NS4802-24P-4S-2X User Manual P/N 1073040 • REV A • ISS 27AUG15
Copyright © 2015 UTC. All rights reserved. Interlogix is part of UTC Building & Industrial Systems, a unit of UTC. All rights reserved Trademarks and patents Manufacturer Trade names used in this document may be trademarks or registered trademarks of the manufacturers or vendors of the respective products. Interlogix 2955 Red Hill Avenue, Costa Mesa, CA 92626-5923, USA Authorized EU manufacturing representative: UTC Fire & Security B.V.
TABLE OF CONTENTS 1. INTRODUCTION .................................................................................................................. 10 1.1 Packet Contents ......................................................................................................................................... 10 1.2 Product Description ................................................................................................................................... 11 1.3 How to Use This Manual .............
.2.2 IP Configuration ................................................................................................................................................... 45 4.2.3 IP Status .............................................................................................................................................................. 47 4.2.4 Users Configuration ......................................................................................................................................
4.4.4 SFP Module Information ...................................................................................................................................... 89 4.4.5 Port Mirror............................................................................................................................................................ 90 4.5 Link Aggregation ........................................................................................................................................ 93 4.5.
4.8.6 IGMP Snooping Port Group Filtering ................................................................................................................. 154 4.8.7 IGMP Snooping Status ...................................................................................................................................... 155 4.8.8 IGMP Group Information.................................................................................................................................... 156 4.8.
4.10.4 ACL Ports Configuration .................................................................................................................................. 210 4.10.5 ACL Rate Limiter Configuration ....................................................................................................................... 212 4.11 Authentication ......................................................................................................................................... 213 4.11.
4.14.5 Neighbor .......................................................................................................................................................... 293 4.14.6 Port Statistics ................................................................................................................................................... 294 4.15 Network Diagnostics .............................................................................................................................. 296 4.15.
5. SWITCH OPERATION ....................................................................................................... 342 5.1 Address Table ........................................................................................................................................... 342 5.2 Learning .................................................................................................................................................... 342 5.3 Forwarding & Filtering .............................
1. INTRODUCTION Thank you for purchasing a NS4802-24P-4S-2X L2+ 24-Port 10/100/1000T 802.3at PoE + 4-Port Shared SFP + 2-Port 10G SFP+ Managed Stackable Switch. NS4802-24P-4S-2X, comes with the multi-port Gigabit Ethernet Switch and SFP fiber optic connectibility and robust layer 2 features. The description of this model is shown below: NS4802-24P-4S-2X L2+ 24-Port 10/100/1000T 802.
1.2 Product Description High-Density, Resilient Deployment Switch Solution for Gigabit Networking of Enterprise, Campus and Data Center For the growing Gigabit network and IoT (Internet of Things) demand, IFS has launched a new-generation Stackable Gigabit PoE+ Switch solution, the NS4802-24P-4S-2X, to meet the needs of IP surveillance, enterprises, telecoms and campuses for a large-scale network deployment.
Highly-reliable Stacking Ability Through its up to 40Gbps, bi-directional high bandwidth tunnel and stacking technology, the NS4802 gives the enterprises, service providers and telecoms flexible control over port density, uplinks and switch stack performance. The stack redundancy of the NS4802 ensures that data integrity is retained even if one switch in the stack fails.
The NS4802 can be programmed for advanced switch management function, such as dynamic port link aggregation, Q-in-Q VLAN, Multiple spanning tree protocol (MSTP), Layer 2/4 QoS, bandwidth control and IGMP/MLD snooping. The NS4802 allows the operation of a high-speed trunk combining multiple ports. It enables up to 3 groups of 6 ports for trunk maximum and supports connection fail-over as well.
Centralized Power Management for Gigabit Ethernet PoE Networking To fulfill the needs of higher power required PoE network applications with Gigabit speed transmission, the NS4802 features high-performance Gigabit IEEE 802.3af PoE (up to 15.4 watts) and IEEE 802.3at PoE+ (up to 30 watts) on all ports.
1.3 How to Use This Manual This User’s Manual is structured as follows: Section 2, INSTALLATION The section explains the functions of the Managed Switch and how to physically install the Managed Switch. Section 3, SWITCH MANAGEMENT The section contains the information about the software function of the Managed Switch. Section 4, WEB CONFIGURATION The section explains how to manage the Managed Switch by Web interface.
1.4 Product Features Physical Port 24-Port 10/100/1000BASE-T RJ45 copper with IEEE 802.3at / 802.
■ Ingress Shaper and Egress Rate Limit per port bandwidth control ■ 8 priority queues on all switch ports ■ Traffic classification - IEEE 802.
DHCP Option82 User Privilege levels control NTP (Network Time Protocol) Link Layer Discovery Protocol (LLDP) and LLDP-MED Network Diagnostic - ICMPv6 / ICMPv4 Remote Ping - Cable Diagnostic technology provides the mechanism to detect and report potential cabling issues SMTP / Syslog remote alarm Four RMON groups (history, statistics, alarms and events) SNMP trap for interface Link Up and Link Down notification System Log IFS Smart Discovery Utility for deploy management Power over
1.
Stacking Functions Stacking Ports 2 SFP+ slots Stacking Numbers 16 Stacking Bandwidth 40Gbps full duplex Stack ID Display 7-Segment LED display (1~9, A~F, 0) Stack Topology Ring / Chain / Back-to-Back Power over Ethernet PoE Standard IEEE 802.3af / 802.3at PoE / PSE PoE Power Supply Type End-span PoE Power Output Per Port 56V DC, Max. 30 watts per port (Max.7 per each side) Power Pin Assignment 1/2(+), 3/6(-) PoE Power Budget 380 watts (max.
IGMP Snooping MLD Snooping Access Control List Bandwidth Control SNMP MIBs IGMP (v1/v2/v3) Snooping, up to 255 multicast Groups IGMP Querier mode support MLD (v1/v2) Snooping, up to 255 multicast Groups MLD Querier mode support IP-based ACL / MAC-based ACL Up to 256 entries Per port ingress / egress bandwidth control RFC 1213 MIB-II RFC 2819 RMON MIB (Group 1, 2, 3 and 9) IF-MIB RFC 2618 RADIUS Client MIB RFC 1493 Bridge MIB RFC 3411 SNMP-Frameworks-MIB RFC 1643 Ethernet MIB IEEE 802.
2. INSTALLATION This section describes the hardware features and installation of the Managed Switch on the desktop or rack mount. For easier management and control of the Managed Switch, familiarize yourself with its display indicators, and ports. Front panel illustrations in this chapter display the unit LED indicators. Before connecting any network device to the Managed Switch, please read this chapter completely. 2.1 Hardware Description 2.1.
Winterm and so on) to enter the startup screen of the device. ■ Reset button At the right of the front panel, the reset button is designed for rebooting the Managed Switch without turning off and on the power. The following is the summary table of reset button functions: Reset Button Pressed and Released Function < 5 sec: System Reboot Reboot the Managed Switch. Reset the Managed Switch to Factory Default configuration.
Lights to indicate the link through that SFP+ stacking port is successfully established with STX1 Green speed 10Gbps. Off to indicate that the port is link down. Lights to indicate the link through that SFP+ stacking port is successfully established with STX2 Green speed 10Gbps. Off to indicate that the port is link down.
2.2 Installing the Switch This section describes how to install your Managed Switch and make connections to the Managed Switch. Please read the following topics and perform the procedures in the order being presented. To install your Managed Switch on a desktop or shelf, simply complete the following steps. 2.2.1 Desktop Installation To install the Managed Switch on desktop or shelf, please follow these steps: Step 1: Attach the rubber feet to the recessed areas on the bottom of the Managed Switch.
2.2.2 Rack Mounting To install the Managed Switch in a 19-inch standard rack, please follow the instructions described below. Step 1: Place the Managed Switch on a hard flat surface, with the front panel positioned towards the front side. Step 2: Attach the rack-mount bracket to each side of the Managed Switch with supplied screws attached to the package. Figure 2-2-2 shows how to attach brackets to one side of the Managed Switch. Figure 2-2-2: Attach Brackets to the Managed Switch.
Figure 2-2-4: Plug-in the SFP/SFP+ Transceiver Approved IFS SFP/SFP+ Transceivers IFS Managed Switch supports both single mode and multi-mode SFP/SFP+ transceiver.
10Gigabit Ethernet Transceiver (10GBASE-X SFP+) ■ 10 Gigabit Stacked SFP+ slot 10GBASE-SR/LR mini-GBIC slot, SFP+ Transceiver Module supports from 300 meters (multi-mode fiber) to up to 10 kilometers (single-mode fiber) Model Speed (Mbps) Connector Interface Fiber Mode Distance S40-2MLC 10G LC Multi Mode 300m 850nm 0 ~ 60 ℃ S40-2SLC-10 10G LC Single Mode 10km 1310nm 0 ~ 60 ℃ Wavelength (nm) Operating Temp. 1. It is recommended to use IFS SFP on the Managed Switch.
Figure 2-2-5: How to Pull Out the SFP/SFP+ Transceiver Never pull out the module without lifting up the lever of the module and turning it to a horizontal position. Directly pulling out the module could damage the module and the SFP/SFP+ module slot of the Managed Switch. 2.3 Stack Installation NS4802-24P-4S-2X The NS4802 Managed Switch series provides a switch stacking function to manage up to 16 switches using a single IP address.
1. Please note that from now on the stacking example images are coming from NS4802, however, as NS4802-24P stacking ports are on the front panel, but the stacking cable connection rule is totally same with NS3601. 2. if you remove one of switch from stacking group and causes stacking ID without sequence, please re-assign stacking ID from “Stack Configuration“before you make the other operation. 3.
2.3.1 Connecting Stacking Cable Before attempting to connect stacking ports, verify that you have the required stack cables. The following cables are used to connect stacked switches: • NS-10G-CBL-50: 10G SFP+ Directly-attached Copper Cable (0.5M in length) • NS-10G-CBL-2M: 10G SFP+ Directly-attached Copper Cable (2M in length) • SFP+ Port 10GBASE-LR mini-GBIC Module (single-mode / 1310nm / max. 10km). • SFP+ Port 10GBASE-SR mini-GBIC Module (multi-mode / 850nm / max.
2.3.2 Management Stacking The stack operation of the IFS Managed Switch supports Plug and Play Stacking connection and auto stack configuration. Step 5: Once the stack starts operation, the Stack master will be automatically elected without any configuration. The Stack master is indicated by a lit green “Master” LED on the front panel as Figure 2-24 shows.
It allows to build a stack of up to 16 NS4802 Switches. If there is the space limitation or power issue and you wish to stack all the switches in different racks, use long stack cables to connect two stacks. 2m stack cable 2m stack cable .
3. SWITCH MANAGEMENT This chapter explains the methods that you can use to configure management access to the Managed Switch. It describes the types of management applications and the communication and management protocols that deliver data between your management device (workstation or personal computer) and the system. It also contains information about port connection options.
3.2 Management Access Overview The Managed Switch gives you the flexibility to access and manage it using any or all of the following methods: An administration console Web browser interface An external SNMP-based network management application The administration console and Web browser interface support are embedded in the Managed Switch software and are available for immediate use. Each of these management methods has their own advantages. Table 3-1 compares the three management methods.
3.3 Administration Console The administration console is an internal, character-oriented, and command line user interface for performing system administration such as displaying statistics or changing option settings. Using this method, you can view the administration console from a terminal, personal computer, Apple Macintosh, or workstation connected to the Managed Switch's console (serial) port.
terminal-emulation program for connecting to the terminal serial port. A workstation attachment under UNIX can use an emulator such as TIP. 3.4 Web Management The Managed Switch offers management features that allow users to manage the Managed Switch from anywhere on the network through a standard browser such as Microsoft Internet Explorer.
agent on the switch and the SNMP Network Management Station to use the same community string. This management method, in fact, uses two community strings: the get community string and the set community string. If the SNMP Net-work management Station only knows the set community string, it can read and write to the MIBs. However, if it only knows the get community string, it can only read MIBs. The default getting and setting community strings for the Managed Switch is public.
4. WEB CONFIGURATION This section introduces the configuration and functions of the Web-based management from Managed Switch. About Web-based Management The Managed Switch offers management features that allow users to manage the Managed Switch from anywhere on the network through a standard browser such as Microsoft Internet Explorer. The Web-based Management supports Internet Explorer 8.0.
Figure 4-1-2: Login Screen Default User name: admin Default Password: admin After entering the username and password, the main screen appears as shown in Figure 4-1-3. Figure 4-1-3: Web Main Page Now, you can use the Web management interface to continue the switch management or manage the Managed Switch by Web interface. The Switch Menu on the left of the web Page lets you access all the commands and statistics the Managed Switch provides.
1. It is recommended to use Internet Explore 8.0 or above to access Managed Switch. 2. The changed IP address takes effect immediately after clicking on the Save button. You need to use the new IP address to access the Web interface. 3. For security reason, please change and memorize the new password after this first setup. 4. Only accept command in lowercase letter under web interface. 4.1 Main Web Page The Managed Switch provides a Web-based browser interface for configuring and managing it.
Panel Display The web agent displays an image of the Managed Switch’s ports. The Mode can be set to display different information for the ports, including Link up or Link down. Clicking on the image of a port opens the Port Statistics Page. The port status are illustrated as follows: State Disabled Down Link RJ-45 Ports SFP Ports Main Menu Using the onboard web agent, you can define system parameters, manage and control the Managed Switch, and all its ports, or monitor network conditions.
4.2 System Use the System menu items to display and configure basic administrative details of the Managed Switch. Under the System, the following topics are provided to configure and view the system information. This section has the following items: ■ System Information The Managed Switch system information is provided here. ■ IP Configuration Configures the Managed Switch-managed IPv4/IPv6 interface and IP routes on this Page. ■ IP Status This page displays the status of the IP protocol layer.
4.2.1 System Information The System Infomation Page provides information for the current device information. System Information Page helps a switch administrator to identify the hardware MAC address, software version and system uptime. The screen in Figure 4-2-1 appears. Figure 4-2-1: System Information Page Screenshot The Page includes the following fields: Object Description • Contact The system contact configured in SNMP | System Information | System Contact.
4.2.2 IP Configuration The IP Configuration includes the IP Configuration, IP Interface and IP Routes. The configured column is used to view or change the IP configuration. The maximum number of interfaces supported is 128 and the maximum number of routes is 32. The screen in Figure 4-2-2 appears. Figure 4-2-2: IP Configuration Page Screenshot The current column is used to show the active IP configuration.
should be preferred. DNS Proxy When DNS proxy is enabled, system will relay DNS requests to the currently configured DNS server, and reply as a DNS resolver to the client devices on the network. • IP Address Delete Select this option to delete an existing IP interface. VLAN The VLAN associated with the IP interface. Only ports in this VLAN will be able to access the IP interface. This field is only available for input when creating an new interface.
4.2.3 IP Status IP Status displays the status of the IP protocol layer. The status is defined by the IP interfaces, the IP routes and the neighbour cache (ARP cache) status. The screen in Figure 4-2-3 appears. Figure 4-2-3: IP Status Page Screenshot The Page includes the following fields: Object Description • IP Interfaces • IP Routes • Neighbor Cache Interface The name of the interface. Type The address type of the entry. This may be LINK or IPv4.
4.2.4 Users Configuration This Page provides an overview of the current users. Currently the only way to login as another user on the web server is to close and reopen the browser. After setup is completed, press “Apply” button to take effect. Please login web interface with new user name and password, the screen in Figure 4-2-4 appears. Figure 4-2-4: Users Configuration Page Screenshot The Page includes the following fields: Object Description • User Name The name identifying the user.
Add / Edit User This Page configures a user – add, edit or delete user. Figure 4-2-5: Add / Edit User Configuration Page Screenshot The Page includes the following fields: Object Description • Username A string identifying the user name that this entry should belong to. The allowed string length is 1 to 31. The valid user name is a combination of letters, numbers and underscores. • Password The password of the user. The allowed string length is 1 to 31.
Once the new user is added, the new user entry shown in the Users Configuration Page. Figure 4-2-6: User Configuration Page Screenshot If you forget the new password after changing the default password, please press the “Reset” button on the front panel of the Managed Switch for over 10 seconds and then release it. The current setting including VLAN will be lost and the Managed Switch will restore to the default mode.
4.2.5 Privilege Levels This Page provides an overview of the privilege levels. After setup is completed, please press “Apply” button to take effect. Please login web interface with new user name and password and the screen in Figure 4-2-7 appears.
The Page includes the following fields: Object Description • Group Name The name identifying the privilege group. In most cases, a privilege level group consists of a single module (e.g. LACP, RSTP or QoS), but a few of them contain more than one. The following description defines these privilege level groups in details: System: Contact, Name, Location, Timezone, Log.
Figure 4-2-8: NTP Configuration Page Screenshot The Page includes the following fields: Object Description • Mode Indicates the NTP mode operation. Possible modes are: Enabled: Enable NTP mode operation. When enable NTP mode operation, the agent forward and to transfer NTP messages between the clients and the server when they are not on the same subnet domain. Disabled: Disable NTP mode operation. • Server # Provide the NTP IPv4 or IPv6 address of this switch.
Figure 4-2-9: Time Configuration Page Screenshot The Page includes the following fields: Object Description • Time Zone Lists various Time Zones world wide. Select appropriate Time Zone from the drop down and click Save to set. • Acronym User can set the acronym of the time zone. This is a User configurable acronym to identify the time zone.
• Month - Select the starting month. • Hours - Select the starting hour. • Minutes - Select the starting minute. • End Time Settings • Week - Select the ending week number. • Day - Select the ending day. • Month - Select the ending month. • Hours - Select the ending hour. • Minutes - Select the ending minute Enter the number of minutes to add during Daylight Saving Time. ( Range: 1 to • Offset Settings 1440 ) Buttons : Click to apply changes.
When the mode is enabled, two ACEs are added automatically to trap UPnP related packets to CPU. The ACEs are automatically removed when the mode is disabled. The TTL value is used by UPnP to send SSDP advertisement messages. • TTL Valid values are in the range of 1 to 255. • Advertising Duration The duration, carried in SSDP packets, is used to inform a control point or control points how often it or they should receive a SSDP advertisement message from this switch.
The DHCP option 82 enables a DHCP relay agent to insert specific information into a DHCP request packets when forwarding client DHCP packets to a DHCP server and remove the specific information from a DHCP reply packets when forwarding server DHCP packets to a DHCP client. The DHCP server can use this information to implement IP address or other assignment policies. Specifically the option works by setting two sub-options: Circuit ID (option 1) Remote ID (option2).
information (option82) into a DHCP message when forwarding to DHCP server and removing it from a DHCP message when transferring to DHCP client. It only works under DHCP relay operation mode enabled. Disabled: Disable DHCP relay information mode operation. Indicates the DHCP relay information option policy. When enabling DHCP relay • Relay Information Policy information mode operation, if agent receives a DHCP message that already contains relay agent information. It will enforce the policy.
• Transmit Error The packets number that errors sending packets to clients. • Receive from Server The packets number that received packets from server. • Receive Missing Agent The packets number that received packets without agent information options. Option • Receive Missing Circuit ID The packets number that received packets which the Circuit ID option was missing. • Receive Missing The packets number that received packets which Remote ID option was missing.
4.2.11 CPU Load This Page displays the CPU load, using a SVG graph. The load is measured as average over the last 100ms, 1sec and 10 seconds intervals. The last 120 samles are graphed, and the last numbers are displayed as text as well. In order to display the SVG graph, your browser must support the SVG format. Consult the SVG Wiki for more information on browser support. Specifically, at the time of writing, Microsoft Internet Explorer will need to have a plugin installed to support SVG.
4.2.12 System Log The Managed Switch system log information is provided here. The System Log screen in Figure 4-2-15 appears. Figure 4-2-15: System Log Page Screenshot The Page includes the following fields: Object Description • ID The ID (>= 1) of the system log entry. • Level The level of the system log entry. The following level types are supported: Info: Information level of the system log. Warning: Warning level of the system log. Error: Error level of the system log. All: All levels.
: Updates the system log entries, starting from the first available entry ID. : Updates the system log entries, ending at the last entry currently displayed. : Updates the system log entries, starting from the last entry currently displayed. : Updates the system log entries, ending at the last available entry ID. 4.2.13 Detailed Log The Managed Switch system detailed log information is provided here. The Detailed Log screen in Figure 4-2-16 appears.
4.2.14 Remote Syslog Configure remote syslog on this Page. The Remote Syslog screen in Figure 4-2-17 appears. Figure 4-2-17: Remote Syslog Page Screenshot The Page includes the following fields: Object Description • Mode Indicates the server mode operation. When the mode operation is enabled, the syslog message will send out to syslog server.
4.2.15 SMTP Configuration This Page facilitates an SMTP Configuration on the switch. The SMTP Configure screen in Figure 4-2-18 appears. Figure 4-2-18: SMTP Configuration Page Screenshot The Page includes the following fields: Object Description • SMTP Mode Controls whether SMTP is enabled on this switch. • SMTP Server Type the SMTP server name or the IP address of the SMTP server. • SMTP Port Set port number of SMTP service.
: Click to undo any changes made locally and revert to previously saved values. 4.2.16 Web Firmware Upgrade This Page facilitates an update of the firmware controlling the switch. The Web Firmware Upgrade screen in Figure 4-2-19 appears. Figure 4-2-19: Web Firmware Upgrade Page Screenshot To open Firmware Upgrade screen, perform the following: 1. Click System -> Web Firmware Upgrade. 2. The Firmware Upgrade screen is displayed as in Figure 4-2-19. 3. Click the “ 4.
4.2.17 TFTP Firmware Upgrade The Firmware Upgrade Page provides the functions to allow a user to update the Managed Switch firmware from the TFTP server in the network. Before updating, make sure you have your TFTP server ready and the firmware image is on the TFTP server. The TFTP Firmware Upgrade screen in Figure 4-2-21 appears. Figure 4-2-20: TFTP Firmware Update Page Screenshot The Page includes the following fields: Object Description • TFTP Server IP Fill in your TFTP server IP address.
4.2.18 Save Startup Config This function allows save the current configuration, thereby ensuring that the current active configuration can be used at the next reboot screen in Figure 4-2-22 appears. After saving the configuratioin, the screen Figure 4-2-23 will appear. Figure 4-2-22: Configuration Save Page Screenshot Figure 4-2-23: Finish Saving Page Screenshot 4.2.19 Configuration Download The switch stores its configuration in a number of text files in CLI format.
4.2.20 Configuration Upload Configuration Upload page allows the upload the running-config and startup-config on the switch. Please refer to the Figure 4-2-25 shown below. Figure 4-2-25: Configuration Upload Page Screenshot If the destination is running-config, the file will be applied to the switch configuration. This can be done in two ways: • Replace mode: The current configuration is fully replaced with the configuration in the uploaded file.
It is possible to activate any of the configuration files present on the switch, except for running-config which represents the currently active configuration. Select the file to activate and click . This will initiate the process of completely replacing the existing configuration with that of the selected file. 4.2.22 Configuration Delete Configuration Delete page allows to delete the startup-config and default-config files which stored in FLASH.
Figure 4-2-28: Software Image Selection Page Screenshot The Page includes the following fields: Object Description • Image The flash index name of the firmware image. The name of primary (preferred) image is image, the alternate image is named image.bk. • Version The version of the firmware image. • Date The date where the firmware was produced. Buttons : Click to use the alternate image. This button may be disabled depending on system state. 4.2.
Figure 4-2-29: Factory Default Page Screenshot Buttons : Click to reset the configuration to Factory Defaults. : Click to return to the Port State Page without resetting the configuration. To reset the Managed Switch to the Factory default setting, you can also press the hardware reset button at the front panel about 10 seconds. After the device be rebooted. You can login the management WEB interface within the same subnet of 192.168.0.xx. 4.2.
4.3 Simple Network Management Protocol 4.3.1 SNMP Overview The Simple Network Management Protocol (SNMP) is an application layer protocol that facilitates the exchange of management information between network devices. It is part of the Transmission Control Protocol/Internet Protocol (TCP/IP) protocol suite. SNMP enables network administrators to manage network performance, find and solve network problems, and plan for network growth.
An SNMP community is the group that devices and management stations running SNMP belong to. It helps define where information is sent. The community name is used to identify the group. A SNMP device or agent may belong to more than one SNMP community. It will not respond to requests from management stations that do not belong to one of its communities. SNMP default communities are: 。 Write = private 。 Read = public Use the SNMP Menu to display or configure the Managed Switch's SNMP function.
SNMP v3: Set SNMP supported version 3. • Read Community Indicates the community read access string to permit access to SNMP agent. The allowed string length is 0 to 255, and the allowed content is the ASCII characters from 33 to 126. The field is applicable only when SNMP version is SNMPv1 or SNMPv2c. If SNMP version is SNMPv3, the community string will be associated with SNMPv3 communities table. It provides more flexibility to configure security name than a SNMPv1 or SNMPv2c community string.
4.3.3 SNMP Trap Configuration Configure SNMP trap on this Page. The SNMP Trap Configuration screen in Figure 4-3-2 appears. Figure 4-3-2: SNMP Trap Configuration Page Screenshot The Page includes the following fields: Object Description • Trap Config Indicates which trap Configuration's name for configuring. The allowed string length is 0 to 255, and the allowed content is ASCII characters from 33 to 126. • Trap Mode Indicates the SNMP trap mode operation.
SNMP v1: Set SNMP trap supported version 1. SNMP v2c: Set SNMP trap supported version 2c. SNMP v3: Set SNMP trap supported version 3. • Trap Community Indicates the community access string when send SNMP trap packet. The allowed string length is 0 to 255, and the allowed content is the ASCII characters from 33 to 126. • Trap Destination Indicates the SNMP trap destination address. Address • Trap Destination Port Indicates the SNMP trap destination port.
Indicates that the Switch group's traps. Possible traps are: • Switch STP: Enable/disable STP trap. RMON: Enable/disable RMON trap. Buttons : Click to apply changes : Click to undo any changes made locally and revert to previously saved values. 4.3.4 SNMP System Information The switch system information is provided here. The SNMP System Information screen in Figure 4-3-3 appears.
4.3.5 SNMPv3 Configuration 4.3.5.1 SNMPv3 Communities Configure SNMPv3 communities table on this Page. The entry index key is Community. The SNMPv3 Communities screen in Figure 4-3-4 appears. Figure 4-3-4: SNMPv3 Communities Configuration Page Screenshot The Page includes the following fields: Object Description • Delete Check to delete the entry. It will be deleted during the next save. • Community Indicates the community access string to permit access to SNMPv3 agent.
4.3.5.2 SNMPv3 Users Configure SNMPv3 users table on this Page. The entry index keys are Engine ID and User Name. The SNMPv3 Users screen in Figure 4-3-5 appears. Figure 4-3-5: SNMPv3 Users Configuration Page Screenshot The Page includes the following fields: Object Description • Delete Check to delete the entry. It will be deleted during the next save. • Engine ID An octet string identifying the engine ID that this entry should belong to.
MD5: An optional flag to indicate that this user using MD5 authentication protocol. SHA: An optional flag to indicate that this user using SHA authentication protocol. The value of security level cannot be modified if entry already exist. That means must first ensure that the value is set correctly. A string identifying the authentication pass phrase. For MD5 authentication • Authentication Password protocol, the allowed string length is 8 to 32.
The Page includes the following fields: Object Description • Delete Check to delete the entry. It will be deleted during the next save. • Security Model Indicates the security model that this entry should belong to. Possible security models are: v1: Reserved for SNMPv1. v2c: Reserved for SNMPv2c. usm: User-based Security Model (USM). A string identifying the security name that this entry should belong to.
The Page includes the following fields: Object Description • Delete Check to delete the entry. It will be deleted during the next save. • View Name A string identifying the view name that this entry should belong to. The allowed string length is 1 to 32, and the allowed content is the ASCII characters from 33 to 126. Indicates the view type that this entry should belong to. Possible view type are: • View Type included: An optional flag to indicate that this view subtree should be included.
Object Description • Delete Check to delete the entry. It will be deleted during the next save. • Group Name A string identifying the group name that this entry should belong to. The allowed string length is 1 to 32, and the allowed content is the ASCII characters from 33 to 126. • Security Model Indicates the security model that this entry should belong to. Possible security models are: any: Accepted any security model (v1|v2c|usm). v1: Reserved for SNMPv1. v2c: Reserved for SNMPv2c.
4.4 Port Management Use the Port Menu to display or configure the Managed Switch's ports. This section has the following items: Port Configuration Configures port connection settings Port Statistics Overview Lists Ethernet and RMON port statistics Port Statistics Detail Lists Ethernet and RMON port statistics SFP Module Information Display SFP information Port Mirror Sets the source and target ports for mirroring 4.4.
• Current Link Speed Provides the current link speed of the port. • Configured Link Speed Select any available link speed for the given switch port. Draw the menu bar to select the mode. Auto - Setup Auto negotiation for copper interface. 10Mbps HDX - Force sets 10Mbps/Half-Duplex mode. 10Mbps FDX - Force sets 10Mbps/Full-Duplex mode. 100Mbps HDX - Force sets 100Mbps/Half-Duplex mode. 100Mbps FDX - Force sets 100Mbps/Full-Duplex mode.
4.4.2 Port Statistics Overview This Page provides an overview of general traffic statistics for all switch ports. The Port Statistics Overview screen in Figure 4-4-2 appears. Figure 4-4-2: Port Statistics Overview Page Screenshot The displayed counters are: Object Description • Port The logical port for the settings contained in the same row. • Packets The number of received and transmitted packets per port. • Bytes The number of received and transmitted bytes per port.
4.4.3 Port Statistics Detail This Page provides detailed traffic statistics for a specific switch port. Use the port select box to select which switch port details to display. The selected port belong to the currently selected stack unit, as reflected by the Page header. The displayed counters are the totals for receive and transmit, the size counters for receive and transmit, and the error counters for receive and transmit. The Port Statistics Detail screen in Figure 4-4-3 appears.
Receive and Transmit Size Counters The number of received and transmitted (good and bad) packets split into categories based on their respective frame sizes. Receive and Transmit Queue Counters The number of received and transmitted packets per input and output queue. Receive Error Counters Object Description • Rx Drops The number of frames dropped due to lack of receive buffers or egress congestion. • Rx CRC/Alignment The number of frames received with CRC or alignment errors.
4.4.4 SFP Module Information The WGSW-48040HP has supported the SFP module with digital diagnostics monitoring (DDM) function, this feature is also known as digital optical monitoring (DOM). You can check the physical or operational status of an SFP module via the SFP Module Information Page. This Page shows the operational status, such as the transceiver type, speed, wavelength, optical output power, optical input power, temperature, laser bias current and transceiver supply voltage in real time.
• Voltage(V) Display the voltage of current SFP DDM module, the voltage value is get from the – SFP DDM Module Only SFP DDM module. • Current(mA) Display the Ampere of current SFP DDM module, the Ampere value is get from – SFP DDM Module Only the SFP DDM module. • TX power(dBm) Display the TX power of current SFP DDM module, the TX power value is get – SFP DDM Module Only from the SFP DDM module.
Figure 4-4-7: Port Mirror Application The traffic to be copied to the mirror port is selected as follows: • All frames received on a given port (also known as ingress or source mirroring). • All frames transmitted on a given port (also known as egress or destination mirroring). Mirror Port Configuration The Port Mirror screen in Figure 4-4-8 appears.
• Port The logical port for the settings contained in the same row. • Mode Select mirror mode. ■ Rx only: Frames received at this port are mirrored to the mirroring port. Frames transmitted are not mirrored. ■ Tx only: Frames transmitted from this port are mirrored to the mirroring port. Frames received are not mirrored. ■ Disabled: Neither frames transmitted or frames received are mirrored. ■ Both: Frames received and frames transmitted are mirrored to the mirror port.
4.5 Link Aggregation Port Aggregation optimizes port usage by linking a group of ports together to form a single Link Aggregated Groups (LAGs). Port Aggregation multiplies the bandwidth between the devices, increases port flexibility, and provides link redundancy. Each LAG is composed of ports of the same speed, set to full-duplex operations. Ports in a LAG, can be of different media types (UTP/Fiber, or different fiber types), provided they operate at the same speed.
The Link Aggregation Control Protocol (LACP) provides a standardized means for exchanging information between Partner Systems that require high speed redundant links. Link aggregation lets you group up to eight consecutive ports into a single dedicated connection. This feature can expand bandwidth to a device on the network. LACP operation requires full-duplex mode, more detail information refer to the IEEE 802.3ad standard.
4.5.1 Static Aggregation This Page is used to configure the Aggregation hash mode and the aggregation group. The aggregation hash mode settings are global, whereas the aggregation group relate to the currently selected stack unit, as reflected by the Page header. Hash Code Contributors The Static Aggeration screen in Figure 4-5-2 appears.
Figure 4-5-3: Aggregation Group Configuration Page Screenshot The Page includes the following fields: .Object Description • Group ID Indicates the group ID for the settings contained in the same row. Group ID "Normal" indicates there is no aggregation. Only one group ID is valid per port. • Port Members Each switch port is listed for each group ID. Select a radio button to include a port in an aggregation, or clear the radio button to remove the port from the aggregation.
This Page allows the user to inspect the current LACP port configurations, and possibly change them as well. The LACP port settings relate to the currently selected stack unit, as reflected by the Page header. The LACP Configuration screen in Figure 4-5-4 appears. Figure 4-5-4: LACP Port Configuration Page Screenshot The Page includes the following fields: Object Description • Port The switch port number. • LACP Enabled Controls whether LACP is enabled on this switch port.
means greater priority. Buttons : Click to apply changes : Click to undo any changes made locally and revert to previously saved values. 4.5.3 LACP System Status This Page provides a status overview for all LACP instances. The LACP Status Page display the current LACP aggregation Groups and LACP Port status. The LACP System Status screen in Figure 4-5-5 appears.
4.5.4 LACP Port Status This Page provides a status overview for LACP status for all ports. The LACP Port Status screen in Figure 4-5-6 appears. Figure 4-5-6: LACP Status Page Screenshot The Page includes the following fields: Object Description • Port The switch port number. • LACP 'Yes' means that LACP is enabled and the port link is up. 'No' means that LACP is not enabled or that the port link is down.
Figure 4-5-7: LACP Statistics Page Screenshot The Page includes the following fields: Object Description • Port The switch port number. • LACP Received Shows how many LACP frames have been sent from each port. • LACP Transmitted Shows how many LACP frames have been received at each port. • Discarded Shows how many unknown or illegal LACP frames have been discarded at each port. Buttons Auto-refresh : Automatic refresh occurs every 3 seconds. : Click to refresh the Page immediately.
4.6 VLAN 4.6.1 VLAN Overview A Virtual Local Area Network (VLAN) is a network topology configured according to a logical scheme rather than the physical layout. VLAN can be used to combine any collection of LAN segments into an autonomous user group that appears as a single LAN. VLAN also logically segment the network into different broadcast domains so that packets are forwarded only between ports within the VLAN. Typically, a VLAN corresponds to a particular subnet, although not necessarily.
provides a similar service at Layer 2 by using VLANs to organize any group of network nodes into separate broadcast domains. VLANs confine broadcast traffic to the originating group, and can eliminate broadcast storms in large networks. This also provides a more secure and cleaner network environment. An IEEE 802.1Q VLAN is a group of ports that can be located anywhere in the network, but communicate as though they belong to the same physical segment.
packet carries the IEEE 802.1Q/802.1p tag. The tag is contained in the following two octets and consists of 3 bits of user priority, 1 bit of Canonical Format Identifier (CFI - used for encapsulating Token Ring packets so they can be carried across Ethernet backbones), and 12 bits of VLAN ID (VID). The 3 bits of user priority are used by 802.1p. The VID is the VLAN identifier and is used by the 802.1Q standard. Because the VID is 12 bits long, 4094 unique VLAN can be identified.
network – if all network devices are 802.1Q compliant). Every physical port on a switch has a PVID. 802.1Q ports are also assigned a PVID, for use within the switch. If no VLAN are defined on the switch, all ports are then assigned to a default VLAN with a PVID equal to 1. Untagged packets are assigned the PVID of the port on which they were received. Forwarding decisions are based upon this PVID, in so far as VLAN are concerned. Tagged packets are forwarded according to the VID contained within the tag.
■ Port Overlapping Port overlapping can be used to allow access to commonly shared network resources among different VLAN groups, such as file servers or printers. Note that if you implement VLANs which do not overlap, but still need to communicate, you can connect them by enabled routing on this switch. ■ Untagged VLANs Untagged (or static) VLANs are typically used to reduce broadcast traffic and to increase security.
■ IEEE 802.1Q Tunneling (Q-in-Q) IEEE 802.1Q Tunneling (QinQ) is designed for service providers carrying traffic for multiple customers across their networks. QinQ tunneling is used to maintain customer-specific VLAN and Layer 2 protocol configurations even when different customers use the same internal VLAN IDs.
Global VLAN Configuration The Global VLAN Configuration screen in Figure 4-6-1 appears. Figure 4-6-1 : Global VLAN Configuration Screenshot The Page includes the following fields: Object Description • Allowed Access This field shows the allowed Access VLANs, it only affects ports configured as VLANs Access ports. Ports in other modes are members of all VLANs specified in the Allowed VLANs field. By default, only VLAN 1 is enabled.
Object Description • Port This is the logical port number for this row. • Mode Access Access ports are normally used to connect to end stations. Dynamic features like Voice VLAN may add the port to more VLANs behind the scenes.
VLAN tag is used to classify the frame on ingress to a particular VLAN, and if so, which TPID it reacts on. Likewise, on egress, the Port Type determines the TPID of the tag, if a tag is required. ■ Unaware: On ingress, all frames, whether carrying a VLAN tag or not, get classified to the Port VLAN, and possible tags are not removed on egress. ■ C-Port: On ingress, frames with a VLAN tag with TPID = 0x8100 get classified to the VLAN ID embedded in the tag.
■ Untag Port VLAN Frames classified to the Port VLAN are transmitted untagged. Other frames are transmitted with the relevant tag. ■ Tag All All frames, whether classified to the Port VLAN or not, are transmitted with a tag. ■ Untag All All frames, whether classified to the Port VLAN or not, are transmitted without a tag. • Allowed VLANs Ports in Trunk and Hybrid mode may control which VLANs they are allowed to become members of.
4.6.4 VLAN Membership Status This Page provides an overview of membership status for VLAN users. The VLAN Membership Status screen in Figure 4-6-4 appears. Figure 4-6-4: VLAN Membership Status for Static User Page Screenshot The Page includes the following fields: Object Description • VLAN User A VLAN User is a module that uses services of the VLAN management functionality to configure VLAN memberships and VLAN port configuration such as PVID, UVID.
Buttons : Select VLAN Users from this drop down list. Auto-refresh : Check this box to refresh the Page automatically. Automatic refresh occurs every 3 seconds. : Click to refresh the Page immediately. : Updates the table starting from the first entry in the VLAN Table, i.e. the entry with the lowest VLAN ID. : Updates the table, starting with the entry after the last entry currently displayed. 4.6.5 VLAN Port Status This Page provides VLAN Port Staus. The VLAN Port Status screen in Figure 4-6-5 appears.
parameter affects VLAN ingress processing. If the port only accepts tagged frames, untagged frames received on that port are discarded. • Port VLAN ID Shows the PVID setting for the port. • Tx Tag Shows egress filtering frame status whether tagged or untagged. • Untagged VLAN ID Shows UVID (untagged VLAN ID). Port's UVID determines the packet's behavior at the egress side. • Conflicts Shows status of Conflicts whether exists or Not.
4.6.6 Port Isolation Overview When a VLAN is configured to be a private VLAN, communication between ports within that VLAN can be prevented. Two application examples are provided in this section: • Customers connected to an ISP can be members of the same VLAN, but they are not allowed to communicate with each other within that VLAN.
mask is applied in addition to the VLAN mask from the VLAN table. This reduces the ports to which forwarding can be done to just the promiscuous ports within the private VLAN. This Page is used for enabling or disabling port isolation on ports in a Private VLAN. A port member of a VLAN can be isolated to other isolated ports on the same VLAN and Private VLAN. The Port Isolation screen in Figure 4-6-7 appears.
4.6.7 VLAN setting example: Separate VLAN 802.1Q VLAN Trunk Port Isolate 4.6.7.1 Two Separate 802.1Q VLANs The diagram shows how the Managed Switch handle Tagged and Untagged traffic flow for two VLANs. VLAN Group 2 and VLAN Group 3 are separated VLAN. Each VLAN isolate network traffic so only members of the VLAN receive traffic from the same VLAN members. The screen in Figure 4-6-8 appears and Table 4-6-9 describes the port configuration of the Managed Switches.
2. [PC-4],[PC-5] and [PC-6] received no packet. 3. While the packet leaves Port-2, it will be stripped away it tag becoming an untagged packet. 4. While the packet leaves Port-3, it will keep as a tagged packet with VLAN Tag=2. Tagged packet entering VLAN 2 5. While [PC-3] transmit a tagged packet with VLAN Tag=2 enters Port-3, [PC-1] and [PC-2] will received the packet through Port-1 and Port-2. 6.
Figure 4-6-10: Change Port VLAN of Port 1~3 to be VLAN2 and Port VLAN of Port 4~6 to be VLAN3 3. Enable VLAN Tag for specific ports Link Type: Port-3 (VLAN-2) and Port-6 (VLAN-3) Change Port 3 Mode as Trunk, Selects Egress Tagging as Tag All and Types 2 in the Allowed VLANs column. Change Port 6 Mode as Trunk and Selects Egress Tagging as Tag All and Types 3 in the Allowed VLANs column. The Per Port VLAN configuration in Figure 4-6-11 appears.
Figure 4-6-12: VLAN Trunking Diagram Setup steps 1. Add VLAN Group Add two VLANs – VLAN 2 and VLAN 3 Type 1-3 in Allowed Access VLANs column, the 1-3 is including VLAN1 and 2 and 3. Figure 4-6-13: Add VLAN 2 and VLAN 3 2.
Figure 4-6-14: Changes Port VLAN of Port 1~3 to be VLAN2 and Port VLAN of Port 4~6 to be VLAN3 For the VLAN ports connecting to the hosts, please refer to 4.6.10.1 examples. The following steps will focus on the VLAN Trunk port configuration. 1. Specify Port-7 to be the 802.1Q VLAN Trunk port. 2. Assign Port-7 to both VLAN 2 and VLAN 3 at the VLAN Member configuration Page. 3. Define a VLAN 1 as a “Public Area” that overlapping with both VLAN 2 members and VLAN 3 members. 4.
6. Repeat Steps 1 to 6, set up the VLAN Trunk port at the partner switch and add more VLANs to join the VLAN trunk, repeat Steps 1 to 3 to assign the Trunk port to the VLANs. 4.6.7.3 Port Isolate The diagram shows how the Managed Switch handles isolated and promiscuous ports, and the each PC is not able to access the isolated port of each other’s PCs. But they all need to access with the same server/AP/Printer.
4.6.8 MAC-based VLAN The MAC-based VLAN enties can be configured here. This Page allows for adding and deleting MAC-based VLAN entries and assigning the entries to different ports. This Page shows only static entries. The MAC-based VLAN screen in Figure 4-6-18 appears. Figure 4-6-18: MAC-based VLAN Membership Configuration Page Screenshot The Page includes the following fields: Object Description • Delete To delete a MAC-based VLAN entry, check this box and press save.
Auto-refresh : Check this box to refresh the Page automatically. Automatic refresh occurs every 3 seconds. : Click to refresh the Page immediately. : Updates the table starting from the first entry in the MAC-based VLAN Table. : Updates the table, starting with the entry after the last entry currently displayed. 4.6.
sub-values. a. DSAP: 1-byte long string (0x00-0xff) b. SSAP: 1-byte long string (0x00-0xff) 4. For SNAP: Valid value in this case also is comprised of two different sub-values. a. OUI: OUI (Organizationally Unique Identifier) is value in format of xx-xx-xx where each pair (xx) in string is a hexadecimal value ranges from 0x00-0xff. b.
Figure 4-6-20: Group Name to VLAN Mapping Table Page Screenshot The Page includes the following fields: Object Description • Delete To delete a Group Name to VLAN map entry, check this box. The entry will be deleted on the switch during the next Save • Group Name A valid Group Name is a string of atmost 16 characters which consists of a combination of alphabets (a-z or A-Z) and integers(0-9), no special character is allowed.
4.7 Spanning Tree Protocol 4.7.1 Theory The Spanning Tree protocol can be used to detect and disable network loops, and to provide backup links between switches, bridges or routers. This allows the switch to interact with other bridging devices in your network to ensure that only one route exists between any two stations on the network, and provide backup links which automatically take over when a primary link goes down.
The port identifier of the transmitting port The switch sends BPDUs to communicate and construct the spanning-tree topology. All switches connected to the LAN on which the packet is transmitted will receive the BPDU. BPDUs are not directly forwarded by the switch, but the receiving switch uses the information in the frame to calculate a BPDU, and, if the topology changes, initiates a BPDU transmission.
Figure 4-7-1: STP Port State Transitions You can modify each port state by using management software. When you enable STP, every port on every switch in the network goes through the blocking state and then transitions through the states of listening and learning at power up. If properly configured, each port stabilizes to the forwarding or blocking state. No packets (except BPDUs) are forwarded from, or received by, STP enabled ports until the forwarding state is enabled for that port. 2.
The following are the user-configurable STP parameters for the switch level: Parameter Description Default Value Bridge Identifier(Not user A combination of the User-set priority and 32768 + MAC configurable the switch’s MAC address.
User-Changeable STA Parameters The Switch’s factory default setting should cover the majority of installations. However, it is advisable to keep the default settings as set at the factory; unless, it is absolutely necessary. The user changeable parameters in the Switch are as follows: Priority – A Priority for the switch can be set from 0 to 65535. 0 is equal to the highest Priority. Hello Time – The Hello Time can be from 1 to 10 seconds.
Figure 4-7-2: Before Applying the STA Rules In this example, only the default STP values are used.
The switch with the lowest Bridge ID (switch C) was elected the root bridge, and the ports were selected to give a high port cost between switches B and C. The two (optional) Gigabit ports (default port cost = 20,000) on switch A are connected to one (optional) Gigabit port on both switch B and C. The redundant link between switch B and C is deliberately chosen as a 100 Mbps Fast Ethernet link (default port cost = 200,000).
The Page includes the following fields: Basic Settings Object Description • Protocol Version The STP protocol version setting. Valid values are: STP (IEEE 802.1D Spanning Tree Protocol) RSTP (IEEE 802.2w Rapid Spanning Tree Protocol) MSTP (IEEE 802.1s Multiple Spanning Tree Protocol) • Bridge Priority Controls the bridge priority. Lower numeric values have better priority.
Control whether a port in the error-disabled state automatically will be enabled • Port Error Recovery after a certain time. If recovery is not enabled, ports have to be disabled and re-enabled for normal STP operation. The condition is also cleared by a system reboot. The time that has to pass before a port in the error-disabled state can be • Port Error Recovery Timeout enabled. Valid values are between 30 and 86400 seconds (24 hours).
• Topology Flag The current state of the Topology Change Flag for this Bridge instance. • Topology Change Last The time since last Topology Change occurred. Buttons Auto-refresh : Check this box to refresh the Page automatically. Automatic refresh occurs every 3 seconds. : Click to refresh the Page immediately. 4.7.4 CIST Port Configuration This Page allows the user to inspect the current STP CIST port configurations, and possibly change them as well.
• Path Cost Controls the path cost incurred by the port. The Auto setting will set the path cost as appropriate by the physical link speed, using the 802.1D recommended values. Using the Specific setting, a user-defined value can be entered. The path cost is used when establishing the active topology of the network. Lower path cost ports are chosen as forwarding ports in favor of higher path cost ports. Valid values are in the range 1 to 200000000. • Priority Controls the port priority.
Buttons : Click to apply changes. : Click to undo any changes made locally and revert to previously saved values. By default, the system automatically detects the speed and duplex mode used on each port, and configures the path cost according to the values shown below. Path cost “0” is used to indicate auto-configuration mode. When the short path cost method is selected and the default path cost recommended by the IEEE 8021w standard exceeds 65,535, the default is set to 65,535. Port Type IEEE 802.
4.7.5 MSTI Priorities This Page allows the user to inspect the current STP MSTI bridge instance priority configurations, and possibly change them as well. The MSTI Priority screen in Figure 4-7-7 appears. Figure 4-7-7: MSTI Priority Page Screenshot The Page includes the following fields: Object Description • MSTI The bridge instance. The CIST is the default instance, which is always active. • Priority Controls the bridge priority. Lower numerical values have better priority.
4.7.6 MSTI Configuration This Page allows the user to inspect the current STP MSTI bridge instance priority configurations, and possibly change them as well. The MSTI Configuration screen in Figure 4-7-8 appears. Figure 4-7-8: MSTI Configuration Page Screenshot The Page includes the following fields: Configuration Identification Object Description • Configuration Name The name identifiying the VLAN to MSTI mapping.
Object Description • MSTI The bridge instance. The CIST is not available for explicit mapping, as it will receive the VLANs not explicitly mapped. The list of VLAN's mapped to the MSTI. The VLANs must be separated with • VLANs Mapped comma and/or space. A VLAN can only be mapped to one MSTI. A unused MSTI should just be left empty. (I.e. not having any VLANs mapped to it.) Buttons : Click to apply changes. : Click to undo any changes made locally and revert to previously saved values. 4.7.
Figure 4-7-10 : MST1 MSTI Port Configuration Page Screenshot The Page includes the following fields: MSTx MSTI Port Configuration Object Description • Port The switch port number of the corresponding STP CIST (and MSTI) port. • Path Cost Controls the path cost incurred by the port. The Auto setting will set the path cost as appropriate by the physical link speed, using the 802.1D recommended values. Using the Specific setting, a user-defined value can be entered.
4.7.8 Port Status This Page displays the STP CIST port status for port physical ports in the currently selected switch. The STP Port Status screen in Figure 4-7-11 appears. Figure 4-7-11: STP Port Status Page Screenshot The Page includes the following fields: Object Description • Port The switch port number of the logical STP port. • CIST Role The current STP port role of the ICST port.
4.7.9 Port Statistics This Page displays the STP port statistics counters for port physical ports in the currently selected switch. The STP Port Statistics screen in Figure 4-7-12 appears. Figure 4-7-12: STP Statistics Page Screenshot The Page includes the following fields: Object Description • Port The switch port number of the logical RSTP port. • MSTP The number of MSTP Configuration BPDU's received/transmitted on the port.
4.8 Multicast 4.8.1 IGMP Snooping The Internet Group Management Protocol (IGMP) lets host and routers share information about multicast groups memberships. IGMP snooping is a switch feature that monitors the exchange of IGMP messages and copies them to the CPU for feature processing. The overall purpose of IGMP Snooping is to limit the forwarding of multicast frames to only ports that are a member of the multicast group.
Figure 4-8-2: Multicast Flooding Figure 4-8-3: IGMP Snooping Multicast Stream Control 145
IGMP Versions 1 and 2 Multicast groups allow members to join or leave at any time. IGMP provides the method for members and multicast routers to communicate when joining or leaving a multicast group. IGMP version 1 is defined in RFC 1112. It has a fixed packet size and no optional data.
The states a computer will go through to join or to leave a multicast group are shown below: Figure 4-8-4: IGMP State Transitions IGMP Querier – A router, or multicast-enabled switch, can periodically ask their hosts if they want to receive multicast traffic. If there is more than one router/switch on the LAN performing IP multicasting, one of these devices is elected “querier” and assumes the role of querying the LAN for group members.
4.8.2 Profile Table This page provides IPMC Profile related configurations. The IPMC profile is used to deploy the access control on IP multicast streams. It is allowed to create at maximum 64 Profiles with at maximum 128 corresponding rules for each. The Profile Table screen in Figure 4-8-5 appears. Figure 4-8-5: IPMC Profile Configuration Page The Page includes the following fields: Object Description • Global Profile Mode Enable/Disable the Global IPMC Profile.
Buttons : Click to add new IPMC profile. Specify the name and configure the new entry. Click "Save”. : Click to apply changes : Click to undo any changes made locally and revert to previously saved values. 4.8.3 Address Entry This page provides address range settings used in IPMC profile. The address entry is used to specify the address range that will be associated with IPMC Profile. It is allowed to create at maximum 128 address entries in the system. The Profile Table screen in Figure 4-8-6 appears.
: Click to apply changes : Click to undo any changes made locally and revert to previously saved values. : Refreshes the displayed table starting from the input fields. : Updates the table starting from the first entry in the IPMC Profile Address Configuration. : Updates the table, starting with the entry after the last entry currently displayed. 4.8.4 IGMP Snooping Configuration This Page provides IGMP Snooping related configuration. The IGMP Snooping Configuration screen in Figure 4-8-7 appears.
When IGMP Snooping is disabled, unregistered IPMCv4 traffic flooding is always active in spite of this setting. • IGMP SSM Range SSM (Source-Specific Multicast) Range allows the SSM-aware hosts and routers run the SSM service model for the groups in the address range. • Leave Proxy Enable Enable IGMP Leave Proxy. This feature can be used to avoid forwarding unnecessary leave messages to the router side. • Proxy Enable Enable IGMP Proxy.
4.8.5 IGMP Snooping VLAN Configuration Each Page shows up to 99 entries from the VLAN table, default being 20, selected through the "entries per Page" input field. When first visited, the web Page will show the first 20 entries from the beginning of the VLAN Table. The first displayed will be the one with the lowest VLAN ID found in the VLAN Table. The "VLAN" input fields allow the user to select the starting point in the VLAN Table. The IGMP Snooping VLAN Configuration screen in Figure 4-8-8 appears.
(PRI) Priority of Interface. It indicates the IGMP control frame priority level • PRI generated by the system. These values can be used to prioritize different classes of traffic. The allowed range is 0 (best effort) to 7 (highest), default interface priority value is 0 Robustness Variable. The Robustness Variable allows tuning for the expected • RV packet loss on a network. The allowed range is 1 to 255, default robustness variable value is 2. Query Interval.
4.8.6 IGMP Snooping Port Group Filtering In certain switch applications, the administrator may want to control the multicast services that are available to end users. For example, an IP/TV service based on a specific subscription plan. The IGMP filtering feature fulfills this requirement by restricting access to specified multicast services on a switch port, and IGMP throttling limits the number of simultaneous multicast groups a port can join.
4.8.7 IGMP Snooping Status This Page provides IGMP Snooping status. The IGMP Snooping Status screen in Figure 4-8-10 appears. Figure 4-8-10: IGMP Snooping Status Page Screenshot The Page includes the following fields: Object Description • VLAN ID The VLAN ID of the entry. • Querier Version Working Querier Version currently. • Host Version Working Host Version currently. • Querier Status Show the Querier status is "ACTIVE" or "IDLE". • Querier Transmitted The number of Transmitted Querier.
Buttons : Click to refresh the Page immediately. : Clears all Statistics counters. Auto-refresh : Automatic refresh occurs every 3 seconds. 4.8.8 IGMP Group Information Entries in the IGMP Group Table are shown on this Page. The IGMP Group Table is sorted first by VLAN ID, and then by group. Each Page shows up to 99 entries from the IGMP Group table, default being 20, selected through the "entries per Page" input field.
4.8.9 IGMPv3 Information Entries in the IGMP SSM Information Table are shown on this Page. The IGMP SSM Information Table is sorted first by VLAN ID, then by group, and then by Port No. Diffrent source addresses belong to the same group are treated as single entry. Each Page shows up to 99 entries from the IGMP SSM (Source Specific Multicast) Information table, default being 20, selected through the "entries per Page" input field.
4.8.10 MLD Snooping Configuration This Page provides MLD Snooping related configuration. The MLD Snooping Configuration screen in Figure 4-8-13 appears. Figure 4-8-13: MLD Snooping Configuration Page Screenshot The Page includes the following fields: Object Description • Snooping Enabled Enable the Global MLD Snooping. • Unregistered IPMCv6 Enable unregistered IPMCv6 traffic flooding. Flooding enabled The flooding control takes effect only when MLD Snooping is enabled.
If an aggregation member port is selected as a router port, the whole aggregation will act as a router port. The allowed selection is Auto, Fix, Fone, default compatibility value is Auto. • Fast Leave Enable the fast leave on the port. • Throtting Enable to limit the number of multicast groups to which a switch port can belong. Buttons : Click to apply changes : Click to undo any changes made locally and revert to previously saved values. 4.8.
Compatibility is maintained by hosts and routers taking appropriate actions • Compatibility depending on the versions of MLD operating on hosts and routers within a network. The allowed selection is MLD-Auto, Forced MLDv1, Forced MLDv2, default compatibility value is MLD-Auto. (PRI) Priority of Interface. It indicates the MLD control frame priority level • PRI generated by the system. These values can be used to prioritize different classes of traffic.
4.8.12 MLD Snooping Port Group Filtering In certain switch applications, the administrator may want to control the multicast services that are available to end users. For example, an IP/TV service based on a specific subscription plan. The MLD filtering feature fulfills this requirement by restricting access to specified multicast services on a switch port, and MLD throttling limits the number of simultaneous multicast groups a port can join.
4.8.13 MLD Snooping Status This Page provides MLD Snooping status. The IGMP Snooping Status screen in Figure 4-8-16 appears. Figure 4-8-16: MLD Snooping Status Page Screenshot The Page includes the following fields: Object Description • VLAN ID The VLAN ID of the entry. • Querier Version Working Querier Version currently. • Host Version Working Host Version currently. • Querier Status Shows the Querier status is "ACTIVE" or "IDLE".
• Port Switch port number. • Status Indicates whether specific port is a router port or not. Buttons : Click to refresh the Page immediately. : Clears all Statistics counters. Auto-refresh : Automatic refresh occurs every 3 seconds. 4.8.14 MLD Group Information Entries in the MLD Group Table are shown on this Page. The MLD Group Table is sorted first by VLAN ID, and then by group.
4.8.15 MLDv2 Information Entries in the MLD SFM Information Table are shown on this Page. The MLD SFM (Source-Filtered Multicast) Information Table also contains the SSM (Source-Specific Multicast) information. This table is sorted first by VLAN ID, then by group, and then by Port. Different source addresses belong to the same group are treated as single entry. Each Page shows up to 99 entries from the MLD SFM Information table, default being 20, selected through the "entries per Page" input field.
4.8.16 MVR (Multicaset VLAN Registration) The MVR feature enables multicast traffic forwarding on the Multicast VLANs. ■ In a multicast television application, a PC or a network television or a set-top box can receive the multicast stream. ■ Multiple set-top boxes or PCs can be connected to one subscriber port, which is a switch port configured as an MVR receiver port.
Figure 4-8-19: MVR Configuration Page Screenshot The Page includes the following fields: Object Description • MVR Mode Enable/Disable the Global MVR. The Unregistered Flooding control depends on the current configuration in IGMP/MLD Snooping. It is suggested to enable Unregistered Flooding control when the MVR group table is full. • Delete Check to delete the entry. The designated entry will be deleted during the next save. • MVR VID Specify the Multicast VLAN ID.
frames. The default IGMP address is not set (0.0.0.0). When the IGMP address is not set, system uses IPv4 management address of the IP interface associated with this VLAN. When the IPv4 management address is not set, system uses the first available IPv4 management address. Otherwise, system uses a pre-defined value. By default, this value will be 192.0.2.1. • Mode Specify the MVR mode of operation. In Dynamic mode, MVR allows dynamic MVR membership reports on source ports.
Buttons : Click to add new MVR VLAN. Specify the VID and configure the new entry. Click "Save" : Click to apply changes : Click to undo any changes made locally and revert to previously saved values. 4.8.17 MVR Status This Page provides MVR status. The MVR Status screen in Figure 4-8-20 appears. Figure 4-8-20: MVR Status Page Screenshot The Page includes the following fields: Object Description • VLAN ID The Multicast VLAN ID.
4.8.18 MVR Groups Information Entries in the MVR Group Table are shown on this Page. The MVR Group Table is sorted first by VLAN ID, and then by group. Each Page shows up to 99 entries from the MVR Group table, default being 20, selected through the "entries per Page" input field. When first visited, the web Page will show the first 20 entries from the beginning of the MVR Group Table. The "Start from VLAN", and "group" input fields allow the user to select the starting point in the MVR Group Table.
Each Page shows up to 99 entries from the MVR SFM Information Table, default being 20, selected through the "entries per Page" input field. When first visited, the web Page will show the first 20 entries from the beginning of the MVR SFM Information Table. The "Start from VLAN", and "Group Address" input fields allow the user to select the starting point in the MVR SFM Information Table. The MVR SFM Information screen in Figure 4-8-22 appears.
4.9 Quality of Service 4.9.1 Understanding QoS Quality of Service (QoS) is an advanced traffic prioritization feature that allows you to establish control over network traffic. QoS enables you to assign various grades of network service to different types of traffic, such as multi-media, video, protocol-specific, time critical, and file-backup traffic. QoS reduces bandwidth limitations, delay, loss, and jitter.
4.9.2 Port Policing This Page allows you to configure the Policer settings for all switch ports. The Port Policing screen in Figure 4-9-1 appears. Figure 4-9-1: QoS Ingress Port Policers Page Screenshot The Page includes the following fields: Object Description • Port The port number for which the configuration below applies. • Enable Controls whether the policer is enabled on this switch port. • Rate Controls the rate for the policer.
Figure 4-9-2 : QoS Ingress Port Classification Page Screenshot The Page includes the following fields: Object Description • Port The port number for which the configuration below applies. • CoS Controls the default class of service. All frames are classified to a CoS. There is a one to one mapping between CoS, queue and priority. A CoS of 0 (zero) has the lowest priority.
the PCP value in the tag. Otherwise the frame is classified to the default PCP value. Controls the default DEI value. • DEI All frames are classified to a DEI value. If the port is VLAN aware and the frame is tagged, then the frame is classified to the DEI value in the tag. Otherwise the frame is classified to the default DEI value. Shows the classification mode for tagged frames on this port. • Tag Class. Disabled: Use default CoS and DPL for tagged frames.
The Page includes the following fields: Object Description • Port The logical port for the settings contained in the same row. Click on the port number in order to configure the schedulers. For more detail, please refer to chapter 4.9.5.1. • Mode Shows the scheduling mode for this port. • Q0 ~ Q5 Shows the weight for this queue and port. 4.9.5 Port Shaping This Page provides an overview of QoS Egress Port Shapers for all switch ports. The Port Shapping screen in Figure 4-9-4 appears.
4.9.5.1 QoS Egress Port Schedule and Shapers The Port Scheduler and Shapers for a specific port are configured on this Page. The QoS Egress Port Schedule and Shaper sscreen in Figure 4-9-5 appears. Figure 4-9-5: QoS Egress Port Schedule and Shapers Page Screenshot The Page includes the following fields: Object Description • Schedule Mode Controls whether the scheduler mode is "Strict Priority" or "Weighted" on this switch port.
Weight This value is restricted to 1-100. This parameter is only shown if "Scheduler Mode" is set to "Weighted". The default value is "17". Shows the weight in percent for this queue. This parameter is only shown if • Queue Scheduler Percent "Scheduler Mode" is set to "Weighted". • Port Shaper Enable Controls whether the port shaper is enabled for this switch port. • Port Shaper Rate Controls the rate for the port shaper.
The Page includes the following fields: Object Description • Port The logical port for the settings contained in the same row. Click on the port number in order to configure tag remarking. For more detail, please refer to chapter 4.9.6.1. Shows the tag remarking mode for this port. • Mode ■ Classified: Use classified PCP/DEI values ■ Default: Use default PCP/DEI values. ■ Mapped: Use mapped versions of QoS class and DP level. 4.9.6.
4.9.7 Port DSCP This Page allows you to configure the basic QoS Port DSCP Configuration settings for all switch ports. The Port DSCP screen in Figure 4-9-8 appears. Figure 4-9-8: QoS Port DSCP Configuration Page Screenshot The Page includes the following fields: Object Description • Port The Port coulmn shows the list of ports for which you can configure dscp ingress and egress settings. • Ingress In Ingress settings you can change ingress translation and classification settings for individual ports.
Remap DP Unaware: DSCP from analyzer is remapped and frame is remarked with remapped DSCP value. The remapped DSCP value is always taken from the 'DSCP Translation->Egress Remap DP0' table. Remap DP Aware: DSCP from analyzer is remapped and frame is remarked with remapped DSCP value. Depending on the DP level of the frame, the remapped DSCP value is either taken from the 'DSCP Translation->Egress Remap DP0' table or from the 'DSCP Translation->Egress Remap DP1' table.
Object Description • DSCP Maximum number of support ed DSCP values are 64. • Trust Controls whether a specific DSCP value is trusted. Only frames with trusted DSCP values are mapped to a specific QoS class and Drop Precedence Level. Frames with untrusted DSCP values are treated as a non-IP frame. • QoS Class QoS Class value can be any of (0-7) • DPL Drop Precedence Level (0-1) 4.9.9 DSCP Translation This Page allows you to configure the basic QoS DSCP Translation settings for all switches.
Ingress side DSCP can be first translated to new DSCP before using the DSCP • Ingress for QoS class and DPL map. There are two configuration parameters for DSCP Translation – ■ Translate ■ Classify • Translate DSCP at Ingress side can be translated to any of (0-63) DSCP values. • Classify Click to enable Classification at Ingress side. • Egress There is following configurable parameter for Egress side ■ Remap Select the DSCP value from select menu to which you want to remap.
Object Description • QoS Class Available QoS Class value ranges from 0 to 7. QoS Class (0-7) can be mapped to followed parameters. • DPL Actual Drop Precedence Level. • DSCP Select DSCP value (0-63) from DSCP menu to map DSCP to corresponding QoS Class and DPL value Buttons : Click to apply changes : Click to undo any changes made locally and revert to previously saved values. 4.9.11 QoS Control List This Page shows the QoS Control List(QCL), which is made up of the QCEs.
• SMAC Displays the OUI field of Source MAC address, i.e. first three octet (byte) of MAC address. • Tag Type Indicates tag type. Possible values are: ■ Any: Match tagged and untagged frames. ■ Untagged: Match untagged frames. ■ Tagged: Match tagged frames. The default value is 'Any' • VID Indicates (VLAN ID), either a specific VID or range of VIDs.
4.9.11.1 QoS Control Entry Configuration The QCE Configuration screen in Figure 4-9-13 appears. Figure 4-9-13: QCE Configuration Page Screenshot The Page includes the following fields: Object Description • Port Members Check the checkbox button in case you what to make any port member of the QCL entry.
3. LLC 4. SNAP 5. IPv4 6. IPv6 Note: all frame types are explained below. • Any Allow all types of frames. • EtherType Ethernet Type Valid ethernet type can have value within 0x600-0xFFFF or 'Any' but excluding 0x800(IPv4) and 0x86DD(IPv6), default value is 'Any'.
DPL Valid Drop Precedence Level can be (0-3) or 'Default'. DSCP Valid DSCP value can be (0-63, BE, CS1-CS7, EF or AF11-AF43) or 'Default'. 'Default' means that the default classified value is not modified by this QCE. Buttons : Click to apply changes : Click to undo any changes made locally and revert to previously saved values : Return to the previous Page without saving the configuration change 4.9.12 QCL Status This Page shows the QCL status by different QCL users.
■ LLC: Only (LLC) frames are allowed. ■ SNAP: Only (SNAP) frames are allowed. ■ IPv4: The QCE will match only IPV4 frames. ■ IPv6: The QCE will match only IPV6 frames. Indicates the classification action taken on ingress frame if parameters • Action configured are matched with the frame's content. There are three action fields: Class, DPL and DSCP. ■ Class: Classified QoS class; if a frame matches the QCE it will be put in the queue.
Figure 4-9-15: Storm Control Configuration Page Screenshot The Page includes the following fields: Object Description • Port The port number for which the configuration below applies. • Enable Controls whether the storm control is enabled on this switch port. • Rate Controls the rate for the storm control. The default value is 500. This value is restricted to 100-1000000 when the "Unit" is "kbps" or "fps", and it is restricted to 1-13200 when the "Unit" is "Mbps" or "kfps”.
Figure 4-9-16 WRED page screenshot The page includes the following fields: Object Description • Queue The queue number (QoS class) for which the configuration below applies. • Enable Controls whether RED is enabled for this queue. • Min. Threshold Controls the lower RED threshold. If the average queue filling level is below this threshold, the drop probability is zero. This value is restricted to 0-100. • Max.
Max. DP 1-3 is the drop probability when the average queue filling level is 100%. Frames marked with Drop Precedence Level 0 are never dropped. Min. Threshold is the average queue filling level where the queues randomly start dropping frames. The drop probability for frames marked with Drop Precedence Level n increases linearly from zero (at Min. Threshold average queue filling level) to Max. DP n (at 100% average queue filling level).
4.9.15 QoS Statistics This Page provides statistics for the different queues for all switch ports. The QoS Statistics screen in Figure 4-9-17 appears. Figure 4-9-17: Queuing Counters Page Screenshot The Page includes the following fields: Object Description • Port The logical port for the settings contained in the same row. • Q0 ~ Q7 There are 8 QoS queues per port. Q0 is the lowest priority queue. • Rx/Tx The number of received and transmitted packets per queue.
Figure 4-9-18: Voice VLAN Configuration Page Screenshot The Page includes the following fields: Object Description • Mode Indicates the Voice VLAN mode operation. We must disable MSTP feature before we enable Voice VLAN. It can avoid the conflict of ingress filter. Possible modes are: • VLAN ID ■ Enabled: Enable Voice VLAN mode operation. ■ Disabled: Disable Voice VLAN mode operation. Indicates the Voice VLAN ID. It should be a unique VLAN ID in the system and cannot equal each port PVID.
• Traffic Class Indicates the Voice VLAN traffic class. All traffic on Voice VLAN will apply this class. • Mode Indicates the Voice VLAN port mode. Possible port modes are: ■ Disabled: Disjoin from Voice VLAN. ■ Auto: Enable auto detect mode. It detects whether there is VoIP phone attached to the specific port and configures the Voice VLAN members automatically. ■ • Port Security Forced: Force join to Voice VLAN. Indicates the Voice VLAN port security mode.
4.9.17 Voice VLAN OUI Table Configure VOICE VLAN OUI table on this Page. The maximum entry number is 16. Modifying the OUI table will restart auto detection of OUI process. The Voice VLAN OUI Table screen in Figure 4-9-19 appears. Figure 4-9-19: Voice VLAN OUI Table Page Screenshot The Page includes the following fields: Object Description • Delete Check to delete the entry. It will be deleted during the next save.
4.10 Access Control Lists ACL is an acronym for Access Control List. It is the list table of ACEs, containing access control entries that specify individual users or groups permitted or denied to specific traffic objects, such as a process or a program. Each accessible traffic object contains an identifier to its ACL. The privileges determine whether there are specific traffic object access rights.
frames. ■ ARP: The ACE will match ARP/RARP frames. ■ IPv4: The ACE will match all IPv4 frames. ■ IPv4/ICMP: The ACE will match IPv4 frames with ICMP protocol. ■ IPv4/UDP: The ACE will match IPv4 frames with UDP protocol. ■ IPv4/TCP: The ACE will match IPv4 frames with TCP protocol. ■ IPv4/Other: The ACE will match IPv4 frames, which are not ICMP/UDP/TCP. ■ IPv6: The ACE will match all IPv6 standard frames. Indicates the forwarding action of the ACE.
4.10.2 Access Control List Configuration This Page shows the Access Control List (ACL), which is made up of the ACEs defined on this switch. Each row describes the ACE that is defined. The maximum number of ACEs is 512 on each switch. Click on the lowest plus sign to add a new ACE to the list. The reserved ACEs used for internal protocol, cannot be edited or deleted, the order sequence cannot be changed and the priority is highest. The Access Control List Configuration screen in Figure 4-10-2 appears.
• Rate Limiter Indicates the rate limiter number of the ACE. The allowed range is 1 to 16. When Disabled is displayed, the rate limiter operation is disabled. • Port Redirect Indicates the port redirect operation of the ACE. Frames matching the ACE are redirected to the port number. The allowed values are Disabled or a specific port number. When Disabled is displayed, the port redirect operation is disabled. • Counter The counter indicates the number of times the ACE was hit by a frame.
4.10.3 ACE Configuration Configure an ACE (Access Control Entry) on this Page. An ACE consists of several parameters. These parameters vary according to the frame type that you select. First select the ingress port for the ACE, and then select the frame type. Different parameter options are displayed depending on the frame type selected. A frame that hits this ACE matches the configuration that is defined here. The ACE Configuration screen in Figure 4-10-3 appears.
■ Ethernet Type: Only Ethernet Type frames can match this ACE. The IEEE 802.3 describes the value of Length/Type Field specifications to be greater than or equal to 1536 decimal (equal to 0600 hexadecimal). ■ ARP: Only ARP frames can match this ACE. Notice the ARP frames won't match the ACE with ethernet type. ■ IPv4: Only IPv4 frames can match this ACE. Notice the IPv4 frames won't match the ACE with ethernet type. ■ IPv6: Only IPv6 frames can match this ACE.
MAC Parameters Object Description • SMAC Filter (Only displayed when the frame type is Ethernet Type or ARP.) Specify the source MAC filter for this ACE. ■ Any: No SMAC filter is specified. (SMAC filter status is "don't-care".) ■ Specific: If you want to filter a specific source MAC address with this ACE, choose this value. A field for entering an SMAC value appears. • SMAC Value When "Specific" is selected for the SMAC filter, you can enter a specific source MAC address.
ARP Parameters The ARP parameters can be configured when Frame Type "ARP" is selected. Object Description • ARP/RARP Specify the available ARP/RARP opcode (OP) flag for this ACE. • Request/Reply • Sender IP Filter ■ Any: No ARP/RARP OP flag is specified. (OP is "don't-care".) ■ ARP: Frame must have ARP/RARP opcode set to ARP. ■ RARP: Frame must have ARP/RARP opcode set to RARP. ■ Other: Frame has unknown ARP/RARP Opcode flag. Specify the available ARP/RARP opcode (OP) flag for this ACE.
• RARP Target MAC Match • IP/Ethernet Length Specify whether frames can hit the action according to their target hardware address field (THA) settings. ■ 0: RARP frames where THA is not equal to the SMAC address. ■ 1: RARP frames where THA is equal to the SMAC address. ■ Any: Any value is allowed ("don't-care"). Specify whether frames can hit the action according to their ARP/RARP hardware address length (HLN) and protocol address length (PLN) settings.
• IP Protocol Value When "Specific" is selected for the IP protocol value, you can enter a specific value. The allowed range is 0 to 255. A frame that hits this ACE matches this IP protocol value. • IP TTL Specify the Time-to-Live settings for this ACE. ■ zero: IPv4 frames with a Time-to-Live field greater than zero must not be able to match this entry. ■ non-zero: IPv4 frames with a Time-to-Live field greater than zero must be able to match this entry.
that appear. • DIP Address When "Host" or "Network" is selected for the destination IP filter, you can enter a specific DIP address in dotted decimal notation. • DIP Mask When "Network" is selected for the destination IP filter, you can enter a specific DIP mask in dotted decimal notation. IPv6 Parameters Object Description • Next Header Fliter Specify the IPv6 next header filter for this ACE. ■ Any: No IPv6 next header filter is specified ("don't-care").
• Hop Limit Specify the hop limit settings for this ACE. ■ zero: IPv6 frames with a hop limit field greater than zero must not be able to match this entry. ■ non-zero: IPv6 frames with a hop limit field greater than zero must be able to match this entry. ■ Any: Any value is allowed ("don't-care”). ICMP Parameters Object Description • ICMP Type Filter Specify the ICMP filter for this ACE. ■ Any: No ICMP filter is specified (ICMP filter status is "don't-care").
■ Range: If you want to filter a specific TCP/UDP source range filter with this ACE, you can enter a specific TCP/UDP source range value. A field for entering a TCP/UDP source value appears. • TCP/UDP Source No. When "Specific" is selected for the TCP/UDP source filter, you can enter a specific TCP/UDP source value. The allowed range is 0 to 65535. A frame that hits this ACE matches this TCP/UDP source value.
• TCP PSH Specify the TCP "Push Function" (PSH) value for this ACE. ■ 0: TCP frames where the PSH field is set must not be able to match this entry. • TCP ACK ■ 1: TCP frames where the PSH field is set must be able to match this entry. ■ Any: Any value is allowed ("don't-care"). Specify the TCP "Acknowledgment field significant" (ACK) value for this ACE. ■ 0: TCP frames where the ACK field is set must not be able to match this entry.
4.10.4 ACL Ports Configuration Configure the ACL parameters (ACE) of each switch port. These parameters will affect frames received on a port unless the frame matches a specific ACE. The ACL Ports Configuration screen in Figure 4-10-4 appears. Figure 4-10-4: ACL Ports Configuration Page Screenshot The Page includes the following fields: Object Description • Port The logical port for the settings contained in the same row. • Policy ID Select the policy to apply to this port.
• Shutdown Specify the port shut down operation of this port. The allowed values are: ■ Enabled: If a frame is received on the port, the port will be disabled. ■ Disabled: Port shut down is disabled. The default value is "Disabled". • State Specify the port state of this port. The allowed values are: ■ Enabled: To reopen ports by changing the volatile port configuration of the ACL user module. ■ Disabled: To close ports by changing the volatile port configuration of the ACL user module.
4.10.5 ACL Rate Limiter Configuration Configure the rate limiter for the ACL of the switch. The ACL Rate Limiter Configuration screen in Figure 4-10-5 appears. Figure 4-10-5: ACL Rate Limiter Configuration Page Screenshot The Page includes the following fields: Object Description • Rate Limiter ID The rate limiter ID for the settings contained in the same row. • Rate (pps) The allowed values are: 0-3276700 in pps or 0, 100, 200, 300, ..., 1000000 in kbps.
4.11 Authentication This section is to control the access of the Managed Switch, includes the user access and management control. The Authentication section contains links to the following main topics: IEEE 802.1X Port-Based Network Access Control MAC-Based Authentication User Authentication Overview of 802.1X (Port-Based) Authentication In the 802.1X-world, the user is called the supplicant, the switch is the authenticator, and the RADIUS server is the authentication server.
to authenticate. The disadvantage is that MAC addresses can be spoofed by malicious users, equipment whose MAC address is a valid RADIUS user can be used by anyone, and only the MD5-Challenge method is supported. The 802.1X and MAC-Based Authentication configuration consists of two sections, a system- and a port-wide.
Figure 4-11-1 Client—the device (workstation) that requests access to the LAN and switch services and responds to requests from the switch. The workstation must be running 802.1X-compliant client software such as that offered in the Microsoft Windows XP operating system. (The client is the supplicant in the IEEE 802.1X specification.) Authentication server—performs the actual authentication of the client.
The switch or the client can initiate authentication. If you enable authentication on a port by using the dot1x port-control auto interface configuration command, the switch must initiate authentication when it determines that the port link state transitions from down to up. It then sends an EAP-request/identity frame to the client to request its identity (typically, the switch sends an initial identity/request frame followed by one or more requests for authentication information).
If a client that does not support 802.1X is connected to an unauthorized 802.1X port, the switch requests the client's identity. In this situation, the client does not respond to the request, the port remains in the unauthorized state, and the client is not granted access to the network. In contrast, when an 802.1X-enabled client connects to a port that is not running the 802.1X protocol, the client initiates the authentication process by sending the EAPOL-start frame.
The Page includes the following fields: Object Description • Client The management client for which the configuration below applies. • Authentication Method Authentication Method can be set to one of the following values: ■ None: authentication is disabled and login is not possible. ■ Local: use the local user database on the switch stack for authentication. ■ RADIUS: use a remote RADIUS server for authentication. ■ TACACS+: use a remote TACACS+ server for authentication.
Figure 4-11-4: Network Access Server Configuration Page Screenshot The Page includes the following fields: System Configuration Object Description • Mode Indicates if NAS is globally enabled or disabled on the switch. If globally disabled, all ports are allowed forwarding of frames. • Reauthentication Enabled If checked, successfully authenticated supplicants/clients are reauthenticated after the interval specified by the Reauthentication Period. Reauthentication for 802.
switch and the client, and therefore doesn't imply that a client is still present on a port. • Reauthentication Period Determines the period, in seconds, after which a connected client must be reauthenticated. This is only active if the Reauthentication Enabled checkbox is checked. Valid values are in the range 1 to 3600 seconds. • EAPOL Timeout Determines the time for retransmission of Request Identity EAPOL frames. Valid values are in the range 1 to 65535 seconds.
the client during the hold time. The Hold Time can be set to a number between 10 and 1000000 seconds. • RADIUS-Assigned QoS Enabled RADIUS-assigned QoS provides a means to centrally control the traffic class to which traffic coming from a successfully authenticated supplicant is assigned on the switch. The RADIUS server must be configured to transmit special RADIUS attributes to take advantage of this feature.
enabled. Valid values are in the range [1; 255]. • Allow Guest VLAN if EAPOL Seen The switch remembers if an EAPOL frame has been received on the port for the life-time of the port. Once the switch considers whether to enter the Guest VLAN, it will first check if this option is enabled or disabled. If disabled (unchecked; default), the switch will only enter the Guest VLAN if an EAPOL frame has not been received on the port for the life-time of the port.
packets also encapsulate EAP PDUs together with other attributes like the switch's IP address, name, and the supplicant's port number on the switch. EAP is very flexible, in that it allows for different authentication methods, like MD5-Challenge, PEAP, and TLS. The important thing is that the authenticator (the switch) doesn't need to know which authentication method the supplicant and the authentication server are using, or how many information exchange frames are needed for a particular method.
allowed access. This is the most secure of all the supported modes. In this mode, the Port Security module is used to secure a supplicant's MAC address once successfully authenticated. Multi 802.1X Multi 802.1X is - like Single 802.1X - not an IEEE standard, but a variant that features many of the same characteristics. In Multi 802.1X, one or more supplicants can get authenticated on the same port at the same time.
the 802.1X standard. The advantage of MAC-based authentication over port-based 802.1X is that several clients can be connected to the same port (e.g. through a 3rd party switch or a hub) and still require individual authentication, and that the clients don't need special supplicant software to authenticate. The advantage of MAC-based authentication over 802.1X-based authentication is that the clients don't need special supplicant software to authenticate.
successfully authenticated. If present and valid, the port's Port VLAN ID will be changed to this VLAN ID, the port will be set to be a member of that VLAN ID, and the port will be forced into VLAN unaware mode. Once assigned, all traffic arriving on the port will be classified and switched on the RADIUS-assigned VLAN ID.
Single 802.1X Multi 802.1X For trouble-shooting VLAN assignments, use the "Monitor→VLANs→VLAN Membership and VLAN Port" Pages. These Pages show which modules have (temporarily) overridden the current Port VLAN configuration. Guest VLAN Operation: When a Guest VLAN enabled port's link comes up, the switch starts transmitting EAPOL Request Identity frames. If the number of transmissions of such frames exceeds Max. Reauth.
authentication is globally enabled and the port's Admin State is in an EAPOL-based or MAC-based mode. Clicking these buttons will not cause settings changed on the Page to take effect. ■ Reauthenticate: Schedules a reauthentication to whenever the quiet-period of the port runs out (EAPOL-based authentication). For MAC-based authentication, reauthentication will be attempted immediately.
4.11.4 Network Access Overview This Page provides an overview of the current NAS port states for the selected switch. The Network Access Overview screen in Figure 4-11-5 appears. Figure 4-11-5: Network Access Server Switch Status Page Screenshot The Page includes the following fields: Object Description • Port The switch port number. Click to navigate to detailed NAS statistics for this port. • Admin State The port's current administrative state.
Buttons : Click to refresh the Page immediately. Auto-refresh : Check this box to refresh the Page automatically. Automatic refresh occurs every 3 seconds. 4.11.5 Network Access Statistics This Page provides detailed NAS statistics for a specific switch port running EAPOL-based IEEE 802.1X authentication. For MAC-based ports, it shows selected backend server (RADIUS Authentication Server) statistics, only. Use the port select box to select which port details to be displayed.
Port Counters Object Description • EAPOL Counters These supplicant frame counters are available for the following administrative states: ■ Force Authorized ■ Force Unauthorized ■ Port-based 802.1X ■ Single 802.1X ■ Multi 802.1X Direction Name IEEE Name Description Rx Total dot1xAuthEapolFrames The number of valid EAPOL Rx frames of any type that have been received by the switch.
which the Packet Body Length field is invalid. Total Tx dot1xAuthEapolFrames The number of EAPOL Tx frames of any type that have been transmitted by the switch. Request ID Tx dot1xAuthEapolReqIdFr The number of EAPOL amesTx Request Identity frames that have been transmitted by the switch. Requests Tx dot1xAuthEapolReqFra The number of valid EAPOL mesTx Request frames (other than Request Identity frames) that have been transmitted by the switch.
Rx Other dot1xAuthBackendOther 802.1X-based: Requests RequestsToSupplicant Counts the number of times that the switch sends an EAP Request packet following the first to the supplicant. Indicates that the backend server chose an EAP-method. MAC-based: Not applicable. Rx Auth. dot1xAuthBackendAuth 802.1X- and MAC-based: Successes Successes Counts the number of times that the switch receives a success indication.
for a given port (left-most table) or client (right-most table). Possible retransmissions are not counted. • Last Supplicant/Client Info Information about the last supplicant/client that attempted to authenticate. This information is available for the following administrative states: ■ Port-based 802.1X ■ Single 802.1X ■ Multi 802.1X ■ MAC-based Auth. Name IEEE Name Description MAC dot1xAuthLastEapolF The MAC address of the last supplicant/client.
no MAC address is currently selected. To populate the table, select one of the attached MAC Addresses from the table below. Attached MAC Address Object Description • Identity Shows the identity of the supplicant, as received in the Response Identity EAPOL frame. Clicking the link causes the supplicant's EAPOL and Backend Server counters to be shown in the Selected Counters table. If no supplicants are attached, it shows No supplicants attached. This column is not available for MAC-based Auth.
Click to clear both the port counters and all of the attached client's counters. The "Last Client" will not be cleared, however. : This button is available in the following modes: • Multi 802.1X • MAC-based Auth.X Click to clear only the currently selected client's counters.
4.11.6 RADIUS This Page allows you to configure the RADIUS Servers. The RADIUS Configuration screen in Figure 4-11-7 appears. Figure 4-11-7: RADIUS Server Configuration Page Screenshot The Page includes the following fields: Global Configuration These setting are common for all of the RADIUS Servers. Object Description • Timeout Timeout is the number of seconds, in the range 1 to 1000, to wait for a reply from a RADIUS server before retransmitting the request.
The IPv4 address to be used as attribute 4 in RADIUS Access-Request packets. • NAS-IP-Address If this field is left blank, the IP address of the outgoing interface is used. • NAS-IPv6-Address The IPv6 address to be used as attribute 95 in RADIUS Access-Request packets. If this field is left blank, the IP address of the outgoing interface is used. The identifier - up to 253 characters long - to be used as attribute 32 in RADIUS • NAS-Identifier Access-Request packets.
4.11.7 TACACS+ This Page allows you to configure the TACACS+ Servers. The TACACS+ Configuration screen in Figure 4-11-8 appears. Figure 4-11-8: TACACS+ Server Configuration Page Screenshot The Page includes the following fields: Global Configuration These setting are common for all of the TACACS+ Servers. Object Description • Timeout Timeout is the number of seconds, in the range 1 to 1000, to wait for a reply from a TACACS+ server before it is considered to be dead.
To delete a TACACS+ server entry, check this box. The entry will be deleted • Delete during the next Save. • Hostname The IP address or hostname of the TACACS+ server. • Port The TCP port to use on the TACACS+ server for authentication. • Timeout This optional setting overrides the global timeout value. Leaving it blank will use the global timeout value. This optional setting overrides the global key. Leaving it blank will use the global • Key key. Buttons : Click to add a new TACACS+ server.
The Page includes the following fields: RADIUS Authentication Server Status Overview Object Description • # The RADIUS server number. Click to navigate to detailed statistics for this server. • IP Address The IP address and UDP port number (in : notation) of this server. • Status The current state of the server. This field takes one of the following values: Disabled: The server is disabled. Not Ready: The server is enabled, but IP communication is not yet up and running.
4.11.9 RADIUS Details This Page provides detailed statistics for a particular RADIUS server. The RADIUS Authentication/Accounting for Server Overview screen in Figure 4-11-10 appears. Figure 4-11-10: RADIUS Authentication/Accounting for Server Overview Page Screenshot The Page includes the following fields: RADIUS Authentication Statistics The statistics map closely to those specified in RFC4668 - RADIUS Authentication Client MIB.
Rx Access radiusAuthClientExtA The number of RADIUS Accepts ccessAccepts Access-Accept packets (valid or invalid) received from the server. Rx Access Rejects radiusAuthClientExtA The number of RADIUS ccessRejects Access-Reject packets (valid or invalid) received from the server. Rx Access radiusAuthClientExtA The number of RADIUS Challenges ccessChallenges Access-Challenge packets (valid or invalid) received from the server.
authentication port and dropped for some other reason. Tx Access radiusAuthClientExtA The number of RADIUS Requests ccessRequests Access-Request packets sent to the server. This does not include retransmissions. Tx Access radiusAuthClientExtA The number of RADIUS Retransmissio ccessRetransmission Access-Request packets ns s retransmitted to the RADIUS authentication server.
in question. State - Shows the state of the server. It takes one of the following values: Disabled: The selected server is disabled. Not Ready: The server is enabled, but IP communication is not yet up and running. Ready: The server is enabled, IP communication is up and running, and the RADIUS module is ready to accept access attempts. Dead (X seconds left): Access attempts were made to this server, but it did not reply within the configured timeout.
Rx Malformed radiusAccClientExt The number of malformed Responses MalformedRespons RADIUS packets received es from the server. Malformed packets include packets with an invalid length. Bad authenticators or or unknown types are not included as malformed access responses. Rx Bad radiusAcctClientExt The number of RADIUS Authenticators BadAuthenticators packets containing invalid authenticators received from the server.
retransmission. Tx Timeouts radiusAccClientExt The number of accounting Timeouts timeouts to the server. After a timeout, the client may retry to the same server, send to a different server, or give up. A retry to the same server is counted as a retransmit as well as a timeout. A send to a different server is counted as a Request as well as a timeout. • Other Info This section contains information about the state of the server and the latest round-trip time.
The granularity of this measurement is 100 ms. A value of 0 ms indicates that there hasn't been round-trip communication with the server yet. Buttons Auto-refresh : Check this box to refresh the Page automatically. Automatic refresh occurs every 3 seconds. : Click to refresh the Page immediately. : Clears the counters for the selected server. The "Pending Requests" counter will not be cleared by this operation. 4.11.
2. Add New RADIUS Cleint on the Windows 2003 server Figure 4-11-12: Windows Server – Add New RADIUS Client Setting 3.
4. The shared secret key should be as same as the key configured on the Managed Switch. Figure 4-11-14: Windows Server RADIUS Server Setting 5. Configure ports attribute of 802.1X, the same as “802.1X Port Configuration”. Figure 4-11-15: 802.1x Port Configuration 6. Create user data. The establishment of the user data needs to be created on the Radius Server PC.
Figure 4-11-16: Windows 2003 AD Server Setting Path 7.
Figure 4-11-17: Add User Properties Screen Figure 4-11-18: Add User Properties Screen Set the Port Authenticate Status to “Force Authorized” if the port is connected to the RADIUS server or the port is an uplink port that is connected to another switch. Or once the 802.1X starts to work, the switch might not be able to access the RADIUS server.
4.11.11 802.1X Client Configuration Windows XP is originally 802.1X support. As to other operating systems (windows 98SE, ME, 2000), an 802.1X client utility is needed. The following procedures show how to configure 802.1X Authentication in Windows XP. Please note that if you want to change the 802.1x authentication type of a wireless client, i.e. switch to EAP-TLS from EAP-MD5, you must remove the current existing wireless network from your preferred connection first, and add it in again.
Figure 4-11-20 7. Click “OK”. 8. When client has associated with the Managed Switch, a user authentication notice appears in system tray. Click on the notice to continue.
9. Enter the user name, password and the logon domain that your account belongs. 10. Click “OK” to complete the validation process.
4.12 Security This section is to control the access of the Managed Switch, includes the user access and management control. The Security Page contains links to the following main topics: Port Limit Control Access Management HTTPs / SSH DHCP Snooping IP Source Guard ARP Inspection 4.12.1 Port Limit Control This Page allows you to configure the Port Security Limit Control system and port settings. Limit Control allows for limiting the number of users on a given port.
The Page includes the following fields: System Configuration Object Description • Mode Indicates if Limit Control is globally enabled or disabled on the switchstack. If globally disabled, other modules may still use the underlying functionality, but limit checks and corresponding actions are disabled. • Aging Enabled If checked, secured MAC addresses are subject to aging as discussed under Aging Period. • Aging Period If Aging Enabled is checked, then the aging period is controlled with this input.
• Limit The maximum number of MAC addresses that can be secured on this port. This number cannot exceed 1024. If the limit is exceeded, the corresponding action is taken. The switch is "born" with a total number of MAC addresses from which all ports draw whenever a new MAC address is seen on a Port Security-enabled port. Since all ports draw from the same pool, it may happen that a configured maximum cannot be granted, if the remaining ports have already used all available MAC addresses.
• Re-open Button If a port is shutdown by this module, you may reopen it by clicking this button, which will only be enabled if this is the case. For other methods, refer to Shutdown in the Action section. Note, that clicking the reopen button causes the Page to be refreshed, so non-committed changes will be lost. Buttons : Click to apply changes : Click to undo any changes made locally and revert to previously saved values. : Click to refresh the Page. Note that non-committed changes will be lost.
4.12.2 Access Management Configure access management table on this Page. The maximum entry number is 16. If the application's type match any one of the access management entries, it will allow access to the switch. The Access Management Configuration screen in Figure 4-12-2 appears. Figure 4-12-2: Access Management Configuration Overview Page Screenshot The Page includes the following fields: Object Description • Mode Indicates the access management mode operation.
4.12.3 Access Management Statistics This Page provides statistics for access management. The Access Management Statistics screen in Figure 4-12-3 appears. Figure 4-12-3: Access Management Statistics Overview Page Screenshot The Page includes the following fields: Object Description • Interface The interface that allowed remote host can access the switch. • Receive Packets The received packets number from the interface under access management mode is enabled.
4.12.4 HTTPs Configure HTTPS on this Page. The HTTPS Configuration screen in Figure 4-12-4 appears. Figure 4-12-4: HTTPS Configuration Screen Page Screenshot The Page includes the following fields: Object Description • Mode Indicates the HTTPS mode operation. When the current connection is HTTPS, to apply HTTPS disabled mode operation will automatically redirect web browser to an HTTP connection. Possible modes are: • Automatic Redirect Enabled: Enable HTTPS mode operation.
4.12.5 SSH Configure SSH on this Page. This Page shows the Port Security status. Port Security is a module with no direct configuration. Configuration comes indirectly from other modules - the user modules. When a user module has enabled port security on a port, the port is set-up for software-based learning. In this mode, frames from unknown MAC addresses are passed on to the port security module, which in turn asks all user modules whether to allow this new MAC address to forward or block it.
Security Status screen in Figure 4-12-6 appears. Figure 4-12-6: Port Security Status Screen Page Screenshot The Page includes the following fields: User Module Legend The legend shows all user modules that may request Port Security services. Object Description • User Module Name The full name of a module that may request Port Security services. • Abbr A one-letter abbreviation of the user module. This is used in the Users column in the port status table.
not enabled, whereas a letter indicates that the user module abbreviated by that letter has enabled port security. Shows the current state of the port. It can take one of four values: • State Disabled: No user modules are currently using the Port Security service. Ready: The Port Security service is in use by at least one user module, and is awaiting frames from unknown MAC addresses to arrive.
4.12.7 Port Security Detail This Page shows the MAC addresses secured by the Port Security module. Port Security is a module with no direct configuration. Configuration comes indirectly from other modules - the user modules. When a user module has enabled port security on a port, the port is set-up for software-based learning.
4.12.8 DHCP Snooping DHCP Snooping is used to block intruder on the untrusted ports of DUT when it tries to intervene by injecting a bogus DHCP reply packet to a legitimate conversation between the DHCP client and server. Configure DHCP Snooping on this Page. The DHCP Snooping Configuration screen in Figure 4-12-8 appears.
Figure 4-12-8: DHCP Snooping Configuration Screen Page Screenshot The Page includes the following fields: Object Description • Snooping Mode Indicates the DHCP snooping mode operation. Possible modes are: Enabled: Enable DHCP snooping mode operation. When enable DHCP snooping mode operation, the request DHCP messages will be forwarded to trusted ports and only allowed reply packets from trusted ports. Disabled: Disable DHCP snooping mode operation. Indicates the DHCP snooping port mode.
reached the text "No more entries" is shown in the displayed table : To start over 4.12.10 IP Source Guard Configuration IP Source Guard is a secure feature used to restrict IP traffic on DHCP snooping untrusted ports by filtering traffic based on the DHCP Snooping Table or manually configured IP Source Bindings. It helps prevent IP spoofing attacks when a host tries to spoof and use the IP address of another host. This Page provides IP Source Guard related configuration.
given port. • Max Dynamic Clients Specify the maximum number of dynamic clients can be learned on given ports. This value can be 0, 1, 2 and unlimited. If the port mode is enabled and the value of max dynamic client is equal 0, it means only allow the IP packets forwarding that are matched in static entries on the specific port. Buttons : Click to translate all dynamic entries to static entries. : Click to apply changes : Click to undo any changes made locally and revert to previously saved values. 4.12.
: Click to undo any changes made locally and revert to previously saved values. 4.12.12 ARP Inspection ARP Inspection is a secure feature. Several types of attacks can be launched against a host or devices connected to Layer 2 networks by "poisoning" the ARP caches. This feature is used to block such attacks. Only valid ARP requests and responses can go through DUT. This Page provides ARP Inspection related configuration. The ARP Inspection Configuration screen in Figure 4-12-12 appears.
If you want to inspect the VLAN configuration, you have to enable the setting of "Check VLAN". The default setting of "Check VLAN" is disabled. When the setting of "Check VLAN" is disabled, the log type of ARP Inspection will refer to the port setting. And the setting of "Check VLAN" is enabled, the log type of ARP Inspection will refer to the VLAN setting. Possible setting of "Check VLAN" are: Enabled: Enable check VLAN operation. Disabled: Disable check VLAN operation.
Object Description • Delete Check to delete the entry. It will be deleted during the next save. • Port The logical port for the settings. • VLAN ID The VLAN ID for the settings. • MAC Address Allowed Source MAC address in ARP request packets. • IP Address Allowed Source IP address in ARP request packets. Buttons : Click to add a new entry to the Static ARP Inspection table. : Click to apply changes : Click to undo any changes made locally and revert to previously saved values.
4.1 Address Table Switching of frames is based upon the DMAC address contained in the frame. The Managed Switch builds up a table that maps MAC addresses to switch ports for knowing which ports the frames should go to (based upon the DMAC address in the frame ). This table contains both static and dynamic entries. The static entries are configured by the network administrator if the administrator wants to do a fixed mapping between the DMAC address and switch ports.
The Page includes the following fields: Aging Configuration By default, dynamic entries are removed from the MAC table after 300 seconds. This removal is also called aging. Object Description • Disable Automatic Enables/disables the the automatic aging of dynamic entries Aging • Aging Time The time after which a learned entry is discarded. By default, dynamic entries are removed from the MAC after 300 seconds. This removal is also called aging.
Buttons : Click to apply changes : Click to undo any changes made locally and revert to previously saved values. 4.13.2 MAC Address Table Status Dynamic MAC Table Entries in the MAC Table are shown on this Page. The MAC Table contains up to 8192 entries, and is sorted first by VLAN ID, then by MAC address. The MAC Address Table screen in Figure 4-13-2 appears.
The Page includes the following fields: Object Description • Type Indicates whether the entry is a static or dynamic entry. • VLAN The VLAN ID of the entry. • MAC Address The MAC address of the entry. • Port Members The ports that are members of the entry. Buttons Auto-refresh : Automatic refresh occurs every 3 seconds. : Refreshes the displayed table starting from the "Start from MAC address" and "VLAN" input fields. : Flushes all dynamic entries.
the value of the first displayed entry, allowing for continuous refresh with the same start address. The “>>” will use the last entry of the currently displayed as a basis for the next lookup. When the end is reached the text "No more entries" is shown in the displayed table. Use the “|<<” button to start over. The Page includes the following fields: Object Description • Port The port number for which the status applies. Click the port number to see the status for this particular port.
Navigating the ARP Inspection Table Each Page shows up to 99 entries from the Dynamic IP Source Guard table, default being 20, selected through the "entries per Page" input field. When first visited, the web Page will show the first 20 entries from the beginning of the Dynamic IP Source Guard Table. The "Start from port address", "VLAN", "IP address" and "IP mask" input fields allow the user to select the starting point in the Dynamic IP Source Guard Table.
4.14 LLDP 4.14.1 Link Layer Discovery Protocol Link Layer Discovery Protocol (LLDP) is used to discover basic information about neighboring devices on the local broadcast domain. LLDP is a Layer 2 protocol that uses periodic broadcasts to advertise information about the sending device. Advertised information is represented in Type Length Value (TLV) format according to the IEEE 802.1ab standard, and can include details such as device identification, capabilities and configuration settings.
Object Description • Tx Interval The switch is periodically transmitting LLDP frames to its neighbors for having the network discovery information up-to-date. The interval between each LLDP frame is determined by the Tx Interval value. Valid values are restricted to 5 32768 seconds.
information received from neighbors. Enabled The switch will send out LLDP information, and will analyze LLDP information received from neighbors. • CDP Aware Select CDP awareness. The CDP operation is restricted to decoding incoming CDP frames (The switch doesn't transmit CDP frames). CDP frames are only decoded if LLDP on the port is enabled. Only CDP TLVs that can be mapped to a corresponding field in the LLDP neighbours' table are decoded.
4.14.3 LLDP MED Configuration This Page allows you to configure the LLDP-MED. The LLDPMED Configuration screen in Figure 4-14-2 appears. Figure 4-14-2: LLDPMED Configuration Page Screenshot The Page includes the following fields: Fast start repeat count Object Description • Fast start repeat count Rapid startup and Emergency Call Service Location Identification Discovery of endpoints is a critically important aspect of VoIP systems in general.
advertise LLDP-MED TLVs in outgoing LLDPDUs on the associated port. The LLDP-MED application will temporarily speed up the transmission of the LLDPDU to start within a second, when a new LLDP-MED neighbour has been detected in order share LLDP-MED information as fast as possible to new neighbours.
WGS84: (Geographical 3D) - World Geodesic System 1984, CRS Code 4327, Prime Meridian Name: Greenwich. NAD83/NAVD88: North American Datum 1983, CRS Code 4269, Prime Meridian Name: Greenwich; The associated vertical datum is the North American Vertical Datum of 1988 (NAVD88). This datum pair is to be used when referencing locations on land, not near tidal water (which would use Datum = NAD83/MLLW).
• Place type Place type - Example: Office • Postal community Postal community name - Example: Leonia name • P.O. Box Post office box (P.O. BOX) - Example: 12345 • Additional code Additional code - Example: 1320300003 Emergency Call Service Emergency Call Service (e.g. E911 and others), such as defined by TIA or NENA.
LLDP-MED allows multiple policies to be advertised per port, each corresponding to a different application type. Different ports on the same Network Connectivity Device may advertise different sets of policies, based on the authenticated user identity or port configuration.
Streaming Video - for use by broadcast or multicast based video content distribution and other similar applications supporting streaming video services that require specific network policy treatment. Video applications relying on TCP with buffering would not be an intended use of this application type. Video Signaling (conditional) - for use in network topologies that require a separate policy for the video signaling than for the video media.
Object Description • Port The port number for which the configuration applies. • Policy ID The set of policies that shall apply for a given port. The set of policies is selected by checkmarking the checkboxes that corresponds to the policies Buttons : Click to apply changes : Click to undo any changes made locally and revert to previously saved values. 4.14.4 LLDP-MED Neighbor This Page provides a status overview for all LLDP-MED neighbors.
2. IEEE 802.1 Bridge 3. IEEE 802.3 Repeater (included for historical reasons) 4. IEEE 802.11 Wireless Access Point 5. Any device that supports the IEEE 802.1AB and MED extensions defined by TIA-1057 and can relay IEEE 802 frames via any method. LLDP-MED Endpoint Device Definition Within the LLDP-MED Endpoint Device category, the LLDP-MED scheme is broken into further Endpoint Device Classes, as defined in the following.
expected to adhere to this class include (but are not limited to) end user communication appliances, such as IP Phones, PC-based softphones, or other communication appliances that directly support the end user. Discovery services defined in this class include provision of location identifier (including ECS / E911 information), embedded L2 switch support, inventory management • LLDP-MED Capabilities LLDP-MED Capabilities describes the neighbor unit's LLDP-MED capabilities. The possible capabilities are: 1.
policy for the video signaling than for the video media. Policy indicates that an Endpoint Device wants to explicitly advertise that the • Policy policy is required by the device. Can be either Defined or Unknown Unknown: The network policy for the specified application type is currently unknown. Defined: The network policy is defined. TAG is indicating whether the specified application type is using a tagged or an • TAG untagged VLAN.
4.14.5 Neighbor This Page provides a status overview for all LLDP neighbors. The displayed table contains a row for each port on which an LLDP neighbor is detected. The LLDP Neighbor Information screen in Figure 4-14-4 appears. Figure 4-14-4: LLDP Neighbor Information Page Screenshot The Page includes the following fields: Object Description • Local Port The port on which the LLDP frame was received. • Chassis ID The Chassis ID is the identification of the neighbor's LLDP frames.
4.14.6 Port Statistics This Page provides an overview of all LLDP traffic. Two types of counters are shown. Global counters are counters that refer to the whole stack, switch, while local counters refers to counters for the currently selected switch. The LLDP Statistics screen in Figure 4-14-5 appears.
The displayed table contains a row for each port. The columns hold the following information: Object Description • Local Port The port on which LLDP frames are received or transmitted. • Tx Frames The number of LLDP frames transmitted on the port. • Rx Frames The number of LLDP frames received on the port. • Rx Errors The number of received LLDP frames containing some kind of error.
4.15 Network Diagnostics This section provide the Physical layer and IP layer network diagnostics tools for troubleshoot. The diagnostic tools are designed for network manager to help them quickly diagnose problems between point to point and better service customers. Use the Diagnastics menu items to display and configure basic administrative details of the Managed Switch.
4.15.1 Ping This Page allows you to issue ICMP PING packets to troubleshoot IP connectivity issues. After you press “Start”, 5 ICMP packets are transmitted, and the sequence number and roundtrip time are displayed upon reception of a reply. The Page refreshes automatically until responses to all packets are received, or until a timeout occurs. The ICMP Ping screen in Figure 4-15-1 appears.
4.15.2 IPv6 Ping This Page allows you to issue ICMPv6 PING packets to troubleshoot IPv6 connectivity issues. After you press “Start”, 5 ICMPv6 packets are transmitted, and the sequence number and roundtrip time are displayed upon reception of a reply. The Page refreshes automatically until responses to all packets are received, or until a timeout occurs. The ICMPv6 Ping screen in Figure 4-15-2 appears.
4.15.3 Remote IP Ping Test This Page allows you to issue ICMP PING packets to troubleshoot IP connectivity issues on special port. After you press “Test”, 5 ICMP packets are transmitted, and the sequence number and roundtrip time are displayed upon reception of a reply. The Page refreshes automatically until responses to all packets are received, or until a timeout occurs. The ICMP Ping screen in Figure 4-15-3 appears.
4.15.4 Cable Diagnostics This Page is used for running the Cable Diagnostics. Press to run the diagnostics. This will take approximately 5 seconds. If all ports are selected, this can take approximately 15 seconds. When completed, the Page refreshes automatically, and you can view the cable diagnostics results in the cable status table. Note that Cable Diagnostics is only accurate for cables of length 7 - 140 meters. 10 and 100 Mbps ports will be linked down while running cable diagnostic.
The Page includes the following fields: Object Description • Port The port where you are requesting Cable Diagnostics. • Description Display per port description. • Cable Status Port: Port number. Pair: The status of the cable pair.
4.16 Power over Ethernet Providing up to 24 PoE, in-line power interfaces, the NS4802 PoE Switch can easily build a power central-controlled IP phone system, IP Camera system, AP group for the enterprise. For instance, 24 camera / AP can be easily installed around the corner in the company for surveillance demands or build a wireless roaming environment in the office. Without the power-socket limitation, the NS4802 PoE Switch makes the installation of cameras or WLAN AP more easily and efficiently.
Wireless LAN Access Points Museum, Sightseeing, Airport, Hotel, Campus, Factory, Warehouse can 6~12 Watts install the Access Point any where with no hesitation. IP Surveillance Enterprise, Museum, Campus, Hospital, Bank, can install IP Camera 10~12 Watts without limits of install location – no need electrician to install AC sockets. PoE Splitter PoE Splitter split the PoE 56V DC over the Ethernet cable into 5/12V DC power output.
4.16.2 System Configuration In a power over Ethernet system, operating power is applied from a power source (PSU-power supply unit) over the LAN infrastructure to powered devices (PDs), which are connected to ports. Under some conditions, the total output power required by PDs can exceed the maximum available power provided by the PSU. The system may a prior be planed with a PSU capable of supplying less power than the total potential power consumption of all the PoE ports in the system.
Allocation mode In this mode the user allocates the amount of power that each port may reserve. The allocated/reserved power for each port/PD is specified in the Maximum Power fields. The ports are shut down when total reserved powered exceeds the amount of power that the power supply can deliver. In this mode the port power is not turned on if the PD requests more available power. LLDP mode In this mode the ports of PoE power is managed and determined by LLDP Media protocol. 4.16.
Class-Reserved-Power mode: System reserves PoE power to PD according to PoE class level. Allocation-Consumption mode: System offers PoE power according to PD real power consumption. Allocation-Reserved-Power mode: Users allow to assign how much PoE power for per port and system will reserves PoE power to PD. LLDP-Consumption mode: System offers PoE power according to PD real power consumption. LLDP-Reserved-Power mode: System reserves PoE power to PD according to LLDP configuration.
4.16.4 Port Sequential This page allows the user to configure the PoE Ports started up interval time. The PoE Port will start up one by one as Figure 4-16-3 shows. Figure 4-16-3: PoE Port Sequential Power Up Interval Configuration Screenshot The PoE port will start up after the whole system program has finished running post diagnostics. Starts with Port 0 up to Port 24 at 5 second intervals is default.
4.16.5 Port Configuration This section allows the user to inspect and configure the current PoE port settings as Figure 4-16-4 shows. Figure 4-16-4: Power over Ethernet Configuration Screenshot The page includes the following fields: Object Description • PoE Mode There are three modes for PoE mode. Enable: enable PoE function.. Disable: disable PoE function. Schedule: enable PoE function in schedule mode. • Schedule Indicates the schedule profile mode.
• AF/AT Mode Allows user to select 802.3at or 802.3af compatibility mode. The default vaule is 802.3at mode. This function wil affect PoE power reservation on Classification power limit mode only, as 802.3af mode, system is going to reserve 15.4W maximum for PD that supported Class3 level. As IEEE 802.3at mode, system is going to reserve 30.8Watts for PD that support Class4 level. From class1 to class3 level on the 802.3at mode will be reserved the same PoE power with 802.3af mode.
4.16.6 PoE Status This page allows the user to inspect the total power consumption, total power reserved and current status for all PoE ports. The screen in Figure 4-16-5 appears. Figure 4-16-5:PoE Status Screenshot The page includes the following fields: Object Description • Sequential Power On Displays the current sequential power on mode. • System Power Budget Displays the maximum PoE power budget. • Operation mode Displays the current PoE operation mode.
• Reserved Power Shows how much the total power be reserved for all PDs. (Reserved mode) • PoE Temperature Displays the current operating temperature of first PoE chip unit. Chipset 1 = port 1 ~ 12; Chipset 2 = port 13 ~ 24 • Current Power Shows the total watts usage of Managed PoE Switch. Consumption • Total Power Reserved Shows how much the total power be reserved for all PDs. • Temperature 1 Displays the current operating temperature of first PoE chip unit.
4.16.7 PoE Schedule This page allows the user to define PoE schedule and schedule power recycle. PoE Schedule Besides being used as an IP Surveillance, the Managed PoE switch is certainly applicable to construct any PoE network including VoIP and Wireless LAN. Under the trend of energy saving worldwide and contributing to the environmental protection on the Earth, the Managed PoE switch can effectively control the power supply besides its capability of giving high watts power.
The screen in Figure 4-16-6 appears. Figure 4-16-6: PoE Schedule Screenshot Please press Add New Rule button to start set PoE Schedule function. You have to set PoE schedule to profile then go back to PoE Port Configuration, and select “Schedule” mode from per port “PoE Mode” option then you can indicate which schedule profile could be apply to the PoE port. The page includes the following fields: Object Description • Profile Set the schedule profile mode.
• End Min Allows user to set what minute does PoE function disables. • Reboot Enable Allows user to enable or disable whole PoE port reboot by PoE reboot schedule. Please be noticed that if you want to PoE schedule and PoE reboot schedule work at the same time, please use this function, and don’t use Reboot Only function. This function offers administrator to reboot PoE device at indicate time if administrator has this kind of requirement.
4.16.8 LLDP PoE Neighbours This page provides a status overview for all LLDP PoE neighbors. The displayed table contains a row for each port on which an LLDP PoE neighbor is detected. The columns hold the following information: The screen in Figure 4-16-78 appears. Figure 4-16-87: LLDP PoE Neighbour Screenshot Please be noticed that administrator has to enable LLDP port from LLDP configuration, please refer to following example (The screen in Figure 4-16-98 appears.
4.17 Loop Protection This chapter describes enabling loop protection function that provides loop protection to prevent broadcast loops in Managed Switch. 4.17.1 Configuration This Page allows the user to inspect the current Loop Protection configurations, and possibly change them as well; screen in Figure 4-17-1 appears.
The period (in seconds) for which a port will be kept disabled in the event of a • Shutdown Time loop is detected (and the port action shuts down the port). Valid values are 0 to 604800 seconds (7 days). A value of zero will keep a port disabled (until next device restart). Port Configuration Object Description • Port The switch port number of the port. • Enable Controls whether loop protection is enabled on this switch port.
• Loops The number of loops detected on this port. • Status The current loop protection status of the port. • Loop Whether a loop is currently detected on the port. • Time of Last Loop The time of the last loop event detected. Buttons : Click to refresh the Page immediately. Auto-refresh : Check this box to enable an automatic refresh of the Page at regular intervals.
4.18 RMON RMON is the most important expansion of the standard SNMP. RMON is a set of MIB definitions, used to define standard network monitor functions and interfaces, enabling the communication between SNMP management terminals and remote monitors. RMON provides a highly efficient method to monitor actions inside the subnets. MIB of RMON consists of 10 groups.
InNUcastPkts: The number of broad-cast and multi-cast packets delivered to a higher-layer protocol. InDiscards: The number of inbound packets that are discarded even the packets are normal. InErrors: The number of inbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. InUnknownProtos: the number of the inbound packets that were discarded because of the unknown or un-support protocol.
4.18.2 RMON Alarm Status This Page provides an overview of RMON Alarm entries. Each Page shows up to 99 entries from the Alarm table, default being 20, selected through the "entries per Page" input field. When first visited, the web Page will show the first 20 entries from the beginning of the Alarm table. The first displayed will be the one with the lowest ID found in the Alarm table; screen in Figure 4-18-2 appears.
4.18.3 RMON Event Configuration Configure RMON Event table on this Page. The entry index key is ID; screen in Figure 4-18-3 appears. Figure 4-18-4: RMON Event Configuration Page Screenshot The Page includes the following fields: Object Description • Delete Check to delete the entry. It will be deleted during the next save. • ID Indicates the index of the entry. The range is from 1 to 65535. • Desc Indicates this event, the string length is from 0 to 127, default is a null string.
4.18.4 RMON Event Status This Page provides an overview of RMON Event table entries.Each Page shows up to 99 entries from the Event table, default being 20, selected through the "entries per Page" input field. When first visited, the web Page will show the first 20 entries from the beginning of the Event table. The first displayed will be the one with the lowest Event Index and Log Index found in the Event table table; screen in Figure 4-18-5 appears.
4.18.5 RMON History Configuration Configure RMON History table on this Page. The entry index key is ID; screen in Figure 4-18-6 appears. Figure 4-18-6: RMON History Configuration Page Screenshot The Page includes the following fields: Object Description • Delete Check to delete the entry. It will be deleted during the next save. • ID Indicates the index of the entry. The range is from 1 to 65535. • Data Source Indicates the port ID which wants to be monitored.
4.18.6 RMON History Status This Page provides an detail of RMON history entries; screen in Figure 4-18-7 appears. Figure 4-18-7: RMON History Overview Page Screenshot The Page includes the following fields: Object Description • History Index Indicates the index of History control entry. • Sample Index Indicates the index of the data entry associated with the control entry. • Sample Start The value of sysUpTime at the start of the interval over which this sample was measured.
• Utilization The best estimate of the mean physical layer network utilization on this interface during this sampling interval, in hundredths of a percent. Buttons : Click to refresh the Page immediately. Auto-refresh : Check this box to refresh the Page automatically. Automatic refresh occurs every 3 seconds. : Updates the table, starting from the first entry in the History table, i.e.
4.18.8 RMON Statistics Status This Page provides an overview of RMON Statistics entries. Each Page shows up to 99 entries from the Statistics table, default being 20, selected through the "entries per Page" input field. When first visited, the web Page will show the first 20 entries from the beginning of the Statistics table. The first displayed will be the one with the lowest ID found in the Statistics table; screen in Figure 4-18-9 appears.
• Coll. The best estimate of the total number of collisions on this Ethernet segment. • 64 Bytes The total number of packets (including bad packets) received that were 64 octets in length. The total number of packets (including bad packets) received that were between • 65~127 65 to 127 octets in length. The total number of packets (including bad packets) received that were between • 128~255 128 to 255 octets in length.
4.19 Stack Using Stacking, it is possible to connect a number of switches together in a stack, which behaves as a single switch as seen from outside the stack. Two types of stack topologies are supported: Ring topology Chain topology (same as a disconnected ring) Multiple IFS devices may be connected together to constitute a ring or chain stack topology using the STX / 10Gbps SFP+ ports as interconnect links.
Chain Stack: A chain of sample switches, that is, no redundant forwarding paths. Figure 4-19-1 Chain Stack topology Ring Stack: A ring of sample switches, thereby providing redundant forwarding paths. Figure 4-19-2 Ring Stack topology Back-to-Back Stack : Two sample switches interconnected on both stacking ports.
4.19.1 Stack This section provides information for understand stacking architecture, include the below items: Switch IDs • Assigning and Swapping Switch IDs • Removing a Switch From the Stack • Replacing a Switch • General Switch ID Assignment Rules Master Election Stack Redundancy Shortest Path Forwarding 4.19.1.1 Switch IDs The Switch ID (1-16) assigned to a IFS-NS4802-24P-4S-2X Switch.
General Switch ID Assignment Rules When assigning Switch IDs to the devices in the stack, you must note the following: 1. Switches with assigned IDs can be changed to use any other switch ID (possibly by swapping Switch ID with another active switch). 2. When swapping two Switch IDs, the devices will retain their (own) configuration, except for the Switch ID. 3. Switches without an assigned Switch ID can only be assigned to any unused ID. 4.
Figure 4-19-4 Remove or Replace a switch from the stack 4.19.1.4 Shortest Path Forwarding The IFS-NS4802 Swtich supports shortest path forwarding technology to optimal data flow across the stack. The advantage of shortest path forwarding as below: Automatic Loop Prevention – Using Time To Live (TTL) information in the stack-header Utilize all stack links in the ring. Figure 4-19-5 True Ring Topology 4.19.
information. The screen in Figure 4-19-6appears. Figure 4-19-6 Stack Configuration page screenshot The page includes the following fields: Object Description • Delete Deletes this switch from the stack configuration. • Stack Member The MAC address of the switch. • Switch ID The Switch ID (1-16) assigned to a switch. For more information, see description of Switch IDs Assigning and Swapping Switch IDs When a switch is added to the stack, a Switch ID is automatically assigned to the switch.
2. Insert the new switch into the stack. The new switch is assigned an unused Switch ID. 3. To remove the automatic switch ID assignment, choose "Delete", followed by "Save". The new switch is then shown with Switch ID set to "-". 4. To assign the configuration of Switch ID 3 to the new hardware, simply choose 3 in the Switch ID column and click "Save". 5. The new hardware has now taken over the configuration of the failing hardware.
This is done by clicking "Start Master Election", followed by "Save". This causes the first two criteria to be ignored, thereby basing master election only on master priority and MAC address. When master election is enforced, the first two criteria are ignored for a period of 10-15 seconds. Within a managed stack, one master switch (or just "master") must be elected. Any switch not being master is a slave switch (or just "slave"). To elect a master, the following criteria are evaluated sequentially: 1.
4.19.3 Stack Information This page provides an overview of the stack topology, as detected by SPROUT. Stack Topology The Stack Topology screen in Figure 4-19-7 appears. Figure 4-17-7 Stack Information page screenshot - Stack Topology The page includes the following fields: Object Description • Stack Topology Specifies the type of topology for the stack: Chain: A chain of switches, that is, no redundant forwarding paths. Ring: A ring of switches, thereby providing redundant forwarding paths.
For each switch in the stack, the following information is shown: • The MAC address, switch ID, distance information, and the primary forwarding path to the switch. • For ring topology, a backup path is also provided. Figure 4-19-9 Stack Information page screenshot - Master Forwarding Table 4.19.4 Stack Port State Overview This page provides an overview of the current switch port states. Clicking on the image of a port opens the Port Statistics page.
Step 2: Check the Master LED of each NS4802 switch to find out the Master Switch that is elected automatically by the stack operation. Step 3: Use the Web browser such as IE 7.0 to login the Master Switch, the default IP address is 192.168.0.100. Or you can use the IFS Smart Discovery Utility to find out the IP address of the stack group. Figure 4-19-11 Use IFS Smart Discovery Utility to display the IP address of stack master Step 4: Choose “Stack \ Stack Configuration” from menu tree.
Figure 4-19-13 Assing new ID for current master Example 2: Currently a8-f7-e0-06-a6-da is the master of stack group, and we wish to make the NS4802 switch with “MAC: a8-f7-e0-06-af-cd/ Priority=1” be the Master Switch of stack group. Select the target switch and set up with higher priority “1”. After click Save, click “Start Master Election” and save again. Apply the settings with Apply button. Figure 4-19-14 Assing higher priority value fo the target switch View the master status from “Stack \
Figure 4-19-16 To manage the member switch Slave switch IP will be covered by Master one, and disappear temporarily. The slave IP address can be the same as Master IP address. Thus, if master switch is malfunctioned, you can still access the other switch by the same IP address. If you have difficulty in selecting another switch, you may be connecting to the slave switch’s web. Please close the browser window, use the “arp –d * ” DOS command to clear the ARP table and then reopen the web.
5. SWITCH OPERATION 5.1 Address Table The Managed Switch is implemented with an address table. This address table composed of many entries. Each entry is used to store the address information of some node in network, including MAC address, port no, etc. This in-formation comes from the learning process of Managed Switch. 5.2 Learning When one packet comes in from any port, the Managed Switch will record the source address, port no. And the other related information in address table.
The Managed Switch performs "Store and Fforward" therefore, no error packets occur. More reliably, it reduces the re-transmission rate. No packet loss will occur. 5.5 Auto-Negotiation The STP ports on the Switch have built-in "Auto-negotiation". This technology automatically sets the best possible bandwidth when a connection is established with another network device (usually at Power On or Reset).
6. TROUBLESHOOTING This chapter contains information to help you solve issues. If the Managed Switch is not functioning properly, make sure the Managed Switch was set up according to instructions in this manual. ■ The Link LED is not lit Solution: Check the cable connection and remove duplex mode of the Managed Switch ■ Some stations cannot talk to other stations located on the other port Solution: Please check the VLAN settings, trunk settings, or port enabled / disabled status.
APPENDIX A: Networking Connection A.1 PoE RJ-45 Port Pin Assignments PIN NO RJ-45 POWER ASSIGNMENT 1 • Power + 2 • Power + 3 • Power - 6 • Power - A.
The standard cable, RJ-45 pin assignment 6 32 1 6 321 6 3 21 The standard RJ-45 receptacle/connector There are 8 wires on a standard UTP/STP cable and each wire is color-coded.
APPENDIX B : GLOSSARY A ACE ACE is an acronym for Access Control Entry. It describes access permission associated with a particular ACE ID. There are three ACE frame types (Ethernet Type, ARP, and IPv4) and two ACE actions (permit and deny). The ACE also contains many detailed, different parameter options that are available for individual application. ACL ACL is an acronym for Access Control List.
ranging from 1-1024K packets per seconds. Under "Ports" and "Access Control List" web-Pages you can assign a Rate Limiter ID to the ACE(s) or ingress port(s). AES AES is an acronym for Advanced Encryption Standard. The encryption key protocol is applied in 802.1i standard to improve WLAN security. It is an encryption standard by the U.S. government, which will replace DES and 3DES. AES has a fixed block size of 128 bits and a key size of 128, 192, or 256 bits. AMS AMS is an acronym for Auto Media Select.
C CC CC is an acronym for Continuity Check. It is a MEP functionality that is able to detect loss of continuity in a network by transmitting CCM frames to a peer MEP. CCM CCM is an acronym for Continuity Check Message. It is a OAM frame transmitted from a MEP to it's peer MEP and used to implement CC functionality. CDP CDP is an acronym for Cisco Discovery Protocol. D DEI DEI is an acronym for Drop Eligible Indicator. It is a 1-bit field in the VLAN tag. DES DES is an acronym for Data Encryption Standard.
Dynamic addressing simplifies network administration because the software keeps track of IP addresses rather than requiring an administrator to manage the task. This means that a new computer can be added to a network without the hassle of manually assigning it a unique IP address. DHCP Relay DHCP Relay is used to forward and to transfer DHCP messages between the clients and the server when they are not on the same subnet domain.
DSCP DSCP is an acronym for Differentiated Services Code Point. It is a field in the header of IP packets for packet classification purposes. E EEE EEE is an abbreviation for Energy Efficient Ethernet defined in IEEE 802.3az. EPS EPS is an abbreviation for Ethernet Protection Switching defined in ITU/T G.8031. Ethernet Type Ethernet Type, or EtherType, is a field in the Ethernet MAC header, defined by the Ethernet networking standard.
connection to a particular port on a remote host (port 80 by default). An HTTP server listening on that port waits for the client to send a request message. HTTPS HTTPS is an acronym for Hypertext Transfer Protocol over Secure Socket Layer. It is used to indicate a secure HTTP connection. HTTPS provide authentication and encrypted communication and is widely used on the World Wide Web for security-sensitive communication such as payment transactions and corporate logons.
from a mail server. IMAP is the protocol that IMAP clients use to communicate with the servers, and SMTP is the protocol used to transport mail to an IMAP server. The current version of the Internet Message Access Protocol is IMAP4. It is similar to Post Office Protocol version 3 (POP3), but offers additional and more complex features. For example, the IMAP4 protocol leaves your email messages on the server rather than downloading them to your computer.
LLDP is an IEEE 802.1ab standard protocol.
For debugging network problems or monitoring network traffic, the switch system can be configured to mirror frames from multiple ports to a mirror port. (In this context, mirroring a frame is the same as copying the frame.) Both incoming (source) and outgoing (destination) frames can be mirrored to the mirror port. MLD MLD is an acronym for Multicast Listener Discovery for IPv6. MLD is used by IPv6 routers to discover multicast listeners on a directly attached link, much as IGMP is used in IPv4.
NTP NTP is an acronym for Network Time Protocol, a network protocol for synchronizing the clocks of computer systems. NTP uses UDP (datagrams) as transport layer. O OAM OAM is an acronym for Operation Administration and Maintenance. It is a protocol described in ITU-T Y.1731 used to implement carrier ethernet functionality. MEP functionality like CC and RDI is based on this. Optional TLVs.
PING Ping is a program that sends a series of packets over a network or the Internet to a specific computer in order to generate a response from that computer. The other computer responds with an acknowledgment that it received the packets. Ping was created to verify whether a specific computer on a network or the Internet exists and is connected. ping uses Internet Control Message Protocol (ICMP) packets.
QCE QCE is an acronym for QoS Control Entry. It describes QoS class associated with a particular QCE ID. There are six QCE frame types: Ethernet Type, VLAN, UDP/TCP Port, DSCP, TOS, and Tag Priority. Frames can be classified by one of 4 different QoS classes: "Low", "Normal", "Medium", and "High" for individual application. QCL QCL is an acronym for QoS Control List. It is the list table of QCEs, containing QoS control entries that classify to a specific QoS class on specific traffic objects.
RADIUS is an acronym for Remote Authentication Dial In User Service. It is a networking protocol that provides centralized access, authorization and accounting management for people or computers to connect and use a network service. RDI RDI is an acronym for Remote Defect Indication. It is a OAM functionallity that is used by a MEP to indicate defect detected to the remote peer MEP Router Port A router port is a port on the Ethernet switch that leads switch towards the Layer 3 multicast device.
SNAP The SubNetwork Access Protocol (SNAP) is a mechanism for multiplexing, on networks using IEEE 802.2 LLC, more protocols than can be distinguished by the 8-bit 802.2 Service Access Point (SAP) fields. SNAP supports identifying protocols by Ethernet type field values; it also supports vendor-private protocol identifier. SNMP SNMP is an acronym for Simple Network Management Protocol. It is part of the Transmission Control Protocol/Internet Protocol (TCP/IP) protocol for network management.
T TACACS+ TACACS+ is an acronym for Terminal Acess Controller Access Control System Plus. It is a networking protocol which provides access control for routers, network access servers and other networked computing devices via one or more centralized servers. TACACS+ provides separate authentication, authorization and accounting services. Tag Priority Tag Priority is a 3-bit field storing the priority level for the 802.1Q frame. TCP TCP is an acronym for Transmission Control Protocol.
determine the priority from the 6-bit ToS field in the IP header. The most significant 6 bits of the ToS field are fully decoded into 64 possibilities, and the singular code that results is compared against the corresponding bit in the IPv4 ToS priority control bit (0~63). TLV TLV is an acronym for Type Length Value. A LLDP frame can contain multiple pieces of information. Each of these pieces of information is known as TLV. TKIP TKIP is an acronym for Temporal Key Integrity Protocol.
Virtual LAN. A method to restrict communication between switch ports. VLANs can be used for the following applications: VLAN unaware switching: This is the default configuration. All ports are VLAN unaware with Port VLAN ID 1 and members of VLAN 1. This means that MAC addresses are learned in VLAN 1, and the switch does not remove or insert VLAN tags. VLAN aware switching: This is based on the IEEE 802.1Q standard. All ports are VLAN aware.
necessarily with first generation wireless access points. WPA2 implements the full standard, but will not work with some older network cards (Wikipedia). WPA-PSK WPA-PSK is an acronym for Wi-Fi Protected Access - Pre Shared Key. WPA was designed to enhance the security of wireless networks. There are two flavors of WPA: enterprise and personal. Enterprise is meant for use with an IEEE 802.1X authentication server, which distributes different keys to each user.
