HP 1920 Gigabit Ethernet Switch Series User Guide Part number: 5998-5627 Software version: Release 1102 Document version: 5W100-20140620
Legal and notice information © Copyright 2014 Hewlett-Packard Development Company, L.P. No part of this documentation may be reproduced or transmitted in any form or by any means without prior written consent of Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.
Contents Overview ······································································································································································ 1 Configuring the switch in the Web interface ············································································································· 2 Restrictions and guidelines ·············································································································································
Displaying system and device information··············································································································· 47 Displaying system information ······································································································································ 47 Displaying basic system information ··················································································································· 47 Displaying the system resource sta
Mirroring source ···················································································································································· 79 Mirroring destination ············································································································································ 79 Mirroring direction ················································································································································ 79 Mirroring
Configuring an SNMP user ········································································································································· 120 Configuring SNMP trap function ································································································································ 121 Displaying SNMP packet statistics ····························································································································· 123 SNMPv1/v2c config
Creating a static MAC address entry················································································································ 176 Configuring MSTP ··················································································································································· 177 Overview······································································································································································· 177 Introducti
Configuring Switch A ·········································································································································· 236 Configuring Switch B ·········································································································································· 239 Verifying the configuration ································································································································· 239 LLDP configuration gui
Static route ··························································································································································· 278 Default route ························································································································································· 279 Displaying the IPv4 active route table ······················································································································· 279 Crea
Configuring 802.1X ··············································································································································· 321 802.1X overview ························································································································································· 321 802.
PKI applications ··················································································································································· 386 Recommended configuration procedures ·················································································································· 386 Recommended configuration procedure for manual request·········································································· 386 Recommended configuration procedure for automatic requ
Configuring loopback detection ···························································································································· 447 Recommended configuration procedure···················································································································· 447 Configuring loopback detection globally ·················································································································· 447 Configuring loopback detection on a p
Configuring PoE ······················································································································································ 497 Overview······································································································································································· 497 Configuring PoE ·················································································································································
Overview The HP 1920 Switch Series can be configured through the command line interface (CLI), Web interface, and SNMP/MIB. These configuration methods are suitable for different application scenarios. • The Web interface supports all 1920 Switch Series configurations. • The CLI provides configuration commands to facilitate your operation. To perform other configurations not supported by the CLI, use the Web interface.
Configuring the switch in the Web interface Restrictions and guidelines To ensure a successful login, verify that your operating system and Web browser meet the requirements, and follow the guidelines in this section.
Figure 1 Internet Explorer settings (1) 3. Click Custom Level. 4. In the Security Settings dialog box, enable Run ActiveX controls and plug-ins, Script ActiveX controls marked safe for scripting, and Active scripting.
Figure 2 Internet Explorer settings (2) 5. Click OK to save your settings. Enabling JavaScript in a Firefox browser 1. Launch the Firefox browser, and select Tools > Options. 2. In the Options dialog box, click the Content icon, and select Enable JavaScript.
Figure 3 Firefox browser settings 3. Click OK to save your settings. Others • The Web interface does not support the Back, Next, and Refresh buttons provided by the browser. Using these buttons might result in abnormal display of Web pages. • To ensure correct display of Web page contents after software upgrade or downgrade, clear data cached by the browser before you log in. • If you click the verification code displayed on the Web login page, you can get a new verification code.
Overview The device provides web-based configuration interfaces for visual device management and maintenance. Figure 4 Web-based network management operating environment Logging in to the Web interface You can use the following default settings to log in to the web interface through HTTP: • Username—admin • Password—None • IP address of VLAN-interface 1 on the device—IP address of the device, depending on the status of the network where the device resides.
b. Enter the username admin and the verification code, leave the password blank, and click Login. Figure 5 Login page of the Web interface Logging out of the Web interface CAUTION: • You cannot log out by directly closing the browser. • For security purposes, log out of the Web interface after you finish your operations. 1. Save the current configuration. Because the system does not save the current configuration automatically, HP recommends that you perform this step to avoid loss of configuration. 2.
• Navigation tree—Organizes the Web-based NM functions as a navigation tree, where you can select and configure functions as needed. The result is displayed in the body area. • Body area—Allows you to configure and display features.
Function menu System Time Description User level Electronic Label Display the electronic label of the device. Monitor Diagnostic Information Generate diagnostic information file and view or save the file to local host. Management System Time Display and configure the system date and time. Configure Net Time Display the synchronization status of the system clock and configure the network time. Monitor Display and refresh system logs. Monitor Clear system logs.
Function menu Description User level Switch To Management Switch the current user level to the management level. Visitor Loopback Loopback Perform loopback tests on Ethernet interfaces. Configure VCT VCT Check the status of the cables connected to Ethernet ports. Configure Flow Interval Port Traffic Statistics Display the average rate at which the interface receives and sends packets within a specified time interval. Monitor Statistics Display, create, modify, and clear RMON statistics.
Function menu VLAN VLAN Interface Net work Voice VLAN MAC Description User level Select VLAN Select a VLAN range. Monitor Create Create VLANs. Configure Port Detail Display the VLAN-related details of a port. Monitor Detail Display the member port information about a VLAN. Monitor Modify VLAN Modify the description and member ports of a VLAN. Configure Modify Port Change the VLAN to which a port belongs. Configure Remove Remove VLANs.
Function menu LACP LLDP Description User level Summary Display information about LACP-enabled ports and their partner ports. Monitor Setup Set LACP priorities. Configure Port Setup Display the LLDP configuration information, local information, neighbor information, statistics information, and status information about a port. Monitor Modify LLDP configuration on a port. Configure Display global LLDP configuration information. Monitor Configure global LLDP parameters.
Function menu IPv6 Routing Description User level Summary Display the IPv6 active route table. Monitor Create Create an IPv6 static route. Configure Remove Delete the selected IPv6 static routes. Configure Monitor DHCP Relay Display information about the DHCP status, advanced configuration information about the DHCP relay agent, DHCP server group configuration, DHCP relay agent interface configuration, and the DHCP client information.
Function menu Description User level Display the accounting method configuration information about an ISP domain. Monitor Specify accounting methods for an ISP domain. Management RADIUS Server Display and configure RADIUS server information. Management RADIUS Setup Display and configure RADIUS parameters. Management Local User Display configuration information about local users. Monitor Create, modify, and remove a local user. Management Display configuration information about user groups.
Function menu Description User level Link Setup Create a rule for a link layer ACL. Configure Remove Delete an IPv4 ACL or its rules. Configure Summary Display IPv6 ACL configuration information. Monitor Create Create an IPv6 ACL. Configure Basic Setup Configure a rule for a basic IPv6 ACL. Configure Advanced Setup Configure a rule for an advanced IPv6 ACL. Configure Remove Delete an IPv6 ACL or its rules. Configure Summary Display the queue information about a port.
Function menu PoE PoE Description User level Summary Display PSE information and PoE interface information. Monitor PSE Setup Configure a PoE interface. Configure Port Setup Configure a port. Configure Common items on the Web pages Buttons and icons Table 2 Commonly used buttons and icons Button and icon Function Applies the configuration on the current page. Cancels the configuration on the current page. Refreshes the current page. Clears all entries in a list or all statistics.
Figure 7 Content display by pages Search function The Web interface provides you with the basic and advanced searching functions to display only the entries that match specific searching criteria. • Basic search—As shown in Figure 7, type the keyword in the text box above the list, select a search item from the list and click Search to display the entries that match the criteria. Figure 8 shows an example of searching for entries with LLDP disabled.
Figure 9 Advanced search Take the LLDP table shown in Figure 7 as an example. To search for the LLDP entries with LLDP Work Mode TxRx, and LLDP Status Disabled: 1. Click the Advanced Search link, specify the search criteria on the advanced search page as shown in Figure 10, and click Apply. The LLDP entries with LLDP Work Mode being TxRx are displayed. Figure 10 Advanced search function example (1) 2.
Figure 12 Advanced search function example (3) Sort function On some list pages, the Web interface provides the sorting function to display the entries in a certain order. The Web interface provides you with the sorting functions to display entries in certain orders. On a list page, you can click the blue heading item of each column to sort the entries based on the heading item you selected. After your clicking, the heading item is displayed with an arrow beside it as shown in Figure 13.
Configuring the switch at the CLI The HP 1920 Switch Series can be configured through the CLI, Web interface, and SNMP/MIB, among which the Web interface supports all 1920 Switch Series configurations. These configuration methods are suitable for different application scenarios. As a supplementary to the Web interface, the CLI provides some configuration commands to facilitate your operation, which are described in this chapter.
NOTE: • The serial port on a PC does not support hot swapping. When you connect a PC to a powered-on switch, connect the DB-9 connector of the console cable to the PC before connecting the RJ-45 connector to the switch. • When you disconnect a PC from a powered-on switch, disconnect the DB-9 connector of the console cable from the PC after disconnecting the RJ-45 connector from the switch.
Figure 16 Setting the serial port used by the HyperTerminal connection 4. Set Bits per second to 38400, Data bits to 8, Parity to None, Stop bits to 1, and Flow control to None, and click OK. Figure 17 Setting the serial port parameters 5. Select File > Properties in the HyperTerminal window.
Figure 18 HyperTerminal window 6. Click the Settings tab, set the emulation to VT100, and click OK in the Switch Properties dialog box.
Logging in to the CLI The login process requires a username and password. The default username for first time configuration is admin, no password is required. Usernames and passwords are case sensitive. To log in to the CLI: 1. Press Enter. The Username prompt displays: Login authentication Username: 2. Enter your username at the Username prompt. Username:admin 3. Press Enter. The Password prompt appears.
initialize Syntax initialize Parameters None Description Use initialize to delete the configuration file to be used at the next startup and reboot the device with the default configuration being used during reboot. Use the command with caution because this command deletes the configuration file to be used at the next startup and restores the factory default settings.
# Create VLAN-interface 1 and assign 192.168.1.2 to the interface, and specify 192.168.1.1 as the default gateway. ipsetup ip-address 192.168.1.2 24 default-gateway 192.168.1.1 ipsetup ipv6 Syntax ipsetup ipv6 { auto | address { ipv6-address prefix-length | ipv6-address/prefix-length } [ default-gateway ipv6-address ] } Parameters auto: Enables the stateless address autoconfiguration function.
Change password for user: admin Old password: *** Enter new password: ** Retype password: ** The password has been successfully changed. ping Syntax ping host Parameters host: Destination IPv4 address (in dotted decimal notation) or host name (a string of 1 to 255 characters). Description Use ping to ping a specified destination. To terminate a ping operation, press Ctrl+C. Examples # Ping IP address 1.1.2.2. ping 1.1.2.2 PING 1.1.2.2: 56 data bytes, press CTRL_C to break Reply from 1.1.2.
Examples # Ping IPv6 address 2001::4.
reboot Syntax reboot Parameters None Description Use reboot to reboot the device and run the main configuration file. Use the command with caution because reboot results in service interruption. If the main configuration file is corrupted or does not exist, the device cannot be rebooted with the reboot command.
Select menu option: Summary IP Method: Manual IP address: 192.168.0.233 Subnet mask: 255.255.255.0 Default gateway: IPv6 Method: IPv6 link-local address: IPv6 subnet mask length: IPv6 global address: IPv6 subnet mask length: IPv6 default gateway: Current boot app is: flash:/hp1920-24G.bin Next main boot app is: flash:/hp1920-24G.bin Next backup boot app is: flash:/test.bin HP Comware Platform Software Comware Software, Version 5.20.
Use upgrade server-address source-filename runtime to upgrade the system software image file. If the system software image file in the downloaded software package file is not applicable, the original system software image file is still used as the startup configuration file. To validate the downloaded software package file, reboot the device.
Examples # Download software package file main.bin from the TFTP server and use the Boot ROM image in the package as the startup configuration file. upgrade ipv6 2001::2 main.bin bootrom # Download software package file main.bin from the TFTP server and use the system software image file in the package as the startup configuration file. upgrade ipv6 2001::2 main.
Deleting the old file, please wait... File will be transferred in binary mode Downloading file from remote TFTP server, please wait.../ TFTP: 10262144 bytes received in 61 second(s) File downloaded successfully. BootRom file updating finished! # Reboot the switch. reboot After getting the new image file, reboot the switch to validate the upgraded image.
Configuration wizard The configuration wizard guides you through configuring the basic service parameters, including the system name, system location, contact information, and management IP address. Basic service setup Entering the configuration wizard homepage Select Wizard from the navigation tree. Figure 21 Configuration wizard homepage Configuring system parameters 1. On the wizard homepage, click Next.
Figure 22 System parameter configuration page 2. Configure the parameters as described in Table 3. Table 3 Configuration items Item Description Specify the system name. Sysname The system name appears at the top of the navigation tree. You can also set the system name in the System Name page you enter by selecting Device > Basic. For more information, see "Configuring basic device settings." Specify the physical location of the system.
Configuring management IP address CAUTION: Modifying the management IP address used for the current login terminates the connection to the device. Use the new management IP address to re-log in to the system. 1. On the system parameter configuration page, click Next. Figure 23 Management IP address configuration page 2. Configure the parameters as described in Table 4. Table 4 Configuration items Item Description Select a VLAN interface.
Item Description Enable or disable the VLAN interface. When errors occurred in the VLAN interface, disable the interface and then enable the port to bring the port to operate correctly. Admin status By default, the VLAN interface is down if no Ethernet ports in the VLAN is up. The VLAN is in the up state if one or more ports in the VLAN are up. IMPORTANT: Disabling or enabling the VLAN interface does not affect the status of the Ethernet ports in the VLAN.
Figure 24 Configuration complete 38
Configuring stack Overview The stack management feature allows you to configure and monitor a group of connected devices by logging in to one device in the stack, as shown in Figure 25. Figure 25 Stacking devices To set up a stack for a group of connected devices, you must log in to one device to create the stack. This device is the master device for the stack. You configure and monitor all member devices on the master device. The ports that connect the stack member devices are called stack ports.
Task Remarks Configuring member devices of a stack: Required. Configuring stack ports Configure a port of a member device that connects to the master device or another member device as a stack port. By default, a port is not a stack port. Displaying topology summary of a stack Optional. Display information about stack members. Optional. Display the control panels of stack members.
Figure 26 Setting up Table 6 Configuration items Item Description Configure a private IP address pool for the stack. Private Net IP Mask The master device of a stack must be configured with a private IP address pool to make sure it can automatically allocate an available IP address to a member device when the device joints the stack.
Displaying topology summary of a stack Select Stack from the navigation tree and click the Topology Summary tab to enter the page shown in Figure 27. Figure 27 Topology Summary tab Table 7 Field description Fields Description Member ID of the device in the stack: Device ID • Value 0 indicates that the device is the master device of the stack. • A value other than 0 indicates that the device is a member device and the value is the member ID of the member device in the stack.
Figure 29 Device summary (a member device) Stack configuration example Network requirements As shown in Figure 30, Switch A, Switch B, Switch C, and Switch D are connected to one another. Create a stack, where Switch A is the master device, and Switch B, Switch C, and Switch D are member devices. An administrator can log in to Switch B, Switch C, and Switch D through Switch A to perform remote configurations. Figure 30 Network diagram Configuration procedure 1.
Figure 31 Configuring global parameters for the stack on Switch A Switch A becomes the master device. 2. Configure a stack port on Switch A: a. In the Port Settings area on the Setup tab, select GigabitEthernet1/0/1. b. Click Enable. Figure 32 Configuring a stack port on Switch A 3. On Switch B, configure GigabitEthernet 1/0/2 (connected to Switch A), GigabitEthernet 1/0/1 (connected to Switch C), and GigabitEthernet 1/0/3 (connected to Switch D) as stack ports: a.
Figure 33 Configuring stack ports on Switch B Switch B becomes a member device. 4. On Switch C, configure GigabitEthernet 1/0/1 (the port connected to Switch B) as a stack port: a. Select Stack from the navigation tree of Switch C. b. In the Port Settings area on the Setup tab, select GigabitEthernet1/0/1. c. Click Enable. Figure 34 Configuring a stack port on Switch C Switch C becomes a member device. 5. On Switch D, configure GigabitEthernet 1/0/1 (the port connected to Switch B) as a stack port: a.
Verifying the configuration To verify the stack topology on Switch A: 1. Select Stack from the navigation tree of Switch A. 2. Click the Topology Summary tab. Figure 35 Verifying the configuration Configuration guidelines When you configure a stack, follow these guidelines: • If a device is already configured as the master device of a stack, you cannot modify the private IP address pool on the device.
Displaying system and device information Displaying system information Select Summary from the navigation tree to enter the System Information page to view the basic system information, system resource state, and recent system logs. Figure 36 System information Displaying basic system information Table 8 Field description Item Description Product Information Description for the device. Device Location Device location, which you can configure on the page you enter by selecting Device > SNMP > Setup.
Displaying the system resource state The System Resource State area displays the most recent CPU usage, memory usage, and temperature. Displaying recent system logs Table 9 Field description Field Description Time Time when the system logs were generated. Level Severity of the system logs. Description Description for the system logs. The System Information page displays up to five the most recent system logs. To display more system logs, click More to enter the Log List page.
Figure 37 Device information To set the interval for refreshing device information, select one of the following options from the Refresh Period list: • If you select a certain period, the system refreshes device information at the specified interval. • If you select Manual, the system refreshes device information only when you click the Refresh button.
Configuring basic device settings The device basic information feature provides the following functions: • Set the system name of the device. The configured system name is displayed on the top of the navigation bar. • Set the idle timeout period for logged-in users. The system logs an idle user off the Web for security purpose after the configured period. Configuring system name 1. Select Device > Basic from the navigation tree. The system name configuration page appears.
3. Set the idle timeout period for logged-in users. 4. Click Apply.
Maintaining devices Software upgrade CAUTION: Software upgrade takes some time. Avoid performing any operation on the Web interface during the upgrading procedure. Otherwise, the upgrade operation may be interrupted. A boot file, also known as the system software or device software, is an application file used to boot the device. Software upgrade allows you to obtain a target application file from the local host and set the file as the boot file to be used at the next reboot.
Item Description If a file with the same name already exists, overwrite it without any prompt Specify whether to overwrite the file with the same name. If you do not select the option, when a file with the same name exists, a dialog box appears, telling you that the file already exists and you cannot continue the upgrade. Reboot after the upgrade finished Specify whether to reboot the device to make the upgraded software take effect after the application file is uploaded.
Electronic label Electronic label allows you to view information about the device electronic label, which is also known as the permanent configuration data or archive information. The information is written into the storage medium of a device or a card during the debugging and testing processes, and includes card name, product bar code, MAC address, debugging and testing dates, and manufacture name. 1. Select Device > Device Maintenance from the navigation tree. 2.
Figure 44 The diagnostic information file is created The generation of the diagnostic file takes a period of time. During this process, do not perform any operation on the Web page. After the diagnostic file is generated successfully, you can view this file on the page you enter by selecting Device > File Management, or downloading this file to the local host. For more information, see "Managing files.
Configuring system time Overview You must configure a correct system time so that the device can operate correctly with other devices. The system time module allows you to display and set the device system time on the Web interface. You can set the system time through manual configuration or network time protocol (NTP) automatic synchronization. Defined in RFC 1305, the NTP synchronizes timekeeping among distributed time servers and clients.
Figure 46 Calendar page 3. Enter the system date and time in the Time field, or select the date and time in the calendar. To set the time on the calendar page, select one of the following methods: { { 4. Click Today. The date setting in the calendar is synchronized to the current local date configuration, and the time setting does not change. Select the year, month, date, and time, and then click OK. Click Apply on the system time configuration page to save your configuration.
Table 11 Configuration items Item Description Clock status Display the synchronization status of the system clock. Source Interface Set the source interface for an NTP message. This configuration makes the source IP address in the NTP messages the primary IP address of this interface. If the specified source interface is down, the source IP address is the primary IP address of the egress interface.
Figure 48 Network diagram Configuring the system time 1. Configure the local clock as the reference clock, with the stratum of 2. Enable NTP authentication, set the key ID to 24, and specify the created authentication key aNiceKey as a trusted key. (Details not shown.) 2. On Switch B, configure Device A as the NTP server: a. Select Device > System Time from the navigation tree. b. Click the Network Time Protocol tab. c. Enter 24 in the ID field, enter aNiceKey in the Key String field for key 1, enter 1.
• The synchronization process takes some time. The clock status might be displayed as unsynchronized after your configuration. In this case, refresh the page to view the clock status and system time later on. • If the system time of the NTP server is ahead of the system time of the device, and the time gap exceeds the Web idle time specified on the device, all online Web users are logged out because of timeout after the synchronization finishes.
Configuring syslog System logs record network and device information, including running status and configuration changes. With system logs, administrators can take corresponding actions against network problems and security problems. The system sends system logs to the following destinations: • Console • Monitor terminal, a terminal that has logged in to the device through the AUX or VTY user interface • Log buffer • Log host • Web interface • Log file Displaying syslogs 1.
Table 12 Field description Field Description Time/Date Displays the time/date when the system log was generated. Source Displays the module that generated the system log. Displays the severity level of the system log. The information is classified into eight levels by severity: Level • • • • • • • • Emergency—The system is unusable. Alert—Action must be taken immediately. Critical—Critical condition. Error—Error condition. Warning—Warning condition. Notification—Normal but significant condition.
4. Click Apply. Table 13 Configuration items Item Description IPv4/Domain Specify the IPv4 address or domain name of the log host. Loghost IP/Domain IPv6 Loghost IP Set the IPv6 address of the log host. IMPORTANT: You can specify up to four log hosts. Setting buffer capacity and refresh interval 1. Select Device > Syslog from the navigation tree. 2. Click the Log Setup tab. The syslog configuration page appears. Figure 52 Syslog configuration page 3.
Managing the configuration You can back up, restore, save, or reset the device configuration. Backing up the configuration Configuration backup allows you to do the following: • Open and view the configuration files for the next startup, including the .cfg file and .xml file. • Back up the configuration files for the next startup to your local host. IMPORTANT: HP recommends backing up both the .cfg and .xml files. If you back up only the .
To restore the configuration: 1. Select Device > Configuration from the navigation tree. 2. Click the Restore tab. Figure 54 Restoring the configuration 3. Click the upper Browse button. The file upload dialog box appears. 4. Select the .cfg file to be uploaded, and click OK. 5. Click the lower Browse button. The file upload dialog box appears. 6. Select the .xml file to be uploaded, and click OK. Saving the configuration You save the running configuration to both the .
Figure 55 Saving the configuration • Common mode. To save the configuration in common mode: a. Select Device > Configuration from the navigation tree. b. Click the Save tab. c. Click Save Current Settings. Resetting the configuration Resetting the configuration restores the device's factory defaults, deletes the current configuration files, and reboots the device. To reset the configuration: 1. Select Device > Configuration from the navigation tree. 2. Click the Initialize tab. 3.
Managing files The device requires a series of files for correct operation, including boot files and configuration files. These files are saved on the storage media. You can display files on the storage media, download, upload, or remove a file, or specify the main boot file. Displaying files 1. Select Device > File Management from the navigation tree. Figure 57 File management page 2. Select a medium from the Please select disk list.
4. Click Download File. The File Download dialog box appears. 5. Open the file or save the file to a path. Uploading a file IMPORTANT: Uploading a file takes some time. HP recommends not performing any operation on the Web interface during the upload. 1. Select Device > File Management from the navigation tree to enter the file management page (see Figure 57). 2. In the Upload File area, select the medium for saving the file from the Please select disk list. 3.
Managing ports You can use the port management feature to set and view the operation parameters of a Layer 2 Ethernet port and an aggregate interface. • For a Layer 2 Ethernet port, these operation parameters include its state, speed, duplex mode, link type, PVID, description, MDI mode, flow control settings, MAC learning limit, and storm suppression ratios. • For an aggregate interface, these operation parameters include its state, link type, PVID, description, and MAC learning limit.
Figure 58 The Setup tab 3. Set the operation parameters for the port as described in Table 15. 4. Click Apply. Table 15 Configuration items Item Description Enable or disable the port. Port State Sometimes, after you modify the operation parameters of a port, you must disable and then enable the port to have the modifications take effect.
Item Description Set the transmission speed of the port: Speed • • • • • • • • • • • 10—10 Mbps. 100—100 Mbps. 1000—1000 Mbps. Auto—Autonegotiation. Auto 10—Autonegotiated to 10 Mbps. Auto 100—Autonegotiated to 100 Mbps. Auto 1000—Autonegotiated to 1000 Mbps. Auto 10 100—Autonegotiated to 10 or 100 Mbps. Auto 10 1000—Autonegotiated to 10 or 1000 Mbps. Auto 100 1000—Autonegotiated to 100 or 1000 Mbps. Auto 10 100 1000—Autonegotiated to 10, 100, or 1000 Mbps.
Item Description Enable or disable flow control on the port. Flow Control With flow control enabled at both sides, when traffic congestion occurs on the ingress port, the ingress port sends a Pause frame notifying the egress port to temporarily suspend the sending of packets. The egress port is expected to stop sending any new packet when it receives the Pause frame. In this way, flow control helps to avoid dropping of packets.
Item Description Set unicast suppression on the port: • ratio—Sets the maximum percentage of unicast traffic to the total bandwidth of an Ethernet port. When you select this option, you must enter a percentage in the box below. Unicast Suppression • pps—Sets the maximum number of unicast packets that can be forwarded on an Ethernet port per second. When you select this option, you must enter a number in the box below.
Figure 59 The Summary tab Displaying all the operation parameters for a port 1. Select Device > Port Management from the navigation tree 2. Click the Detail tab. 3. Select a port whose operation parameters you want to view in the chassis front panel. The operation parameter settings of the selected port are displayed on the lower part of the page. Whether the parameter takes effect is displayed in the square brackets.
Port management configuration example Network requirements As shown in Figure 61: • Server A, Server B, and Server C are connected to GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 of the switch, respectively. The rates of the network adapters of these servers are all 1000 Mbps. • The switch connects to the external network through GigabitEthernet 1/0/4 whose speed is 1000 Mbps.
Figure 62 Configuring the speed of GigabitEthernet 1/0/4 2. Batch configure the autonegotiation speed range on GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 as 100 Mbps: a. On the Setup tab, select Auto 100 from the Speed list. b. Select 1, 2, and 3 on the chassis front panel. 1, 2, and 3 represent ports GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3. c. Click Apply.
Figure 63 Batch configuring the port speed 3. Display the speed settings of ports: a. Click the Summary tab. b. Click the Speed button to display the speed information of all ports on the lower part of the page, as shown in Figure 64.
Figure 64 Displaying the speed settings of ports 78
Configuring port mirroring Port mirroring refers to the process of copying the packets passing through a port/VLAN/CPU to the monitor port connecting to a monitoring device for packet analysis. Terminology Mirroring source The mirroring source can be one or more monitored ports, called source ports. The device where the ports reside is called a "source device." Packets (called "mirrored packets") passing through them are copied to a port connecting to a monitoring device for packet analysis.
Figure 65 Local port mirroring implementation As shown in Figure 65, the source port GigabitEthernet 1/0/1 and monitor port GigabitEthernet 1/0/2 reside on the same device. Packets of GigabitEthernet 1/0/1 are copied to GigabitEthernet 1/0/2, which then forwards the packets to the data monitoring device for analysis.
2. Click Add to enter the page for adding a mirroring group. Figure 66 Adding a mirroring group 3. Configure the mirroring group as described in Table 16. 4. Click Apply. Table 16 Configuration items Item Description Mirroring Group ID ID of the mirroring group to be added. Type Specify the type of the mirroring group to be added as Local, which indicates adding a local mirroring group. Configuring ports for the mirroring group 1. From the navigation tree, select Device > Port Mirroring. 2.
Figure 67 Modifying ports 3. Configure ports for the mirroring group as described in Table 17. 4. Click Apply. A progress dialog box appears. 5. After the success notification appears, click Close. Table 17 Configuration items Item Mirroring Group ID Description ID of the mirroring group to be configured. The available groups were added previously. Select a Local mirroring group ID to configure ports for the local mirroring group.
Local port mirroring configuration example Network requirements As shown in Figure 68, configure local port mirroring on Switch A so the server can monitor the packets received and sent by the Marketing department and Technical department. Figure 68 Network diagram Configuration procedure Adding a local mirroring group 1. From the navigation tree, select Device > Port Mirroring. 2. Click Add to enter the page for adding mirroring groups as shown in Figure 69.
3. Enter 1 for Mirroring Group ID, and select Local from the Type list. 4. Click Apply. Configuring GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 as the source ports 1. Click Modify Port. 2. Select 1 – Local from the Mirroring Group ID list. 3. Select Mirror Port from the Port Type list. 4. Select both from the Stream Orientation list. 5. Select 1 (GigabitEthernet 1/0/1) and 2 (GigabitEthernet 1/0/2) on the chassis front panel. Figure 70 Configuring the source ports 6. Click Apply.
Figure 71 Configuring the monitor port 5. Click Apply. A configuration progress dialog box appears. 6. After the success notification appears, click Close.
Managing users The user management function allows you to do the following: • Adding a local user, and specifying the password, access level, and service types for the user. • Setting the super password for non-management level users to switch to the management level. • Switching to the management level from a lower level. Adding a local user 1. Select Device > Users from the navigation tree. 2. Click the Create tab. Figure 72 Adding a local user 3.
Item Description Select an access level for the user. Users of different levels can perform different operations. User levels, in order from low to high, are as follows: • Visitor—A visitor level user can perform only ping and traceroute operations. They cannot access the data on the device or configure the device. Access Level • Monitor—A monitor level user can perform ping and traceroute operations and access the data on the device, but they cannot configure the device.
4. Click Apply. Table 19 Configuration items Item Description Select the operation type: Create/Remove • Create—Configure or change the super password. • Remove—Remove the current super password. Password Set the password for non-management level users to switch to the management level. Confirm Password Enter the same password again. Select the password encryption type: Password Encryption • Reversible—Uses a reversible encryption algorithm.
Configuring a loopback test You can check whether an Ethernet port operates correctly by performing Ethernet port loopback test. During the test time, the port cannot forward data packets correctly. Ethernet port loopback test has the following types: • Internal loopback test—Establishes self loop in the switching chip and checks whether there is a chip failure related to the functions of the port. • External loopback test—Uses a loopback plug on the port.
4. Click Test. After the test is complete, the system displays the loopback test result.
Configuring VCT Overview You can use the Virtual Cable Test (VCT) function to check the status of the cable connected to an Ethernet port on the device. The result is returned in less than 5 seconds. The test covers whether short circuit or open circuit occurs on the cable and the length of the faulty cable. The fiber port does not support this feature. Testing cable status 1. Select Device > VCT from the navigation tree to enter the page for testing cable status. 2.
Configuring the flow interval With the flow interval module, you can view the number of packets and bytes sent and received by a port, and the bandwidth use of the port over the specified interval. Viewing port traffic statistics 1. Select Device > Flow interval from the navigation tree. By default, the Port Traffic Statistics tab is displayed. 2. View the number of packets and bytes sent and received by each port, and the bandwidth use of each port over the last interval.
Configuring RMON Overview Remote Network Monitoring (RMON) is an enhancement to SNMP. It enables proactive remote monitoring and management of network devices and subnets. An RMON monitor periodically or continuously collects traffic statistics for the network attached to a port on the managed device. The managed device can automatically send a notification when a statistic crosses an alarm threshold, so the NMS does not need to constantly poll MIB variables and compare the results.
History group The history group defines that the system periodically collects traffic statistics on interfaces and saves the statistics in the history record table (ethernetHistoryTable). The statistics include bandwidth utilization, number of error packets, and total number of packets. The history statistics table record traffic statistics collected for each sampling interval. The sampling interval is user-configurable.
RMON configuration task list Configuring the RMON statistics function The RMON statistics function can be implemented by either the Ethernet statistics group or the history group, but the objects of the statistics are different, as follows: • A statistics object of the Ethernet statistics group is a variable defined in the Ethernet statistics table, and the recorded content is a cumulative sum of the variable from the time the statistics entry is created to the current time.
Table 22 RMON alarm configuration task list Task Remarks Required. You can create up to 100 statistics entries in a statistics table. Configuring a statistics entry As the alarm variables that can be configured through the Web interface are MIB variables that defined in the history group or the statistics group, configure the RMON Ethernet statistics function or the RMON history statistics function on the monitored Ethernet interface.
Task Remarks Displaying RMON event logs If you configure the system to log an event after the event is triggered when you configure the event group, the event is recorded in the RMON log. Perform this task to display the details of the log table. Configuring a statistics entry 1. Select Device > RMON from the navigation tree. The Statistics tab page appears. Figure 80 Statistics entry 2. Click Add. Figure 81 Adding a statistics entry 3. Configure a statistic entry as described in Table 24. 4.
Configuring a history entry 1. Select Device > RMON from the navigation tree. 2. Click the History tab. Figure 82 History entry 3. Click Add. Figure 83 Adding a history entry 4. Configure a history entry as described in Table 25. 5. Click Apply. Table 25 Configuration items Item Description Interface Name Select the name of the interface on which the history entry is created.
Configuring an event entry 1. Select Device > RMON from the navigation tree. 2. Click the Event tab. Figure 84 Event entry 3. Click Add. Figure 85 Adding an event entry 4. Configure an event entry as described in Table 26. 5. Click Apply. Table 26 Configuration items Item Description Description Set the description for the event. Owner Set the entry owner. Set the actions that the system takes when the event is triggered: Event Type • Log—The system logs the event.
Configuring an alarm entry 1. Select Device > RMON from the navigation tree. 2. Click the Alarm tab. Figure 86 Alarm entry 3. Click Add. Figure 87 Adding an alarm entry 4. Configure an alarm entry as described in Table 27. 5. Click Apply. Table 27 Configuration items Item Description Alarm variable: Static Item Set the traffic statistics that are collected and monitored. For more information, see Table 28.
Item Description Interval Set the sampling interval. Set the sampling type: • Absolute—Absolute sampling to obtain the value of the Sample Type variable when the sampling time is reached. • Delta—Delta sampling to obtain the variation value of the variable during the sampling interval when the sampling time is reached. Set the owner of the alarm entry. Owner: Alarm: Select whether to create a default event.
Figure 88 RMON statistics Table 28 Field description Field Description Number of Received Bytes Total number of octets received by the interface, corresponding to the MIB node etherStatsOctets. Number of Received Packets Total number of packets received by the interface, corresponding to the MIB node etherStatsPkts. Number of Received Broadcasting Packets Total number of broadcast packets received by the interface, corresponding to the MIB node etherStatsBroadcastPkts.
Field Description Number of Network Conflicts Total number of collisions received on the interface, corresponding to the MIB node etherStatsCollisions. Number of Packet Discarding Events Total number of drop events received on the interface, corresponding to the MIB node etherStatsDropEvents. Number of Received 64 Bytes Packets Total number of received packets with 64 octets on the interface, corresponding to the MIB node etherStatsPkts64Octets.
Table 29 Field description Field Description Number of the entry in the system buffer. NO Statistics are numbered chronologically when they are saved to the system buffer. Time Time at which the information is saved. DropEvents Dropped packets during the sampling period, corresponding to the MIB node etherHistoryDropEvents. Octets Number of octets received during the sampling period, corresponding to the MIB node etherHistoryOctets.
Figure 90 Log tab In this example, event 1 has generated one log, which is triggered because the alarm value (11779194) exceeds the rising threshold (10000000). The sampling type is absolute. RMON configuration example Network requirements As shown in Figure 91, create an entry in the RMON Ethernet statistics table to gather statistics on GigabitEthernet 1/0/1 with the sampling interval being 10 seconds.
Figure 92 Adding a statistics entry 2. Display RMON statistics for GigabitEthernet 1/0/1: a. Click the icon corresponding to GigabitEthernet 1/0/1. b. Display this information as shown in Figure 93. Figure 93 Displaying RMON statistics 3. Create an event to start logging after the event is triggered: a. Click the Event tab. b. Click Add. The page in Figure 94 appears. c. Type user1-rmon in the Owner field, select the box before Log, and click Apply. d.
Figure 94 Configuring an event group Figure 95 Displaying the index of an event entry 4. Configure an alarm group to sample received bytes on GigabitEthernet 1/0/1. When the received bytes exceed the rising or falling threshold, logging is enabled: a. Click the Alarm tab. b. Click Add. The page in Figure 96 appears. c.
Figure 96 Configuring an alarm group Verifying the configuration After the above configuration, when the alarm event is triggered, you can display log information for event 1 on the Web interface. 1. Select Device > RMON from the navigation tree. 2. Click the Log tab. The log page appears. The log in this example indicates that event 1 generated one log, which was triggered because the alarm value (22050) exceeded the rising threshold (1000). The sampling type is absolute.
Configuring energy saving Energy saving enables a port to operate at the lowest transmission speed, disable PoE, or go down during a specific time range on certain days of a week. The port resumes when the effective time period ends. Configuring energy saving on a port 1. Select Device > Energy Saving from the navigation tree to enter the energy saving configuration page. 2. Click a port. Figure 98 Energy saving configuration page 3.
Item Description Set the port to transmit data at the lowest speed. Lowest Speed If you configure the lowest speed limit on a port that does not support 10 Mbps, the configuration cannot take effect. Shut down the port. Shutdown An energy saving policy can have all the three energy saving schemes configured, of which the shutdown scheme takes the highest priority.
Configuring SNMP This chapter provides an overview of the Simple Network Management Protocol (SNMP) and guides you through the configuration procedure. Overview SNMP is an Internet standard protocol widely used for a management station to access and operate the devices on a network, regardless of their vendors, physical characteristics and interconnect technologies.
• Set—The NMS modifies the value of an object node in an agent MIB. • Notifications—Includes traps and informs. SNMP agent sends traps or informs to report events to the NMS. The difference between these two types of notification is that informs require acknowledgement but traps do not. The device supports only traps. SNMP protocol versions HP supports SNMPv1, SNMPv2c, and SNMPv3. An NMS and an SNMP agent must use the same SNMP version to communicate with each other.
Table 32 SNMPv3 configuration task list Task Remarks Required. The SNMP agent function is disabled by default. 1. Enabling SNMP agent IMPORTANT: If SNMP agent is disabled, all SNMP agent-related configurations are removed. Optional. 2. Configuring an SNMP view After creating SNMP views, you can specify an SNMP view for an SNMP group to limit the MIB objects that can be accessed by the SNMP group. Required. 3.
Figure 101 Setup tab 2. Configure SNMP settings on the upper part of the page as described in Table 33. 3. Click Apply. Table 33 Configuration items Item Description SNMP Specify to enable or disable SNMP agent. Configure the local engine ID. Local Engine ID Maximum Packet Size Contact The validity of a user after it is created depends on the engine ID of the SNMP agent. If the engine ID when the user is created is not identical to the current engine ID, the user is invalid.
Item Description Location Set a character string to describe the physical location of the device. SNMP Version Set the SNMP version run by the system. Configuring an SNMP view Creating an SNMP view 1. Select Device > SNMP from the navigation tree. 2. Click the View tab. The View tab appears. Figure 102 View tab 3. Click Add. The Add View window appears. Figure 103 Creating an SNMP view (1) 4. Type the view name. 5. Click Apply. The page in Figure 104 appears. 6.
8. Repeat steps 6 and 7 to add more rules for the SNMP view. 9. Click Apply. To cancel the view, click Cancel. Figure 104 Creating an SNMP view (2) Table 34 Configuration items Item Description View Name Set the SNMP view name. Rule Select to exclude or include the objects in the view range determined by the MIB subtree OID and subtree mask. Set the MIB subtree OID (such as 1.4.5.3.1) or name (such as system).
Figure 105 Adding rules to an SNMP view 4. Configure the parameters as described in Table 34. 5. Click Apply. NOTE: You can also click the icon corresponding to the specified view on the page as shown in Figure 102, and then you can enter the page to modify the view. Configuring an SNMP community 1. Select Device > SNMP from the navigation tree. 2. Click the Community tab. The Community tab appears. Figure 106 Configuring an SNMP community 3. Click Add. The Add SNMP Community page appears.
Figure 107 Creating an SNMP Community 4. Configure the SNMP community as described in Table 35. 5. Click Apply. Table 35 Configuration items Item Description Community Name Set the SNMP community name. Configure SNMP NMS access right: • Read only—The NMS can perform read-only operations to the MIB objects Access Right when it uses this community name to access the agent.
3. Click Add. The Add SNMP Group page appears. Figure 109 Creating an SNMP group 4. Configure SNMP group as described in Table 36. 5. Click Apply. Table 36 Configuration items Item Description Group Name Set the SNMP group name. Select the security level for the SNMP group: Security Level • NoAuth/NoPriv—No authentication no privacy. • Auth/NoPriv—Authentication without privacy. • Auth/Priv—Authentication and privacy. IMPORTANT: For an existing SNMP group, its security level cannot be modified.
Configuring an SNMP user 1. Select Device > SNMP from the navigation tree. 2. Click the User tab. The User tab appears. Figure 110 SNMP user 3. Click Add. The Add SNMP User page appears. Figure 111 Creating an SNMP user 4. Configure the SNMP user as described in Table 37. 5. Click Apply.
Table 37 Configuration items Item Description User Name Set the SNMP user name. Select the security level for the SNMP group. The available security levels are: Security Level • NoAuth/NoPriv—No authentication no privacy. • Auth/NoPriv—Authentication without privacy. • Auth/Priv—Authentication and privacy. Select an SNMP group to which the user belongs: • When the security level is NoAuth/NoPriv, you can select an SNMP group with no authentication no privacy.
Figure 112 Traps configuration 3. Select Enable SNMP Trap. 4. Click Apply to enable the SNMP trap function. 5. Click Add. The page for adding a target host of SNMP traps appears. Figure 113 Adding a target host of SNMP traps 6. Configure the settings for the target host as described in Table 38. 7. Click Apply. Table 38 Configuration items Item Description Set the destination IP address.
Item Description Security Name Set the security name, which can be an SNMPv1 community name, an SNMPv2c community name, or an SNMPv3 user name. Set UDP port number. IMPORTANT: UDP Port Security Model Security Level The default port number is 162, which is the SNMP-specified port used for receiving traps on the NMS. Generally (such as using IMC or MIB Browser as the NMS), you can use the default port number.
SNMPv1/v2c configuration example Network requirements As shown in Figure 115, the NMS at 1.1.1.2/24 uses SNMPv1 or SNMPv2c to manage the switch (agent) at 1.1.1.1/24, and the switch automatically sends traps to report events to the NMS. Figure 115 Network diagram Configuring the agent 1. Enable SNMP: a. Select Device > SNMP from the navigation tree. The SNMP configuration page appears. b. Select the Enable option, and select the v1 and v2c options. c. Click Apply. Figure 116 Configuring the SNMP agent 2.
Figure 117 Configuring an SNMP read-only community 3. Configure a read and write community: a. Click Add on the Community tab page. The Add SNMP Community page appears. b. Enter private in the Community Name field, and select Read and write from the Access Right list. c. Click Apply. Figure 118 Configuring an SNMP read and write community 4. Enable SNMP traps: a. Click the Trap tab. The Trap tab page appears. b. Select Enable SNMP Trap. c. Click Apply.
Figure 119 Enabling SNMP traps 5. Configure a target host SNMP traps: a. Click Add on the Trap tab page. The page for adding a target host of SNMP traps appears. b. Select the IPv4/Domain option and type 1.1.1.2 in the following field, type public in the Security Name field, and select v1 from the Security Model list. c. Click Apply. Figure 120 Adding a trap target host Configuring the NMS The configuration on the NMS must be consistent with that on the agent.
For information about how to configure the NMS, see the NMS manual. Verifying the configuration After the above configuration, an SNMP connection is established between the NMS and the agent. The NMS can get and configure the values of some parameters on the agent through MIB nodes. Disable or enable an idle interface on the agent, and you can see the interface state change traps on the NMS. SNMPv3 configuration example Network requirements As shown in Figure 121, the NMS (1.1.1.
2. Configure an SNMP view: a. Click the View tab. b. Click Add. The page for creating an SNMP view appears. c. Type view1 in the View Name field. d. Click Apply. Figure 123 Creating an SNMP view (1) e. On the page that appears, select the Included option, type the MIB subtree OID interfaces, and click Add. f. Click Apply. A configuration progress dialog box appears. g. Click Close after the configuration process is complete. Figure 124 Creating an SNMP view (2) 3. Configure an SNMP group: a.
Figure 125 Creating an SNMP group 4. Configure an SNMP user: a. Click the User tab. b. Click Add. The page in Figure 126 appears. c. Type user1 in the User Name field, select Auth/Priv from the Security Level list, select group1 from the Group Name list, select MD5 from the Authentication Mode list, type authkey in the Authentication Password and Confirm Authentication Password fields, select DES56 from the Privacy Mode list, and type prikey in the Privacy Password and Confirm Privacy Password fields. d.
Figure 126 Creating an SNMP user 5. Enable SNMP traps: a. Click the Trap tab. The Trap tab page appears. b. Select Enable SNMP Trap. c. Click Apply. Figure 127 Enabling SNMP traps 6. Configure a target host SNMP traps: a. Click Add on the Trap tab page. The page for adding a target host of SNMP traps appears.
b. Select the IPv4/Domain option and type 1.1.1.2 in the following field, type user1 in the Security Name field, select v3 from the Security Model list, and select Auth/Priv from the Security Level list. c. Click Apply. Figure 128 Adding a trap target host Configuring the NMS The configuration on NMS must be consistent with that on the agent. Otherwise, you cannot perform corresponding operations. To configure the NMS: 1. Specify the SNMP version for the NMS as v3. 2. Create an SNMP user user1. 3.
Displaying interface statistics The interface statistics module displays statistics about the packets received and sent through interfaces. To display interface statistics, select Device > Interface Statistics from the navigation tree. Figure 129 Interface statistics display page Table 39 describes the fields on the page. Table 39 Field description Field Description InOctets Total octets of all packets received on the interface. InUcastPkts Number of received unicast packets.
Configuring VLANs Overview Ethernet is a network technology based on the CSMA/CD mechanism. As the medium is shared, collisions and excessive broadcasts are common on an Ethernet. To address the issue, virtual LAN (VLAN) was introduced to break a LAN down into separate VLANs. VLANs are isolated from each other at Layer 2. A VLAN is a bridging domain, and all broadcast traffic is contained within it, as shown in Figure 130.
Figure 131 Traditional Ethernet frame format IEEE 802.1Q inserts a four-byte VLAN tag after the DA&SA field, as shown in Figure 132. Figure 132 Position and format of VLAN tag A VLAN tag comprises the following fields: • Tag protocol identifier (TPID)—The 16-bit TPID field indicates whether the frame is VLAN-tagged and is 0x8100 by default. • Priority—The 3-bit priority field indicates the 802.1p priority of the frame.
Port-based VLAN Port-based VLANs group VLAN members by port. A port forwards traffic for a VLAN only after it is assigned to the VLAN. Port link type You can configure the link type of a port as access, trunk, or hybrid. The link types use the following VLAN tag handling methods: • Access port—An access port belongs to only one VLAN and sends traffic untagged.
PVID By default, VLAN 1 is the PVID for all ports. You can change the PVID for a port, as required. Use the following guidelines when you configure the PVID on a port: • An access port can join only one VLAN. The VLAN to which the access port belongs is the PVID of the port. • A trunk or hybrid port can join multiple VLANs, and you can configure a PVID for the port. • You can use a nonexistent VLAN as the PVID for a hybrid or trunk port, but not for an access port.
Recommended VLAN configuration procedures Recommended configuration procedure for assigning an access port to a VLAN Step 1. Remarks Required. Creating VLANs. Create one or multiple VLANs. Optional. 2. Configuring the link type of a port. Configure the link type of the port as access. By default, the link type of a port is access. 3. Setting the PVID for a port. 4. Configuring the access ports as untagged members of a VLAN: Configure the PVID of the access port. Required. a.
Step Remarks 3. Setting the PVID for a port. 4. Configure the trunk port as an untagged member of the specified VLANs: Configure the PVID of the trunk port. a. Selecting VLANs Specify the range of VLANs available for selection during related operations. Configure a subset of all existing VLANs. This step is required before you perform operations on the Detail, Modify VLAN, and Modify Port tabs. A trunk port has only one untagged VLAN and the untagged VLAN is its PVID.
Step Remarks Optional. 3. Setting the PVID for a port. Configure the PVID of the hybrid port. By default, the PVID of a hybrid port is VLAN 1. 4. Configure the hybrid port as an untagged member of the specified VLANs: a. Selecting VLANs Specify the range of VLANs available for selection during related operations. Configure a subset of all existing VLANs. This step is required before you perform operations on the Detail, Modify VLAN, and Modify Port tabs. Required. N/A b.
Figure 134 Creating VLANs Table 40 Configuration items Item Description VLAN IDs IDs of the VLANs to be created. • ID—Select the ID of the VLAN whose description string is to be modified. Modify the description of the selected VLAN Click the ID of the VLAN to be modified in the list in the middle of the page. • Description—Set the description string of the selected VLAN. By default, the description string of a VLAN is its VLAN ID, such as VLAN 0001.
Figure 135 Modifying ports Setting the PVID for a port You can also configure the PVID of a port on the Setup tab of Device > Port Management. For more information, see "Managing ports." To set the PVID for a port: 1. From the navigation tree, select Network > VLAN. 2. Click Modify Port. 3. Select the port that you want to configure on the chassis front panel. 4. Select the PVID option. The option allows you to modify the PVID of the port. 5. Set a PVID for the port.
Figure 136 Modifying the PVID for a port Selecting VLANs 1. From the navigation tree, select Network > VLAN. The Select VLAN tab is displayed by default for you to select VLANs. Figure 137 Selecting VLANs 2. Select the Display all VLANs option to display all VLANs, or select the Display a subnet of all configured VLANs option to enter the VLAN IDs to be displayed. 3. Click Select.
Modifying a VLAN 1. From the navigation tree, select Network > VLAN. 2. Click Modify VLAN to enter the page for modifying a VLAN. Figure 138 Modifying a VLAN 3. Modify the member ports of a VLAN as described in Table 41. 4. Click Apply. A progress dialog box appears. 5. Click Close on the progress dialog box when the dialog box prompts that the configuration succeeds. Table 41 Configuration items Item Please select a VLAN to modify Modify Description Description Select the VLAN to be modified.
Item Description Select ports to be modified and assigned to this VLAN Select the ports to be modified in the selected VLAN. When you configure an access port as a tagged member of a VLAN, the link type of the port is automatically changed into hybrid. Modifying ports 1. From the navigation tree, select Network > VLAN. 2. Click Modify Port to enter the page for modifying ports. Figure 139 Modifying ports 3. Modify the VLANs of a port as described in Table 42. 4. Click Apply.
Item Description Set the member types of the selected ports to be modified in the specified VLANs: Select membership type • Untagged—Configures the ports to send the traffic of the VLANs after removing the VLAN tags. • Tagged—Configures the ports to send the traffic of the VLANs without removing the VLAN tags. • Not a Member—Removes the ports from the VLANs. Set the IDs of the VLANs to or from which the selected ports are to be assigned or removed.
Figure 141 Configuring GigabitEthernet 1/0/1 as a trunk port and its PVID as 100 2. Create VLAN 2, VLAN 6 through VLAN 50, and VLAN 100: a. From the navigation tree, select Network > VLAN. b. Click Create to enter the page for creating VLANs. c. Enter VLAN IDs 2, 6-50, 100. d. Click Apply.
Figure 142 Creating VLAN 2, VLAN 6 through VLAN 50, and VLAN 100 3. Assign GigabitEthernet 1/0/1 to VLAN 100 as an untagged member: a. Click Select VLAN to enter the page for selecting VLANs. b. Select the option before Display a subnet of all configured VLANs, and enter 1-100 in the field. c. Click Select. Figure 143 Setting a VLAN range d. Click Modify VLAN to enter the page for modifying the ports in a VLAN. e.
A configuration progress dialog box appears. g. After the configuration process is complete, click Close. Figure 144 Assigning GigabitEthernet 1/0/1 to VLAN 100 as an untagged member 4. Assign GigabitEthernet 1/0/1 to VLAN 2, and VLAN 6 through VLAN 50 as a tagged member: a. Click Modify Port to enter the page for modifying the VLANs to which a port belongs. b. Select GigabitEthernet 1/0/1 on the chassis front device panel, select the Tagged option, and enter VLAN IDs 2, 6-50. c. Click Apply.
Figure 145 Assigning GigabitEthernet 1/0/1 to VLAN 2 and to VLANs 6 through 50 as a tagged member Configuring Switch B Configure Switch B in the same way Switch A is configured. (Details not shown.) Configuration guidelines When you configure VLANs, follow these guidelines: • As the default VLAN, VLAN 1 can be neither created nor removed manually. • You cannot manually create or remove VLANs reserved for special purposes. • Dynamic VLANs cannot be removed on the page for removing VLANs.
Configuring VLAN interfaces Before creating a VLAN interface, you must create the corresponding VLAN in Network > VLAN. For more information, see "Configuring VLANs." Overview For hosts of different VLANs to communicate, you must use a router or Layer 3 switch to perform layer 3 forwarding. To achieve this, you can use VLAN interfaces. VLAN interfaces are virtual interfaces used for Layer 3 communication between different VLANs. They do not exist as physical entities on devices.
Figure 146 Creating a VLAN interface 3. Configure the VLAN interface as described in Table 43. 4. Click Apply. Table 43 Configuration items Item Description Input a VLAN ID: Enter the ID of the VLAN interface to be created. Before creating a VLAN interface, make sure the corresponding VLAN exists. Configure Primary IPv4 Address DHCP Configure the way in which the VLAN interface gets an IPv4 address.
Item Description Auto Configure the way in which the VLAN interface gets an IPv6 link-local address. Select the Auto or Manual option: Configure IPv6 Link Local Address Manual • Auto—The device automatically assigns a link-local address to the VLAN interface based on the link-local address prefix (FE80::/64) and the link-layer address of the VLAN interface. • Manual—Requires manual assignment. IPv6 Address Configure an IPv6 link-local address for the VLAN interface.
Figure 147 Modifying a VLAN interface 3. Modify a VLAN interface as described in Table 44. 4. Click Apply. Table 44 Configuration items Item Description Select the VLAN interface to be configured. Select VLAN Interface The VLAN interfaces available for selection in the list are those created on the page for creating VLAN interfaces.
Item Description DHCP Configure the way in which the VLAN interface gets an IPv4 address. BOOTP Allow the VLAN interface to get an IP address automatically by selecting the DHCP or BOOTP option, or manually assign the VLAN interface an IP address by selecting the Manual option. In the latter case, you must set the mask length or enter a mask in dotted decimal notation format. Manual Select Up or Down from the Admin Status list to bring up or shut down the selected VLAN interface.
Configuration guidelines When you configure VLAN interfaces, follow these guidelines: • A link-local address is automatically generated for an IPv6 VLAN interface after an IPv6 site-local address or global unicast address is configured for the VLAN interface. This generated link-local address is the same as the one generated in the Auto mode. If a manually assigned link-local address is available, the manually assigned one takes effect.
Configuring a voice VLAN Overview The voice technology is developing quickly, and more and more voice devices are in use. In broadband communities, data traffic and voice traffic are usually transmitted in the network at the same time. Usually, voice traffic needs higher priority than data traffic to reduce the transmission delay and packet loss ratio. A voice VLAN is configured for voice traffic.
automatically assigns the receiving port to a voice VLAN, issues ACL rules and configures the packet precedence. You can configure an aging timer for the voice VLAN. The system will remove the port from the voice VLAN when the aging timer expires if no voice packet is received on the port during the aging timer. The system automatically assigns ports to, or removes ports from, a voice VLAN.
Table 46 Required configurations on ports of different link types for them to support tagged voice traffic Port link type Voice VLAN assignment mode supported for tagged voice traffic Configuration requirements Access Manual Configure the PVID of the port as the voice VLAN. Trunk Hybrid • In automatic mode, the PVID of the port cannot be the voice VLAN. Automatic and manual In manual mode, configure the port to permit packets of the voice VLAN to pass through.
the PVID of the port is the voice VLAN and the port operates in manual VLAN assignment mode, the port forwards all received untagged packets in the voice VLAN. In normal mode, the voice VLANs are vulnerable to traffic attacks. Vicious users can forge a large amount of untagged packets and send them to voice VLAN-enabled ports to consume the voice VLAN bandwidth, affecting normal voice communication.
Recommended configuration procedure for a port in automatic voice VLAN assignment mode Step Remarks (Optional.) Configuring voice VLAN globally 1. Configure the voice VLAN to operate in security mode and configure the aging timer (Required.) Configuring voice VLAN on ports 2. Configure the voice VLAN assignment mode of a port as automatic and enable the voice VLAN function on the port. By default, the voice VLAN assignment mode of a port is automatic, and the voice VLAN function is disabled on a port.
3. Configure the global voice VLAN settings as described in Table 49. 4. Click Apply. Table 49 Configuration items Item Description Voice VLAN security Select Enable or Disable in the list to enable or disable the voice VLAN security mode. By default, the voice VLANs operate in security mode. Set the voice VLAN aging timer. Voice VLAN aging time The voice VLAN aging timer setting only applies to a port in automatic voice VLAN assignment mode.
Item Description Voice VLAN port state Select Enable or Disable in the list to enable or disable the voice VLAN function on the port. Voice VLAN ID Set the voice VLAN ID of a port when the voice VLAN port state is set to Enable. Select the port on the chassis front panel. You can select multiple ports to configure them in bulk. The numbers of the selected ports will be displayed in the Ports selected for voice VLAN field.
Voice VLAN configuration examples Configuring voice VLAN on a port in automatic voice VLAN assignment mode Network requirements As shown in Figure 153: • Configure VLAN 2 as the voice VLAN allowing only voice traffic to pass through. • The IP phone connected to hybrid port GigabitEthernet 1/0/1 sends untagged voice traffic. • GigabitEthernet 1/0/1 operates in automatic VLAN assignment mode. Set the voice VLAN aging timer to 30 minutes.
Figure 154 Creating VLAN 2 2. Configure GigabitEthernet 1/0/1 as a hybrid port: a. Select Device > Port Management from the navigation tree. b. Click the Setup tab. c. Select Hybrid from the Link Type list. d. Select GigabitEthernet 1/0/1 from the chassis front panel. e. Click Apply.
Figure 155 Configuring GigabitEthernet 1/0/1 as a hybrid port 3. Configure the voice VLAN function globally: a. Select Network > Voice VLAN from the navigation tree. b. Click the Setup tab. c. Select Enable in the Voice VLAN security list. d. Set the voice VLAN aging timer to 30 minutes. e. Click Apply. Figure 156 Configuring the voice VLAN function globally 4.
a. Click the Port Setup tab. b. Select Auto in the Voice VLAN port mode list. c. Select Enable in the Voice VLAN port state list. d. Enter voice VLAN ID 2. e. Select GigabitEthernet 1/0/1 on the chassis front panel. f. Click Apply. Figure 157 Configuring voice VLAN on GigabitEthernet 1/0/1 5. Add OUI addresses to the OUI list: a. Click the OUI Add tab. b. Enter OUI address 0011-2200-0000. c. Select FFFF-FF00-0000 in the Mask list. d. Enter description string test. e. Click Apply.
Verifying the configuration 1. When the preceding configurations are completed, the OUI Summary tab is displayed by default, as shown in Figure 159. You can view the information about the newly-added OUI address. Figure 159 Displaying the current OUI list of the device 2. Click the Summary tab, where you can view the current voice VLAN information.
0011-2200-0000 and mask ffff-ff00-0000 to pass through. The description of the OUI address entry is test. Figure 161 Network diagram Configuring Switch A 1. Create VLAN 2: a. Select Network > VLAN from the navigation tree. b. Click the Create tab. c. Enter VLAN ID 2. d. Click Create. Figure 162 Creating VLAN 2 2. Configure GigabitEthernet 1/0/1 as a hybrid port and configure its PVID as VLAN 2: a. Select Device > Port Management from the navigation tree. b. Click the Setup tab. c.
d. Select the PVID box and enter 2 in the field. e. Select GigabitEthernet 1/0/1 from the chassis front panel. f. Click Apply. Figure 163 Configuring GigabitEthernet 1/0/1 as a hybrid port 3. Assign GigabitEthernet 1/0/1 to VLAN 2 as an untagged member: a. Select Network > VLAN from the navigation tree. b. Click the Modify Port tab. c. Select GigabitEthernet 1/0/1 from the chassis front panel. d. Select the Untagged option. e. Enter VLAN ID 2. f. Click Apply. A configuration progress dialog box appears.
Figure 164 Assigning GigabitEthernet 1/0/1 to VLAN 2 as an untagged member 4. Configure voice VLAN on GigabitEthernet 1/0/1: a. Select Network > Voice VLAN from the navigation tree. b. Click the Port Setup tab. c. Select Manual in the Voice VLAN port mode list. d. Select Enable in the Voice VLAN port state list. e. Enter 2 in the VLAN IDs field. f. Select GigabitEthernet 1/0/1 on the chassis front panel. g. Click Apply.
Figure 165 Configuring voice VLAN on GigabitEthernet 1/0/1 5. Add OUI addresses to the OUI list: a. Click the OUI Add tab. b. Enter OUI address 0011-2200-0000. c. Select FFFF-FF00-0000 as the mask. d. Enter description string test. e. Click Apply. Figure 166 Adding OUI addresses to the OUI list Verifying the configuration 1. When the preceding configurations are complete, the OUI Summary tab is displayed by default, as shown in Figure 167. You can view the information about the newly-added OUI address.
Figure 167 Displaying the current OUI list of the device 2. Click the Summary tab, where you can view the current voice VLAN information. Figure 168 Displaying the current voice VLAN information Configuration guidelines When you configure the voice VLAN function, follow these guidelines: • To remove a VLAN functioning as a voice VLAN, disable its voice VLAN function first. • Only one VLAN is supported and only an existing static VLAN can be configured as the voice VLAN.
Configuring the MAC address table MAC address configurations related to interfaces apply to Layer 2 Ethernet interfaces and Layer 2 aggregate interfaces only. This document covers only the configuration of unicast MAC address entries, including static, dynamic, and blackhole entries. Overview To reduce single-destination packet flooding in a switched LAN, an Ethernet device uses a MAC address table to forward frames. This table describes from which port a MAC address (or host) can be reached.
Types of MAC address entries A MAC address table can contain the following types of entries: • Static entries—Manually added and never age out. • Dynamic entries—Manually added or dynamically learned, and might age out. • Blackhole entries—Manually configured and never age out. They are configured for filtering out frames with specific source or destination MAC addresses.
Item Description Set the type of the MAC address entry: • Static—Static MAC address entries that never age out. • Dynamic—Dynamic MAC address entries that will age out. • Blackhole—Blackhole MAC address entries that never age out. Type The MAC tab (see Figure 169) displays the following types of MAC address entries: • • • • Config static—Static MAC address entries manually configured by the users. Blackhole—Blackhole MAC address entries. Learned—Dynamic MAC address entries learned by the device.
Creating a static MAC address entry 1. Select Network > MAC from the navigation tree. By default, the MAC tab is displayed. 2. Click Add. 3. Configure a MAC address entry: a. Type MAC address 00e0-fc35-dc71. b. Select static from the Type list. c. Select 1 from the VLAN list. d. Select GigabitEthernet1/0/1 from the Port list. 4. Click Apply.
Configuring MSTP Overview Spanning tree protocols eliminate loops in a physical link-redundant network by selectively blocking redundant links and putting them in a standby state. The recent versions of STP include the Rapid Spanning Tree Protocol (RSTP) and the Multiple Spanning Tree Protocol (MSTP). Introduction to STP STP was developed based on the 802.1d standard of IEEE to eliminate loops at the data link layer in a LAN.
Forward delay—Delay that STP bridges use to transit port state. • The descriptions and examples in this chapter only use the following fields in the configuration BPDUs: • Root bridge ID (represented by device priority) • Root path cost • Designated bridge ID (represented by device priority) • Designated port ID (represented by port name) Basic concepts in STP Root bridge A tree network must have a root bridge.
Figure 173 Designated bridges and designated ports Path cost Path cost is a reference value used for link selection in STP. STP calculates path costs to select the most robust links and block redundant links that are less robust, to prune the network into a loop-free tree. All the ports on the root bridge are designated ports. Calculation process of the STP algorithm The spanning tree calculation process described in the following sections is a simplified process for example only.
Step Description Based on the configuration BPDU and the path cost of the root port, the device calculates a designated port configuration BPDU for each of the other ports. 2 • The root bridge ID is replaced with that of the configuration BPDU of the root port. • The root path cost is replaced with that of the configuration BPDU of the root port plus the path cost of the root port. • The designated bridge ID is replaced with the ID of this device.
Figure 174 STP network As shown in Figure 174, the priority values of Device A, Device B, and Device C are 0, 1, and 2, and the path costs of links among the three devices are 5, 10, and 4, respectively. 1. Device state initialization. In Table 55, each configuration BPDU contains the following fields: root bridge ID, root path cost, designated bridge ID, and designated port ID. Table 55 Initial state of each device Device Device A Device B Device C 2.
Table 56 Comparison process and result on each device Device Configuration BPDU on ports after comparison Comparison process • Port AP1 receives the configuration BPDU of Device B {1, 0, 1, BP1}. Device A finds that the configuration BPDU of the local port {0, 0, 0, AP1} is superior to the received configuration BPDU, and it discards the received configuration BPDU. • Port AP2 receives the configuration BPDU of Device C {2, 0, Device A 2, CP1}.
Device Configuration BPDU on ports after comparison Comparison process After comparison: • The configuration BPDU of CP1 is elected as the optimum configuration BPDU, so CP1 is identified as the root port, the configuration BPDUs of which will not be changed.
The configuration BPDU forwarding mechanism of STP The configuration BPDUs of STP are forwarded according to these guidelines: • Upon network initiation, every device regards itself as the root bridge, generates configuration BPDUs with itself as the root, and sends the configuration BPDUs at a regular hello interval.
Introduction to MSTP MSTP overcomes the following STP and RSTP limitations: • STP limitations—STP does not support rapid state transition of ports. A newly elected port must wait twice the forward delay time before it transits to the forwarding state, even if it connects to a point-to-point link or is an edge port. • RSTP limitations—Although RSTP enables faster network convergence than STP, RSTP fails to provide load balancing among VLANs.
Figure 176 Basic concepts in MSTP MST region A multiple spanning tree region (MST region) consists of multiple devices in a switched network and the network segments among them. All these devices have the following characteristics: • A spanning tree protocol enabled. • Same region name. • Same VLAN-to-instance mapping configuration. • Same MSTP revision level. • Physically linked with one another. Multiple MST regions can exist in a switched network.
VLAN-to-instance mapping table As an attribute of an MST region, the VLAN-to-instance mapping table describes the mapping relationships between VLANs and MSTIs. In Figure 176, the VLAN-to-instance mapping table of region A0 is: VLAN 1 is mapped to MSTI 1, VLAN 2 to MSTI 2, and the rest to CIST. MSTP achieves load balancing by means of the VLAN-to-instance mapping table. CST The common spanning tree (CST) is a single spanning tree that connects all MST regions in a switched network.
Figure 177 Port roles MSTP calculation involves the following port roles: • Root port—Forwards data for a non-root bridge to the root bridge. The root bridge does not have any root port. • Designated port—Forwards data to the downstream network segment or device. • Master port—Serves as a port on the shortest path from the local MST region to the common root bridge. The master port is not always located on the regional root.
port state is available for the corresponding port role, and a dash [—] indicates that the port state is not available for the corresponding port role.
• Loop guard • TC-BPDU (a message that notifies the device of topology changes) guard • Support for the hot swapping of interface boards and switchover of the active and standby main boards. Protocols and standards MSTP is documented in the following protocols and standards: • IEEE 802.1d, Spanning Tree Protocol • IEEE 802.1w, Rapid Spanning Tree Protocol • IEEE 802.
Step 4. Remarks Displaying MSTP information of a port. Optional. Display MSTP information of a port in MSTI 0, the MSTI to which the port belongs, and the path cost and priority of the port. Configuring an MST region 1. From the navigation tree, select Network > MSTP. By default, the Region tab is displayed. Figure 178 MST region 2. Click Modify. Figure 179 Configuring an MST region 3. Configure the MST region information as described in Table 58, and click Apply.
Table 58 Configuration items Item Region Name 4. Description MST region name. The MST region name is the bridge MAC address of the device by default. Revision Level Revision level of the MST region. Manual (Instance ID and VLAN ID) Manually add VLAN-to-instance mappings. Click Apply to add the VLAN-to-instance mapping entries to the list. Modulo The device automatically maps 4094 VLANs to the corresponding MSTIs based on the modulo value. Click Activate. Configuring MSTP globally 1.
Figure 180 Configuring MSTP globally 3. Configure the global MSTP configuration as described in Table 59, and then click Apply. Table 59 Configuration items Item Enable STP Globally Description Selects whether to enable STP globally. Other MSTP configurations take effect only after you enable STP globally. Selects whether to enable BPDU guard. BPDU Guard BPDU guard can protect the device from malicious BPDU attacks, making the network topology stable.
Item Description Sets the operating mode of STP: • STP—Each port on a device sends out STP BPDUs. • RSTP—Each port on a device sends out RSTP BPDUs, and automatically Mode migrates to STP-compatible mode when detecting that it is connected with a device running STP. • MSTP—Each port on a device sends out MSTP BPDUs, and automatically migrates to STP-compatible mode when detecting that it is connected with a device running STP.
Item Description Selects whether to enable TC-BPDU guard. When receiving topology change (TC) BPDUs, the device flushes its forwarding address entries. If someone forges TC-BPDUs to attack the device, the device will receive a large number of TC-BPDUs within a short time and frequently flushes its forwarding address entries. This affects network stability. tc-protection With the TC-BPDU guard function, you can prevent frequent flushing of forwarding address entries.
Item Description Sets the priority and path cost of the port in the current MSTI: • Priority—The priority of a port is an important factor in determining whether the port Instance (Instance ID, Port Priority, Auto Path Cost, and Manual Path Cost) can be elected as the root port of a device. If all other conditions are the same, the port with the highest priority will be elected as the root port.
Protection type Description Enables the root guard function. Root Protection Configuration errors or attacks might result in configuration BPDUs with their priorities higher than that of a root bridge, which causes a new root bridge to be elected and network topology change to occur. The root guard function is used to address such a problem. Enables the loop guard function.
Table 62 Field description Field Description [FORWARDING] The port is in forwarding state, so the port learns MAC addresses and forwards user traffic. [LEARNING] The port is in learning state, so the port learns MAC addresses but does not forward user traffic. [DISCARDING] The port is in discarding state, so the port does not learn MAC addresses or forward user traffic. [DOWN] The port is down. Port Protocol Whether STP is enabled on the port.
Field Description Major parameters for the port: PortTimes • • • • • Hello—Hello timer. MaxAge—Max Age timer. FWDly—Forward delay timer. MsgAge—Message Age timer. Remain Hop—Remaining hops. BPDU Sent Statistics on sent BPDUs. BPDU Received Statistics on received BPDUs. Protocol Status Whether MSTP is enabled. Protocol Std. MSTP standard. Version MSTP version. CIST Bridge-Prio. Priority of the current device in the CIST. MAC address MAC address of the current device.
Figure 183 Network diagram Switch A Switch B Permit: all VLAN Permit: VLAN 10, 40 Permit: VLAN 20, 40 Permit: VLAN 10, 40 Permit: VLAN 20, 40 Permit: VLAN 30, 40 Switch C Switch D "Permit:" next to a link in the figure is followed by the VLANs the packets of which are permitted to pass this link. Configuration procedure Configuring Switch A 1. Configure an MST region: a. From the navigation tree, select Network > MSTP. By default, the Region tab is displayed. b. Click Modify.
j. Click Activate. Figure 185 Configuring an MST region 2. Configure MSTP globally: a. From the navigation tree, select Network > MSTP. b. Click the Global tab. c. Select Enable from the Enable STP Globally list. d. Select MSTP from the Mode list. e. Select the box before Instance. f. Set the Instance ID field to 1. g. Set the Root Type field to Primary. h. Click Apply.
Figure 186 Configuring MSTP globally (on Switch A) Configuring Switch B 1. Configure an MST region on the switch in the same way the MST region is configured on Switch A. 2. Configure MSTP globally: a. From the navigation tree, select Network > MSTP. b. Click the Global tab. c. Select Enable from the Enable STP Globally list. d. Select MSTP from the Mode list. e. Select the box before Instance. f. Set the Instance ID field to 2. g. Set the Root Type field to Primary. h. Click Apply.
Configuring Switch C 1. Configure an MST region on the switch in the same way the MST region is configured on Switch A. 2. Configure MSTP globally: a. From the navigation tree, select Network > MSTP. b. Click Global. c. Select Enable from the Enable STP Globally list. d. Select MSTP from the Mode list. e. Select the box before Instance. f. Set the Instance ID field to 3. g. Set the Root Type field to Primary. h. Click Apply. Configuring Switch D 1.
Figure 187 Configuring MSTP globally (on Switch D) 204
Configuring link aggregation and LACP Overview Ethernet link aggregation bundles multiple physical Ethernet links into one logical link, called an aggregate link. Link aggregation has the following benefits: • Increased bandwidth beyond the limits of any single link. In an aggregate link, traffic is distributed across the member ports. • Improved link reliability. The member ports dynamically back up one another. When a member port fails, its traffic is automatically switched to other member ports.
Configuration classes Port configurations include the following classes: • Class-two configurations—A member port can be placed in the Selected state only if it has the same class-two configurations as the aggregate interface. Table 63 Class-two configurations • Type Considerations Port isolation Whether a port has joined an isolation group, and the isolation group to which the port belongs.
exceeded, places the ports with smaller port numbers in the Selected state and those with greater port numbers in the Unselected state. 4. Places the member ports in the Unselected state if all the member ports are down. 5. Places the ports that cannot aggregate with the reference port in the Unselected state, for example, as a result of the inter-board aggregation restriction.
Configuration procedures Configuring a static aggregation group Step Remarks Creating a link aggregation group. 1. Create a static aggregate interface and configure member ports for the static aggregation group. By default, no link aggregation group exists. (Optional.) Displaying aggregate interface information. 2. Display detailed information of an existing aggregation group. Configuring a dynamic aggregation group Step Remarks 1.
Figure 188 Creating a link aggregation group 3. Configure a link aggregation group as described in Table 64. 4. Click Apply. Table 64 Configuration items Item Description Enter Link Aggregation Interface ID Assign an ID to the link aggregation group to be created. You can view the result in the Summary area at the bottom of the page. Set the type of the link aggregation interface to be created: Specify Interface Type Select port(s) for the link aggregation interface • Static—LACP is disabled.
2. Choose an aggregate interface from the list. The list on the lower part of the page displays the detailed information about the member ports of the link aggregation group. Figure 189 Displaying information of an aggregate interface Table 65 Field description Field Aggregation interface Description Type and ID of the aggregate interface. Bridge-Aggregation indicates a Layer 2 aggregate interface. Link Type Type of the aggregate interface: static or dynamic.
Setting LACP priority 1. From the navigation tree, select Network > LACP. 2. Click Setup. 3. In the Set LACP enabled port(s) parameters area, set the port priority, and select the ports in the chassis front panel. 4. Click Apply in the area. Figure 190 Setting the LACP priority Table 66 Configuration items Item Description Port Priority Set a port LACP priority. Select port(s) to apply Port Priority Choose the ports where the port LACP priority you set will apply on the chassis front panel.
Detailed information about the peer port appears on the lower part of the page. Table 68 describes the fields. Figure 191 Displaying the information of LACP-enabled ports Table 67 Field description Field Description Unit ID of a device in a stack. Port Port where LACP is enabled. LACP State State of LACP on the port. Port Priority LACP priority of the port. State Aggregation state of the port. If a port is Selected, this field also displays the ID of the aggregation group it belongs to.
Field Description Partner Port ID of the peer port. States of the peer port: • • • • • • • • Partner Port State Oper Key A—LACP is enabled. B—LACP short timeout. If B does not appear, it indicates LACP long timeout. C—The sending system considers the link is aggregatable. D—The sending system considers the link is synchronized. E—The sending system considers the incoming frames are collected. F—The sending system considers the outgoing frames are distributed.
a. Enter link aggregation interface ID 1. b. Select Static (LACP Disabled) for the aggregate interface type. c. Select GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 on the chassis front panel. 4. Click Apply. Figure 193 Creating static link aggregation group 1 Method 2: Create dynamic link aggregation group 1 1. From the navigation tree, select Network > Link Aggregation. 2. Click Create. 3. Configure dynamic aggregation group 1: a. Enter link aggregation interface ID 1. b.
Figure 194 Creating dynamic link aggregation group 1 Configuration guidelines When you configure a link aggregation group, follow these guidelines: • In an aggregation group, a Selected port must have the same port attributes and class-two configurations as the reference port. To keep these configurations consistent, you should configure the port manually. • Choose a reference port from the member ports that are in up state and with the same class-two configurations as the aggregate interface.
• Do not assign the following types of ports to Layer 2 aggregate groups: { MAC address authentication-enabled ports. { port security-enabled ports. { packet filtering-enabled ports. { Ethernet frame filtering-enabled ports. { IP source guard-enabled ports. { 802.1X-enabled ports. • Deleting a Layer 2 aggregate interface also deletes its aggregation group and causes all member ports to leave the aggregation group.
Configuring LLDP Overview In a heterogeneous network, a standard configuration exchange platform makes sure different types of network devices from different vendors can discover one another and exchange configuration. The Link Layer Discovery Protocol (LLDP) is specified in IEEE 802.1AB. The protocol operates on the data link layer to exchange device information between directly connected devices.
• Field Description Data LLDPDU. FCS Frame check sequence, a 32-bit CRC value used to determine the validity of the received Ethernet frame. LLDP frames encapsulated in SNAP Figure 196 LLDP frame encapsulated in SNAP Table 70 Fields in a SNAP-encapsulated LLDP frame Field Description Destination MAC address MAC address to which the LLDP frame is advertised. It is fixed to 0x0180-C200-000E, a multicast MAC address. Source MAC address MAC address of the sending port.
• Basic management TLVs • Organizationally (IEEE 802.1 and IEEE 802.3) specific TLVs • LLDP-MED (media endpoint discovery) TLVs Basic management TLVs are essential to device management. Organizationally specific TLVs and LLDP-MED TLVs are used for improved device management. They are defined by standardization or other organizations and are optional to LLDPDUs. • Basic management TLVs Table 71 lists the basic management TLV types. Some of them are mandatory for LLDPDUs.
Type Description Protocol Identity Indicates protocols supported on the port. An LLDPDU can carry multiple different TLVs of this type. DCBX Data center bridging exchange protocol. NOTE: HP devices support only receiving protocol identity TLVs. • IEEE 802.3 organizationally specific TLVs Table 73 IEEE 802.
Type Description Extended Power-via-MDI Allows a network device or terminal device to advertise power supply capability. This TLV is an extension of the Power Via MDI TLV. Hardware Revision Allows a terminal device to advertise its hardware version. Firmware Revision Allows a terminal device to advertise its firmware version. Software Revision Allows a terminal device to advertise its software version. Serial Number Allows a terminal device to advertise its serial number.
• A new neighbor is discovered. A new LLDP frame is received carrying device information new to the local device. • The LLDP operating mode of the port changes from Disable or Rx to TxRx or Tx. This is the fast sending mechanism of LLDP. With this mechanism, the specified number of LLDP frames is sent successively at the 1-second interval. The mechanism helps LLDP neighbors discover the local device as soon as possible. Then, the normal LLDP frame transmission interval resumes.
Step 5. 6. Remarks Displaying global LLDP information. Displaying LLDP information received from LLDP neighbors. Optional. You can display the local global LLDP information and statistics. Optional. You can display the LLDP information received from LLDP neighbors. Enabling LLDP on ports 1. From the navigation tree, select Network > LLDP. By default, the Port Setup tab is displayed. This tab displays the enabling status and operating mode of LLDP on a port. 2.
Setting LLDP parameters on ports The Web interface allows you to set LLDP parameters for a single port or for multiple ports in batch. Setting LLDP parameters for a single port 1. From the navigation tree, select Network > LLDP. By default, the Port Setup tab is displayed. 2. Click the icon for the port. On the page as shown in Figure 199, the LLDP settings of the port are displayed. Figure 199 Modifying LLDP settings on a port 3. Configure the LLDP parameters for the port as described in Table 75.
Item Description Set the encapsulation for LLDP frames: • ETHII—Encapsulates outgoing LLDP frames in Ethernet II frames Encapsulation Format and processes an incoming LLDP frame only if its encapsulation is Ethernet II. • SNAP—Encapsulates outgoing LLDP frames in Ethernet II frames and processes an incoming LLDP frame only if its encapsulation is Ethernet II. LLDP-CDP PDUs use only SNAP encapsulation.
Item DOT1 TLV Setting Description Port VLAN ID Select the box to include the PVID TLV in transmitted LLDP frames. Protocol VLAN ID Select the box to include port and protocol VLAN ID TLVs in transmitted LLDP frames and specify the VLAN IDs to be advertised. If no VLAN is specified, the lowest protocol VLAN ID is transmitted. VLAN Name DOT3 TLV Setting MED TLV Setting Select the box to include VLAN name TLVs in transmitted LLDP frames, and specify the VLAN IDs to be advertised.
Setting LLDP parameters for ports in batch 1. From the navigation tree, select Network > LLDP. By default, the Port Setup tab is displayed. 2. Select one or multiple ports on the port list. 3. Click Modify Selected to enter the page for modifying these ports in batch. Figure 200 Modifying LLDP settings on ports in batch 4. Set the LLDP settings for these ports as described in Table 75. 5. Click Apply. A progress dialog box appears. 6.
Figure 201 The global setup tab 3. Set the global LLDP setup as described in Table 76. 4. Click Apply. A progress dialog box appears. 5. Click Close on the progress dialog box when the progress dialog box prompts that the configuration succeeds. Table 76 Configuration items Item Description LLDP Enable Select from the list to enable or disable global LLDP. Select from the list to enable or disable CDP compatibility of LLDP.
Item Description Set the TTL multiplier. The TTL TLV carried in an LLDPDU determines how long the device information carried in the LLDPDU can be saved on a recipient device. You can configure the TTL of locally sent LLDPDUs to determine how long information about the local device can be saved on a neighbor device by setting the TTL multiplier. The TTL is expressed as TTL multiplier × LLDP frame transmission interval.
By default, the Local Information tab is displayed. Table 77 describes the fields. Figure 202 The local information tab Table 77 Field description Field Description Port ID subtype: Port ID subtype • • • • • • • Interface alias. Port component. MAC address. Network address. Interface name. Agent circuit ID. Locally assigned—Locally-defined port ID type other than those listed above. PoE port class: Power port class • PSE—Power sourcing equipment. • PD—Powered device.
Field Description PSE power source type: PoE PSE power source • Primary. • Backup. PoE power supply priority of PSE ports: Port PSE priority 3. • • • • Unknown—Unknown PSE priority. Critical—Priority level 1. High—Priority level 2. Low—Priority level 3. Click the Neighbor Information tab to display the LLDP neighbor information. Table 78 describes the fields.
Field Description Port ID type: Port ID type Port ID • • • • • • • Interface alias. Port component. MAC address. Network address. Interface name. Agent circuit ID. Locally assigned—Locally-defined port ID type other than those listed above. Port ID value. Capabilities supported on the system: System capabilities supported • Repeater. • Bridge. • Router. Capabilities enabled on the system: System capabilities enabled • Repeater. • Bridge. • Router.
Field Description Media policy type: Media policy type • • • • • • • • • Unknown. Voice. Voice signaling. Guest voice. Guest voice signaling. Soft phone voice. Videoconferencing. Streaming video. Video signaling. Unknown Policy Indicates whether the media policy type is unknown. VLAN tagged Indicates whether packets of the media VLAN are tagged. Media policy VlanID ID of the media VLAN. Media policy L2 priority Layer 2 priority. Media policy Dscp DSCP value.
Figure 204 The statistic information tab 5. Click the Status Information tab to display the LLDP status information. Figure 205 The status information tab Displaying global LLDP information 1. From the navigation tree, select Network > LLDP. 2. Click the Global Summary tab to display global local LLDP information and statistics. Table 79 describes the fields.
Figure 206 The global summary tab Table 79 Field description Field Description Chassis ID Local chassis ID depending on the chassis type defined. Capabilities supported on the system: System capabilities supported • Repeater. • Bridge. • Router. Capabilities enabled on the system: System capabilities enabled • Repeater. • Bridge. • Router. MED device class: • Connectivity device—An intermediate device that provide network connectivity. • Class I—A generic endpoint device.
Displaying LLDP information received from LLDP neighbors 1. From the navigation tree, select Network > LLDP. 2. Click the Neighbor Summary tab to display the global LLDP neighbor information, as shown in Figure 207. Figure 207 The neighbor summary tab LLDP configuration example Network requirements As shown in Figure 208, configure LLDP on Switch A and Switch B so that the NMS can determine the status of the link between Switch A and MED and the link between Switch A and Switch B.
The page shown in Figure 210 appears. Figure 209 The port setup tab d. Select Rx from the LLDP Operating Mode list. 3. Click Apply. A progress dialog box appears. 4. Click Close on the progress dialog box when the progress dialog box prompts that the configuration succeeds.
Figure 210 Setting LLDP on multiple ports 5. Enable global LLDP: a. Click the Global Setup tab, as shown in Figure 211. b. Select Enable from the LLDP Enable list. 6. Click Apply. A progress dialog box appears. 7. Click Close on the progress dialog box when the progress dialog box prompts that the configuration succeeds.
Configuring Switch B 1. (Optional.) Enable LLDP on port GigabitEthernet 1/0/1. By default, LLDP is enabled on Ethernet ports. 2. Set the LLDP operating mode to Tx on GigabitEthernet 1/0/1: a. From the navigation tree, select Network > LLDP. By default, the Port Setup tab is displayed. b. Click the icon for port GigabitEthernet 1/0/1. c. Select Tx from the LLDP Operating Mode list. 3. Click Apply. A progress dialog box appears. 4.
b. Click the GigabitEthernet1/0/1 port name in the port list. c. Click the Status Information tab at the lower half of the page. The output shows that port GigabitEthernet 1/0/1 is connected to an MED neighbor device. Figure 213 The status information tab (1) 2. Display the status information of port GigabitEthernet 1/0/2 on Switch A: a. Click the GigabitEthernet1/0/2 port name in the port list. b. Click the Status Information tab at the lower half of the page.
LLDP configuration guidelines When you configure LLDP, follow these guidelines: • To make LLDP take effect on a port, enable LLDP both globally and on the port. • To advertise LLDP-MED TLVs other than the LLDP-MED capabilities TLV, include the LLDP-MED capabilities TLV. • To remove the LLDP-MED capabilities TLV, remove all other LLDP-MED TLVs. • To remove the MAC/PHY configuration TLV, remove the LLDP-MED capabilities set TLV first.
Configuring ARP Overview ARP resolves IP addresses into MAC addresses on Ethernet networks. ARP message format ARP uses two types of messages: ARP request and ARP reply. Figure 216 shows the format of the ARP request/reply messages. Numbers in the figure refer to field lengths. Figure 216 ARP message format • Hardware type—Hardware address type. The value 1 represents Ethernet. • Protocol type—Type of the protocol address to be mapped. The hexadecimal value 0x0800 represents IP.
2. If Host A finds no entry for Host B, Host A buffers the packet and broadcasts an ARP request. The payload of the ARP request contains the following information: { Sender IP address and sender MAC address—Host A's IP address and MAC address. { Target IP address—Host B's IP address. { Target MAC address—An all-zero MAC address. All hosts on this subnet can receive the broadcast request, but only the requested host (Host B) processes the request. 3.
Dynamic ARP entry ARP automatically creates and updates dynamic entries. A dynamic ARP entry is removed when its aging timer expires or the output interface goes down. In addition, a dynamic ARP entry can be overwritten by a static ARP entry. Static ARP entry A static ARP entry is manually configured and maintained. It does not age out and cannot be overwritten by any dynamic ARP entry.
Creating a static ARP entry 1. From the navigation tree, select Network > ARP Management. The default ARP Table page appears, as shown in Figure 218. 2. Click Add. The New Static ARP Entry page appears. Figure 219 Add a static ARP entry 3. Configure the static ARP entry as described in Table 80. 4. Click Apply. Table 80 Configuration items Item Description IP Address Enter an IP address for the static ARP entry. MAC Address Enter a MAC address for the static ARP entry.
Configuring gratuitous ARP 1. From the navigation tree, select Network > ARP Management. 2. Click the Gratuitous ARP tab. Figure 220 Gratuitous Configuring ARP page 3. Configure gratuitous ARP as described in Table 81. 4. Click Apply. Table 81 Configuration items Item Description Disable gratuitous ARP packets learning function Disable learning of ARP entries from gratuitous ARP packets.
Figure 221 Network diagram Configuring Switch A 1. Create VLAN 100: a. From the navigation tree, select Network > VLAN. b. Click the Add tab. c. Enter 100 in the VLAN ID field. d. Click Create. Figure 222 Creating VLAN 100 2. Add GigabitEthernet 1/0/1 to VLAN 100: a. Click the Modify Port tab. b. In the Select Ports area, select interface GigabitEthernet 1/0/1.
c. Select Untagged for Select membership type. d. Enter 100 in the VLAN IDs field. e. Click Apply. A configuration process dialog box appears. f. After the configuration process is complete, click Close. Figure 223 Adding GigabitEthernet 1/0/1 to VLAN 100 3. Create VLAN-interface 100: a. From the navigation tree, select Network > VLAN Interface. b. Click the Create tab. c. Enter 100 in the VLAN ID field. d. Select Configure Primary IPv4 Address. e. Select Manual. f. Enter 192.168.1.
Figure 224 Creating VLAN-interface 100 4. Create a static ARP entry: a. From the navigation tree, select Network > ARP Management. The default ARP Table page appears. b. Click Add. c. Enter 192.168.1.1 in the IP Address field. d. Enter 00e0-fc01-0000 in the MAC Address field. e. Select Advanced Options. f. Enter 100 in the VLAN ID field. g. Select GigabitEthernet1/0/1 from the Port list. h. Click Apply.
Configuring ARP attack protection Overview Although ARP is easy to implement, it provides no security mechanism and is vulnerable to network attacks. The ARP detection feature enables access devices to block ARP packets from unauthorized clients to prevent user spoofing and gateway spoofing attacks. ARP detection provides user validity check and ARP packet validity check.
Figure 226 ARP detection configuration page 2. Configure ARP detection as described in Table 82. 3. Click Apply. Table 82 Configuration items Item Description Select VLANs on which ARP detection is to be enabled. VLAN Settings To add VLANs to the Enabled VLANs list, select one or multiple VLANs from the Disabled VLANs list and click the << button. To remove VLANs from the Enabled VLANs list, select one or multiple VLANs from the list and click the >> button. Select trusted ports and untrusted ports.
Configuring IGMP snooping Overview IGMP snooping runs on a Layer 2 switch as a multicast constraining mechanism to improve multicast forwarding efficiency. It creates Layer 2 multicast forwarding entries from IGMP packets that are exchanged between the hosts and the router. As shown in Figure 227, when IGMP snooping is not enabled, the Layer 2 switch floods multicast packets to all hosts.
Figure 228 IGMP snooping related ports The following describes the ports involved in IGMP snooping: • Router port—Layer 3 multicast device-side port. Layer 3 multicast devices include designated routers and IGMP queriers. In Figure 228, GigabitEthernet 1/0/1 of Switch A and GigabitEthernet 1/0/1 of Switch B are router ports. A switch records all its local router ports in its router port list.
Timer Description Dynamic member port aging timer When a port dynamically joins a multicast group, the switch starts or resets an aging timer for the port. When the timer expires, the dynamic member port ages out. Message received before the timer expires Action after the timer expires IGMP membership report. The switch removes this port from the IGMP snooping forwarding table. NOTE: In IGMP snooping, only dynamic ports age out. How IGMP snooping works The ports in this section are dynamic ports.
switch cannot determine whether the reported multicast group still has active members attached to that port. Leave message An IGMPv1 host silently leaves a multicast group and the switch is not notified of the leaving. However, because the host stops sending IGMP reports as soon as it leaves the multicast group, the switch removes the port that connects to the host from the forwarding entry for the multicast group when the aging timer for the port expires.
Step Remarks Required. Enable IGMP snooping in the VLAN and configure the IGMP snooping version and querier feature. 2. Configuring IGMP snooping in a VLAN By default, IGMP snooping is disabled in a VLAN. When you enable IGMP snooping, follow these guidelines: • Enable IGMP snooping globally before you enable it for a VLAN. • IGMP snooping for a VLAN takes effect only on the member ports in that VLAN. Optional. 3.
Configuring IGMP snooping in a VLAN 1. From the navigation tree, select Network > IGMP snooping. 2. Click the icon for the VLAN. Figure 230 Configuring IGMP snooping in a VLAN 3. Configure the parameters as described in Table 83. 4. Click Apply. Table 83 Configuration items Item Description Enable or disable IGMP snooping in the VLAN. IGMP snooping You can proceed with the subsequent configurations only if Enable is selected here. The default setting is IGMPv2.
Item Description Enable or disable the IGMP snooping querier function. On an IP multicast network that runs IGMP, a Layer 3 device acts as an IGMP querier to send IGMP queries and establish and maintain multicast forwarding entries, ensuring correct multicast traffic forwarding at the network layer. Querier On a network without Layer 3 multicast devices, IGMP querier cannot work because a Layer 2 device does not support IGMP.
Table 84 Configuration items Item Description Select the port on which advanced IGMP snooping features will be configured. The port can be an GigabitEthernet port or Layer 2 aggregate interface. After a port is selected, advanced features configured on this port are displayed at the lower part of this page. Port TIP: The advanced IGMP snooping configurations on a Layer 2 aggregate interface do not interfere with configurations on its member ports, nor do they participate in aggregation calculations.
Figure 233 Displaying detailed information about the entry Table 85 Field description Field Description VLAN ID ID of the VLAN to which the entry belongs. Source Address Multicast source address. If no multicast sources are specified, this field displays 0.0.0.0. Group Address Multicast group address. Router Port(s) All router ports. Member Port(s) All member ports.
Figure 234 Network diagram VLAN 100 Host B 1.1.1.1/24 GE1/0/2 GE1/0/2 Source GE1/0/1 Router A IGMP querier GE1/0/3 GE1/0/1 Switch A Host A Receiver Configuration procedure Configuring Router A Enable IP multicast routing globally, enable PIM-DM on each interface, and enable IGMP on GigabitEthernet 1/0/1. (Details not shown.) Configuring Switch A 1. Create VLAN 100: a. From the navigation tree, select Network > VLAN. b. Click the Create tab. c. Enter 100 as the VLAN ID. d. Click Apply.
Figure 235 Creating VLAN 100 2. Assign GigabitEthernet 1/0/1 through GigabitEthernet 1/0/3 to VLAN 100: a. Click the Modify Port tab. b. Select GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 in the Select Ports area. c. Select Untagged for Select membership type. d. Enter 100 as the VLAN ID. e. Click Apply.
Figure 236 Assigning ports to the VLAN 3. Enable IGMP snooping globally: a. From the navigation tree, select Network > IGMP snooping. b. Select Enable. c. Click Apply. Figure 237 Enabling IGMP snooping globally 4. Enable IGMP snooping for VLAN 100: a. Click the icon for VLAN 100. b. Select Enable for IGMP snooping. c. Select 2 for Version. d. Click Apply.
Figure 238 Configuring IGMP snooping in VLAN 100 Verifying the configuration 1. From the navigation tree, select Network > IGMP snooping. 2. Click Show Entries in the basic VLAN configuration page to display information about IGMP snooping multicast forwarding entries. Figure 239 Displaying IGMP snooping multicast forwarding entries 3. Click the this entry. icon for the multicast entry (0.0.0.0, 224.1.1.
The output shows that GigabitEthernet 1/0/3 of Switch A is listening to the multicast streams destined for multicast group 224.1.1.1.
Configuring MLD snooping Overview MLD snooping runs on a Layer 2 switch as an IPv6 multicast constraining mechanism to improve multicast forwarding efficiency. It creates Layer 2 multicast forwarding entries from MLD messages that are exchanged between the hosts and the router. As shown in Figure 241, when MLD snooping is not enabled, the Layer 2 switch floods IPv6 multicast packets to all hosts.
Figure 242 MLD snooping related ports The following describes the ports involved in MLD snooping: • Router port—Layer 3 multicast device-side port. Layer 3 multicast devices include designated routers and MLD queriers. As shown in Figure 242, GigabitEthernet 1/0/1 of Switch A and GigabitEthernet 1/0/1 of Switch B are router ports. A switch records all its local router ports in its router port list.
Timer Description Dynamic member port aging timer When a port dynamically joins an IPv6 multicast group, the switch starts or resets an aging timer for the port. When the timer expires, the dynamic member port ages out. Message received before the timer expires Action after the timer expires MLD membership report. The switch removes this port from the MLD snooping forwarding table. NOTE: In MLD snooping, only dynamic ports age out. How MLD snooping works The ports in this section are dynamic ports.
the reported IPv6 multicast group address to suppress their own reports. In this case, the switch cannot determine whether the reported IPv6 multicast group still has active members attached to that port. Done message When a host leaves an IPv6 multicast group, the host sends an MLD done message to the multicast router.
Step Remarks Required. Enable MLD snooping in the VLAN and configure the MLD snooping version and querier. 2. Configuring MLD snooping in a VLAN By default, MLD snooping is disabled in a VLAN. When you enable MLD snooping, follow these guidelines: • Enable MLD snooping globally before you enable it for a VLAN. • MLD snooping for a VLAN takes effect only on the member ports in that VLAN. Optional.
2. Click the icon for the VLAN. Figure 244 Configuring MLD snooping in a VLAN 3. Configure the parameters as described in Table 86. 4. Click Apply. Table 86 Configuration items Item MLD snooping Description Enable or disable MLD snooping in the VLAN. You can proceed with the subsequent configurations only if Enable is selected here. The default setting is MLDv1. By configuring an MLD snooping version, you actually configure the versions of MLD messages that MLD snooping can process.
Configuring MLD snooping port functions 1. Select Network > MLD snooping from the navigation tree. 2. Click the Advanced tab. Figure 245 Configuring MLD snooping port functions 3. Configure the parameters as described in Table 87. 4. Click Apply. Table 87 Configuration items Item Description Select the port on which advanced MLD snooping features will be configured. The port can be an GigabitEthernet port or Layer 2 aggregate interface.
Item Description Enable or disable fast-leave processing on the port. Fast Leave When a port that is enabled with the MLD snooping fast-leave processing feature receives an MLD done message, the switch immediately deletes that port from the IPv6 forwarding table entry for the multicast group specified in the message. When the switch receives MLD multicast-address-specific queries for that multicast group, it does not forward them to that port.
Field Description Member Ports All member ports. MLD snooping configuration example Network requirements As shown in Figure 247, MLDv1 runs on Router A and MLDv1 snooping runs on Switch A. Router A acts as the MLD querier. Perform the configuration so that Host A can receive the IPv6 multicast packets destined for the IPv6 multicast group FF1E::101.
Figure 248 Creating VLAN 100 2. Assign GigabitEthernet 1/0/1 through GigabitEthernet 1/0/3 to VLAN 100: a. Click the Modify Port tab. b. Select GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 in the Select Ports area. c. Select Untagged for Select membership type. d. Enter 100 as the VLAN ID. e. Click Apply.
Figure 249 Assigning ports to VLAN 100 3. Enable MLD snooping globally: a. Select Network > MLD snooping from the navigation tree. b. Select Enable. c. Click Apply. Figure 250 Enabling MLD snooping globally 4. Enable MLD snooping: a. Click the icon for VLAN 100. b. Select Enable for MLD snooping. c. Select 1 for Version.
d. Click Apply. Figure 251 Enabling MLD snooping in VLAN 100 Verifying the configuration 1. Select Network > MLD snooping from the navigation tree. 2. Click Show Entries in the basic VLAN configuration page to display information about MLD snooping multicast forwarding entries. Figure 252 Displaying MLD snooping multicast forwarding entries 3. Click the entry.
Configuring IPv4 and IPv6 routing The term "router" in this chapter refers to both routers and Layer 3 switches. Overview A router selects an appropriate route according to the destination address of a received packet and forwards the packet to the next router. The last router on the path is responsible for sending the packet to the destination host. Routing provides the path information that guides the forwarding of packets.
Static routes cannot adapt to network topology changes. If a fault or a topological change occurs in the network, the network administrator must modify the static routes manually. Default route A default route is used to forward packets that do not match any specific routing entry in the routing table. Without a default route, packets that do not match any routing entries are discarded.
Creating an IPv4 static route 1. Select Network > IPv4 Routing from the navigation tree. 2. Click the Create tab. The page for configuring an IPv4 static route appears. Figure 255 Creating an IPv4 static route 3. Create an IPv4 static route as described in Table 91. 4. Click Apply. Table 91 Configuration items Item Description Destination IP Address Enter the destination host or network IP address in dotted decimal notation. Mask Enter the mask of the destination IP address.
Item Description Select the output interface. Interface You can select any available Layer 3 interface, for example, a virtual interface, of the device. If you select NULL 0, the destination IP address is unreachable. Displaying the IPv6 active route table Select Network > IPv6 Routing from the navigation tree to enter the page.
The page for configuring an IPv6 static route appears. Figure 257 Creating an IPv6 static route 3. Create an IPv6 static route as described in Table 93. 4. Click Apply. Table 93 Configuration items Item Description Destination IP Address Enter the destination host or network IP address, in the X:X::X:X format. The 128-bit destination IPv6 address is a hexadecimal address with eight parts separated by colons (:). Each part is represented by a 4-digit hexadecimal integer.
IPv4 static route configuration example Network requirements As shown in Figure 258, configure IPv4 static routes on Switch A, Switch B, and Switch C for any two hosts to communicate with each other. Figure 258 Network diagram Configuration considerations On Switch A, configure a default route with Switch B as the next hop. On Switch B, configure one static route with Switch A as the next hop and the other with Switch C as the next hop. On Switch C, configure a default route with Switch B as the next hop.
Figure 259 Configuring a default route 2. Configure a static route to Switch A and Switch C on Switch B: a. Select Network > IPv4 Routing from the navigation tree of Switch B. b. Click the Create tab. The page for configuring a static route appears. c. Enter 1.1.2.0 for Destination IP Address, 24 for Mask, and 1.1.4.1 for Next Hop. d. Click Apply.
Figure 260 Configuring a static route e. Enter 1.1.3.0 for Destination IP Address, enter 24 for Mask, and enter 1.1.5.6 for Next Hop. f. Click Apply. 3. Configure a default route to Switch B on Switch C: a. Select Network > IPv4 Routing from the navigation tree of Switch C. b. Click the Create tab. c. Enter 0.0.0.0 for Destination IP Address, 0 for Mask, and 1.1.5.5 for Next Hop. d. Click Apply.
Figure 261 Configuring a default route Verifying the configuration 1. Display the routing table. Enter the IPv4 route page of Switch A, Switch B, and Switch C to verify that the newly configured static routes are displayed as active routes on the pages. 2. Ping Host C from Host A (assuming both hosts run Windows XP): C:\Documents and Settings\Administrator>ping 1.1.3.2 Pinging 1.1.3.2 with 32 bytes of data: Reply from 1.1.3.2: bytes=32 time=1ms TTL=128 Reply from 1.1.3.
IPv6 static route configuration example Network requirements As shown in Figure 262, configure IPv6 static routes on Switch A, Switch B, and Switch C for any two hosts to communicate with each other.
Figure 263 Configuring a default route 2. Configure a static route to Switch A and Switch C on Switch B: a. Select Network > IPv6 Routing from the navigation tree of Switch B. b. Click the Create tab. The page for configuring a static route appears. c. Enter 1:: for Destination IP Address, select 64 from the Prefix Length list, and enter 4::1 for Next Hop. d. Click Apply.
Figure 264 Configuring a static route e. Enter 3:: for Destination IP Address, select 64 from the Prefix Length list, and enter 5::1 for Next Hop. f. Click Apply. 3. Configure a default route to Switch B on Switch C: a. Select Network > IPv6 Routing from the navigation tree of Switch C. b. Click the Create tab. c. Enter :: for Destination IP Address, select 0 from the Prefix Length list, and enter 5::2 for Next Hop. d. Click Apply.
Figure 265 Configuring a default route Verifying the configuration 1. Display the routing table. Enter the IPv6 route page of Switch A, Switch B, and Switch C to verify that the newly configured static routes are displayed as active routes on the pages. 2.
round-trip min/avg/max = 62/62/63 ms Configuration guidelines When you configure a static route, follow these guidelines: • If you do not specify the preference, the default preference will be used. Reconfiguration of the default preference applies only to newly created static routes. The Web interface does not support configuration of the default preference.
DHCP overview The Dynamic Host Configuration Protocol (DHCP) provides a framework to assign configuration information to network devices. DHCP uses the client-server model. Figure 266 shows a typical DHCP application. A DHCP client can obtain an IP address and other configuration parameters from a DHCP server on another subnet through a DHCP relay agent. For more information about the DHCP relay agent, see "Configuring DHCP relay agent." You can enable the DHCP client on an interface.
IP address allocation process Figure 267 Dynamic IP address allocation process 1. The client broadcasts a DHCP-DISCOVER message to locate a DHCP server. 2. A DHCP server offers configuration parameters such as an IP address to the client in a DHCP-OFFER message. The sending mode of the DHCP-OFFER is determined by the flag field in the DHCP-DISCOVER message. For more information about the DHCP message format, see "DHCP message format." 3.
DHCP message format Figure 268 shows the DHCP message format. DHCP uses some of the fields in significantly different ways. The numbers in parentheses indicate the size of each field in bytes. Figure 268 DHCP message format 0 7 op (1) 23 15 htype (1) hlen (1) 31 hops (1) xid (4) secs (2) flags (2) ciaddr (4) yiaddr (4) siaddr (4) giaddr (4) chaddr (16) sname (64) file (128) options (variable) • op—Message type defined in option field.
DHCP options DHCP defines the message format as an extension to BOOTP for compatibility. DHCP uses the Option field to carry information for dynamic address allocation and to provide additional configuration information to clients. Figure 269 DHCP option format Common DHCP options The following are common DHCP options: • Option 3—Router option. It specifies the gateway address. • Option 6—DNS server option. It specifies the DNS server's IP address. • Option 33—Static route option.
The administrator can use Option 82 to locate the DHCP client and further implement security control and accounting. The DHCP server can use Option 82 to provide individual configuration policies for the clients. Option 82 can include up to 255 sub-options and must have one sub-option at least. Option 82 supports two sub-options: sub-option 1 (Circuit ID) and sub-option 2 (Remote ID). Option 82 has no unified definition. Its padding formats vary with vendors.
Configuring DHCP relay agent Overview Since the DHCP clients request IP addresses through broadcast messages, the DHCP server and clients must be on the same subnet. Through a DHCP relay agent, DHCP clients can get IP addresses from a DHCP server on another subnet. This feature avoids deploying a DHCP server for each subnet to centralize management and reduce investment. Figure 272 shows a typical application of the DHCP relay agent.
Figure 273 DHCP relay agent operation Recommended configuration procedure Task Remarks Enabling DHCP and configuring advanced parameters for the DHCP relay agent Required. Enable DHCP globally and configure advanced DHCP parameters. By default, global DHCP is disabled. Required. Creating a DHCP server group To improve reliability, you can specify several DHCP servers as a group on the DHCP relay agent and correlate a relay agent interface with the server group.
Enabling DHCP and configuring advanced parameters for the DHCP relay agent 1. From the navigation tree, select Network > DHCP to enter the default DHCP Relay page. 2. Click Display Advanced Configuration to expand the advanced DHCP relay agent configuration area, as shown in Figure 274. Figure 274 DHCP relay agent configuration page 3. Enable DHCP service and configure advanced parameters for DHCP relay agent as shown in Table 94.
4. Click Apply. Table 94 Configuration items Item Description DHCP Service Enable or disable global DHCP. Enable or disable unauthorized DHCP server detection. There are unauthorized DHCP servers on networks, which reply DHCP clients with wrong IP addresses. Unauthorized Server Detect With this feature enabled, upon receiving a DHCP request, the DHCP relay agent records the IP address of any DHCP server that assigned an IP address to the DHCP client and the receiving interface.
3. Configure the DHCP server group as shown in Table 95. 4. Click Apply. Table 95 Configuration items Item Server Group ID Description Enter the ID of a DHCP server group. You can create up to 20 DHCP server groups. Enter the IP address of a server in the DHCP server group. IP Address The server IP address cannot be on the same subnet as the IP address of the DHCP relay agent. Otherwise, the client cannot obtain an IP address. Enabling the DHCP relay agent on an interface 1.
Configuring and displaying clients' IP-to-MAC bindings 1. From the navigation tree, select Network > DHCP to enter the default DHCP Relay page shown in Figure 274. 2. In the User Information area, click User Information to view static and dynamic bindings, as shown in Figure 277. Figure 277 Displaying clients' IP-to-MAC bindings 3. Click Add to enter the page as shown in Figure 278. Figure 278 Creating a static IP-to-MAC binding 4. Configure the static IP-to-MAC binding as described in Table 97. 5.
DHCP relay agent configuration example Network requirements As shown in Figure 279, VLAN-interface 1 on the DHCP relay agent (Switch A) connects to the network where DHCP clients reside. The IP address of VLAN-interface 1 is 10.10.1.1/24 and the IP address of VLAN-interface 2 is 10.1.1.1/24. VLAN-interface 2 is connected to the DHCP server whose IP address is 10.1.1.1/24. The switch forwards DHCP messages between DHCP clients and the DHCP server.
Figure 280 Enabling DHCP 2. Configure a DHCP server group: a. In the Server Group area, click Add and then perform the following operations, as shown in Figure 281. b. Enter 1 for Server Group ID. c. Enter 10.1.1.1 for IP Address. d. Click Apply.
3. Enable the DHCP relay agent on VLAN-interface 1: a. In the Interface Config field, click the icon of VLAN-interface 1, and then perform the following operations, as shown in Figure 282. b. Select the Enable option next to DHCP Relay. c. Select 1 for Server Group ID. d. Click Apply.
Configuring DHCP snooping DHCP snooping works between the DHCP client and server, or between the DHCP client and DHCP relay agent. It guarantees that DHCP clients obtain IP addresses from authorized DHCP servers. Also, it records IP-to-MAC bindings of DHCP clients (called DHCP snooping entries) for security purposes. DHCP snooping does not work between the DHCP server and DHCP relay agent.
Figure 283 Trusted and untrusted ports In a cascaded network as shown in Figure 284, configure each DHCP snooping device's ports connected to other DHCP snooping devices as trusted ports. To save system resources, you can disable the untrusted ports that are not directly connected to DHCP clients from generating DHCP snooping entries. Figure 284 Trusted and untrusted ports in a cascaded network Table 98 describes roles of the ports shown in Figure 284.
Device Untrusted port Trusted port disabled from recording binding entries Trusted port enabled to record binding entries Switch B GigabitEthernet 1/0/3 and GigabitEthernet 1/0/4 GigabitEthernet 1/0/1 GigabitEthernet 1/0/2 Switch C GigabitEthernet 1/0/1 GigabitEthernet 1/0/3 and GigabitEthernet 1/0/4 GigabitEthernet 1/0/2 DHCP snooping support for Option 82 Option 82 records the location information about the DHCP client so the administrator can locate the DHCP client for security and accounting
Task Remarks Displaying clients' IP-to-MAC bindings Optional. Display clients' IP-to-MAC bindings recorded by DHCP snooping. Enabling DHCP snooping 1. From the navigation tree, select Network > DHCP. 2. Click the DHCP Snooping tab to enter the page shown in Figure 285. 3. Select the Enable option next to DHCP Snooping to enable DHCP Snooping. Figure 285 DHCP snooping configuration page Configuring DHCP snooping functions on an interface 1. From the navigation tree, select Network > DHCP. 2.
Figure 286 DHCP snooping interface configuration page 4. Configure DHCP snooping on the interface as described in Table 100. 5. Click Apply. Table 100 Configuration items Item Description Interface Name This field displays the name of a specific interface. Interface State Configure the interface as trusted or untrusted. Option 82 Support Configure DHCP snooping to support Option 82 or not. Select the handling strategy for DHCP requests containing Option 82.
Item Description Displays the client type: Type • Dynamic—The IP-to-MAC binding is generated dynamically. • Static—The IP-to-MAC binding is configured manually. Static bindings are not supported. Interface Name Displays the device interface to which the client is connected. VLAN Displays the VLAN to which the device belongs. Remaining Lease Time Displays the remaining lease time of the IP address.
Figure 289 Enabling DHCP snooping 2. Configure DHCP snooping functions on GigabitEthernet 1/0/1: a. Click the icon of GigabitEthernet 1/0/1 on the interface list. b. Select the Trust option next to Interface State as shown in Figure 290. c. Click Apply. Figure 290 Configuring DHCP snooping functions on GigabitEthernet 1/0/1 3. Configure DHCP snooping functions on GigabitEthernet 1/0/2: a. Click the icon of GigabitEthernet 1/0/2 on the interface list. b.
4. Configure DHCP snooping functions on GigabitEthernet 1/0/3: a. Click the icon of GigabitEthernet 1/0/3 on the interface list. b. Select the Untrust option for Interface State as shown in Figure 292. c. Select the Enable option next to Option 82 Support. d. Select Replace for Option 82 Strategy. e. Click Apply.
Managing services Overview Service management allows you to manage the following types of services: FTP, Telnet, SSH, SFTP, HTTP and HTTPS. You can enable or disable the services, modify HTTP and HTTPS port numbers, and associate the FTP, HTTP, or HTTPS service with an ACL to block illegal users. FTP service FTP is an application layer protocol for sharing files between server and client over a TCP/IP network.
Managing services 1. Select Network > Service from the navigation tree to enter the service management configuration page, as shown in Figure 293. Figure 293 Service management 2. Enable or disable services on the page. Table 102 describes the detailed configuration items. 3. Click Apply. Table 102 Configuration items Description Item Enable FTP service FTP ACL Enable or disable the FTP service. The FTP service is disabled by default. Associate the FTP service with an ACL.
Item Description Set the port number for HTTP service. Port Number You can view this configuration item by clicking the expanding button in front of HTTP. IMPORTANT: When you modify a port, make sure the port is not used by any other service. ACL Enable HTTPS service Associate the HTTP service with an ACL. Only the clients that pass the ACL filtering are permitted to use the HTTP service. You can view this configuration item by clicking the expanding button in front of HTTP.
Using diagnostic tools This chapter describes how to use the ping and traceroute utilities. Ping Use the ping utility to determine if a specific address is reachable. A ping operation involves the following steps: 1. The source device sends ICMP echo requests to the destination device. 2. The destination device responds by sending ICMP echo replies to the source device after receiving the ICMP echo requests. 3. The source device displays related statistics after receiving the replies.
2. The first hop device responds with an ICMP TTL-expired message to the source. In this way, the source device gets the address of the first device. 3. The source device sends a packet with a TTL value of 2 to the destination device. 4. The second hop responds with an ICMP TTL-expired message. In this way, the source device gets the address of the second device. 5. The destination device responds with an ICMP port-unreachable message because the packet from the source has an unreachable port number.
Figure 295 Ping operation result Traceroute operation The Web interface does not support IPv6 traceroute. Before performing a traceroute operation, perform the following tasks: • Enable sending of ICMP timeout packets by executing the ip ttl-expires enable command on intermediate devices. • Enable sending of ICMP destination unreachable packets by executing the ip unreachables enable command on the destination device. To perform a traceroute operation: 1.
3. Enter the IP address or host name of the destination device in the Trace Route field. 4. Click Start. 5. View the output in the Summary area.
Configuring 802.1X 802.1X overview 802.1X is a port-based network access control protocol initially proposed by the IEEE 802 LAN/WAN committee for the security of WLANs. It has been widely used on Ethernet for access control. 802.1X controls network access by authenticating the devices connected to 802.1X-enabled LAN ports. This chapter describes how to configure 802.1X on an HP device. You can also configure the port security feature to perform 802.1X. Port security combines and extends 802.
• MAC-based access control—Each user is separately authenticated on a port. When a user logs off, no other online users are affected. Controlled/uncontrolled port and port authorization status 802.1X defines two logical ports for the network access port: controlled port and uncontrolled port. Any packet arriving at the network access port is visible to both logical ports.
• Code—Type of the EAP packet. Options include Request (1), Response (2), Success (3), or Failure (4). • Identifier—Used for matching Responses with Requests. • Length—Length (in bytes) of the EAP packet. The length is the sum of the Code, Identifier, Length, and Data fields. • Data—Content of the EAP packet. This field appears only in a Request or Response EAP packet. The Data field comprises the request type (or the response type) and the type data.
EAP-Message RADIUS encapsulates EAP packets in the EAP-Message attribute, as shown in Figure 302. The Type field takes 79, and the Value field can be up to 253 bytes. If an EAP packet is longer than 253 bytes, RADIUS encapsulates it in multiple EAP-Message attributes. Figure 302 EAP-Message attribute format 7 0 Type 15 N Length String EAP packets Message-Authenticator RADIUS includes the Message-Authenticator attribute in all packets that have an EAP-Message attribute to check their integrity.
802.1X authentication procedures 802.1X provides the following methods for authentication: • EAP relay. • EAP termination. You choose either mode depending on the support of the RADIUS server for EAP packets and EAP authentication methods. • EAP relay mode: EAP relay is defined in IEEE 802.1X. In this mode, the network device uses EAPOR packets to send authentication information to the RADIUS server, as shown in Figure 304.
Packet exchange method Benefits Limitations • Supports only MD5-Challenge EAP EAP termination Works with any RADIUS server that supports PAP or CHAP authentication. authentication and the "username + password" EAP authentication initiated by an HP iNode 802.1X client. • The processing is complex on the network access device. EAP relay Figure 306 shows the basic 802.1X authentication procedure in EAP relay mode, assuming that EAP-MD5 is used. Figure 306 802.
5. The authentication server uses the identity information in the RADIUS Access-Request to search its user database. If a matching entry is found, the server uses a randomly generated challenge (EAP-Request/MD5 challenge) to encrypt the password in the entry, and sends the challenge in a RADIUS Access-Challenge packet to the network access device. 6. The network access device relays the EAP-Request/MD5 Challenge packet in a RADIUS Access-Request packet to the client. 7.
Figure 307 802.1X authentication procedure in EAP termination mode In EAP termination mode, the network access device rather than the authentication server generates an MD5 challenge for password encryption (see Step 4). The network access device then sends the MD5 challenge together with the username and encrypted password in a standard RADIUS packet to the RADIUS server. 802.1X timers This section describes the timers used on an 802.
• Handshake timer—Sets the interval at which the access device sends client handshake requests to check the online status of a client that has passed authentication. If the device receives no response after sending the maximum number of handshake requests, it considers that the client has logged off. For information about how to enable the online user handshake function, see "Configuring 802.1X on a port.
Authentication status VLAN manipulation No 802.1X user has performed authentication within 90 seconds after 802.1X is enabled. The device assigns the 802.1X guest VLAN to the port as the PVID. All 802.1X users on this port can access only resources in the guest VLAN. A user in the 802.1X guest VLAN fails 802.1X authentication. If no 802.1X guest VLAN is configured, the access device does not perform any VLAN operation. If an 802.
Authentication status VLAN manipulation A user fails 802.1X authentication. The device assigns the Auth-Fail VLAN to the port as the PVID. All 802.1X users on this port can access only resources in the Auth-Fail VLAN. A user in the Auth-Fail VLAN fails 802.1X re-authentication. The Auth-Fail VLAN is still the PVID on the port, and all 802.1X users on this port are in this VLAN. • The device assigns the VLAN specified for the user to the port as the A user passes 802.1X authentication.
Recommended configuration procedure Step Remarks Required. 1. Configuring 802.1X globally This function enables 802.1X authentication globally. It also configures the authentication method and advanced parameters.By default, 802.1X authentication is disabled globally. Required. 2. Configuring 802.1X on a port This function enables 802.1X authentication on the specified port and configures 802.1X parameters for the port.By default, 802.1X authentication is disabled on a port. Configuring 802.
4. { The support of the RADIUS server for EAP packets. { The authentication methods supported by the 802.1X client and the RADIUS server. Click Advanced to expand the advanced 802.1X configuration area. Figure 309 Configuring advanced 802.1X parameters 5. Configure advanced 802.1X settings as described in Table 104, and then click Apply. Table 104 Configuration items Item Description Quiet Sets whether to enable the quiet timer. Quiet Period Sets the value of the quiet timer.
Figure 310 Configuring 802.1X on a port Table 105 describes the configuration items. Table 105 Configuration items Item Port Port Control Description Selects a port where you want to enable 802.1X. Only ports not enabled with 802.1X authentication are available. 802.1X configuration takes effect on a port only after 802.1X is enabled both globally and on the port. Selects an access control method for the port, MAC Based or Port Based. Selects a port authorization state for 802.
Item Description Specifies whether to enable periodic online user re-authentication on the port. Periodic online user re-authentication tracks the connection status of online users and updates the authorization attributes assigned by the server, such as the ACL, and VLAN. The re-authentication interval is specified by the Re-Authentication Period setting in Table 104.
Table 106 Relationships of the 802.1X guest VLAN and other security features Feature Relationship description MAC authentication guest VLAN on a port that performs MAC-based access control Only the 802.1X guest VLAN take effect. A user that fails MAC authentication will not be assigned to the MAC authentication guest VLAN. 802.1X Auth-Fail VLAN on a port that performs MAC-based access control The 802.1X Auth-Fail VLAN has a higher priority.
Use RADIUS servers to perform authentication, authorization, and accounting for the 802.1X users. If RADIUS accounting fails, the access device logs the user off. The RADIUS servers run CAMS or IMC. Configure the host at 10.1.1.1 as the primary authentication and secondary accounting servers, and the host at 10.1.1.2 as the secondary authentication and primary accounting servers. Assign all users to the ISP domain test.
2. Configure 802.1X for GigabitEthernet 1/0/1: a. In the Ports With 802.1X Enabled area, click Add. b. Select GigabitEthernet1/0/1 from the Port list, select Enable Re-Authentication, and click Apply. Figure 313 Configuring 802.1X for GigabitEthernet 1/0/1 Configuring the RADIUS scheme for the switch 1. Configure authentication and accounting attributes for the RADIUS scheme: a. From the navigation tree, select Authentication > RADIUS, and click Add. b. Enter the scheme name system. c.
Figure 314 Configuring the RADIUS scheme 2. Configure the primary authentication server in the RADIUS scheme: a. In the RADIUS Server Configuration area, click Add. b. Select the server type Primary Authentication. c. Enter the IP address 10.1.1.1, and enter the port number 1812.
d. Click Apply. The RADIUS Server Configuration area displays the primary authentication server you have configured. 3. Configure the backup authentication server in the RADIUS scheme: a. In the RADIUS Server Configuration area, click Add. b. Select the server type Backup Authentication. c. Enter the IP address 10.1.1.2, and enter the port number 1812. d. Click Apply. The RADIUS Server Configuration area displays the backup authentication server you have configured. 4.
Figure 315 Creating an ISP domain 2. Configure AAA authentication method for the ISP domain: a. Click the Authentication tab. b. Select test from the Select an ISP domain list. c. Select Default AuthN, select authentication method RADIUS from the Default AuthN list, and select the authentication scheme system from the Name list, as shown in Figure 316. Figure 316 Configuring AAA authentication method for the ISP domain d. Click Apply. A configuration progress dialog box appears, as shown in Figure 317.
Figure 317 Configuration progress dialog box e. After the configuration process is complete, click Close. 3. Configure AAA authorization method for the ISP domain: a. Click the Authorization tab. b. Select test from the Select an ISP domain list. c. Select Default AuthZ, select the authorization method RADIUS from the Default AuthZ list, and select the authorization scheme system from the Name list, as shown in Figure 318. Figure 318 Configuring the AAA authorization method for the ISP domain d.
Figure 319 Configuring the AAA accounting method for the ISP domain d. Click Apply. e. After the configuration process is complete, click Close. 802.X with ACL assignment configuration example Network requirements As shown in Figure 320, perform 802.1X authentication on port GigabitEthernet 1/0/1. Use the RADIUS server at 10.1.1.1 as the authentication and authorization server and the RADIUS server at 10.1.1.2 as the accounting server. Assign an ACL to GigabitEthernet 1/0/1 to deny the access of 802.
d. Select Without domain name from the Username Format list. e. Click Apply. 2. Configure the primary authentication server in the RADIUS scheme: a. In the RADIUS Server Configuration area, click Add. b. Select the server type Primary Authentication. c. Enter the IP address 10.1.1.1, and enter the port number 1812. d. Enter expert in the Key and Confirm Key fields. e. Click Apply. Figure 321 Configuring the RADIUS authentication server 3. Configure the primary accounting server in the RADIUS scheme: a.
Figure 323 Configuring the RADIUS scheme 4. Click Apply. Configuring AAA 1. Create an ISP domain: a. From the navigation tree, select Authentication > AAA. The Domain Setup page appears. b. Enter test from the Domain Name list, and select Enable from the Default Domain list. c. Click Apply.
Figure 324 Creating an ISP domain 2. Configure AAA authentication method for the ISP domain: a. Click the Authentication tab. b. Select test from the Select an ISP domain list. c. Select Default AuthN, select RADIUS as the default authentication method, and select the authentication scheme system from the Name list, as shown in Figure 325. Figure 325 Configuring the AAA authentication method for the ISP domain d. Click Apply. A configuration progress dialog box appears, as shown in Figure 326.
Figure 326 Configuration progress dialog box e. After the configuration process is complete, click Close. 3. Configure AAA authorization method for the ISP domain: a. Click the Authorization tab. b. Select test from the Select an ISP domain list. c. Select Default AuthZ, select RADIUS as the default authorization method, and select the authorization scheme system from the Name list, as shown in Figure 327. Figure 327 Configuring the AAA authorization method for the ISP domain d. Click Apply. e.
Figure 328 Configuring the AAA accounting method for the ISP domain f. After the configuration process is complete, click Close. Configuring an ACL 1. From the navigation tree, select QoS > ACL IPv4. 2. Click the Add tab. 3. Enter the ACL number 3000, and click Apply. Figure 329 Creating ACL 3000 4. Click the Advanced Setup tab. 5. Configure the following parameters: a. Select 3000 from the ACL list. b. Select Rule ID, enter the rule ID 0, and select the action Deny.
c. In the IP Address Filter area, select Destination IP Address: − Enter 10.0.0.1 as the destination IP address. − Enter 0.0.0.0 as the destination IP address wildcard. d. Click Add. Figure 330 ACL rule configuration Configuring 802.1X 1. Configure 802.1X globally: a. From the navigation tree, select Authentication > 802.1X. b. Select Enable 802.1X.
c. Select the authentication method CHAP. d. Click Apply. Figure 331 Configuring 802.1X globally 2. Configure 802.1X for GigabitEthernet 1/0/1: a. In the Ports With 802.1X Enabled area, click Add. b. Select GigabitEthernet1/0/1 from the Port list. c. Click Apply. Figure 332 Configuring 802.1X for GigabitEthernet 1/0/1 Verifying the configuration After the user passes authentication and gets online, use the ping command to test whether ACL 3000 takes effect. 1.
Figure 333 shows the ping operation summary.
Configuring AAA Overview Authentication, Authorization, and Accounting (AAA) provides a uniform framework for implementing network access management. It provides the following security functions: • Authentication—Identifies users and determines whether a user is valid. • Authorization—Grants user rights and controls user access to resources and services. For example, a user who has successfully logged in to the device can be granted read and print permissions to the files on the device.
AAA can be implemented through multiple protocols. The device supports RADIUS, which is most often used. For more information about RADIUS, see "Configuring RADIUS." Domain-based user management A NAS manages users based on ISP domains. On a NAS, each user belongs to one ISP domain. A NAS determines the ISP domain for a user by the username entered by the user at login.
Step Remarks Configuring authorization methods for the ISP domain 3. Configuring accounting methods for the ISP domain 4. Optional. Specify the authorization methods for various types of users. By default, all types of users use local authorization. Required. Specify the accounting methods for various types of users. By default, all types of users use local accounting. Configuring an ISP domain 1. Select Authentication > AAA from the navigation tree. The Domain Setup page appears.
Item Description Specify whether to use the ISP domain as the default domain. Options include: Default Domain • Enable—Uses the domain as the default domain. • Disable—Uses the domain as a non-default domain. There can only be one default domain at a time. If you specify another domain as the default domain, the original default domain becomes a non-default domain. Configuring authentication methods for the ISP domain 1. Select Authentication > AAA from the navigation tree. 2.
Item Description Configure the authentication method and secondary authentication method for LAN access users. LAN-access AuthN Name Secondary Method Options include: • • • • Local—Local authentication. None—No authentication. This method trusts all users and is not for general use. RADIUS—RADIUS authentication. You must specify the RADIUS scheme to be used. Not Set—The device uses the settings in the Default AuthN area for LAN access users.
Table 110 Configuration items Item Description Select an ISP domain Select the ISP domain for which you want to specify authentication methods. Configure the default authorization method and secondary authorization method for all types of users. Options include: Default AuthZ Name Secondary Method • HWTACACS—HWTACACS authorization. You must specify the HWTACACS scheme to be used. • • • • Local—Local authorization. None—This method trusts all users and assigns default rights to them.
Figure 338 Accounting method configuration page 3. Select the ISP domain and specify accounting methods for the ISP domain, as described in Table 111. 4. Click Apply. Table 111 Configuration items Item Description Select an ISP domain Select the ISP domain for which you want to specify authentication methods. Specify whether to enable the accounting optional feature.
Item Description Configure the accounting method and secondary accounting method for login users. Options include: Login Accounting Name Secondary Method • HWTACACS—HWTACACS accounting. You must specify the HWTACACS scheme to be used. • • • • Local—Local accounting. None—No accounting. RADIUS—RADIUS accounting. You must specify the RADIUS scheme to be used. Not Set—The device uses the settings in the Default Accounting area for login users.
Figure 340 Configuring a local user 4. Configure ISP domain test: a. Select Authentication > AAA from the navigation tree. The domain configuration page appears. b. Enter the domain name test. c. Click Apply.
5. Configure the ISP domain to use local authentication: a. Select Authentication > AAA from the navigation tree. b. Click the Authentication tab. c. Select the domain test. d. Select Login AuthN and select the authentication method Local. Figure 342 Configuring the ISP domain to use local authentication e. Click Apply. A configuration progress dialog box appears, as shown in Figure 343. f. After the configuration process is complete, click Close. Figure 343 Configuration progress dialog box 6.
f. After the configuration progress is complete, click Close. Figure 344 Configuring the ISP domain to use local authorization 7. Configure the ISP domain to use local accounting: a. Select Authentication > AAA from the navigation tree. b. Click the Accounting tab. c. Select the domain test. d. Select Login Accounting and select the accounting method Local. e. Click Apply. A configuration progress dialog box appears. f. After the configuration process is complete, click Close.
Configuring RADIUS Overview Remote Authentication Dial-In User Service (RADIUS) is a distributed information interaction protocol that uses a client/server model to implement AAA. It can protect networks against unauthorized access and is often used in network environments that require both high security and remote user access. For more information about AAA, see "Configuring AAA." RADIUS uses UDP port 1812 for authentication and UDP port 1813 for accounting.
Security and authentication mechanisms The RADIUS client and the RADIUS server use a shared key to authenticate RADIUS packets and encrypt user passwords exchanged between them. For security, this key must be manually configured on the client and the server. RADIUS servers support multiple authentication protocols, including PPP PAP and CHAP. A RADIUS server can act as the client of another AAA server to provide authentication proxy services.
7. The host requests the RADIUS client to tear down the connection and the RADIUS client sends a stop-accounting request (Accounting-Request) to the RADIUS server. 8. The RADIUS server returns an acknowledgement (Accounting-Response) and stops accounting for the user. RADIUS packet format RADIUS uses UDP to transmit messages. To ensure smooth message exchange between the RADIUS server and the client, RADIUS uses a timer management mechanism, a retransmission mechanism, and a backup server mechanism.
• The Length field (2 bytes long) indicates the length of the entire packet, including the Code, Identifier, Length, Authenticator, and Attribute fields. Bytes beyond this length are considered padding and are neglected upon reception. If the length of a received packet is less than this length, the packet is dropped. The value of this field is in the range 20 to 4096. • The Authenticator field (16 bytes long) is used to authenticate replies from the RADIUS server and to encrypt user passwords.
No. Attribute No.
Figure 349 Format of attribute 26 Protocols and standards • RFC 2865, Remote Authentication Dial In User Service (RADIUS) • RFC 2866, RADIUS Accounting • RFC 2867, RADIUS Accounting Modifications for Tunnel Protocol Support • RFC 2868, RADIUS Attributes for Tunnel Protocol Support • RFC 2869, RADIUS Extensions Configuring a RADIUS scheme A RADIUS scheme defines a set of parameters that the device uses to exchange information with the RADIUS servers.
Figure 351 RADIUS scheme configuration page 3. Configure the parameters as described in Table 114. 4. Click Apply. Table 114 Configuration items Item Description Scheme Name Enter a name for the RADIUS scheme. Common Configuration Configure the common parameters for the RADIUS scheme, including the server type, the username format, and the shared keys for authentication and accounting packets. For more information about common configuration, see "Configuring common parameters.
Figure 352 Common configuration 2. Configure the parameters, as described in Table 115. Table 115 Configuration items Item Description Select the type of the RADIUS servers supported by the device, which can be: • Standard—Standard RADIUS servers. The RADIUS client and RADIUS Server Type server communicate by using the standard RADIUS protocol and packet format defined in RFC 2138/2139 or later. • Extended—Extended RADIUS servers, usually running on CAMS or IMC.
Item Description Select the format of usernames to be sent to the RADIUS server. Username Format Typically, a username is in the format of userid@isp-name, of which isp-name is used by the device to determine the ISP domain for the user. If a RADIUS server (such as a RADIUS server of some early version) does not accept a username that contains an ISP domain name, you can configure the device to remove the domain name of a username before sending it to the RADIUS server.
Item Request Transmission Attempts Description Set the maximum number of attempts for transmitting a RADIUS packet to a single RADIUS server. If the device does not receive a response to its request from the RADIUS server within the response timeout period, it retransmits the RADIUS request. If the number of transmission attempts exceeds the limit but the device still does not receive a response from the RADIUS server, the device considers the request a failure.
Item Description Set the maximum number of stop-accounting attempts. The maximum number of stop-accounting attempts, together with some other parameters, controls how the NAS deals with stop-accounting request packets. Stop-Accounting Attempts Suppose that the RADIUS server response timeout period is three seconds, the maximum number of transmission attempts is five, and the maximum number of stop-accounting attempts is 20.
Table 116 Configuration items Item Description Server Type Select the type of the RADIUS server to be configured. Options include primary authentication server, primary accounting server, secondary authentication server, and secondary accounting server. Specify the IPv4 or IPv6 address of the RADIUS server. IP Address The IP addresses of the primary and secondary servers for a scheme must be different. Otherwise, the configuration fails.
c. Select Without domain name for the username format. 3. In the RADIUS Server Configuration area, click Add to configure the primary authentication server: a. Select Primary Authentication as the server type. b. Enter 10.110.91.146 as the IP address. c. Enter 1812 as the port. d. Enter expert as the key and enter expert again to confirm the key. e. Click Apply. Figure 355 RADIUS authentication server configuration page 4.
Figure 357 RADIUS scheme configuration Configuring AAA 1. Select Authentication > AAA in the navigation tree. The domain setup page appears. 2. On the domain setup page, configure a domain: a. Enter test for Domain Name. b. Click Enable to use the domain as the default domain. c. Click Apply.
3. Select the Authentication tab to configure the authentication scheme: a. Select the domain name test. b. Select Default AuthN and select RADIUS as the authentication mode. c. Select system from the Name list to use it as the authentication scheme. d. Click Apply. A configuration progress dialog box appears. e. After the configuration process is complete, click Close. Figure 359 Configuring the AAA authentication method for the ISP domain Figure 360 Configuration progress dialog box 4.
Figure 361 Configuring the AAA authorization method for the ISP domain 5. Select the Accounting tab to configure the accounting scheme: a. Select the domain name test. b. Select Accounting Optional and select Enable from the list. c. Select Default Accounting and select RADIUS as the accounting mode. d. Select system from the Name list to use it as the accounting scheme. e. Click Apply. A configuration progress dialog box appears. f. After the configuration process is complete, click Close.
• If you remove the accounting server used for online users, the device cannot send real-time accounting requests and stop-accounting messages for the users to the server, and the stop-accounting messages are not buffered locally. • The status of RADIUS servers, blocked or active, determines which servers the device will communicate with or turn to when the current servers are not available.
Configuring users You can configure local users and create groups to manage them. A local user represents a set of user attributes configured on a device (such as the user password, use type, service type, and authorization attribute), and is uniquely identified by the username. For a user to pass local authentication, you must add an entry for the user in the local user database of the device. For more information about local authentication, see "Configuring AAA.
Figure 364 Local user configuration page 3. Configure the local user as described in Table 118. 4. Click Apply. Table 118 Configuration items Item Description Username Specify a name for the local user. Password Confirm Password Encryption Group User-type Specify and confirm the password of the local user. The settings of these two fields must be the same. Do not specify a password starting with spaces because the spaces will be ignored.
Item Description Specify an expiration time for the local user, in the HH:MM:SS-YYYY/MM/DD format. Expire-time VLAN To authenticate a local user with the expiration time configured, the access device checks whether the expiration time has passed. If it has not passed, the device permits the user to log in. Specify the VLAN to be authorized to the local user after the user passes authentication. This option takes effect on only LAN users.
Figure 366 User group configuration page 4. Configure the user group as described in Table 119. 5. Click Apply. Table 119 Configuration items Item Description Group-name Specify a name for the user group. Level Select an authorization level for the user group: Visitor, Monitor, Configure, or Management, in ascending order of priority. VLAN Specify the VLAN to be authorized to users of the user group after the users pass authentication.
Managing certificates Overview The Public Key Infrastructure (PKI) offers an infrastructure for securing network services through public key technologies and digital certificates, and for verifying the identities of the digital certificate owners. A digital certificate is a binding of certificate owner identity information and a public key. Users can get certificates, use certificates, and revoke certificates.
Figure 367 PKI architecture Entity An entity is an end user of PKI products or services, such as a person, an organization, a device like a router or a switch, or a process running on a computer. CA A CA is a trusted authority responsible for issuing and managing digital certificates. A CA issues certificates, specifies the validity periods of certificates, and revokes certificates as needed by publishing CRLs. RA An RA is an extended part of a CA or an independent authority.
4. The RA receives the certificate from the CA, sends it to the LDAP server to provide directory navigation service, and notifies the entity that the certificate is successfully issued. 5. The entity retrieves the certificate. With the certificate, the entity can communicate with other entities safely through encryption and digital signature. 6. The entity makes a request to the CA when it needs to revoke its certificate.
Step Remarks Required. Create a PKI domain, setting the certificate request mode to Manual. 2. Creating a PKI domain Before requesting a PKI certificate, an entity needs to be configured with some enrollment information, which is called a PKI domain. A PKI domain is intended only for convenience of reference by other applications like IKE and SSL, and has only local significance. Required. Generate a local RSA key pair. By default, no local RSA key pair exists. 3.
Step Remarks Optional. Destroy the existing RSA key pair and the corresponding local certificate. 6. Destroying the RSA key pair 7. Retrieving and displaying a certificate Optional. Retrieving and displaying a CRL Optional. 8. If the certificate to be retrieved contains an RSA key pair, you must destroy the existing key pair. Otherwise, the retrieving operation will fail. Retrieve an existing certificate. Retrieve a CRL and display its contents.
Figure 368 PKI entity list 2. Click Add on the page. Figure 369 PKI entity configuration page 3. Configure the parameters, as described in Table 120. 4. Click Apply. Table 120 Configuration items Item Description Entity Name Enter the name for the PKI entity. Common Name Enter the common name for the entity. IP Address Enter the IP address of the entity. Enter the FQDN for the entity. FQDN Country/Region Code An FQDN is a unique identifier of an entity on the network.
Item Description State Enter the state or province for the entity. Locality Enter the locality for the entity. Organization Enter the organization name for the entity. Organization Unit Enter the unit name for the entity. Creating a PKI domain 1. From the navigation tree, select Authentication > Certificate Management. 2. Click the Domain tab. Figure 370 PKI domain list 3. Click Add. 4. Click Display Advanced Config to display the advanced configuration items.
Figure 371 PKI domain configuration page 5. Configure the parameters, as described in Table 121. 6. Click Apply. Table 121 Configuration items Item Description Domain Name Enter the name for the PKI domain. Enter the identifier of the trusted CA. CA Identifier An entity requests a certificate from a trusted CA. The trusted CA takes the responsibility of certificate registration, distribution, and revocation, and query. In offline mode, this item is optional. In other modes, this item is required.
Item Description Enter the URL of the RA. Requesting URL The entity will submit the certificate request to the server at this URL through the SCEP protocol. The SCEP protocol is intended for communication between an entity and an authentication authority. In offline mode, this item is optional. In other modes, this item is required. IMPORTANT: This item does not support domain name resolution. LDAP IP Enter the IP address, port number and version of the LDAP server.
Item Description Enter the URL of the CRL distribution point. The URL can be an IP address or a domain name. CRL URL This item is available after you click the Enable CRL Checking box. If the URL of the CRL distribution point is not set, you should get the CA certificate and a local certificate, and then get a CRL through SCEP. Generating an RSA key pair 1. From the navigation tree, select Authentication > Certificate Management. 2. Click the Certificate tab.
Figure 373 Key pair parameter configuration page Destroying the RSA key pair 1. From the navigation tree, select Authentication > Certificate Management. 2. Click the Certificate tab. 3. Click Destroy Key. 4. Click Apply to destroy the existing RSA key pair and the corresponding local certificate. Figure 374 Key pair destruction page Retrieving and displaying a certificate You can retrieve an existing CA certificate or local certificate from the CA server and save it locally.
Figure 375 PKI certificate retrieval page 4. Configure the parameters, as described in Table 122. 5. Click Apply. Table 122 Configuration items Item Description Domain Name Select the PKI domain for the certificate. Certificate Type Select the type of the certificate to be retrieved, which can be CA or local.
Figure 376 Certificate information Requesting a local certificate 1. From the navigation tree, select Authentication > Certificate Management. 2. Click the Certificate tab. 3. Click Request Cert.
Figure 377 Local certificate request page 4. Configure the parameters, as described in Table 123. Table 123 Configuration items 5. Item Description Domain Name Select the PKI domain for the certificate. Password Enter the password for certificate revocation. Enable Offline Mode Select this box to request a certificate in offline mode, that is, by an out-of-band means like FTP, disk, or email. Click Apply.
Retrieving and displaying a CRL 1. From the navigation tree, select Authentication > Certificate Management. 2. Click the CRL tab. Figure 379 CRL page 3. Click Retrieve CRL to retrieve the CRL of a domain. 4. Click View CRL for the domain to display the contents of the CRL. Figure 380 CRL information Table 124 Field description Field Description Version CRL version number. Signature Algorithm Signature algorithm that the CRL uses. Issuer CA that issued the CRL.
Field Description Last Update Last update time. Next Update Next update time. X509v3 CRL Number CRL sequence number X509v3 Authority Key Identifier Identifier of the CA that issued the certificate and the certificate version (X509v3). Pubic key identifier. keyid A CA might have multiple key pairs, and this field identifies which key pair is used for the CRL signature. No Revoked Certificates. No certificates are revoked.
Configuring the switch 1. Create a PKI entity: a. From the navigation tree, select Authentication > Certificate Management. The PKI entity list page is displayed by default. b. Click Add. c. Enter aaa as the PKI entity name, enter ac as the common name, and click Apply. Figure 382 Creating a PKI entity 2. Create a PKI domain: a. Click the Domain tab. b. Click Add. The page in Figure 383 appears. c.
Figure 383 Creating a PKI domain 3. Generate an RSA key pair: a. Click the Certificate tab. b. Click Create Key. c. Enter 1024 as the key length, and click Apply to generate an RSA key pair. Figure 384 Generating an RSA key pair 4. Retrieve the CA certificate: a. Click the Certificate tab. b. Click Retrieve Cert. c. Select torsa as the PKI domain, select CA as the certificate type, and click Apply.
Figure 385 Retrieving the CA certificate 5. Request a local certificate: a. Click the Certificate tab. b. Click Request Cert. c. Select torsa as the PKI domain, select Password , and enter challenge-word as the password. d. Click Apply. The system displays "Certificate request has been submitted." e. Click OK to finish the operation. Figure 386 Requesting a local certificate 6. Retrieve the CRL: a. Click the CRL tab. b. Click Retrieve CRL of the PKI domain of torsa.
Authentication > Certificate Management > CRL from the navigation tree to view detailed information about the retrieved CRL. Configuration guidelines When you configure PKI, follow these guidelines: • Make sure the clocks of entities and the CA are synchronous. Otherwise, the validity period of certificates will be abnormal. • The Windows 2000 CA server has some restrictions on the data length of a certificate request.
Configuring MAC authentication Overview MAC authentication controls network access by authenticating source MAC addresses on a port. It does not require client software. A user does not need to enter a username and password for network access. The device initiates a MAC authentication process when it detects an unknown source MAC address on a MAC authentication enabled port. If the MAC address passes authentication, the user can access authorized network resources.
MAC authentication timers MAC authentication uses the following timers: • Offline detect timer—Sets the interval that the device waits for traffic from a user before it regards the user idle. If a user connection has been idle for two consecutive intervals, the device logs the user out and stops accounting for the user. • Quiet timer—Sets the interval that the device must wait before it can perform MAC authentication for a user that has failed MAC authentication.
If a user in the Auth-Fail VLAN passes MAC authentication, it is removed from the Auth-Fail VLAN and can access all authorized network resources. If not, the user is still in the Auth-Fail VLAN. A hybrid port is always assigned to an Auth-Fail VLAN as an untagged member. After the assignment, do not re-configure the port as a tagged member in the VLAN. Configuration prerequisites Before you configure MAC authentication, complete the following tasks: 1. Configure an ISP domain and specify an AAA method.
Figure 388 MAC authentication configuration page 3. Configure MAC authentication global settings as described in Table 125, and then click Apply. Table 125 Configuration items Item Description Enable MAC Authentication Specifies whether to enable MAC authentication globally. Offline Detection Period Sets the period that the device waits for traffic from a user before it regards the user idle.
Configuring MAC authentication on a port 1. From the navigation tree, select Authentication > MAC Authentication. 2. In the Ports With MAC Authentication Enabled area, click Add. Figure 389 Configuring MAC authentication on a port 3. Configure MAC authentication for a port as described in Table 126, and then click Apply. Table 126 Configuration items Item Description Port Selects a port on which you want to enable MAC authentication. Specifies whether to enable MAC-based VLAN on the port.
• Configure all users to belong to the domain aabbcc.net, and specify local authentication for users in the domain. • Use the MAC address of each user as the username and password for authentication, and require that the MAC addresses is hyphenated and in lower case. • Configure the access device to detect whether a user has gone offline every 180 seconds. When a user fails authentication, the device does not authenticate the user within 180 seconds.
Figure 392 Configuring the authentication method for the ISP domain 6. Click Apply. A configuration progress dialog box appears, as shown in Figure 393. Figure 393 Configuration progress dialog box 7. After the configuration process is complete, click Close. Configuring MAC authentication 1. Configure MAC authentication globally: a. From the navigation tree, select Authentication > MAC Authentication. b. Select Enable MAC Authentication. c. Click Advanced, and configure advanced MAC authentication. d.
Figure 394 Configuring MAC authentication globally 2. Configure MAC authentication for GigabitEthernet 1/0/1: a. In the Ports With MAC Authentication Enabled area, click Add. b. Select GigabitEthernet1/0/1 from the Port list, and click Apply. Figure 395 Enabling MAC authentication for port GigabitEthernet 1/0/1 ACL assignment configuration example Network requirements As shown in Figure 396, the switch uses RADIUS servers to perform authentication, authorization, and accounting.
Figure 396 Network diagram RADIUS servers Auth:10.1.1.1 Acct:10.1.1.2 GE1/0/1 Host Internet Switch FTP server 192.168.1.10 10.0.0.1 Configuring IP addresses # Assign an IP address to each interface. Make sure the RADIUS servers, host, and switch can reach each other. (Details not shown.) Configuring the RADIUS servers # Add a user account with the host MAC address unhyphenated as both the username and password, and specify ACL 3000 as the authorization ACL for the user account. (Details not shown.
Figure 397 Configuring a RADIUS authentication server 3. Configure the primary accounting server in the RADIUS scheme: a. In the RADIUS Server Configuration area, click Add. b. Configure the primary accounting server: − Select the server type Primary Accounting. − Enter the IP address 10.1.1.2, and enter the port number 1813. − Enter expert in the Key field and the Confirm Key field. c. Click Apply. Figure 398 Configuring a RADIUS accounting server 4. On the RADIUS configuration page, click Apply.
Figure 399 RADIUS configuration Configuring AAA for the scheme 1. Create an ISP domain: a. From the navigation tree, select Authentication > AAA. b. On the Domain Setup page, enter test in the Domain Name field and click Apply.
Figure 400 Creating an ISP domain 2. Configure AAA authentication method for the ISP domain: a. Click the Authentication tab. b. Select the ISP domain test. c. Select Default AuthN, select the authentication method RADIUS, and select the authentication scheme system from the Name list. Figure 401 Configuring the authentication method for the ISP domain d. Click Apply. A configuration progress dialog box appears, as shown in Figure 402.
Figure 402 Configuration progress dialog box e. After the configuration process is complete, click Close. 3. Configure AAA authorization method for the ISP domain: a. Click the Authorization tab. b. Select the ISP domain test. c. Select Default AuthZ, select the authorization mode RADIUS, and select the authorization scheme system from the Name list. d. Click Apply. Figure 403 Configuring the authorization method for the ISP domain e. After the configuration process is complete, click Close. 4.
Figure 404 Configuring the accounting method for the ISP domain e. After the configuration process is complete, click Close. Configuring an ACL 1. From the navigation tree, select QoS > ACL IPv4. 2. Click the Add tab. 3. Enter the ACL number 3000, and then click Apply. Figure 405 Adding ACL 3000 4. Click the Advanced Setup tab. 5. Configure the following parameters: a. Select the ACL 3000. b. Select Rule ID, and enter the rule ID 0.
c. Select the action Deny. d. In the IP Address Filter area, select Destination IP Address: − Enter the destination IP address 10.0.0.1. − Enter the destination address wildcard 0.0.0.0. e. Click Add. Figure 406 Configuring an ACL rule Configuring MAC authentication 1. Configure MAC authentication globally: a. From the navigation tree, select Authentication > MAC Authentication.
b. Select Enable MAC Authentication. c. Click Advanced. d. Select the authentication ISP domain test, select the authentication information format MAC without hyphen, and click Apply. Figure 407 Configuring MAC authentication globally 2. Configure MAC authentication for GigabitEthernet 1/0/1: a. In the Ports With MAC Authentication Enabled area, click Add. b. Select the port GigabitEthernet1/0/1, and click Apply.
Request timed out. Request timed out. Ping statistics for 10.0.0.
Configuring port security Overview Port security combines and extends 802.1X and MAC authentication to provide MAC-based network access control. It applies networks that require different authentication methods for different users on a port. Port security prevents unauthorized access to a network by checking the source MAC address of inbound traffic and prevents access to unauthorized devices by checking the destination MAC address of outbound traffic.
• Basic mode—In this mode, a port can learn the specified number of MAC addresses and save those addresses as secure MAC addresses. It permits only frames whose source MAC addresses are secure MAC addresses or configured static MAC addresses. When the number of secure MAC addresses reaches the upper limit, no more secure MAC addresses can be added. • Advanced mode—Port security supports 802.1X and MAC authentication. Different port security modes represent different combinations of the two methods.
The maximum number of users a port supports equals the maximum number of secure MAC addresses that port security allows or the maximum number of concurrent users the authentication mode in use allows, whichever is smaller. An OUI is a 24-bit number that uniquely identifies a vendor, manufacturer, or organization. In MAC addresses, the first three octets are the OUI.
Step Remarks Required. 1. Configuring global settings for port security This function enables port security globally and configures intrusion protection actions. By default, port security is disabled globally. Required. 2. Configuring advanced port security control This function configures the advanced port security mode, intrusion protection action, or outbound restriction, and selects whether to ignore the authorization information from the RADIUS server.
Figure 410 Port security configuration 3. Configure global port security settings as described in Table 128. 4. Click Apply. Table 128 Configuration items Item Enable Port Security Description Specifies whether to enable the port security feature globally. By default, port security is disabled. Configures intrusion protection actions globally.
The page for applying port security control appears. Figure 412 Configuring basic port security control 3. Configure basic port security control settings as described in Table 129. 4. Click Apply. Table 129 Configuration items Item Description Selects a port where you want to configure port security. Port By default, port security is disabled on all ports, and access to the ports is not restricted. Sets the maximum number of secure MAC addresses on the port.
Item Description Specifies whether to enable outbound traffic control, and selects a control method. Available control methods: • Only MAC-Known Unicasts—Allows only unicast frames with their destination Enable Outbound Restriction MAC addresses being authenticated to pass through. • Only Broadcasts and MAC-Known Unicasts—Allows only broadcast and unicast packets with their destination MAC addresses being authenticated to pass through.
Table 130 Configuration items Item Description Port Selects a port where the secure MAC address is configured. Secure MAC Address Enters the MAC address that you want to configure as a secure MAC address. Enters the ID of the VLAN in which the secure MAC address is configured. VLAN ID The VLAN must already exist on the selected port. Configuring advanced port security control 1. From the navigation tree, select Authentication > Port Security. The Port Security page appears. 2.
Item Description Specifies whether to enable intrusion protection, and selects an action to be taken upon detection of illegal frames. Available actions: • Disable Port Temporarily—Disables the port for a period of time. The period can be Enable Intrusion Protection configured in the global settings. For more information, see "Configuring global settings for port security." • Disable Port Permanently—Disables the port permanently upon detecting an illegal frame received on the port.
Port security configuration examples Basic port security mode configuration example Network requirements As shown in Figure 418, configure port GigabitEthernet 1/0/3 of the switch as follows: • Allow up to three users to access the port without authentication, and permit the port to learn the MAC addresses of the users as secure MAC addresses. • After the number of secure MAC addresses reaches 3, the port stops learning MAC addresses.
Figure 419 Configuring port security Configuring the basic port security control 1. In the Security Ports And Secure MAC Address List area, click Add. 2. On the page that appears, select GigabitEthernet1/0/3. 3. Enter 3 as the maximum number of MAC addresses. 4. Select Enable Intrusion Protection, and select Disable Port Temporarily from the list. 5. Click Apply. Figure 420 Applying the port security feature Verifying the configuration 1.
Figure 421 Secure MAC address list 2. When the maximum number of MAC addresses is reached, intrusion protection is triggered. Select Device > Port Management from the navigation tree, and then select the Detail tab. On the page, click the target port (GigabitEthernet 1/0/3 in this example) to view details. Figure 422 shows that the port state is inactive. Figure 422 Displaying port state 3. Re-select GigabitEthernet 1/0/3 to refresh its data 30 seconds later.
Figure 423 Displaying port state If you remove MAC addresses from the secure MAC address list, the port can continue to learn MAC addresses. Advanced port security mode configuration example Network requirements As shown in Figure 424, the switch authenticates the client with a RADIUS server. If the authentication succeeds, the client is authorized to access the Internet. • The RADIUS server at 192.168.1.
NOTE: Configurations on the host and RADIUS servers are not shown. Configuring a RADIUS scheme 1. Create a RADIUS scheme: a. From the navigation tree, select Authentication > RADIUS. b. Click Add. c. On the page that appears, configure a RADIUS scheme: − Enter the scheme name system. − Select the service type Extended. − Select Without domain name from the Username Format list. d. Click Apply. 2. Configure the primary authentication server in the RADIUS scheme: a.
Figure 426 Configuring the RADIUS accounting server c. Click Apply. The RADIUS Server Configuration area displays the servers you have configured, as shown in Figure 427. Figure 427 Configuring the RADIUS scheme 4. Click Apply. Configuring AAA 1. Configure AAA authentication method: a. From the navigation tree, select Authentication > AAA. b. Click the Authentication tab. c. Select the ISP domain system. d.
Figure 428 Configuring AAA authentication e. Click Apply. A dialog box appears, displaying the configuration progress, as shown in Figure 429. Figure 429 Configuration progress dialog box f. When the configuration process is complete, click Close. 2. Configure AAA authorization method: a. Click the Authorization tab. b. Select the ISP domain system. c. Select Default AuthZ, select authorization method RADIUS from the list, and select the authorization scheme system from the Name list. d. Click Apply.
Figure 430 Configuring AAA authorization e. When the configuration process is complete, click Close. 3. Configure AAA accounting method: a. Click the Accounting tab. b. Select the ISP domain system. c. Select Default Accounting, select the accounting method RADIUS from the list, and select the accounting scheme system from the Name list. d. Click Apply. Figure 431 Configuring AAA accounting e. When the configuration process is complete, click Close. Configuring port security 1. Enable port security: a.
Figure 432 Configuring global port security settings 2. Configure advanced port security control: a. In the Advanced Port Security Configuration area, click Ports Enabled With Advanced Features, and then click Add. b. Select GigabitEthernet1/0/1 from the Port list, and select 802.1X MAC Based Or OUI from the Security Mode list. c. Click Apply. Figure 433 Configuring advanced port security control settings on GigabitEthernet 1/0/1 3. Add permitted OUIs: a.
Figure 434 Configuring permitted OUI values d. Repeat previous three steps to add the OUI values of the MAC addresses 1234-0200-0000 and 1234-0300-0000.
Configuring port isolation The port isolation feature isolates Layer 2 traffic for data privacy and security without using VLANs. You can also use this feature to isolate the hosts in a VLAN from one another. The switch supports only one isolation group that is automatically created as isolation group 1. You cannot remove the isolation group or create other isolation groups on the device. The number of ports assigned to the isolation group is not limited.
Port isolation configuration example Network requirements As shown in Figure 436: • Campus network users Host A, Host B, and Host C are connected to GigabitEthernet 1/0/2, GigabitEthernet 1/0/3, and GigabitEthernet 1/0/4 of Switch. • Switch is connected to the external network through GigabitEthernet 1/0/1. • GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, GigabitEthernet 1/0/3, and GigabitEthernet 1/0/4 belong to the same VLAN.
Figure 437 Assigning ports to the isolation group e. Click Apply. A configuration progress dialog box appears. f. After the configuration process is complete, click Close. Viewing information about the isolation group 1. Click Summary. 2. Display port isolation group 1, which contains ports GigabitEthernet 1/0/2, GigabitEthernet 1/0/3, and GigabitEthernet 1/0/4.
Configuring authorized IP The authorized IP function associates the HTTP or Telnet service with an ACL to filter the requests of clients. Only the clients that pass the ACL filtering can access the device. Configuration procedure 1. From the navigation tree, select Security > Authorized IP. 2. Click Setup to enter the authorized IP configuration page. Figure 439 Authorized IP configuration page 3. Configure authorized IP as described in Table 133. 4. Click Apply.
Authorized IP configuration example Network requirements In Figure 440, configure Switch to deny Telnet and HTTP requests from Host A, and permit Telnet and HTTP requests from Host B. Figure 440 Network diagram Configuration procedure 1. Create an ACL: a. From the navigation tree, select QoS > ACL IPv4. b. Click Create. c. Enter 2001 for ACL Number. d. Click Apply. Figure 441 Creating an ACL 2.
a. Click Basic Setup. The page for configuring an ACL rule appears. b. Select 2001 from the ACL list, select Permit from the Action list, select the Source IP Address box and enter 10.1.1.3, and then enter 0.0.0.0 in the Source Wildcard field. c. Click Add. Figure 442 Configuring an ACL rule to permit Host B 3. Configure authorized IP: a. From the navigation tree, select Security > Authorized IP. b. Click Setup. The authorized IP configuration page appears. c.
Figure 443 Configuring authorized IP 446
Configuring loopback detection A loop occurs when a port receives a packet sent by itself. Loops might cause broadcast storms. The purpose of loopback detection is to detect loops on ports. With loopback detection enabled on an Ethernet port, the device periodically checks for loops on the port. If the device detects a loop on the port, it operates on the port according to the preconfigured loopback detection actions.
Figure 444 Loopback detection configuration page 2. Configure the global loopback detection settings as described in Table 134, and then click Apply. Table 134 Configuration items Item Description Enable loopback detection on the system Sets whether to enable loopback detection globally. Loopback Detection Interval Sets the loopback detection interval. Configuring loopback detection on a port 1. From the navigation tree, select Security > Loopback Detection.
Item Description Sets whether the system performs loopback detection in all VLANs for the target trunk or hybrid port. Detection in VLAN If you select Disable, the system performs loopback detection only in the default VLAN of the target trunk or hybrid port. This configuration item is available only for a trunk or hybrid port.
Configuring ACLs Unless otherwise stated, ACLs refer to both IPv4 and IPv6 ACLs throughout this document. Grayed-out options on Web configuration pages cannot be configured. Overview An access control list (ACL) is a set of rules (or permit or deny statements) for identifying traffic based on criteria such as source IP address, destination IP address, and port number. ACLs are essentially used for packet filtering.
Table 136 Depth-first match for ACLs ACL category IPv4 basic ACL IPv4 advanced ACL IPv6 basic ACL IPv6 advanced ACL Ethernet frame header ACL Sequence of tie breakers 1. More 0s in the source IP address wildcard (more 0s means a narrower IP address range). 2. Smaller rule ID. 1. Specific protocol number. 2. More 0s in the source IP address wildcard mask. 3. More 0s in the destination IP address wildcard. 4. Narrower TCP/UDP service port number range. 5. Smaller ID. 1.
For example, if the numbering step is 5 (the default), and there are five ACL rules numbered 0, 5, 9, 10, and 12, the newly defined rule is numbered 15. If the ACL does not contain any rule, the first rule is numbered 0. Whenever the step changes, the rules are renumbered, starting from 0. For example, if there are five rules numbered 5, 10, 13, 15, and 20, changing the step from 5 to 2 causes the rules to be renumbered 0, 2, 4, 6, and 8.
Step Remarks 3. Configuring a rule for a basic IPv4 ACL. Required. 4. Configuring a rule for an advanced IPv4 ACL. 5. Configuring a rule for an Ethernet frame header ACL. Complete one of the following tasks according to the ACL category. Recommended IPv6 ACL configuration procedure Step Remarks Optional. 1. Configuring a time range. 2. Adding an IPv6 ACL. Add an IPv6 ACL. The category of the added IPv6 ACL depends on the ACL number that you specify. 3.
4. Click Apply. Table 137 Configuration items Item Description Time Range Name Set the name for the time range. Periodic Time Range Start Time Set the start time of the periodic time range. End Time Set the end time of the periodic time range. The end time must be greater than the start time. Sun, Mon, Tue, Wed, Thu, Fri, and Sat. Select the day or days of the week on which the periodic time range is valid. You can select any combination of the days of the week.
Table 138 Configuration items Item Description ACL Number Set the number of the IPv4 ACL. Set the match order of the ACL. Available values are: Match Order • Config—Packets are compared against ACL rules in the order that the rules are configured. • Auto—Packets are compared against ACL rules in the depth-first match order. Description Set the description for the ACL. Configuring a rule for a basic IPv4 ACL 1. Select QoS > ACL IPv4 from the navigation tree. 2. Click the Basic Setup tab.
Table 139 Configuration items Item Description Select the basic IPv4 ACL for which you want to configure rules. ACL Available ACLs are basic IPv4 ACLs. Select the Rule ID box and enter a number for the rule. Rule ID If you do not specify the rule number, the system will assign one automatically. If the rule number you specify already exists, the following operations modify the configuration of the rule.
Figure 448 Configuring an advanced IPv4 ACL 3. Configure a rule for an advanced IPv4 ACL as described in Table 140. 4. Click Add. Table 140 Configuration items Item Description ACL Select the advanced IPv4 ACL for which you want to configure rules. Available ACLs are advanced IPv4 ACLs.
Item Description Select the Rule ID box and enter a number for the rule. If you do not specify the rule number, the system will assign one automatically. Rule ID If the rule number you specify already exists, the following operations modify the configuration of the rule. Select the action to be performed for packets matching the rule: • Permit—Allows matched packets to pass. • Deny—Drops matched packets. Action Select this box to apply the rule to only non-first fragments.
Item Description TCP Connection Established Source Operator Port Operator TCP/UDP Port Select this box to make the rule match packets used for establishing and maintaining TCP connections. These items are available only when you select 6 TCP from the Protocol list. Select the operators and enter the source port numbers and destination port numbers as required. These items are available only when you select 6 TCP or 17 UDP from the Protocol list.
Figure 449 Configuring a rule for an Ethernet frame header ACL 3. Configure a rule for an Ethernet frame header IPv4 ACL as described in Table 141. 4. Click Add. Table 141 Configuration items Item Description ACL Select the Ethernet frame header IPv4 ACL for which you want to configure rules. Available ACLs are Ethernet frame header IPv4 ACLs. Select the Rule ID box and enter a number for the rule. Rule ID If you do not specify the rule number, the system will assign one automatically.
Item Description Source MAC Address MAC Address Filter Source Mask Destination MAC Address Destination Mask COS(802.1p priority) Type Filter Select the Source MAC Address box and enter a source MAC address and a mask. Select the Destination MAC Address box and enter a destination MAC address and a mask. Specify the 802.1p priority for the rule.
Table 142 Configuration items Item Description ACL Number Enter a number for the IPv6 ACL. Select a match order for the ACL. Available values are: Match Order • Config—Packets are compared against ACL rules in the order the rules are configured. • Auto—Packets are compared against ACL rules in the depth-first match order. Description Set the description for the ACL. Configuring a rule for a basic IPv6 ACL 1. Select QoS > ACL IPv6 from the navigation tree. 2. Click the Basic Setup tab.
Item Description Select the Rule ID box and enter a number for the rule. Rule ID If you do not specify the rule number, the system will assign one automatically. If the rule number you specify already exists, the following operations modify the configuration of the rule. Select the operation to be performed for IPv6 packets matching the rule: Operation Check Fragment • Permit—Allows matched packets to pass. • Deny—Drops matched packets. Select this box to apply the rule to only non-first fragments.
Figure 452 Configuring a rule for an advanced IPv6 ACL 3. Add a rule for an advanced IPv6 ACL as described in Table 144. 4. Click Add. Table 144 Configuration items Item Description Select Access Control List (ACL) Select the advanced IPv6 ACL for which you want to configure rules. Select the Rule ID box and enter a number for the rule. Rule ID If you do not specify the rule number, the system will assign one automatically.
Item Description Select this box to apply the rule to only non-first fragments. Check Fragment If you do no select this box, the rule applies to all fragments and non-fragments. Select this box to keep a log of matched IPv6 packets. A log entry contains the ACL rule number, operation for the matched packets, protocol number, source/destination address, source/destination port number, and number of matched packets. Check Logging This function is not supported.
Configuring QoS Grayed-out options on Web configuration pages cannot be configured. Overview Quality of Service (QoS) reflects the ability of a network to meet customer needs. In an internet, QoS evaluates the ability of the network to forward packets of different services. The evaluation can be based on different criteria because the network might provide various services.
Congestion: causes, impacts, and countermeasures Network congestion is a major factor contributed to service quality degrading on a traditional network. Congestion is a situation where the forwarding rate decreases due to insufficient resources, resulting in extra delay. Causes Congestion easily occurs in complex packet switching circumstances in the Internet.
End-to-end QoS Figure 454 End-to-end QoS model Traffic classification Traffic policing Traffic classification Traffic policing Traffic policing Traffic policing WAN Congestion management Congestion management Congestion avoidance Traffic shaping Congestion avoidance Traffic shaping Congestion management Congestion management Congestion avoidance Traffic shaping Congestion avoidance Traffic shaping As shown in Figure 454, traffic classification, traffic policing, traffic shaping, congestion managemen
When packets are classified on the network boundary, the precedence bits in the ToS field of the IP packet header are generally re-set. In this way, IP precedence can be directly used to classify the packets in the network. IP precedence can also be used in queuing to prioritize traffic. The downstream network can either use the classification results from its upstream network or classify the packets again according to its own criteria.
Table 146 Description on DSCP values DSCP value (decimal) DSCP value (binary) Description 46 101110 ef 10 001010 af11 12 001100 af12 14 001110 af13 18 010010 af21 20 010100 af22 22 010110 af23 26 011010 af31 28 011100 af32 30 011110 af33 34 100010 af41 36 100100 af42 38 100110 af43 8 001000 cs1 16 010000 cs2 24 011000 cs3 32 100000 cs4 40 101000 cs5 48 110000 cs6 56 111000 cs7 0 000000 be (default) 802.1p priority 802.
Figure 457 802.1Q tag header Byte 1 Byte 2 Byte 3 TPID (Tag protocol identifier) Byte 4 TCI (Tag control information) 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 Priority CFI VLAN ID 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 Table 147 Description on 802.1p priority 802.1p priority (decimal) 802.
Figure 458 SP queuing A typical switch provides eight queues per port. As shown in Figure 458, SP queuing classifies eight queues on a port into eight classes, numbered 7 to 0 in descending priority order. SP queuing schedules the eight queues strictly according to the descending order of priority. It sends packets in the queue with the highest priority first. When the queue with the highest priority is empty, it sends packets in the queue with the second highest priority, and so on.
A typical switch provides eight output queues per port. WRR assigns each queue a weight value (represented by w7, w6, w5, w4, w3, w2, w1, or w0) to decide the proportion of resources assigned to the queue. On a 100 Mbps port, you can set the weight values of WRR queuing to 25, 25, 15, 15, 5, 5, 5, and 5 (corresponding to w7, w6, w5, w4, w3, w2, w1, and w0, respectively).
specification, and the traffic is called "conforming traffic." Otherwise, the traffic does not conform to the specification, and the traffic is called "excess traffic." A token bucket has the following configurable parameters: • Mean rate—Rate at which tokens are put into the bucket, or the permitted average rate of traffic. It is usually set to the committed information rate (CIR). • Burst size—The capacity of the token bucket, or the maximum traffic size permitted in each burst.
• For more information about 802.1p priority and DSCP values, see "Packet precedences." • Local precedence is a locally significant precedence that the device assigns to a packet. A local precedence value corresponds to an output queue. Packets with the highest local precedence are processed preferentially.
Table 149 Default DSCP to Queue mapping table Input DSCP value Local precedence (Queue) 0 to 7 0 8 to 15 1 16 to 23 2 24 to 31 3 32 to 39 4 40 to 47 5 48 to 55 6 56 to 63 7 Configuration guidelines When an ACL is referenced by a QoS policy for traffic classification, the action (permit or deny) in the ACL is ignored, and the actions in the associated traffic behavior are performed.
Table 150 Recommended QoS policy configuration procedure Step Remarks Required. 1. Adding a class 2. Configuring classification rules 3. Adding a traffic behavior 4. Configure actions for the behavior: { { 5. Add a class and specify the logical relationship between the match criteria in the class. Required. Configure match criteria for the class. Required. Add a traffic behavior.
Recommended priority trust mode configuration procedure Step Remarks Required. Configuring priority trust mode on a port 1. Set the priority trust mode of a port. Adding a class 1. Select QoS > Classifier from the navigation tree. 2. Click the Add tab to enter the page for adding a class. Figure 463 Adding a class 3. Add a class as described in Table 151. 4. Click Add. Table 151 Configuration items Item Description Classifier Name Specify a name for the classifier to be added.
Configuring classification rules 1. Select QoS > Classifier from the navigation tree. 2. Click Setup to enter the page for setting a class. Figure 464 Configuring classification rules 3. Configure classification rules for a class as described in Table 152. 4. Click Apply.
Table 152 Configuration items Item Description Define a rule to match customer VLAN IDs. If multiple such rules are configured for a class, the new configuration does not overwrite the previous one. VLAN ACL Customer VLAN You can configure only one VLAN ID at a time. Otherwise, the relevant QoS policy fails to be applied. If the same VLAN ID is specified multiple times, the system considers them as one. The relationship between different VLAN IDs is logical OR. ACL IPv4 Define an IPv4 ACL-based rule.
Configuring traffic mirroring and traffic redirecting for a traffic behavior 1. Select QoS > Behavior from the navigation tree. 2. Click Port Setup to enter the port setup page for a traffic behavior. Figure 466 Port setup page for a traffic behavior 3. Configure traffic mirroring and traffic redirecting as described in Table 154. 4. Click Apply. Table 154 Configuration items Item Description Please select a behavior Select an existing behavior in the list.
Figure 467 Setting a traffic behavior 3. Configure other actions for a traffic behavior as described in Table 155. 4. Click Apply. Table 155 Configuration items Item Description Please select a behavior Select an existing behavior in the list. CAR Enable or disable CAR.
Item Description CIR Set the committed information rate (CIR), the average traffic rate. CBS Set the committed burst size (CBS), number of bytes that can be sent in each interval. This function is not supported in the current software version, and it is reserved for future support. Set the action to perform for exceeding packets. Discard After selecting the Red box, you can select one of the following options: • Discard—Drops the exceeding packet. • Pass—Permits the exceeding packet to pass through.
Table 156 Configuration items Item Description Specify a name for the policy to be added. Policy Name Some devices have their own system-defined policies. The policy name you specify cannot overlap with system-defined ones. The system-defined policy is the policy default. Configuring classifier-behavior associations for the policy 1. Select QoS > QoS Policy from the navigation tree. 2. Click Setup to enter the page for setting a policy. Figure 469 Setting a policy 3.
Figure 470 Applying a policy to a port 3. Apply a policy to a port as described in Table 158. 4. Click Apply. Table 158 Configuration items Item Description Please select a policy Select an existing policy in the list. Set the direction in which the policy is to be applied. Direction • Inbound—Applies the policy to the incoming packets of the specified ports. • Outbound—Applies the policy to the outgoing packets of the specified ports.
Table 159 Configuration items Item Description WRR Queue WRR Setup Enable or disable the WRR queue scheduling mechanism on selected ports. The following options are available: • Enable—Enables WRR on selected ports. • Not Set—Restores the default queuing algorithm on selected ports. Select the queue to be configured. The value range for a queue ID is 0 to 7. Specify the group the current queue is to be assigned to. Group This list is available after you select a queue ID.
Item Description Rate Limit Enable or disable rate limit on the specified port. Select a direction in which the rate limit is to be applied. Direction CIR • Inbound—Limits the rate of packets received on the specified port. • Outbound—Limits the rate of packets sent by the specified port. • Both—Limits the rate of packets received and sent by the specified port. Set the committed information rate (CIR), the average traffic rate. Specify the ports to be configured with rate limit.
Configuring priority trust mode on a port 1. Select QoS > Port Priority from the navigation tree. Figure 474 Configuring port priorities 2. Click the icon for a port. Figure 475 Modifying the port priority 3. Configure the port priority for a port as described in Table 162. 4. Click Apply. Table 162 Configuration items Item Description Interface Interface to be configured. Priority Set a local precedence value for the port.
ACL and QoS configuration example Network requirements As shown in Figure 476, the FTP server (10.1.1.1/24) is connected to the Switch, and the clients access the FTP server through GigabitEthernet 1/0/1 of the Switch. Configure an ACL and a QoS policy as follows to prevent the hosts from accessing the FTP server from 8:00 to 18:00 every day: 1. Add an ACL to prohibit the hosts from accessing the FTP server from 8:00 to 18:00 every day. 2. Configure a QoS policy to drop the packets matching the ACL. 3.
Figure 477 Defining a time range covering 8:00 to 18:00 every day 2. Add an advanced IPv4 ACL: a. Select QoS > ACL IPv4 from the navigation tree. b. Click the Add tab. c. Enter the ACL number 3000. d. Click Apply. Figure 478 Adding an advanced IPv4 ACL 3. Define an ACL rule for traffic to the FTP server: a. Click the Advanced Setup tab. b. Select 3000 in the ACL list.
c. Select the Rule ID box, and enter rule ID 2. d. Select Permit in the Action list. e. Select the Destination IP Address box, and enter IP address 10.1.1.1 and destination wildcard 0.0.0.0. f. Select test-time in the Time Range list. g. Click Add. Figure 479 Defining an ACL rule for traffic to the FTP server 4. Add a class: a. Select QoS > Classifier from the navigation tree. b. Click the Add tab.
c. Enter the class name class1. d. Click Add. Figure 480 Adding a class 5. Define classification rules: a. Click the Setup tab. b. Select the class name class1 in the list. c. Select the ACL IPv4 box, and select ACL 3000 in the following list.
Figure 481 Defining classification rules d. Click Apply. A progress dialog box appears, as shown in Figure 482. e. Click Close on the progress dialog box when the progress dialog box prompts that the configuration succeeds.
Figure 482 Configuration progress dialog box 6. Add a traffic behavior: a. Select QoS > Behavior from the navigation tree. b. Click the Add tab. c. Enter the behavior name behavior1. d. Click Add. Figure 483 Adding a traffic behavior 7. Configure actions for the traffic behavior: a. Click the Setup tab. b. Select behavior1 in the list. c. Select the Filter box, and then select Deny in the following list. d. Click Apply. A progress dialog box appears. e.
Figure 484 Configuring actions for the behavior 8. Add a policy: a. Select QoS > QoS Policy from the navigation tree. b. Click the Add tab. c. Enter the policy name policy1. d. Click Add. Figure 485 Adding a policy 9.
a. Click the Setup tab. b. Select policy1. c. Select class1 from the Classifier Name list. d. Select behavior1 from the Behavior Name list. e. Click Apply. Figure 486 Configuring classifier-behavior associations for the policy 10. Apply the QoS policy in the inbound direction of interface GigabitEthernet 1/0/1: a. Select QoS > Port Policy from the navigation tree. b. Click the Setup tab. c. Select policy1 from the Please select a policy list. d. Select Inbound from the Direction list. e.
Configuring PoE Only a device with a mark of PoE supports the PoE feature. Overview IEEE 802.3af-compliant power over Ethernet (PoE) enables a power sourcing equipment (PSE) to supply power to powered devices (PDs) through Ethernet interfaces over straight-through twisted pair cables. Examples of PDs include IP telephones, wireless APs, portable chargers, card readers, Web cameras, and data collectors. A PD can also use a different power source from the PSE at the same time for power redundancy.
Configuring PoE Before configuring PoE, make sure the PoE power supply and PSE are operating correctly. Otherwise, either you cannot configure PoE or the PoE configuration does not take effect. Configuring PoE ports 1. Select PoE > PoE from the navigation tree. 2. Click the Port Setup tab. Figure 489 Port Setup tab 3. Configure the PoE ports as described in Table 163. 4. Click Apply.
Item Description Set the maximum power for the PoE port. Power Max The maximum PoE interface power is the maximum power that the PoE interface can provide to the connected PD. If the PD requires more power than the maximum PoE interface power, the PoE interface does not supply power to the PD. By default, the maximum power of a PoE port is 30 watts. Set the power supply priority for a PoE port. In descending order, the power-supply priority levels of a PoE port are critical, high, and low.
Figure 490 PSE Setup tab Enabling the non-standard PD detection function for a PSE 1. Select Enable in the corresponding Non-Standard PD Compatibility column. 2. Click Apply. Disabling the non-standard PD detection function for a PSE 1. Select Disable in the corresponding Non-Standard PD Compatibility column. 2. Click Apply. Enabling the non-standard PD detection for all PSEs Click Enable All. Disabling the non-standard PD detection for all PSEs Click Disable All.
PoE configuration example Network requirements As shown in Figure 492, GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 are connected to IP telephones. GigabitEthernet 1/0/11 is connected to AP whose maximum power does not exceed 9000 milliwatts. The IP telephones have a higher power supply priority than the AP so the PSE supplies power to the IP telephones first if the PSE power is overloaded. Figure 492 Network diagram Configuring PoE 1.
Figure 493 Configuring the PoE ports supplying power to the IP telephones 2. Enable PoE on GigabitEthernet 1/0/11 and set the maximum power of the port to 9000 milliwatts: a. Click the Setup tab. b. On the tab, click to select port GigabitEthernet 1/0/11 from the chassis front panel, select Enable from the Power State list, and select the box before Power Max and enter 9000. c. Click Apply.
Support and other resources Contacting HP For worldwide technical support information, see the HP support website: http://www.hp.
Conventions This section describes the conventions used in this documentation set. Command conventions Convention Description Boldface Bold text represents commands and keywords that you enter literally as shown. Italic Italic text represents arguments that you replace with actual values. [] Square brackets enclose syntax choices (keywords or arguments) that are optional. { x | y | ... } Braces enclose a set of required syntax choices separated by vertical bars, from which you select one.
Network topology icons Represents a generic network device, such as a router, switch, or firewall. Represents a routing-capable device, such as a router or Layer 3 switch. Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports Layer 2 forwarding and other Layer 2 features. Represents an access controller, a unified wired-WLAN module, or the switching engine on a unified wired-WLAN switch. Represents an access point. Represents a mesh access point.
Index Numerics RADIUS Message-Authentication attribute, 324 802.1X timers, 328 using authentication with other features, 329 access control methods, 321 ACL assignment, 331 architecture, 321 VLAN assignment, 329 802.x 802.1 LLDPDU TLV types, 218 authentication, 325 802.3 LLDPDU TLV types, 218 authentication (access device initiated), 324 QoS packet 802.
match order, 450 packet fragment filtering, 452 QoS policy to port, 484 architecture rule numbering step, 451 security MAC authentication, 411 security 802.1X, 321 ARP time range configuration, 453 attack protection.
port security advanced mode configuration, 433 AAA ISP domain authorization methods configuration, 356 port security authentication modes, 421 security 802.
choosing ACL, 452 Ethernet link aggregation selected state, 205 Ethernet link aggregation unselected state, 205 QoS, 476 configuration wizard CIST basic service setup, 34 calculation, 189 configuring network device connection, 187 802.1X ACL assignment, 343 class (Ethernet link aggregation port configuration), 206 802.1X Auth-Fail VLAN, 336 802.
IGMP snooping port function, 258 port security basic control, 425 IP routing (IPv4), 278 port security basic mode, 430 IP routing (IPv6), 278 port security permitted OUIs, 429 IP services ARP entry, 244 port-based VLAN, 135 isolation group, 440 priority mapping table, 487 LLDP, 217, 236 priority trust mode, 488 LLDP (globally), 227 PVID, 141 local user, 380 QoS, 489 local user and user group, 380 QoS classifier-behavior associations, 484 loopback detection, 447, 447 QoS policy, 466 loopb
configuring MAC authentication (port-specific), 408 system time (by using NTP), 57, 58 system time (manually), 56 user group, 382 DHCP overview, 292 VCT, 91 DHCP relay agent configuration, 303 VLAN interface, 150 idle timeout period configuration, 50 Web device configuration management, 64 LLDP configuration, 217, 236 MAC authentication timers, 405 Web device user management, 86 NMM local port mirroring configuration, 83 Web interface, 2 NMM local port mirroring group monitor port, 84 Web servi
snooping configuration, 306, 308, 311 Web stack configuration, 39 Web user level, 8 snooping Option 82 support, 308 Web-based NM functions, 8 snooping trusted port, 306, 306 device information displaying device information, 47, 48 snooping untrusted port, 306, 306 diagnostic device management device reboot, 53 tools, 317 direction diagnostic information, 54 NMM port mirroring (bidirectional), 79 electronic label, 54 NMM port mirroring (inbound), 79 software upgrade, 52 NMM port mirroring (outb
Web device file, 67 IPv6 multicast MLD snooping (in a VLAN), 270 DSCP LLDP on ports, 223 PSE detect nonstandard PDs, 499 QoS packet IP precedence and DSCP values, 469 dst-mac validity check (ARP), 250 SNMP agent, 113 encapsulating dynamic LLDP frame encapsulated in Ethernet II, 217 ARP table entry, 244 LLDP frame encapsulated in SNAP format, 217 DHCP address allocation, 292 Ethernet link aggregation dynamic mode, 207 security 802.
group configuration, 208 security 802.1X EAPOL packet format, 323 group creation, 208 LACP, 205 security 802.
enabling IGMP snooping (globally), 256 NMM local port mirroring group monitor port, 84 enabling IGMP snooping (in a VLAN), 257 NMM local port mirroring group port, 81 general query, 254 NMM local port mirroring group source port, 84 how it works, 254 leave message, 255 NMM port mirroring group, 79 membership report, 254 NMM RMON, 93 protocols and standards, 255 NMM RMON alarm, 94 NMM RMON configuration, 105 NMM RMON Ethernet statistics, 93 related ports, 252 implementing MSTP device implementati
IP services ARP entry configuration, 244 active route table, 281 IP services ARP entry removal, 245 static route creation, 281 security ARP attack protection configuration, 250 static routing configuration, 287 traceroute, 317 IPv6 multicast configuring MLD snooping, 274 IP routing configuration (IPv4), 278 displaying MLD snooping multicast forwarding entries, 273 configuration (IPv6), 278 enabling MLD snooping (globally), 270 displaying active route table (IPv4), 279 enabling MLD snooping (in
Ethernet link aggregation group creation, 208 enable (on ports), 223 Ethernet link dynamic aggregation group configuration, 208 how it works, 221 Ethernet link static aggregation group configuration, 208 LLDP frame reception, 222 LLDP frame format, 217 LLDP frame transmission, 221 LLDP configuration, 236 LLDPDU management address TLV, 221 loopback detection configuration, 447, 447 LLDPDU TLV types, 218 loopback test configuration, 89, 89 LLDPDU TLVs, 218 NMM port mirroring configuration, 79 op
MSTP configuration, 177, 190, 199 MAC addressing port security secure MAC address configuration, 427 loopback detection configuration, 447, 447 configuration (global), 447 MAC authentication ACL assignment, 405, 411 configuration (port-specific), 448 Auth-Fail VLAN, 405 loopback test configuration, 404, 406, 408 configuration, 89, 89 configuration (global), 406 guidelines, 89 configuration (port-specific), 408 low local authentication, 404, 408 PoE interface power management, 498 port securit
LLDP Rx, 221 membership report IGMP snooping, 254 LLDP Tx, 221 MLD snooping, 268 LLDP TxRx, 221 port security advanced mode, 421 message ARP configuration, 242 port security basic mode, 421 ARP message format, 242 security 802.1X EAP relay/termination comparison, 325 ARP static configuration, 246 security 802.1X multicast trigger mode, 324 DHCP format, 294 gratuitous ARP configuration, 246 gratuitous ARP packet learning, 244 security 802.
displaying IGMP snooping multicast forwarding entries, 259 Ethernet link aggregation LACP-enabled port, 211 Ethernet link aggregation modes, 206 enabling IGMP snooping (globally), 256 Ethernet link aggregation operational key, 205 enabling IGMP snooping (in a VLAN), 257 Ethernet link aggregation static mode, 206 IGMP snooping configuration, 252 gratuitous ARP packet, 244 IGMP snooping port function configuration, 258 gratuitous ARP packet learning, 244 security 802.
Web device file upload, 68 PoE power, 497 Web device local user adding, 86 port isolation configuration, 441 Web device main boot file specifying, 68 port management, 69, 75 Web device privilege level switching, 88 port security advanced control configuration, 428 Web device super password setting, 87 port security advanced mode configuration, 433 Web interface, 7 port security basic control configuration, 425 Web interface HTTP login, 6 port security basic mode configuration, 430 network mana
Web service management, 314, 315 Option 53 (DHCP);Option 053 (DHCP), 295 Web stack configuration, 39, 43 Option 55 (DHCP);Option 055 (DHCP), 295 Web user level, 8 Option 6 (DHCP);Option 006 (DHCP), 295 Web-based NM functions, 8 Option 60 (DHCP);Option 060 (DHCP), 295 NMM Option 66 (DHCP);Option 066 (DHCP), 295 local port mirroring configuration, 83 Option 67 (DHCP);Option 067 (DHCP), 295 local port mirroring group, 80 Option 82 (DHCP);Option 082 (DHCP) local port mirroring group monitor port,
Ethernet link aggregation static mode, 206 ping system maintenance, 317 Ethernet link dynamic aggregation group configuration, 208 configuration, 497, 501, 501 Ethernet link static aggregation group configuration, 208 address reachability determination, 317, 318 PoE IGMP snooping configuration, 252 detect nonstandard PDs enable, 499 IGMP snooping member port, 252 displaying, 500 IGMP snooping port function configuration, 258 interface power management configure, 498 IGMP snooping related ports,
security MAC authentication configuration, 404, 406, 408 configuration (global), 424 configuration guidelines, 423 security MAC local authentication configuration, 408 features, 421 intrusion protection feature, 421 specified operation parameter for all ports, 73 outbound restriction, 421 STP designated port, 178 permitted OUIs configuration, 429 STP root port, 178 secure MAC address configuration, 427 VLAN port link type, 135 port isolation configuration, 440, 441 Ethernet link aggregation class-
configuring AAA authentication methods for ISP domain, 355 configuring MAC authentication (global), 406 configuring MAC authentication (port-specific), 408 configuring AAA authorization methods for ISP domain, 356 configuring MAC-based 802.
creating VLAN interface, 150 configuring QoS traffic redirecting, 481 configuring queue scheduling, 477 displaying active route table (IPv4), 279 configuring queue scheduling on port, 485, 486 displaying active route table (IPv6), 281 configuring RADIUS common parameters, 369 displaying basic system information, 47 displaying all operation parameters for a port, 74 configuring RADIUS scheme, 368 displaying client's IP-to-MAC bindings, 302, 310 configuring rate limit, 477 displaying current system
enabling PSE detect nonstandard PDs, 499 SNMP versions, 112 enabling SNMP agent, 113 entering configuration wizard homepage, 34 STP protocol packets, 177 PSE finishing configuration wizard, 37 identifying node failure with traceroute, 319 detect nonstandard PDs, 499 PVID logging in to member device from master, 42 configuration, 141 logging in to Web interface through HTTP, 6 PVID (port-based VLAN), 136 logging out of Web interface, 7 Q managing port, 69, 75 modifying port, 144 QoS ACL configur
AAA implementation, 363, 374 removing assigning MAC authentication ACL assignment, 405 assigning MAC authentication VLAN assignment, 405 IP services ARP entry, 245 Web device file, 68 reporting IGMP snooping membership, 254 client/server model, 363 common parameter configuration, 369 configuration, 363, 374 configuration guidelines, 378 extended attributes, 367 MAC authentication configuration (global), 406 MAC authentication configuration (port-specific), 408 packet exchange process, 364 packet format,
IGMP snooping router port, 252 searching Web search function, 17 MLD snooping router port, 266 Web sort function, 19 routing ACL configuration, 450 security ACL configuration (advanced), 456, 463 802.
configuring DHCP snooping functions on interface, 309 buffer capacity and refresh interval, 63 configuration environment, 20 DHCP snooping Option 82 support, 308 LACP priority, 211 LLDP parameters for a single port, 224 sorting LLDP parameters for ports in batch, 227 ACL auto match order sort, 450 log host, 62 ACL config match order sort, 450 MAC address table dynamic aging timer, 175 source NMM port mirroring, 79 port operation parameters, 69 refresh period, 48 terminal parameters, 21 Web device
algorithm calculation, 179 syslog basic concepts, 178 configuration, 61 BPDU forwarding, 184 display, 61 CIST, 187 setting buffer capacity and refresh interval, 63 CST, 187 setting log host, 62 designated bridge, 178 system administration designated port, 178 basic device settings configuration, 50 IST, 187 CLI configuration, 20 loop detection, 177 configuration wizard, 34 MST common root bridge, 187 device idle timeout period configuration, 50 MST port roles, 187 device system name con
IP address retrieval, 317, 319 configuring system time (manually), 56 node failure detection, 317, 319 displaying current system time, 56 system maintenance, 317 T table traffic ACL configuration, 450 active route table (IPv4), 279 ACL configuration (Ethernet frame header), 459 active route table (IPv6), 281 NMM RMON configuration, 93 ARP static entry creation, 245 QoS policy configuration, 466 IP routing, 278 QoS priority map table, 475 IP services ARP entry configuration, 244 QoS token buc
MLD snooping configuration, 266 user level MLD snooping port function configuration, 272 Web user level, 8 user management modification, 143 MSTP VLAN-to-instance mapping table, 187 AAA management by ISP domains, 353 NMM local port mirroring group monitor port, 84 V NMM local port mirroring group port, 81 validity check NMM local port mirroring group source port, 84 security ARP packet, 250 NMM port mirroring configuration, 79 security ARP user, 250 policy type VLAN, 134 VCT port isolation c
device file management, 67 device file removing, 68 device file upload, 68 device idle timeout period configuration, 50 device local user adding, 86 device main boot file specifying, 68 device management, 52 device privilege level switching, 88 device reboot, 53 device software upgrade, 52 device stack configuration, 39, 43 device super password setting, 87 device system name configuration, 50 device user management, 86 displaying interface statistics, 132 entering configuration wizard homepage, 34 finishin
