier Create Access Control Lists (ACL) 1 - ACL ID ................. 4 2 - Description .......... ToS 6 traffic - permit 3 - Action .................. Permit 4 - Classifier List ...... 6 5 - Port List ..............
AT-S63 Management Software Menus Interface User’s Guide Creating an ACL This procedure explains how to create an ACL. In order to perform this procedure, you need to know the ID numbers of the classifiers that you want to assign to the ACL. To view classifier ID numbers, refer to “Displaying Classifiers” on page 299. To create an ACL, perform the following procedure: 1. From the Main Menu, type 7 to select Security and Services. The Security and Services menu is shown in Figure 87 on page 291. 2.
Chapter 15: Access Control Lists The Create ACL menu is shown in Figure 101. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Create ACL 1 2 3 4 5 - ACL ID ........... 0 Description ....... Action ............ Deny Classifier List ... Port List ......... C - Create ACL R - Return to Previous Menu Enter your selection? Figure 101. Create ACL Menu 4. Type 1 to select ACL ID and, when prompted, enter an ID number for the ACL.
AT-S63 Management Software Menus Interface User’s Guide 9. Type 5 to select Port List and, when prompted, enter the ports where you want to assign the ACL. You can assign an ACL to just one port or to more than one port. When entering multiple ports, you can list the ports individually (e.g., 2,5,7), as a range (e.g., 8-12) or both (e.g., 14,6,8). 10. Type C to select Create ACL. The ACL is created on the switch and immediately activated on the specified ports. 11.
Chapter 15: Access Control Lists Modifying an ACL This procedure explains how to modify an ACL. In order to perform this procedure, you need to know the ID number of the ACL. To display ACL ID numbers, refer to “Displaying ACLs” on page 319. If you plan to add classifiers to the ACL, you also need to know the ID numbers of the classifiers. To view classifier ID numbers, refer to “Displaying Classifiers” on page 299. To modify an ACL, perform the following procedure: 1.
AT-S63 Management Software Menus Interface User’s Guide You cannot change an ACL’s ID number. 5. To change the description of the ACL, type 2 to select Description and enter a new description for the ACL. The description can be up to 31 alphanumeric characters. Spaces are allowed. This parameter is optional, though recommended. Assigning each ACL a name will make it easier for you to identify them. 6. To change the ACL’s action, type 3 to select Action.
Chapter 15: Access Control Lists Deleting an ACL This procedure deletes an ACL from the switch. To perform this procedure, you need to know the ID number of the ACL. To display ACL ID numbers, refer to “Displaying ACLs” on page 319. To delete an ACL, perform the following procedure: 1. From the Main Menu, type 7 to select Security and Services. The Security and Services menu is shown in Figure 87 on page 291. 2. From the Security and Services menu, type 4 to select Access Control Lists.
AT-S63 Management Software Menus Interface User’s Guide 5. To delete the ACL, type D to select Destroy ACL. To cancel the procedure, type R to select Return to Previous Menu. A deleted ACL is immediately removed from the switch. 6. To delete additional ACLs, repeat this procedure starting with step 3. 7. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes.
Chapter 15: Access Control Lists Deleting All ACLs This procedure deletes all ACLs from the switch. To delete all ACLs, perform the following procedure: 1. From the Main Menu, type 7 to select Security and Services. 2. From the Security and Services menu, type 4 to select Access Control Lists. The Access Control Lists (ACL) menu is shown in Figure 100 on page 311. 3. From the Access Control Lists (ACL) menu, type P to selection Purge ACLs. Caution No confirmation prompt is displayed.
AT-S63 Management Software Menus Interface User’s Guide Displaying ACLs To display the ACLs on a switch, perform this procedure: 1. From the Main Menu, type 7 to select Security and Services. The Security and Services menu is shown in Figure 87 on page 291. 2. From the Security and Services menu, type 4 to select Access Control Lists. The Access Control Lists (ACL) menu is shown in Figure 100 on page 311. 1. From the Access Control Lists (ACL) menu, type 4 to selection Show ACLs.
Chapter 15: Access Control Lists Active - The status of the ACL. An ACL is deemed active if it is assigned to at least one port. An ACL is deemed inactive if it is not assigned to any ports. 2. To view the details of a ACL, type D to select Detail Classifier Display. The following prompt is displayed: Enter ACL ID : [0 to 250] -> 0 3. Enter the ID number of the ACL you want to display. The details of the selected ACL are displayed.
Chapter 16 Class of Service This chapter contains the procedures for configuring Class of Service (CoS).
Chapter 16: Class of Service Class of Service Overview When a port on an Ethernet switch becomes oversubscribed—its egress queues contain more packets than the port can handle in a timely manner—the port may be forced to delay the transmission of some packets, resulting in the delay of packets reaching their destinations.
AT-S63 Management Software Menus Interface User’s Guide Table 7 lists the default mappings between the eight CoS priority levels and the eight egress queues of a switch port. Table 7. Default Mappings of IEEE 802.1p Priority Levels to Priority Queues IEEE 802.
Chapter 16: Class of Service Table 8. Customized Mappings of IEEE 802.1p Priority Levels to Priority Queues (Continued) IEEE 802.1p Priority Level Port Priority Queue 5 Q3 6 Q6 7 Q7 (highest) The procedure for changing the default mappings is found in “Mapping CoS Priorities to Egress Queues” on page 330. Note that because all ports must use the same priority-to-egress queue mappings, these mappings are applied at the switch level. They cannot be set on a per-port basis.
AT-S63 Management Software Menus Interface User’s Guide Note Scheduling is set at the switch level. You cannot set this on a perport basis. Strict Priority Scheduling With this type of scheduling, a port transmits all packets out of higher priority queues before transmitting any from the lower priority queues. For instance, as long as there are packets in Q7 it does not handle any packets in Q6.
Chapter 16: Class of Service Table 9. Example of Weighted Round Robin Priority (Continued) Maximum Number of Packets Port Egress Queue Q5 5 Q6 10 Q7 15 In this example, the port transmits a maximum number of 15 packets from Q7 before moving to Q6, from which it transmits up to 10 packets, and so forth. The maximum number of packets that you can specify is 15.
AT-S63 Management Software Menus Interface User’s Guide Configuring CoS As explained in “Class of Service Overview” on page 322, a packet received on a port is placed it into one of eight priority queues on the egress port according to the switch’s mapping of 802.1p priority levels to egress priority queues. The default mappings are shown in Table 7 on page 323. You can override the mappings at the port level by assigning the packets a temporary priority level.
Chapter 16: Class of Service The Class of Service (CoS) menu is shown in Figure 106. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Class of Service (CoS) Number of CoS Queues: 8 1 2 3 4 - Configure Port CoS Priorities Map CoS Priority to Egress Queue Configure Egress Scheduling Show Port CoS Priorities R - Return to Previous Menu Enter your selection? Figure 106.
AT-S63 Management Software Menus Interface User’s Guide 5. Type 2 to select Priority (0 - 7). The following prompt is displayed: Enter new value -> [0 to 7] 6. Enter a new temporary priority value of 0 to 7 for the untagged frames received on the port. For example, to assign a temporary priority level of 4 to the ingress untagged packets, enter 4. The default is 0.
Chapter 16: Class of Service Mapping CoS Priorities to Egress Queues This procedure explains how to change the default mappings of CoS priorities to egress priority queues, shown in Table 7 on page 323. This is set at the switch level. You cannot set this at the per-port level. To change the mappings, perform the following procedure. 1. From the Main Menu, type 7 to select Security and Services. The Security and Services menu is shown in Figure 87 on page 291. 2.
AT-S63 Management Software Menus Interface User’s Guide 6. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes.
Chapter 16: Class of Service Configuring Egress Scheduling This procedure explains how to select and configure a scheduling method for Class of Service. Scheduling determines the order in which the ports handle packets in their egress queues. For an explanation of the two scheduling methods, refer to “Scheduling” on page 324. Scheduling is set at the switch level. You cannot set this on a per-port basis. 1. From the Main Menu, type 7 to select Security and Services.
AT-S63 Management Software Menus Interface User’s Guide 5. If you select Weighted Round Robin Priority as the scheduling method, select menu options 2 through 9 and specify the maximum number of packets you want a port to transmit from each queue before it moves to the next queue. The range is 1 to 15. For an example, refer to Table 9 on page 325. The default value of 1 for each queue gives all egress queues the same weight. 6. Return to the Main Menu and type S to select Save Configuration Changes.
Chapter 16: Class of Service Displaying Port CoS Priorities The following procedure displays a menu that lists the current CoS priority level for each port. 1. From the Main Menu, type 7 to select Security and Services. The Security and Services menu is shown in Figure 87 on page 291. 2. From the Security and Services menu, type 5 to select Class of Service (CoS). The Class of Service (CoS) menu is shown in Figure 106 on page 328. 3.
AT-S63 Management Software Menus Interface User’s Guide deactivated and the port is using the priority levels contained within the frames. If Yes, the override is activated and the tagged packets are assigned the temporary priority level shown in the Priority column.
Chapter 16: Class of Service 336 Section II: Advanced Operations
Chapter 17 Quality of Service This chapter describes Quality of Service (QoS).
Chapter 17: Quality of Service Quality of Service Overview Quality of Service allows you to prioritize traffic and/or limit the bandwidth available to it. The concept of QoS is a departure from the original networking protocols, which treated all traffic on the Internet or within a LAN in the same manner. Without QoS, every traffic type is equally likely to be dropped if a link becomes oversubscribed.
AT-S63 Management Software Menus Interface User’s Guide The QoS functionality described in this chapter sorts packets into various flows, according to the QoS policy that applies to the port the traffic is received on. The switch then allocates resources to direct this traffic according to bandwidth or priority settings in the policy. A policy contains traffic classes, flow groups, and classifiers. Therefore, to configure QoS, you: Create classifiers to sort packets into traffic flows.
Chapter 17: Quality of Service be added to another traffic class. A traffic class may have many flow groups. Traffic is matched in the order of the flow groups. For example, if a traffic class has flow groups 1, 3, 2 and 5, this is the order in which the packets are matched. QoS controls at the flow group level provide a QoS hierarchy. Non-default flow group settings are always used, but if no setting is specified for a flow group, the flow group uses the settings for the traffic class to which it belongs.
AT-S63 Management Software Menus Interface User’s Guide Packet Processing Bandwidth Allocation Packet Prioritization A policy may have many traffic classes. A policy may be assigned to many ports. A port may only have one policy. You can create a policy without assigning it to a port, but the policy will be inactive. A policy must have at least one action defined in the flow group, traffic class, or the policy itself. A policy without an action is invalid.
Chapter 17: Quality of Service in the appropriate CoS queue for its VLAN tag User Priority field. If neither the traffic class / flow group priority nor the VLAN tag User Priority is set, the packet is sent to the default queue, queue 1. Both the VLAN tag User Priority and the traffic class / flow group priority setting allow eight different priority values (0-7). These eight priorities are mapped to the switch’s eight CoS queues. The switch’s default mapping is shown in Table 7 on page 323.
AT-S63 Management Software Menus Interface User’s Guide DiffServ Domains Differentiated Services (DiffServ) is a method of dividing IP traffic into classes of service, without requiring that every router in a network remember detailed information about traffic flows. DiffServ operates within a DiffServ domain, a network or subnet that is managed as a single QoS unit.
Chapter 17: Quality of Service Assign the classifiers to flow groups and the flow groups to traffic classes, with a different traffic class for each DiffServ code point grouping within the DiffServ domain. Give each traffic class the priority and/or bandwidth limiting controls that are required for that type of packet within this part of the domain. Assign a DSCP value to each traffic class, to be written into the TOS field of the packet header. 2.
AT-S63 Management Software Menus Interface User’s Guide This example creates two policies that ensure low latency for all traffic sent by and destined to a voice application located on a node with the IP address 149.44.44.44. The policies raise the priority level of the packets to 7, the highest level. Policy 6 is for traffic from the application that enter the switch on port 1. Policy 11 is for traffic arriving on port 8 going to the application. The components of the policies are shown in Figure 112.
Chapter 17: Quality of Service The parts of the policies are: 346 Classifier - Defines the traffic flow by specifying the IP address of the node with the voice application. The classifier for Policy 6 specifies the address as a source address because this classifier is part of a policy for packets coming from the application. The classifier for Policy 11 specifies the address as a destination address because this classifier is part of a policy for packets going to the application.
AT-S63 Management Software Menus Interface User’s Guide Video Applications Video applications typically require a larger bandwidth than voice applications. Video applications can be set up to have a high priority and buffering, depending on the application. This example creates policies with low latency and jitter for video streams (for example, net conference calls). The policies in Figure 113 assign the packets a priority level of 4.
Chapter 17: Quality of Service The parts of the policies are: 348 Classifier - Specifies the IP address of the node with a video application. The classifier for Policy 17 specifies the address as a source address since this classifier is part of a policy concerning packets coming from the application. The classifier for Policy 32 specifies the address as a destination address because this classifier is part of a policy concerning packets going to the application.
AT-S63 Management Software Menus Interface User’s Guide Critical Database Critical databases typically require a high bandwidth. They also typically require less priority than either voice or video. The policies in Figure 114 assign 50 Mbps bandwidth, with no change to priority, to traffic going to and from a database. The database is located on a node with the IP address 149.44.44.44 on port 1 of the switch. Policy 15 Policy 17 Create Classifier Create Classifier 01 - Classifier ID: .....
Chapter 17: Quality of Service Policy Component Hierarchy The purpose of this example is to illustrate the hierarchy that exists among the components of a QoS policy and how that hierarchy needs to be taken into account when assigning new priority and DSCP values. A new priority can be set at the flow group and traffic class levels, while a new DSCP value can be set at all three levels—flow group, traffic class and policy.
AT-S63 Management Software Menus Interface User’s Guide Create Classifier 01 - Classifier ID: ..... 1 . 14 - Dst IP Addr ..... 149.11.11.0 15 - Dst IP Mask ..... 255.255.255.0 Create Classifier Create Flow Group 1 - Flow Group ID ......... 1 . 3 - DSCP Value ............. 10 . 9 - Classifier List ............1,2 01 - Classifier ID: ..... 2 . 14 - Dst IP Addr ..... 149.22.22.0 15 - Dst IP Addr ...... 255.255.255.0 Create Traffic Class 1 - Traffic Class ID: ........ 1 . 5 - DSCP value ............. 30 .
Chapter 17: Quality of Service Managing Flow Groups This section contains the following procedures: Creating a Flow Group “Creating a Flow Group,” next “Modifying a Flow Group” on page 355 “Deleting a Flow Group” on page 356 “Displaying Flow Groups” on page 358 To create a flow group, perform the following procedure: 1. From the Main Menu, type 7 to select Security and Services. The Security and Services menu is shown in Figure 87 on page 291. 2.
AT-S63 Management Software Menus Interface User’s Guide The Flow Group Configuration menu is shown in Figure 117. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Flow Group Configuration 1 2 3 4 - Create Flow Group Modify Flow Group Destroy Flow Group Show Flow Groups R - Return to Previous Menu Enter your selection? Figure 117. Flow Group Configuration Menu 4. From the Flow Group Configuration menu, type 1 to select Create Flow Group.
Chapter 17: Quality of Service 2 - Description Specifies a description for the flow group. The description can be from 1 to 15 alphanumeric characters including spaces. This parameter is optional, but recommended. Names can help you identify the groups on the switch. 3 - DSCP value Specifies a replacement value to write into the DSCP (TOS) field of the packets. The range is 0 to 63. A new DSCP value can be set at all three levels: flow group, traffic class, and policy.
AT-S63 Management Software Menus Interface User’s Guide 7. To create another flow group, repeat this procedure starting with step 4. To assign the flow group to a traffic class, go to “Managing Traffic Classes” on page 361. 8. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. Modifying a Flow Group To modify a flow group, perform the following procedure: 1. From the Main Menu, type 7 to select Security and Services.
Chapter 17: Quality of Service The Modify Flow Group menu is shown in Figure 119. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Modify Flow Group 1 2 3 4 5 6 7 8 9 - Flow Group ID .............. Description ................ DSCP value ................. Priority ................... Remark Priority ............ ToS ........................ Move ToS to Priority ....... Move Priority to ToS ....... Classifier List ............
AT-S63 Management Software Menus Interface User’s Guide The Quality of Service (QoS) menu is shown in Figure 116 on page 352. 3. From the Quality of Service (QoS) menu, type 1 to select Flow Group Configuration. The Flow Group Configuration menu is shown in Figure 117 on page 353. 4. From the Flow Group Configuration menu, type 3 to select Destroy Flow Group. The following prompt is displayed: Available Flow Group(s): 0-10 Enter Flow Group ID : [0 to 1023] -> 0 5.
Chapter 17: Quality of Service Displaying Flow Groups To display flow groups, perform the following procedure: 1. From the Main Menu, type 7 to select Security and Services. The Security and Services menu is shown in Figure 87 on page 291. 2. From the Security and Services menu, type 6 to select Quality of Service. The Quality of Service (QoS) menu is shown in Figure 116 on page 352. 3. From the Quality of Service (QoS) menu, type 1 to select Flow Group Configuration.
AT-S63 Management Software Menus Interface User’s Guide Parent Traffic Class ID The ID number of the traffic class to which the flow group is assigned. A flow group can belong to only one traffic class at a time. Active The status of the flow group. If the flow group is part of a QoS policy that is assigned to one or more ports, the flow group is deemed active. If the flow group has not been assigned to a policy or if the policy has not been assigned to any ports, the flow group is deemed inactive. 5.
Chapter 17: Quality of Service DSCP value The replacement value to write into the DSCP (TOS) field of the packets. Priority The new user priority value for the packets. Remark Priority Replaces the user priority value in the packets with the Priority value. ToS Specifies a replacement value to write into the Type of Service (ToS) field of IPv4 packets. The range is 1 to 7. Move ToS to Priority If set to Yes, replaces the value in the 802.
AT-S63 Management Software Menus Interface User’s Guide Managing Traffic Classes This section contains the following procedures: Creating a Traffic Class “Creating a Traffic Class,” next “Modifying a Traffic Class” on page 365 “Deleting a Traffic Class” on page 367 “Displaying Traffic Classes” on page 368 To create a traffic class, perform the following procedure: 1. From the Main Menu, type 7 to select Security and Services.
Chapter 17: Quality of Service The Create Traffic Class menu is shown in Figure 124. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Create Traffic Class 1 2 3 4 5 6 7 8 9 A B D E - Traffic Class ID .......... Description ............... Exceed Action ............. Exceed Remark Value ....... DSCP value ................ Max bandwidth ............. Burst Size ................ Priority .................. Remark Priority ........... ToS .......................
AT-S63 Management Software Menus Interface User’s Guide 5 - DSCP value Specifies a replacement value to write into the DSCP (TOS) field of the packets. The range is 0 to 63. A new DSCP value can be set at all three levels: flow group, traffic class, and policy. A DSCP value specified in a flow group overrides a DSCP value specified at the traffic class or policy level. A DSCP value specified at the traffic class level is used only if no value has been specified at the flow group level.
Chapter 17: Quality of Service matches the number being used by the traffic. However, no unused tokens will accumulate in the bucket. If the traffic increases, the excess traffic will be discarded since no tokens are available for handling the increase. If the traffic is below the maximum bandwidth, unused tokens will accumulate in the bucket since the actual bandwidth falls below the specified maximum.
AT-S63 Management Software Menus Interface User’s Guide value in the ToS priority field for IPv4 packet. If set to No, which is the default, the packets retain their preexisting 802.1p priority level. D - Move Priority to ToS If set to yes, replaces the value in the ToS priority field with the value in the 802.1p priority field on IPv4 packets. If set to No, which is the default, the packets retain their preexisting ToS priority level.
Chapter 17: Quality of Service The Modify Traffic Class menu is shown in Figure 125. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Modify Traffic Class 1 2 3 4 5 6 7 8 9 A B D E - Traffic Class ID .......... Description ............... Exceed Action ............. Exceed Remark Value ....... DSCP value ................ Max bandwidth ............. Burst Size ................ Priority .................. Remark Priority ........... ToS .......................
AT-S63 Management Software Menus Interface User’s Guide Deleting a Traffic Class To delete a traffic class, perform the following procedure: 1. From the Main Menu, type 7 to select Security and Services. The Security and Services menu is shown in Figure 87 on page 291. 2. From the Security and Services menu, type 6 to select Quality of Service. The Quality of Service (QoS) menu is shown in Figure 116 on page 352. 3. From the Quality of Service (QoS) menu, type 2 to select Traffic Class Configuration.
Chapter 17: Quality of Service 6. Type D to delete the traffic class. The traffic class is deleted from the switch. The class is removed from any policies to which it is assigned. 7. To delete another traffic class, repeat this procedure starting with step 4. 8. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. Displaying Traffic Classes To display the traffic classes, perform the following procedure: 1.
AT-S63 Management Software Menus Interface User’s Guide The Show Traffic Classes menu provides the following information: ID The traffic class’ ID number. Description A description of the traffic class. Parent Policy ID The ID number of the policy where the traffic class is assigned. A traffic class can belong to only one policy at a time. Active The status of the traffic class. If the traffic class is part of a QoS policy that is assigned to one or more ports, the traffic class is deemed active.
Chapter 17: Quality of Service The Display Traffic Class Details menu provides the following information: Traffic Class ID The traffic class ID number. Description The description of the traffic class. Exceed Action The action taken if the traffic of the traffic class exceeds the maximum bandwidth. Exceed Remark Value The DSCP replacement value for traffic that exceeds the maximum bandwidth. DSCP value The replacement value to write into the DSCP (TOS) field of the packets.
AT-S63 Management Software Menus Interface User’s Guide Managing Policies This section contains the following procedures: Creating a Policy “Creating a Policy,” next “Modifying a Policy” on page 374 “Deleting a Policy” on page 375 “Displaying Policies” on page 376 To create a policy, perform the following procedure: 1. From the Main Menu, type 7 to select Security and Services. The Security and Services menu is shown in Figure 87 on page 291. 2.
Chapter 17: Quality of Service The Create Policy menu is shown in Figure 130. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Create Policy 1 2 3 4 5 6 7 8 9 A B D - Policy ID ................ Description .............. Remark DSCP .............. DSCP value ............... ToS ...................... Move ToS to Priority ..... Move Priority to ToS ..... Send to Mirror Port ...... Traffic Class List ....... Redirect Port ............ Ingress Port List ........
AT-S63 Management Software Menus Interface User’s Guide 5 - ToS Specifies a replacement value to write into the Type of Service (ToS) field of IPv4 packets. The range is 1 to 7. A ToS value specified at the policy level is used only if no value has been specified at the flow group and traffic class levels. 6 - Move ToS to Priority If set to yes, replaces the value in the 802.1p priority field with the value in the ToS priority field on IPv4 packets.
Chapter 17: Quality of Service 8. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. Modifying a Policy To modify a policy, perform the following procedure: 1. From the Main Menu, type 7 to select Security and Services. The Security and Services menu is shown in Figure 87 on page 291. 2. From the Security and Services menu, type 6 to select Quality of Service. The Quality of Service (QoS) menu is shown in Figure 116 on page 352. 3.
AT-S63 Management Software Menus Interface User’s Guide 6. Modify the settings as needed. For parameter definitions, refer to “Creating a Policy” on page 371. When you modify a policy, note the following: You cannot change the traffic class ID number. To delete a value from a variable so as to leave it blank, select the variable and then use the backspace key to delete its default value.
Chapter 17: Quality of Service 7. To delete another policy, repeat this procedure starting with step 4. 8. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. Displaying Policies To display policies, perform the following procedure: 1. From the Main Menu, type 7 to select Security and Services. The Security and Services menu is shown in Figure 87 on page 291. 2. From the Security and Services menu, type 6 to select Quality of Service.
AT-S63 Management Software Menus Interface User’s Guide Description A description of the policy. Active The status of the policy. A policy that is assigned to one or more ports is deemed active while a policy that is not assigned to any ports is deemed inactive. 5. To display the specifics of a policy, type D to select Display Policy Details. The following prompt is displayed: Available Policy(ies): 0-4 Enter Policy ID : [0 to 255] -> 0 6. Enter the ID number of the policy you want to view.
Chapter 17: Quality of Service Remark DSCP The conditions under which the ingress DSCP value is overwritten. DSCP value The replacement value to write into the DSCP (TOS) field of the packets. ToS Specifies a replacement value to write into the Type of Service (ToS) field of IPv4 packets. The range is 1 to 7. A ToS value specified at the policy level is used only if no value has been specified at the flow group and traffic class levels. Move ToS to Priority If set to yes, replaces the value in the 802.
Chapter 18 Denial of Service Defense This chapter contains procedures for configuring the switch to protect against denial of service (DoS) attacks.
Chapter 18: Denial of Service Defense Denial of Service Overview The AT-S63 management software can help protect your switch against the following types of denial of service attacks. SYN Flood Attack Smurf Attack Land Attack Teardrop Attack Ping of Death Attack IP Options Attack The following subsections briefly describe each type of attack and the mechanism employed by the AT-S63 management software to protect your network.
AT-S63 Management Software Menus Interface User’s Guide Smurf Attack This DoS attack is instigated by an attacker sending a ICMP Echo (Ping) request containing the network’s IP broadcast address as the destination address and the address of the victim as the source of the ICMP Echo (Ping) request. This overwhelms the victim with a large number of ICMP Echo (Ping) replies from the other network nodes.
Chapter 18: Denial of Service Defense which are from outside you network. The following is a overview of how the process takes place. This example assumes that you have activated the feature on port 4, which is connected to a device local to your network, and that you have specified port 1 as the uplink port, which is connected to the device that leads outside your network. The steps below review what happens when an ingress IP packet from the local device arrives on port 4: 1.
AT-S63 Management Software Menus Interface User’s Guide Teardrop Attack An attacker sends an IP packet in several fragments with a bogus offset value, used to reconstruct the packet, in one of the fragments to a victim. The victim is unable to reassemble the packet, possibly causing it to freeze operations. The defense mechanism for this type of attack has all ingress fragmented IP traffic received on a port sent to the switch’s CPU.
Chapter 18: Denial of Service Defense Note This defense mechanism requires some involvement by the switch’s CPU, though not as much as the Teardrop defense. This does not impact the forwarding of traffic between the switch ports, but it can affect the handling of CPU events, such as the processing of IGMP packets and spanning tree BPDUs. For this reason, Allied Telesyn recommends limiting the use of this defense, activating it only on those ports where an attack is most likely to originate.
AT-S63 Management Software Menus Interface User’s Guide Configuring Denial of Service Defense To configure DoS defense, perform the following procedure: 1. From the Main Menu, type 7 to select Security and Services. The Security and Services menu is shown in Figure 87 on page 291. 2. From the Security Configuration menu, type 2 to select Denial of Service (DoS). The Denial of Service (DoS) menu is shown in Figure 134.
Chapter 18: Denial of Service Defense The LAN IP Subnet menu is shown in Figure 135. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 LAN IP Subnet 1 - IP Address ................. 0.0.0.0 2 - Subnet Mask ................ 0.0.0.0 3 - Uplink Port ................ 26 R - Return to Previous Menu Enter your selection? Figure 135. LAN IP Subnet Menu b. Type 1 to select IP Address.
AT-S63 Management Software Menus Interface User’s Guide 5. Enter the port(s) where you want to activate the defense. Note If you plan to use the Teardrop defense, Allied Telesyn recommends activating it on only the uplink port and one other port. The defense is CPU intensive and can overwhelm the switch’s CPU. A menu is displayed containing either one or two options, depending on the DoS defense you selected. An example of the menu is shown in Figure 136.
Chapter 18: Denial of Service Defense 388 Section II: Advanced Operations
Section III IGMP Snooping, MLD Snooping, and RRP Snooping The chapters in this section contain overview information on IGMP snooping, MLD snooping, and RRP snooping. The chapters also explain how to configure these features from the menus interface of the AT-S63 management software.
Section III: IGMP Snooping, MLD Snooping, and RRP Snooping
Chapter 19 IGMP Snooping This chapter explains how to activate and configure the Internet Group Management Protocol (IGMP) snooping feature on the switch.
Chapter 19: IGMP Snooping IGMP Snooping Overview The IGMP protocol enables IPv4 routers to create lists of nodes that are members of multicast groups. (A multicast group is a group of end nodes that want to receive multicast packets from a multicast application.) The router creates a multicast membership list by periodically sending out queries to the local area networks connected to its ports. A node wanting to become a member of a multicast group responds to a query by sending a report.
AT-S63 Management Software Menus Interface User’s Guide Without IGMP snooping a switch would have to flood multicast packets out all of its ports, except the port on which it received the packet. Such flooding of packets can negatively impact network performance.
Chapter 19: IGMP Snooping Configuring IGMP Snooping To configure IGMP snooping on the switch, perform the following procedure: 1. From the Main Menu, type 6 to select Advanced Configuration. The Advanced Configuration menu is shown in Figure 137.
AT-S63 Management Software Menus Interface User’s Guide The IGMP Snooping Configuration menu is shown in Figure 138. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 IGMP Snooping Configuration 1 2 3 4 5 6 7 - IGMP Snooping Status ........... Host Topology .................. Host/Router Timeout Interval ... Maximum IGMP Multicast Groups .. Router Port(s) .................
Chapter 19: IGMP Snooping If a switch has a mixture of host nodes, that is, some connected directly to the switch and others through an Ethernet hub, you should select the Multi-Host Port (Intermediate) selection. 3 - Host/Router Timeout Interval Specifies the time period in seconds at which the switch determines that a host node has become inactive. An inactive host node is a node that has not sent an IGMP report during the specified time interval. The range is from 0 second to 86,400 seconds (24 hours).
AT-S63 Management Software Menus Interface User’s Guide Enabling or Disabling IGMP Snooping To activate or deactivate IGMP snooping on the switch, perform the following procedure: 1. From the Main Menu, type 6 to select Advanced Configuration. The Advanced Configuration menu is shown in Figure 137 on page 394. 2. From the Advanced Configuration menu, type 2 to select IGMP Snooping Configuration. The IGMP Snooping Configuration menu is shown in Figure 138 on page 395. 3.
Chapter 19: IGMP Snooping Displaying a List of Host Nodes You can use the AT-S63 management software to display a list of the multicast groups on a switch, as well as the host nodes. To display the list, perform the following procedure: 1. From the Main Menu, type 6 to select Advanced Configuration. The Advanced Configuration menu is shown in Figure 137 on page 394 2. From the Advanced Configuration menu, type 2 to select IGMP Snooping Configuration.
AT-S63 Management Software Menus Interface User’s Guide VLAN The VID of the VLAN where the port is an untagged member. Port/Trunk The port on the switch where the host node is connected. If the host node is connected to the switch through a trunk, the trunk ID number, not the port number, is displayed. HostIP The IP address of the host node connected to the port. IGMP Ver. The version of IGMP used by the host. Exp.
Chapter 19: IGMP Snooping Displaying a List of Multicast Routers A multicast router is a router that is receiving multicast packets from a multicast application and transmitting the packets to host nodes. You can use the AT-S63 management software to display a list of the multicast routers that are connected to the switch. To display a list of the multicast routers, perform the following procedure: 1. From the Main Menu, type 6 to select Advanced Configuration.
AT-S63 Management Software Menus Interface User’s Guide switch learned the router on a port trunk, the trunk ID number, not the port number, is displayed. Router IP The IP address of the multicast router.
Chapter 19: IGMP Snooping 402 Section III: IGMP Snooping, MLD Snooping, and RRP Snooping
Chapter 20 MLD Snooping This chapter explains how to activate and configure Multicast Listener Discovery (MLD) snooping on the switch.
Chapter 20: MLD Snooping MLD Snooping Overview MLD snooping performs the same function as IGMP snooping. The switch uses the feature to build multicast membership lists and uses the lists to forward multicast packets only to switch ports where there are host nodes that are members of the multicast groups. The difference between the two is that MLD snooping is for IPv6 and IGMP snooping for IPv4 environments. (For background information on IGMP snooping, refer to “IGMP Snooping Overview” on page 392.
AT-S63 Management Software Menus Interface User’s Guide Configuring MLD Snooping To configure MLD snooping on the switch, perform the following procedure: 1. From the Main Menu, type 6 to select Advanced Configuration. The Advanced Configuration menu is shown in Figure 137 on page 394. 2. From the Advanced Configuration menu, type 3 to select MLD Snooping Configuration. The MLD Snooping Configuration menu is shown in Figure 141.
Chapter 20: MLD Snooping additional multicast packets out the port where the host node is connected. Multiple Host/Ports (Intermediate) The Multi-Host setting is appropriate if there is more than one host node connected to a switch port, such as when a port is connected to an Ethernet hub to which multiple host nodes are connected. With this setting selected the switch continues sending multicast packets out a port even after it receives a leave request from a host node on the port.
AT-S63 Management Software Menus Interface User’s Guide Note A change to any parameter in this menu is immediately activated on the switch. Note Selection 6, View MLD Multicast Hosts List, is described in “Displaying a List of Host Nodes” on page 409. Selection 7, View MLD Multicast Routers List, is described in “Displaying a List of Multicast Routers” on page 411. 4. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes.
Chapter 20: MLD Snooping Enabling or Disabling MLD Snooping To activate or deactivate MLD snooping on the switch, perform the following procedure: 1. From the Main Menu, type 6 to select Advanced Configuration. The Advanced Configuration menu is shown in Figure 137 on page 394. 2. From the Advanced Configuration menu, type 3 to select MLD Snooping Configuration. The MLD Snooping Configuration menu is shown in Figure 141 on page 405. 3.
AT-S63 Management Software Menus Interface User’s Guide Displaying a List of Host Nodes You can use the AT-S63 management software to display a list of the multicast groups on a switch, as well as the host nodes. To display the list, perform the following procedure: 1. From the Main Menu, type 6 to select Advanced Configuration. The Advanced Configuration menu is shown in Figure 137 on page 394 2. From the Advanced Configuration menu, type 3 to select MLD Snooping Configuration.
Chapter 20: MLD Snooping node is connected to the switch through a trunk, the trunk ID number, not the port number, is displayed. HostIP The IP address of the host node connected to the port. Exp. Time The number of seconds remaining before the host is timed out if no further MLD reports are received from it.
AT-S63 Management Software Menus Interface User’s Guide Displaying a List of Multicast Routers A multicast router is a router that is receiving multicast packets from a multicast application and transmitting the packets to host nodes. You can use the AT-S63 management software to display a list of the multicast routers that are connected to the switch. To display a list of the multicast routers, perform the following procedure: 1. From the Main Menu, type 6 to select Advanced Configuration.
Chapter 20: MLD Snooping Port/Trunk ID The port on the switch where the multicast router is connected. If the switch learned the router on a port trunk, the trunk ID number, not the port number, is displayed. Router IP The IP address of the multicast router.
Chapter 21 RRP Snooping This chapter explains RRP snooping and contains the following sections: “RRP Snooping Overview” on page 414 “Enabling or Disabling RRP Snooping” on page 416 Section III: IGMP Snooping, MLD Snooping, and RRP Snooping 413
Chapter 21: RRP Snooping RRP Snooping Overview The Router Redundancy Protocol (RRP) allows multiple routers to share the same virtual IP address and MAC address. In network topologies where redundant router paths or links exist, the protocol enables routers, through an election process, to designate one as the master router. This router functions as the provider of the primary path between LAN segments. Slave routers function as backup paths in the event that the master router or primary path fails.
AT-S63 Management Software Menus Interface User’s Guide RRP snooping is supported on ports operating in the MAC addressbased port security level of automatic. This feature is not supported on ports operating with a security level of limited, secured, or locked. RRP snooping is supported on port trunks.
Chapter 21: RRP Snooping Enabling or Disabling RRP Snooping To enable or disable RRP snooping on a switch, perform the following procedure: 1. From the Main Menu, type 6 to select Advanced Configuration. The Advanced Configuration menu is shown in Figure 137 on page 394. 2. From the Advanced Configuration menu, type 1 to select RRP Snooping Configuration. The RRP Snooping Configuration menu is shown in Figure 144.
Section IV SNMPv3 The chapter in this section contains overview information on SNMPv3. The chapter also explains how to configure this feature from the menus interface of the AT-S63 management software.
Section III: SNMPv3
Chapter 22 SNMPv3 This chapter provides a description of the AT-S63 implementation of the SNMPv3 protocol. In addition, the chapter contains procedures that allow you to create and modify SNMPv3 entities.
Chapter 22: SNMPv3 SNMPv3 Overview The SNMPv3 protocol builds on the existing SNMPv1 and SNMPv2c protocol implementation which is described in Chapter 5, “SNMPv1 and SNMPv2c” on page 95. In SNMPv3, User-based Security Model (USM) authentication is implemented along with encryption, allowing you to configure a secure SNMP environment. In addition, SNMP terminology changes in the SNMPv3 protocol. In the SNMPv1 and SNMPv2c protocols, the terms agent and manager are used.
AT-S63 Management Software Menus Interface User’s Guide SNMPv3 Authentication Protocols “SNMPv3 Configuration Example” on page 428 The SNMPv3 protocol supports two authentication protocols—HMACMD5-96 (MD5) and HMAC-SHA-96 (SHA). Both MD5 and SHA use an algorithm to generate a message digest. Each authentication protocol authenticates a user by checking the message digest. In addition, both protocols use keys to perform authentication.
Chapter 22: SNMPv3 SNMPv3 MIB Views The SNMPv3 protocol allows you to configure MIB views for users and groups. The MIB tree is defined by RFC 1155 (Structure of Management Information). See Figure 145.
AT-S63 Management Software Menus Interface User’s Guide MIB subtree view and a subtree mask is analogous to the relationship between an IP address and a subnet mask. The switch uses the subnet mask to determine which portion of an IP address represents the network address and which portion represents the node address. In a similar way, the subtree mask further refines the subtree view and enables you to restrict a MIB view to a specific row of the OID MIB table.
Chapter 22: SNMPv3 Level, Privacy Protocol and Group—with the type of message and the host IP address. SNMPv3 Tables The SNMPv3 configuration is neatly divided into configuring SNMPv3 user information and configuring the message notification. You must configure all seven tables to successfully configure the SNMPv3 protocol.
AT-S63 Management Software Menus Interface User’s Guide Configure SNMPv3 Notify Table Configure SNMPv3 Target Address Table Configure SNMPv3 Target Parameters Table You start the message notification configuration by defining the type of message you want to send with the SNMPv3 Notify Table. Then you define a IP address that is used for notification in the Configure SNMPv3 Target Address Table. This is the IP address of the SNMPv3 host.
Chapter 22: SNMPv3 “SNMPv3 Target Parameters Table” on page 427 “SNMPv3 Community Table” on page 427 SNMPv3 User Table The Configure SNMPv3 User Table menu allows you to create an SNMPv3 user and provides the options of configuring authentication and privacy protocols. With the SNMPv3 protocol, users are authenticated when they send and receive messages. In addition, you can configure a privacy protocol and password so messages a user sends and receives are encrypted.
AT-S63 Management Software Menus Interface User’s Guide SNMPv3 SecurityToGroup Table The Configure SNMPv3 SecurityToGroup Table menu allows you to associate a User Name with a security group called a Group Name. The User Name is previously configured with the Configure SNMPv3 User Table menu. The security group is previously configured with the Configure SNMPv3 Access Table menu. Lastly, you can configure a storage type for this table entry which allows you to save the entry to flash memory.
Chapter 22: SNMPv3 Tables to configure SNMPv1 and SNMPv2c communities, start with the SNMPv3 Community Table. See “Configuring the SNMPv3 Community Table” on page 505. Note Allied Telesyn recommends that you use the procedures described in Chapter 5, “SNMPv1 and SNMPv2c” on page 95 to configure the SNMPv1 and SNMPv2c protocols. SNMPv3 Configuration Example 428 You may want to have two classes of SNMPv3 users—Managers and Operators.
AT-S63 Management Software Menus Interface User’s Guide Configuring SNMPv3 Entities This section describes how to configure SNMPv3 entities using the SNMPv3 Tables. To successfully configure this protocol, you must perform the procedures in the order given. For overview information about SNMPv3, see the “SNMPv3 Overview” on page 420.
Chapter 22: SNMPv3 Configuring the SNMPv3 User Table This section contains a description of the SNMPv3 User Table and how to create, delete, and modify table entries. Configure the SNMPv3 User Table first. Creating this table, allows you to create an entry in an SNMPv3 User Table for a User Name.
AT-S63 Management Software Menus Interface User’s Guide The Configure SNMPv3 Table menu is shown in Figure 148. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Configure SNMPv3 Table 1 2 3 4 5 6 7 8 9 - SNMP Engine...............
Chapter 22: SNMPv3 5. To create a new user table, type 1 to select Create SNMPv3 Table Entry. The following prompt is displayed: Enter User (Security) Name: 6. Enter a descriptive name of the user. You can enter a name that consists of up to 32 alphanumeric characters. The following prompt is displayed: Enter Authentication Protocol [M-MD5, S-SHA, N-None]: 7. Enter one of the following: M-MD5 This value represents the MD5 authentication protocol.
AT-S63 Management Software Menus Interface User’s Guide You are prompted to re-enter the password. The following prompt is displayed: Enter Privacy Protocol [D-DES, N-None]: Note You can only configure the Privacy Protocol if you have configured the Authentication Protocol with the MD5 or SHA values. 9. Select one of the following options: D -DES Select this value to make the DES privacy (or encryption) protocol the privacy protocol for this User Table entry.
Chapter 22: SNMPv3 allowing you to save your changes. Allied Telesyn recommends this storage type. Note The Row Status parameter is a read-only field. The Active value indicates the SNMPv3 User Table entry takes effect immediately. 12. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. Deleting an SNMPv3 User Table Entry You may want to delete an entry from the SNMPv3 User Table.
AT-S63 Management Software Menus Interface User’s Guide “Modifying the Privacy Protocol and Password” on page 437 “Modifying the Storage Type” on page 438 Modifying the Authentication Protocol and Password To modify the Authentication Protocol and Password in an SNMPv3 User Table entry, perform the following procedure. 7. Follow steps 1 through 5 in the procedure described in “Configuring the SNMPv3 User Table” on page 430. Or, from the Main Menu type 5->1->1->8->5.
Chapter 22: SNMPv3 11. Enter the User Name of the User Table you want to modify. The following prompt is displayed: Enter Authentication Protocol [M-MD5, S-SHA, N-None]: 12. Enter one of the following: M-MD5 This value represents the MD5 authentication protocol. With this selection, users (SNMP entities) are authenticated with the MD5 authentication protocol after a message is received. This algorithm generates the message digest.
AT-S63 Management Software Menus Interface User’s Guide Re-enter Privacy password: 16. Re-enter the password. 17. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. Modifying the Privacy Protocol and Password To modify the Privacy Protocol and Password in an SNMPv3 User Table entry, perform the following procedure. Note You can only configure the Privacy Protocol if you have configured the Authentication Protocol with the MD5 or SHA values.
Chapter 22: SNMPv3 messages transmitted between the host and the switch are encrypted with the DES protocol. N -None Select this value if you do not want a privacy protocol for this User Table entry. With this selection, messages transmitted between the host and the switch are not encrypted. If you select None, proceed to step 9. If you select DES, the following prompt is displayed: Enter Privacy Password: 7. Enter a privacy password of up to 32 alphanumeric characters.
AT-S63 Management Software Menus Interface User’s Guide 5. Enter the User Name. The following prompt is displayed: Enter Storage Type [V-Volatile, N-NonVolatile]: 6. Select one of the following storage types for this table entry: V - Volatile Select this storage type if you do not want the ability to save an entry in the SNMPv3 User Table to nonvolatile memory.
Chapter 22: SNMPv3 Configuring the SNMPv3 View Table This section contains a description of the SNMPv3 View Table and how to create, delete, and modify table entries. Creating this table, allows you to specify a view using the following parameters: Subtree OID Subtree Mask MIB OID Table View To configure the SNMPv3 View Table, you need to be very familiar with the OID table. You can be very specific about the view a user can or cannot access—down to a column or row of the table.
AT-S63 Management Software Menus Interface User’s Guide The Configure SNMPv3 View Table menu is shown in Figure 151. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Configure SNMPv3 View Table View Name ................. Subtree OID ............... Subtree Mask .............. View Type ................. Storage Type .............. Row Status ................ internet 1.3.6.
Chapter 22: SNMPv3 tcp The following prompt is displayed: Enter Subtree Mask (Hex format): 6. Enter a subtree mask in hexadecimal format. This is an optional parameter that is used to further refine the value in the View Subtree parameter. This parameter is in binary format. The relationship between a subtree mask and a subtree is similar to the relationship between an IP address and a subnet mask. The subnet mask further refines the IP address.
AT-S63 Management Software Menus Interface User’s Guide N-NonVolatile Select this storage type if you want the ability to save an entry in the SNMPv3 View Table to the configuration file. After making changes to an SNMPv3 View Table entry with a NonVolatile storage type, the S Save Configuration Changes option appears on the Main Menu, allowing you to save your changes. Allied Telesyn recommends this storage type. Note The Row Status parameter is a read-only field.
Chapter 22: SNMPv3 6. Enter Y to delete the view or N to save the view. 7. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. Modifying an SNMPv3 View Table Entry This section describes how to modify parameters in an SNMPv3 Notify Table entry.
AT-S63 Management Software Menus Interface User’s Guide The Modify SNMPv3 View Table menu is shown in Figure 152. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Modify SNMPv3 View Table View Name ................. Subtree OID ............... Subtree Mask .............. View Type ................. Storage Type .............. Row Status ................ tcp 1.3.6.1.2.1.
Chapter 22: SNMPv3 This is an optional parameter that is used to further refine the value in the View Subtree parameter. This parameter is in binary format. A subtree mask and a subtree have a similar relationship as an IP address and a subnet mask. The subnet mask further refines the IP address. In the same way, the OID table entry defines a MIB View and the subtree mask further restricts a user’s view to a specific the column and row of the MIB View.
AT-S63 Management Software Menus Interface User’s Guide The following prompt is displayed: Enter View Subtree (OID format/Text Name): 6. Enter the View Subtree value for this View Name. You can enter either a numeric value in hex format or the equivalent text name. For example, the OID hex format for TCP/IP is: 1.3.6.1.2.1.6 The text format is for TCP/IP is: tcp The following prompt is displayed: Enter View Type [I-Included, E-Excluded]: 7.
Chapter 22: SNMPv3 The Modify SNMPv3 Table menu is shown in Figure 152 on page 445. 4. To modify the storage type, type 3 to select Set Storage Type. The following prompt is displayed: Enter View Name: 5. Enter the View Name you want to modify. The following prompt is displayed: Enter View Subtree (OID format/Text Name): 6. Enter the View Subtree for this View Name. The following prompt is displayed: Enter Storage Type [V-Volatile, N-Nonvolatile]: 7.
AT-S63 Management Software Menus Interface User’s Guide Configuring the SNMPv3 Access Table This section contains a description of the SNMPv3 Access Table and how to create, delete, and modify table entries. The SNMPv3 Access Table allows you to configure a security group. Each user must belong to a security group. After you have configured a security group, use the SecurityToGroup Table to assign users to security groups. See “Creating an SNMPv3 SecurityToGroup Table Entry” on page 464.
Chapter 22: SNMPv3 The Configure SNMPv3 Access Table menu is shown in Figure 153. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Configure SNMPv3 Access Table Group Name .... Context Prefix. Read View...... Write View .... Notify View ... softwareengineering internet tcp tcp Security Model . Security Level . Context Match .. Storage Type ... Row Status .....
AT-S63 Management Software Menus Interface User’s Guide Note The Context Prefix and the Context Match fields are a read only fields. The Context Prefix field is always set to null. The Context Match field is always set to exact. The following prompt is displayed: Enter Security Model [1-v1, 2-v2c, 3-v3]: 5. Select one of the following SNMP protocols as the Security Model for this Group Name. 1-v1 Select this value to associate the Group Name with the SNMPv1 protocol.
Chapter 22: SNMPv3 P-AuthPriv This option represents authentication and the privacy protocol. Select this security level to encrypt messages using a privacy protocol and authenticate SNMP entities. This level provides the greatest level of security. You can select this value if you configured the Security Model parameter with the SNMPv3 protocol. The following prompt is displayed: Enter Read View Name: 7. Enter a value that you configured with the View Name parameter in the SNMPv3 View Table.
AT-S63 Management Software Menus Interface User’s Guide N-NonVolatile Select this storage type if you want the ability to save an entry in the SNMPv3 Access Table to the configuration file. After making changes to an SNMPv3 Access Table entry with a NonVolatile storage type, the S - Save Configuration Changes option appears on the Main Menu, allowing you to save your changes. Allied Telesyn recommends this storage type. Note The Row Status parameter is a read-only field.
Chapter 22: SNMPv3 The following prompt is displayed: Enter Security Model [1-v1, 2-v2c, 3-v3]: 5. Enter the Security Model of this Group Name. Select one of the following security levels: 1-v1 Select this value to associate the Group Name with the SNMPv1 protocol. 2-v2c Select this value to associate the Group Name with the SNMPv2c protocol. 3-v3 Select this value to associate the Group Name with the SNMPv3 protocol.
AT-S63 Management Software Menus Interface User’s Guide Do you want to delete this table entry?(Y/N):[Yes/No]-> 7. Enter Y to delete the view or N to save the view. The following prompt is displayed: 8. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. Modifying an SNMPv3 Access Table Entry This section describes how to modify parameters in an SNMPv3 Access Table entry.
Chapter 22: SNMPv3 3. From the Configure SNMPv3 Access Table, type 3 to select Modify SNMPv3 Table Entry. The Modify SNMPv3 Access Table is shown in Figure 154. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Modify SNMPv3 Access Table Group Name .... Context Prefix. Read View...... Write View .... Notify View ... 1 2 3 4 - Set Set Set Set sales systemmanagers salespeople salespeople Security Model . Security Level . Context Match .. Storage Type ...
AT-S63 Management Software Menus Interface User’s Guide 3-v3 Select this value to associate the Group Name with the SNMPv3 protocol. The following prompt is displayed: Enter Security Level [N-NoAuthNoPriv, A-AuthNoPriv, P-AuthPriv]: 7. Select one of the following security levels: N-NoAuthNoPriv This option represents no authentication and no privacy protocol. Select this security level if you do not want to authenticate SNMP entities and you do not want to encrypt messages using a privacy protocol.
Chapter 22: SNMPv3 Modifying the Write View Name To modify the Write View Name parameter in an SNMPv3 Access Table entry, perform the following procedure. 1. Follow steps 1 through 5 in the procedure described in “Creating an SNMPv3 User Table Entry” on page 430. Or, from the Main Menu type 5->1->1->8->5. The Configure SNMPv3 Table menu is shown in Figure 148 on page 431. 2. From the Configure SNMPv3 Table menu, type 4 to select Configure SNMPv3 Access Table.
AT-S63 Management Software Menus Interface User’s Guide The following prompt is displayed: Enter Security Level [N-NoAuthNoPriv, A-AuthNoPriv, P-AuthPriv]: 7. Enter the Security Level configured for this Group Name. You cannot change the value of the Security Level parameter. Select one of the following security levels: N-NoAuthNoPriv This option represents no authentication and no privacy protocol.
Chapter 22: SNMPv3 Modifying the Notify View Name To modify the Notify View Name parameter in an SNMPv3 Access Table entry, perform the following procedure. 1. Follow steps 1 through 5 in the procedure described in “Creating an SNMPv3 User Table Entry” on page 430. Or, from the Main Menu type 5->1->1->8->5. The Configure SNMPv3 Table menu is shown in Figure 148 on page 431. 2. From the Configure SNMPv3 Table menu, type 4 to select Configure SNMPv3 Access Table.
AT-S63 Management Software Menus Interface User’s Guide The following prompt is displayed: Enter Security Level [N-NoAuthNoPriv, A-AuthNoPriv, P-AuthPriv]: 7. Enter the Security Level configured for this Group Name. You cannot change the value of the Security Level parameter. Select one of the following security levels: N-NoAuthNoPriv This option represents no authentication and no privacy protocol.
Chapter 22: SNMPv3 1. Follow steps 1 through 5 in the procedure described in “Creating an SNMPv3 User Table Entry” on page 430. Or, from the Main Menu type 5->1->1->8->5. The Configure SNMPv3 Table menu is shown in Figure 148 on page 431. 2. From the Configure SNMPv3 Table menu, type 4 to select Configure SNMPv3 Access Table. The Configure SNMPv3 Access Table is shown in Figure 153 on page 450. 3. From the Configure SNMPv3 Access Table, type 3 to select Modify SNMPv3 Table Entry.
AT-S63 Management Software Menus Interface User’s Guide 7. Enter the Security Level configured for this Group Name. You cannot change the value of the Security Level parameter. Select one of the following security levels: N-NoAuthNoPriv This option represents no authentication and no privacy protocol. Select this security level if you do not want to authenticate SNMP entities and you do not want to encrypt messages using a privacy protocol. This security level provides the least security.
Chapter 22: SNMPv3 Configuring the SNMPv3 SecurityToGroup Table This section contains a description of the SNMPv3 SecurityToGroup Table and how to create, delete, and modify table entries. The SNMPv3 SecurityToGroup Table allows you to associate a User Name with a Group Name. The User Name is configured in the Configure SNMPv3 User Table menu while the Group Name is configured in the Configure SNMPv3 Access Table menu.
AT-S63 Management Software Menus Interface User’s Guide The Configure SNMPv3 SecurityToGroup Table menu is shown in Figure 155. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Configure SNMPv3 SecurityToGroup Table Security Model................. Security Name ................. Group Name .................... Storage Type .................. Row Status ....................
Chapter 22: SNMPv3 3-v3 Select this value to associate the Group Name with the SNMPv3 protocol. The following prompt is displayed: Enter Group Name: 6. Enter a Group Name that you configured in the SNMPv3 Access Table. See “Creating an SNMPv3 Access Table Entry” on page 449. There are four default values for this field: defaultV1GroupReadOnly defaultV1GroupReadWrite defaultV2cGroupReadOnly defaultV2cGroupReadWrite These values are reserved for SNMPv1 and SNMPv2c implementations.
AT-S63 Management Software Menus Interface User’s Guide Deleting an SNMPv3 SecurityToGroup Table Entry You may want to delete an entry from the SNMPv3 SecurityToGroup Table. When you delete an SNMPv3 SecurityToGroup Table entry, there is no way to undelete, or recover, the entry. To delete an entry in the SNMPv3 SecurityToGroup Table, perform the following procedure: 1. Follow steps 1 through 5 in the procedure described in “Creating an SNMPv3 User Table Entry” on page 430.
Chapter 22: SNMPv3 3-v3 Select this value to associate the Group Name with the SNMPv3 protocol. The following prompt is displayed: Do you want to delete this table entry? (Y/N):[Yes/No]-> 6. Enter Y to delete this SecurityToGroup entry or N to save the entry. 7. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes.
AT-S63 Management Software Menus Interface User’s Guide The Modify SecurityToGroup Table is displayed as shown Figure 155. Allied Telesyn Ethernet Switch AT-9400 Series - AT-S63 Marketing User: Manager 11:20:02 02-Oct-2004 Modify SNMPv3 SecurityToGroup Table Security Model................. Security Name ................. Group Name .................... Storage Type .................. Row Status ....................
Chapter 22: SNMPv3 3-v3 Select this value to associate the User Name with the SNMPv3 protocol. The following prompt is displayed: Enter Group Name: 7. Enter the new Group Name. This value must match a value configured in the Group Name parameter in the Configure SNMPv3 Access Table. See “Creating an SNMPv3 Access Table Entry” on page 449. 8. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes.
AT-S63 Management Software Menus Interface User’s Guide 6. Enter the Security Model configured for this User Name. You cannot change the value of the Security Model parameter. Select one of the following SNMP protocols: 1-v1 Select this value if this User Name is configured with the SNMPv1 protocol. 2-v2c Select this value if this User Name is configured with the SNMPv2c protocol. 3-v3 Select this value if this User Name is configured with the SNMPv3 protocol.
Chapter 22: SNMPv3 Configuring the SNMPv3 Notify Table This section contains a description of the SNMPv3 Notify Table menu and how to create, delete, and modify table entries. The Configure SNMPv3 Notify Table menu allows you to define a name for sending traps. For each Notify Name, you define if a trap or inform message ia sent. The two message types, trap and inform, have different packet formats.
AT-S63 Management Software Menus Interface User’s Guide The Configure SNMPv3 Notify Table menu is shown in Figure 157. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Configure SNMPv3 Notify Table Notify Name ...................... Notify Tag ....................... Notify Type ...................... Storage Type ..................... Row Status .......................
Chapter 22: SNMPv3 I-Inform Indicates this notify table is used to send inform messages. With this message type, the switch expects a response from the host. The following prompt is displayed: Enter Storage Type [V-Volatile, N-NonVolatile]: 7. Select one of the following storage types for this table entry: V - Volatile Select this storage type if you do not want the ability to save an entry in the SNMPv3 Notify Table to the configuration file.
AT-S63 Management Software Menus Interface User’s Guide The Configure SNMPv3 Notify Table menu is shown in Figure 157 on page 473. Note To display a Group Name and its associated parameters from the Configure SNMPv3 SecurityToGroup Table menu, type N to display the Next Page and P to display the previous page. 3. To delete an SNMPv3 Notify Table entry, type 2 to select Delete SNMPv3 Table Entry. The following prompt is displayed: Enter Notify Name: 4. Enter a Notify Name.
Chapter 22: SNMPv3 3. From the Configure SNMPv3 Notify Table menu, type 3 to select Modify SNMPv3 Table Entry. The Modify SNMPv3 Notify Table menu is shown in Figure 158. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Modify SNMPv3 Notify Table Notify Name ................... Notify Tag..................... Notify Type.................... Storage Type .................. Row Status ....................
AT-S63 Management Software Menus Interface User’s Guide Modifying a Notify Type To modify the Notify Type parameter in an SNMPv3 Notify Table entry, perform the following procedure. 1. Follow steps 1 through 5 in the procedure described in “Creating an SNMPv3 User Table Entry” on page 430. Or, from the Main Menu type 5->1->1->8->5. The Configure SNMPv3 Table menu is shown in Figure 148 on page 431. 2. From the Configure SNMPv3 Table menu, type 6 to select Configure SNMPv3 Notify Table.
Chapter 22: SNMPv3 1. Follow steps 1 through 5 in the procedure described in “Creating an SNMPv3 User Table Entry” on page 430. Or, from the Main Menu type 5->1->1->8->5. The Configure SNMPv3 Table menu is shown in Figure 148 on page 431. 2. From the Configure SNMPv3 Table menu, type 6 to select Configure SNMPv3 Notify Table. The Configure SNMPv3 Notify Table menu is shown in Figure 157 on page 473. 3. From the Configure SNMPv3 Notify Table menu, type 3 to select Modify SNMPv3 Table Entry.
AT-S63 Management Software Menus Interface User’s Guide Configuring the SNMPv3 Target Address Table This section contains a description of the SNMPv3 Target Address Table menu and how to create, delete, and modify table entries. You use the SNMPv3 Target Address Table menu to assign the IP address of a host that is used for generating notifications. The Configure SNMPv3 Target Address Table menu is linked internally to the Configure SNMPv3 Notify Table through the Tag List parameter.
Chapter 22: SNMPv3 The Configure SNMPv3 Target Address Table menu is shown in Figure 159. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Configure SNMPv3 Target Address Table Target Addr Name ... Target Parameters .. IP Address ......... Storage Type ....... Tag List ........... host451 Timeout ..... 1500 SNMPmanagerPC Retries ..... 3 198.35.11.1 UDP Port# ... 162 NonVolatile Row Status ..
AT-S63 Management Software Menus Interface User’s Guide The following prompt is displayed: Enter Timeout (10mS): [0 to 2147483647]-> 1500 7. Enter a timeout value in milliseconds. When an Inform message is generated, a response from the switch is required. The timeout value determines how long the switch considers the Inform message an active message. This parameter applies to Inform messages only. The range is from 0 to 2,147,483,647 milliseconds. The default value is 1500 milliseconds.
Chapter 22: SNMPv3 V - Volatile Select this storage type if you do not want the ability to save an entry in the SNMPv3 Target Address Table to the configuration file. After making changes to an SNMPv3 Target Address Table entry with a Volatile storage type, the S - Save Configuration Changes option does not appear on the Main Menu. N-NonVolatile Select this storage type if you want the ability to save an entry in the SNMPv3 Target Address Table to the configuration file.
AT-S63 Management Software Menus Interface User’s Guide 3. To delete an SNMPv3 Target Address Table entry, type 2 to select Delete SNMPv3 Table Entry. The following prompt is displayed: Enter Target Address Name: 4. Enter a Target Address Name. The following prompt is displayed: Do you want to delete this table entry?(Y/N):[Yes/No]-> 5. Enter Y to delete the SNMPv3 Target Address Table entry or N to save the entry. 6. After making changes, type R until you return to the Main Menu.
Chapter 22: SNMPv3 The Configure SNMPv3 Target Address Table menu is shown in Figure 159 on page 480. 3. From the Configure SNMPv3 Target Address Table menu, type 3 to select Modify SNMPv3 Table Entry. The Modify SNMPv3 Target Address Table menu is shown in Figure 160. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager11:20:02 02-Mar-2005 Modify SNMPv3 Target Address Table Target Addr Name ... Target Parameters .. IP Address ......... Storage Type ....... Tag List ...........
AT-S63 Management Software Menus Interface User’s Guide Use the following format for an IP address: XXX.XXX.XXX.XXX 7. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. Modifying the Target Address UDP Port To modify the Target Address UDP Port parameter in an SNMPv3 Target Address Table entry, perform the following procedure: 1. Follow steps 1 through 5 in the procedure described in “Creating an SNMPv3 User Table Entry” on page 430.
Chapter 22: SNMPv3 7. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. Modifying the Target Address Timeout The Target Address Timeout parameter only applies when the message type is an Inform message. To modify the Target Address Timeout parameter in an SNMPv3 Target Address Table entry, perform the following procedure. 1. Follow steps 1 through 5 in the procedure described in “Creating an SNMPv3 User Table Entry” on page 430.
AT-S63 Management Software Menus Interface User’s Guide Inform messages only. The range is from 0 to 2,147,483,647 milliseconds. The default value is 1500 milliseconds. 7. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. Modifying the Target Address Retries The Target Address Retries parameter only applies when the message type is an Inform message.
Chapter 22: SNMPv3 The range is 0 to 255 retries. The default is 3 retries. 7. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. Modifying the Target Address Tag List To modify the Target Address Tag List parameter in an SNMPv3 Target Address Table entry, perform the following procedure. 1. Follow steps 1 through 5 in the procedure described in “Creating an SNMPv3 User Table Entry” on page 430. Or, from the Main Menu type 5->1->1->8->5.
AT-S63 Management Software Menus Interface User’s Guide 6. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. Modifying the Target Parameters Field To modify the Target Parameters field in an SNMPv3 Target Address Table entry, perform the following procedure. 1. Follow steps 1 through 5 in the procedure described in “Creating an SNMPv3 User Table Entry” on page 430. Or, from the Main Menu type 5->1->1->8->5.
Chapter 22: SNMPv3 7. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. Modifying the Storage Type To modify the Storage Type parameter in an SNMPv3 Target Address Table entry, perform the following procedure. 1. Follow steps 1 through 5 in the procedure described in “Creating an SNMPv3 User Table Entry” on page 430. Or, from the Main Menu type 5->1->1->8->5. The Configure SNMPv3 Table menu is shown in Figure 148 on page 431. 2.
AT-S63 Management Software Menus Interface User’s Guide N-NonVolatile Select this storage type if you want the ability to save an entry in the SNMPv3 Target Address Table to the configuration file. After making changes to an SNMPv3 Target Address entry with a NonVolatile storage type, the S - Save Configuration Changes option appears on the Main Menu, allowing you to save your changes. Allied Telesyn recommends this storage type. 7. After making changes, type R until you return to the Main Menu.
Chapter 22: SNMPv3 Configuring the SNMPv3 Target Parameters Table This section contains a description of the SNMPv3 Target Parameters Table and how to create, delete, and modify table entries. The SNMPv3 Target Parameters Table links the user security information with the message notification information configured in the Configure SNMPv3 Notify Table menu and Configure SNMPv3 Target Address Table menu.
AT-S63 Management Software Menus Interface User’s Guide Creating an SNMPv3 Target Parameters Table Entry “Deleting an SNMPv3 Target Parameters Table Entry” on page 496 “Modifying an SNMPv3 Target Parameters Table Entry” on page 497 To create an entry in the Configure SNMPv3 Target Parameters Table, perform the following procedure. 1. Follow steps 1 through 5 in the procedure described in “Creating an SNMPv3 User Table Entry” on page 430. Or, from the Main Menu type 5->1->1->8->5.
Chapter 22: SNMPv3 Note You are prompted to enter a value for the Message Processing Model parameter only if you select SNMPv1 or SNMPv2c as the Security Model. If you select the SNMPv3 protocol as the Security Model, then the Message Processing Model is automatically assigned to SNMPv3. The following prompt is displayed: Enter User (Security) Name: 5. Enter a User Name. The value of this parameter is previously configured with the Configure SNMPv3 User Table.
AT-S63 Management Software Menus Interface User’s Guide N-NoAuthNoPriv This option represents no authentication and no privacy protocol. Select this security level if you do not want to authenticate SNMP entities and you do not want to encrypt messages using a privacy protocol. This security level provides the least security. Note If you have selected SNMPv1 or SNMPv2c, N-NoAuthNoPriv is the only security level you can select. A-AuthNoPriv This option represents authentication, but no privacy protocol.
Chapter 22: SNMPv3 9. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. Deleting an SNMPv3 Target Parameters Table Entry You may want to delete an entry from the SNMPv3 Target Parameters Table. When you delete an SNMPv3 Target Parameters Table entry, there is no way to undelete, or recover, the entry. To delete an entry in the SNMPv3 Target Parameters Table, perform the following procedure: 1.
AT-S63 Management Software Menus Interface User’s Guide Modifying an SNMPv3 Target Parameters Table Entry This section provides procedures for modifying parameters in an SNMPv3 Target Parameters Table entry. The parameter values configured in the Target Parameters Table must match those configured in the other tables. For a more detailed explanation, see “Creating an SNMPv3 Target Parameters Table Entry” on page 493.
Chapter 22: SNMPv3 When you modify the Security Name parameter, you must use a value that you configured with the User Name parameter in the Configure SNMPv3 User Table menu. If you do not use a value configured with the User Name parameter, messages are not sent on behalf of this User Name. See “Creating an SNMPv3 User Table Entry” on page 430. To modify the Security Name parameter in an SNMPv3 Target Parameter Table entry, perform the following procedure. 1.
AT-S63 Management Software Menus Interface User’s Guide 4. To change the Security Name parameter, type 1 to select Set Security Name. The following prompt is displayed: Enter Target Parameters Name: 5. Enter a previously configured Target Parameters Name. Enter a value of up to 32 alphanumeric characters. The following prompt is displayed: Enter User (Security) Name: 6. Enter a User Name. Enter a value that you previously configured with the Configure SNMPv3 User Table menu.
Chapter 22: SNMPv3 The Configure SNMPv3 Target Parameters Table menu is shown in Figure 161. 3. From the Configure SNMPv3 Target Parameters Table menu, type 3 to select Modify SNMPv3 Table Entry. The Modify SNMPv3 Target Parameters Table menu is shown in Figure 162 on page 498. 4. To change the Security Model, type 2 to select Security Model. The following prompt is displayed: Enter Target Parameters Name: 5. Enter a previously configured Target Parameters Name.
AT-S63 Management Software Menus Interface User’s Guide 5->1->1->8->5. The Configure SNMPv3 Table menu is shown in Figure 148 on page 431. 2. From the Configure SNMPv3 Table menu, type 8 to select Configure SNMPv3 Target Address Table. The Configure SNMPv3 Target Parameters Table menu is shown in Figure 161. 3. From the Configure SNMPv3 Target Parameters Table menu, type 3 to select Modify SNMPv3 Table Entry. The Modify SNMPv3 Target Parameters Table menu is shown in Figure 162 on page 498. 4.
Chapter 22: SNMPv3 A-AuthNoPriv This option represents authentication, but no privacy protocol. Select this security level if you want to authenticate SNMP users, but you do not want to encrypt messages using a privacy protocol.You can select this value if you configured the Security Model parameter with the SNMPv3 protocol. P-AuthPriv This option represents authentication and the privacy protocol. Select this security level to encrypt messages using a privacy protocol and authenticate SNMP entities.
AT-S63 Management Software Menus Interface User’s Guide 5. Enter a previously configured Target Parameters Name. Enter a value of up to 32 alphanumeric characters. The following prompt is displayed: Enter Message Processing Model[1-v1,2-v2c,3-v3]: 6. Select one of the following SNMP protocols that is used to process, or send messages: 1-v1 Select this value to process messages with the SNMPv1 protocol.
Chapter 22: SNMPv3 5. Enter a previously configured Target Parameters Name. Enter a value of up to 32 alphanumeric characters. The following prompt is displayed: Enter Storage Type [V-Volatile, N-NonVolatile]: 6. Select one of the following storage types for this table entry: V - Volatile Select this storage type if you do not want the ability to save an entry in the SNMPv3 Target Parameters Table to the configuration file.
AT-S63 Management Software Menus Interface User’s Guide Configuring the SNMPv3 Community Table This section contains a description of the SNMPv3 Community Table and how to create, delete, and modify table entries. The SNMPv3 Community Table allows you to create SNMPv1 and SNMPv2c Communities using the SNMPv3 Tables. Allied Telesyn does not recommend that you use the menu described in this section to configure SNMPv1 and SNMPv2c communities.
Chapter 22: SNMPv3 Security Name Transport Tag Storage Type In addition, you can display the entries configured with the Configure SNMPv1 & SNMPv2c Community menu in the Configure SNMPv3 Community Table menu. However, you cannot modify an SNMPv1 & SNMPv2c Community Table entry with the Configure SNMPv3 Community Table menu. There are three functions you can perform with the Configure SNMPv3 Target Parameters Table menu.
AT-S63 Management Software Menus Interface User’s Guide The Configure SNMPv3 Community Table menu is shown in Figure 163. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Configure SNMPv3 Community Table Community Index ............... Community Name ................ Security Name ................. Transport Tag ................. Storage Type .................. Row Status ....................
Chapter 22: SNMPv3 The following prompt is displayed: Enter Security Name: 6. Enter the name of an SNMPv1 and SNMPv2c user. This name must be unique. Enter a value of up to 32 alphanumeric characters. Note Do not use a value configured with the User Name parameter in the SNMPv3 User Table. The following prompt is displayed: Enter Transport Tag: 7. Enter a name of up to 32 alphanumeric characters for the Transport Tag.
AT-S63 Management Software Menus Interface User’s Guide Note The Row Status parameter is a read-only field. The Active value indicates the SNMPv3 Community Table entry takes effect immediately. 9. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. Deleting an SNMPv3 Community Table Entry You may want to delete an entry from the SNMPv3 Community Table.
Chapter 22: SNMPv3 Modifying an SNMPv3 Community Table Entry For each entry in the SNMPv3 Community Table, you can modify the following parameters: Community Name Security Name Transport Tag Storage Type However, you cannot modify the Community Index parameter. Although you can display the SNMPv1 and SNMPv2c configuration created with the procedures described in “Creating an SNMP Community String” on page 101, you cannot modify these Community Table entries with the SNMPv3 Tables.
AT-S63 Management Software Menus Interface User’s Guide The Modify SNMPv3 Community Table menu is shown in Figure 164. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Modify SNMPv3 Community Table Community Index ............... Community Name ................ Security Name ................. Transport Tag ................. Storage Type .................. Row Status ....................
Chapter 22: SNMPv3 Modifying the Security Name To modify the Security Name parameter in an SNMPv3 Community Table entry, perform the following procedure: 1. Follow steps 1 through 5 in the procedure described in “Creating an SNMPv3 User Table Entry” on page 430. Or, from the Main Menu type 5->1->1->8->5. The Configure SNMPv3 Table menu is displayed as shown in Figure 148 on page 431. 2. From the Configure SNMPv3 Table menu, type 9 to select Configure SNMPv3 Community Table.
AT-S63 Management Software Menus Interface User’s Guide The Configure SNMPv3 Table menu is displayed as shown in Figure 148 on page 431. 2. From the Configure SNMPv3 Table menu, type 9 to select Configure SNMPv3 Community Table. The Configure SNMPv3 Community Table menu is shown in Figure 163 on page 507. 3. From the Configure SNMPv3 Community Table, type 3 to select Modify SNMPv3 Table Entry. The Modify SNMPv3 Community Table menu is shown in Figure 164 on page 511. 4.
Chapter 22: SNMPv3 3. From the Configure SNMPv3 Community Table, type 3 to select Modify SNMPv3 Table Entry. The Modify SNMPv3 Community Table Menu is shown in Figure 164 on page 511. 4. To change the Storage Type, type 4 to select Set Storage Type. The following prompt is displayed: Enter Community Index: 5. Enter the Community Index of the Storage Type you want to change. The following prompt is displayed: Enter Storage type [V-volatile, N-NonVolatile]: 6.
AT-S63 Management Software Menus Interface User’s Guide Displaying SNMPv3 Table Menus The procedures in this section describe how to display the SNMPv3 Tables.
Chapter 22: SNMPv3 The Display SNMPv3 Table menu is shown in Figure 165.
AT-S63 Management Software Menus Interface User’s Guide Display SNMPv3 User Table Menu” on page 515. Or, from the Main menu type 5->1->1->8->6. 2. From the Display SNMPv3 Table menu, type 2 to select Display SNMPv3 View Table. The Display SNMPv3 View Table menu is shown in Figure 167. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Display SNMPv3 View Table View Name ................... Subtree OID ................. Subtree Mask ................ View Type ....
Chapter 22: SNMPv3 The Display SNMPv3 Access Table menu is shown in Figure 168. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Display SNMPv3 Access Table Group Name .... technicalsales Context Prefix. Read View...... internet Write View .... Notify View ... Security Model . Security Level . Context Match .. Storage Type ... Row Status .....
AT-S63 Management Software Menus Interface User’s Guide The Display SNMPv3 SecurityToGroup Table menu is shown in Figure 169. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Display SNMPv3 SecurityToGroup Table Security Model................. Security Name ................. Group Name .................... Storage Type .................. Row Status ....................
Chapter 22: SNMPv3 Displaying the Display SNMPv3 Target Address Table Menu This section describes how to display the Display SNMPv3 Target Address Table menu. For information about the SNMPv3 Target Address Table parameters, see “Creating an SNMPv3 Target Address Table Entry” on page 479. To display the Display SNMPv3 Target Address Table menu, perform the following procedure. 1. Follow steps 1 through 5 in the procedure described in “Displaying the Display SNMPv3 User Table Menu” on page 515.
AT-S63 Management Software Menus Interface User’s Guide The Display SNMPv3 Target Parameters Table menu is shown in Figure 169. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Display SNMPv3 Target Parameters Table Target Parameters Name ... Message Processing Model . Security Model ........... Security Name ............ Security Level ........... Storage Type ............. Row Status ...............
Chapter 22: SNMPv3 The Display SNMPv3 Community Table menu is shown in Figure 169. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Display SNMPv3 Community Table Community Index ........ Community Name ......... Security Name .......... Transport Tag........... Storage Type ........... Row Status ............. atiindex14 sunnyvale hoa sampletag14 NonVolatile Active U - Update Display R - Return to Previous Menu Enter your selection? Figure 173.
Section V Spanning Tree Protocols The chapters in this section contain overview information on the different spanning tree protocols supported on the AT-9400 Series switch. The chapters also explain how to configure the spanning tree protocols from the menu interface of the AT-S63 management software.
Section V: Spanning Tree Protocols
Chapter 23 Spanning Tree and Rapid Spanning Tree Protocols This chapter provides background information on the Spanning Tree Protocol (STP) and Rapid Spanning Tree Protocol (RSTP). The chapter also contains procedures on how to adjust the STP and RSTP bridge and port parameters.
Chapter 23: Spanning Tree and Rapid Spanning Tree Protocols STP and RSTP Overview The performance of a Ethernet network can be negatively impacted by the formation of a data loop in the network topology. A data loop exists when two or more nodes on a network can transmit data to each other over more than one data path.
AT-S63 Management Software Menus Interface User’s Guide Bridge Priority and the Root Bridge The first task that bridges perform when a spanning tree protocol is activated on a network is the selection of a root bridge. A root bridge distributes network topology information to the other network bridges and is used by the other bridges to determine if there are redundant paths in the network.
Chapter 23: Spanning Tree and Rapid Spanning Tree Protocols Where there is only one path between a bridge and the root bridge, the bridge is referred to as the designated bridge and the port through which the bridge is communicating with the root bridge is referred to as the root port. If redundant paths exist, the bridges that are a part of the paths must determine which path will be the primary, active path, and which path(s) will be placed in the standby, blocking mode.
AT-S63 Management Software Menus Interface User’s Guide Table 13 lists the RSTP port costs with Auto-Detect. Table 13. RSTP Auto-Detect Port Costs Port Speed Port Cost 10 Mbps 2,000,000 100 Mbps 200,000 1000 Mbps 20,000 Table 14 lists the RSTP port costs with Auto-Detect when the port is part of a port trunk. Table 14. RSTP Auto-Detect Port Trunk Costs Port Speed Port Cost 10 Mbps 20,000 100 Mbps 20,000 1000 Mbps 2,000 You can override Auto-Detect and set the port cost manually.
Chapter 23: Spanning Tree and Rapid Spanning Tree Protocols Table 15. Port Priority Value Increments Increment Bridge Priority Bridge Priority Increment 5 80 13 208 6 96 14 224 7 112 15 240 Forwarding Delay and Topology Changes If there is a change in the network topology due to a failure, removal, or addition of any active components, the active topology also changes. This may trigger a change in the state of some blocked ports.
AT-S63 Management Software Menus Interface User’s Guide brought online, it issues a BPDU in order to determine whether a root bridge has already been selected on the network, and if not, whether it has the lowest bridge priority number of all the bridges and should therefore become the root bridge. The root bridge periodically transmits a BPDU to determine whether there have been any changes to the network topology and to inform other bridges of topology changes.
Chapter 23: Spanning Tree and Rapid Spanning Tree Protocols If a port is operating in half-duplex mode and is not connected to any further bridges participating in STP or RSTP, then the port is an edge port. Figure 175 illustrates an edge port on an AT-9400 switch. The port is connected to an Ethernet hub, which in turn is connected to a series of Ethernet workstations.
AT-S63 Management Software Menus Interface User’s Guide Mixed STP and RSTP Networks RSTP IEEE 802.1w is fully compliant with STP IEEE 802.1d. Your network can consist of bridges running both protocols. STP and RSTP in the same network can operate together to create a single spanning tree domain. If you decide to activate spanning tree on the switch, there is no reason not to activate RSTP on an AT-9400 Series switch even when all other switches are running STP.
Chapter 23: Spanning Tree and Rapid Spanning Tree Protocols You can avoid this problem by not activating spanning tree or by connecting VLANs using tagged instead of untagged ports. (For information on tagged and untagged ports, refer to Chapter 25, “Portbased and Tagged VLANs” on page 599.
AT-S63 Management Software Menus Interface User’s Guide Enabling or Disabling a Spanning Tree Protocol The AT-S63 management software supports STP, RSTP, and MSTP. However, only one spanning tree protocol can be active on the switch at a time. Before you can enable a spanning tree protocol, you must first select it as the active spanning tree protocol on the switch. After you have selected it as the active protocol, you can then configure it and enable or disable it.
Chapter 23: Spanning Tree and Rapid Spanning Tree Protocols 4. If you selected STP as the active spanning tree protocol, go to “Configuring STP” on page 537 for further instructions. If you selected RSTP, go to “Configuring RSTP” on page 543. Multiple Spanning Tree Protocol (MSTP) is described in Chapter 24, “Multiple Spanning Tree Protocol” on page 553. Note After you have configured the spanning tree parameters, perform steps 5 through 7 to enable spanning tree. 5.
AT-S63 Management Software Menus Interface User’s Guide Configuring STP This section contains the following procedures: Configuring STP Bridge Settings ”Configuring STP Bridge Settings”, next “Configuring STP Port Settings” on page 539 This section contains the procedure for configuring a bridge’s STP settings. Caution The default STP parameters are adequate for most networks.
Chapter 23: Spanning Tree and Rapid Spanning Tree Protocols 3. Adjust the following parameters as needed. 1 - Bridge Priority The priority number for the bridge. This number is used to determine the root bridge for RSTP. The bridge with the lowest priority number is selected as the root bridge. If two or more bridges have the same priority value, the bridge with the numerically lowest MAC address becomes the root bridge.
AT-S63 Management Software Menus Interface User’s Guide Configuring STP Port Settings To adjust STP port parameters, perform the following procedure: 1. From the Main Menu, type 3 to select Spanning Tree Configuration. The Spanning Tree Configuration menu is shown in Figure 178 on page 535. 2. From the Spanning Tree Configuration menu, type 3 to select Configure Active Protocol. The STP menu is shown in Figure 179 on page 537. 3. From the STP menu, type P to select STP Port Parameters.
Chapter 23: Spanning Tree and Rapid Spanning Tree Protocols The Configure STP Port Settings menu is shown in Figure 181. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Configure STP Port Settings Configuring Ports 4-6 1 - Port Priority ..... 128 2 - Port Cost ......... Automatic-Update R - Return to Previous Menu Enter your selection? Figure 181. Configure STP Port Settings Menu 7. Adjust the following parameters as needed.
AT-S63 Management Software Menus Interface User’s Guide Displaying STP Port Settings To display STP port settings, perform the following procedure: 1. From the Main Menu, type 3 to select Spanning Tree Configuration. The Spanning Tree Configuration menu is shown in Figure 178 on page 535. 2. From the Spanning Tree Configuration menu, type 3 to select Configure Active Protocol. The STP menu is shown in Figure 179 on page 537. 3. From the STP menu, type P to select STP Port Parameters.
Chapter 23: Spanning Tree and Rapid Spanning Tree Protocols Cost Port cost of the port. The default is Auto-Update. Priority The number used as a tie breaker when two or more ports have equal costs to the root bridge. Resetting STP to the Default Settings To reset STP to the default settings, perform the following procedure: 1. From the Main Menu, type 3 to select Spanning Tree Configuration. The Spanning Tree Configuration menu is shown in Figure 178 on page 535. 2.
AT-S63 Management Software Menus Interface User’s Guide Configuring RSTP This section contains the following procedures: Configuring RSTP Bridge Settings ”Configuring RSTP Bridge Settings”, next “Configuring RSTP Port Settings” on page 545 This section contains the procedure for configuring a bridge’s RSTP settings. Caution The default RSTP parameters are adequate for most networks.
Chapter 23: Spanning Tree and Rapid Spanning Tree Protocols 3. Adjust the following parameters as necessary. 1 - Force Version This selection determines whether the bridge operates with RSTP or in an STP-compatible mode. If you select RSTP, the bridge operates all ports in RSTP, except for those ports that receive STP BPDU packets. If you select Force STP Compatible, the bridge operates in RSTP, using the RSTP parameter settings, but it sends only STP BPDU packets out the ports.
AT-S63 Management Software Menus Interface User’s Guide 6 - Bridge Identifier The MAC address of the bridge. The bridge identifier is used as a tie breaker in the selection of the root bridge when two or more bridges have the same bridge priority value. This value cannot be changed. 4. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. Configuring RSTP Port Settings To adjust RSTP port parameters, perform the following procedure: 1.
Chapter 23: Spanning Tree and Rapid Spanning Tree Protocols The following prompt is displayed: Ending Port to Configure [1 to 24] -> 7. To configure just one port, enter the same port number here as you entered in the previous step. To configure a range of ports, enter the last port of the range. The Configure RSTP Port Settings menu is shown in Figure 185.
AT-S63 Management Software Menus Interface User’s Guide 4 - Edge Port This parameter defines whether the port is functioning as an edge port. The possible settings are Yes and No. For an explanation of this parameter, refer to “Point-to-Point and Edge Ports” on page 531. C - Check Migration To RSTP on Selected Ports (MCHECK) The MCHECK parameter is displayed only when RSTP is enabled. This parameter resets an RSTP port, allowing it to send RSTP BPDUs.
Chapter 23: Spanning Tree and Rapid Spanning Tree Protocols The Display RSTP Port Configuration menu is shown in Figure 186.
AT-S63 Management Software Menus Interface User’s Guide Displaying the RSTP Port State To display the RSTP port state, perform the following procedure: 1. From the Main Menu, type 3 to select Spanning Tree Configuration. The Spanning Tree Configuration menu is shown in Figure 178 on page 535. 2. From the Spanning Tree Configuration menu, type 3 to select Configure Active Protocol. The RSTP menu is shown in Figure 179 on page 537. 3. From the RSTP menu, type P to select RSTP Port Parameters.
Chapter 23: Spanning Tree and Rapid Spanning Tree Protocols State The RSTP state of the port. The possible states are: Discarding - The port is discarding received packets and is not submitting forwarded packets for transmission. Learning - The port is enabled for receiving, but not forwarding packets. Forwarding - Normal operation. Disabled - The port has not established a link with its end node. Role The RSTP role of the port.
AT-S63 Management Software Menus Interface User’s Guide The following prompt is displayed: Do you want to reset RSTP configuration to default [Yes/ No] -> 4. Type Y for Yes or N for No and press Return. The RSTP configuration is reset to the defaults.
Chapter 23: Spanning Tree and Rapid Spanning Tree Protocols 552 Section V: Spanning Tree Protocols
Chapter 24 Multiple Spanning Tree Protocol This chapter provides background information on the Multiple Spanning Tree Protocol (MSTP) and contains procedures on how to adjust spanning tree bridge and port parameters.
Chapter 24: Multiple Spanning Tree Protocol MSTP Overview As mentioned in Chapter 23, ”Spanning Tree and Rapid Spanning Tree Protocols” on page 525, STP and RSTP are referred to as single-instance spanning trees that search for physical loops across all VLANs in a bridged network. When loops are detected, the protocols stop the loops by placing one or more bridge ports in a blocking state.
AT-S63 Management Software Menus Interface User’s Guide Multiple Spanning Tree Instance (MSTI) The individual spanning trees in MSTP are referred to as Multiple Spanning Tree Instances (MSTIs). A MSTI can span any number of AT-9400 Series switches, and an AT-9400 Series switch can support up to 16 MSTIs at a time. To create a MSTI, you first assign it a number, referred to as the MSTI ID. The range is 1 to 15. (The switch is shipped with a default MSTI with an MSTI ID of 0.
Chapter 24: Multiple Spanning Tree Protocol the Production VLAN.
AT-S63 Management Software Menus Interface User’s Guide Figure 189 illustrates the same two AT-9400 Series switches and the same two virtual LANs. But in this example, the two switches are running MSTP and the two VLANs have been assigned different spanning tree instances. Now that they reside in different MSTIs, both links remain active, enabling the VLANs to forward traffic over their respective direct link.
Chapter 24: Multiple Spanning Tree Protocol A MSTI can contain more than one VLAN. This is illustrated in Figure 190 where there are two AT-9400 Series switches with four VLANs. There are two MSTIs, each containing two VLANs. MSTI 1 contains the Sales and Presales VLANs and MSTI 2 contains the Design and Engineering VLANs.
AT-S63 Management Software Menus Interface User’s Guide MSTI Guidelines Following are several guidelines to keep in mind about MSTIs: An AT-9400 Series switch can support up to 16 spanning tree instances, including the CIST. A MSTI can contain any number of VLANs. A VLAN can belong to only one MSTI at a time. A switch port can belong to more than one spanning tree instance at a time. This allows you to assign a port as an untagged and tagged member of VLANs that belong to different MSTI’s.
Chapter 24: Multiple Spanning Tree Protocol internal path cost, a port can have a different priority value for each of its MSTI’s. Multiple Spanning Tree Regions Another important concept of MSTP is regions. A MSTP region is defined as a group of bridges that share exactly the same MSTI characteristics. Those characteristics are: Configuration name Revision number VLANs VLAN to MSTI ID associations A configuration name is a name you assign to a region to help you identify it.
AT-S63 Management Software Menus Interface User’s Guide Figure 191 illustrates the concept of regions. It shows one MSTP region consisting of two AT-9400 Series switches. Each switch in the region has the same configuration name and revision level. The switches also have the same five VLANs and the VLANs are associated with the same MSTIs.
Chapter 24: Multiple Spanning Tree Protocol The same is true for any ports connected to bridges running the singleinstance spanning tree STP or RSTP. Those ports are also considered as part of another region. Each MSTI functions as an independent spanning tree within a region. Consequently, each MSTI must have a root bridge to locate physical loops within the spanning tree instance. An MSTI’s root bridge is called a regional root.
AT-S63 Management Software Menus Interface User’s Guide Common and Internal Spanning Tree (CIST) MSTP has a default spanning tree instance called the Common and Internal Spanning Tree (CIST). This instance has an MSTI ID of 0. This instance has unique features and functions that make it different from the MSTIs that you create yourself. First, you cannot delete this instance and you cannot change its MSTI ID.
Chapter 24: Multiple Spanning Tree Protocol An MSTP region can be considered as a virtual bridge. The implication is that other MSTP regions and STP and RSTP single-instance spanning trees cannot discern the topology or constitution of a MSTP region. The only bridge they are aware of is the regional root of the CIST instance. Summary of Guidelines 564 Careful planning is essential for the successful implementation of MSTP.
AT-S63 Management Software Menus Interface User’s Guide Note The AT-S63 MSTP implementation complies fully with the new IEEE 802.1s standard. Any other vendor’s fully compliant 802.1s implementation is interoperable with the AT-S63 implementation. Associating VLANs to MSTIs Allied Telesyn recommends that you assign all VLANs on a switch to an MSTI. You should not leave a VLAN assigned to just the CIST, including the Default_VLAN.
Chapter 24: Multiple Spanning Tree Protocol belongs only to CIST with its MSTI ID 0.
AT-S63 Management Software Menus Interface User’s Guide determine that a loop exists between the regions, and Switch B would block a port.
Chapter 24: Multiple Spanning Tree Protocol Selecting MSTP as the Active Spanning Tree Protocol To select and activate MSTP as the active spanning tree protocol on the switch, or to disable spanning tree, perform the following procedure: 1. From the Main Menu, type 3 to select Spanning Tree Configuration. The Spanning Tree Configuration menu is shown in Figure 178 on page 535. 2. To change the active version of spanning tree on the switch, type 2 to select Active Protocol Version.
AT-S63 Management Software Menus Interface User’s Guide Configuring MSTP Bridge Settings To configure a bridge’s MSTP settings, perform the following procedure: 1. From the Main Menu, type 3 to select Spanning Tree Configuration. The Spanning Tree Configuration menu is shown in Figure 178 on page 535. 2. From the Spanning Tree menu, type 3 to select Configure Active Protocol. The MSTP menu is shown in Figure 195.
Chapter 24: Multiple Spanning Tree Protocol seconds. The default is 2 seconds. This value is active only if the bridge is selected as the root bridge of the network. 3 - Forwarding Delay The waiting period before a bridge changes to a new state, for example, becomes the new root bridge after the topology changes. If the bridge transitions too soon, not all links may have yet adapted to the change, possibly resulting in a network loop. The range is 4 to 30 seconds. The default is 15 seconds.
AT-S63 Management Software Menus Interface User’s Guide 9 - Root Identifier If this MAC address is the same as the bridge’s MAC address, then the switch is also functioning as a root bridge. If the two MAC addresses are different, then a different switch is functioning as the root bridge. You cannot change this parameter. This parameter is only displayed with MSTP is enabled. Note Selection C, CIST menu, is described in “Configuring the CIST Priority,” next.
Chapter 24: Multiple Spanning Tree Protocol Configuring the CIST Priority This procedure explains how to adjust the bridge’s CIST priority. To change the CIST priority, perform the following procedure: 1. From the Main Menu, type 3 to select Spanning Tree Configuration. The Spanning Tree Configuration menu is shown in Figure 178 on page 535. 2. From the Spanning Tree Configuration menu, type 3 to select Configure Active Protocol. The MSTP menu is shown in Figure 195 on page 569. 3.
AT-S63 Management Software Menus Interface User’s Guide Enter new priority [the value will be multiplied by 4096]: [0 to 15] -> 5. Enter the increment that represents the new CIST priority value. The range is 0 (zero) to 61,440 in increments of 4,096, with 0 being the highest priority. For a list of the increments, refer to Table 15, “Port Priority Value Increments” on page 529. 6. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes.
Chapter 24: Multiple Spanning Tree Protocol Displaying the CIST Priority To change the CIST priority, perform the following procedure: 1. From the Main Menu, type 3 to select Spanning Tree Configuration. The Spanning Tree Configuration menu is shown in Figure 178 on page 535. 2. From the Spanning Tree Configuration menu, type 3 to select Configure Active Protocol. The MSTP menu is shown in Figure 195 on page 569. 3. From the MSTP menu, type M to select MSTI menu. The MSTI menu is shown in Figure 197.
AT-S63 Management Software Menus Interface User’s Guide Path Cost Specifies the path cost from the bridge to the regional root. If the bridge is the regional root, the value is 0. Associated VLANs Specifies the VIDs of the VLANs that have been associated with the MSTI ID. The table does not include the CIST. The table is empty if no MSTI IDs have been created.
Chapter 24: Multiple Spanning Tree Protocol Creating, Deleting, and Modifying MSTI IDs The following sections contain procedures for working with MSTI IDs: Creating an MSTI ID ”Creating an MSTI ID” next “Deleting an MSTI ID” on page 577 “Modifying an MSTI ID” on page 577 To create an MSTI ID, perform the following procedure: 1. From the Main Menu, type 3 to select Spanning Tree Configuration. The Spanning Tree Configuration menu is shown in Figure 178 on page 535. 2.
AT-S63 Management Software Menus Interface User’s Guide 8. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. Deleting an MSTI ID To delete an MSTI ID, perform the following procedure: 1. From the Main Menu, type 3 to select Spanning Tree Configuration. The Spanning Tree Configuration menu is shown in Figure 178 on page 535. 2. From the Spanning Tree Configuration menu, type 3 to select Configure Active Protocol.
Chapter 24: Multiple Spanning Tree Protocol Enter the MSTI ID to be modified: [1 to 15] -> 5. Enter the MSTP IDs that you want to modify. The range is 1 to 15. You can specify only one MSTI ID at a time. The following prompt is displayed: Enter new priority [the value will be multiplied by 4096] [0 to 15] -> 8 6. Enter a new MSTI priority number for this MSTI on the bridge. This parameter is used in selecting a regional root for the MSTI.
AT-S63 Management Software Menus Interface User’s Guide Adding, Removing, and Modifying VLAN Associations to MSTI IDs When you create a new MSTI ID, you are given the opportunity of associating VLANs to it. But after an MSTI ID is created, you may want to add more VLANs to it, or perhaps remove VLANs. This procedure explains how to associate VLANs on the switch to an existing MSTI ID and also how to remove VLANs.
Chapter 24: Multiple Spanning Tree Protocol The VLAN-MSTI Association menu is shown in Figure 198.
AT-S63 Management Software Menus Interface User’s Guide 4. From the MSTP menu, type V to select VLAN-MSTI Association menu. The VLAN-MSTI Association menu is shown in Figure 198 on page 580. 5. From the VLAN-MSTI Association menu, type 1 to select Add VLANs to MSTI. The following prompt is displayed: Enter the MSTI ID [0 to 15] -> 6. Enter the MSTI ID to which you want to associate a VLAN. A prompt similar to the following is displayed: Enter the list of VLANs: 7.
Chapter 24: Multiple Spanning Tree Protocol Enter the MSTI ID [0 to 15] -> 6. Enter the MSTI ID to which you want to associate a VLAN. A prompt similar to the following is displayed: Enter the list of VLANs: 7. Enter the VLAN ID of the virtual LAN that you want to remove from the MSTI ID. You can enter more than one VLAN at a time (for example, 2,4,7) To view VIDs, refer to “Displaying VLANs” on page 623. A removed VLAN is returned to CIST. 8.
AT-S63 Management Software Menus Interface User’s Guide 8. Enter the VLAN ID of the virtual LAN that you want to associate with the MSTI ID. You can enter more than one VLAN at a time (for example, 2,4,7) (To view VIDs, refer to “Displaying VLANs” on page 623.) The VLANs already associated with the MSTI ID are removed when the new VLANs are added. The removed VLANs are returned to CIST. 9. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes.
Chapter 24: Multiple Spanning Tree Protocol Configuring MSTP Port Settings As explained in “Ports in Multiple MSTIs” on page 559, MSTP port settings are divided into two groups. The parameters in the first group are set just once on a port, regardless of the number of MSTIs in which a port is a member. These settings are: External path cost Point-to-point designation Edge port designation The procedure for setting these parameters is in “Configuring Generic MSTP Port Settings” on page 584.
AT-S63 Management Software Menus Interface User’s Guide The MSTP Port Parameters menu is shown in Figure 199. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 MSTP Port Parameters 1 2 3 4 - Configure Generic Port Settings Configure Per Spanning Tree Port Settings Display MSTP Port Configuration Display MSTP Port State R - Return to Previous Menu Enter your selection? Figure 199. MSTP Port Parameters Menu 4.
Chapter 24: Multiple Spanning Tree Protocol 7. Adjust the following parameters as necessary: 1- Port External Path Cost The port cost of the port if the port is connected to a bridge which is a member of another MSTP region or is running STP or RSTP. The range is 0 to 200,000,000. The default setting is Auto, which sets port cost depending on the speed of the port. Table 16 lists the MSTP port costs with the Auto setting when the port is not a member of a trunk.
AT-S63 Management Software Menus Interface User’s Guide The Spanning Tree Configuration menu is shown in Figure 178 on page 535. 2. From the Spanning Tree Configuration menu, type 3 to select Configure Active Protocol. The MSTP menu is shown in Figure 195 on page 569. 3. From the MSTP menu, type P to select MSTP Port Parameters. The MSTP Port Parameters menu is shown in Figure 199 on page 585. 4. Type 2 to select Configure Per Spanning Tree Port Settings.
Chapter 24: Multiple Spanning Tree Protocol Configure Per Spanning Tree Port Settings Menu is shown in Figure 201. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Configure Per Spanning Tree Port Settings Spanning Tree List: 4 Configuring Ports: 7-7 1 - Port Priority ............... 128 2 - Port Internal Path Cost ..... Auto Update R - Return to Previous Menu Enter your selection? Figure 201.
AT-S63 Management Software Menus Interface User’s Guide Table 19 lists the RSTP port costs with Auto-Detect when the port is part of a port trunk. Table 19. RSTP Auto-Detect Port Trunk Costs Port Speed Port Cost 10 Mbps 20,000 100 Mbps 20,000 1000 Mbps 2,000 9. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes.
Chapter 24: Multiple Spanning Tree Protocol Displaying the MSTP Port Configuration To display the MSTP port configuration, perform the following procedure: 1. From the Main Menu, type 3 to select Spanning Tree Configuration. The Spanning Tree Configuration menu is shown in Figure 178 on page 535. 2. From the Spanning Tree Configuration menu, type 3 to select Configure Active Protocol. The MSTP menu is shown in Figure 195 on page 569. 3. From the MSTP menu, type P to select MSTP Port Parameters.
AT-S63 Management Software Menus Interface User’s Guide Port The port number. Edge-Port Whether or not the port is functioning as an edge port. The possible settings are Yes and No. Point-to-Point Whether or not the port is functioning as a point-to-point port. The possible settings are Yes, No, and Auto-Detect. External or Internal Port Cost External Port Cost The port cost of the port if the port is connected to a bridge which is a member of another MSTP region or is running STP or RSTP.
Chapter 24: Multiple Spanning Tree Protocol Displaying the MSTP Port State To display the MSTP port state, perform the following procedure: 1. From the Main Menu, type 3 to select Spanning Tree Configuration. The Spanning Tree Configuration menu is shown in Figure 178 on page 535. 2. From the Spanning Tree Configuration menu, type 3 to select Configure Active Protocol. The MSTP menu is shown in Figure 195 on page 569. 3. From the MSTP menu, type P to select MSTP Port Parameters.
AT-S63 Management Software Menus Interface User’s Guide The Display MSTP Port State menu is shown in Figure 203.
Chapter 24: Multiple Spanning Tree Protocol Backup - The port on a designated switch that provides a backup for the path provided by the designated port. Designated - The port on the designated switch for a LAN that has the least cost path to the root switch. This port connects the LAN to the root switch. Master - Similar to the root port. When the port is a boundary port, the MSTI port roles follow the CIST port roles. The MSTI port role is called “master” when the CIST role is “root.
AT-S63 Management Software Menus Interface User’s Guide Resetting MSTP to the Defaults To reset MSTP to the defaults, perform the following procedure: 1. From the Main Menu, type 3 to select Spanning Tree Configuration. The Spanning Tree Configuration menu is shown in Figure 178 on page 535. 2. From the Spanning Tree Configuration menu, type 3 to select Configure Active Protocol. The MSTP menu is shown in Figure 195 on page 569. 3. From the MSTP menu, type D to select Reset MSTP to Defaults.
Chapter 24: Multiple Spanning Tree Protocol 596 Section V: Spanning Tree Protocols
Section VI Virtual LANs The chapters in this section contain overview information on the different types of virtual LANs supported by the AT-9400 Series switch. The chapters also explain how to configure these features from the menu interface of the AT-S63 management software.
Section VI: VLANs
Chapter 25 Port-based and Tagged VLANs This chapter contains basic information about virtual LANs (VLANs) and procedures for creating, modifying, and deleting VLANs from a local or Telnet management session.
Chapter 25: Port-based and Tagged VLANs VLAN Overview A VLAN is a group of ports on an Ethernet switch that form a logical Ethernet segment. The ports of a VLAN form an independent traffic domain where the traffic generated by the nodes of a VLAN remains within the VLAN. With VLANs, you can segment your network through the switch’s AT-S63 management software and so be able to group nodes with related functions into their own separate, logical LAN segments.
AT-S63 Management Software Menus Interface User’s Guide management software. You can change the VLAN memberships through the management software without moving the workstations physically, or changing group memberships by moving cables from one switch port to another. In addition, a virtual LAN can span more than one switch. This means that the end nodes of a VLAN do not need to be connected to the same switch and so are not restricted to being in the same physical location.
Chapter 25: Port-based and Tagged VLANs Port-based VLAN Overview As explained in “VLAN Overview” on page 600, a VLAN consists of a group of ports on one or more Ethernet switches that form an independent traffic domain. Traffic generated by the end nodes of a VLAN remains within the VLAN and does not cross over to the end nodes of other VLANs unless there is an interconnection device, such as a router or Layer 3 switch.
AT-S63 Management Software Menus Interface User’s Guide For example, if you had a port-based VLAN titled Marketing that spanned three AT-9400 Series switches, you would assign the Marketing VLAN on each switch the same VID. You can assign this number manually or allow the AT-S63 management software to do it automatically. If you allow the management software to do it automatically, it selects the next available VID. This is acceptable when you are creating a new, unique VLAN.
Chapter 25: Port-based and Tagged VLANs Guidelines to Creating a Portbased VLAN Drawbacks of Port-based VLANs 604 Below are the guidelines to creating a port-based VLAN. Each port-based VLAN must be assigned a unique VID. If a particular VLAN spans multiples switches, each part of the VLAN on the different switches should be assigned the same VID. A port can be an untagged member of only one port-based VLAN at a time. Each port must be assigned a PVID.
AT-S63 Management Software Menus Interface User’s Guide Port-based Example 1 Figure 204 illustrates an example of one AT-9424T/SP Gigabit Ethernet Switch with three port-based VLANs. (For purposes of the following examples, the Default_VLAN is not shown.) Engineering VLAN (VID 3) Production VLAN (VID 4) Sales VLAN (VID 2) 1 3 5 7 9 11 13 15 17 19 21 23 2 4 6 8 10 12 14 16 18 20 22 24 AT-9424T/SP Gigabit Ethernet Switch WAN Router Figure 204.
Chapter 25: Port-based and Tagged VLANs In the example, each VLAN has one port connected to the router. The router interconnects the various VLANs and functions as a gateway to the WAN. Port-based Example 2 Figure 205 illustrates more port-based VLANs. In this example, two VLANs, Sales and Engineering, span two AT-9400 Series Gigabit Ethernet switches.
AT-S63 Management Software Menus Interface User’s Guide Production VLANs on the switches: Sales VLAN (VID 2) Engineering VLAN (VID 3) Production VLAN (VID 4) AT-9424T/SP Switch (top) Ports 1 - 6 (PVID 2) Ports 9 - 13 (PVID 3) Ports 17, 19 - 21 (PVID 4) AT-9424T/GB Switch (bottom) Ports 2 - 4, 6, 8 (PVID 2) Ports 16, 18-20, 22 (PVID 3) none Sales VLAN - This VLAN spans both switches.
Chapter 25: Port-based and Tagged VLANs Tagged VLAN Overview The second type of VLAN supported by the AT-S63 management software is the tagged VLAN. VLAN membership in a tagged VLAN is determined by information within the frames that are received on a port. This differs from a port-based VLAN, where the PVIDs assigned to the ports determine VLAN membership. The VLAN information within an Ethernet frame is referred to as a tag or tagged header.
AT-S63 Management Software Menus Interface User’s Guide Tagged and Untagged Ports Port VLAN Identifier Note For explanations of VLAN name and VLAN identifier, refer back to “VLAN Name” on page 602 and “VLAN Identifier” on page 602. Tagged and Untagged Ports You need to specify which ports will be members of the VLAN. In the case of a tagged VLAN, it is usually a combination of both untagged ports and tagged ports. You specify which ports are tagged and which untagged when you create the VLAN.
Chapter 25: Port-based and Tagged VLANs Tagged VLAN Example Figure 206 illustrates how tagged ports can be used to interconnect IEEE 802.1Q-based products. Engineering VLAN (VID 3) Sales VLAN (VID 2) Production VLAN (VID 4) Legacy Server 1 3 5 7 9 11 13 15 17 19 21 23 2 4 6 8 10 12 14 16 18 20 22 24 AT-9424T/SP Gigabit Ethernet Switch IEEE 802.
AT-S63 Management Software Menus Interface User’s Guide The port assignments for the VLANs are as follows: Sales VLAN (VID 2) Engineering VLAN (VID 3) Production VLAN (VID 4) Untagged Ports Tagged Ports Untagged Ports Tagged Ports Untagged Ports Tagged Ports AT-9424T/ SP Switch (top) 1, 3 to 5 (PVID 2) 2, 10 9, 11 to 13 (PVID 3) 2, 10 17, 19 to 21 (PVID 4) 2 AT-9424T/ GB Switch (bottom) 2, 4, 6, 8 (PVID 2) 9 16, 18, 20, 22 (PVID 3) 9 none none This example is nearly identical to the
Chapter 25: Port-based and Tagged VLANs Creating a New Port-based or Tagged VLAN To create a new port-based or tagged VLAN, perform the following procedure: 1. From the Main Menu, type 2 to select VLAN Configuration. The VLAN Configuration menu is shown in Figure 207. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 VLAN Configuration 1 2 3 4 5 6 7 - Ingress Filtering Status ........ Disabled VLANs Mode ......................
AT-S63 Management Software Menus Interface User’s Guide The Configure VLANs menu is shown in Figure 208. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Configure VLANs 1 2 3 4 - Create VLAN Modify VLAN Delete VLAN Reset to Default VLAN R - Return to Previous Menu Enter your selection? Figure 208. Configure VLANs Menu 3. From the Configure VLANs menu, type 1 to select Create VLAN. The Create VLAN menu is shown in Figure 209.
Chapter 25: Port-based and Tagged VLANs contain spaces or special characters, such as asterisks (*) or exclamation points (!). If the VLAN will be unique in your network, then the name should be unique as well. If the VLAN will be part of a larger VLAN that spans multiple switches, then the name for the VLAN should be the same on each switch where nodes of the VLAN are connected. Note A VLAN must be assigned a name. 6. Type 2 to select VLAN ID (VID.
AT-S63 Management Software Menus Interface User’s Guide Note The MAC Based setting for option 3 is used to create MAC addressbased VLANs. For instructions, refer to Chapter 29, “MAC Addressbased VLANs” on page 687. 9. If the VLAN will contain tagged ports, type 4 to select Tagged Ports and specify the ports. If this VLAN will not contain any tagged ports, leave this field empty. You can specify the ports individually (e.g., 2,3,5), as a range (e.g., 79), or both (e.g., 2,5,7-9). 10.
Chapter 25: Port-based and Tagged VLANs Note When you create a new VLAN, ports designated as untagged ports of the new VLAN are automatically removed from their current untagged VLAN assignment. For example, if you are creating a new VLAN on a switch that contains only the Default_VLAN, the ports that you specify as untagged ports of the new VLAN are automatically removed from the Default_VLAN.
AT-S63 Management Software Menus Interface User’s Guide Example of Creating a Port-based VLAN The following procedure creates the Sales VLAN illustrated in “Port-based Example 1” on page 605. This VLAN will be assigned a VID of 2 and will consist of four untagged ports, ports 1, 3 to 5. The VLAN will not contain any tagged ports. To create the Sales VLAN, perform the following procedure: 1. From the Main Menu, type 2 to select VLAN Configuration.
Chapter 25: Port-based and Tagged VLANs Example of Creating a Tagged VLAN The following procedure creates the Engineering VLAN in the top switch illustrated in “Tagged VLAN Example” on page 610. This VLAN will be assigned a VID of 3. It will consist of four untagged ports, ports 9, 11 to 13, and two tagged ports, ports 2 and 10. To create the example Engineering VLAN, perform the following procedure: 1. From the Main Menu, type 2 to select VLAN Configuration.
AT-S63 Management Software Menus Interface User’s Guide Modifying a Port-based or Tagged VLAN Note To modify a VLAN, you need to know its VID. To view VLAN VIDs, refer to “Displaying VLANs” on page 623. To modify a VLAN, perform the following procedure: 1. From the Main Menu, type 2 to select VLAN Configuration. The VLAN Configuration menu is shown in Figure 207 on page 612. 2. From the VLAN Configuration menu, type 4 to select Configure VLANs. The Configure VLANs menu is shown in Figure 208 on page 613.
Chapter 25: Port-based and Tagged VLANs 4. From the Modify VLAN menu, type 1 to select VLAN ID (VID). The following prompt is displayed: Enter new value -> [1 to 4096] -> 5. Enter the VID of the port-based or tagged VLAN you want to modify. The Modify VLAN menu expands to contain all relevant information about the VLAN, as shown in Figure 211. Allied Telesyn Ethernet Switch AT-9400 Series - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Modify VLAN 1 2 3 4 5 6 - VLAN Name ..............
AT-S63 Management Software Menus Interface User’s Guide 2 - VLAN ID (VID) This is the VLAN’s VID value. You cannot change this value. 3 - VLAN Type VLAN type should be Port Based for a port-based or tagged VLAN. You cannot change this value. 4 - Tagged Ports Use this selection to add or remove tagged ports from the VLAN. You can specify the ports individually (e.g., 2,3,5), as a range (e.g., 7-9), or both (e.g., 2,5,7-9).
Chapter 25: Port-based and Tagged VLANs The VLAN has been modified and is now ready for network operations. Any untagged ports removed from a VLAN are automatically returned to the Default_VLAN as untagged ports. If you added or removed from the VLAN a port with one or more static MAC addresses assigned to it, you must update the static addresses by deleting their entries from the MAC address table and reentering them again using the VID of the VLAN to which the port has been moved to.
AT-S63 Management Software Menus Interface User’s Guide Displaying VLANs To view the name, VID number, and member ports of all the VLANs on a switch, perform the following procedure: 1. From the Main Menu, type 2 to select VLAN Configuration. The VLAN Configuration menu is shown in Figure 207 on page 612. 2. From the VLAN Configuration menu, type 5 to select Show VLANs. The Show VLANs menu is shown in Figure 212.
Chapter 25: Port-based and Tagged VLANs VLAN Type The VLAN type. The possible settings are: Port Based - The VLAN is a port-based or tagged VLAN. MAC Based - The VLAN is a MAC address-based VLAN. GARP - The VLAN was automatically created by GARP. Protocol The protocol associated with this VLAN. The possible settings are: Blank - The VLAN is a port-based, tagged, or MAC address-based VLAN. GARP - The VLAN is a dynamic GVRP VLAN or the port is a dynamic GVRP port of a static VLAN.
AT-S63 Management Software Menus Interface User’s Guide Deleting a Port-based or Tagged VLAN Note To delete a VLAN, you need to know its VID. To view VLAN VIDs, refer to “Displaying VLANs” on page 623. To delete a VLAN, perform the following procedure: 1. From the Main Menu, type 2 to select VLAN Configuration. The VLAN Configuration menu is shown in Figure 207 on page 612. 2. From the VLAN Configuration menu, type 4 to select Configure VLANs. The Configure VLANs menu is shown in Figure 208 on page 613. 3.
Chapter 25: Port-based and Tagged VLANs The Delete VLAN menu expands to contain all relevant information about the VLAN, as shown in Figure 214. You can use this menu to confirm that you are deleting the correct VLAN. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Delete VLAN 1 2 3 4 5 6 - VLAN Name .............. VLAN ID (VID) .......... VLAN Type .............. Tagged Ports ........... Untagged Ports ......... Protected Ports ........
AT-S63 Management Software Menus Interface User’s Guide 10. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes.
Chapter 25: Port-based and Tagged VLANs Deleting All VLANs The following procedure deletes all port-based, tagged, and MAC address-based VLANs on a switch, except the Default_VLAN. To delete selected VLANs, perform the procedure in “Deleting a Port-based or Tagged VLAN” on page 625. To return all ports to the default VLAN, perform the following procedure: 1. From the Main Menu, type 2 to select VLAN Configuration. The VLAN Configuration menu is shown in Figure 207 on page 612. 2.
AT-S63 Management Software Menus Interface User’s Guide 6. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes.
Chapter 25: Port-based and Tagged VLANs Displaying PVIDs The following procedure displays a menu that lists the PVIDs for all the ports on the switch. To display the PVID settings on the switch, perform the following procedure: 1. From the Main Menu, type 2 to select VLAN Configuration. The VLAN Configuration menu is shown in Figure 207 on page 612. 2. From the VLAN Configuration menu, type 6 to select Show PVIDs. The Show PVIDs menu is shown in Figure 215.
AT-S63 Management Software Menus Interface User’s Guide Enabling or Disabling Ingress Filtering There are rules a switch follows when it receives and forwards an Ethernet frame. There are rules for frames as they enter a port (called ingress rules) and rules for when a frame is transmitted out a port (called egress rules). A switch does not accept and forward a frame unless the frame passes the ingress and egress rules. There are many ingress and egress rules for Gigabit Ethernet switches.
Chapter 25: Port-based and Tagged VLANs In most cases, you will probably want to leave ingress filtering activated on the switch, which is the default. You can enable or disable ingress filtering on a per switch basis. You cannot set this per port. To enable or disable ingress filtering, perform the following procedure: 1. From the Main Menu, type 2 to select VLAN Configuration. The VLAN Configuration menu is shown in Figure 207 on page 612. 2.
AT-S63 Management Software Menus Interface User’s Guide Specifying a Management VLAN The management VLAN is the VLAN on which an AT-9400 Series switch expects to receive management packets. This VLAN is important if you will be managing a switch remotely or using the enhanced stacking feature of the switch. Management packets are packets generated by a management station when you manage a switch using the Telnet application protocol or a web browser.
Chapter 25: Port-based and Tagged VLANs of 24. Then you need to be sure that the uplink and downlink ports connecting the switches together are either tagged or untagged members of the NMS VLAN. You also need to specify the NMS VLAN as the management VLAN on each switch using the AT-S63 management software. Finally, you must be sure to connect your management station to a port on a switch that is a tagged or untagged member of the management VLAN.
Chapter 26 GARP VLAN Registration Protocol This chapter describes the GARP VLAN Registration Protocol (GVRP) and contains the following sections: Section VI: VLANs “GARP VLAN Registration Protocol (GVRP) Overview” on page 636 “Configuring GVRP” on page 644 “Enabling or Disabling GVRP on a Port” on page 646 “Converting a Dynamic GVRP VLAN” on page 648 “Displaying the GVRP Port Configuration” on page 649 “Displaying GVRP Counters” on page 650 “Displaying the GVRP Database” on pa
Chapter 26: GARP VLAN Registration Protocol GARP VLAN Registration Protocol (GVRP) Overview The GARP VLAN Registration Protocol (GVRP) allows network devices to share VLAN information. The main purpose of GVRP is to allow switches to automatically discover some of the VLAN information that would otherwise need to be manually configured in each switch. This is helpful in networks where VLANs span more than one switch.
AT-S63 Management Software Menus Interface User’s Guide Figure 216 provides an example of how GVRP works.
Chapter 26: GARP VLAN Registration Protocol port that received the PDU, in this case port 4, is a member of the VLAN. If it is not a member, it automatically adds the port to the VLAN as an tagged dynamic GVRP port. If the port is already a member of the VLAN, then no change is made. 5. Switch #3 sends a PDU out port 4 to switch #2. 6. Switch #2 receives the PDU on port 3 and then adds the port as a tagged dynamic GVRP port to the dynamic GVRP_VLAN_11 VLAN.
AT-S63 Management Software Menus Interface User’s Guide disabling GVRP on those ports that are connected to GVRP-inactive devices, meaning devices that do not feature GVRP. GVRP and Network Security PDUs are transmitted to only those switch ports where GVRP is enabled. Use GVRP with caution because it can expose your network to unauthorized access.
Chapter 26: GARP VLAN Registration Protocol To use GARP, a GARP application must be defined. The Layer 2 switch has one GARP application presently implemented, GVRP. The GARP application specifies what the attribute represents. GARP defines the architecture, rules of operation, state machines and variables for the registration and deregistration of attribute values. By itself, GARP is not directly used by devices in a bridged LAN. It is the applications of GARP that perform meaningful actions.
AT-S63 Management Software Menus Interface User’s Guide GARP architecture is shown in Figure 217. Switch GARP Participant GARP Participant GARP Application GARP Application GIP MAC Layer: Port 1 GARP PDUs GID LLC GARP PDUs LLC GARP PDUs GARP PDUs GID MAC Layer: Port 2 Figure 217.
Chapter 26: GARP VLAN Registration Protocol GID Attribute ... state: Attribute C state: Attribute B state: Attribute A state: Applicant State Registrar State Figure 218. GID Architecture GARP registers and deregisters attribute values through GARP messages sent at the GID level. A GARP participant that wishes to make a declaration (an applicant registering an attribute value) sends a JoinIn or JoinEmpty message.
AT-S63 Management Software Menus Interface User’s Guide To control the applicant state machine, an applicant administrative control parameter is provided. This parameter determines whether or not the applicant state machine participates in GARP protocol exchanges. The default value has the applicant participating in the exchanges. To control the registrar state machine, a registrar administrative control parameter is provided.
Chapter 26: GARP VLAN Registration Protocol Configuring GVRP To configure GVRP, perform the following procedure: Note The timers in the following menus are in increments of centi seconds which is one hundredth of a second. To configure GVRP, perform the following procedure: 1. From the Main Menu, type 2 to select VLAN Configuration. The VLAN Configuration menu is shown in Figure 207 on page 612. 2. From the VLAN Configuration menu, type 7 to select Configure GARPGVRP.
AT-S63 Management Software Menus Interface User’s Guide 4. Type E to enable GVRP or D to disable GVRP. The default setting is disabled. 5. Type 2 to select GVRP GIP Status. The following prompt is displayed: Enter your new value (E-Enabled, D-Disabled): 6. Type E to enable GIP or D to disable GIP. Note Do not disable GIP if you intend to use GVRP. GIP is required to propagate VLAN information among the ports of the switch. Caution The following steps change the three GVRP timers.
Chapter 26: GARP VLAN Registration Protocol Enabling or Disabling GVRP on a Port This procedure enables and disables GVRP on a switch port. The default setting for GVRP on a port is enabled. Only those ports where GVRP is enabled transmit PDUs. Note Allied Telesyn recommends disabling GVRP on unused ports and those ports that are connected to GVRP-inactive devices. This protects against unauthorized access to restricted areas of your network.
AT-S63 Management Software Menus Interface User’s Guide The following prompt is displayed: Enter port-list: 5. Enter a port or a list of ports. The Configure GVRP Port Settings menu is shown in Figure 221. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Configure GVRP Port Settings Configuring Port 1-8 1 - Port Mode ............. Normal R - Return to Previous Menu Enter your selection? Figure 221. Configure GVRP Port Settings Menu 6.
Chapter 26: GARP VLAN Registration Protocol Converting a Dynamic GVRP VLAN This procedure converts a dynamic GVRP VLAN into a static VLAN. You can perform this procedure to permanently retain the VLANs the switch learned through GVRP. Note This procedure cannot convert a dynamic GVRP port in a static VLAN into a static port. For that you must manually modify the static VLAN by specifying the dynamic port as either a tagged or untagged member of the VLAN.
AT-S63 Management Software Menus Interface User’s Guide Displaying the GVRP Port Configuration To display the GVRP port configuration, perform the following procedure: 1. From the Main Menu, type 2 to select VLAN Configuration. The VLAN Configuration menu is shown in Figure 207 on page 612. 2. From the VLAN Configuration menu, type 7 to select Configure GARPGVRP. The GARP-GVRP menu is shown in Figure 219 on page 644. 3. From the GVRP Port Parameters menu, type 2 to select Display GVRP Port Configuration.
Chapter 26: GARP VLAN Registration Protocol Displaying GVRP Counters To display GVRP counters, perform the following procedure: 1. From the Main Menu, type 2 to select VLAN Configuration. The VLAN Configuration menu is shown in Figure 207 on page 612. 2. From the VLAN Configuration menu, type 7 to select Configure GARPGVRP. The GARP-GVRP menu is shown in Figure 219 on page 644. 3. From the GARP-GVRP menu, type O to select Other GVRP Parameters. The Other GVRP Parameters menu is shown in Figure 223.
AT-S63 Management Software Menus Interface User’s Guide The GVRP Counters menu (page 1) is shown in Figure 224.
Chapter 26: GARP VLAN Registration Protocol Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 GVRP Counters Receive: -------GARP Messages: --------------LeaveAll JoinEmpty JoinIn LeaveEmpty LeaveIn Empty Bad Message Bad Attribute Transmit: --------7 0 68 0 0 5 0 0 LeaveAll JoinEmpty JoinIn LeaveEmpty LeaveIn Empty 77 58 285 1 0 21 P - Previous Page U - Update Display R - Return to Previous Menu Enter your selection? Figure 225.
AT-S63 Management Software Menus Interface User’s Guide Table 20. GVRP Counters (Continued) Parameter Section VI: VLANs Meaning Receive Discarded: Port Not Listening Number of GARP PDUs discarded because the port that received the PDUs was not listening, that is, MODE=NONE was set on the port. Transmit Discarded: Port Not Sending Number of GARP PDUs discarded because the port that the PDUs were to be transmitted on was not sending, that is, MODE=NONE was set on the port.
Chapter 26: GARP VLAN Registration Protocol Table 20. GVRP Counters (Continued) Parameter 654 Meaning Transmit GARP Messages: LeaveEmpty Total number of GARP LeaveEmpty messages transmitted for all attributes in the GARP application. Receive GARP Messages: LeaveIn Total number of GARP LeaveIn messages received for all attributes in the GARP application. Transmit GARP Messages: LeaveIn Total number of GARP LeaveIn messages transmitted for all attributes in the GARP application.
AT-S63 Management Software Menus Interface User’s Guide Displaying the GVRP Database To display GVRP database, perform the following procedure: 1. From the Main Menu, type 2 to select VLAN Configuration. The VLAN Configuration menu is shown in Figure 207 on page 612. 2. From the VLAN Configuration menu, type 8 to select Configure GARPGVRP. The GARP-GVRP menu is shown in Figure 219 on page 644. 3. From the GARP-GVRP menu, type O to select Other GVRP Parameters menu.
Chapter 26: GARP VLAN Registration Protocol begin at 0. If the GARP application has no attributes presently registered, “No attributes have been registered” is displayed. VLAN ID The VLAN ID. Used Indicates whether the GID index is currently being used by any port in the GARP application. The definition of “used” is whether the Applicant and Registrar state machine for the GID index are in a non-initialized state, that is, not in {Vo, Mt} state. The value of this parameter is either “Yes” or “No”.
AT-S63 Management Software Menus Interface User’s Guide Displaying the GIP Connected Ports Ring To display the GIP connected ports ring, perform the following procedure: 1. From the Main Menu, type 2 to select VLAN Configuration. The VLAN Configuration menu is shown in Figure 207 on page 612. 2. From the VLAN Configuration menu, type 8 to select Configure GARPGVRP. The GARP-GVRP menu is shown in Figure 219 on page 644. 3. From the GARP-GVRP menu, type O to select Other GVRP Parameters menu.
Chapter 26: GARP VLAN Registration Protocol STP ID Present if the GARP application is GVRP; identifies the spanning tree instance associated with the GIP context. Connected Ring The ring of connected ports. Only ports presently in the spanning tree Forwarding state are eligible for membership in the GIP connected ring. If no ports exist in the GIP connected ring, “No ports are connected” is displayed. If the GARP application has no ports, “No ports have been assigned” is displayed.
AT-S63 Management Software Menus Interface User’s Guide Displaying the GVRP State Machine To display the GVRP state machine, perform the following procedure: 1. From the Main Menu, type 2 to select VLAN Configuration. The VLAN Configuration menu is shown in Figure 207 on page 612. 2. From the VLAN Configuration menu, type 7 to select Configure GARPGVRP. The GARP-GVRP menu is shown in Figure 219 on page 644. 3. From the GARP-GVRP menu, type O to select Other GVRP Parameters menu.
Chapter 26: GARP VLAN Registration Protocol The GVRP State Machine menu (page 2) is displayed, as shown in Figure 229.
AT-S63 Management Software Menus Interface User’s Guide Table 21. GVRP State Machine Parameters (Continued) Parameter App Meaning Applicant state machine for the GID index on that particular port.
Chapter 26: GARP VLAN Registration Protocol Table 21. GVRP State Machine Parameters (Continued) Parameter Reg Meaning Registrar state machine for the GID index on that particular port. One of: “Mt” Empty “Lv3” Leaving substate 3 (final Leaving substate) “Lv2” Leaving substate 2 “Lv1” Leaving substate 1 “Lv” Leaving substate (initial Leaving substate) “In” In “Fix” Registration Fixed “For” Registration Forbidden The initialized state for the Registrar is Mt.
Chapter 27 Multiple VLAN Modes This chapter describes the multiple VLAN modes and how to select a mode.
Chapter 27: Multiple VLAN Modes Multiple VLAN Mode Overview The multiple VLAN modes are designed to simplify the task of configuring the switch in network environments that require a high degree of network segmentation. In a multiple VLAN mode, the ports on a switch are prohibited from forwarding traffic to each other and are only allowed to forward traffic to a user-designated uplink port.
AT-S63 Management Software Menus Interface User’s Guide A user-designated port on the switch functions as an uplink port, which can be connected to a shared device such as a router for access to a WAN. This port is placed as a tagged port in each VLAN. Thus, while the switch ports are separated from each other in their individual VLANs, they all have access to the uplink port. The uplink port also has its own VLAN, where it is an untagged member. This VLAN is called Uplink_VLAN. Note In 802.
Chapter 27: Multiple VLAN Modes Table 22. 802.
AT-S63 Management Software Menus Interface User’s Guide Note When the uplink port receives a packet with a destination MAC address that is not in the MAC address table, the port broadcasts the packet to all switch ports. This can result in ports receiving packets that are not intended for them. Also note that a switch operating in this mode can be remotely managed through any port on the switch, not just the uplink port.
Chapter 27: Multiple VLAN Modes Selecting a VLAN Mode The following procedure explains how to select a VLAN mode. Available modes are: User-configured VLAN mode (port-based and tagged VLANs) IEEE 802.1Q Compliant Multiple VLAN mode Non-IEEE 802.1Q Compliant Multiple VLAN mode Note Any port-based or tagged VLANs that exist on the switch are not retained when the VLAN mode is changed from the user-configured mode to a multiple VLAN mode and, at some point, the switch is reset.
AT-S63 Management Software Menus Interface User’s Guide Displaying VLAN Information To view the VLANs on the switch while the unit is operating in Multiple VLAN mode, perform the following procedure: 1. From the Main Menu, type 2 to select VLAN Configuration. The VLAN Configuration menu (multiple VLAN mode) is shown in Figure 230. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 VLAN Configuration 1 2 3 4 5 6 - Ingress Filtering Status ........
Chapter 27: Multiple VLAN Modes The Show Multiple VLANs menu is shown in Figure 231.
Chapter 28 Protected Ports VLANs This chapter explains protected ports VLANs.
Chapter 28: Protected Ports VLANs Protected Ports VLAN Overview The purpose of a protected ports VLAN is to allow multiple ports on the switch to share the same uplink port but not share traffic with each other. This feature has some of the same characteristics as the multiple VLAN modes described in the previous chapter, but it offers several advantages. One is that it provides more flexibility. With the multiple VLAN modes, you can select only one uplink port which is shared by all the other ports.
AT-S63 Management Software Menus Interface User’s Guide To create a protected ports VLAN, you perform many of the same steps that you do when you create a new port-based or tagged VLAN. You give it a name and a unique VID, and you indicate which of the ports will be tagged and untagged. What makes creating this type of VLAN different is that you must assign the ports of the VLAN to their respective groups. Following is an example of a protected ports VLAN.
Chapter 28: Protected Ports VLANs Protected Ports VLAN Guidelines 674 Following are guidelines for implementing protected ports VLANS: A protected ports VLAN should contain a minimum of two groups. A protected ports VLAN of only one group has little value. Create a portbased or tagged VLAN instead. A protected ports VLAN can contain any number of groups. A group can contain any number of ports. The ports of a group can be tagged or untagged.
AT-S63 Management Software Menus Interface User’s Guide Creating a Protected Ports VLAN To create a new protected ports VLAN, perform the following procedure: 1. From the Main Menu, type 2 to select VLAN Configuration. 2. From the VLAN Configuration menu, type 4 to select Configure VLANs. Note If the menu does not include selection 4, Configure VLANs, the switch is running a multiple VLAN mode. To change the switch’s VLAN mode, refer to “Selecting a VLAN Mode” on page 668. 3.
Chapter 28: Protected Ports VLANs Note A VLAN must be assigned a name. 6. Type 2 to select VLAN ID (VID. The following prompt is displayed: Enter new value -> [2 to 4094] -> 7. Type a VID value for the new VLAN. The range for the VID value is 1 to 4094. The AT-S63 management software uses the next available VID number on the switch as the default value.
AT-S63 Management Software Menus Interface User’s Guide 12. Type C to select Create VLAN. The following prompt is displayed: Enter Uplink Ports (4 - 12) -> The prompt will shown the ports that you specified as belonging to the VLAN. 13. Enter the port in the VLAN that will function as the uplink port for the different VLAN groups. You can select more than one uplink port.
Chapter 28: Protected Ports VLANs Modifying a Protected Ports VLAN Please note the following before you perform this procedure: To modify this type of VLAN, you must recreate it by reselecting the uplink port(s) and reassigning the ports to the groups. For this reason Allied Telesyn recommends that before you perform this procedure you first display the details of the protected ports VLAN you want to modify and write down on paper the VLAN’s current configuration (i.e.
AT-S63 Management Software Menus Interface User’s Guide The Modify VLAN menu is shown in Figure 210 on page 619. 4. Type 1 to select VLAN ID (VID). The following prompt is displayed: Enter new value -> [1 to 4096] -> 5. Enter the VID of the VLAN you want to modify. The Modify VLAN menu expands to contain all relevant information about the VLAN, as shown in Figure 233. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Modify VLAN 1 2 3 4 5 - VLAN Name ........
Chapter 28: Protected Ports VLANs 3 - Tagged Ports Use this selection to add or remove tagged ports from the VLAN. You can specify the ports individually (e.g., 2,3,5), as a range (e.g., 7-9), or both (e.g., 2,5,7-9). The new list of tagged ports will replace the existing tagged ports. 4 - Untagged Ports Use this selection to add or remove untagged ports from the VLAN. You can specify the ports individually (e.g., 2,3,5), as a range (e.g., 79), or both (e.g., 2,5,7-9).
AT-S63 Management Software Menus Interface User’s Guide After you have created all of the groups, this prompt is displayed: SUCCESS - Press any key to continue. Press any key to continue. The modified protected ports VLAN and its groups are now active on the switch. 12. Press any key to return to the Configure VLANs menu. 13. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes.
Chapter 28: Protected Ports VLANs Displaying a Protected Ports VLAN To view the name, VID number, and member ports of all the VLANs on a switch, perform the following procedure: 1. From the Main Menu, type 2 to select VLAN Configuration. The VLAN Configuration menu is shown in Figure 207 on page 612. 2. From the VLAN Configuration menu, type 6 to select Show VLANs. The Show VLANs menu is shown in Figure 234.
AT-S63 Management Software Menus Interface User’s Guide An example of the Show VLANs window is shown in Figure 235.
Chapter 28: Protected Ports VLANs Deleting a Protected Ports VLAN All untagged ports in a deleted protected ports VLAN are automatically returned to the Default_VLAN. To delete a protected ports VLAN, perform the following procedure: 1. From the Main Menu, type 2 to select VLAN Configuration. The VLAN Configuration menu is shown in Figure 207 on page 612. 2. From the VLAN Configuration menu, type 4 to select Configure VLANs. The Configure VLANs menu is shown in Figure 208 on page 613.
AT-S63 Management Software Menus Interface User’s Guide Note You cannot delete the Default_VLAN, which has a VID of 1. The Delete VLAN menu expands to contain all relevant information about the VLAN, as shown in Figure 237. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Delete VLAN 1 2 3 4 - VLAN Name .............. VLAN ID (VID) .......... Tagged Ports ........... Untagged Ports .........
Chapter 28: Protected Ports VLANs 9. Repeat this procedure starting with Step 4 to delete other VLANs. 10. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes.
Chapter 29 MAC Address-based VLANs This chapter contains the procedures for creating MAC address-based VLANs.
Chapter 29: MAC Address-based VLANs MAC Address-based VLAN Overview Note MAC address-based VLANs are only supported on the AT-9424Ti/SP switch. As explained in “VLAN Overview” on page 600, VLANs are a means for creating independent LAN segments within a network and are typically employed to improve network performance and security. The AT-S63 management software offers several different types of VLANs, including port-based, tagged, and protected ports.
AT-S63 Management Software Menus Interface User’s Guide Table 23 illustrates a simple example of the mapping of addresses to egress ports for a MAC address-based VLAN of 6 nodes. The example consists of four workstations, a printer, and a server. For instance, Workstation 1 is connected to port 1 on the switch and is mapped to egress ports 5 for the server and 6 for the printer. Table 23.
Chapter 29: MAC Address-based VLANs addresses or egress ports from a VLAN. Here is how the example might look. Table 24.
AT-S63 Management Software Menus Interface User’s Guide egress ports, the switch forwards the packet to the port. VLANs That Span Switches If the packet’s destination MAC address is in the MAC address table but the port where the address was learned is not one of the VLAN’s egress ports, the switch discards the packet. A MAC address-based VLAN can span switches, but it does require a large degree of management in terms of entering the MAC addresses.
Chapter 29: MAC Address-based VLANs Table 25.
AT-S63 Management Software Menus Interface User’s Guide Guidelines Section VI: Virtual LANs Follow these guidelines when implementing a MAC address-based VLAN: This type of VLAN is only supported on the AT-9424Ti/SP switch. The switch can support up to a total of 4094 port-based, tagged, protected ports, and MAC address-based VLANs. The source nodes of this type of VLAN must send only untagged packets. A MAC address-based VLAN does not support tagged packets.
Chapter 29: MAC Address-based VLANs Creating a MAC Address-based VLAN This is the first stage to creating a MAC address-based VLAN. This procedure assigns the VLAN a name and a VID and sets the VLAN type. After completing this procedure you can add the source MAC addresses to the VLAN, as explained in “Adding and Deleting MAC Addresses” on page 697 and, finally, the egress ports, as explained in “Adding and Deleting Egress Ports” on page 699.
AT-S63 Management Software Menus Interface User’s Guide multiple switches, then the name for the VLAN should be the same on each switch where nodes of the VLAN are connected. Note A VLAN must be assigned a name. 6. Type 2 to select VLAN ID (VID. The following prompt is displayed: Enter new value -> [2 to 4094] -> 7. Type a VID value for the new VLAN. The range for the VID value is 1 to 4094. The AT-S63 management software uses the next available VID number on the switch as the default value.
Chapter 29: MAC Address-based VLANs Note Do not specify any tagged or untagged ports. Additionally, leave the Protected Ports selection at the default setting of No. 9. Type C to select Create VLAN. 10. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes. This completes the first phase to creating a new MAC address-based VLAN. You assigned it a name, gave it a VID, and set the VLAN type.
AT-S63 Management Software Menus Interface User’s Guide Adding and Deleting MAC Addresses This procedure explains how to add and delete MAC addresses from a MAC address-based VLAN. If you are creating a new VLAN, you perform this procedure after you initially create the VLAN by giving it a name and a VID and setting the VLAN type, as explained in “Creating a MAC Addressbased VLAN” on page 694.
Chapter 29: MAC Address-based VLANs 5. To add a MAC address to a MAC address-based VLAN, type 1 to select Add MAC Address. To delete an address, type 2 to select Delete MAC Address. The following prompt is displayed: Please enter VLAN ID -> [1 to 4094] -> 2 6. Enter the VID of the MAC address-based VLAN where you want to add or delete a MAC address. You can enter only one VID. To display the VIDs, refer to “Displaying MAC Address-based VLANs” on page 703.
AT-S63 Management Software Menus Interface User’s Guide Adding and Deleting Egress Ports This procedure explains how to add and delete egress ports from the MAC addresses in a MAC address-based VLAN. Before adding egress ports to a MAC address, review the following: The egress ports of a MAC address-based VLAN are considered as a community. Assigning a port to one address makes it an egress port for all the addresses in the same VLAN. A MAC address must have at least one egress port.
Chapter 29: MAC Address-based VLANs 6. Enter the VID of the MAC address-based VLAN where you want to add or delete an egress port. You can enter only one VID. To display the VIDs, refer to “Displaying MAC Address-based VLANs” on page 703. The following prompt is displayed: Please enter MAC address -> 7. Enter the MAC address where you want to add or delete an egress port. You can specify only one address and the address must already exist in the VLAN.
AT-S63 Management Software Menus Interface User’s Guide Deleting a MAC Address-based VLAN Note To delete a VLAN, you need to know its VID. To view VLAN VIDs, refer to “Displaying MAC Address-based VLANs” on page 703. To delete a VLAN, perform the following procedure: 1. From the Main Menu, type 2 to select VLAN Configuration. The VLAN Configuration menu is shown in Figure 207 on page 612. 2. From the VLAN Configuration menu, type 4 to select Configure VLANs.
Chapter 29: MAC Address-based VLANs The Delete VLAN menu expands to contain all relevant information about the VLAN, as shown in Figure 241. You can use this menu to confirm that you are deleting the correct VLAN. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Delete VLAN 1 2 3 4 5 6 - VLAN Name .............. VLAN ID (VID) .......... VLAN Type .............. Tagged Ports ........... Untagged Ports ......... Protected Ports ........
AT-S63 Management Software Menus Interface User’s Guide Displaying MAC Address-based VLANs To view the details of a MAC address-based VLAN, perform the following procedure: 1. From the Main Menu, type 2 to select VLAN Configuration. The VLAN Configuration menu is shown in Figure 207 on page 612. 2. From the VLAN Configuration menu, type 5 to select Show VLANs. The Show VLANs menu is shown in Figure 242.
Chapter 29: MAC Address-based VLANs Protocol The protocol associated with this VLAN. The possible settings are: Blank - The VLAN is a port-based, tagged, or MAC address-based VLAN. GARP - The VLAN is a dynamic GVRP VLAN or the port is a dynamic GVRP port of a static VLAN. Untagged (U) / Tagged (T) The untagged and tagged ports of a VLAN. These are empty for a MAC address-based VLAN. 3. To view the MAC addresses and egress ports of a MAC addressbased VLAN, type D to select Detail Information Display.
AT-S63 Management Software Menus Interface User’s Guide The lower portion of the display lists the MAC addresses that belong to the VLAN along with their egress ports.
Chapter 29: MAC Address-based VLANs 706 Section VI: Virtual LANs
Section VII Port Security The chapters in this section contain overview information on the port security features of the AT-9400 Series switch. The chapters also explain how to configure these features from the menu interface of the AT-S63 management software. The chapters include: Section VII: Port Security Chapter 30, “MAC Address-based Port Security” on page 709 Chapter 31, “802.
Section VII: Port Security
Chapter 30 MAC Address-based Port Security This chapter explains how you can use the dynamic and static MAC addresses learned or manually added to the switch’s MAC address table to control which end nodes can forward packets through the device.
Chapter 30: MAC Address-based Port Security MAC Address Port Security Overview This feature can enhance the security of your network. You can use it to control which end nodes can forward frames through the switch, and so prevent unauthorized individuals from accessing your network or particular parts of the network. This type of network security uses a frame’s source MAC address to determine whether the switch should forward a frame or discard it.
AT-S63 Management Software Menus Interface User’s Guide port has already learned its maximum number of dynamic MAC addresses. A switch port can have up to 255 dynamic and static MAC addresses. Secured The Secured security level instructs a port to forward frames using only static MAC addresses. The port does not learn any dynamic MAC addresses and deletes any dynamic addressees that it has already learned.
Chapter 30: MAC Address-based Port Security Intrusion action defines what a port does when it receives an invalid frame. For a port operating under either the Secured or Locked security mode, the intrusion action is always the same. The port discards the frame. But with the Limited security mode you can specify an intrusion action. Here are the options: MAC Address Port Security Guidelines 712 Discard the invalid frame. Discard the invalid frame and send an SNMP trap.
AT-S63 Management Software Menus Interface User’s Guide Configuring MAC Address Port Security To set the port security level, perform the following procedure: 1. From the Main Menu, type 1 to select Port Configuration. The Port Configuration menu is shown in Figure 25 on page 112. 2. From the Port Configuration menu, type 5 to select Port Security. The Port Security menu is shown in Figure 244.
Chapter 30: MAC Address-based Port Security The menu displays the current security level on the selected port. If you are configuring a range of ports and the ports have different security levels, the menu displays the security level of the lowest number port. Note Option D, Select Default Port Security, sets the security mode for the port to the default value of Automatic. 5. From the Configure Port Security menu, type 1 to select Security Mode.
AT-S63 Management Software Menus Interface User’s Guide Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Configure Port Security Configuring Port Security 4 1 2 3 4 - Security Mode ..................... Intruder Action ................... Port Participating ................ Threshold ......................... Limited No Action No 100 D - Set Default Port Security R - Return to Previous Menu Enter your selection? Figure 246.
Chapter 30: MAC Address-based Port Security 10. If you selected the trap or disable intrusion action, type 4 to toggle the Port Participating option to Yes. Option 3, Port Participating, applies only when the intrusion action is set to trap or disable. This option does not apply when intrusion action is set to discard. If this option is set to No when intrusion action is set to trap or disable, the port discards invalid packets, but it does not send an SNMP trap or disable the port.
AT-S63 Management Software Menus Interface User’s Guide Displaying Port Security Levels To view the current security levels and intrusion actions for the ports on the switch, perform the following procedure: 1. From the Main Menu, type 1 to select Port Configuration. The Port Configuration menu is shown in Figure 25 on page 112. 2. From the Port Configuration menu, type 5 to select Port Security. The Port Security menu is shown in Figure 244 on page 713. 3.
Chapter 30: MAC Address-based Port Security Threshold The maximum number of dynamic MAC addresses the port learns. It only applies when a port is operating in the Limited security mode. Intruder Action The action taken by a port if it receives an invalid frame while operating in the Limited security mode. The possible settings are: Discard - The port discards invalid frames. This is the default. Trap - The port discards invalid frames and sends a trap.
Chapter 31 802.1x Port-based Network Access Control This chapter explains 802.1x Port-based Network Access Control and how you can use this feature to restrict access to the network ports on the switch. Sections are as follows: Section VII: Port Security “IEEE 802.1x Port-based Network Access Control Overview” on page 720 “Setting Port Roles” on page 734 “Enabling or Disabling 802.
Chapter 31: 802.1x Port-based Network Access Control IEEE 802.1x Port-based Network Access Control Overview The AT-S63 management software offers you several different methods for protecting your network and its resources from unauthorized access. For instance, Chapter 30, “MAC Address-based Port Security” on page 709, explains how you can restrict network access using the MAC addresses that belong to the end nodes of your network. This chapter explains yet another way. This method, referred to as 802.
AT-S63 Management Software Menus Interface User’s Guide Authentication server - The authentication server is the network device that has the RADIUS server software. This is the device that does the actual authenticating of the user names and passwords from the supplicants. The AT-9400 Series switch does not authenticate any of the username and passwords from the end users. Rather, it acts as an intermediary between a supplicant and the authentication server during the authentication process.
Chapter 31: 802.1x Port-based Network Access Control Port Roles Part of the task of implementing this feature is specifying the roles of the ports on the switch. A port can have one of three roles: None Authenticator Supplicant None Role A switch port in the None role does not participate in port-based access control. Any device can connect to the port and send traffic through it and receive traffic from it without providing a username and password.
AT-S63 Management Software Menus Interface User’s Guide 1 3 5 7 9 11 13 15 17 19 21 23R AT-9424T/SP PORT ACTIVITY CLASS 1 LASER PRODUCT L/A D/C 1000 LINK / ACT 10/100 LINK / HDX / FDX 1 3 5 7 9 11 15 17 19 TERMINAL PORT 21 23R 1000 LINK / ACT L/A L/A 23 24 6 8 10 12 14 16 18 20 22 24R 23 24 MASTER RPS POWER D/C 4 STATUS FAULT SFP SFP D/C 2 Gigabit Ethernet Switch ACT COL 13 L/A SFP 2 4 6 8 10 12 14 16 18 20 22 24R Port 22 in None Role
Chapter 31: 802.
AT-S63 Management Software Menus Interface User’s Guide Note, however, that should the client who accomplished the initial log on fail to periodically reauthenticate or log out, the switch port reverts to the unauthenticated state. It bars all further traffic to and from all the clients on the port, until the initial client or another client logs on by providing a valid username and password combination.
Chapter 31: 802.
AT-S63 Management Software Menus Interface User’s Guide This scenario is illustrated in Figure 252.
Chapter 31: 802.
AT-S63 Management Software Menus Interface User’s Guide log onto and forward traffic through the AT-9400 Series switch. Of course, the combinations must be defined on the RADIUS authentication server. The switch prompts a client for the information the first time they try to pass a packet through the authenticator port. The port accepts and forwards traffic only from those clients who successfully log on and denies access to all other users.
Chapter 31: 802.1x Port-based Network Access Control example, you were to make a client’s port an authenticator, the client would have to log on twice when trying to access switch A, once on its port on switch B as well as the authenticator port on switch A. This is not permitted. Consequently, in our example the clients on switch B have full access to that switch, but are denied access to switch A until they log on to port 6 on switch A.
AT-S63 Management Software Menus Interface User’s Guide The information sent by the switch to the RADIUS server for an event includes: Port number where the event occurred The date and time when the event occurred The number of packets transmitted and received by the switch port during a supplicant’s session. (This information is sent only when the client logs off.) You can also configure the accounting feature to send interim updates so you can monitor which clients are still active.
Chapter 31: 802.1x Port-based Network Access Control 3. You must configure and activate the RADIUS client software in the AT-S63 management software. The default setting for the authentication protocol is disabled. You will need to provide the following information: The IP addresses of up to three RADIUS servers. The encryption key used by the authentication servers. The instructions for this step are in “Configuring RADIUS” on page 836. 4.
AT-S63 Management Software Menus Interface User’s Guide Note End users of 802.1x port-based network access control should be instructed to always log off when they are finished with a work session. This prevents unauthorized individuals from accessing the network through unattended network workstations.
Chapter 31: 802.1x Port-based Network Access Control Setting Port Roles This procedure sets port roles. For an explanation of port roles, refer to “Port Roles” on page 722. You must set up the port roles before you enable port access control. To set port roles, perform the following procedure: 1. From the Main Menu, type 7 to select Security and Services. The Security and Services menu is shown in Figure 87 on page 291. 2. From the Security Configuration menu, type 1 to select Port Access Control (802.1X).
AT-S63 Management Software Menus Interface User’s Guide The Configure Port Access Role menu is shown in Figure 257. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Configure Port Access Role Configuring Port 3 1 - Port Role ......... None R - Return to Previous Menu Enter your selection? Figure 257. Configure Port Access Role Menu 5. Type 1 to select Port Role.
Chapter 31: 802.1x Port-based Network Access Control Enabling or Disabling 802.1x Port-based Network Access Control This procedure explains how to enable and disable port-based access control on the switch. If you have not assigned port roles and configured the parameter settings, you should skip this procedure and go first to “Setting Port Roles” on page 734.
AT-S63 Management Software Menus Interface User’s Guide Configuring Authenticator Port Parameters To configure the parameters of an authenticator port, perform the following procedure: 1. From the Main Menu, type 7 to select Security and Services. The Security and Services menu is shown in Figure 87 on page 291. 2. From the Security Configuration menu, type 2 to select Port Access Control (802.1X). The Port Access Control (802.1X) menu is shown in Figure 256 on page 734. 3.
Chapter 31: 802.1x Port-based Network Access Control The Configure Authenticator Port Access Parameters menu is shown in Figure 259. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Configure Authenticator Port Access Parameters Configuring Port 3 1 2 3 4 5 6 7 8 9 A B - Supplicant Mode .......... Port Control ............. Quiet Period ............. TX Period ................ Reauth Enabled ........... Reauth Period ............ Supplicant Timeout .......
AT-S63 Management Software Menus Interface User’s Guide 2 - Port Control The possible settings for this parameter are: Auto - Enables 802.1x port-based authentication and causes the port to begin in the unauthorized state, allowing only EAPOL frames to be sent and received through the port. The authentication process begins when the link state of the port changes or the port receives an EAPOLStart packet from a supplicant.
Chapter 31: 802.1x Port-based Network Access Control 9 - Max Requests This parameter specifies the maximum number of times that the switch retransmits an EAP Request packet to the client before it times out the authentication session. The default value for this parameter is 2 retransmissions. The range is 1 to 10 retransmissions. A - Control Direction This parameter specifies how the port handles ingress and egress broadcast and multicast packets when in the unauthorized state.
AT-S63 Management Software Menus Interface User’s Guide Configuring Supplicant Port Parameters To configure supplicant port parameters, perform the following procedure: 1. From the Main Menu, type 7 to select Security and Services. The Security and Services menu is shown in Figure 87 on page 291. 2. From the Security Configuration menu, type 2 to select Port Access Control (802.1X). The Port Access Control (802.1X) menu is shown in Figure 256 on page 734. 3.
Chapter 31: 802.1x Port-based Network Access Control The Configure Supplicant Port Access Parameters menu is shown in Figure 259. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Configure Supplicant Port Access Parameters Configuring Port 5-8 1 2 3 4 5 6 - Auth Period........... Held Period........... Max Start ........... Start Period.......... User Name: ........... User Password: .......
AT-S63 Management Software Menus Interface User’s Guide characters, such as asterisks or exclamation points. The username is case sensitive. 6 - User Password This parameter specifies the password for the switch port. The port sends the password to the authentication server for verification when the port logs on to the network. The password can be from 1 to 16 alphanumeric characters (A to Z, a to z, 1 to 9). Do not use spaces or special characters, such as asterisks or exclamation points.
Chapter 31: 802.1x Port-based Network Access Control Displaying the Port Access Parameters To display the port access parameters for the ports on the switch, perform the following procedure: 1. From the Main Menu, type 7 to select Security and Services. The Security and Services menu is shown in Figure 87 on page 291. 2. From the Security Configuration menu, type 2 to select Port Access Control (802.1X). The Port Access Control (802.1X) menu is shown in Figure 256 on page 734. 3.
AT-S63 Management Software Menus Interface User’s Guide Port Role Port access role configured for the port. The possible settings are None, Authenticator, or Supplicant. State State of the port. The state field is dependent on whether a port is configured as an authenticator or a supplicant.
Chapter 31: 802.1x Port-based Network Access Control Configuring RADIUS Accounting The AT-S63 management software supports RADIUS accounting for ports operating in the Authenticator role. The accounting information sent by the switch to a RADIUS server includes the date and time when clients log on and log off, as well as the number of packets sent and received by a switch port during a client session. For background information on this feature, refer to “RADIUS Accounting” on page 730.
AT-S63 Management Software Menus Interface User’s Guide switch. Select Enabled to activate the feature or Disabled to deactivate it. The default is Disabled. 2 - Port This parameter specifies the UDP port for RADIUS accounting. The default is port 1813. 3 - Type This parameter specifies the type of RADIUS accounting. The default is Network. This value cannot be changed. 4 - Trigger Type This parameter specifies the action that causes the switch to send accounting information to the RADIUS server.
Chapter 31: 802.
Section VIII Management Security The chapters in this section contain overview information on the management security features of the AT-9400 Series switch. The chapters also explain how to configure these features from the menu interface of the AT-S63 management software.
Section VIII: Management Security
Chapter 32 Web Server The chapter provides an overview of the web server feature and procedures to configure the server.
Chapter 32: Web Server Web Server Overview The AT-S63 management software comes with web server software. The software is available so that you can remotely manage the switch with a web browser from any management station on your network. (The instructions for managing a switch with a web browser are described in the AT-S63 Network Management Web Browser Interface User’s Guide.) The web server can operate in two modes. The first is referred to as nonsecure HTTP mode.
AT-S63 Management Software Menus Interface User’s Guide Configuring the Web Server This procedure explains how to enable and disable the web server and how to configure the HTTP and HTTPS settings from a local or Telnet management session. The default setting for the web server is enabled, with the non-secure HTTP mode as the active web server mode. Before you configure the web server, note the following: You cannot make any changes to the HTTP or HTTPS settings while the web server is enabled.
Chapter 32: Web Server 3. Type 1 to select Status to enable or disable the web server. To configure the web server, you must first disable it. Toggle between the following values: Enabled - Enables the web server. This is the default setting. Disabled - Disables the web server. (If you are making any changes to the web server settings, you must first disable it.) 4. Type 2 to select Mode to set the mode of the web server.
AT-S63 Management Software Menus Interface User’s Guide The Web Server Configuration menu is redisplayed. Figure 265 shows an example of the menu configured for HTTPS. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Web Server Configuration 1 2 3 4 - Status ............................ Mode .............................. Port Number ....................... SSL Key ID ........................
Chapter 32: Web Server General Steps for Configuring the Web Server for Encryption There are several procedures you need to perform in order to implement HTTPS and web browser encryption on the switch. This section is here to provide you with the general steps you need to do and the procedures for performing them. There is a section for configuring the web server with a self-signed certificate and another for a public or private CA certificate.
AT-S63 Management Software Menus Interface User’s Guide 6. After you have received the appropriate certificates from the CA, download them into the AT-S63 file system from your management station or a TFTP server, as explained in “Downloading a System File” on page 244. 7. Add the certificates to the certificate database, as explained in “Adding a Certificate to the Database” on page 797. 8.
Chapter 32: Web Server 758 Section VIII: Management Security
Chapter 33 Encryption Keys This chapter describes encryption keys and how you can use keys to improve the security of your switches. Because of the complexity of the feature, this chapter contains several overview sections. The Basic Overview section offers a general review of the purpose of this feature along with relevant guidelines. For additional information, refer to the two Technical Overview sections.
Chapter 33: Encryption Keys Basic Overview Protecting your managed switches from unauthorized management access is an important role for a network manager. Network operations and security can be severely compromised if an intruder gains access to critical switch information, such as a manager’s login username and password, and uses that information to alter a switch’s configuration settings.
AT-S63 Management Software Menus Interface User’s Guide Encryption Key Length To create a key pair, you must specify its length. The length is given in bits. The range is 512 to 1,536 bits, in increments of 256 bits. The default is 512 bits. The general rule on key lengths is that the longer the key, the more difficult it is for someone to break (decipher).
Chapter 33: Encryption Keys Technical Overview The encryption feature provides the following data security services: Data Encryption Data encryption Data authentication Key exchange algorithms Key creation and storage Data encryption for switches is driven by the need for organizations to keep sensitive data private and secure. Data encryption operates by applying an encryption algorithm and key to the original data (the plaintext) to convert it into an encrypted form (the ciphertext).
AT-S63 Management Software Menus Interface User’s Guide algorithm and key. For a given input block of plaintext ECB always produces the same block of ciphertext. Cipher Block Chaining (CBC) is the most popular form of DES encryption. CBC also operates on 64-bit blocks of data, but includes a feedback step which chains consecutive blocks so that repetitive plaintext data, such as ASCII blanks, does not yield identical ciphertext.
Chapter 33: Encryption Keys secret. Only the decryption, or private key, needs to be kept secret. The other name for this type of algorithm is public key encryption. The public and private key pair cannot be randomly assigned, but must be generated together. In a typical scenario, a decryption station generates a key pair and then distributes the public key to encrypting stations.
AT-S63 Management Software Menus Interface User’s Guide It is very hard to find another message and key which give the same hash The two most commonly used one-way hash algorithms are MD5 (Message Digest 5, defined in RFC 1321) and SHA-1 (Secure Hash Algorithm, defined in FIPS-180-1). MD5 returns a 128-bit hash and SHA-1 returns a 160-bit hash. MD5 is faster in software than SHA-1, but SHA-1 is generally regarded to be slightly more secure.
Chapter 33: Encryption Keys A Diffie-Hellman algorithm requires more processing overhead than RSAbased key exchange schemes, but it does not need the initial exchange of public keys. Instead, it uses published and well tested public key values. The security of the Diffie-Hellman algorithm depends on these values. Public key values less than 768 bits in length are considered to be insecure. A Diffie-Hellman exchange starts with both parties generating a large random number.
AT-S63 Management Software Menus Interface User’s Guide Creating an Encryption Key This section contains the procedure for creating an encryption key pair. Caution Key generation is a CPU-intensive process. Because this process may affect switch behavior, Allied Telesyn recommends creating keys when the switch is not connected to a network or during periods of low network activity. To create an encryption key, perform the following procedure: 1. From the Main Menu, type 7 to select Security and Services.
Chapter 33: Encryption Keys The Key Management menu is shown in Figure 267.
AT-S63 Management Software Menus Interface User’s Guide 6. Enter an identification number for the key. This number can be from 0 to 65,535. This number is used only for identification purposes and not in generating the actual encryption key. The ID for each key on the switch must be unique. Note You cannot change the value for option 2, Key Type. This value is always RSA - Private. 7. Type 3 to select Key Length. The following prompt is displayed: Enter Key Length ->[512 to 1536] -> 512 8.
Chapter 33: Encryption Keys The new key is added to the list of keys in the Key Management menu. Returning to the Main Menu to save your changes is not necessary with this procedure. This type of change is automatically saved by the management software. To create a self-signed certificate using the new encryption key, go to “Creating a Self-signed Certificate” on page 793. To create an enrollment request, go to “Generating an Enrollment Request” on page 808.
AT-S63 Management Software Menus Interface User’s Guide Deleting an Encryption Key This section contains the procedure for deleting an encryption key pair from the switch. Note the following before performing this procedure. Deleting a key pair from the key management database also deletes the key’s corresponding “.ukf” file from the AT-S63 file system. You cannot delete a key pair if it is being used by SSL or SSH.
Chapter 33: Encryption Keys Modifying an Encryption Key The Key Management menu has a selection for modifying the description of an encryption key. This is the only item of a key that you can modify. You cannot change a key’s ID, type, or length. To change the description of a key, perform the following procedure: 1. From the Main Menu, type 7 to select Security and Services. The Security and Services menu is shown in Figure 87 on page 291. 2.
AT-S63 Management Software Menus Interface User’s Guide Exporting an Encryption Key The following procedure exports the public key of a key pair into the AT-S63 file system. (The management software does not allow you to export a private key.) Before performing this procedure, please note the following: The only circumstance in which you are likely to perform this procedure is if you are using an SSH client that does not download the key automatically when you start an SSH management session.
Chapter 33: Encryption Keys The Export Key to File menu is shown in Figure 269. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Export Key to File 1 2 3 4 5 - Key ID ............ 0 Key Type .......... RSA-Public Key File Format ... HEX Key File Name Export Key to File R - Return to Previous Menu Enter your selection? Figure 269. Export Key to File Menu 5. From the Export Key to File menu, type 1 to select Key ID.
AT-S63 Management Software Menus Interface User’s Guide The following message is displayed: Key Export in Progress. Please wait...Done 11. Press any key to return to the Key Management menu. To view the public key in the switch’s file system, refer to “Displaying System Files” on page 220. Returning to the Main Menu to save your changes is not necessary with this procedure. This type of change is automatically saved by the management software.
Chapter 33: Encryption Keys Importing an Encryption Key Use the following procedure to import a public key from the AT-S63 file system into the key management database. If a file contains both public and private keys, only the public key is imported. The private key is ignored. Note It is unlikely that you will ever need to perform this procedure. A switch can only use those public keys that it has generated itself. This procedure starts from the Key Management menu.
AT-S63 Management Software Menus Interface User’s Guide The Import Key from File menu is shown in Figure 270. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Import Key from File 1 2 3 4 5 - Key ID ............ 0 Key Type .......... RSA-Public Key File Format ... HEX Key File Name ..... Import Key from File R - Return to Previous Menu Enter your selection? Figure 270. Import Key from File Menu 5. From the Import Key from File menu, type 1 to select Key ID.
Chapter 33: Encryption Keys The key file name must include the “.key” extension. If you are unsure of the file name, display the files in the switch’s file system by referring to “Displaying System Files” on page 220. 10. Type 5 to select Import Key From File to import a key to the switch from an external file. The following message is displayed: Key Import in Progress. Please wait...Done After you receive this message, the key is added to the Key Management database.
AT-S63 Management Software Menus Interface User’s Guide Displaying the Encryption Keys To display the encryption keys, perform the following procedure: 1. From the Main Menu, type 7 to select Security and Services. The Security and Services menu is shown in Figure 87 on page 291. 2. From the Security and Services menu, type 7 to select Keys/Certificate Configuration. The Keys/Certificate Configuration menu is shown in Figure 266 on page 767. 3.
Chapter 33: Encryption Keys Length The length of the key in bits. Digest The CRC32 value of the MD5 digest of the public key. Description The key’s description.
Chapter 34 PKI Certificates and SSL This chapter contains the procedures for creating public key infrastructure (PKI) certificates for web server security. Because of the complexity of this feature, two overview sections are provided. The Basic Overview section offers a general review of the purpose of certificates along with relevant guidelines. For additional information refer to the Technical Overview section.
Chapter 34: PKI Certificates and SSL Basic Overview This chapter describes the second part of the encryption feature of the AT-S63 management software—PKI certificates. The first part is explained in Chapter 33, “Encryption Keys” on page 759. Encryption keys and certificates allow you to encrypt the communications between your management station and a switch when you manage the device with a web browser.
AT-S63 Management Software Menus Interface User’s Guide devices. If your company is large enough, it might have a private CA and you might want that group to issue any AT-9400 Series switch certificates, if for no other reason than to follow company policy. What is required to create a certificate by a public or private CA? First, you must create a key pair. After you have done that you need to generate an digital document called an enrollment request.
Chapter 34: PKI Certificates and SSL This distinguished name omits the common name, but includes everything else: ou=Network Support,o=XYZ Inc.,st=CA,c=US So what would be a good distinguished name for a certificate for an AT-9400 Series switch? If the switch has an IP address, such as a master switch, you could use its address as the name. The following example is a distinguished name for a certificate for a master switch with the IP address 149.11.11.11: cn=149.11.11.
AT-S63 Management Software Menus Interface User’s Guide that the master switch is using is the same for all the switches in the stack. As an example, if the master switch is using HTTPS, a web browser management session assumes that all the other switches in the stack are also using HTTPS, and it does not allow you to manage any switches running HTTP. For those networks that consist of enhanced stacking switches where some switches support SSL and others do not, there are two approaches you can take.
Chapter 34: PKI Certificates and SSL Technical Overview This section describes the Secure Sockets Layer (SSL) feature, a security protocol that provides a secure and private TCP connection between a client and server. SSL can be used with many higher layer protocols including HTTP, File Transfer Protocol (FTP) and Net News Transfer Protocol (NNTP). Most web browsers and servers support SSL, and its most common deployment is for secure connections between a client and server over the Internet.
AT-S63 Management Software Menus Interface User’s Guide SSL uses asymmetrical (Public Key) encryption to establish a connection between client and server, and symmetrical (Secret Key) encryption for the data transfer phase. User Verification An SSL connection has two phases: handshake and data transfer. The handshake initiates the SSL session, during which data is securely transmitted between a client and server.
Chapter 34: PKI Certificates and SSL Authentication Authentication is the process of ensuring that both the web site and the end user are genuine. In other words, they are not imposters. Both the server and an individual users need to be authenticated. This is especially important when transmitting secure data over the Internet. To verify the authenticity of a server, the server has a public and private key. The public key is given to the user. SSL uses certificates for authentication.
AT-S63 Management Software Menus Interface User’s Guide Both the exchange of encrypted messages and digital signatures are secure only if the public key used for encryption or decryption belongs to the message’s expected recipient. If a public key is insecurely distributed, it is possible a malicious agent could intercept it and replace it with the malicious agent’s public key (the Man-in-the-Middle attack).
Chapter 34: PKI Certificates and SSL The issuing organization’s digital signature is included in order to authenticate the certificate. As a result, if a certificate is tampered with during transmission, the tampering is detected. Elements of a Public Key Infrastructure A public key infrastructure is a set of applications which manage the creation, retrieval, validation and storage of certificates.
AT-S63 Management Software Menus Interface User’s Guide Certificate Validation To validate a certificate, the end entity verifies the signature in the certificate, using the public key of the CA who issued the certificate. CA Hierarchies and Certificate Chains It may not be practical for every individual certificate in an organization to be signed by one certification authority. A certification hierarchy may be formed, in which one CA (for example, national headquarters) is declared to be the root CA.
Chapter 34: PKI Certificates and SSL PKI Implementation The following sections discuss Allied Telesyn’s implementation of PKI for the AT-9400 Series switches.
AT-S63 Management Software Menus Interface User’s Guide Creating a Self-signed Certificate This section contains the procedure for creating a self-signed certificate. Please review the following before you perform the procedure: For a general review of all the steps to configuring the switch for a selfsigned certificate, refer to “General Steps for a Self-signed Certificate” on page 756.) The switch’s time and date must be set before you create a certificate.
Chapter 34: PKI Certificates and SSL The Public Key Infrastructure (PKI) Configuration menu is shown in Figure 272. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Public Key Infrastructure (PKI) Configuration 1 - Maximum Number of Certificates....... 256 2 - X509 Certificate Management 3 - Generate Enrollment Request R - Return to Previous Menu Enter your selection? Figure 272. Public Key Infrastructure (PKI) Configuration Menu 4.
AT-S63 Management Software Menus Interface User’s Guide Note In the X509 Certificate Management menu, MTrust means manually trusted. This field indicates that you verified the certificate. The Source field indicates the certificate was generated on the switch. Both MTrust and Source are read-only fields. 5. Type 1 to select Create Self-Signed Certificate. The Create Self-Signed Certificate menu is shown in Figure 274.
Chapter 34: PKI Certificates and SSL 9. Enter the ID number of the encryption key that you want to use to create this certificate. The encryption key must already exist on the switch. (If you have forgotten the key ID number, return to the Key Management menu to view the keys on the switch.) The value can be from 0 to 65,535. 10. Type 3 to select Format to choose the encoding format for the certificate. The possible options are: DER - Indicates the certificate contents are in a binary format.
AT-S63 Management Software Menus Interface User’s Guide Adding a Certificate to the Database After you have created a certificate or received a certificate from a public or private CA, you need to add it into the certificate database to make it available for use by the switch’s web server. After you add a certificate to the certificate database, it appears in the X509 Certificate Management menu. To add a certificate to the certificate database, perform the following procedure: 1.
Chapter 34: PKI Certificates and SSL The Add Certificate menu is shown in Figure 275. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Add Certificate 1 2 3 4 5 - Certificate Name ............. State ........................ Trusted Type ......................... EE File Name .................... Add Certificate R - Return to Previous Menu Enter your selection? Figure 275. Add Certificate Menu 6. Type 1 to select Certificate Name.
AT-S63 Management Software Menus Interface User’s Guide Note This parameter has no affect on the operation of a certificate. The parameter is included only for informational purposes when the certificate is displayed in the certificate database. 9. Type 3 to select Type (of certificate). The possible settings are: EE The certificate was issued by a CA, such as VeriSign. This is the default. CA The certificate belongs to a CA. Self This certificate is a self-signed certificate.
Chapter 34: PKI Certificates and SSL Modifying a Certificate The procedure in this section modifies a certificate. (The certificate to be modified must be in the certificate database.) Here are the certificate items you can modify: State - trusted or untrusted Type - EE, CA, or Self Note These parameters have no affect on the operation of a certificate. They are included only for informational purposes when the certificate is displayed in the certificate database.
AT-S63 Management Software Menus Interface User’s Guide 6. Enter the name of the certificate you want to modify. (This field is case sensitive.) The Modify Certificate menu is shown in Figure 276. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Modify Certificate 1 2 3 4 - Certificate Name................. Switch12 State ........................... Trusted Type ............................
Chapter 34: PKI Certificates and SSL The following message is displayed: Please wait while certificate is updated...Done. 10. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes.
AT-S63 Management Software Menus Interface User’s Guide Deleting a Certificate The procedure in this section deletes a certificate from the certificate database. Please note the following before performing this procedure: Deleting a certificate from the database does not delete it from the switch. It continues to reside in the AT-S63 file system. To completely remove a certificate from the switch, you must also delete it from the file system.
Chapter 34: PKI Certificates and SSL The following prompt is displayed: Enter certificate name (ALL - delete all) -> 6. Enter the name of the certificate you want to delete. (This field is case sensitive.) To delete all the certificates, enter ALL. 7. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes.
AT-S63 Management Software Menus Interface User’s Guide Viewing a Certificate This procedure displays information about a certificate, such as its distinguished name and serial number. This procedure starts from the X509 Certificate Management menu. If you are unsure how to access the menu, perform steps 1 to 4 in the procedure “Adding a Certificate to the Database” on page 797. To view the details of a certificate, perform the following procedure: 1.
Chapter 34: PKI Certificates and SSL The View Certificate Details menu (page 1) is shown in Figure 277. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 View Certificate Details Certificate Details: Name ............... State .............. Manually Trusted ... Type ............... Source ............. Version ............ Serial Number ...... Signature Alg ...... Public Key Alg ..... Not Valid Before ... Not Valid After ....
AT-S63 Management Software Menus Interface User’s Guide Not Valid Before The date the certificate became active. Not Valid After The date the certificate expires. Self-signed certificates are valid for two years. 7. Type N to see the second page of certificate details. The View Certificate Details menu (page 2) is shown in Figure 278. User: Manager Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing 11:20:02 02-Mar-2005 View Certificate Details Subject ......... CN=149.44.44.44 Issuer ..........
Chapter 34: PKI Certificates and SSL Generating an Enrollment Request To request a certificate from a CA, you need to generate an enrollment request. The request contains the public key for the certificate, a distinguished name, and other information. The request is stored as a file with a “.csr” extension in the AT-S63 file system, from where you can upload it onto your management station or TFTP server for submission to the CA.
AT-S63 Management Software Menus Interface User’s Guide The Generate Enrollment Request menu is shown in Figure 279. Allied Telesyn Ethernet Switch AT-94xx - AT-S63 Marketing User: Manager 11:20:02 02-Mar-2005 Generate Enrollment Request 1 2 3 4 5 - Request Name.................... KeyPair ID ..................... 0 Format ......................... PEM Type ........................... PKCS10 Generate Enrollment Request R - Return to Previous Menu Enter your selection? Figure 279.
Chapter 34: PKI Certificates and SSL 12. Type 5 to select Generate Enrollment Request. After the switch has finished generating the request, a message similar to the following is displayed: Enrollment request is being generated. Please wait ...Done. Enrollment Request available in file [Switch 12.csr]. Press any key to continue ... The enrollment request is now stored in the AT-S63 file system. To see the file, refer to “Displaying System Files” on page 220. 13.
AT-S63 Management Software Menus Interface User’s Guide Installing CA Certificates onto a Switch This section lists the procedures that you will need to perform if the switch’s certificate was created by a public or private CA. It should be noted that a CA generated certificate actually consists of several certificates. There is a minimum of two. All the certificates from the CA must be installed on the switch.
Chapter 34: PKI Certificates and SSL Viewing or Configuring the Number of Certificates in the Database You can specify the maximum number of certificates that can be stored on the certificate database. The range is a maximum of 12 to 256. The default value is 256. There should be little cause or need for you to adjust this value. To view or change the number of certificates in the certificate database, perform the following procedure: 1. From the Main Menu, type 7 to select Security and Services.
AT-S63 Management Software Menus Interface User’s Guide Configuring SSL To configure the SSL protocol, perform the following procedure: 1. From the Main Menu, type 7 to select Security and Services. The Security and Services menu is shown in Figure 87 on page 291. 2. From the Security and Services menu, type 9 to select Secure Socket Layer (SSL). The Secure Socket Layer (SSL) menu is shown in Figure 280.
Chapter 34: PKI Certificates and SSL 814 Section VIII: Management Security
Chapter 35 Secure Shell (SSH) The chapter contains overview information about the Secure Shell (SSH) protocol as well a procedure for configuring this protocol on a switch using a local or Telnet management session.
Chapter 35: Secure Shell (SSH) SSH Overview Secure management is increasingly important in modern networks, as the ability to easily and effectively manage switches and the requirement for security are two universal requirements. Switches are often remotely managed using remote sessions via the Telnet protocol. This method, however, has a serious security problem—it is only protected by plaintext usernames and passwords which are vulnerable to wiretapping and password guessing.
AT-S63 Management Software Menus Interface User’s Guide Note Non-encrypted Secure Shell sessions serve no purpose. SSH Server When the SSH server is enabled, connections from SSH clients are accepted. When the SSH server is disabled, connections from SSH clients are rejected by the switch. Within the switch, the AT-S63 management software uses well-known port 22 as the SSH default port.
Chapter 35: Secure Shell (SSH) enhanced stacking feature. Management packets from your workstation are first directed to the master switch before being forwarded to the slave switch. The reverse is true as well. Management packets from a slave switch first pass through the master switch before reaching your management station. Enhanced stacking uses a proprietary protocol different from Telnet and SSH protocols. Consequently, there is no encryption between a master switch and a slave switch.
AT-S63 Management Software Menus Interface User’s Guide SSH Configuration Guidelines General Steps for Configuring SSH Below are the guidelines to observe when you configure SSH: SSH requires two encryption key pairs. One key pair will function as the host key and the other the server key. For instructions on creating keys, refer to “Creating an Encryption Key” on page 767. The two encryption key pairs must be of different lengths of at least one increment (256 bits) apart.
Chapter 35: Secure Shell (SSH) Configuring SSH This section describes how to configure the switch as an SSH server. For a description of all the steps required to configure an SSH server, see “General Steps for Configuring SSH” on page 819. Before you begin this procedure, you need to configure a host and server keys for SSH. See Chapter 33, “Encryption Keys” on page 759. The minimum bit size of the server key is 512 bits. The recommended bit size for a server key is 768 bits.
AT-S63 Management Software Menus Interface User’s Guide 3. Type 2 to select Host Key ID. The following prompt is displayed: Enter Host Key ID [0 to 65535] -> 0 Enter the ID number of the encryption key that will function as the host key. The default is Not Defined. For instructions on creating encryption keys, see Chapter 33, “Encryption Keys” on page 759. 4. Type 3 to select Server Key ID.
Chapter 35: Secure Shell (SSH) Type E to enable the SSH server. Select this value after you have finished configuring SSH and want to log on to the server. Or, type D to disable SSH while you are configuring the protocol. SSH must be disabled while you are configuring the protocol. This is the default. Note When there are active SSH connections, you cannot disable the SSH server. If you attempt to disable the SSH server when it is in this state, you receive a warning message.
AT-S63 Management Software Menus Interface User’s Guide Displaying SSH Information To display SSH server information, perform the following procedure: 1. From the Main Menu, type 7 to select Security and Services. The Security and Services menu is shown in Figure 87 on page 291. 2. From the Security and Services menu, type 8 to select Secure Shell (SSH). The Secure Shell (SSH) menu is shown in Figure 282 on page 820. 3. From the Secure Shell (SSH) menu, type 6 to select Show Server Information.
Chapter 35: Secure Shell (SSH) Host Key ID The host key ID defined for SSH. Host Key Bits Number of bits in the host key. Server Key ID Server key ID defined for SSH. Server Key Expiry Length of time, in hours, until the server key is regenerated. The default is 0 hours which means the server key is not regenerated. Login Timeout Time, in seconds, until a SSH server is released from an incomplete connection with a SSH client. Authentication Available Authentication method available.
Chapter 36 TACACS+ and RADIUS Protocols This chapter describes how to configure the parameter settings for the two authentication protocols TACACS+ and RADIUS.
Chapter 36: TACACS+ and RADIUS Protocols TACACS+ and RADIUS Overview TACACS+ and RADIUS are authentication protocols for enhancing the security of your network. In general terms, these authentication protocols transfer the task of authenticating network access from a network device to an authentication protocol server. The AT-S62 software comes with TACACS+ and RADIUS client software. You can use the client software to add two security features to the switch.
AT-S63 Management Software Menus Interface User’s Guide authentication protocol server. The server checks to see if the username and password are valid for that switch. This is referred to as authentication. If the combination is valid, the authentication protocol server notifies the switch and the switch completes the login process, allowing the manager to manage the switch. If the username and password are invalid, the authentication protocol server notifies the switch and the switch cancels the login.
Chapter 36: TACACS+ and RADIUS Protocols You need to configure the TACACS+ or RADIUS software on the authentication server. This involves the following: – Specifying the username and password combinations. The maximum length for a username is 38 alphanumeric characters and spaces, and the maximum length for a password is 16 alphanumeric characters and spaces. – Assigning each combination an authorization level. How this is achieved differs depending on the server software you are using.
AT-S63 Management Software Menus Interface User’s Guide When a switch receives a username and password combination from a network manager, it sends the combination to the first authentication server in its list. If the server fails to respond, the switch sends the combination to the next server in the list, and so on.
Chapter 36: TACACS+ and RADIUS Protocols Enabling or Disabling Server-based Management Authentication To enable or disable server-based management authentication on the switch, perform one of the following procedures. Enabling Serverbased Management Authentication To enable server-based management authentication, perform the following procedure: Note Before enabling this feature on the switch, you should first configure the TACACS+ or RADIUS settings.
AT-S63 Management Software Menus Interface User’s Guide Note Option 1 - Server-based Authentication in the menu applies only to the manager accounts feature described in this chapter. This menu selection has no affect on the 802.1x port-based access control feature described in Chapter 31, “802.1x Port-based Network Access Control” on page 719. When Option 1 is set to disabled, the default setting, the switch uses the default manager and operator accounts.
Chapter 36: TACACS+ and RADIUS Protocols Disabling Serverbased Management Authentication To disable server-based management authentication feature on the switch so that the device uses the standard manager and operator accounts, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2. From the System Administration menu, type 6 to select Authentication Configuration.
AT-S63 Management Software Menus Interface User’s Guide Configuring TACACS+ To configure the TACACS+ client software, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2. From the System Administration menu, type 6 to select Authentication Configuration. The Authentication Configuration menu is shown in Figure 284 on page 830. 3.
Chapter 36: TACACS+ and RADIUS Protocols If you will be specifying more than one TACACS+ server and if all of the servers use the same encryption secret, you can answer No to this prompt and enter the encryption secret using the TAC Global Secret parameter. However, if you are specifying only one TACACS+ server or if the servers have difference encryption secrets, then respond with Yes to this prompt.
AT-S63 Management Software Menus Interface User’s Guide Displaying the TACACS+ Settings To display the TACACS+ settings, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2. From the System Administration menu, type 6 to select Authentication Configuration. The Authentication Configuration menu is shown in Figure 284 on page 830. 3. Type 3 to select TACACS+ Configuration.
Chapter 36: TACACS+ and RADIUS Protocols Configuring RADIUS To configure the RADIUS protocol, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2. From the System Administration menu, type 6 to select Authentication Configuration. The Authentication Configuration menu is shown in Figure 284 on page 830. 3. Type 4 to select RADIUS Configuration.
AT-S63 Management Software Menus Interface User’s Guide Manager and Operator accounts. The default is 10 seconds. The range is 1 to 60 seconds. 3 - RADIUS Server 1 Configuration 4 - RADIUS Server 1 Configuration 5 - RADIUS Server 1 Configuration Use these parameters to specify the IP addresses of up to three network servers containing the RADIUS server software. Selecting one of the options displays the RADIUS Server Configuration menu, shown in Figure 288.
Chapter 36: TACACS+ and RADIUS Protocols Displaying RADIUS Status and Settings To display the RADIUS status and settings, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2. From the System Administration menu, type 6 to select Authentication Configuration. The Authentication Configuration menu is shown in Figure 284 on page 830. 3.
AT-S63 Management Software Menus Interface User’s Guide The Show Status menu displays a table that contains the following columns of information: Server IP Address IP address of the RADIUS server. Auth Port UDP port of the RADIUS protocol. Encryption Key Encryption key for the RADIUS server. Auth Req Number of authentication requests the switch has made to the RADIUS server. Auth Resp Number of responses that the switch has received back from the server.
Chapter 36: TACACS+ and RADIUS Protocols 840 Section VIII: Management Security
Chapter 37 Management Access Control List This chapter explains how to create an access control list (ACL) to restrict Telnet and web browser management access to the switch.
Chapter 37: Management Access Control List Management ACL Security Overview This chapter explains how to restrict remote management access of a switch by creating a management access control list (management ACL). This feature controls which management stations can remotely manage the device using the Telnet application protocol or a web browser. The switch uses the management ACL to filter the management packets that it receives.
AT-S63 Management Software Menus Interface User’s Guide Mask You need to enter a mask that indicates the parts of the IP address the switch should filter on. A binary “1” indicates the switch should filter on the corresponding bit of the address, while a “0” indicates that it should not. If you are filtering on a specific IP address, use the mask 255.255.255.255. If you are filtering on a subnet, enter the appropriate mask. For example, to allow all management stations in the subnet 149.11.11.
Chapter 37: Management Access Control List Examples Activating this feature without specifying any ACEs prohibits you from managing the switch remotely using a Telnet application or web browser because the switch discards all Telnet and web browser management packets. You can apply management ACLs to both master and slave switches in an enhanced stack.
AT-S63 Management Software Menus Interface User’s Guide ACE #1 IP Address Subnet Mask Protocol Interface 149.11.11.0 255.255.255.0 TCP Telnet ACE #2 IP Address Subnet Mask Protocol Interface 149.22.22.0 255.255.255.0 TCP Telnet The two ACEs in this management ACL permit remote management from the management station with the IP address 149.11.11.11 and all management stations in the subnet 149.22.22.0: ACE #1 IP Address Mask Protocol Interface 149.11.11.11 255.255.255.
Chapter 37: Management Access Control List Enabling or Disabling the Management ACL This procedure enables and disables the management ACL. When enabled, only those management stations specified in the ACL are allowed to manage the switch remotely using the Telnet application protocol or a web browser. When the feature is disabled, the management software on the switch can be accessed remotely from any management workstation.
AT-S63 Management Software Menus Interface User’s Guide A change to the status of the management ACL is immediately activated on the switch. Note If you activate the feature while managing the switch from a Telnet management session, your management session will end and you will not be able to reestablish it if the management ACL does not contain an ACE that specifies your management workstation. 4. After making changes, type R until you return to the Main Menu.
Chapter 37: Management Access Control List Adding an ACE To add a new ACE to the management ACL, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2. From the System Administration menu, type 7 to select Management ACL. The Management ACL Configuration menu is shown in Figure 290 on page 846. 3. From the Management ACL Configuration menu, type 2 to select Add Management ACL Entry.
AT-S63 Management Software Menus Interface User’s Guide 7. Specify which interface you want the management station to be able to use when managing the switch. The options are: Telnet - Allows Telnet management packets. Web - Allows web browser management packets. All - Allows both Telnet and web browser management packets. The new ACE is added to the ACL. 8. After making changes, type R until you return to the Main Menu. Then type S to select Save Configuration Changes.
Chapter 37: Management Access Control List Deleting an ACE To delete an ACE, you need to know its details, such as its IP address, mask, protocol, and interface. The management software prompts you for this information when you delete it. You can simplify this procedure by first displaying the contents of the Management ACL and jotting down on paper the specifics of the ACE you want to delete. That way you will have the information when the management software prompts you for it.
AT-S63 Management Software Menus Interface User’s Guide 7. Specify the interface of the ACE. The specified ACE is removed from the switch. 8. If desired, repeat this procedure starting with Step 3 to delete more ACEs from the Management ACL.
Chapter 37: Management Access Control List Displaying the ACEs To display the ACEs in the management ACL, perform the following procedure: 1. From the Main Menu, type 5 to select System Administration. The System Administration menu is shown in Figure 4 on page 54. 2. From the System Administration menu, type 7 to select Management ACL. The Management ACL Configuration menu is shown in Figure 290 on page 846. 3.
Appendix A AT-S63 Management Software Default Settings This appendix lists the factory default settings for the AT-S63 management software. It contains the following sections in alphabetical order: “Boot Configuration File Default Setting” on page 855 “Class of Service” on page 856 “Denial of Service Prevention Default Settings” on page 857 “802.
Appendix A: AT-S63 Management Software Default Settings 854 “Telnet Server Default Settings” on page 881 “VLAN Default Settings” on page 882 “Web Server Default Settings” on page 883
AT-S63 Management Software Menus Interface User’s Guide Boot Configuration File Default Setting The following table lists the File menu default setting. Boot Configuration File Menu Setting Default Configuration File Default boot.
Appendix A: AT-S63 Management Software Default Settings Class of Service The following table lists the default mappings of IEEE 802.1p priority levels to egress port priority queues IEEE 802.
AT-S63 Management Software Menus Interface User’s Guide Denial of Service Prevention Default Settings The following table lists the default settings for the Denial of Service prevention feature. Denial of Service Prevention Setting Default IP Address 0.0.0.0 Subnet Mask 0.0.0.
Appendix A: AT-S63 Management Software Default Settings 802.1x Port-Based Network Access Control Default Settings The following table describes the 802.1x Port-based Network Access Control default settings. 802.1x Port-based Network Access Control Settings Default Port Access Control Disabled Authentication Method RADIUS EAP Port Role None The following table lists the default settings for RADIUS accounting.
AT-S63 Management Software Menus Interface User’s Guide Enhanced Stacking Default Setting The following table lists the enhanced stacking default setting.
Appendix A: AT-S63 Management Software Default Settings Event Log Default Settings The following table lists the event log default settings.
AT-S63 Management Software Menus Interface User’s Guide GVRP Default Settings This section provides the default settings for GVRP.
Appendix A: AT-S63 Management Software Default Settings IGMP Snooping Default Settings The following table lists the IGMP Snooping default settings.
AT-S63 Management Software Menus Interface User’s Guide IP Default Settings The following table describes the IP default settings. IP Setting Default IP Address 0.0.0.0 Subnet Mask 0.0.0.0 Gateway Address 0.0.0.
Appendix A: AT-S63 Management Software Default Settings MAC Address-based Port Security Default Settings The following table lists the MAC address-based port security default settings.
AT-S63 Management Software Menus Interface User’s Guide MAC Address Table Default Setting The following table lists the default setting for the MAC address table.
Appendix A: AT-S63 Management Software Default Settings Management Access Control List Default Setting The following table lists the default setting for the Management Access Control List.
AT-S63 Management Software Menus Interface User’s Guide Manager and Operator Account Default Settings The following table lists the manager and operator account default settings. Manager Account Setting Default Manager Login Name manager Manager Password friend Operator Login Name operator Operator Password operator Console Disconnect Timer Interval 10 minutes Console Startup Mode CLI Note Login names and passwords are case sensitive.
Appendix A: AT-S63 Management Software Default Settings MLD Snooping Default Settings The following table lists the MLD Snooping default settings.
AT-S63 Management Software Menus Interface User’s Guide Networking Stack Default Setting The following table lists the networking stack default setting.
Appendix A: AT-S63 Management Software Default Settings PKI Default Settings The following table lists the PKI default settings, including the generate enrollment request settings.
AT-S63 Management Software Menus Interface User’s Guide Port Configuration Default Settings The following table lists the port configuration default settings.
Appendix A: AT-S63 Management Software Default Settings RJ-45 Serial Terminal Port Default Settings The following table lists the RJ-45 serial terminal port default settings. RJ-45 Serial Terminal Port Setting Default Data Bits 8 Stop Bits 1 Parity None Flow Control None Baud Rate 9600 bps The only adjustable parameter on the port is the baud rate.
AT-S63 Management Software Menus Interface User’s Guide RRP Snooping Default Setting The following table lists the RRP Snooping default setting.
Appendix A: AT-S63 Management Software Default Settings Server-based Authentication (RADIUS and TACACS+) Default Settings This section describes the server-based authentication, RADIUS, and TACACS+ client default settings. Server-based Authentication Default Settings RADIUS Default Settings The following table describes the server-based authentication default settings.
AT-S63 Management Software Menus Interface User’s Guide SNMP Default Settings The following table describes the SNMP default settings.
Appendix A: AT-S63 Management Software Default Settings SNTP Default Settings The following table lists the SNTP default settings. SNTP Setting 876 Default System Time 00:00:00 on January 1, 1970 SNTP Status Disabled SNTP Server 0.0.0.
AT-S63 Management Software Menus Interface User’s Guide Spanning Tree (STP, RSTP, and MSTP) Default Settings This section provides the spanning tree, STP RSTP, and MSTP, default settings. Spanning Tree Switch Settings The following table describes the Spanning Tree Protocol default settings for the switch. Spanning Tree Setting STP Default Settings Default Spanning Tree Status Disabled Active Protocol Version RSTP The following table describes the STP default settings.
Appendix A: AT-S63 Management Software Default Settings MSTP Default Settings The following table lists the MSTP default settings.
AT-S63 Management Software Menus Interface User’s Guide SSH Default Settings The following table lists the SSH default settings. SSH Setting Default Status Disabled Host Key ID Not Defined Server Key ID Not Defined Server Key Expiry Time 0 hours Login Timeout 180 seconds SSH Port Number 22 The SSH port number is not adjustable.
Appendix A: AT-S63 Management Software Default Settings SSL Default Settings The following table lists the SSL default settings.
AT-S63 Management Software Menus Interface User’s Guide Telnet Server Default Settings The following table lists the Telnet server default settings. Telnet Server Setting Default Telnet Server Enabled Telnet Port Number 23 NULL Character Off The Telnet port number is not adjustable.
Appendix A: AT-S63 Management Software Default Settings VLAN Default Settings This section provides the VLAN default settings.
AT-S63 Management Software Menus Interface User’s Guide Web Server Default Settings The following table lists the web server default settings.
Appendix A: AT-S63 Management Software Default Settings 884
Appendix B SNMPv3 Configuration Examples This appendix provides two examples of SNMPv3 configuration using the SNMPv3 Table menus and a worksheet to use as an aid when configuring the SNMPv3 protocol.
Appendix B: SNMPv3 Configuration Examples SNMPv3 Configuration Examples This appendix provides SNMPv3 configuration examples for the following types of users: Manager Operator In addition an SNMPv3 Configuration Table is provided to record your SNMPv3 configuration. For more information about the SNMPv3 protocol, see Chapter 22, “SNMPv3” on page 419. SNMPv3 Manager Configuration This section provides a sample configuration for a Manager with a User Name of systemadmin24.
AT-S63 Management Software Menus Interface User’s Guide Configure SNMPv3 SecurityToGroup Table User Name:systemadmin24 Security Model:v3 Group Name: Managers Storage Type: NonVolatile Configure SNMPv3 Notify Table Notify Name: sysadminTrap Notify Tag: sysadminTag Notify Type: Trap Storage Type: NonVolatile Configure SNMPv3 Target Address Table Target Address Name: host451 Target IP Address: 198.35.11.
Appendix B: SNMPv3 Configuration Examples Configure SNMPv3 View Table Menu View Name: internet View Subtree OID: 1.3.6.1 (or internet) Subtree Mask: View Type: Included Storage Type: NonVolatile Configure SNMPv3 Access Table Group Name: Operators Security Model: SNMPv3 Security Level: Authentication Read View Name: internet Write View Name: Notify View Name: SNMPv3 Worksheet This section supplies a table that you can use a worksheet when configuring SNMPv3.
AT-S63 Management Software Menus Interface User’s Guide SNMPv3 Parameters (Continued) Security Model Security Level Read View Name Write View Name Notify View Name Storage Type SNMPv3 SecurityToGroup Table User Name Security Model Group Name Storage Type SNMPv3 Notify Table Notify Name Notify Tag Notify Type Storage Type SNMPv3 Target Address Table Target Address Name Target IP Address UDP Port Timeout Retries Tag List Target Parms Name Storage Type SNMPv3 Target Parameters Table Target Parameters Name Use
Appendix B: SNMPv3 Configuration Examples SNMPv3 Parameters (Continued) Security Model Security Level Storage Type 890
Index Numerics 802.1Q-compliant VLAN mode described 664 displaying 669 selecting 668 802.
Index B back pressure 119 default setting 871 baud rate, terminal port 74 boot configuration file. See configuration file Boot Protocol (BootP) activating 57 deactivating 57 default setting 863 defined 57 BPDU.
AT-S63 Management Software Menus Interface User’s Guide console startup mode configuring 71 default setting 867 console timer 72 CoS. See Class of Service (CoS) CRL.
Index displaying 358 modifying 355 force version default setting 877, 878 Multiple Spanning Tree Protocol (MSTP) 569 Rapid Spanning Tree Protocol (RSTP) 544 forwarding delay 530 G GARP VLAN Registration Protocol (GVRP) configuring 644 default settings 861 described disabling 644 disabling on a port 646 displaying counters 650 database 655 GIP connected ports ring 657 GVRP state machine 659 port configuration 649 dynamic VLAN, converting 648 enabling 644 enabling on a port 646 guidelines 638 intermediate s
AT-S63 Management Software Menus Interface User’s Guide Land attack configuring defense 385 described 381 limited port security mode, described 710 Link Aggregation Control Protocol (LACP) port trunk adminkey parameter changing 172 configuring 169 described 153 aggregate trunk 150 aggregator creating 168 deleting 173 described 150 modifying 171 configuring ports 174 described 150 displaying status 175 enabling or disabling protocol 166 guidelines 155 load distribution method changing 172 described 156 sele
Index maximum multicast groups IGMP snooping 396, 862 MLD snooping 406, 868 maximum number of sessions configuring 813 default setting 880 MCHECK 547 MD5 authentication algorithm 765 MD5 authentication protocol 421 MDI/MDI-X 115 MIB subtree view 422 MIB tree diagram 422 RFC 422 MIB view 422 MIBs supported 37 viewing 420 MLD snooping.
AT-S63 Management Software Menus Interface User’s Guide P packet filter, default setting 871 packet filtering, configuring 121 packet rate limiting default setting 871 password, default 45 path cost 575 path cost, desciption 528 PEM 796 PEM certificate format 809 piggy-back mode described 724 selecting 740 Ping of Death attack configuring defense 385 described 383 pinging 75 PKI.
Index Public Key Infrastructure (PKI) See also certificates, encryption keys certificate database 792 certificates adding 792 fingerprint 792 maximum number of, default setting 870 retrieving 792 validating 791 certification authority (CA) described 790 root 791 default settings 870 End Entity 790 overview 788 standards 792 structure 790 X.509 certificates 789 PVID. See Port VLAN identifier (PVID) QoS.
AT-S63 Management Software Menus Interface User’s Guide default settings 880 described 782 encryption 786 technical overview 786 secured port security mode, described 711 self-signed certificate creating 756 described 782 server authentication UDP port 837 default setting 874 server encryption key 837 server IP address 837 server key expiry time parameter 821 server key ID parameter 821 server-based authentication.
Index deleting 482 displaying 520 modifying storage type 490 target address retries 487 target address tag list 488 target address timeout 486 target address UDP port 485 target IP address 483 target parameters 489 SNMPv3 Target Address Table, described 427 SNMPv3 Target Parameters Table entry creating 493 deleting 496 displaying 520 modifying message process model 502 security level 500 security model 499 storage type 503 user name 497 SNMPv3 Target Parameters Table, described 427 SNMPv3 trap 423 SNMPv3 U
AT-S63 Management Software Menus Interface User’s Guide system temperature 79 system time default setting 876 setting 67 T TACACS+ configuring 833 default settings 874 disabling 832 displaying settings 835 enabling 830 guidelines 827 overview 826 server IP address 833 server timeout configuring 834 default setting 874 displaying 835 tagged ports adding to VLAN 615, 621 deleting from VLAN 621 described 609 tagged VLAN creating 612 creating, example 618 defined 608 deleting 625, 628 displaying 623 example 6
Index 902
