XS712T Smart Switch Sof t wa re Adm i n i strat ion M anua l 350 East Plumeria Drive San Jose, CA 95134 USA March 2013 202-11254-02 v2.
XS712T Smart Switch ® NETGEAR, Inc. All rights reserved No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of NETGEAR, Inc. Technical Support Thank you for choosing NETGEAR. To register your product, get the latest product updates, get support online, or for more information about the topics covered in this manual, visit the support website at http://support.
Contents Chapter 1 Getting Started Getting Started with the XS712T Smart Switch . . . . . . . . . . . . . . . . . . . . . . 7 Connect the Switch to the Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Discover a Switch in a Network with a DHCP Server . . . . . . . . . . . . . . . . . 9 Discover a Switch in a Network without a DHCP Server . . . . . . . . . . . . . . 10 Configure the Network Settings on the Administrative System . . . . . . . . .
XS712T Smart Switch Protocol Based VLAN Group Configuration . . . . . . . . . . . . . . . . . . . . . . 90 Protocol Based VLAN Group Membership . . . . . . . . . . . . . . . . . . . . . . . 91 Auto-VoIP Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Configure Protocol-Based Auto VoIP Settings . . . . . . . . . . . . . . . . . . . . 93 Port Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 OUI Table . . . .
XS712T Smart Switch Chapter 6 Managing Device Security Management Security Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 Change Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 Authentication List Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180 Configure Management Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183 HTTP Configuration . . . . . . . . . . . . . . . . . . . . . . . .
XS712T Smart Switch Download . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263 TFTP File Download. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263 HTTP File Download . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265 File Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266 Copy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1. Getting Started 1 This manual describes how to configure and operate the XS712T Smart Switch by using the web-based graphical user interface (GUI). The manual describes the software configuration procedures and explains the options available within those procedures. Note: For information about issues and workarounds, see the release notes for the XS712T Smart Switch.
XS712T Smart Switch Switch Management Interface The NETGEAR XS712T Smart Switch contain an embedded web server and management software for managing and monitoring switch functions. The XS712T functions as a simple switch without the management software. However, you can use the management software to configure more advanced features that can improve switch efficiency and overall network performance.
XS712T Smart Switch host (administrative system) in the 192.168.0.0/24 network and change the settings by using the web management interface on the switch. For information about how to set the IP address on the administrative system so it is in the same subnet as the default IP address of the switch, see Configure the Network Settings on the Administrative System on page 12.
XS712T Smart Switch 6. Make a note of the displayed IP address assigned by the DHCP server. You will need this value to access the switch directly from a web browser (without using the Smart Control Center). 7. Select your switch by clicking the line that displays the switch, then click the Web Browser Access button. The Smart Control Center displays a login window. Use your web browser to manage your switch. The default password is password. Use this screen to manage your switch.
XS712T Smart Switch 6. Select the switch, then click Configure Device. The screen expands to display additional fields at the bottom. 7. Select the Disabled radio button to disable DHCP. 8. Enter the static switch IP address, gateway IP address, and subnet mask for the switch, and then type your password. Tip: You must enter the current password every time you use the Smart Control Center to update the switch setting. The default password is password. 9.
XS712T Smart Switch Configure the Network Settings on the Administrative System If you choose not to use the Smart Control Center to configure the network information on the switch, you can connect directly to the switch from an administrative system, such as a computer or laptop. The IP address of the administrative system must be in the same subnet as the default IP address on the switch.
XS712T Smart Switch 3. In the Local Area Connection Status window, click Properties. The Local Area Connection Properties window displays. 4. Select the Internet Protocol Version 4 (TCP/IPv4) option, and then click Properties. The Internet Protocol Version 4 (TCP/IPv4) Properties window displays.
XS712T Smart Switch 5. Select Use the following IP address and set the IP address of the administrative system to an address in the 192.168.0.0 network, such as 192.168.0.200. The IP address must be different from that of the switch but within the same subnet. WARNING: When you change the IP address of your administrative system, you lose your connection to the rest of the network. Be sure to write down your current network address settings before you change them. 6. Click OK.
XS712T Smart Switch Access the Management Interface from a Web Browser You must be able to ping the IP address of the switch web management interface from your administrative system for web access to be available. If you used the Smart Control Center to set up the IP address and subnet mask, either with or without a DHCP server, use that IP address in the address field of your web browser. If you did not change the IP address of the switch from the default value, enter 192.168.0.239 in the address field.
XS712T Smart Switch To access the management interface form the Smart Control Center: 1. Open a web browser. 2. Enter the IP address of the switch in the address field of the browser.
XS712T Smart Switch Navigation tab Configuration menus Help link Logout button Help page Links Configuration status and options Figure 1. Smart Switch Web Interface Navigation Tabs, Configuration Menus, and Links The navigation tabs along the top of the web interface give you quick access to the various switch functions. The tabs are always available and remain constant, regardless of which feature you configure.
XS712T Smart Switch Link Submenu Links Figure 2. Menu hierarchy Configuration and Status Options The area directly under the configuration menus and to the right of the links displays the configuration information or status for the screen you select. On screens that contain configuration options, you can input information into fields or select options from drop-down lists. Each screen contains access to the HTML-based help that explains the fields and configuration options for the screen.
XS712T Smart Switch Device View The Device View is a Java applet that displays the ports on the switch. This graphic provides an alternate way to navigate to configuration and monitoring options. The graphic also provides information about device ports, current configuration and status, table information, and feature components. The Device View is available by selecting System Device View. Depending upon the status of the port, the color of a port in the Device View is either red, green, or black.
XS712T Smart Switch Click the port you want to view or configure to see a menu that displays statistics and configuration options. Select the menu option to access the screen that contains the configuration or monitoring options. If you click the graphic, but do not click a specific port, the main menu displays, as the following figure shows. This menu contains the same option as the navigation tabs at the top of the screen.
XS712T Smart Switch User-Defined Fields User-defined fields can contain 1 to 159 characters, unless otherwise noted in the field label on the configuration screen. All alphanumeric and special characters can be used except for the following (unless specifically noted for that feature): Table 2.
XS712T Smart Switch To configure authentication and encryption settings for the SNMPv3 admin profile by using the web interface: 1. Select System SNMP SNMPv3 User Configuration. The User Configuration screen displays. The SNMPv3 Access Mode is a read-only field that shows the access privileges for the user account. The admin account always has Read/Write access, and all other accounts have Read Only access. 2. To enable authentication, select an Authentication Protocol option.
XS712T Smart Switch Interface Naming Convention The switch supports physical and logical interfaces. Interfaces are identified by their type and the interface number. All the physical ports are as follows: • Ports 1–10. Copper ports that operate at 100MB, 1G, or 10G. • Ports 11–12. Combo ports that can act as 100M/1G/10G copper ports or 1G/10G SFP+ ports. The number of the port is identified on the front panel. You can configure the logical interfaces by using the software.
XS712T Smart Switch Online Help The Help main navigation tab of the web management interface provides access to the menus that are described in the following sections: • Support • User Guide Support The Support screen provides access to the NETGEAR support website at support.netgear.com. To access the support website from the web management interface: 1. Select Help Support.. The Support screen displays. 2. Click Apply to access the NETGEAR support site for the switch.
XS712T Smart Switch Registration To qualify for product updates and product warranty, NETGEAR encourages you to register your product. The first time that you connect to the switch while it is connected to the Internet, you have the option to register your product. At any time, you can register your product from the web management interface, or you can visit the NETGEAR website for registration at https://my.netgear.com/registration/login.aspx. To register the switch with NETGEAR: 1.
2. Configure System Information 2 Use the features you access from the System navigation tab to define the switch’s relationship to its environment.
XS712T Smart Switch System Information After a successful login, the System Information screen displays. Use this screen to configure and view general device information. To define a system name, location, and contact: 1. Select System Management System Information. The System Information screen displays. 2. Define the following fields: • System Name. Enter the name you want to use to identify this switch. You can use up to 255 alphanumeric characters. The factory default is blank.
XS712T Smart Switch The following table describes the status information the System Information screen displays. Table 4. System Information screen status fields Field Description Product Name The product name that describes the switch. Serial Number The serial number of the switch. System Object ID The base object ID for the switch's enterprise MIB. Date & Time The current date and time. System Up Time Displays the number of days, hours, and minutes since the last system restart.
XS712T Smart Switch IP Configuration Use the IP Configuration screen to configure network information for the management interface, which is the logical interface used for in-band connectivity with the switch through any of the switch's front-panel ports. The configuration parameters associated with the switch’s network interface do not affect the configuration of the front panel ports through which traffic is switched or routed. To configure the network information for the management interface: 1.
XS712T Smart Switch 4. Specify the VLAN ID for the management VLAN. Note: Make sure that the VLAN to be configured as the management VLAN exists. And make sure that the PVID of at least one port that is a port of the VLAN is the same as the management VLAN ID. For information about creating VLANs and configuring the PVID for a port, see VLANs on page 84. The management VLAN is used to establish an IP connection to the switch from a workstation that is connected to a port in the same VLAN.
XS712T Smart Switch IPv6 Network Configuration Use the IPv6 Network Configuration screen to configure the IPv6 network interface, which is the logical interface used for in-band connectivity with the switch through all of the switch's front-panel ports. The configuration parameters associated with the switch's network interface do not affect the configuration of the front-panel ports through which traffic is switched or routed.
XS712T Smart Switch information from a DHCPv6 server. Selecting None disables the DHCPv6 client on the network interface. When DHCPv6 is enabled, the DHCPv6 Client DUID field displays the client identifier used by the DHCPv6 client (if enabled) when sending messages to the DHCPv6 server. 4. In the IPv6 Gateway field, specify the default gateway for the IPv6 network interface. The gateway address is in IPv6 global or link-local address format. 5.
XS712T Smart Switch Table 5. IPv6 neighbor table fields (Continued) Field Description Neighbor State The state of the neighbor cache entry. The following are the states for dynamic entries in the IPv6 neighbor discovery cache: • Reach. The neighbor is reachable through the network interface. • Stale. The neighbor is not known to be reachable, and the switch will begin the process to reach the neighbor. • Delay.
XS712T Smart Switch Time Configuration Use the Time Configuration screen to view and adjust date and time settings. To manually configure the time: 1. Select System Management Time Time Configuration. The Time Configuration screen displays. 2. Next to the Clock Source field, select Local. 3. In the Date field, enter the date in the DD/MM/YYYY format. 4. In the Time field, enter the time in HH:MM:SS format.
XS712T Smart Switch 3. Next to the Client Mode field, select Unicast or Broadcast: • Unicast. SNTP operates in a point-to-point fashion. A unicast client sends a request to a designated server at its unicast address and expects a reply from which it can determine the time and, optionally the round-trip delay and local clock offset relative to the server. • Broadcast. SNTP operates in the same manner as multicast mode but uses a local broadcast address instead of a multicast address.
XS712T Smart Switch • Time Zone Name. The acronym that represents the time zone. This field is not validated against an official list of time zone acronyms. • Hours Offset. The number of hours the system clock is offset from UTC, which is also known as Greenwich Mean Time (GMT). • Minutes Offset. The number of minutes the system clock is offset from UTC. 5. Click Apply. 6.
XS712T Smart Switch Table 6. Time Configuration status fields (Continued) Field Description Address Type Specifies the address type of the SNTP Server address for the last received valid packet. Server Stratum Specifies the claimed stratum of the server for the last received valid packet. Reference Clock Id Specifies the reference clock identifier of the server for the last received valid packet. Server Mode Specifies the mode of the server for the last received valid packet.
XS712T Smart Switch 5. Under the Priority field, specify the order in which to query the servers. The SNTP client on the device continues sending SNTP requests to different servers until a successful response is received or all servers are exhausted. The request is sent to an SNTP server with a priority value of 1 first, then to a server with a priority value of 2, and so on. If more than one server has the same priority, the SNTP client contacts the servers in the order that they appear in the table. 6.
XS712T Smart Switch Table 7. SNTP server status fields (Continued) Field Description Last Attempt Status Specifies the status of the last SNTP request to this server. If no packet has been received from this server, a status of Other is displayed: • Other. None of the following enumeration values. • Success. The SNTP operation was successful and the system time was updated. • Request Timed Out. A directed SNTP request timed out without receiving a response from the SNTP server. • Bad Date Encoded.
XS712T Smart Switch 2. Next to the Summer Time field, select one of the following options: • Recurring. Summer time occurs at the same time every year. The start and end times and dates for the time shift must be manually configured. • Recurring EU. The system clock uses the standard recurring summer time settings used in countries in the European Union. When this field is selected, the rest of the applicable fields on the screen are automatically populated and cannot be edited. • Recurring USA.
XS712T Smart Switch 2. Next to the Auto-DoS Mode field, select Enable. When an attack is detected, a warning message is logged to the buffered log and is sent to the Syslog server. At the same time, the port is shut down and can be enabled only manually by the admin user. 3. Click Apply. Configure Denial of Service The Denial of Service Configuration screen lets you to select which types of DoS attacks for the switch to monitor and block. To configure individual DoS settings: 1.
XS712T Smart Switch • Denial of Service Min TCP Header Size: Specify the minimum TCP header size allowed. If DoS TCP Fragment is enabled, the switch will drop packets that have a TCP header smaller than the configured value. • Denial of Service ICMPv4: Enabling ICMPv4 DoS prevention causes the switch to drop ICMPv4 packets that have a type set to ECHO_REQ (ping) and a size greater than the configured ICMPv4 Pkt Size. The factory default is disabled.
XS712T Smart Switch 3. Click Apply.
XS712T Smart Switch DNS You can use these screens to configure information about DNS servers the network uses and how the switch operates as a DNS client. Configure DNS Use this screen to configure global DNS settings and DNS server information. To configure the global DNS settings: 1. Select System Management DNS DNS Configuration. The DNS Configuration screen displays. 2. Specify whether to enable or disable the administrative status of the DNS Client.
XS712T Smart Switch Configure and View Hostname-to-IP Address Information Use this screen to manually map host names to IP addresses or to view dynamic DNS mappings. To add a static entry to the local DNS table: 1. Select System Management DNS Host Configuration. 2. The DNS Host Configuration screen displays. 3. Under the Host Name field, specify the static host name to add. 4. Under the IPv4/IPv6 Address field, specify the IP address to associate with the hostname. 5. Click Add.
XS712T Smart Switch Green Ethernet The Green Ethernet feature can help reduce the amount of power the switch uses. The switch supports Energy Efficient Ethernet (EEE). To configure the administrative mode of Energy Efficient Ethernet: 1. Select System Management Green Ethernet Green Ethernet Configuration. The Green Ethernet Configuration screen displays. 2. Enable or disable the EEE mode. • Enable.
XS712T Smart Switch 2. Select the port(s) to configure. • To configure a single port, select the check box associated with it, or type the port number in the Go To Interface field and click Go. • To configure multiple ports with the same settings, select the check box associated with each port to configure. • To configure all ports with the same settings, select the check box in the heading row. 3. Use the EEE Mode list to administratively enable or disable EEE for the selected ports.
XS712T Smart Switch 2. From the Interface list, select the interface to configure. 3. Enable or disable the administrative mode of EEE on the port: When this mode is enabled and the send and receive sides of a link are lightly loaded, the port can transition to low power mode. 4. Click Apply. The Local Device Information table displays information about the Green Ethernet status and statistics on the port. Table 9.
XS712T Smart Switch Table 9. Green Ethernet local device information (Continued) Field Description Tx Low Power Idle Duration (uSec) The amount of time (in 10 microsecond increments) the link partner has spent in a low-power idle state. Tw_sys_tx (uSec) The value of Tw_sys that the local system can support.
XS712T Smart Switch Figure 4. Green Ethernet summary screen The following table describes the information the power saving table displays. Table 10.
XS712T Smart Switch The following table describes the information in the Green Ethernet feature support table. Table 11. Green Ethernet support information Field Description Unit The ID number for the switch. Green Features supported on this unit The Green Ethernet feature(s) supported on this unit. The following table describes the information in the Green Ethernet interface table. Table 12.
XS712T Smart Switch This configuration is applied on all interfaces on the switch. 4. Click Apply. To view per-interface LPI history information, select the interface with the information to view from the Interface list. The screen refreshes and displays the LPI history for the selected interface. The following table describes the status fields on the screen. Table 13. LPI history information Field Description Percentage LPI time The percentage of time spent in LPI mode on the switch Sample No.
XS712T Smart Switch SNMP This section describes how to configure the Simple Network Management Protocol (SNMP) version 1 and SNMP version 2 information on the switch. For information about configuring the SNMPv3 administrative profile, see Use SNMPv3 on page 21. SNMPV1/V2 The screens under the SNMPV1/V2 link allow you to configure SNMPv1/v2 community information, traps, and trap flags.
XS712T Smart Switch access from only one station, use a Management Station IP Mask value of 255.255.255.255, and use that machine’s IP address for Client Address. 4. Next to Community String, specify a community name. 5. From the Access Mode list, select the access level for this community, which is either Read/Write or Read Only. 6. From the Status list, enable or disable the community.
XS712T Smart Switch Trap Configuration Use this screen to configure settings for each SNMPv1 or SNMPv2 management host that will receive notifications about traps generated by the device. The SNMP management host is also known as the SNMP trap receiver. To add an SNMP trap receiver: 1. Select System SNMP SNMP V1/V2 Trap Configuration The Trap Configuration screen displays. 2. Next to Recipients IP, specify the IP address in x.x.x.x format to receive SNMP traps from this device. 3.
XS712T Smart Switch Trap Flags Use the Trap Flags screen to enable or disable traps the switch can send to an SNMP manager. When the condition identified by an active trap is encountered by the switch, a trap message is sent to any enabled SNMP Trap Receivers, and a message is written to the trap log. To configure the trap flags: 1. Select System SNMP SNMP V1/V2 Trap Flags. The Trap Flag screen displays. 2. Enable or disable the following system traps: • Authentication.
XS712T Smart Switch LLDP The IEEE 802.1AB-defined standard, Link Layer Discovery Protocol (LLDP), allows stations on an 802 LAN to advertise major capabilities and physical descriptions. This information is viewed by a network manager to identify system topology and detect bad configurations on the LAN.
XS712T Smart Switch LLDP Configuration Use the LLDP Configuration screen to specify the global LLDP and LLDP-MED parameters that are applied to the switch. To configure global LLDP settings: 1. Select System > LLDP > Basic > LLDP Configuration. The LLDP Configuration screen displays. 2. Optionally, configure non-default values for the following LLDP properties. • TLV Advertised Interval: The number of seconds between transmissions of LLDP advertisements.
XS712T Smart Switch LLDP Port Settings Use the LLDP Port Settings screen to specify per-interface LLDP settings. To configure LLDP port settings: 1. Select System LLDP Advanced LLDP Port Settings. The LLDP Port Settings screen displays. 2. Select the port(s) to configure. • To configure a single port, select the check box associated with it, or type the port number in the Go To Interface field and click Go.
XS712T Smart Switch • Notification: When notifications are enabled, LLDP interacts with the Trap Manager to notify subscribers of remote data change statistics. The default is Disabled. • Optional TLV(s): Enable or disable the transmission of optional type-length value (TLV) information from the interface. The TLV information includes the system name, system description, system capabilities, and port description. To configure the System Name, see Management on page 26.
XS712T Smart Switch Table 14. LLDP-MED network policy information Field Description Network Policy Number The policy number. Application The media application type associated with the policy, which can be one of the following: • Unknown • Voice • Guest Voice • Guest Voice Signaling • Softphone Voice • Video Conferencing • Streaming Video • Video Signaling A port can receive multiple application types.
XS712T Smart Switch 3. Use the lists to enable or disable the following LLDP-MED settings for the selected port: • LLDP-MED Status. The administrative status of LLDP-MED on the interface. When LLDP-MED is enabled, the transmit and receive function of LLDP is effectively enabled on the interface. • Notification. When enabled, the port sends a topology change notification if a device is connected or removed. • Transmit Optional TLVs.
XS712T Smart Switch Note: The list includes only the interfaces on which LLDP is enabled. If no interfaces are enabled for LLDP, the Interface list does not display. The following table describes the LLDP device information and port summary information. Field Description Chassis ID Subtype The type of information used to identify the switch in the Chassis ID field. Chassis ID The hardware platform identifier for the switch. System Name The user-configured system name for the switch.
XS712T Smart Switch 3. To view additional details about a port, click the name of the port in the Interface column of the Port Information table. A popup window displays information for the selected port. The following table describes the detailed local information that displays for the selected port. Field Description Managed Address Address SubType The type of address the management interface uses, such as an IPv4 address. Address The address used to manage the device.
XS712T Smart Switch Field Description Operational MAU Type The Medium Attachment Unit (MAU) type. The MAU performs physical layer functions, including digital data conversion from the Ethernet interface collision detection and bit injection into the network. MED Details Capabilities Supported The MED capabilities enabled on the port. Current Capabilities The TLVs advertised by the port. Device Class Network Connectivity indicates the device is a network connectivity device.
XS712T Smart Switch The following table describes the information that displays for all LLDP neighbors that have been discovered. Field Description MSAP Entry The Media Service Access Point (MSAP) entry number for the remote device. Local Port The interface on the local system that received LLDP information from a remote system. Chassis ID Subtype Identifies the type of data displayed in the Chassis ID field on the remote system. Chassis ID Identifies the remote 802 LAN device's chassis.
XS712T Smart Switch The following table describes the information transmitted by the neighbor. Field Description Port Details Local Port The interface on the local system that received LLDP information from a remote system. MSAP Entry The Media Service Access Point (MSAP) entry number for the remote device. Basic Details Chassis ID Subtype Identifies the type of data displayed in the Chassis ID field on the remote system. Chassis ID Identifies the remote 802 LAN device's chassis.
XS712T Smart Switch Field Description MED Details Capabilities Supported The supported capabilities that were received in MED TLV from the device. Current Capabilities The advertised capabilities that were received in MED TLV from the device. Device Class Displays the LLDP-MED endpoint device class. The possible device classes are: • Endpoint Class 1 Indicates a generic endpoint class, offering basic LLDP services.
XS712T Smart Switch Field Description User Priority The priority associated with the policy. DSCP The DSCP associated with a particular policy type. LLDP Unknown TLVs Type Displays the unknown TLV type field. Value Displays the unknown TLV value field. Services—DHCP Snooping DHCP Snooping is a useful feature that provides security by filtering untrusted DHCP messages and by building and maintaining a DHCP snooping binding table.
XS712T Smart Switch Global Configuration Use this screen to view and configure the global settings for DHCP Snooping. To configure DHCP snooping global settings: 1. Select System Services DHCP Snooping Global Configuration. The DHCP Snooping Global Configuration screen displays. 2. Next to DHCP Snooping Mode field enable the DHCP Snooping feature. 3. Optionally, next to MAC Address Validation enable the verification of the sender MAC address for DHCP snooping.
XS712T Smart Switch Interface Configuration Use the DHCP Snooping Interface Configuration screen to view and configure each port as a trusted or untrusted port. Any DHCP responses received on a trusted port are forwarded. If a port is configured as untrusted, any DHCP (or BootP) responses received on that port are discarded. To configure DHCP snooping interface settings: 1. Select System Services DHCP Snooping Interface Configuration. The DHCP Snooping Interface Configuration screen displays. 2.
XS712T Smart Switch • To configure a group of interfaces, select the check boxes for the individual interfaces that you want to configure. • To configure all interfaces, select the check box at the left in the table heading. 4. From the Trust Mode list, select the desired trust mode. • Disabled. The interface is considered to be untrusted and could potentially be used to launch a network attack. DHCP server messages are checked against the bindings database.
XS712T Smart Switch Binding Configuration Use this screen to view, add, and remove static bindings in the DHCP snooping bindings database and to view or clear the dynamic bindings in the bindings table. To configure static DHCP bindings: 1. Select System Services DHCP Snooping Binding Configuration. 2. The DHCP Snooping Binding Configuration screen displays. 3. From the Interface list, select the interface on which the DHCP client is authorized. 4.
XS712T Smart Switch Persistent Configuration Use this screen to configure the persistent location of the DHCP snooping bindings database. The bindings database can be stored locally on the device or on a remote system somewhere else in the network. The device must be able to reach the IP address of the remote system to send bindings to a remote database. To configure DHCP snooping persistent settings: 1. Select System Services DHCP Snooping Persistent Configuration.
XS712T Smart Switch Statistics Use this screen to view and clear per-interface statistics about the DHCP messages filtered by the DHCP snooping feature on untrusted interfaces. To view and clear the DHCP snooping statistics: 1. Select System Services DHCP Snooping Statistics. The DHCP Snooping Statistics screen displays. 2. Select whether to display statistics for physical interfaces, link aggregation groups (LAGs), or both by clicking one of the following links above the table heading: • 1.
XS712T Smart Switch Table 16. DHCP Snooping statistics (Continued) Field Description Client Ifc Mismatch The number of packets that were dropped by DHCP snooping because the interface and VLAN on which the packet was received does not match the client's interface and VLAN information stored in the binding database. DHCP Server Msgs Received The number of DHCP server messages ((DHCPOFFER, DHCPACK, DHCPNAK, DHCPRELEASEQUERY) that have been dropped on an untrusted port.
3. Layer 2 Switching Configuration 3 Use the features you access from the Switching tab to define Layer 2 features. The Switching tab contains links to the features described in the following sections. • Ports • Link Aggregation Groups • VLANs • Auto-VoIP Configuration • Spanning Tree Protocol • Multicast • Forwarding Database Ports The screens you access from the Ports menu allow you to view and monitor the physical port information for the ports available on the switch.
XS712T Smart Switch 2. Select whether to configure physical interfaces, link aggregation groups (LAGs), or both by clicking one of the following links above the table heading: • 1. Only physical interfaces are displayed. This is the default setting. • LAGS. Only link aggregation groups are displayed. • All. Both physical interfaces and link aggregation groups are displayed. 3.
XS712T Smart Switch port’s maximum capability (full duplex and 10 Gbps) will be advertised. Otherwise, your selection will determine the port’s duplex mode and transmission rate. The factory default is Auto. • Physical Status. Indicates the physical port’s speed and duplex mode • Link Status. Indicates whether the Link is up or down. • Link Trap. This object determines whether or not to send a trap when link status changes. The factory default is Enable. - Enable.
XS712T Smart Switch Link Aggregation Groups Link aggregation groups (LAGs), which are also known as port channels, allow you to combine multiple full-duplex Ethernet links into a single logical link. Network devices treat the aggregation as if it were a single link, which increases fault tolerance and provides load sharing. You assign the LAG VLAN membership after you create a LAG. The LAG by default becomes member of default management VLAN (i.e, 1).
XS712T Smart Switch Note: Click current members in the list to see existing member ports in that LAG. • LAG Name. Specify the name you want assigned to the LAG. You can enter any string of up to 15 alphanumeric characters. A valid name has to be specified in order to create the LAG • Description. Specify the Description string to be attached to a LAG. It can be up to 64 characters in length. • LAG ID. Displays the number assigned to the LAG. This field is read-only. • Link Trap.
XS712T Smart Switch 3. In the LAG Name field, enter the name you want assigned to the LAG. You can enter any string of up to 15 alphanumeric characters. A valid name has to be specified to create the LAG. 4. Click the unit name in the orange bar to display the ports. 5. Click the box below each port to include in the LAG. 6. Click Apply. 7. To verify the configuration and view the ports that are members of the selected LAG, click Current Members.
XS712T Smart Switch LACP Port Configuration The LACP port configuration screen is used to configure the LACP priority value for the selected port and the administrative LACP Timeout value. To configure LACP port priority settings: 1. Select Switching LAG Advanced LACP Port Configuration. 2. Select the port(s) to configure: • To configure a single port, select the check box associated with it, or type the port number in the Go To Interface field and click Go.
XS712T Smart Switch VLANs Adding Virtual LAN (VLAN) support to a Layer 2 switch offers some of the benefits of both bridging and routing. Like a bridge, a VLAN switch forwards traffic based on the Layer 2 header, which is fast, and like a router, it partitions the network into logical segments, which provides better administration, security and management of multicast traffic. By default, all ports on the switch are in the same broadcast domain.
XS712T Smart Switch Basic VLAN Configuration Use the VLAN Configuration screen to define VLAN groups stored in the VLAN membership table. The XS712T supports up to 256 VLANs. VLAN 1, VLAN 2, and VLAN 3 are created by default, and all ports are untagged members. To configure VLANs: 1. Select Switching VLAN Basic VLAN Configuration. 2. Under VLAN ID, specify the VLAN Identifier for the new VLAN. 3. Optionally, under VLAN Name, specify a name to help identify the VLAN. 4. Click Add.
XS712T Smart Switch VLAN Membership Configuration Use this screen to configure VLAN Port Membership for a particular VLAN. You can select the Group operation through this screen. To configure VLAN membership for specific ports and LAGs: 1. Select Switching VLAN Advanced VLAN Membership. 2. From the VLAN ID field, select the VLAN to which you want to add ports. 3. Click the orange bar below the VLAN Type field to display the physical ports on the switch. 4.
XS712T Smart Switch VLAN Status This VLAN Status screen displays the status of all currently configured VLANs. To view the current VLAN status: 1. Select Switching VLAN Advanced VLAN Status. 2. View the following VLAN status information: • VLAN ID. The VLAN Identifier (VID) of the VLAN. The range of the VLAN ID is (1 to 4093) • VLAN Name. The name of the VLAN. VLAN ID 1 is always named Default. • VLAN Type. The VLAN type: - Default (VLAN ID = 1). always present. - Static.
XS712T Smart Switch To configure PVID information: 1. Select Switching VLAN Advanced Port PVID Configuration. 2. To configure PVID settings for a physical port, enter the interface and click Go to select that particular interface. 3. Select the interfaces for which you want to configure the PVID settings: • To configure PVID settings for a Link Aggregation Group (LAG), click LAGS. • To configure PVID settings for both physical ports and LAGs, click ALL. 4.
XS712T Smart Switch • Enable. A tagged frame is discarded if this interface is not a member of the VLAN identified by the VLAN ID in the tag. In an untagged frame, the VLAN is the Port VLAN ID specified for the port that received this frame. • Disable. all frames are forwarded in accordance with the 802.1Q VLAN bridge specification. The factory default is disabled. 8. Specify the default 802.1p priority assigned to untagged packets arriving at the port. Possible values are 0–7. 9. Click Apply.
XS712T Smart Switch Protocol Based VLAN Group Configuration Protocol-based VLAN can be used to define filtering criteria for untagged packets. By default, if you do not configure any port- (IEEE 802.1Q) or protocol based VLANs, untagged packets will be assigned to VLAN 1. You can override this behavior by defining either port-based VLANs or protocol based VLANs, or both. Tagged packets are always handled according to the IEEE 802.1Q standard, and are not included in protocol based VLANs.
XS712T Smart Switch To modify protocol based VLAN information: 1. Select the check box next to the protocol-based VLAN to update. 2. Specify the desired value in the available fields. 3. Click Apply. To delete a protocol based VLAN group: 1. Select the check box next to each protocol-based VLAN to remove. 2. Click Delete. Protocol Based VLAN Group Membership The protocol based VLAN group membership screen is used to define a protocol based VLAN group.
XS712T Smart Switch Voice VLAN The Voice VLAN feature enables ports to carry voice traffic that has a defined priority. Voice over IP (VoIP) traffic is inherently time-sensitive. For a network to provide acceptable service, the transmission rate is vital. The priority level enables the separation of voice and data traffic entering the port.
XS712T Smart Switch 4. From the Interface Mode list, select one of the following options to determine how an IP phone connected to the selected port should send voice traffic: • VLAN ID. Forward voice traffic in the specified voice VLAN. • Dot1p. Tag voice traffic with the specified 802.1p priority value. • None. Use the settings configured on the IP phone to send untagged voice traffic. • Untagged. Send untagged voice traffic. • Disable.
XS712T Smart Switch 2. In the Prioritization Type list, select method used to prioritize VoIP traffic when a call-control protocol is detected, which is one of the following: • Remark. Remark the voice traffic with the specified 802.1p priority value at the ingress interface. • Traffic Class. Assign VoIP traffic to the specified traffic class when egressing the interface. 3.
XS712T Smart Switch OUI Based Properties The OUI based properties screen allows you to configure the OUI based properties. To configure OUI based properties: 1. Select Switching Auto-VoIP OUI-based Properties. 2. In the VoIP VLAN ID list, select the VLAN to use to segregate VoIP traffic from other non-voice traffic. All VoIP traffic that matches a value in the known OUI list gets assigned to this VoIP VLAN.elect the VoIP VLAN Id on the switch. 3. In the OUI-based priority list, select the 802.
XS712T Smart Switch 2. Select the interface(s) to configure. 3. In the Auto VoIP Mode list, select Enable to enable Auto VoIP on the selected interfaces. The Operational Status field displays the current operational status of the interface. 4. Click Apply. OUI Table Device hardware manufacturers can include an OUI in a network adapter to help identify a hardware device. The OUI is a unique 24-bit number assigned by the IEEE registration authority.
XS712T Smart Switch You can select an existing OUI or add a new OUI and description to identify the IP phones on the network. To configure OUI settings: 1. Select Switching Auto-VoIP OUI-based OUI Table. 2. Under Telephony OUI(s), specify the VOIP OUI prefix. The OUI prefix must be in the format AA:BB:CC. 3. Under Description, type a description that identifies the manufacturer or vendor associated with the OUI. The maximum length of description is 32 characters. 4. Click Add.
XS712T Smart Switch Spanning Tree Protocol The Spanning Tree Protocol (STP) provides a tree topology for any arrangement of bridges. STP also provides one path between end stations on a network, eliminating loops. Spanning tree versions supported include Common STP, Multiple STP, and Rapid STP. Classic STP provides a single path between end stations, avoiding and eliminating loops. For information about configuring Common STP, see CST Port Configuration on page 102.
XS712T Smart Switch STP Configuration The STP Configuration screen contains fields for enabling STP on the switch. To configure STP settings on the switch: 1. Select Switching STP Basic STP Configuration. 2. From the Spanning Tree State field, specify whether to enable or disable Spanning Tree operation on the switch. 3. From the STP Operation Mode field, specify the Force Protocol Version parameter for the switch. Options are: • STP (Spanning Tree Protocol). IEEE 802.
XS712T Smart Switch 6. Click Apply. 7. View the STP Status information displayed on the screen. Field Description Configuration Digest Key This is used to identify the configuration currently being used. Bridge Identifier The bridge identifier for the CST. It is made up using the bridge priority and the base MAC address of the bridge. Time Since Topology Change The time in seconds since the topology of the CST last changed.
XS712T Smart Switch CST Configuration Use the CST Configuration screen to configure Common Spanning Tree (CST) and Internal Spanning Tree on the switch. To configure CST settings: 1. Select Switching STP Advanced CST Configuration. 2. Specify values for CST in the appropriate fields: • Bridge Priority. When switches or bridges are running STP, each is assigned a priority. After exchanging BPDUs, the switch with the lowest priority value becomes the root bridge.
XS712T Smart Switch 3. Click Apply. 4. View the MSTP status information displayed on the Spanning Tree CST Configuration screen. Field Description MST ID Table consisting of the MST instances (including the CST) and the corresponding VLAN IDs associated with each of them. VID Table consisting of the VLAN IDs and the corresponding FID associated with each of them FID Table consisting of the FIDs and the corresponding VLAN IDs associated with each of them. 5.
XS712T Smart Switch 4. Select the check box next to the port or LAG to configure. You can select multiple ports and LAGs to apply the same setting to the selected interfaces. Select the check box in the heading row to apply the same settings to all interfaces. 5. Configure the CST values for the selected port(s) or LAG(s): • STP Status. Enable or disable the Spanning Tree Protocol Administrative Mode associated with the port or port channel. • Fast Link.
XS712T Smart Switch CST Port Status Use the CST Port Status screen to display Common Spanning Tree (CST) and Internal Spanning Tree on a specific port on the switch. To display the CST port status for a specific port: 1. Select Switching STP Advanced CST Port Status. The following table describes the CST Status information displayed on the screen. Field Description Interface Displays the port associated with the VLAN(s) associated with the CST.
XS712T Smart Switch Field Description Topology Change Acknowledge Identifies whether the next BPDU to be transmitted for this port would have the topology change acknowledgement flag set. It is either True or False. Edge Port Indicates whether the port is enabled as an edge port. Possible values are Enabled or Disabled. Point-to-point MAC Derived value of the point-to-point status. CST Regional Root Displays the bridge priority and base MAC address of the CST Regional Root.
XS712T Smart Switch The following table describes the Rapid STP Status information displayed on the screen. Field Description Interface The physical or port channel interfaces associated with VLANs associated with the CST. Role Each MST Bridge Port that is enabled is assigned a Port Role for each spanning tree. The port role will be one of the following values: Root Port, Designated Port, Alternate Port, Backup Port, Master Port, or Disabled Port. Mode Specifies the spanning tree operation mode.
XS712T Smart Switch For each configured instance, the information described in the following table displays on the screen. Field Description Bridge Identifier The bridge identifier for the selected MST instance. It is made up using the bridge priority and the base MAC address of the bridge. Time Since Topology Change Displays the total amount of time since the topology of the selected MST instance last changed.
XS712T Smart Switch 3. Select the interfaces for which you want to configure the CoS settings: • To configure MST settings for a Link Aggregation Group (LAG), click LAGS. • To configure MST settings for both physical ports and LAGs, click ALL. 4. Select the check box next to the port or LAG to configure. You can select multiple ports and LAGs to apply the same setting to the selected interfaces. Select the check box in the heading row to apply the same settings to all interfaces. 5.
XS712T Smart Switch Field Description Port Forwarding State Indicates the current STP state of a port. If enabled, the port state determines what forwarding action is taken on traffic. Possible port states are: • Disabled. STP is currently disabled on the port. The port forwards traffic while learning MAC addresses. • Blocking. The port is currently blocked and cannot be used to forward traffic or learn MAC addresses. • Listening. The port is currently in the listening mode.
XS712T Smart Switch The following table describes the information available on the STP Statistics screen. Field Description Interface Select a physical or port channel interface to view its statistics. STP BPDUs Received Number of STP BPDUs received at the selected port. STP BPDUs Transmitted Number of STP BPDUs transmitted from the selected port. RSTP BPDUs Received Number of RSTP BPDUs received at the selected port.
XS712T Smart Switch Multicast Multicast IP traffic is traffic that is destined to a host group. Host groups for IPv4 multicast are identified by class D addresses, which range from 224.0.0.0 to 239.255.255.255. Host groups for IPv6 multicast are identified by the prefix ff00::/8. The Multicast menu contains links described in the following sections.
XS712T Smart Switch responsibility for accepting or dropping the packets belongs to the hosts. If a multicast packet is received and there are ports registered to receive it, the packet is sent only to the registered ports. • Forward All. All multicast packets received from a VLAN are flooded to all ports in the VLAN, regardless of port registrations to multicast addresses. • Filter Unregistered.
XS712T Smart Switch • Type. This displays the type of the entry. Static entries are those that are configured by the end user. Dynamic entries are added to the table as a result of a learning process or protocol. • Description. The text description of this multicast table entry. Possible values are Management Configured, Network Configured and Network Assisted. • Interface. The list of interfaces that are designated for forwarding (Fwd:) and filtering (Flt:) for the selected address.
XS712T Smart Switch Auto-Video Use this screen to configure the Auto-Video parameters. To configure Auto-Video: 1. Select Switching Multicast Auto-Video. 2. Select one of the following radio buttons: • Select the Disable radio button to globally disable Auto-Video administrative mode for the switch. • Select the Enable radio button to globally enable Auto-Video administrative mode for the switch. The Auto-Video VLAN field shows the number of Auto-configured IGMP snooping VLANs. 3. Click Apply.
XS712T Smart Switch problem of wasting bandwidth is even worse when the LAN segment is not shared, for example in full-duplex links. Allowing switches to snoop IGMP packets is a creative effort to solve this problem. The switch uses the information in the IGMP packets as they are being forwarded throughout the network to determine which segments should receive packets directed to the group address.
XS712T Smart Switch The following table displays information about the global IGMP snooping status and statistics on the screen. Field Description Multicast Control Frame Count Displays the number of multicast control frames that have been processed by the CPU. Interfaces Enabled for IGMP Snooping Lists the interfaces currently enabled for IGMP Snooping. To enable interfaces for IGMP snooping, see IGMP Snooping Interface Configuration on page 116.
XS712T Smart Switch 3. Select the interfaces for which you want to configure the CoS settings: • To configure IGMP Snooping settings for a Link Aggregation Group (LAG), click LAGS. • To configure IGMP Snooping settings for both physical ports and LAGs, click ALL. 4. Select the check box next to the port or LAG to configure. You can select multiple ports and LAGs to apply the same setting to the selected interfaces. Select the check box in the heading row to apply the same settings to all interfaces. 5.
XS712T Smart Switch 3. View the information associated with the IGMP snooping table entry. The following table describes the information in the IGMP snooping table. Field Description MAC Address A multicast MAC address for which the switch has forwarding and/or filtering information. The format is 6 two-digit hexadecimal numbers that are separated by colons, for example, 01:00:5e:45:67:89. VLAN ID A VLAN ID for which the switch has forwarding and filtering information.
XS712T Smart Switch port but were still interested in receiving multicast traffic directed to that group. Also, fast-leave processing is supported only with IGMP version 2 hosts. • Host Timeout. Sets the value for group membership interval of IGMP snooping for the specified VLAN ID. The valid range is (Maximum Response Time + 1) to 3600 seconds. • Maximum Response Time. Sets the value for maximum response time of IGMP Snooping for the specified VLAN ID. Valid range is 1 to 25.
XS712T Smart Switch 2. Select each interface to configure. 3. Use the Multicast Router menu to enable or disable Multicast Router on the selected interfaces. 4. Click Apply. Multicast Router VLAN Configuration Use this screen to configure the interface to only forward the snooped IGMP packets that come from VLAN ID to the multicast router attached to this interface.
XS712T Smart Switch 2. Select the Interface for which you want Multicast Router to be enabled or to be disabled. 3. Enter the VLAN ID for which the Multicast Router Mode is to be Enabled or Disabled. 4. Enable the VLAN ID for the multicast router. 5. Click Apply. IGMP Snooping Querier IGMP snooping requires that one central switch or router periodically query all end-devices on the network to announce their multicast memberships. This central device is the IGMP querier.
XS712T Smart Switch 2. From the Querier Admin Mode field, enable or disable the administrative mode for IGMP Snooping Querier. 3. Specify the IP address to be used as source address in periodic IGMP queries om the Snooping Querier Address field. This address is used when no address is configured on the VLAN on which the query is being sent. 4. Specify the IGMP protocol version used in periodic IGMP queries in the IGMP Version field. 5.
XS712T Smart Switch 2. Select New Entry from the VLAN ID field and complete the following fields: • VLAN ID. Specifies the VLAN ID for which the IGMP Snooping Querier is to be enabled. • • Querier Election Participate Mode. Enable or disable Querier Participate Mode. - Disable. Upon seeing another querier of the same version in the VLAN, the snooping querier moves to the non-querier state. - Enable.
XS712T Smart Switch The following table describes the information available on the Querier VLAN Status screen. Table 17. IGMP snooping querier VLAN status Field Description VLAN ID Specifies the VLAN ID on which the IGMP Snooping Querier is administratively enabled and for which VLAN exists in the VLAN database. Operational State Specifies the operational state of the IGMP Snooping Querier on a VLAN: • Querier: The snooping switch is the querier in the VLAN.
XS712T Smart Switch MLD Snooping Configuration In IPv4, Layer 2 switches can use IGMP Snooping to limit the flooding of multicast traffic by dynamically configuring Layer 2 interfaces so that multicast traffic is forwarded to only those interfaces associated with IP multicast address. In IPv6, MLD snooping performs a similar function. With MLD snooping, IPv6 multicast data is selectively forwarded to a list of ports that want to receive the data, instead of being flooded to all ports in a VLAN.
XS712T Smart Switch 2. To configure MLD settings for a physical port, enter the interface and click Go to select that particular interface. 3. Select the interfaces for which you want to configure the CoS settings: • To configure MLD settings for a Link Aggregation Group (LAG), click LAGS. • To configure MLD settings for both physical ports and LAGs, click ALL. 4. Select all physical, VLAN and LAG interface you want to configure in the Interface field. 5.
XS712T Smart Switch Enter a value greater or equal to 1 and less than the Group Membership Interval in seconds. The default is 10 seconds. The configured value must be less than the Group Membership Interval. 8. Use the Present Expiration Time field to specify the amount of time you want the switch to wait to receive a query on an interface before removing it from the list of interfaces with multicast routers attached. Enter a value between 0 and 3600 seconds. The default is 0 seconds.
XS712T Smart Switch 8. Under Multicast Router Expiry Time, specify the number of seconds the VLAN should wait to receive a query before it is removed from the list of VLANs with multicast routers attached. 9. Click Add. To disable MLD snooping on a VLAN: 1. Select the check box next to each VLAN on which MLD snooping should be disabled. 2. Click Delete.
XS712T Smart Switch • To configure Multicast Router settings for a Link Aggregation Group (LAG), click LAGS. • To configure Multicast Router settings for both physical ports and LAGs, click ALL. 4. Use the Multicast Router field to enable or disable Multicast Router on the selected interface. 5. Click Apply.
XS712T Smart Switch 2. From the Querier Admin Mode field, enable or disable the administrative mode for MLD Snooping Querier. 3. In the Querier Address field, specify the Snooping Querier Address to be used as source address in periodic MLD queries. This address is used when no address is configured on the VLAN on which query is being sent. The supported IPv6 formats are x:x:x:x:x:x:x:x and x::x. 4. In the MLD Version field, the MLD protocol version used in periodic MLD queries is displayed.
XS712T Smart Switch 2. Under VLAN ID, specify the VLAN ID for which the MLD Snooping Querier is to be enabled. 3. From the Querier Election Participate Mode list, select the mode: • Disabled. Upon seeing another querier of the same version in the VLAN, the snooping querier moves to the non-querier state. • Enabled. The snooping querier participates in querier election, in which the least IP address operates as the querier in that VLAN. The other querier moves to non-querier state. 4.
XS712T Smart Switch To remove an MLD snooping querier configuration: 1. Select the check box next to each entry to remove. 2. Click Delete. Forwarding Database The forwarding database maintains a list of MAC addresses after having received a packet from this MAC address. The transparent bridging function uses the forwarding database entries to determine how to forward a received frame. The Address Table link contains links described in the following sections.
XS712T Smart Switch • Interface. Select Interface from the menu, enter the interface ID in g1, g2... format, then, click Go. If any entries learned on that interface exist, they are displayed. 3. Click Clear to clear Dynamic MAC Addresses in the table. 4. Click Refresh to redisplay the screen to show the latest MAC Addresses. The following table describes the information available for each entry in the address table.
XS712T Smart Switch Note: IEEE 802.1D recommends a default of 300 seconds, which is the factory default. 3. Click Apply. Address Table The MAC Address Table contains information about unicast entries for which the switch has forwarding and filtering information. This information is used by the transparent bridging function in determining how to propagate a received frame. Use the search function of the MAC Address Table screen to display information about the entries in the table.
XS712T Smart Switch • Interface. Select Interface from the menu, enter the interface ID in g1, g2... format, then, click Go. If any entries learned on that interface exist, they are displayed. 3. Click Clear to clear Dynamic MAC Addresses in the table. 4. Click Refresh to redisplay the screen to show the latest MAC Addresses. The following table describes the information available for each entry in the address table. Field Description VLAN ID The VLAN ID associated with the MAC address.
XS712T Smart Switch To delete a static MAC address: 1. Select the check box next to each entry to remove. 2. Click Delete.
4. Configuring Routing 4 The XS712T Smart Switch supports IP routing. Use the menus under the Routing tab to manage routing on the system. When a packet enters the switch, the destination MAC address is checked to see if it matches any of the configured routing interfaces. If it does, then the switch searches the host table for a matching destination IP address. If an entry is found, then the packet is routed to the host.
XS712T Smart Switch IP Configuration Use the IP Configuration screen to configure routing parameters for the switch. To enable routing on the switch: 1. Select Routing IP > IP Configuration. 2. Next to Routing Mode, select Enable. You must enable routing for the switch before you can route through any of the interfaces. Routing is also enabled or disabled per VLAN interface. The default value is Disable. The following table describes the IP configuration information displayed on the screen.
XS712T Smart Switch Figure 5. IP statistics screen The following table describes the IP statistics information displayed on the screen. Table 18. IP routing statistics Field Description IpInReceives The total number of input datagrams received from interfaces, including those received in error.
XS712T Smart Switch Table 18. IP routing statistics (Continued) Field Description IpForwDatagrams The number of input datagrams for which this entity was not their final IP destination, as a result of which an attempt was made to find a route to forward them to that final destination. In entities which do not act as IP Gateways, this counter includes only those packets which were Source-Routed via this entity, and the Source-Route option processing was successful.
XS712T Smart Switch Table 18. IP routing statistics (Continued) Field Description IpFragFails The number of IP datagrams that have been discarded because they needed to be fragmented at this entity but could not be, e.g., because their Don't Fragment flag was set. IpFragCreates The number of IP datagram fragments that have been generated as a result of fragmentation at this entity. IpRoutingDiscards The number of routing entries which were chosen to be discarded even though they are valid.
XS712T Smart Switch Table 18. IP routing statistics (Continued) Field Description IcmpOutRedirects The number of ICMP Redirect messages sent. For a host, this object is always zero, since hosts do not send redirects. IcmpOutEchos The number of ICMP Echo (request) messages sent. IcmpOutEchoReps The number of ICMP Echo Reply messages sent. IcmpOutTimestamps The number of ICMP Timestamp (request) messages. IcmpOutTimestampReps The number of ICMP Timestamp Reply messages sent.
XS712T Smart Switch • Create a LAG, add selected ports to a LAG, then add LAG to the newly created VLAN. • Enable tagging on selected ports if the port is in another VLAN. Disable tagging if a selected port does not exist in another VLAN. • Exclude ports not selected from the VLAN. • Enable routing on the VLAN using the IP address and subnet mask entered. To configure VLAN routing using the VLAN routing wizard: 1. Click Routing VLAN > VLAN Routing Wizard. 2.
XS712T Smart Switch VLAN Routing Configuration Use the VLAN Routing Configuration screen to view information about the VLAN routing interfaces configured on the system or to assign an IP address and subnet mask to VLANs on the system. To configure VALN routing: 1. Select Routing VLAN > VLAN Routing. 2. In the VLAN list, select the VLAN you want to configure for VLAN routing. This field will display the all IDs of VLANs configured on this switch. 3. Enter an IP address of the VLAN routing interface.
XS712T Smart Switch Configure Router Discovery The Router Discovery protocol is used by hosts to identify operational routers on the subnet. Router Discovery messages are of two types: Router Advertisements and Router Solicitations. The protocol mandates that every router periodically advertise the IP Addresses it is associated with. Hosts listen for these advertisements and discover the IP Addresses of neighboring routers.
XS712T Smart Switch 8. Specify the preference level of the router as a default router relative to other routers on the same subnet. Higher numbered addresses are preferred. You must enter an integer. The value must be in the range of (-2147483648 to 2147483647). Default value is 0. 9. Click Apply. Configure and View Routes From the Route Configuration screen, you can configure static and default routes and view the routes that the switch has already learned. To configure a static route: 1.
XS712T Smart Switch The preference is an integer value from 1 to 255. You can specify the preference value (sometimes called administrative distance of an individual static route. For more information, see the Preference description in Table 19. 7. Enter a description for this route. This is the description of this route that identifies the route. The description must consist of alpha-numeric, dash or underscore characters and have a length in the range from (0 to 31). 8. Click Add.
XS712T Smart Switch Configure ARP The address resolution protocol (ARP) associates a layer 2 MAC address with a layer 3 IPv4 address. XS712T Smart Switch software features both dynamic and manual ARP configuration. With manual ARP configuration, you can statically add entries into the ARP table. ARP is a necessary part of the Internet protocol (IP) and is used to translate an IP address to a media (MAC) address, defined by a local area network (LAN) such as Ethernet.
XS712T Smart Switch The following table provides information included in the management VLAN ARP section. Table 20. ARP cache information Field Description IP Address Displays the associated IP address of a device on a subnet attached to one of the switch's existing routing interfaces. Port Shows the associated interface of the connection. MAC Address Displays the MAC address of the device. The following table provides information included in the routing VLANs ARP cache section. Table 21.
XS712T Smart Switch To add an entry to the ARP table: 1. Select Routing ARP > Advanced ARP Create. 2. Under IP Address, specify the IP address to add. It must be the IP address of a device on a subnet attached to one of the switch's existing routing interfaces. 3. Under MAC Address, specify the unicast MAC address of the device. The format is six two-digit hexadecimal numbers separated by colons, for example 00:06:29:32:81:40. 4. Click Add.
XS712T Smart Switch You must enter a valid integer, which represents the number of seconds the switch will wait for a response to an ARP request. The range for this field is 1 to 10 seconds. The default value for Response Time is 10 second. 4. Enter an integer which specifies the maximum number of times an ARP request will be retried. The range for this field is 0 to 10. The default value for Retries is 10. 5. Enter an integer which specifies the maximum number of entries for the ARP cache.
XS712T Smart Switch Remove an ARP Entry From the ARP Cache Use this screen to remove certain entries from the ARP Table. To remove entries from the ARP table: 1. select Routing ARP > Advanced ARP Entry Management. 2. Select the type of ARP entry to be removed from the Remove From Table drop down menu. The choices listed specify the type of ARP Entry to be deleted: • All Dynamic Entries • All Dynamic and Gateway Entries • Specific Dynamic / Gateway Entry.
5. Configuring Quality of Service 5 Use the features you access from the QoS tab to configure Quality of Service (QoS) settings on the switch. The QoS tab contains links described in the following sections. • Class of Service • Differentiated Services In a typical switch, each physical port consists of one or more queues for transmitting packets on the attached network. Multiple queues per port are often provided to give preference to certain packets over others based on user-defined criteria.
XS712T Smart Switch From the Advanced link, the Class of service menu under the QoS tab, you can access the following screens: • Basic CoS Configuration • CoS Interface Configuration • Interface Queue Configuration • 802.1p to Queue Mapping • DSCP to Queue Mapping Basic CoS Configuration Use the Trust Mode Configuration screen to set the class of service trust mode of an interface. Each port in the switch can be configured to trust one of the packet fields (802.
XS712T Smart Switch Global Trust Mode can be one of the following: • Untrusted. Do not trust any CoS packet marking at ingress. • 802.1p. The eight priority tags that are specified in IEEE 802.1p are p0 to p7. The QoS setting lets you map each of the eight priority levels to one of seven internal hardware priority queues. • DSCP. The six most significant bits of the DiffServ field are called the Differentiated Services Code Point (DSCP) bits. 4.
XS712T Smart Switch 2. To configure CoS settings for a specific interface, enter the interface and click Go to select that particular interface. 3. Alternatively, select the check box associated with each interface for which you want to configure the CoS settings: • To configure CoS settings for a Link Aggregation Group (LAG), click LAGS. • To configure CoS settings for both physical ports and LAGs, click ALL. The same settings will be applied to all selected interfaces. 4.
XS712T Smart Switch To configure CoS queue settings for an interface: 1. Select QoS CoS > Advanced Interface Queue Configuration. 2. To configure CoS queue settings for a physical port, enter the interface and click Go to select that particular interface. 3. Select the interfaces for which you want to configure the interface queue settings: • To configure CoS settings for a Link Aggregation Group (LAG), click LAGS. • To configure CoS settings for both physical ports and LAGs, click ALL. 4.
XS712T Smart Switch - Weighted. Weighted round robin associates a weight to each queue. This is the default. - Strict. Services traffic with the highest priority on a queue first. - Queue Management Type. Displays the type of packet management used for all packets, which is Taildrop. All packets on a queue are safe until congestion occurs. At this point, any additional packets queued are dropped. 6. Click Apply. 802.
XS712T Smart Switch The values in each drop-down menu represent the traffic class. The traffic class is the hardware queue for a port. Higher traffic class values indicate a higher queue position. Before traffic in a lower queue is sent, it must wait for traffic in higher queues to be sent. 4. Click Apply. DSCP to Queue Mapping Use the DSCP to Queue Mapping screen to specify which internal traffic class to map the corresponding DSCP value. To map DSCP values to queues: 1.
XS712T Smart Switch Differentiated Services The QoS feature contains Differentiated Services (DiffServ) support that allows traffic to be classified into streams and given certain QoS treatment in accordance with defined per-hop behaviors. Standard IP-based networks are designed to provide “best effort” data delivery service. “Best effort” service implies that the network delivers the data in a timely fashion, although there is no guarantee that it will.
XS712T Smart Switch Diffserv Configuration Use the DiffServ Configuration screen to display DiffServ General Status Group information, which includes the current administrative mode setting as well as the current and maximum number of rows in each of the main DiffServ private MIB tables. To configure the global DiffServ mode: 1. Select QoS DiffServ Advanced DiffServ Configuration. 2. Select the administrative mode for DiffServ: • Enable. Differentiated Services are active. • Disable.
XS712T Smart Switch Class Configuration Use the Class Configuration screen to add a new DiffServ class name, or to rename or delete an existing class. The screen also allows you to define the criteria to associate with a DiffServ class. As packets are received, these DiffServ classes are used to prioritize packets. You can have multiple match criteria in a class. The logic is a Boolean logical-and for this criteria. After creating a Class, click the class link to the Class screen.
XS712T Smart Switch 2. Define the criteria to associate with a DiffServ class: • Match Every. This adds to the specified class definition a match condition whereby all packets are considered to belong to the class. • Reference Class. Selects a class to start referencing for criteria. A specified class can reference at most one other class of the same type. • Class of Service. Select the field and enter a class of service 802.1p user priority value to be matched for the packets. The valid range is 0–7.
XS712T Smart Switch • Protocol Type. Requires a packet’s layer 4 protocol to match the protocol you select. If you select Other, enter a protocol number in the field that displays. The valid range is 0–255. • Source IP Address. Requires a packet’s source port IP address to match the address listed here. In the IP Address field, enter a valid source IP address in dotted decimal format. • Source Mask. Enter a valid subnet mask to determine which bits in the IP address are significant.
XS712T Smart Switch IPv6 Class Configuration The IPv6 Class Configuration feature extends the existing QoS ACL and DiffServ functionality by providing support for IPv6 packet classification. An Ethernet IPv6 packet is distinguished from an IPv4 packet by its unique Ethertype value, so all IPv6 classifiers include the Ethertype field. An IPv6 access list serves the same purpose as its IPv4 counterpart. Prior to the IPv6 class feature, any DiffServ class definition was assumed to apply to an IPv4 packet.
XS712T Smart Switch To delete a class: 1. Select the check box next to the class name. 2. Click Delete. The same set of fields described for IPv6 ACL classification are also supported as match criteria for DiffServ classes. Prior to the introduction of IPv6 class rule fields, any layer 3 or layer 4 item was interpreted as a field in an IPv4 packet.
XS712T Smart Switch To configure the policy attributes: 1. Click the name of the policy. The policy name is a hyperlink. The following figure shows the configuration fields for the policy. 2. Configure the policy attributes: • Assign Queue. Select this value from the drop-down list. This is an integer value in the range 0 to 7. • Drop. Select this option to drop packets for this policy-class. • Mark VLAN CoS. Select this value from the drop-down list.
XS712T Smart Switch • Mark IP DSCP. This lists the keywords for the known DSCP values from which one can be selected. • Simple Policy. This lists the keywords for the known DSCP values from which one can be selected. 3. Color Conform Class. This field is visible only if you select Color Aware Color Mode on the Policing Attributes screen, this lists the DiffServ classes that are valid for use as a conform color-aware specifier. One of the classes must be selected from this list. 4.
XS712T Smart Switch - Mark IP Precedence. These packets are marked by DiffServ with the specified IP Precedence value before being presented to the system forwarding element. This selection requires that the Mark IP Precedence value field be set. - Mark IP DSCP. These packets are marked by DiffServ with the specified DSCP value before being presented to the system forwarding element. This selection requires that the DSCP value field be set. 5. Click Apply.
XS712T Smart Switch You can select multiple ports and LAGs to apply the same setting to the selected interfaces. Select the check box in the heading row to apply the same settings to all interfaces. 5. From the Policy In Name list, select the policy to attach to the interface. 6. Click Apply. To remove a policy from an interface: 1. Select the interface(s) on which the policy is to be removed. 2. From the Policy In Name list, select None. 3. Click Apply.
6. Managing Device Security 6 Use the features available from the Security tab to configure management security settings for port, user, and server security. The Security tab contains links described in the following sections.
XS712T Smart Switch 2. Specify the current password in the Old Password field. The entered password will be displayed in asterisks (*). Passwords are 1–20 alphanumeric characters in length and are case sensitive. 3. Enter the new password. It will not display as it is typed, and only asterisks (*) will show on the screen. Passwords are 1–20 alphanumeric characters in length and are case sensitive. 4. To confirm the password, enter it again to make sure you entered it correctly.
XS712T Smart Switch RADIUS Configuration RADIUS servers provide additional security for networks. The RADIUS server maintains a user database, which contains per-user authentication information. The switch passes information to the configured RADIUS server, which can authenticate a user name and password before authorizing use of the network. RADIUS servers provide a centralized authentication method for: • Web Access • Access Control Port (802.
XS712T Smart Switch 3. In the Timeout Duration field, specify the timeout value, in seconds, for request retransmissions. Consideration to maximum delay time should be given when configuring RADIUS maximum retransmit and RADIUS timeout. If multiple RADIUS servers are configured, the maximum retransmit value on each will run out before the next server is attempted. A retransmit will not occur until the configured timeout value on that server has passed without a response from the RADIUS server.
XS712T Smart Switch To modify settings for a RADIUS server that is already configured on the switch: 1. Select the check box next to the server IP address. 2. Update the desired fields for the selected server. 3. Click Apply. To delete a configured RADIUS server: 1. Select the check box next to the IP address of the server to remove. 2. Click Delete. The following table describes the RADIUS server statistics available on the screen. Table 24.
XS712T Smart Switch Use the buttons at the bottom of the screen to perform the following actions: • Click Clear Counters to clear the authentication server and RADIUS statistics to their default values. • Click Refresh to refresh the screen with the most current data from the switch. Accounting Server Configuration Use the RADIUS Accounting Server Configuration screen to view and configure various settings for one or more RADIUS accounting servers on the network.
XS712T Smart Switch The following table describes RADIUS accounting server statistics available on the screen. Table 25. RADIUS accounting server statistics Field Description Accounting Server Address Displays the IP address of the supported RADIUS accounting server. Round Trip Time (secs) Displays the time interval, in hundredths of a second, between the most recent Accounting-Response and the Accounting-Request that matched it from this RADIUS accounting server.
XS712T Smart Switch Configuring TACACS+ TACACS+ provides a centralized user management system, while still retaining consistency with RADIUS and other authentication processes. TACACS+ provides the following services: • Authentication. Provides authentication during login and via user names and user-defined passwords. • Authorization. Performed at login. When the authentication session is completed, an authorization session starts using the authenticated user name.
XS712T Smart Switch TACACS+ Server Configuration Use the TACACS+ Server Configuration screen to configure up to five TACACS+ servers with which the switch can communicate. To configure TACACS+ server: 1. Select Security Management Security > TACACS+ Server Configuration. 2. In the TACACS Server field, specify the IP address of the TACACS server.
XS712T Smart Switch Authentication List Configuration Use the Authentication List screen to configure the default login list. A login list specifies one or more authentication methods to validate switch or port access for the admin user. Note: Admin is the only user on the system and is assigned to a preconfigured list named defaultList, which you cannot delete. HTTP Authentication List The HTTP authentication list defines the HTTP authentication method used for the default list.
XS712T Smart Switch 4. Use the menu in the 2 column to select the authentication method, if any, that should appear second in the selected authentication login list. This is the method that will be used if the first method times out. If you select a method that does not time out as the second method, the third method will not be tried. This parameter will not appear when you first create a new login list. 5.
XS712T Smart Switch • TACACS+. The user's ID and password will be authenticated using the TACACS+ server. If you select RADIUS or TACACS+ as the first method and an error occurs during the authentication, the switch attempts user authentication Method 2. • None. The authentication method is unspecified. This option is only available for Method 2 and Method 3. 4. Use the menu in the 2 column to select the authentication method, if any, that should appear second in the selected authentication login list.
XS712T Smart Switch 4. Click Apply. Configure Management Access From the Access menu, you can configure HTTP and Secure HTTP access to the XS712T management interface. You can also configure Access Control Profiles and Access Rules. The Access tab contains links described in the following sections.
XS712T Smart Switch 5. In the Maximum Number of HTTP Sessions field, specify the maximum number of HTTP sessions that can exist at the same time. The value must be in the range of (0–4). The default value is 4. 6. Click Apply. Secure HTTP Configuration Secure HTTP enables the transmission of HTTP over an encrypted Secure Sockets Layer (SSL) or Transport Layer Security (TLS) connection.
XS712T Smart Switch After the session is inactive for the configured amount of time, the administrator is automatically logged out and must re-enter the password to access the management interface. A value of zero corresponds to an infinite timeout. The valid range is 1—60 minutes. The default value is 5 minutes. 7. In the HTTPS Session Hard Timeout (Hours) field, specify the number of hours an HTTPS session can remain active, regardless of session activity. The value must be in the range of (1–168) hours.
XS712T Smart Switch Certificate Download For the Web server on the switch to accept HTTPS connections from a management station, the Web server needs a public key certificate. You can generate a certificate externally (for example, off-line) and download it to the switch. Before you download a file to the switch, the following conditions must be true: • The file to download from the TFTP server is on the server in the appropriate directory. • The file is in the correct format.
XS712T Smart Switch You can enter up to 32 characters. 7. Select the Start File Transfer check box. 8. Click Apply to start the transfer. A status message displays during the transfer and upon successful completion of the transfer.
XS712T Smart Switch Access Control Access control allows you to define a profile configuration and set access rules. Access Profile Configuration Use the Access Profile Configuration screen to set up a security access profile. To configure an access profile: 1. Select Security > Access > Access Control Access Profile Configuration. 2. Enter the name of the access profile to be added in the Access Profile Name field. Maximum length is 32 characters. 3.
XS712T Smart Switch IP 10.10.10.10 is configured with priority 1 to permit, and Source IP 10.10.10.10 is configured with priority 2 to Deny, then access is permitted if the profile is active, and the second rule is ignored. 4. Click Apply. Access Rule Configuration Use the Access Rule Configuration screen to add security access rules. To configure access rules: 1. Select Security > Access > Access Control Access Rule Configuration. 2. Specify the following settings: • Rule Type.
XS712T Smart Switch Port Authentication In port-based authentication mode, when 802.1X is enabled globally and on the port, successful authentication of any one supplicant attached to the port results in all users being able to use the port without restrictions. At any given time, only one supplicant is allowed to attempt authentication on a port in this mode. Ports in this mode are under bidirectional control. This is the default authentication mode. The 802.
XS712T Smart Switch Note: If 802.1X is enabled, authentication is performed by a RADIUS server. This means the primary authentication method must be RADIUS. To set the method, select Security Management Security Authentication List and select RADIUS as method 1 for defaultList. For more information, see Authentication List Configuration on page 180. • Disable. The switch does not check for 802.
XS712T Smart Switch 2. Select the check box next to the port to configure. You can also select multiple check boxes to apply the same settings to the select ports, or select the check box in the heading row to apply the same settings to all ports. 3. For one or more of the selected port, specify the following settings: • Port Control. Defines the port authorization state. The control mode is only set if the link status of the port is link up. The possible field values are.
XS712T Smart Switch - Auto. The system automatically detects the mode of the interface. - Authorized. The system places the interface into an authorized state without being authenticated. The interface sends and receives normal traffic without client port-based authentication. - Unauthorized. The system denies the selected interface system access by moving the interface into unauthorized state. The switch cannot provide authentication services to the client through the interface. - MAC based.
XS712T Smart Switch • Max EAP Requests. This input field allows you to enter the maximum requests for the selected port. The maximum requests value is the maximum number of times the authenticator state machine on this port will retransmit an EAPOL EAP Request/Identity before timing out the supplicant. The maximum requests value must be in the range of 1–10. The default value is 2. • Supplicant Timeout. This input field allows the user to enter the supplicant timeout for the selected port.
XS712T Smart Switch Table 26. Port authentication status information (Continued) Field Description Authenticator PAE State The authenticator PAE state displays the current state of the authenticator PAE state machine. Possible values are as follows: Initialize Disconnected Connecting Authenticating Authenticated Aborting Held ForceAuthorized ForceUnauthorized Backend State The backend state displays the current state of the backend authentication state machine.
XS712T Smart Switch The following table describes the fields on the Port Summary screen. Table 27. IEEE 802.1X port summary information Field Description Port The port whose settings are displayed in the current table row. Control Mode Defines the port authorization state. The control mode is only set if the link status of the port is link up. The possible field values are: • Auto. Automatically detects the mode of the interface. • Force Authorized.
XS712T Smart Switch Table 27. IEEE 802.1X port summary information (Continued) Field Description Reauthentication Enabled Displays if reauthentication is enabled on the selected port. This is a configurable field. The possible values are true and false. If the value is true, reauthentication will occur. Otherwise, reauthentication will not be allowed. Port Status This field displays the authorization status of the specified port. The possible values are Authorized, Unauthorized, and N/A.
XS712T Smart Switch 2. Select Create Filter from the MAC Filter menu. If no filters have been configured, this is the only option available. 3. From the VLAN ID menu, select the VLAN to use with the MAC address to fully identify packets you want filtered. You can change this field only when the Create Filter option is selected from the MAC Filter menu. 4. In the MAC Address field, specify the MAC address of the filter in the format 00:01:1A:B2:53:4D.
XS712T Smart Switch MAC Filter Summary Use the MAC Filter Summary screen to view the MAC filters that are configured on the system. To display the MAC filter summary screen: Select Security Traffic Control > MAC Filter MAC Filter Summary. The MAC Filter Summary screen displays Figure 6. MAC filter summary screen The following table describes the information displayed on the screen: Table 28.
XS712T Smart Switch Storm Control A broadcast storm is the result of an excessive number of broadcast messages simultaneously transmitted across a network by a single port. Forwarded message responses can overload network resources and/or cause the network to time out. The switch measures the incoming broadcast/multicast/unknown unicast packet rate per port and discards packets when the rate exceeds the defined value.
XS712T Smart Switch • Unknown Unicast. If the rate of unknown L2 unicast (destination lookup failure) traffic ingressing on an interface increases beyond the configured threshold, the traffic will be dropped. • Multicast. If the rate of L2 multicast traffic ingressing on an interface increases beyond the configured threshold, the traffic will be dropped. • Broadcast. If the rate of L2 broadcast traffic ingressing on an interface increases beyond the configured threshold, the traffic will be dropped.
XS712T Smart Switch The Port Security Violation table shows information about violations that occurred on ports that are enabled for port security. The following table describes the fields in the Port Security Violation table. Table 29. Port security violation information Field Description Port Identifies the port where a violation occurred. Last Violation MAC Displays the source MAC address of the last packet that was discarded at a locked port.
XS712T Smart Switch 2. To configure port security settings for a Link Aggregation Group (LAG), click LAGS. 3. To configure port security settings for both physical ports and LAGs, click ALL. 4. To configure settings for a physical port, enter the port in unit/slot/port format and click on the Go button. The entry corresponding to the specified port will be selected. 5. Select the check box next to the port or LAG to configure.
XS712T Smart Switch Security MAC Address Use the Security MAC Address screen to convert a dynamically learned MAC address to a statically locked address. To convert learned MAC addresses: 1. Select Security Traffic Control > Port Security Security MAC Address. 2. Select the Convert Dynamic Address to Static check box. 3. The Number of Dynamic MAC Addresses Learned field displays the number of dynamically learned MAC addresses on a specific port. 4.
XS712T Smart Switch Protected Ports Membership If a port is configured as protected, it does not forward traffic to any other protected port on the switch, but it will forward traffic to unprotected ports. Use the Protected Ports Membership screen to configure the ports as protected or unprotected. To configure protected ports: 1. Select Security Traffic Control Protected Ports. 2. Click the orange bar to display the available ports. 3.
XS712T Smart Switch 2. Use the Private VLAN Type menu to select the type of private vlan. The factory default is Unconfigured. • Primary. A private VLAN that forwards the traffic from the promiscuous ports to isolated ports, community ports, and other promiscuous ports in the same private VLAN. Only one primary VLAN can be configured per private VLAN. All ports within a private VLAN share the same primary VLAN. • Isolated. A secondary VLAN that carries traffic from isolated ports to promiscuous ports.
XS712T Smart Switch 4. Click Apply. Table 32. Private VLAN association table information Field Description Isolated VLAN The VLAN ID of the isolated VLAN associated with the primary VLAN. If the field is blank, no isolated VLAN has been associated with the primary VLAN. An isolated VLAN is a secondary VLAN that carries traffic from isolated ports to promiscuous ports. Only one isolated VLAN can be configured per private VLAN.
XS712T Smart Switch 3. Use the Port Vlan Mode menu to select the Switch Port Mode. The factory default is General. • General. The interface is in general mode and is not a member of a private VLAN. • Host.
XS712T Smart Switch • To configure a single port, select the check box associated with it, or type the port number in the Go To Interface field and click Go. • To configure multiple ports with the same settings, select the check box associated with each port to configure. • To configure all ports with the same settings, select the check box in the heading row. 3. The primary private VLAN the port is a member of when it is configured to operate in Host mode.
XS712T Smart Switch Private VLAN Promiscuous Interface Configuration The private VLAN Promiscuous interface configuration screen allows you to configure the primary and secondary Promiscuous VLAN IDs for the host association mode. To configure the private VLAN Promiscuous interface: 1. Select Security Traffic Control Private Vlan > Private Vlan Promiscuous Interface Configuration. 2. Select the port(s) to configure.
XS712T Smart Switch • You can specify an individual VLAN ID. Example: 10. • You can specify the VLAN range values separated by a '-'. Example, 10–13. • You can specify a combination of both separated by ','. Example, 12,15,40–43,1000–1005,2000. The range of the VLAN ID is 2–4093. Note: The VLAN ID List given in this control will replace the configured Secondary VLAN list in the association. 5. Click Apply. Table 34.
XS712T Smart Switch Configuring Access Control Lists Access Control Lists (ACLs) ensure that only authorized users have access to specific resources while blocking off any unwarranted attempts to reach network resources. ACLs are used to provide traffic flow control, restrict contents of routing updates, decide which types of traffic are forwarded or blocked, and above all provide security for the network. XS712T Smart Switch software supports IPv4 and MAC ACLs.
XS712T Smart Switch ACL Wizard ACL Wizard helps you to create a simple ACL and apply it to the selected ports easily and quickly. First, you can select an ACL type. Then, you can add an ACL rule to this ACL and a rule can be applied this ACL on the selected ports. The ACL Wizard allows you only to create the ACL, but does not allow you to modify it. For information about how to modify it, see the instructions on the to the ACL configuration screen. To display the ACL wizard screen: 1.
XS712T Smart Switch • ACL Based on Destination IPv6 L4 Port. Use this to create an ACL based on the destination IPv6 layer4 port number. • ACL Based on Source IPv6 L4 Port. Use this to create an ACL based on the source IPv6 layer4 port number. 3. In the Rule ID field, enter a whole number in the range of (1 to 10) that will be used to identify the rule. 4. In the Action field, specify what action should be taken if a packet matches the rule's criteria. The choices are permit or deny. 5.
XS712T Smart Switch MAC ACL A MAC ACL consists of a set of rules which are matched sequentially against a packet. When a packet meets the match criteria of a rule, the specified rule action (Permit/Deny) is taken and the additional rules are not checked for a match. There are multiple steps involved in defining a MAC ACL and applying it to the switch: 1. Create the ACL ID. See MAC ACL. 2. Create a MAC rule. See MAC Rules. 3. Create a MAC binding configuration. See MAC Binding Configuration. 4.
XS712T Smart Switch To delete a MAC ACL: 1. Select the check box next to the Name field. 2. Click Delete. MAC Rules Use the MAC Rules screen to define rules for MAC-based ACLs. The access list definition includes rules that specify whether traffic matching the criteria is forwarded normally or discarded. A default 'deny all' rule is the last rule of every list. Note: To set up a new MAC ACL, use the MAC ACL screen. To add rules to a MAC ACL: 1. Select Security ACL > Basic MAC Rules. 2.
XS712T Smart Switch • Destination MAC. Requires an Ethernet frame’s destination port MAC address to match the address listed here. Enter a MAC address in this field. The valid format is xx:xx:xx:xx:xx:xx. • Destination MAC Mask. If desired, enter the MAC Mask associated with the Destination MAC to match. The MAC address mask specifies which bits in the destination MAC to compare against an Ethernet frame. Use Fs and zeros in the MAC mask, which is in a wildcard format.
XS712T Smart Switch MAC Binding Configuration When an ACL is bound to an interface, all the rules that have been defined are applied to the selected interface. Use the MAC Binding Configuration screen to assign MAC ACL lists to ACL Priorities and Interfaces. To configure MAC ACL interface bindings: 1. Select Security ACL > Basic MAC Binding Configuration. 2. Select an existing MAC ACL which requires binding configuration from the ACL ID menu.
XS712T Smart Switch The Interface Binding Status section on the MAC Binding Configuration screen displays the following information: • Interface. Displays selected interface. • Direction. Displays selected packet filtering direction for ACL. • ACL Type. Displays the type of ACL assigned to selected interface and direction. • ACL ID. Displays the ACL Number or Name identifying the ACL assigned to selected interface and direction. • Sequence Number.
XS712T Smart Switch IP ACL IP ACLs allow network managers to define classification actions and rules for specific ingress ports. Packets can be filtered on ingress (inbound) ports only. If the filter rules match, then some actions can be taken, including dropping the packet or disabling the port. For example, a network administrator defines an ACL rule that says port number 20 can receive TCP packets. However, if a UDP packet is received the packet is dropped.
XS712T Smart Switch IP Rules Use the IP Rules screen to define rules for IP-based standard ACLs. The access list definition includes rules that specify whether traffic matching the criteria is forwarded normally or discarded. Note: There is an implicit deny all rule at the end of an ACL list. This means that if an ACL is applied to a packet and if none of the explicit rules match, then the final implicit deny all rule applies and the packet is dropped. To add IP rules: 1.
XS712T Smart Switch - Deny. Drops packets which meet the ACL criteria. • Egress Queue. Specifies the hardware egress queue identifier used to handle all packets matching this ACL rule. • Logging. When set to Enable, logging is enabled for this ACL rule (subject to resource availability in the device). If the Access List Trap Flag is also enabled, then this causes periodic traps to be generated indicating the number of times this rule was hit during the current report interval.
XS712T Smart Switch Note: There is an implicit “deny all” rule at the end of an ACL list. This means that if an ACL is applied to a packet and if none of the explicit rules match, then the final implicit “deny all” rule applies and the packet is dropped. To add rules to an IP ACL: 1. Select Security ACL > Advanced IP Extended Rules. In the following figure, an extended IP ACL exists, and one rule has been configured. 2. In the ACL ID/Name list, select the ACL to add the rule to. 3. Click Add.
XS712T Smart Switch 5. Select or specify values for one or more of the following match criteria: • Action. Select the ACL forwarding action, which is one of the following: - Permit. Forwards packets which meet the ACL criteria. - Deny. Drops packets which meet the ACL criteria. • Egress Queue. Specifies the hardware egress queue identifier used to handle all packets matching this ACL rule. Enter an identifying number from 0–7 in the appropriate field. • Match Every.
XS712T Smart Switch • - Destination L4 Keyword. Select the desired L4 keyword from a list of destination ports on which the rule can be based. - Destination L4 Port Number. If the destination L4 keyword is Other, enter a user-defined Port ID by which packets are matched to the rule. Service Type. Select one of the Service Type match conditions for the extended IP ACL rule.
XS712T Smart Switch taken and the additional rules are not checked for a match. On this menu, the interfaces to which an IP ACL applies must be specified, as well as whether it applies to inbound or outbound traffic. Rules for the IPv6 ACL are specified/created using the IPv6 Rules screen. To add an IPv6 ACL: 1. Select Security ACL > Advanced IPv6 ACL. The current number of the IP ACLs configured on the switch is displayed in the Current Number of ACL area.
XS712T Smart Switch 2. In the ACL Name list, select the name of the ACL to add a rule to. 3. Click Add. The screen displays the IPv6 ACL Rule Configuration fields. 4. Next to Rule ID, specify a number from 1–10 to identify the IPv6 ACL rule. You can create up to 10 rules for each ACL. 5. Select or specify values for one or more of the following match criteria: • Rule ID. Enter a whole number in the range of 1 to 10 that will be used to identify the rule. An IPv6 ACL can have up to 10 rules. • Action.
XS712T Smart Switch • Assign Queue ID. Specifies the hardware egress queue identifier used to handle all packets matching this IPv6 ACL rule. The valid range of Queue IDs is from 0 to 6. This field is visible for a Permit Action. • Mirror Interface. Specifies the specific egress interface where the matching traffic stream is copied in addition to being forwarded normally by the device. This field cannot be set if a Redirect Interface is already configured for the ACL rule.
XS712T Smart Switch • Flow Label. Flow label is 20-bit number that is unique to an IPv6 packet, used by end stations to signify quality-of-service handling in routers. Flow label can be specified within the range (0 to 1048575). • IPv6 DSCP Service. Specify the IP DiffServ Code Point (DSCP) field. The DSCP is defined as the high-order six bits of the Service Type octet in the IPv6 header. This is an optional configuration. Enter an integer from 0 to 63.
XS712T Smart Switch IP Binding Configuration When an ACL is bound to an interface, all the rules that have been defined are applied to the selected interface. Use the IP Binding Configuration screen to assign ACL lists to ACL Priorities and Interfaces. To add IP ACL interface bindings: 1. Select Security ACL > Advanced IP Binding Configuration. 2. Select an existing IP ACL in which you want to add an IP ACL interface binding from the ACL ID menu.
XS712T Smart Switch IP Binding Table Use the IP Binding Table screen to view or delete the IP ACL bindings. To delete an IP ACL binding: 1. Select Security ACL > Advanced Binding Table. 2. Select the check box associated with the ACL-to-interface binding to remove. 3. Click Delete. The following table describes the information displayed in the IP binding table. Table 36. IP binding table information Field Description Interface Displays the interface to which the IP ACL is bound.
XS712T Smart Switch VLAN Binding Table Use the VLAN binding table screen to associate an ACL with a VLAN. To configure an ACL-to-VLAN binding: 1. Select Security ACL > Advanced Vlan Binding Table. 2. In the VLAN ID field, specify a VLAN ID for ACL mapping. 3. In the Direction field, specify the direction of packet traffic affected by the ACL, which can be Inbound or blank. 4. (Optional) In the Sequence Number field, specify the sequence number of the access lists.
7. Monitoring the System 7 Use the features available from the Monitoring tab to view a variety of information about the switch and its ports and to configure how the switch monitors events. The Monitoring tab contains configuration menus described in the following sections. • Ports • Logs • Mirroring Ports The screens available from the Ports menu contain a variety of information about the number and type of traffic transmitted from and received on the switch.
XS712T Smart Switch Figure 7. Switch Statistics screen The following table describes the switch statistics displayed on the screen. Table 37. Switch statistics Field Description ifIndex This object indicates the ifIndex of the interface table entry associated with the processor of this switch. Octets Received The total number of octets of data received by the processor (excluding framing bits, but including FCS octets).
XS712T Smart Switch Table 37. Switch statistics (Continued) Field Description Receive Packets Discarded The number of inbound packets which were chosen to be discarded, even though no errors had been detected, in order to prevent their being delivered to a higher layer protocol. A possible reason for discarding a packet could be to free up buffer space. Octets Transmitted The total number of octets transmitted out of the interface, including framing characters.
XS712T Smart Switch Port Statistics The Port Statistics screen displays a summary of per-port traffic statistics on the switch. To access the port summary screen: 1. Select Monitoring Ports > Port Statistics. 2. Select whether to display physical interfaces, link aggregation groups (LAGs), or both by clicking one of the following links above the table heading: • 1. Only physical interfaces are displayed. This is the default setting. • All.
XS712T Smart Switch Table 38. Port statistics (Continued) Field Description Broadcast Packets Received The total number of good packets received that were directed to the broadcast address. This does not include multicast packets. Packets Transmitted Without Errors The number of frames that have been transmitted by this port to its segment. Transmit Packet Errors The number of outbound packets that could not be transmitted because of errors.
XS712T Smart Switch Port Detailed Statistics The Port Detailed Statistics screen displays a variety of per-port traffic statistics. To access the port detailed screen: 1. Select Monitoring Ports > Port Detailed Statistics. The Port Detailed Statistics figure shows some, but not all, of the fields on the screen. 2. From the Interface list, select the interface with the statistics to view. 3. From the MST list, select the MST ID associated with the interface (if available).
XS712T Smart Switch The following table describes the detailed port information displayed on the screen. Table 39. Detailed interface statistics Field Description ifIndex This field indicates the ifIndex of the interface table entry associated with this port on an adapter. Port Type For most ports this field is blank. Otherwise the possible values are: • Mirrored. Indicates that the port has been configured as a monitoring port and is the source port in a port mirroring session.
XS712T Smart Switch Table 39. Detailed interface statistics (Continued) Field Description LACP Mode Selects the Link Aggregation Control Protocol administration state: • Enable. Specifies that the port is allowed to participate in a port channel (LAG), which is the default mode. • Disable. Specifies that the port cannot participate in a port channel (LAG). Physical Mode Indicates the port speed and duplex mode.
XS712T Smart Switch Table 39. Detailed interface statistics (Continued) Field Description Octets Received The total number of octets of data (including those in bad packets) received on the network (excluding framing bits but including FCS octets). This object can be used as a reasonable estimate of Ethernet utilization. If greater precision is desired, the etherStatsPkts and etherStatsOctets objects should be sampled before and after a common interval.
XS712T Smart Switch Table 39. Detailed interface statistics (Continued) Field Description Jabbers Received The total number of packets received that were longer than 1518 octets (excluding framing bits, but including FCS octets), and had either a bad Frame Check Sequence (FCS) with an integral number of octets (FCS Error) or a bad FCS with a non-integral number of octets (Alignment Error). This definition of jabber is different than the definition in IEEE 802.3 section 8.2.1.5 (10BASE5) and section 10.
XS712T Smart Switch Table 39. Detailed interface statistics (Continued) Field Description Packets Transmitted 256-511 Octets The total number of packets (including bad packets) transmitted that were between 256 and 511 octets in length inclusive (excluding framing bits but including FCS octets). Packets Transmitted 512-1023 Octets The total number of packets (including bad packets) transmitted that were between 512 and 1023 octets in length inclusive (excluding framing bits but including FCS octets).
XS712T Smart Switch Table 39. Detailed interface statistics (Continued) Field Description Dropped Transmit Frames Number of transmit frames discarded at the selected port. STP BPDUs Received Number of STP BPDUs received at the selected port. STP BPDUs Transmitted Number of STP BPDUs transmitted from the selected port. RSTP BPDUs Received Number of RSTP BPDUs received at the selected port. RSTP BPDUs Transmitted Number of RSTP BPDUs transmitted from the selected port.
XS712T Smart Switch EAP Statistics Use the EAP Statistics screen to display information about EAP packets received on a specific port. To display the EAP statistics screen: 1. Select Monitoring Ports > EAP Statistics. 2. Select whether to display physical interfaces, link aggregation groups (LAGs), or both by clicking one of the following links above the table heading: • 1. Only physical interfaces are displayed. This is the default setting. • All.
XS712T Smart Switch Table 40. EAP statistics (Continued) Field Description Invalid Frames Received The number of unrecognized EAPOL frames received on this port. Length Error Frames Received The number of EAPOL frames with an invalid Packet Body Length received on this port. Response/ID Frames Received The number of EAP Respond ID frames that have been received on the port. Response Frames Received The number of valid EAP Response frames received on the port.
XS712T Smart Switch Cable Test Use the Cable Test screen to display information about the cables connected to switch ports. To display the cable test screen: 1. Select Monitoring Ports > Cable Test. 2. Select whether to display physical interfaces, link aggregation groups (LAGs), or both by clicking one of the following links above the table heading: • 1. Only physical interfaces are displayed. This is the default setting. • All. Both physical interfaces and link aggregation groups are displayed.
XS712T Smart Switch The following table describes the cable information displayed on the screen. Table 41. Cable information Field Description Port Specifies the port that has the connected cable. Cable Status Displays the cable status. • Normal. The cable is working correctly. • Open. The cable is disconnected or there is a faulty connector. • Short. There is an electrical short in the cable. • Cable Test Failed. The cable status could not be determined. The cable can in fact be working. • Unknown.
XS712T Smart Switch Memory Log The Memory Log stores messages in memory based upon the settings for message component and severity. Use the Memory Log screen to set the administrative status and behavior of logs in the system buffer. These log messages are cleared when the switch reboots. To configure the memory log settings: 1. Select Monitoring Logs > Memory Log. 2. Select the radio buttons in the Admin Status field to determine whether to log messages. • Enable. Enables system logging. • Disable.
XS712T Smart Switch Priority = (facility value × 8) + severity level. The facility value is usually one, which means it is a user-level message. Therefore, to determine the severity level of the message, subtract eight from the number in the angle brackets. The example log message has a severity level of 6 (informational). For more information about the severity of a log message, see Server Log on page 252. The message was generated on March 24 at 5:34:05 a.m by the switch with an IP address of 10.131.12.
XS712T Smart Switch 3. From the Severity Filter field, specify the type of log messages to record. A log records messages equal to or above a configured severity threshold. For example, if you select Error, the logged messages include Error, Critical, Alert, and Emergency. The default severity level is Alert (1). The severity can be one of the following levels: • Emergency (0). The highest warning level. If the device is down or not functioning properly, an emergency log is saved to the device.
XS712T Smart Switch Server Log Use the Server Log screen to allow the switch to send log messages to the remote logging hosts configured on the system. To configure local log server settings: 1. Select Monitoring Logs > Server Log link. 2. Select the radio buttons in the Admin Status field to determine whether to send log messages to the remote syslog hosts configured on the switch. • Enable.
XS712T Smart Switch To add a remote syslog host (log server): 1. Specify the following settings in the following list. • IP Address Type. Specify the IP Address Type of Host. It can be one of the following: - IPv4 - IPv6 - DNS • Host Address. Specify the hostname of the host configured for syslog. • Port. Specify the port on the host to which syslog messages are sent. The default port is 514. • Severity Filter. Use the menu to select the severity of the logs to send to the logging host.
XS712T Smart Switch Trap Logs Use the Trap Logs screen to view information about the SNMP traps generated on the switch. To view trap log information: Select Monitoring Logs > Trap Logs. The Trap Logs screen displays. Figure 8. Trap log screen The following table describes the Trap Log information displayed on the screen. Table 42. Trap log statistics Field Description Number of Traps Since The number of traps that have occurred since the switch last reboot.
XS712T Smart Switch Event Logs Use the Event Log screen to display the event log, which is used to hold error messages for catastrophic events. After the event is logged and the updated log is saved in flash memory, the switch will be reset. The log can hold at least 2,000 entries and is erased when an attempt is made to add an entry after it is full. The event log is preserved across system resets. To view the event logs: Select Monitoring Logs > Event Logs. The Event Logs screen displays Figure 9.
XS712T Smart Switch Mirroring The Port Mirroring screen allows you to view and configure port mirroring on the system. Port mirroring selects the network traffic for analysis by a network analyzer. This is done for specific ports of the switch. As such, many switch ports are configured as source ports and one switch port is configured as a destination port. You have the ability to configure how traffic is mirrored on a source port.
XS712T Smart Switch 3. Select the mode for port mirroring on the selected port from the Session Mode: • Enable. Multiple Port Mirroring is active on the selected port. • Disable. Port mirroring is not active on the selected port, but the mirroring information is retained. 4. Select the source port(s). You can configure multiple ports and LAGs as source ports. a. Display the port(s) or LAG(s) to configure as source ports.
XS712T Smart Switch 258
8. Maintenance 8 Use the features available from the Maintenance tab to help you manage the switch. The Maintenance tab contains links described in the following sections. • Reset • Upload • Download • File Management Reset The Reset menu contains links described in the following sections. • Device Reboot • Factory Default Device Reboot Use the Device Reboot screen to reboot the switch. To reboot the switch: 1. Select Maintenance Reset Device Reboot. 2. Select the check box. 3.
XS712T Smart Switch Factory Default Use the Factory Default screen to reset the system configuration to the factory default values. Note: If you reset the switch to the default configuration, the IP address is reset to 192.168.0.239, and the DHCP client is enabled. If you loose network connectivity after you reset the switch to the factory defaults, see Connect the Switch to the Network on page 8. To reset the switch to the factory default settings: 1. Select Maintenance Reset Factory Default. 2.
XS712T Smart Switch TFTP File Upload Use the TFTP File Upload screen to upload configuration (ASCII), log (ASCII), and image (binary) files from the switch to a TFTP server on the network. To upload a file from the switch to the TFTP server: 1. Select Maintenance Upload TFTP File Upload. 2. Use the File Type menu to specify the type of file you want to upload: • Archive. Retrieve the image from the operational flash. • Text Configuration. Retrieve the stored text configuration. • Error Log.
XS712T Smart Switch 8. Select the Start File Transfer check box to initiate the file upload. 9. Click Apply to begin the file transfer. Note: The file transfer will not begin until you click Apply. The last row of the table displays information about the progress of the file transfer. The screen refreshes automatically until the file transfer completes or fails.
XS712T Smart Switch Download The switch supports system file downloads from a remote system to the switch by using either TFTP or HTTP. The Download menu contains links described in the following sections. • TFTP File Download • HTTP File Download TFTP File Download Use the Download File to switch screen to download device software, the image file, the configuration files and SSL files from a TFTP server to the switch.
XS712T Smart Switch • Text Configuration. A text-based configuration file enables you to edit a configured text file (startup-config) offline as needed without having to translate the contents for the switch to understand. The most common usage of text-based configuration is to upload a working configuration from a device, edit it offline to personalize it for another similar device (for example, change the device name, serial number, IP address), and download it to that device.
XS712T Smart Switch 9. Click Apply to begin the file transfer. The last row of the table displays information about the progress of the file transfer. The screen refreshes automatically until the file transfer completes or fails. To activate a software image that you download to the switch, see File Management on page 266. HTTP File Download Use the HTTP File Download screen to download files of various types to the switch using an HTTP session (for example, via your Web browser).
XS712T Smart Switch Note: It is recommended that you do not overwrite the active image. The system will display a warning that you are trying to overwrite the active image. 4. Next to the Select File field, click Browse to locate the file you want to download. 5. Click the Apply button to initiate the file download. Note: After a file transfer is started, wait until the screen refreshes. When the screen refreshes, the Select File option will be blanked out. This indicates that the file transfer is done.
XS712T Smart Switch Dual Image Configuration The system running a legacy software version will ignore (not load) a configuration file created by the newer software version. When a configuration file created by the newer software version is discovered by the system running an older version of the software, the system will display an appropriate warning to the user. Use the Dual Image Configuration screen to set the boot image, configure an image description, or delete an image.
XS712T Smart Switch Dual Image Status The Dual Image Status screen shows the following: • Image1 Ver. The version of the image1 code file. • Image2 Ver. The version of the image2 code file. • Current-active. The currently active image on this unit. • Next-active. The image to be used on the next restart of this unit. • Image1 Description.The description associated with the image1 code file. • Image2 Description. The description associated with the image2 code file. Figure 10.
A. Smart Control Center Utilities A The NETGEAR Smart Control Center (SCC) is a Windows based application. Its main function is to discover NETGEAR Smart switches in your network and connect them to your network. For information about device discovery and network connectivity, see Chapter 1, Getting Started. In addition to device discovery, the Smart Control Center includes network configuration utilities and several maintenance features.
XS712T Smart Switch • Configure Device. Allows you to modify network information for the switch, including the IP address, DHCP client mode, system name, and location. For more information about this feature, see Configure the Device on page 271. • Change Password. Allows you to set a new password for the device. For more information about this feature, see Change the Switch Password on page 272.
XS712T Smart Switch Configure the Device Use the Configure Device button to define basic switch configuration information. To modify switch information: 1. Select the switch. 2. Click Configure Device. Additional fields appear on the screen. 3. To assign or update a static IP address, default gateway, or subnet mask, disable the DHCP client and enter the new information. You can also specify a system name and location for the switch. 4. Type the password in the Current Password field.
XS712T Smart Switch Change the Switch Password Use the Change Password button to change the administrative password you use to log in to the switch management interface. To change the switch password: 1. Select the switch. 2. Click Change Password. Additional fields appear on the screen. 3. Type the switch password in the Current Password field. The default password for the switch is password. 4. Type the new password in the New Password and Confirm Password fields.
XS712T Smart Switch Manage the Switch Configuration and Firmware The Maintenance tab includes links to perform the following tasks: • Upload and download the configuration. Upload the configuration file from the switch to an administrative system or other network location or download the configuration file from a remote device to the switch. • Firmware upgrade. Load a new firmware image on the switch.
XS712T Smart Switch 4. Click OK. 5. Enter the switch password and click Apply. The file is uploaded to the administrative computer as a *.cfg file. You can open it and view the contents with a text editor. To restore the configuration to a previously saved version: 1. Click the Maintenance tab and select the device with the configuration to restore. 2. Click Download Configuration. The Select a Configuration window displays. 3. Navigate to and select the configuration file to download to the switch. 4.
XS712T Smart Switch Upgrade the Firmware The application software for the XS712T Smart Switch is upgradeable, enabling your switch to take advantage of improvements and additional features as they become available. Before you begin, download the firmware file from the NETGEAR Support web site for your switch to a TFTP server on your network. This procedure uses the TFTP protocol to implement the transfer from computer to switch.
XS712T Smart Switch 6. Download the firmware to primary or secondary storage. • Download the firmware as to primary storage. By default, the firmware is downloaded to primary storage and will be become the active image after the download completes and the switch reboots. • Download the firmware to secondary storage. Select the Secondary Storage option to save the firmware as a backup image on the switch.
XS712T Smart Switch View and Manage Tasks From the Tasks tab, you can view information about configuration downloads and firmware upgrades that have already occurred, are in progress, or are scheduled to take place at a later time. You can also delete or reschedule selected tasks. Figure 11 shows the Tasks screen. Figure 11. Tasks screen The following list describes the command buttons that are specific to the Tasks screen: • Delete Task: Remove a completed or schedule task from the list.
XS712T Smart Switch 278
B. Troubleshooting B This appendix covers the following topics: • Troubleshooting Configuration Menu • Troubleshooting Chart Troubleshooting Configuration Menu The Maintenance main navigation tab gives access to the Troubleshooting configuration menu. This menu lets you perform basic troubleshooting functions such as pinging an IPv4 or IPv6 address to check if the switch can communicate with a particular network host and tracing an IPv4 route to determine the packet’s path to a remote destination.
XS712T Smart Switch 2. In the IP Address/Host Name field, specify the IP address or the host name of the station you want the switch to ping. The initial value is blank. This information is not retained across a power cycle. 3. Configure the following settings: • In the Count field, specify the number of pings to send. The valid range is 1–15. • In the Interval (secs) field, specify the number of seconds between pings sent. The valid range is 1–60.
XS712T Smart Switch Ping IPv6 Use the Ping IPv6 screen to send a Ping request to a specified host name or IPv6 address. You can use this to check whether the switch can communicate with a particular IPv6 station. When you click the Apply button, the switch will send three pings and the results will be displayed below the configurable data. To send a ping to an IPv6 address: 1. Select Maintenance Troubleshooting Ping IPv6. 2.
XS712T Smart Switch TraceRoute Use the Traceroute utility to discover the paths that a packet takes to a remote destination. To trace a route to an IPv4 address or host: 1. Select Maintenance Troubleshooting TraceRoute. 2. In the Hostname/IP Address field, specify the IP address or the hostname of the station you want the switch to ping. The initial value is blank. This information is not retained across a power cycle. 3. Configure the following settings: • Probes Per Hop.
XS712T Smart Switch Troubleshooting Chart The following table lists symptoms, causes, and solutions of possible problems. Table 45. Troubleshooting chart Symptom Cause Solution Power LED is off. No power is received. Check the power cord connections for the switch at the switch and the connected AC power source. Link/ACT LED is off when a cable connects the port to a valid device. Port connection is not working.
XS712T Smart Switch 284
C. Configuration Examples C This appendix contains information about how to configure: • Virtual Local Area Networks (VLANs) • Access Control Lists (ACLs) • Differentiated Services (DiffServ) • 802.1X • MSTP • VLAN Routing with a Static Route Virtual Local Area Networks (VLANs) A local area network (LAN) can generally be defined as a broadcast domain. Hubs, bridges, or switches in the same physical segment or segments connect all end node devices.
XS712T Smart Switch • They are easy to manage. The addition of nodes, as well as moves and other changes, can be dealt with quickly and conveniently from a management interface rather than from the wiring closet. • They provide increased performance. VLANs free up bandwidth by limiting node-to-node and broadcast traffic throughout the network. • They ensure enhanced network security. VLANs create virtual boundaries that can be crossed only through a router.
XS712T Smart Switch • For the VLAN with VLAN ID 10, specify the following members: port 1 (U), port 2 (U), and port 3 (T). • For the VLAN with VLAN ID 20, specify the following members: port 4 (U), port 5 (T), and port 6 (U). 3. In the Port PVID Configuration screen (see Port VLAN ID Configuration on page 87), specify the PVID for ports g1 and g4 so that packets entering these ports are tagged with the port VLAN ID: • Port g1: PVID 10 • Port g4: PVID 20 4.
XS712T Smart Switch criteria to a particular queue or redirect the traffic to a particular port. A default deny all rule is the last rule of every list. 2. Apply the access list to an interface in the inbound direction. The XS712T Smart Switch allows ACLs to be bound to physical ports and LAGs.The switch software supports MAC ACLs and IP ACLs.
XS712T Smart Switch You can assign an optional sequence number to indicate the order of this access list relative to other access lists if any are already assigned to this interface and direction. 4. The MAC Binding Table displays the interface and MAC ACL binding information (see MAC Binding Table on page 219). The ACL named Sales_ACL looks for Ethernet frames with destination and source MAC addresses and MAC masks defined in the rule.
XS712T Smart Switch 8. Use the IP Binding Table screen to view the interfaces and IP ACL binding information (see IP Binding Table on page 231). The IP ACL in this example matches all packets with the source IP address and subnet mask of the Finance department's network and deny it on the Ethernet interfaces 2, 3, and 4 of the switch. The second rule permits all non-Finance traffic on the ports. The second rule is required because there is an explicit deny all rule as the lowest priority rule.
XS712T Smart Switch Class You can classify incoming packets at layers 2, 3, and 4 by inspecting the following information for a packet: • Source/destination MAC address • EtherType • Class of Service (802.
XS712T Smart Switch Create Policies Use DiffServ policies to associate a collection of classes that you configure with one or more QoS policy statements. The result of this association is referred to as a policy. From a DiffServ perspective, there are two types of policies: • Traffic Conditioning Policy. a policy applied to a DiffServ traffic class • Service Provisioning Policy.
XS712T Smart Switch designating the incoming color value to be used as the conforming color. The color of exceeding traffic can be optionally specified as well. • Counting. Updating octet and packet statistics to keep track of data handling along traffic paths within DiffServ. In this DiffServ feature, counters are not explicitly configured by the user, but are designed into the system based on the DiffServ policy being created. For more information, see Statistics on page 75. • Assigning QoS Queue.
XS712T Smart Switch 8. Configure the Policy attributes as follows: • Assign Queue. 3 • Policy Attribute. Simple Policy • Color Mode. Color Blind • Committed Rate. 1000000 Kbps • Committed Burst Size. 128 KB • Confirm Action. Send • Violate Action. Drop For additional information about this screen, see Policy Configuration on page 166. 9.
XS712T Smart Switch The XS712T Smart Switch supports a guest VLAN, which allows unauthenticated users to have limited access to the network resources. Note: You can use QoS features to provide rate limiting on the guest VLAN to limit the network resources the guest VLAN provides. Another 802.1X feature is the ability to configure a port to Enable/Disable EAPoL packet forwarding support.You can disable or enable the forwarding of EAPoL when 802.1X is disabled on the device. The ports of an 802.
XS712T Smart Switch Supplicant Authenticator Switch Authentication Server (RADIUS) 192.168.10.23 Supplicant Sample 802.1X Configuration This example shows how to configure the switch so that 802.1X-based authentication is required on the ports in a corporate conference room (g1–g8). These ports are available to visitors and need to be authenticated before granting access to the network. The authentication is handled by an external RADIUS server.
XS712T Smart Switch For more information, see RADIUS Configuration on page 173. 7. Click Add. 8. From the Authentication List screen, configure the default List to use RADIUS as the first authentication method (see Authentication List Configuration on page 180). This example enables 802.1X-based port security on the XS712T switch and prompts the hosts connected on ports g1–g8 for an 802.1X-based authentication. The switch passes the authentication information to the configured RADIUS server.
XS712T Smart Switch All bridges, whether they use STP, RSTP or MSTP, send information in configuration messages via Bridge Protocol Data Units (BPDUs) to assign port roles that determine each port’s participation in a fully and simply connected active topology based on one or more spanning trees. The information communicated is known as the spanning tree priority vector. The BPDU structure for each of these different protocols is different.
XS712T Smart Switch Sample MSTP Configuration This example shows how to create an MSTP instance from the XS712T switch. The example network has three different XS712T switches that serve different locations in the network. In this example, ports g1–g5 are connected to host stations, so those links are not subject to network loops. Ports g6–g8 are connected across switches 1, 2, and 3.
XS712T Smart Switch If you do not specify a root bridge and all switches have the same Bridge Priority value, the switch with the lowest MAC address is elected as the root bridge (see CST Configuration on page 101). 5. From the CST Port Configuration screen, select ports g1–g8 and select Enable from the STP Status menu (see CST Port Configuration on page 102). 6. Click Apply. 7. Select ports g1–g5 (edge ports), and select Enable from the Fast Link menu.
XS712T Smart Switch VLAN Routing with a Static Route Refer to the following sections to configure VLAN routing with a static route. VLAN Routing Overview VLANs divide broadcast domains in a LAN environment. Whenever hosts in one VLAN need to communicate with hosts in another VLAN, the traffic must be routed between them. This is known as inter-VLAN routing. On the switch, it is accomplished by creating Layer 3 interfaces (Switch virtual interfaces (SVI)).
XS712T Smart Switch Note: You can only use the VLAN Routing Wizard for creating VLANs, adding ports, and enabling it for routing by assigning the IP address and mask.
D. Hardware Specifications and Default Values D XS712T Smart Switch Specifications The XS712T Smart Switch conforms to the TCP/IP, UDP, HTTP, ICMP, TFTP, DHCP, IEEE 802.1D, IEEE 802.1p, and IEEE 802.1Q standards. Table 46. Smart Switch specifications Feature Value Interfaces Port 1–10 are 100M/1G/10Gbps copper ports; Port 11 and 12 are Combo ports that can act as either 100M/1G/10Gbps copper ports or 1G/10Gbps SFP+ ports.
XS712T Smart Switch XS712T Switch Features and Defaults Table 47. Switch features and defaults Feature Sets Supported Default Auto negotiation/static speed/duplex All ports Auto negotiation Auto MDI/MDIX N/A Enabled 802.3x flow control/back pressure 1 (per system) Disabled Port mirroring 1 Disabled Port trunking (aggregation) 8 Pre-configured 802.1D spanning tree 1 Disabled 802.1w RSTP 1 Disabled 802.1s spanning tree 8 instances Enabled Static 802.
XS712T Smart Switch Table 47. Switch features and defaults (Continued) Feature Sets Supported Default Password control access 1 Idle timeout = 5 mins. Password = “password” Management security 1 profile with 20 rules for HTTP/HTTPS/SNMP access to allow/deny an IP address/subnet All IP addresses allowed Port MAC lock down All ports Disabled Boot code update 1 N/A DHCP/manual IP 1 DHCP enabled/192.168.0.239 Default gateway 1 192.168.0.
XS712T Smart Switch Table 47.
E. Notification of Compliance N ETGE A R Wire d P ro d uct s E Certificate of the Manufacturer/Importer It is hereby certified that the ProSafe™ XS712T Smart Switch has been suppressed in accordance with the conditions set out in the BMPT-AmtsblVfg 243/1991 and Vfg 46/1992. The operation of some equipment (for example, test transmitters) in accordance with the regulations may, however, be subject to certain restrictions. Please refer to the notes in the operating instructions.
XS712T Smart Switch Europe – EU Declaration of Conformity Marking by the above symbol indicates compliance with the Essential Requirements of the R&TTE Directive of the European Union (1999/5/EC). This equipment meets the following conformance standards: EN300 328, EN301 489-17, EN60950 For the current EU Declaration of Conformity, visit http://kb.netgear.com/app/answers/detail/a_id/11621/. EDOC in Languages of the European Community Cesky [Czech] NETGEAR Inc.
XS712T Smart Switch EDOC in Languages of the European Community Nederlands [Dutch] Hierbij verklaart NETGEAR Inc. dat het toestel Radiolan in overeenstemming is met de essentiële eisen en de andere relevante bepalingen van richtlijn 1999/5/EG. Malti [Maltese] Hawnhekk, NETGEAR Inc., jiddikjara li dan Radiolan jikkonforma mal-htigijiet essenzjali u ma provvedimenti ohrajn relevanti li hemm fid-Dirrettiva 1999/5/EC. Magyar [Hungarian] Alulírott, NETGEAR Inc.
XS712T Smart Switch • This device must accept any interference received, including interference that may cause undesired operation. FCC Radio Frequency Interference Warnings & Instructions This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation.