User Manual

ManualsBrandsZyXEL Communications ManualsComputer AccessoriesGS-4024

www.zyxel.com

GS-4012F/4024

Intelligent Layer 3+ Switch

User’s Guide

Version 3.8

6/2007

Edition 1

DEFAULT LOGIN

IP Address http://192.168.1.1

User Name admin

Password 1234

Summary of content (462 pages)

PAGE 1
GS-4012F/4024 Intelligent Layer 3+ Switch User’s Guide Version 3.8 6/2007 Edition 1 DEFAULT LOGIN IP Address http://192.168.1.1 User Name admin Password 1234 www.zyxel.
PAGE 2
PAGE 3
About This User's Guide About This User's Guide Intended Audience This manual is intended for people who want to configure the GS-4024 or GS-4012F using the web configurator or via commands. You should have at least a basic knowledge of TCP/IP networking concepts and topology. Related Documentation • Quick Start Guide The Quick Start Guide is designed to help you get up and running right away. It contains information on setting up your network and configuring for Internet access.
PAGE 4
Document Conventions Document Conventions Warnings and Notes These are how warnings and notes are shown in this User’s Guide. 1 " Warnings tell you about things that could harm you or your device. Notes tell you other important information (for example, other things you may need to configure or helpful tips) or recommendations. Syntax Conventions • The GS-4024 and GS-4012F models may be referred to as the “Switch”, the “device”, the “system” or the “product” in this User’s Guide.
PAGE 5
Document Conventions Icons Used in Figures Figures in this User’s Guide may use the following generic icons. The Switch icon is not an exact representation of your device.
PAGE 6
Safety Warnings Safety Warnings 1 For your safety, be sure to read and follow all warning notices and instructions. • Do NOT use this product near water, for example, in a wet basement or near a swimming pool. • Do NOT expose your device to dampness, dust or corrosive liquids. • Do NOT store things on the device. • Do NOT install, use, or service this device during a thunderstorm. There is a remote risk of electric shock from lightning. • Connect ONLY suitable accessories to the device.
PAGE 7
Safety Warnings GS-4012F/4024 User’s Guide 7
PAGE 8
Safety Warnings 8 GS-4012F/4024 User’s Guide
PAGE 9
Contents Overview Contents Overview Introduction and Hardware ................................................................................................... 35 Getting to Know Your Switch ..................................................................................................... 37 Hardware Installation and Connection ....................................................................................... 41 Hardware Overview ...................................................................
PAGE 10
Contents Overview IP Multicast .............................................................................................................................. 249 Differentiated Services ............................................................................................................. 251 DHCP ...................................................................................................................................... 259 VRRP ..............................................................
PAGE 11
Table of Contents Table of Contents About This User's Guide .......................................................................................................... 3 Document Conventions............................................................................................................ 4 Safety Warnings........................................................................................................................ 6 Contents Overview .......................................................
PAGE 12
Table of Contents 3.3 Power Connections Overview ............................................................................................. 49 3.3.1 AC Power Connection ................................................................................................ 49 3.3.2 DC Power Connection ................................................................................................ 50 3.3.3 External Backup Power Supply Connector ...............................................................
PAGE 13
Table of Contents 7.3 General Setup ................................................................................................................. 79 7.4 Introduction to VLANs ........................................................................................................ 81 7.5 Switch Setup Screen 7.6 IP Setup ........................................................................................................ 81 ...........................................................................
PAGE 14
Table of Contents 11.1.2 How STP Works .....................................................................................................110 11.1.3 STP Port States ......................................................................................................111 11.1.4 Multiple RSTP .......................................................................................................111 11.1.5 Multiple STP ........................................................................................
PAGE 15
Table of Contents 16.2.1 Activate IEEE 802.1x Security ........................................................................... 143 16.2.2 Activate MAC Authentication ................................................................................. 144 Chapter 17 Port Security.......................................................................................................................... 147 17.1 About Port Security ............................................................................
PAGE 16
Table of Contents 22.1.1 IP Multicast Addresses ........................................................................................... 171 22.1.2 IGMP Filtering ........................................................................................................ 171 22.1.3 IGMP Snooping ..................................................................................................... 171 22.1.4 IGMP Snooping and VLANs ..............................................................................
PAGE 17
Table of Contents 24.6.2 ARP Inspection Log Status .................................................................................... 213 24.7 ARP Inspection Configure ............................................................................................... 215 24.7.1 ARP Inspection Port Configure .............................................................................. 216 24.7.2 ARP Inspection VLAN Configure ...........................................................................
PAGE 18
Table of Contents 29.3 Configuring IGMP ............................................................................................................ 243 Chapter 30 DVMRP ................................................................................................................................... 245 30.1 DVMRP Overview ............................................................................................................ 245 30.2 How DVMRP Works ..................................................
PAGE 19
Table of Contents Chapter 34 VRRP ...................................................................................................................................... 267 34.1 VRRP Overview .............................................................................................................. 267 34.2 VRRP Status .................................................................................................................. 268 34.3 VRRP Configuration ............................................
PAGE 20
Table of Contents 36.4 SSH Overview ................................................................................................................. 296 36.5 How SSH works ............................................................................................................... 296 36.6 SSH Implementation on the Switch ................................................................................. 297 36.6.1 Requirements for Using SSH ................................................................
PAGE 21
Table of Contents 42.2 Viewing the ARP Table ................................................................................................... 319 Chapter 43 Routing Table ........................................................................................................................ 321 43.1 Overview .......................................................................................................................... 321 43.2 Viewing the Routing Table .......................................
PAGE 22
Table of Contents 46.2.3 show logging ......................................................................................................... 378 46.2.4 show interface ....................................................................................................... 378 46.2.5 show mac address-table ....................................................................................... 379 46.3 ping .....................................................................................................
PAGE 23
Table of Contents 48.2.12 name .................................................................................................................... 400 48.2.13 speed-duplex ........................................................................................................ 400 48.2.14 test ....................................................................................................................... 401 48.3 Interface no Command Examples .........................................................
PAGE 24
Table of Contents Appendix A Product Specifications....................................................................................... 425 Appendix B IP Addresses and Subnetting ........................................................................... 431 Appendix C Common Services ............................................................................................ 441 Appendix D Legal Information ..............................................................................................
PAGE 25
List of Figures List of Figures Figure 1 Backbone Application .............................................................................................................. 38 Figure 2 Bridging Application ................................................................................................................ 38 Figure 3 High Performance Switched Workgroup Application ............................................................... 39 Figure 4 Shared Server Using VLAN Example .......................
PAGE 26
List of Figures Figure 39 Advanced Application > VLAN > VLAN Port Setting ............................................................. 97 Figure 40 Subnet Based VLAN Application Example ............................................................................ 98 Figure 41 Advanced Application > VLAN > VLAN Port Setting > Subnet Based VLAN ........................ 99 Figure 42 Port Based VLAN Setup (All Connected) ............................................................................
PAGE 27
List of Figures Figure 82 Advanced Application > Multicast ........................................................................................ 172 Figure 83 Advanced Application > Multicast > Multicast Setting ......................................................... 173 Figure 84 Advanced Application > Multicast > Multicast Setting > IGMP Snooping VLAN ................. 175 Figure 85 Advanced Application > Multicast > Multicast Setting > IGMP Filtering Profile ...................
PAGE 28
List of Figures Figure 125 OSPF Interface .................................................................................................................. 237 Figure 126 OSPF Virtual Link .............................................................................................................. 238 Figure 127 IP Multicast ........................................................................................................................ 241 Figure 128 IGMP Version 1 Example .......................
PAGE 29
List of Figures Figure 168 Maintenance ..................................................................................................................... 279 Figure 169 Load Factory Default: Start ................................................................................................ 280 Figure 170 Reboot System: Confirmation ........................................................................................... 281 Figure 171 Firmware Upgrade ...............................................
PAGE 30
List of Figures Figure 211 Java (Sun) .......................................................................................................................... 421 Figure 212 Network Number and Host ID ............................................................................................ 432 Figure 213 Subnetting Example: Before Subnetting ............................................................................ 434 Figure 214 Subnetting Example: After Subnetting .................................
PAGE 31
List of Tables List of Tables Table 1 Front Panel ............................................................................................................................... 45 Table 2 LEDs ......................................................................................................................................... 51 Table 3 Navigation Panel Sub-links Overview .......................................................................................
PAGE 32
List of Tables Table 39 Advanced Application > Port Authentication > 802.1x .......................................................... 144 Table 40 Advanced Application > Port Authentication > MAC Authentication ..................................... 145 Table 41 Advanced Application > Port Security ................................................................................... 148 Table 42 Advanced Application > Classifier ................................................................................
PAGE 33
List of Tables Table 82 RIP ........................................................................................................................................ 228 Table 83 OSPF vs. RIP ........................................................................................................................ 229 Table 84 OSPF: Router Types ............................................................................................................. 229 Table 85 OSPF Status ................................
PAGE 34
List of Tables Table 125 Syslog ................................................................................................................................. 306 Table 126 Syslog: Server Setup .......................................................................................................... 307 Table 127 ZyXEL Clustering Management Specifications ................................................................... 309 Table 128 Cluster Management: Status .........................................
PAGE 35
P ART I Introduction and Hardware Getting to Know Your Switch (37) Hardware Installation and Connection (41) Hardware Overview (45) 35
PAGE 36
PAGE 37
CHAPTER 1 Getting to Know Your Switch This chapter introduces the main features and applications of the Switch. 1.1 Introduction Your Switch is a stand-alone layer-3 Gigabit Ethernet switch. By integrating router functions, the Switch performs wire-speed layer-3 routing in addition to layer-2 switching. The GS-4024 is a stand-alone layer 3 Ethernet switch with 20 Gigabit Ethernet ports and 4 GbE dual personality interfaces for uplink.
PAGE 38
Chapter 1 Getting to Know Your Switch Figure 1 Backbone Application 1.1.2 Bridging Example In this example application the Switch connects different company departments (RD and Sales) to the corporate backbone. It can alleviate bandwidth contention and eliminate server and network bottlenecks. All users that need high bandwidth can connect to high-speed department servers via the Switch. You can provide a super-fast uplink connection by using a Gigabit Ethernet/mini-GBIC port on the Switch.
PAGE 39
Chapter 1 Getting to Know Your Switch Switching to higher-speed LANs such as ATM (Asynchronous Transmission Mode) is not feasible for most people due to the expense of replacing all existing Ethernet cables and adapter cards, restructuring your network and complex maintenance. The Switch can provide the same bandwidth as ATM at much lower cost while still being able to use existing adapters and switches.
PAGE 40
Chapter 1 Getting to Know Your Switch Figure 4 Shared Server Using VLAN Example 40 GS-4012F/4024 User’s Guide
PAGE 41
CHAPTER 2 Hardware Installation and Connection This chapter shows you how to install the hardware and make port connections. " Example graphics are shown. 2.1 Freestanding Installation 1 Make sure the Switch is clean and dry. 2 Set the Switch on a smooth, level surface strong enough to support the weight of the Switch and the connected cables. Make sure there is a power outlet nearby.
PAGE 42
Chapter 2 Hardware Installation and Connection " " Do NOT block the ventilation holes. Leave space between devices when stacking. For proper ventilation, allow at least 4 inches (10 cm) of clearance at the front and 3.4 inches (8 cm) at the back of the Switch. This is especially important for enclosed rack installations. 2.2 Mounting the Switch on a Rack This section lists the rack mounting requirements and precautions and describes the installation steps.
PAGE 43
Chapter 2 Hardware Installation and Connection Figure 6 Attaching the Mounting Brackets 2 Using a #2 Philips screwdriver, install the M3 flat head screws through the mounting bracket holes into the Switch. 3 Repeat steps 1 and 2 to install the second mounting bracket on the other side of the Switch. 4 You may now mount the Switch on a rack. Proceed to the next section. 2.2.
PAGE 44
Chapter 2 Hardware Installation and Connection 44 GS-4012F/4024 User’s Guide
PAGE 45
CHAPTER 3 Hardware Overview This chapter describes the front panel and rear panel of the Switch and shows you how to make the hardware connections. 3.1 Front Panel Connection The figure below shows the front panel of the Switch. Figure 8 Front Panel: GS-4024 Figure 9 Front Panel: GS-4012F The following table describes the port labels on the front panel. Table 1 Front Panel PORT DESCRIPTION MGMT Connect to a computer using an RJ-45 Ethernet cable for local configuration of the Switch.
PAGE 46
Chapter 3 Hardware Overview Table 1 Front Panel (continued) PORT DESCRIPTION Four Dual Personality Interfaces Each interface has one 1000 Base-T copper RJ-45 port and one Small Form-Factor Pluggable (SFP) fiber port, with one port active at a time. • 4 100/1000 Mbps RJ-45 Gigabit Ports: Connect these Gigabit Ethernet ports to high-bandwidth backbone network Ethernet switches.
PAGE 47
Chapter 3 Hardware Overview • Flow control: on 3.1.3 SFP Slots The Switch comes with SFP (Small Form-factor Pluggable) slots for mini-GBIC (Gigabit Interface Converter) transceivers. A transceiver is a single unit that houses a transmitter and a receiver. The Switch does not come with transceivers. You must use transceivers that comply with the SFP transceiver MultiSource Agreement (MSA). See the SFF committee’s INF-8074i specification Rev 1.0 for details.
PAGE 48
Chapter 3 Hardware Overview Figure 11 Installed Transceiver 3.1.3.2 Transceiver Removal Use the following steps to remove a mini-GBIC transceiver (SFP module). 1 Open the transceiver’s latch (latch styles vary). Figure 12 Opening the Transceiver’s Latch Example 2 Pull the transceiver out of the slot. Figure 13 Transceiver Removal Example 3.2 Rear Panel The following figures show the rear panels of the AC and DC power input model switches.
PAGE 49
Chapter 3 Hardware Overview Figure 15 Rear Panel: GS-4024 Figure 16 Rear Panel: GS-4012F (DC Model) Figure 17 Rear Panel: GS-4024 (DC Model) 3.3 Power Connections Overview Use the following procedures to connect the Switch to a power source after you have installed it. Make sure that no objects obstruct the airflow of the fans. " Check the power supply requirements in Appendix A on page 425, and make sure you are using an appropriate power source.
PAGE 50
Chapter 3 Hardware Overview 3.3.2 DC Power Connection " This is only for the DC model of the Switch. The DC-powered unit uses a single terminal block with four terminals which allows you to connect two power supplies. If one power supply fails the system can operate on the remaining power supply. Use two wires to connect a single terminal pair, one wire for the positive terminal and one wire for the negative terminal. " The current rating of the power wires must be greater than 20 Amps.
PAGE 51
Chapter 3 Hardware Overview 3.3.3 External Backup Power Supply Connector The backup power supply constantly monitors the status of the internal power supply. The backup power supply automatically provides power to the Switch in the event of a power failure. Once the Switch receives power from the backup power supply, it will not automatically switch back to using the internal power supply even when the power is resumed. 3.3.4 Powering on the Switch 1 Turn on the power supply first.
PAGE 52
Chapter 3 Hardware Overview Table 2 LEDs (continued) LED COLOR STATUS DESCRIPTION On The port has a successful connection. Off No Ethernet device is connected to this port. Blinking The port is sending or receiving data. Off The port is not sending or receiving data or there is no connection. Mini-GBIC (SFP) Slots LNK ACT Green Green GS-4012F Model Mini-GBIC (SFP) Slots (Standalone and Part of Dual Personality Interface) LNK ACT Green Green On The port has a successful connection.
PAGE 53
P ART II Basic Configuration The Web Configurator (55) Initial Setup Example (65) System Status and Port Statistics (71) Basic Setting (77) 53
PAGE 54
PAGE 55
CHAPTER 4 The Web Configurator This section introduces the configuration and functions of the web configurator. 4.1 Introduction The web configurator is an HTML-based management interface that allows easy Switch setup and management via Internet browser. Use Internet Explorer 6.0 and later or Netscape Navigator 7.0 and later versions. The recommended screen resolution is 1024 by 768 pixels. In order to use the web configurator you need to allow: • Web browser pop-up windows from your device.
PAGE 56
Chapter 4 The Web Configurator Figure 19 Web Configurator: Login 4 Click OK to view the first web configurator screen. 4.3 The Status Screen The Status screen is the first screen that displays when you access the web configurator. The following figure shows the navigating components of a web configurator screen. Figure 20 Web Configurator Home Screen (Status) B C DE A A - Click the menu items to open submenu links, and then click on a submenu link to open the screen in the main window.
PAGE 57
Chapter 4 The Web Configurator C - Click this link to go to the status page of the Switch. D - Click this link to logout of the web configurator. E - Click this link to display web help pages. The help pages provide descriptions for all of the configuration screens. In the navigation panel, click a main link to reveal a list of submenu links.
PAGE 58
Chapter 4 The Web Configurator The following table lists the various web configurator screens within the sub-links.
PAGE 59
Chapter 4 The Web Configurator The following table describes the links in the navigation panel. Table 5 Navigation Panel Links LINK DESCRIPTION Basic Settings System Info This link takes you to a screen that displays general system and hardware monitoring information. General Setup This link takes you to a screen where you can configure general identification information about the Switch.
PAGE 60
Chapter 4 The Web Configurator Table 5 Navigation Panel Links (continued) LINK DESCRIPTION Auth and Acct This link takes you to a screen where you can configure authentication and accounting services via external servers. The external servers can be either RADIUS (Remote Authentication Dial-In User Service) or TACACS+ (Terminal Access Controller Access-Control System Plus).
PAGE 61
Chapter 4 The Web Configurator 4.3.1 Change Your Password After you log in for the first time, it is recommended you change the default administrator password. Click Management, Access Control and then Logins to display the next screen. Figure 21 Change Administrator Login Password 4.4 Saving Your Configuration When you are done modifying the settings in a screen, click Apply to save your changes back to the run-time memory. Settings in the run-time memory are lost when the Switch’s power is turned off.
PAGE 62
Chapter 4 The Web Configurator 6 Forget the password and/or IP address. 7 Prevent all services from accessing the Switch. 8 Change a service port number but forget it. " Be careful not to lock yourself and others out of the Switch. If you do lock yourself out, try using out-of-band management (via the management port) to configure the Switch. 4.
PAGE 63
Chapter 4 The Web Configurator Figure 22 Resetting the Switch: Via the Console Port Bootbase Version: V3.1 | 03/08/2007 18:36:17 RAM:Size = 64 Mbytes DRAM POST: Testing: 65536K OK DRAM Test SUCCESS ! FLASH: Intel 64M ZyNOS Version: V3.80(TS.0)b4 | 03/31/2007 20:43:39 Press any key to enter debug mode within 3 seconds..................... Enter Debug Mode GS-4024> atlc Starting XMODEM upload (CRC mode).... CCCCCCCCCCCCCCCC Total 393216 bytes received. Erasing.. ..............................................
PAGE 64
Chapter 4 The Web Configurator 64 GS-4012F/4024 User’s Guide
PAGE 65
CHAPTER 5 Initial Setup Example This chapter shows how to set up the Switch for an example network. 5.1 Overview The following lists the configuration steps for the example network: • • • • • Configure an IP interface Configure DHCP server settings Create a VLAN Set port VLAN ID Enable RIP 5.1.1 Configuring an IP Interface On a layer-3 Switch, an IP interface (also known as an IP routing domain) is not bound to a physical port. The default IP address of the Switch is 192.168.1.
PAGE 66
Chapter 5 Initial Setup Example 2 Open your web browser and enter 192.168.0.1 (the default MGMT port IP address) in the address bar to access the web configurator. See Section 4.2 on page 55 for more information. 3 Click Basic Setting and IP Setup in the navigation panel. 4 Configure the related fields in the IP Setup screen. For the Sales network, enter 192.168.2.1 as the IP address and 255.255.255.0 as the subnet mask.
PAGE 67
Chapter 5 Initial Setup Example 5.1.3 Creating a VLAN VLANs confine broadcast frames to the VLAN group in which the port(s) belongs. You can do this with port-based VLAN or tagged static VLAN with fixed port members. In this example, you want to configure port 1 as a member of VLAN 2. Figure 25 Initial Setup Network Example: VLAN 1 Click Advanced Application and VLAN in the navigation panel and click the Static VLAN link.
PAGE 68
Chapter 5 Initial Setup Example " The VLAN Group ID field in this screen and the VID field in the IP Setup screen refer to the same VLAN ID. 3 Since the VLAN2 network is connected to port 1 on the Switch, select Fixed to configure port 1 to be a permanent member of the VLAN only. 4 To ensure that VLAN-unaware devices (such as computers and hubs) can receive frames properly, clear the TX Tagging check box to set the Switch to remove VLAN tags before sending.
PAGE 69
Chapter 5 Initial Setup Example 5.1.5 Enabling RIP To exchange routing information with other routing devices across different routing domains, enable RIP (Routing Information Protocol) in the RIP screen. 1 Click IP Application > RIP in the navigation panel. 2 Select Both in the Direction field to set the Switch to broadcast and receive routing information. 3 In the Version field, select RIP-1 for the RIP packet format that is universally supported.
PAGE 70
Chapter 5 Initial Setup Example 70 GS-4012F/4024 User’s Guide
PAGE 71
CHAPTER 6 System Status and Port Statistics This chapter describes the system status (web configurator home page) and port details screens. 6.1 Overview The home screen of the web configurator displays a port statistical summary with links to each port showing statistical details. 6.2 Port Status Summary To view the port statistics, click Status in all web configurator screens to display the Status screen as shown next. Figure 27 Status The following table describes the labels in this screen.
PAGE 72
Chapter 6 System Status and Port Statistics Table 6 Status (continued) LABEL DESCRIPTION Link This field displays the speed (either 10M for 10Mbps, 100M for 100Mbps or 1000M for 1000Mbps) and the duplex (F for full duplex or H for half). It also shows the cable type (Copper or Fiber) for the combo ports. State If STP (Spanning Tree Protocol) is enabled, this field displays the STP state of the port (see Section 11.1 on page 109 for more information).
PAGE 73
Chapter 6 System Status and Port Statistics Figure 28 Status > Port Details The following table describes the labels in this screen. Table 7 Status: Port Details LABEL DESCRIPTION Port Info Port NO. This field displays the port number you are viewing. Name This field displays the name of the port. Link This field displays the speed (either 10M for 10Mbps, 100M for 100Mbps or 1000M for 1000Mbps) and the duplex (F for full duplex or H for half duplex). It also shows the cable type (Copper or Fiber).
PAGE 74
Chapter 6 System Status and Port Statistics Table 7 Status: Port Details (continued) LABEL Up Time DESCRIPTION This field shows the total amount of time the connection has been up. Tx Packet The following fields display detailed information about packets transmitted. TX Packet This field shows the number of good packets (unicast, multicast and broadcast) transmitted. Multicast This field shows the number of good multicast packets transmitted.
PAGE 75
Chapter 6 System Status and Port Statistics Table 7 Status: Port Details (continued) LABEL DESCRIPTION 512-1023 This field shows the number of packets (including bad packets) received that were between 512 and 1023 octets in length. 10241518 This field shows the number of packets (including bad packets) received that were between 1024 and 1518 octets in length. Giant This field shows the number of packets dropped because they were bigger than the maximum frame size.
PAGE 76
Chapter 6 System Status and Port Statistics 76 GS-4012F/4024 User’s Guide
PAGE 77
CHAPTER 7 Basic Setting This chapter describes how to configure the System Info, General Setup, Switch Setup, IP Setup and Port Setup screens. 7.1 Overview The System Info screen displays general Switch information (such as firmware version number) and hardware polling information (such as fan speeds). The General Setup screen allows you to configure general Switch identification information.
PAGE 78
Chapter 7 Basic Setting Figure 29 System Info The following table describes the labels in this screen. Table 8 System Info LABEL DESCRIPTION System Name This field displays the descriptive name of the Switch for identification purposes. ZyNOS F/W Version This field displays the version number of the Switch 's current firmware including the date created. Ethernet Address This field refers to the Ethernet MAC (Media Access Control) address of the Switch.
PAGE 79
Chapter 7 Basic Setting Table 8 System Info (continued) LABEL DESCRIPTION Current This field displays this fan's current speed in Revolutions Per Minute (RPM). MAX This field displays this fan's maximum speed measured in Revolutions Per Minute (RPM). MIN This field displays this fan's minimum speed measured in Revolutions Per Minute (RPM). "<41" is displayed for speeds too small to measure (under 2000 RPM). Threshold This field displays the minimum speed at which a normal fan should work.
PAGE 80
Chapter 7 Basic Setting The following table describes the labels in this screen. Table 9 Basic Setting > General Setup 80 LABEL DESCRIPTION System Name Choose a descriptive name for identification purposes. This name consists of up to 64 printable characters; spaces are allowed. Location Enter the geographic location of your Switch. You can use up to 32 printable ASCII characters; spaces are allowed. Contact Person's Name Enter the name of the person in charge of this Switch.
PAGE 81
Chapter 7 Basic Setting Table 9 Basic Setting > General Setup (continued) LABEL DESCRIPTION End Date Configure the day and time when Daylight Saving Time ends if you selected Daylight Saving Time. The time field uses the 24 hour format. Here are a couple of examples: Daylight Saving Time ends in the United States on the first Sunday of November. Each time zone in the United States stops using Daylight Saving Time at 2 A.M. local time.
PAGE 82
Chapter 7 Basic Setting Figure 31 Basic Setting > Switch Setup The following table describes the labels in this screen. Table 10 Basic Setting > Switch Setup LABEL DESCRIPTION VLAN Type Choose 802.1Q or Port Based. The VLAN Setup screen changes depending on whether you choose 802.1Q VLAN type or Port Based VLAN type in this screen. See Chapter 8 on page 91 for more information.
PAGE 83
Chapter 7 Basic Setting Table 10 Basic Setting > Switch Setup (continued) LABEL DESCRIPTION Priority Queue Assignment IEEE 802.1p defines up to eight separate traffic types by inserting a tag into a MAC-layer frame that contains bits to define class of service. Frames without an explicit priority tag are given the default priority of the ingress port. Use the next two fields to configure the priority level-to-physical queue mapping.
PAGE 84
Chapter 7 Basic Setting Figure 32 Basic Setting > IP Setup The following table describes the labels in this screen. Table 11 Basic Setting > IP Setup LABEL DESCRIPTION Default Gateway Enter the IP address of the default outgoing gateway in dotted decimal notation, for example 192.168.1.254. Domain Name Server DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa.
PAGE 85
Chapter 7 Basic Setting Table 11 Basic Setting > IP Setup (continued) LABEL DESCRIPTION Apply Click Apply to save your changes to the Switch’s run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Save link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Cancel Click Cancel to reset the fields to your previous configuration.
PAGE 86
Chapter 7 Basic Setting Figure 33 Basic Setting > Port Setup The following table describes the labels in this screen. Table 12 Basic Setting > Port Setup LABEL DESCRIPTION Port This is the port index number. * Settings in this row apply to all ports. Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis. Note: Changes in this row are copied to all the ports as soon as you make them.
PAGE 87
Chapter 7 Basic Setting Table 12 Basic Setting > Port Setup (continued) LABEL DESCRIPTION Flow Control A concentration of traffic on a port decreases port bandwidth and overflows buffer memory causing packet discards and frame losses. Flow Control is used to regulate transmission of signals to match the bandwidth of the receiving port. The Switch uses IEEE802.3x flow control in full duplex mode and backpressure flow control in half duplex mode. IEEE802.
PAGE 88
Chapter 7 Basic Setting 88 GS-4012F/4024 User’s Guide
PAGE 89
P ART III Advanced VLAN (91) Static MAC Forward Setup (105) Filtering (107) Spanning Tree Protocol (109) Bandwidth Control (127) Broadcast Storm Control (129) Mirroring (131) Link Aggregation (133) Port Authentication (141) Port Security (147) Classifier (151) Policy Rule (157) Queuing Method (163) VLAN Stacking (165) Multicast (171) Authentication & Accounting (185) IP Source Guard (199) Loop Guard (219) 89
PAGE 90
PAGE 91
CHAPTER 8 VLAN The type of screen you see here depends on the VLAN Type you selected in the Switch Setup screen. This chapter shows you how to configure 802.1Q tagged and port-based VLANs. 8.1 Introduction to IEEE 802.1Q Tagged VLANs A tagged VLAN uses an explicit tag (VLAN ID) in the MAC header to identify the VLAN membership of a frame across bridges - they are not confined to the switch on which they were created. The VLANs can be created statically by hand or dynamically through GVRP.
PAGE 92
Chapter 8 VLAN 8.2 Automatic VLAN Registration GARP and GVRP are the protocols used to automatically register VLAN membership across switches. 8.2.1 GARP GARP (Generic Attribute Registration Protocol) allows network switches to register and deregister attribute values with other GARP participants within a bridged LAN. GARP is a protocol that provides a generic mechanism for protocols that serve a more specific application, for example, GVRP. 8.2.1.1 GARP Timers Switches join VLANs by making a declaration.
PAGE 93
Chapter 8 VLAN 8.3 Port VLAN Trunking Enable VLAN Trunking on a port to allow frames belonging to unknown VLAN groups to pass through that port. This is useful if you want to set up VLAN groups on end devices without having to configure the same VLAN groups on intermediary devices. Refer to the following figure. Suppose you want to create VLAN groups 1 and 2 (V1 and V2) on devices A and B.
PAGE 94
Chapter 8 VLAN 8.5.1 Static VLAN Status See Section 8.1 on page 91 for more information on Static VLAN. Click Advanced Application > VLAN from the navigation panel to display the VLAN Status screen as shown next. Figure 36 Advanced Application > VLAN: VLAN Status The following table describes the labels in this screen. Table 14 Advanced Application > VLAN: VLAN Status LABEL DESCRIPTION The Number of VLAN This is the number of VLANs configured on the Switch. Index This is the VLAN index number.
PAGE 95
Chapter 8 VLAN The following table describes the labels in this screen. Table 15 Advanced Application > VLAN > VLAN Detail LABEL DESCRIPTION VLAN Status Click this to go to the VLAN Status screen. VID This is the VLAN identification number that was configured in the Static VLAN screen. Port Number This column displays the ports that are participating in a VLAN. A tagged port is marked as T, an untagged port is marked as U and ports not participating in a VLAN are marked as “–“.
PAGE 96
Chapter 8 VLAN The following table describes the related labels in this screen. Table 16 Advanced Application > VLAN > Static VLAN LABEL DESCRIPTION ACTIVE Select this check box to activate the VLAN settings. Name Enter a descriptive name for the VLAN group for identification purposes. This name consists of up to 64 printable characters. VLAN Group ID Enter the VLAN ID for this static entry; the valid range is between 1 and 4094. Port The port number identifies the port you are configuring.
PAGE 97
Chapter 8 VLAN Figure 39 Advanced Application > VLAN > VLAN Port Setting The following table describes the labels in this screen. Table 17 Advanced Application > VLAN > VLAN Port Setting LABEL DESCRIPTION GVRP GVRP (GARP VLAN Registration Protocol) is a registration protocol that defines a way for switches to register necessary VLAN members on ports across the network. Select this check box to permit VLAN groups beyond the local Switch.
PAGE 98
Chapter 8 VLAN Table 17 Advanced Application > VLAN > VLAN Port Setting (continued) LABEL DESCRIPTION VLAN Trunking Enable VLAN Trunking on ports connected to other switches or routers (but not ports directly connected to end users) to allow frames belonging to unknown VLAN groups to pass through the Switch. Apply Click Apply to save your changes to the Switch’s run-time memory.
PAGE 99
Chapter 8 VLAN 8.7 Configuring Subnet Based VLAN Click Subnet Based VLAN in the VLAN Port Setting screen to display the configuration screen as shown. " Subnet based VLAN applies to un-tagged packets and is applicable only when you use IEEE 802.1Q tagged VLAN. Figure 41 Advanced Application > VLAN > VLAN Port Setting > Subnet Based VLAN The following table describes the labels in this screen.
PAGE 100
Chapter 8 VLAN Table 18 Advanced Application > VLAN > VLAN Port Setting > Subnet Based VLAN Setup LABEL DESCRIPTION Mask-Bits Enter the bit number of the subnet mask. To find the bit number, convert the subnet mask to binary format and add all the 1’s together. Take “255.255.255.0” for example. 255 converts to eight 1s in binary. There are three 255s, so add three eights together and you get the bit number (24).
PAGE 101
Chapter 8 VLAN " In screens (such as IP Setup and Filtering) that require a VID, you must enter 1 as the VID. The port-based VLAN setup screen is shown next. The CPU management port forms a VLAN with all Ethernet ports. 8.8.1 Configure a Port-based VLAN Select Port Based as the VLAN Type in the Switch Setup screen and then click VLAN from the navigation panel to display the next screen.
PAGE 102
Chapter 8 VLAN Figure 43 Port Based VLAN Setup (Port Isolation) The following table describes the labels in this screen. Table 19 Port Based VLAN Setup label Description Setting Wizard Choose All connected or Port isolation. All connected means all ports can communicate with each other, that is, there are no virtual LANs. All incoming and outgoing ports are selected. This option is the most flexible but also the least secure.
PAGE 103
Chapter 8 VLAN Table 19 Port Based VLAN Setup (continued) label Description Outgoing These are the egress ports; an egress port is an outgoing port, that is, a port through which a data packet leaves. If you wish to allow two subscriber ports to talk to each other, you must define the egress port for both ports. CPU refers to the Switch management port. By default it forms a VLAN with all Ethernet ports. If it does not form a VLAN with a particular port then the Switch cannot be managed from that port.
PAGE 104
Chapter 8 VLAN 104 GS-4012F/4024 User’s Guide
PAGE 105
CHAPTER 9 Static MAC Forward Setup Use these screens to configure static MAC address forwarding. 9.1 Overview This chapter discusses how to configure forwarding rules based on MAC addresses of devices on your network. 9.2 Configuring Static MAC Forwarding A static MAC address is an address that has been manually entered in the MAC address table. Static MAC addresses do not age out. When you set up static MAC address rules, you are setting static MAC addresses for a port.
PAGE 106
Chapter 9 Static MAC Forward Setup The following table describes the labels in this screen. Table 20 Advanced Application > Static MAC Forwarding LABEL DESCRIPTION Active Select this check box to activate your rule. You may temporarily deactivate a rule without deleting it by clearing this check box. Name Enter a descriptive name for identification purposes for this static MAC address forwarding rule.
PAGE 107
CHAPTER 10 Filtering This chapter discusses MAC address port filtering. 10.1 Configure a Filtering Rule Filtering means sifting traffic going through the Switch based on the source and/or destination MAC addresses and VLAN group (ID). Click Advanced Application > Filtering in the navigation panel to display the screen as shown next. Figure 45 Advanced Application > Filtering The following table describes the related labels in this screen.
PAGE 108
Chapter 10 Filtering Table 21 Advanced Application > FIltering (continued) 108 LABEL DESCRIPTION Action Select Discard source to drop frame from the source MAC address (specified in the MAC field). The Switch can still send frames to the MAC address. Select Discard destination to drop frames to the destination MAC address (specified in the MAC address). The Switch can still receive frames originating from the MAC address.
PAGE 109
CHAPTER 11 Spanning Tree Protocol The Switch supports Spanning Tree Protocol (STP), Rapid Spanning Tree Protocol (RSTP) and Multiple Spanning Tree Protocol (MSTP) as defined in the following standards. • IEEE 802.1D Spanning Tree Protocol • IEEE 802.1w Rapid Spanning Tree Protocol • IEEE 802.1s Multiple Spanning Tree Protocol The Switch also allows you to set up multiple STP configurations (or trees). Ports can then be assigned to the trees. 11.
PAGE 110
Chapter 11 Spanning Tree Protocol Path cost is the cost of transmitting a frame onto a LAN through that port. The recommended cost is assigned according to the speed of the link to which a port is attached. The slower the media, the higher the cost.
PAGE 111
Chapter 11 Spanning Tree Protocol 11.1.3 STP Port States STP assigns five port states to eliminate packet looping. A bridge port is not allowed to go directly from blocking state to forwarding state so as to eliminate transient loops. Table 23 STP Port States PORT STATE DESCRIPTION Disabled STP is disabled (default). Blocking Only configuration and management BPDUs are received and processed. Listening All BPDUs are received and processed. Note: The listening state does not exist in RSTP.
PAGE 112
Chapter 11 Spanning Tree Protocol 11.1.5 Multiple STP Multiple Spanning Tree Protocol (IEEE 802.1s) is backward compatible with STP/RSTP and addresses the limitations of existing spanning tree protocols (STP and RSTP) in networks to include the following features: • One Common and Internal Spanning Tree (CIST) that represents the entire network’s connectivity. • Grouping of multiple bridges (or switching devices) into regions that appear as one single bridge on the network.
PAGE 113
Chapter 11 Spanning Tree Protocol Figure 48 MSTP Network Example A VLAN 1 VLAN 2 B 11.1.5.2 MST Region An MST region is a logical grouping of multiple network devices that appears as a single device to the rest of the network. Each MSTP-enabled device can only belong to one MST region. When BPDUs enter an MST region, external path cost (of paths outside this region) is increased by one. Internal path cost (of paths within this region) is increased by one when BPDUs traverse the region.
PAGE 114
Chapter 11 Spanning Tree Protocol Figure 49 MSTIs in Different Regions 11.1.5.4 Common and Internal Spanning Tree (CIST) A CIST represents the connectivity of the entire network and it is equivalent to a spanning tree in an STP/RSTP. The CIST is the default MST instance (MSTID 0). Any VLANs that are not members of an MST instance are members of the CIST. In an MSTP-enabled network, there is only one CIST that runs between MST regions and single spanning tree devices.
PAGE 115
Chapter 11 Spanning Tree Protocol Figure 51 Advanced Application > Spanning Tree Protocol This screen differs depending on which STP mode (RSTP, MRSTP or MSTP) you configure on the Switch. This screen is described in detail in the section that follows the configuration section for each STP mode. Click Configuration to activate one of the STP standards on the Switch. 11.3 Spanning Tree Configuration Use the Spanning Tree Configuration screen to activate one of the STP modes on the Switch.
PAGE 116
Chapter 11 Spanning Tree Protocol 11.4 Configure Rapid Spanning Tree Protocol Use this screen to configure RSTP settings, see Section 11.1 on page 109 for more information on RSTP. Click RSTP in the Advanced Application > Spanning Tree Protocol screen. Figure 53 Advanced Application > Spanning Tree Protocol > RSTP The following table describes the labels in this screen.
PAGE 117
Chapter 11 Spanning Tree Protocol Table 25 Advanced Application > Spanning Tree Protocol > RSTP (continued) LABEL DESCRIPTION Hello Time This is the time interval in seconds between BPDU (Bridge Protocol Data Units) configuration message generations by the root switch. The allowed range is 1 to 10 seconds. Max Age This is the maximum time (in seconds) the Switch can wait without receiving a BPDU before attempting to reconfigure.
PAGE 118
Chapter 11 Spanning Tree Protocol " This screen is only available after you activate RSTP on the Switch. Figure 54 Advanced Application > Spanning Tree Protocol > Status: RSTP The following table describes the labels in this screen. Table 26 Advanced Application > Spanning Tree Protocol > Status: RSTP LABEL DESCRIPTION Configuration Click Configuration to specify which STP mode you want to activate. Click RSTP to edit RSTP settings on the Switch.
PAGE 119
Chapter 11 Spanning Tree Protocol 11.6 Configure Multiple Rapid Spanning Tree Protocol To configure MRSTP, click MRSTP in the Advanced Application > Spanning Tree Protocol screen. See Section 11.1 on page 109 for more information on MRSTP. Figure 55 Advanced Application > Spanning Tree Protocol > MRSTP The following table describes the labels in this screen.
PAGE 120
Chapter 11 Spanning Tree Protocol Table 27 Advanced Application > Spanning Tree Protocol > MRSTP (continued) LABEL DESCRIPTION Max Age This is the maximum time (in seconds) the Switch can wait without receiving a BPDU before attempting to reconfigure. All Switch ports (except for designated ports) should receive BPDUs at regular intervals. Any port that ages out STP information (provided in the last BPDU) becomes the designated port for the attached LAN.
PAGE 121
Chapter 11 Spanning Tree Protocol " This screen is only available after you activate MRSTP on the Switch. Figure 56 Advanced Application > Spanning Tree Protocol > Status: MRSTP The following table describes the labels in this screen. Table 28 Advanced Application > Spanning Tree Protocol > Status: MRSTP LABEL DESCRIPTION Configuration Click Configuration to specify which STP mode you want to activate. Click MRSTP to edit MRSTP settings on the Switch.
PAGE 122
Chapter 11 Spanning Tree Protocol 11.8 Configure Multiple Spanning Tree Protocol To configure MSTP, click MSTP in the Advanced Application > Spanning Tree Protocol screen. See Section 11.1.5 on page 112 for more information on MSTP.
PAGE 123
Chapter 11 Spanning Tree Protocol The following table describes the labels in this screen. Table 29 Advanced Application > Spanning Tree Protocol > MSTP LABEL DESCRIPTION Status Click Status to display the MSTP Status screen (see Figure 58 on page 125). Active Select this check box to activate MSTP on the Switch. Clear this checkbox to disable MSTP on the Switch.
PAGE 124
Chapter 11 Spanning Tree Protocol Table 29 Advanced Application > Spanning Tree Protocol > MSTP (continued) LABEL DESCRIPTION VLAN Range Enter the start of the VLAN ID range that you want to add or remove from the VLAN range edit area in the Start field. Enter the end of the VLAN ID range that you want to add or remove from the VLAN range edit area in the End field. Next click: • Add - to add this range of VLAN(s) to be mapped to the MST instance.
PAGE 125
Chapter 11 Spanning Tree Protocol " This screen is only available after you activate MSTP on the Switch. Figure 58 Advanced Application > Spanning Tree Protocol > Status: MSTP The following table describes the labels in this screen. Table 30 Advanced Application > Spanning Tree Protocol > Status: MSTP LABEL DESCRIPTION Configuration Click Configuration to specify which STP mode you want to activate. Click MSTP to edit MSTP settings on the Switch.
PAGE 126
Chapter 11 Spanning Tree Protocol Table 30 Advanced Application > Spanning Tree Protocol > Status: MSTP (continued) 126 LABEL DESCRIPTION Forwarding Delay (second) This is the time (in seconds) the root switch will wait before changing states (that is, listening to learning to forwarding). Cost to Bridge This is the path cost from the root port on this Switch to the root switch.
PAGE 127
CHAPTER 12 Bandwidth Control This chapter shows you how you can cap the maximum bandwidth using the Bandwidth Control screen. 12.1 Bandwidth Control Overview Bandwidth control means defining a maximum allowable bandwidth for incoming and/or outgoing traffic flows on a port. 12.1.1 CIR and PIR The Committed Information Rate (CIR) is the guaranteed bandwidth for the incoming traffic flow on a port.
PAGE 128
Chapter 12 Bandwidth Control Figure 59 Advanced Application > Bandwidth Control The following table describes the related labels in this screen. Table 31 Advanced Application > Bandwidth Control LABEL DESCRIPTION Active Select this check box to enable bandwidth control on the Switch. Port This field displays the port number. * Settings in this row apply to all ports. Use this row only if you want to make some settings the same for all ports.
PAGE 129
CHAPTER 13 Broadcast Storm Control This chapter introduces and shows you how to configure the broadcast storm control feature. 13.1 Broadcast Storm Control Setup Broadcast storm control limits the number of broadcast, multicast and destination lookup failure (DLF) packets the Switch receives per second on the ports. When the maximum number of allowable broadcast, multicast and/or DLF packets is reached per second, the subsequent packets are discarded.
PAGE 130
Chapter 13 Broadcast Storm Control The following table describes the labels in this screen. Table 32 Advanced Application > Broadcast Storm Control LABEL DESCRIPTION Active Select this check box to enable traffic storm control on the Switch. Clear this check box to disable this feature. Port This field displays the port number. * Settings in this row apply to all ports. Use this row only if you want to make some settings the same for all ports.
PAGE 131
CHAPTER 14 Mirroring This chapter discusses port mirroring setup screens. 14.1 Port Mirroring Setup Port mirroring allows you to copy a traffic flow to a monitor port (the port you copy the traffic to) in order that you can examine the traffic from the monitor port without interference. Click Advanced Application > Mirroring in the navigation panel to display the Mirroring screen. Use this screen to select a monitor port and specify the traffic flow to be copied to the monitor port.
PAGE 132
Chapter 14 Mirroring The following table describes the labels in this screen. Table 33 Advanced Application > Mirroring LABEL DESCRIPTION Active Select this check box to activate port mirroring on the Switch. Clear this check box to disable the feature. Monitor Port The monitor port is the port you copy the traffic to in order to examine it in more detail without interfering with the traffic flow on the original port(s). Enter the port number of the monitor port.
PAGE 133
CHAPTER 15 Link Aggregation This chapter shows you how to logically aggregate physical links to form one logical, higherbandwidth link. 15.1 Link Aggregation Overview Link aggregation (trunking) is the grouping of physical ports into one logical higher-capacity link. You may want to trunk ports if for example, it is cheaper to use multiple lower-speed links than to under-utilize a high-speed, but more costly, single-port link. However, the more ports you aggregate then the fewer available ports you have.
PAGE 134
Chapter 15 Link Aggregation • You must connect all ports point-to-point to the same Ethernet switch and configure the ports for LACP trunking. • LACP only works on full-duplex links. • All ports in the same trunk group must have the same media type, speed, duplex mode and flow control settings. Configure trunk groups or LACP before you connect the Ethernet switch to avoid causing network topology loops. 15.2.
PAGE 135
Chapter 15 Link Aggregation Table 36 Advanced Application > Link Aggregation Status (continued) LABEL DESCRIPTION Synchronized Ports These are the ports that are currently transmitting data as one logical link in this trunk group. Aggregator ID Link Aggregator ID consists of the following: system priority, MAC address, key, port priority and port number. Refer to Section 15.2.1 on page 134 for more information on this field. Status This field displays how these ports were added to the trunk group.
PAGE 136
Chapter 15 Link Aggregation The following table describes the labels in this screen. Table 37 Advanced Application > Link Aggregation > Link Aggregation Setting LABEL DESCRIPTION Link Aggregation Setting This is the only screen you need to configure to enable static link aggregation. Group ID The field identifies the link aggregation group, that is, one logical link containing multiple ports. Active Select this option to activate a trunk group. Port This field displays the port number.
PAGE 137
Chapter 15 Link Aggregation Figure 64 Advanced Application > Link Aggregation > Link Aggregation Setting > LACP The following table describes the labels in this screen. Table 38 Advanced Application > Link Aggregation > Link Aggregation Setting > LACP LABEL Link Aggregation Control Protocol DESCRIPTION Note: Do not configure this screen unless you want to enable dynamic link aggregation. Active Select this checkbox to enable Link Aggregation Control Protocol (LACP).
PAGE 138
Chapter 15 Link Aggregation Table 38 Advanced Application > Link Aggregation > Link Aggregation Setting > LACP LABEL DESCRIPTION * Settings in this row apply to all ports. Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis. Note: Changes in this row are copied to all the ports as soon as you make them.
PAGE 139
Chapter 15 Link Aggregation Figure 66 Trunking Example - Configuration Screen Your trunk group 1 (T1) configuration is now complete; you do not need to go to any additional screens.
PAGE 140
Chapter 15 Link Aggregation 140 GS-4012F/4024 User’s Guide
PAGE 141
CHAPTER 16 Port Authentication This chapter describes the IEEE 802.1x and MAC authentication methods. 16.1 Port Authentication Overview Port authentication is a way to validate access to ports on the Switch to clients based on an external server (authentication server). The Switch supports the following methods for port authentication: • IEEE 802.1x2 - An authentication server validates access to a port based on a username and password provided by the user.
PAGE 142
Chapter 16 Port Authentication Figure 67 IEEE 802.1x Authentication Process 1 New Connection 2 Login Info Request 3 Login Credentials 4 Authentication Request 5 Authentication Reply Session Granted/Denied 16.1.2 MAC Authentication MAC authentication works in a very similar way to IEEE 802.1x authentication. The main difference is that the Switch does not prompt the client for login credentials.
PAGE 143
Chapter 16 Port Authentication 16.2 Port Authentication Configuration To enable port authentication, first activate the port authentication method(s) you want to use (both on the Switch and the port(s)) then configure the RADIUS server settings in the Auth and Acct > Radius Server Setup screen. Click Advanced Application > Port Authentication in the navigation panel to display the screen as shown. Figure 69 Advanced Application > Port Authentication 16.2.1 Activate IEEE 802.
PAGE 144
Chapter 16 Port Authentication The following table describes the labels in this screen. Table 39 Advanced Application > Port Authentication > 802.1x LABEL DESCRIPTION Active Select this check box to permit 802.1x authentication on the Switch. Note: You must first enable 802.1x authentication on the Switch before configuring it on each port. Port This field displays the port number. * Settings in this row apply to all ports. Use this row only if you want to make some settings the same for all ports.
PAGE 145
Chapter 16 Port Authentication Figure 71 Advanced Application > Port Authentication > MAC Authentication The following table describes the labels in this screen. Table 40 Advanced Application > Port Authentication > MAC Authentication LABEL DESCRIPTION Active Select this check box to permit MAC authentication on the Switch. Note: You must first enable MAC authentication on the Switch before configuring it on each port.
PAGE 146
Chapter 16 Port Authentication Table 40 Advanced Application > Port Authentication > MAC Authentication (continued) LABEL DESCRIPTION * Use this row to make the setting the same for all ports. Use this row first and then make adjustments on a port-by-port basis. Note: Changes in this row are copied to all the ports as soon as you make them. 146 Active Select this checkbox to permit MAC authentication on this port.
PAGE 147
CHAPTER 17 Port Security This chapter shows you how to set up port security. 17.1 About Port Security Port security allows only packets with dynamically learned MAC addresses and/or configured static MAC addresses to pass through a port on the Switch. The Switch can learn up to 16K MAC addresses in total with no limit on individual ports other than the sum cannot exceed 16K. For maximum port security, enable this feature, disable MAC address learning and configure static MAC address(es) for a port.
PAGE 148
Chapter 17 Port Security Figure 72 Advanced Application > Port Security The following table describes the labels in this screen. Table 41 Advanced Application > Port Security LABEL DESCRIPTION Active Select this option to enable port security on the Switch. Port This field displays the port number. * Settings in this row apply to all ports. Use this row only if you want to make some settings the same for all ports.
PAGE 149
Chapter 17 Port Security Table 41 Advanced Application > Port Security (continued) LABEL DESCRIPTION Apply Click Apply to save your changes to the Switch’s run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Save link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Cancel Click Cancel to begin configuring this screen afresh.
PAGE 150
Chapter 17 Port Security 150 GS-4012F/4024 User’s Guide
PAGE 151
CHAPTER 18 Classifier This chapter introduces and shows you how to configure the packet classifier on the Switch. 18.1 About the Classifier and QoS Quality of Service (QoS) refers to both a network's ability to deliver data with minimum delay, and the networking methods used to control the use of bandwidth. Without QoS, all traffic data is equally likely to be dropped when the network is congested.
PAGE 152
Chapter 18 Classifier Figure 73 Advanced Application > Classifier The following table describes the labels in this screen. Table 42 Advanced Application > Classifier LABEL DESCRIPTION Active Select this option to enable this rule. Name Enter a descriptive name for this rule for identifying purposes. Packet Format Specify the format of the packet. Choices are All, 802.3 tagged, 802.3 untagged, Ethernet II tagged and Ethernet II untagged. A value of 802.
PAGE 153
Chapter 18 Classifier Table 42 Advanced Application > Classifier (continued) LABEL DESCRIPTION Ethernet Type Select an Ethernet type or select Other and enter the Ethernet type number in hexadecimal value. Refer to Table 44 on page 154 for information. Source MAC Address Select Any to apply the rule to all MAC addresses. To specify a source, select the second choice and type a MAC address in valid MAC address format (six hexadecimal character pairs).
PAGE 154
Chapter 18 Classifier 18.3 Viewing and Editing Classifier Configuration To view a summary of the classifier configuration, scroll down to the summary table at the bottom of the Classifier screen. To change the settings of a rule, click a number in the Index field. " When two rules conflict with each other, a higher layer rule has priority over lower layer rule. Figure 74 Advanced Application > Classifier: Summary Table The following table describes the labels in this screen.
PAGE 155
Chapter 18 Classifier Some of the most common IP ports are: Table 45 Common IP Ports PORT NUMBER PORT NAME 21 FTP 23 Telnet 25 SMTP 53 DNS 80 HTTP 110 POP3 18.4 Classifier Example The following screen shows an example where you configure a classifier that identifies all traffic from MAC address 00:50:ba:ad:4f:81 on port 2. After you have configured a classifier, you can configure a policy (in the Policy screen) to define action(s) on the classified traffic flow.
PAGE 156
Chapter 18 Classifier Figure 75 Classifier: Example 156 GS-4012F/4024 User’s Guide
PAGE 157
CHAPTER 19 Policy Rule This chapter shows you how to configure policy rules. 19.1 Policy Rules Overview A classifier distinguishes traffic into flows based on the configured criteria (refer to Chapter 18 on page 151 for more information). A policy rule ensures that a traffic flow gets the requested treatment in the network. 19.1.
PAGE 158
Chapter 19 Policy Rule 19.2 Configuring Policy Rules You must first configure a classifier in the Classifier screen. Refer to Section 18.2 on page 151 for more information. Click Advanced Applications > Policy Rule in the navigation panel to display the screen as shown.
PAGE 159
Chapter 19 Policy Rule The following table describes the labels in this screen. Table 46 Advanced Application > Policy Rule LABEL DESCRIPTION Active Select this option to enable the policy. Name Enter a descriptive name for identification purposes. Classifier(s) This field displays the active classifier(s) you configure in the Classifier screen. Select the classifier(s) to which this policy rule applies. To select more than one classifier, press [SHIFT] and select the choices at the same time.
PAGE 160
Chapter 19 Policy Rule Table 46 Advanced Application > Policy Rule (continued) LABEL DESCRIPTION Outgoing Select Send the packet to the mirror port to send the packet to the mirror port. Select Send the packet to the egress port to send the packet to the egress port. Select Send the matching frames (broadcast or DLF, multicast, marked for dropping or to be sent to the CPU) to the egress port to send the broadcast, multicast, DLF, marked-to-drop or CPU frames to the egress port.
PAGE 161
Chapter 19 Policy Rule 19.4 Policy Example The figure below shows an example Policy screen where you configure a policy to limit bandwidth and discard out-of-profile traffic on a traffic flow classified using the Example classifier (refer to Section 18.4 on page 155).
PAGE 162
Chapter 19 Policy Rule 162 GS-4012F/4024 User’s Guide
PAGE 163
CHAPTER 20 Queuing Method This chapter introduces the queuing methods supported. 20.1 Queuing Method Overview Queuing is used to help solve performance degradation when there is network congestion. Use the Queuing Method screen to configure queuing algorithms for outgoing traffic. See also Priority Queue Assignment in Switch Setup and 802.1p Priority in Port Setup for related information.
PAGE 164
Chapter 20 Queuing Method 20.2 Configuring Queuing Click Advanced Application, Queuing Method in the navigation panel. Figure 79 Queuing Method The following table describes the labels in this screen. Table 48 Queuing Method 164 LABEL DESCRIPTION Port This label shows the port you are configuring. Method Select SPQ (Strict Priority Queuing) or WRR (Weighted Round Robin). Strict Priority Queuing (SPQ) services queues based on priority only.
PAGE 165
CHAPTER 21 VLAN Stacking This chapter shows you how to configure VLAN stacking on your Switch. See the chapter on VLANs for more background information on Virtual LAN 21.1 VLAN Stacking Overview A service provider can use VLAN stacking to allow it to distinguish multiple customers VLANs, even those with the same (customer-assigned) VLAN ID, within its network. Use VLAN stacking to add an outer VLAN tag to the inner IEEE 802.1Q tagged frames that enter the network.
PAGE 166
Chapter 21 VLAN Stacking Figure 80 VLAN Stacking Example 21.2 VLAN Stacking Port Roles Each port can have three VLAN stacking “roles”, Normal, Access Port and Tunnel (the latter is for Gigabit ports only). • Select Normal for “regular” (non-VLAN stacking) IEEE 802.1Q frame switching. • Select Access Port for ingress ports on the service provider's edge devices (1 and 2 in the VLAN stacking example figure). The incoming frame is treated as "untagged", so a second VLAN tag (outer VLAN tag) can be added.
PAGE 167
Chapter 21 VLAN Stacking 21.3 VLAN Tag Format A VLAN tag (service provider VLAN stacking or customer IEEE 802.1Q) consists of the following three fields. Table 49 VLAN Tag Format Type Priority VID Type is a standard Ethernet type code identifying the frame and indicates that whether the frame carries IEEE 802.1Q tag information. SP TPID (Service Provider Tag Protocol Identifier) is the service provider VLAN stacking tag type. Many vendors use 0x8100 or 0x9100.
PAGE 168
Chapter 21 VLAN Stacking Table 51 802.1Q Frame (SP)TPID (Service Provider) Tag Protocol IDentifier Data Frame data VID FCS Frame Check Sequence VLAN ID 21.4 Configuring VLAN Stacking Click Advanced Applications > VLAN Stacking to display the screen as shown. Figure 81 Advanced Application > VLAN Stacking The following table describes the labels in this screen. Table 52 Advanced Application > VLAN Stacking LABEL DESCRIPTION Active Select this checkbox to enable VLAN stacking on the Switch.
PAGE 169
Chapter 21 VLAN Stacking Table 52 Advanced Application > VLAN Stacking (continued) LABEL DESCRIPTION Role Select Normal to have the Switch ignore frames received (or transmitted) on this port with VLAN stacking tags. Anything you configure in SPVID and Priority are ignored. Note: The Normal option is only supported on the GS-4012F model. Select Access Port to have the Switch add the SP TPID tag to all incoming frames received on this port.
PAGE 170
Chapter 21 VLAN Stacking 170 GS-4012F/4024 User’s Guide
PAGE 171
CHAPTER 22 Multicast This chapter shows you how to configure various multicast features. 22.1 Multicast Overview Traditionally, IP packets are transmitted in one of either two ways - Unicast (1 sender to 1 recipient) or Broadcast (1 sender to everybody on the network). Multicast delivers IP packets to just a group of hosts on the network. IGMP (Internet Group Management Protocol) is a network-layer protocol used to establish membership in a multicast group - it is not used to carry user data.
PAGE 172
Chapter 22 Multicast The Switch forwards multicast traffic destined for multicast groups (that it has learned from IGMP snooping or that you have manually configured) to ports that are members of that group. IGMP snooping generates no additional network traffic, allowing you to significantly reduce multicast traffic passing through your Switch. 22.1.4 IGMP Snooping and VLANs The Switch can perform IGMP snooping on up to 16 VLANs.
PAGE 173
Chapter 22 Multicast Figure 83 Advanced Application > Multicast > Multicast Setting The following table describes the labels in this screen. Table 54 Advanced Application > Multicast > Multicast Setting LABEL DESCRIPTION IGMP Snooping Use these settings to configure IGMP Snooping. Active Select Active to enable IGMP Snooping to forward group multicast traffic only to ports that are members of that group.
PAGE 174
Chapter 22 Multicast Table 54 Advanced Application > Multicast > Multicast Setting (continued) LABEL DESCRIPTION Reserved Multicast Group Multicast addresses (224.0.0.0 to 224.0.0.255) are reserved for the local scope. For examples, 224.0.0.1 is for all hosts in this subnet, 224.0.0.2 is for all multicast routers in this subnet, etc. A router will not forward a packet with the destination IP address within this range. See the IANA web site for more information.
PAGE 175
Chapter 22 Multicast Figure 84 Advanced Application > Multicast > Multicast Setting > IGMP Snooping VLAN The following table describes the labels in this screen. Table 55 Advanced Application > Multicast > Multicast Setting > IGMP Snooping VLAN LABEL DESCRIPTION Mode Select auto to have the Switch learn multicast group membership information of any VLANs automatically. Select fixed to have the Switch only learn multicast group membership information of the VLAN(s) that you specify below.
PAGE 176
Chapter 22 Multicast Table 55 Advanced Application > Multicast > Multicast Setting > IGMP Snooping VLAN LABEL DESCRIPTION Index This is the number of the IGMP snooping VLAN entry in the table. Name This field displays the descriptive name for this VLAN group. VID This field displays the ID number of the VLAN group. Delete Check the rule(s) that you want to remove in the Delete column, then click the Delete button. Cancel Click Cancel to clear the Delete check boxes. 22.
PAGE 177
Chapter 22 Multicast Table 56 Advanced Application > Multicast > Multicast Setting > IGMP Filtering Profile LABEL DESCRIPTION Add Click Add to save the profile to the Switch’s run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Save link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Clear Click Clear to clear the fields to the factory defaults.
PAGE 178
Chapter 22 Multicast 22.6.2 MVR Modes You can set your Switch to operate in either dynamic or compatible mode. In dynamic mode, the Switch sends IGMP leave and join reports to the other multicast devices (such as multicast routers or servers) in the multicast VLAN. This allows the multicast devices to update the multicast forwarding table to forward or not forward multicast traffic to the receiver ports. In compatible mode, the Switch does not send any IGMP reports.
PAGE 179
Chapter 22 Multicast " Your Switch automatically creates a static VLAN (with the same VID) when you create a multicast VLAN in this screen. Figure 88 Advanced Application > Multicast > Multicast Setting > MVR The following table describes the related labels in this screen. Table 57 Advanced Application > Multicast > Multicast Setting > MVR LABEL DESCRIPTION Active Select this check box to enable MVR to allow one single multicast VLAN to be shared among different subscriber VLANs on the network.
PAGE 180
Chapter 22 Multicast Table 57 Advanced Application > Multicast > Multicast Setting > MVR (continued) LABEL DESCRIPTION * Settings in this row apply to all ports. Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis. Note: Changes in this row are copied to all the ports as soon as you make them.
PAGE 181
Chapter 22 Multicast Figure 89 Advanced Application > Multicast > Multicast Setting > MVR: Group Configuration The following table describes the labels in this screen. Table 58 Advanced Application > Multicast > Multicast Setting > MVR: Group Configuration LABEL DESCRIPTION Multicast VLAN ID Select a multicast VLAN ID (that you configured in the MVR screen) from the dropdown list box. Name Enter a descriptive name for identification purposes.
PAGE 182
Chapter 22 Multicast Figure 90 MVR Configuration Example To configure the MVR settings on the Switch, create a multicast group in the MVR screen and set the receiver and source ports. Figure 91 MVR Configuration Example To set the Switch to forward the multicast group traffic to the subscribers, configure multicast group settings in the Group Configuration screen. The following figure shows an example where two multicast groups (News and Movie) are configured for the multicast VLAN 200.
PAGE 183
Chapter 22 Multicast Figure 93 MVR Group Configuration Example GS-4012F/4024 User’s Guide 183
PAGE 184
Chapter 22 Multicast 184 GS-4012F/4024 User’s Guide
PAGE 185
CHAPTER 23 Authentication & Accounting This chapter describes how to configure authentication and accounting settings on the Switch. 23.1 Authentication, Authorization and Accounting Authentication is the process of determining who a user is and validating access to the Switch. The Switch can authenticate users who try to log in based on user accounts configured on the Switch itself.
PAGE 186
Chapter 23 Authentication & Accounting 23.1.2 RADIUS and TACACS+ RADIUS and TACACS+ are security protocols used to authenticate users by means of an external server instead of (or in addition to) an internal device user database that is limited to the memory capacity of the device. In essence, RADIUS and TACACS+ authentication both allow you to validate an unlimited number of users from a central location. The following table describes some key differences between RADIUS and TACACS+.
PAGE 187
Chapter 23 Authentication & Accounting Figure 96 Advanced Application > Auth and Acct > RADIUS Server Setup The following table describes the labels in this screen. Table 60 Advanced Application > Auth and Acct > RADIUS Server Setup LABEL DESCRIPTION Authentication Server Use this section to configure your RADIUS authentication settings. Mode This field is only valid if you configure multiple RADIUS servers.
PAGE 188
Chapter 23 Authentication & Accounting Table 60 Advanced Application > Auth and Acct > RADIUS Server Setup (continued) LABEL DESCRIPTION Delete Check this box if you want to remove an existing RADIUS server entry from the Switch. This entry is deleted when you click Apply. Apply Click Apply to save your changes to the Switch’s run-time memory.
PAGE 189
Chapter 23 Authentication & Accounting Figure 97 Advanced Application > Auth and Acct > TACACS+ Server Setup The following table describes the labels in this screen. Table 61 Advanced Application > Auth and Acct > TACACS+ Server Setup LABEL DESCRIPTION Authentication Server Use this section to configure your TACACS+ authentication settings. Mode This field is only valid if you configure multiple TACACS+ servers.
PAGE 190
Chapter 23 Authentication & Accounting Table 61 Advanced Application > Auth and Acct > TACACS+ Server Setup (continued) LABEL DESCRIPTION Shared Secret Specify a password (up to 32 alphanumeric characters) as the key to be shared between the external TACACS+ server and the Switch. This key is not sent over the network. This key must be the same on the external TACACS+ server and the Switch. Delete Check this box if you want to remove an existing TACACS+ server entry from the Switch.
PAGE 191
Chapter 23 Authentication & Accounting Figure 98 Advanced Application > Auth and Acct > Auth and Acct Setup The following table describes the labels in this screen. Table 62 Advanced Application > Auth and Acct > Auth and Acct Setup LABEL DESCRIPTION Authentication Use this section to specify the methods used to authenticate users accessing the Switch.
PAGE 192
Chapter 23 Authentication & Accounting Table 62 Advanced Application > Auth and Acct > Auth and Acct Setup (continued) 192 LABEL DESCRIPTION Login These fields specify which database the Switch should use (first, second and third) to authenticate administrator accounts (users for Switch management). Configure the local user accounts in the Access Control > Logins screen. The TACACS+ and RADIUS are external servers.
PAGE 193
Chapter 23 Authentication & Accounting Table 62 Advanced Application > Auth and Acct > Auth and Acct Setup (continued) LABEL DESCRIPTION Apply Click Apply to save your changes to the Switch’s run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Save link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Cancel Click Cancel to begin configuring this screen afresh. 23.2.
PAGE 194
Chapter 23 Authentication & Accounting Table 63 Supported VSAs FUNCTION ATTRIBUTE Egress Bandwidth Assignment Vendor-Id = 890 Vendor-Type = 2 Vendor-data = egress rate (Kbps in decimal format) Privilege Assignment Vendor-ID = 890 Vendor-Type = 3 Vendor-Data = "shell:priv-lvl=N" or Vendor-ID = 9 (CISCO) Vendor-Type = 1 (CISCO-AVPAIR) Vendor-Data = "shell:priv-lvl=N" where N is a privilege level (from 0 to 14).
PAGE 195
Chapter 23 Authentication & Accounting 23.3.1 Attributes Used for Authentication The following sections list the attributes sent from the Switch to the RADIUS server when performing authentication. 23.3.1.1 Attributes Used for Authenticating Privilege Access User-Name - the format of the User-Name attribute is $enab#$, where # is the privilege level (1=14) User-Password NAS-Identifier NAS-IP-Address 23.3.1.2 Attributes Used to Login Users User-Name User-Password NAS-Identifier NAS-IP-Address 23.3.1.
PAGE 196
Chapter 23 Authentication & Accounting 23.3.2.
PAGE 197
Chapter 23 Authentication & Accounting Table 67 RADIUS Attributes - Exec Events via Console ATTRIBUTE START INTERIM-UPDATE STOP NAS-Port-Type Y Y Y Acct-Status-Type Y Y Y Acct-Delay-Time Y Y Y Acct-Session-Id Y Y Y Acct-Authentic Y Y Y Acct-Input-Octets Y Y Acct-Output-Octets Y Y Acct-Session-Time Y Y Acct-Input-Packets Y Y Acct-Output-Packets Y Y Acct-Terminate-Cause Y Acct-Input-Gigawords Y Y Acct-Output-Gigawords Y Y GS-4012F/4024 User’s Guide 197
PAGE 198
Chapter 23 Authentication & Accounting 198 GS-4012F/4024 User’s Guide
PAGE 199
CHAPTER 24 IP Source Guard Use IP source guard to filter unauthorized DHCP and ARP packets in your network. 24.1 IP Source Guard Overview IP source guard uses a binding table to distinguish between authorized and unauthorized DHCP and ARP packets in your network. A binding contains these key attributes: • • • • MAC address VLAN ID IP address Port number When the Switch receives a DHCP or ARP packet, it looks up the appropriate MAC address, VLAN ID, IP address, and port number in the binding table.
PAGE 200
Chapter 24 IP Source Guard Trusted ports are connected to DHCP servers or other switches. The Switch discards DHCP packets from trusted ports only if the rate at which DHCP packets arrive is too high. The Switch learns dynamic bindings from trusted ports. " The Switch will drop all DHCP requests if you enable DHCP snooping and there are no trusted ports. Untrusted ports are connected to subscribers.
PAGE 201
Chapter 24 IP Source Guard 24.1.1.3 DHCP Relay Option 82 Information The Switch can add information to DHCP requests that it does not discard. This provides the DHCP server more information about the source of the requests. The Switch can add the following information: • Slot ID (1 byte), port ID (1 byte), and source VLAN ID (2 bytes) • System name (up to 32 bytes) This information is stored in an Agent Information field in the option 82 field of the DHCP headers of client DHCP request frames.
PAGE 202
Chapter 24 IP Source Guard 24.1.2.1 ARP Inspection and MAC Address Filters When the Switch identifies an unauthorized ARP packet, it automatically creates a MAC address filter to block traffic from the source MAC address and source VLAN ID of the unauthorized ARP packet. You can configure how long the MAC address filter remains in the Switch. These MAC address filters are different than regular MAC address filters (Chapter 10 on page 107). • They are stored only in volatile memory.
PAGE 203
Chapter 24 IP Source Guard 24.2 IP Source Guard Use this screen to look at the current bindings for DHCP snooping and ARP inspection. Bindings are used by DHCP snooping and ARP inspection to distinguish between authorized and unauthorized packets in the network. The Switch learns the bindings by snooping DHCP packets (dynamic bindings) and from information provided manually by administrators (static bindings). To open this screen, click Advanced Application > IP Source Guard.
PAGE 204
Chapter 24 IP Source Guard Figure 102 IP Source Guard Static Binding The following table describes the labels in this screen. Table 69 IP Source Guard Static Binding 204 LABEL DESCRIPTION MAC Address Enter the source MAC address in the binding. IP Address Enter the IP address assigned to the MAC address in the binding. VLAN Enter the source VLAN ID in the binding. Port Specify the port(s) in the binding.
PAGE 205
Chapter 24 IP Source Guard 24.4 DHCP Snooping Use this screen to look at various statistics about the DHCP snooping database. To open this screen, click Advanced Application > IP Source Guard > DHCP Snooping.
PAGE 206
Chapter 24 IP Source Guard The following table describes the labels in this screen. Table 70 DHCP Snooping LABEL DESCRIPTION Database Status This section displays the current settings for the DHCP snooping database. You can configure them in the DHCP Snooping Configure screen. See Section 24.5 on page 208. Agent URL This field displays the location of the DHCP snooping database.
PAGE 207
Chapter 24 IP Source Guard Table 70 DHCP Snooping (continued) LABEL DESCRIPTION Successful writes This field displays the number of times the Switch updated the bindings in the DHCP snooping database successfully. Failed writes This field displays the number of times the Switch was unable to update the bindings in the DHCP snooping database. Database detail First successful access This field displays the first time the Switch accessed the DHCP snooping database for any reason.
PAGE 208
Chapter 24 IP Source Guard 24.5 DHCP Snooping Configure Use this screen to enable DHCP snooping on the Switch (not on specific VLAN), specify the VLAN where the default DHCP server is located, and configure the DHCP snooping database. The DHCP snooping database stores the current bindings on a secure, external TFTP server so that they are still available after a restart. To open this screen, click Advanced Application > IP Source Guard > DHCP Snooping > Configure.
PAGE 209
Chapter 24 IP Source Guard Table 71 DHCP Snooping Configure (continued) LABEL DESCRIPTION Database If Timeout interval is greater than Write delay interval, it is possible that the next update is scheduled to occur before the current update has finished successfully or timed out. In this case, the Switch waits to start the next update until it completes the current one. Agent URL Enter the location of the DHCP snooping database.
PAGE 210
Chapter 24 IP Source Guard Figure 105 DHCP Snooping Port Configure The following table describes the labels in this screen. Table 72 DHCP Snooping Port Configure 210 LABEL DESCRIPTION Port This field displays the port number. If you configure the * port, the settings are applied to all of the ports. Server Trusted state Select whether this port is a trusted port (Trusted) or an untrusted port (Untrusted).
PAGE 211
Chapter 24 IP Source Guard 24.5.2 DHCP Snooping VLAN Configure Use this screen to enable DHCP snooping on each VLAN and to specify whether or not the Switch adds DHCP relay agent option 82 information (Chapter 33 on page 259) to DHCP requests that the Switch relays to a DHCP server for each VLAN. To open this screen, click Advanced Application > IP Source Guard > DHCP Snooping > Configure > VLAN. Figure 106 DHCP Snooping VLAN Configure The following table describes the labels in this screen.
PAGE 212
Chapter 24 IP Source Guard 24.6 ARP Inspection Status Use this screen to look at the current list of MAC address filters that were created because the Switch identified an unauthorized ARP packet. When the Switch identifies an unauthorized ARP packet, it automatically creates a MAC address filter to block traffic from the source MAC address and source VLAN ID of the unauthorized ARP packet. To open this screen, click Advanced Application > IP Source Guard > ARP Inspection.
PAGE 213
Chapter 24 IP Source Guard Figure 108 ARP Inspection VLAN Status The following table describes the labels in this screen. Table 75 ARP Inspection VLAN Status LABEL DESCRIPTION Show VLAN range Use this section to specify the VLANs you want to look at in the section below. Enabled VLAN Select this to look at all the VLANs on which ARP inspection is enabled in the section below. Selected VLAN Select this to look at all the VLANs in a specific range in the section below.
PAGE 214
Chapter 24 IP Source Guard Figure 109 ARP Inspection Log Status The following table describes the labels in this screen. Table 76 ARP Inspection Log Status 214 LABEL DESCRIPTION Clearing log status table Click Apply to remove all the log messages that were generated by ARP packets and that have not been sent to the syslog server yet. Total number of logs This field displays the number of log messages that were generated by ARP packets and that have not been sent to the syslog server yet.
PAGE 215
Chapter 24 IP Source Guard 24.7 ARP Inspection Configure Use this screen to enable ARP inspection on the Switch. You can also configure the length of time the Switch stores records of discarded ARP packets and global settings for the ARP inspection log. To open this screen, click Advanced Application > IP Source Guard > ARP Inspection > Configure. Figure 110 ARP Inspection Configure The following table describes the labels in this screen.
PAGE 216
Chapter 24 IP Source Guard Table 77 ARP Inspection Configure (continued) LABEL DESCRIPTION Syslog rate Enter the maximum number of syslog messages the Switch can send to the syslog server in one batch. This number is expressed as a rate because the batch frequency is determined by the Log Interval. You must configure the syslog server (Chapter 38 on page 305) to use this. Enter 0 if you do not want the Switch to send log messages generated by ARP packets to the syslog server.
PAGE 217
Chapter 24 IP Source Guard The following table describes the labels in this screen. Table 78 ARP Inspection Port Configure LABEL DESCRIPTION Port This field displays the port number. If you configure the * port, the settings are applied to all of the ports. Trusted State Select whether this port is a trusted port (Trusted) or an untrusted port (Untrusted). The Switch does not discard ARP packets on trusted ports for any reason.
PAGE 218
Chapter 24 IP Source Guard The following table describes the labels in this screen. Table 79 ARP Inspection VLAN Configure 218 LABEL DESCRIPTION VLAN Use this section to specify the VLANs you want to manage in the section below. Start VID Enter the lowest VLAN ID you want to manage in the section below. End VID Enter the highest VLAN ID you want to manage in the section below. Apply Click this to display the specified range of VLANs in the section below.
PAGE 219
CHAPTER 25 Loop Guard This chapter shows you how to configure the Switch to guard against loops on the edge of your network. 25.1 Loop Guard Overview Loop guard allows you to configure the Switch to shut down a port if it detects that packets sent out on that port loop back to the Switch. While you can use Spanning Tree Protocol (STP) to prevent loops in the core of your network. STP cannot prevent loops that occur on the edge of your network.
PAGE 220
Chapter 25 Loop Guard The following figure shows port N on switch A connected to switch B. Switch B is in loop state. When broadcast or multicast packets leave port N and reach switch B, they are sent back to port N on A as they are rebroadcast from B. Figure 114 Switch in Loop State B A N The loop guard feature checks to see if a loop guard enabled port is connected to a switch in loop state. This is accomplished by periodically sending a probe packet and seeing if the packet returns on the same port.
PAGE 221
Chapter 25 Loop Guard " After resolving the loop problem on your network you can re-activate the disabled port via the web configurator (see Section 7.7 on page 85) or via commands (see Section 45.12.4 on page 368). 25.2 Loop Guard Setup Click Advanced Application > Loop Guard in the navigation panel to display the screen as shown. " The loop guard feature can not be enabled on the ports that have Spanning Tree Protocol (RSTP, MRSTP or MSTP) enabled.
PAGE 222
Chapter 25 Loop Guard Table 80 Advanced Application > Loop Guard (continued) 222 LABEL DESCRIPTION Active Select this check box to enable the loop guard feature on this port. The Switch sends probe packets from this port to check if the switch it is connected to is in loop state. If the switch that this port is connected is in loop state the Switch will shut down this port. Clear this check box to disable the loop guard feature. Apply Click Apply to save your changes to the Switch’s run-time memory.
PAGE 223
P ART IV IP Application Static Route (225) RIP (227) OSPF (229) IGMP (241) DVMRP (245) IP Multicast (249) Differentiated Services (251) DHCP (259) VRRP (267) 223
PAGE 224
PAGE 225
CHAPTER 26 Static Route This chapter shows you how to configure static routes. 26.1 Configuring Static Routing Static routes tell the Switch how to forward IP traffic when you configure the TCP/IP parameters manually. Click IP Application, Static Routing in the navigation panel to display the screen as shown. Figure 118 Static Routing The following table describes the related labels you use to create a static route.
PAGE 226
Chapter 26 Static Route Table 81 Static Routing (continued) 226 LABEL DESCRIPTION Metric The metric represents the “cost” of transmission for routing purposes. IP routing uses hop count as the measurement of cost, with a minimum of 1 for directly connected networks. Enter a number that approximates the cost for this link. The number need not be precise, but it must be between 1 and 15. In practice, 2 or 3 is usually a good number.
PAGE 227
CHAPTER 27 RIP This chapter shows you how to configure RIP (Routing Information Protocol). 27.1 RIP Overview RIP (Routing Information Protocol) allows a routing device to exchange routing information with other routers. The Direction field controls the sending and receiving of RIP packets. When set to: • Both - the Switch will broadcast its routing table periodically and incorporate the RIP information that it receives.
PAGE 228
Chapter 27 RIP Figure 119 RIP The following table describes the labels in this screen. Table 82 RIP 228 LABEL DESCRIPTION Active Select this check box to enable RIP on the Switch. Index This field displays the index number of an IP interface. Network This field displays the IP interface configured on the Switch. Refer to the section on IP Setup for more information on configuring IP domains. Direction Select the RIP direction from the drop-down list box.
PAGE 229
CHAPTER 28 OSPF This chapter describes the OSPF (Open Shortest Path First) routing protocol and shows you how to configure OSPF. 28.1 OSPF Overview OSPF (Open Shortest Path First) is a link-state protocol designed to distribute routing information within an autonomous system (AS). An autonomous system is a collection of networks using a common routing protocol to exchange routing information. OSPF offers some advantages over traditional vector-space routing protocols (such as RIP).
PAGE 230
Chapter 28 OSPF The following figure depicts an OSPF network example. The backbone is area 0 with a backbone router. The internal routers are in area 1 and 2. The area border routers connect area 1 and 2 to the backbone. Figure 120 OSPF Network Example 28.1.2 How OSPF Works Layer 3 devices exchange routing information to build synchronized link state database within the same AS or area.
PAGE 231
Chapter 28 OSPF Figure 121 OSPF Router Election Example You can assign a priority to an interface which determines whether this router will be elected to be a DR or BDR. The router with the highest priority becomes the DR, while a router with a priority of 0 does not participate in router elections. In Figure 121 on page 231 you can assign a priority of 0 to routers B and C, thereby ensuring they do not become DR or BDR and assign a priority of 1 to router A to make sure that it does become the DR. 28.1.
PAGE 232
Chapter 28 OSPF Figure 122 OSPF Status The following table describes the labels in this screen. Table 85 OSPF Status LABEL DESCRIPTION OSPF This field displays whether OSPF is activated (Running) or not (Down). Interface The text box displays the OSPF status of the interface(s) on the Switch. Neighbor The text box displays the status of the neighboring router participating in the OSPF network.
PAGE 233
Chapter 28 OSPF Table 86 OSPF Status: Common Output Fields (continued) FIELD DESCRIPTION State This field displays the state of the Switch (backup or DR (designated router)). Priority This field displays the priority of the Switch. This number is used in the designated router election. Designated Router This field displays the router ID of the designated router. Backup Designated Router This field displays the router ID of a backup designated router.
PAGE 234
Chapter 28 OSPF OSPF Configuration: Activating and General Settings The follow table describes the related labels in this screen. Table 87 OSPF Configuration: Activating and General Settings LABEL DESCRIPTION Active OSPF is disabled by default. Select this option to enable it. Router ID Router ID uniquely identifies the Switch in an OSPF. Enter a unique ID (that uses the format of an IP address in dotted decimal notation) for the Switch.
PAGE 235
Chapter 28 OSPF 28.4 Configure OSPF Areas To ensure that the Switch receives only routing information from a trusted layer 3 devices, activate authentication. The OSPF supports three authentication methods: • None – no authentication is used. • Simple – authenticate link state updates using an 8 printable ASCII character password. • MD5 – authenticate link state updates using a 16 printable ASCII character password. To configure an area, set the related fields in the OSPF Configuration screen.
PAGE 236
Chapter 28 OSPF Table 88 OSPF Configuration: Area Setup (continued) LABEL DESCRIPTION Stub Network Select this option to set the area as a stub area. If you enter 0.0.0.0 in the Area ID field, the settings in the Stub Area fields are ignored. No Summary Select this option to set the Switch to not send/receive LSAs. Default Route Cost Specify a cost (between 0 and 16777214) used to add a default route into a stub area for routes which are external to an OSPF domain.
PAGE 237
Chapter 28 OSPF In the OSPF Configuration screen, click Interface to display the OSPF Interface screen. Figure 125 OSPF Interface The following table describes the labels in this screen. Table 90 OSPF Interface LABEL DESCRIPTION Network Select an IP interface. Area ID Select the area ID (that uses the format of an IP address in dotted decimal notation) of an area to associate the interface to that area.
PAGE 238
Chapter 28 OSPF Table 90 OSPF Interface (continued) LABEL DESCRIPTION Priority The priority you assign to the interface is used in router elections to decide which router is going to be the Designated Router (DR) or the Backup Designated Router (BDR). You can assign a number between 0 and 255. A priority of 0 means that the router will not participate in router elections. Add Click Add to save your changes to the Switch’s run-time memory.
PAGE 239
Chapter 28 OSPF The following table describes the related labels in this screen. Table 91 OSPF Virtual-Link LABEL DESCRIPTION Name Enter a descriptive name (up to 32 printable ASCII characters) for identification purposes. Area ID Select the area ID (that uses the format of an IP address in dotted decimal notation) of an area to associate the interface to that area. Peer Router ID Enter the ID of a peer border router.
PAGE 240
Chapter 28 OSPF 240 GS-4012F/4024 User’s Guide
PAGE 241
CHAPTER 29 IGMP This chapter shows you how to configure the Switch as a multicast router. 29.1 IGMP Overview IP multicast is an IETF standard for distributing data to multiple recipients. The following figure shows a multicast session and the relationship between a multicast server, multicast routers and multicast hosts. A multicast server transmits multicast packets and multicast routers forward multicast packets to multicast hosts.
PAGE 242
Chapter 29 IGMP The Switch supports IGMP version 1 (IGMP-v1), version 2 (IGMP-v2) and IGMP version 3 (IGMP-v3). Refer to RFC 1112, RFC 2236 and RFC 3376 for information on IGMP versions 1, 2 and 3 respectively. At start up, the Switch queries all directly connected networks to gather group membership. After that, the Switch periodically updates this information. 29.1.1 How IGMP Works This section describes how IGMP works and the changes it has gone through from version 1 to version 3.
PAGE 243
Chapter 29 IGMP IGMP version 3 allows a multicast host to join a multicast group and specify from which source (multicast server) it wants to receive multicast packets. Alternatively, a multicast host can specify from which multicast servers it does not want to receive multicast packets. In the following figure multicast server X (IP address 10.1.1.1) and multicast server Z (IP address 13.2.2.2) both send multicast traffic to the same multicast group identified by the multicast IP address 225.1.1.1.
PAGE 244
Chapter 29 IGMP The following table describes the labels in this screen. Table 92 IP Application > IGMP LABEL DESCRIPTION Active Select this check box to enable IGMP on the Switch. Note: You cannot enable both IGMP snooping and IGMP at the same time. Refer to Section 22.3 on page 172 for more information on IGMP snooping. 244 Unknown Multicast Frame Specify the action to perform when the Switch receives an unknown multicast frame.
PAGE 245
CHAPTER 30 DVMRP This chapter introduces DVMRP and tells you how to configure it. 30.1 DVMRP Overview DVMRP (Distance Vector Multicast Routing Protocol) is a protocol used for routing multicast data within an autonomous system (AS). This DVMRP implementation is based on draft-ietfidmr-dvmrp-v3-10. DVMRP provides multicast forwarding capability to a layer 3 switch that runs both the IPv4 protocol (with IP Multicast support) and the IGMP protocol. The DVMRP metric is a hop count of 32.
PAGE 246
Chapter 30 DVMRP Figure 132 How DVMRP Works 30.2.1 DVMRP Terminology DVMRP probes are used to discover other DVMRP Neighbors on a network. DVMRP reports are used to exchange DVMRP source routing information. These packets are used to build the DVMRP multicast routing table that is used to build source trees and also perform Reverse Path Forwarding (RPF) checks on incoming multicast packets. RPF checks prevent duplicate packets being filtered when loops exist in the network topology.
PAGE 247
Chapter 30 DVMRP Table 93 DVMRP (continued) LABEL DESCRIPTION Index Index is the DVMRP configuration for the IP routing domain defined under Network. The maximum number of DVMRP configurations allowed is the maximum number of IP routing domains allowed on the Switch. See Section 7.6 on page 83 for more information on IP routing domains. Network This is the IP routing domain IP address and subnet mask you set up in IP Setup.
PAGE 248
Chapter 30 DVMRP 30.4 Default DVMRP Timer Values The following are some default DVMRP timer values.
PAGE 249
CHAPTER 31 IP Multicast This chapter shows you how to configure the IP Multicast screen. 31.1 IP Multicast Overview Traditionally, IP packets are transmitted in one of either two ways - Unicast (one sender to one recipient) or Broadcast (one sender to everybody on the network). IP Multicast is a third way to deliver IP packets to a group of hosts on the network - not everybody. You can configure the Switch to untag (remove the VLAN tags from) IP multicast packets that the Switch forwards.
PAGE 250
Chapter 31 IP Multicast The following table describes the labels in this screen. Table 95 IP Multicast LABEL DESCRIPTION Port This read-only field displays the port number. * Settings in this row apply to all ports. Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis. Note: Changes in this row are copied to all the ports as soon as you make them.
PAGE 251
CHAPTER 32 Differentiated Services This chapter shows you how to configure Differentiated Services (DiffServ) on the Switch. 32.1 DiffServ Overview Quality of Service (QoS) is used to prioritize source-to-destination traffic flows. All packets in the flow are given the same priority. You can use CoS (class of service) to give different priorities to different packet types.
PAGE 252
Chapter 32 Differentiated Services 32.1.2 DiffServ Network Example The following figure depicts a DiffServ network consisting of a group of directly connected DiffServ-compliant network devices. The boundary node (A in Figure 139) in a DiffServ network classifies (marks with a DSCP value) the incoming packets into different traffic flows (Platinum, Gold, Silver, Bronze) based on the configured marking rules. A network administrator can then apply various traffic policies to the traffic flows.
PAGE 253
Chapter 32 Differentiated Services • Green (low loss priority level) packets are forwarded. TRTCM operates in one of two modes: color-blind or color-aware. In color-blind mode, packets are marked based on evaluating against the PIR and CIR regardless of if they have previously been marked or not. In the color-aware mode, packets are marked based on both existing color and evaluation against the PIR and CIR. If the packets do not match any of colors, then the packets proceed unchanged. 32.2.
PAGE 254
Chapter 32 Differentiated Services 32.3 Activating DiffServ Activate DiffServ to apply marking rules or IEEE 802.1p priority mapping on the selected port(s). Click IP Application > DiffServ in the navigation panel to display the screen as shown. Figure 142 IP Application > DiffServ The following table describes the labels in this screen. Table 96 IP Application > DiffServ LABEL DESCRIPTION Active Select this option to enable DiffServ on the Switch.
PAGE 255
Chapter 32 Differentiated Services " You cannot enable both TRTCM and Bandwidth Control at the same time. Figure 143 IP Application > DiffServ > 2-rate 3 Color Marker The following table describes the labels in this screen. Table 97 IP Application > DiffServ > 2-rate 3 Color Marker LABEL DESCRIPTION Active Select this to activate TRTCM (Two Rate Three Color Marker) on the Switch. The Switch evaluates and marks the packets based on the TRTCM settings.
PAGE 256
Chapter 32 Differentiated Services Table 97 IP Application > DiffServ > 2-rate 3 Color Marker (continued) LABEL DESCRIPTION DSCP Use this section to specify the DSCP values that you want to assign to packets based on the color they are marked via TRTCM. green Specify the DSCP value to use for packets with low packet loss priority. yellow Specify the DSCP value to use for packets with medium packet loss priority. red Specify the DSCP value to use for packets with high packet loss priority.
PAGE 257
Chapter 32 Differentiated Services The following table describes the labels in this screen. Table 99 IP Application > DiffServ > DSCP Setting LABEL DESCRIPTION 0 … 63 This is the DSCP classification identification number. To set the IEEE 802.1p priority mapping, select the priority level from the drop-down list box. Apply Click Apply to save your changes to the Switch’s run-time memory.
PAGE 258
Chapter 32 Differentiated Services 258 GS-4012F/4024 User’s Guide
PAGE 259
CHAPTER 33 DHCP This chapter shows you how to configure the DHCP feature. 33.1 DHCP Overview DHCP (Dynamic Host Configuration Protocol RFC 2131 and RFC 2132) allows individual computers to obtain TCP/IP configuration at start-up from a server. You can configure the Switch as a DHCP server or a DHCP relay agent. When configured as a server, the Switch provides the TCP/IP configuration for the clients.
PAGE 260
Chapter 33 DHCP 33.2 DHCP Status Click IP Application > DHCP in the navigation panel. The DHCP Status screen displays. Figure 145 IP Application > DHCP Status The following table describes the labels in this screen. Table 100 IP Application > DHCP Status LABEL DESCRIPTION Server Status This section displays configuration settings related to the Switch’s DHCP server mode. Index This is the index number. VID This field displays the VLAN ID for which the Switch is a DHCP server.
PAGE 261
Chapter 33 DHCP The following table describes the labels in this screen. Table 101 IP Application > DHCP Server Status Detail LABEL DESCRIPTION Start IP Address This field displays the starting IP address of the IP address pool configured for this DHCP server instance. End IP Address This field displays the last IP address of the IP address pool configured for this DHCP server instance. Subnet Mask This field displays the subnet mask value sent to clients from this DHCP server instance.
PAGE 262
Chapter 33 DHCP The DHCP Relay Agent Information feature adds an Agent Information field to the Option 82 field. The Option 82 field is in the DHCP headers of client DHCP request frames that the Switch relays to a DHCP server. Relay Agent Information can include the System Name of the Switch if you select this option. You can change the System Name in Basic Settings > General Setup.
PAGE 263
Chapter 33 DHCP Table 103 IP Application > DHCP > Global (continued) LABEL DESCRIPTION Apply Click Apply to save your changes to the Switch’s run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Save link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Cancel Click Cancel to begin configuring this screen afresh. 33.4.
PAGE 264
Chapter 33 DHCP 33.5 Configuring DHCP VLAN Settings Use this screen to configure your DHCP settings based on the VLAN domain of the DHCP clients. Click IP Application > DHCP in the navigation panel, then click the VLAN link In the DHCP Status screen that displays. " You must set up a management IP address for each VLAN that you want to configure DHCP settings for on the Switch. See Section 7.6 on page 83 for information on how to do this.
PAGE 265
Chapter 33 DHCP The following table describes the labels in this screen. Table 104 IP Application > DHCP > VLAN LABEL DESCRIPTION VID Enter the ID number of the VLAN to which these DHCP settings apply. DHCP Status Select whether the Switch should function as a DHCP Server or Relay for the specified VID. If you select Server then fields related to DHCP relay configuration are grayed out and vice versa.
PAGE 266
Chapter 33 DHCP 33.5.1 Example: DHCP Relay for Two VLANs The following example displays two VLANs (VIDs 1 and 2) for a campus network. Two DHCP servers are installed to serve each VLAN. The system is set up to forward DHCP requests from the dormitory rooms (VLAN 1) to the DHCP server with an IP address of 192.168.1.100. Requests from the academic buildings (VLAN 2) are sent to the other DHCP server with an IP address of 172.23.10.100. Figure 151 DHCP Relay for Two VLANs DHCP:192.168.1.
PAGE 267
CHAPTER 34 VRRP This chapter shows you how to configure and monitor the Virtual Router Redundancy Protocol (VRRP) on the Switch. 34.1 VRRP Overview Each host on a network is configured to send packets to a statically configured default gateway (this Switch). The default gateway can become a single point of failure. Virtual Router Redundancy Protocol (VRRP), defined in RFC 2338, allows you to create redundant backup gateways to ensure that the default gateway of a host is always available.
PAGE 268
Chapter 34 VRRP If switch A (the master router) is unavailable, switch B takes over. Traffic is then processed by switch B. 34.2 VRRP Status Click IP Application, VRRP in the navigation panel to display the VRRP Status screen as shown next. Figure 154 VRRP Status The following table describes the labels in this screen. Table 105 VRRP Status 268 LABEL DESCRIPTION Index This field displays the index number of a rule.
PAGE 269
Chapter 34 VRRP 34.3 VRRP Configuration The following sections describe the different parts of the VRRP Configuration screen. 34.3.1 IP Interface Setup Before configuring VRRP, first create an IP interface (or routing domain) in the IP Setup screen (see the Section 7.6 on page 83 for more information). Click IP Application, VRRP and click the Configuration link to display the VRRP Configuration screen as shown next. " " You can only configure VRRP on interfaces with unique VLAN IDs.
PAGE 270
Chapter 34 VRRP Table 106 VRRP Configuration: IP Interface LABEL DESCRIPTION Index This field displays the index number of an entry. Network This field displays the IP address and number of subnet mask bit of an IP domain. Authentication Select None to disable authentication. This is the default setting. Select Simple to use a simple password to authenticate VRRP packet exchanges on this interface.
PAGE 271
Chapter 34 VRRP 34.3.3 Configuring VRRP Parameters After you set up an IP interface, configure the VRRP parameters in the VRRP Configuration screen. Figure 156 VRRP Configuration: VRRP Parameters The following table describes the labels in this screen. Table 107 VRRP Configuration: VRRP Parameters LABEL DESCRIPTION Active Select this option to enable this VRRP entry. Name Enter a descriptive name (up to 32 printable ASCII characters) for identification purposes.
PAGE 272
Chapter 34 VRRP 34.4 VRRP Configuration Summary To view a summary of all VRRP configurations on the Switch, scroll down to the bottom of the VRRP Configuration screen. Figure 157 VRRP Configuration: Summary The following table describes the labels in this screen. Table 108 VRRP Configuring: VRRP Parameters LABEL DESCRIPTION Index This field displays the index number of an entry. Active This field shows whether a VRRP entry is enabled (Yes) or disabled (No).
PAGE 273
Chapter 34 VRRP Figure 158 VRRP Configuration Example: One Virtual Router Network 172.21.1.1 172.21.1.100 172.21.1.10 You want to set switch A as the master router. Configure the VRRP parameters in the VRRP Configuration screens on the switches as shown in the figures below.
PAGE 274
Chapter 34 VRRP Figure 162 VRRP Example 1: VRRP Status on Switch B 34.5.2 Two Subnets Example The following figure depicts an example in which two switches share the network traffic. Hosts in the two network groups use different default gateways. Each switch is configured to backup a virtual router using VRRP. You wish to configure switch A as the master router for virtual router VR1 and as a backup for virtual router VR2. On the other hand, switch B is the master for VR2 and a backup for VR1.
PAGE 275
Chapter 34 VRRP Figure 165 VRRP Example 2: VRRP Parameter Settings for VR2 on Switch B After configuring and saving the VRRP configuration, the VRRP Status screens for both switches are shown next.
PAGE 276
Chapter 34 VRRP 276 GS-4012F/4024 User’s Guide
PAGE 277
P ART V Management, CLI, Troubleshooting Maintenance (279) Access Control (285) Diagnostic (303) Syslog (305) Cluster Management (309) MAC Table (315) IP Table (317) ARP Table (319) Routing Table (321) Configure Clone (323) Introducing Commands (325) User and Enable Mode Commands (377) Configuration Mode Commands (383) Interface Commands (395) IEEE 802.
PAGE 278
PAGE 279
CHAPTER 35 Maintenance This chapter explains how to configure the screens that let you maintain the firmware and configuration files. 35.1 The Maintenance Screen Use this screen to manage firmware and your configuration files. Click Management, Maintenance in the navigation panel to open the following screen. Figure 168 Maintenance The following table describes the labels in this screen.
PAGE 280
Chapter 35 Maintenance Table 109 Maintenance (continued) LABEL DESCRIPTION Save Configuration Click Config 1 to save the current configuration settings to Configuration 1 on the Switch. Click Config 2 to save the current configuration settings to Configuration 2 on the Switch. Reboot System Click Config 1 to reboot the system and load Configuration 1 on the Switch. Click Config 2 to reboot the system and load Configuration 2 on the Switch.
PAGE 281
Chapter 35 Maintenance 35.4 Reboot System Reboot System allows you to restart the Switch without physically turning the power off. It also allows you to load configuration one (Config 1) or configuration two (Config 2) when you reboot. Follow the steps below to reboot the Switch. 1 In the Maintenance screen, click the Config 1 button next to Reboot System to reboot and load configuration one. The following screen displays.
PAGE 282
Chapter 35 Maintenance 35.6 Restore a Configuration File Restore a previously saved configuration from your computer to the Switch using the Restore Configuration screen. Figure 172 Restore Configuration Type the path and file name of the configuration file you wish to restore in the File Path text box or click Browse to display the Choose File screen (below) from which you can locate it. After you have specified the file, click Restore.
PAGE 283
Chapter 35 Maintenance 35.8 FTP Command Line This section shows some examples of uploading to or downloading files from the Switch using FTP commands. First, understand the filename conventions. 35.8.1 Filename Conventions The configuration file (also known as the romfile or ROM) contains the factory default settings in the screens such as password, Switch setup, IP Setup, and so on. Once you have customized the Switch’s settings, they can be saved back to your computer under a filename of your choosing.
PAGE 284
Chapter 35 Maintenance 5 Enter bin to set transfer mode to binary. 6 Use put to transfer files from the computer to the Switch, for example, put firmware.bin ras transfers the firmware on your computer (firmware.bin) to the Switch and renames it to “ras”. Similarly, put config.cfg config transfers the configuration file on your computer (config.cfg) to the Switch and renames it to “config”. Likewise get config config.
PAGE 285
CHAPTER 36 Access Control This chapter describes how to control access to the Switch. 36.1 Access Control Overview A console port and FTP are allowed one session each, Telnet and SSH share nine sessions, up to five Web sessions (five different usernames and passwords) and/or limitless SNMP access control sessions are allowed.
PAGE 286
Chapter 36 Access Control 36.3 About SNMP Simple Network Management Protocol (SNMP) is an application layer protocol used to manage and monitor TCP/IP-based devices. SNMP is used to exchange management information between the network management system (NMS) and a network element (NE). A manager station can manage and monitor the Switch through the network via SNMP version one (SNMPv1), SNMP version 2c or SNMP version 3. The next figure illustrates an SNMP management operation.
PAGE 287
Chapter 36 Access Control 36.3.1 SNMP v3 and Security SNMP v3 enhances security for SNMP management. SNMP managers can be required to authenticate with agents before conducting SNMP management sessions. Security can be further enhanced by encrypting the SNMP messages sent from the managers. Encryption protects the contents of the SNMP messages. When the contents of the SNMP messages are encrypted, only the intended recipients can read them. 36.3.
PAGE 288
Chapter 36 Access Control Table 113 SNMP System Traps (continued) OPTION OBJECT LABEL temperature TemperatureEventOn voltage reset timesync OBJECT ID DESCRIPTION GS-4012F: This trap is sent when the 1.3.6.1.4.1.890.1.5.8.20.37.2.1 temperature goes above or below the normal operating range. GS-4024: 1.3.6.1.4.1.890.1.5.8.13.37.2.1 TemperatureEventClear GS-4012F: This trap is sent when the 1.3.6.1.4.1.890.1.5.8.20.37.2.2 temperature returns to the normal operating range. GS-4024: 1.3.6.1.4.1.890.1.
PAGE 289
Chapter 36 Access Control Table 114 SNMP InterfaceTraps OPTION OBJECT LABEL OBJECT ID DESCRIPTION linkup linkUp 1.3.6.1.6.3.1.1.5.4 This trap is sent when the Ethernet link is up. LinkDownEventClear GS-4012F: 1.3.6.1.4.1.890.1.5.8.20.37.2.2 GS-4024: 1.3.6.1.4.1.890.1.5.8.13.37.2.2 This trap is sent when the Ethernet link is up. linkDown 1.3.6.1.6.3.1.1.5.3 This trap is sent when the Ethernet link is down. LinkDownEventOn GS-4012F: 1.3.6.1.4.1.890.1.5.8.20.37.2.1 GS-4024: 1.3.6.1.4.1.890.1.5.
PAGE 290
Chapter 36 Access Control Table 115 AAA Traps (continued) OPTION OBJECT LABEL OBJECT ID DESCRIPTION accounting RADIUSAccountingNotReach GS-4012F: This trap is sent when there is no ableEventOn 1.3.6.1.4.1.890.1.5.8.20.37.2.1 response message from the RADIUS accounting server. GS-4024: 1.3.6.1.4.1.890.1.5.8.13.37.2.1 RADIUSAccountingNotReach GS-4012F: This trap is sent when the RADIUS ableEventClear 1.3.6.1.4.1.890.1.5.8.20.37.2.2 accounting server can be reached. GS-4024: 1.3.6.1.4.1.890.1.5.8.13.37.
PAGE 291
Chapter 36 Access Control Table 117 SNMP Switch Traps OPTION OBJECT LABEL OBJECT ID DESCRIPTION stp STPNewRoot 1.3.6.1.2.1.17.0.1 This trap is sent when the STP root switch changes. MRSTPNewRoot GS-4012F: This trap is sent when the MRSTP 1.3.6.1.4.1.890.1.5.8.20.43.2.1 root switch changes. GS-4024: 1.3.6.1.4.1.890.1.5.8.13.43.2.1 MSTPNewRoot GS-4012F: 1.3.6.1.4.1.890.1.5.8.20.107.7 0.1 GS-4024: 1.3.6.1.4.1.890.1.5.8.13.107.7 0.1 This trap is sent when the MSTP root switch changes.
PAGE 292
Chapter 36 Access Control Figure 176 Access Control: SNMP The following table describes the labels in this screen. Table 118 Access Control: SNMP LABEL DESCRIPTION General Setting Use this section to specify the SNMP version and community (password) values. Version Select the SNMP version for the Switch. The SNMP version on the Switch must match the version on the SNMP manager. Choose SNMP version 2c (v2c), SNMP version 3 (v3) or both (v3v2c).
PAGE 293
Chapter 36 Access Control Table 118 Access Control: SNMP (continued) LABEL DESCRIPTION Port Enter the port number upon which the manager listens for SNMP traps. Username Enter the username to be sent to the SNMP manager along with the SNMP v3 trap. Note: This username must match an existing account on the Switch (configured in Management > Access Control > Logins screen). User Information Use this section to configure users for authentication with managers using SNMP v3.
PAGE 294
Chapter 36 Access Control Figure 177 Access Control: SNMP: Trap Group The following table describes the labels in this screen. Table 119 Access Control: SNMP: Trap Group LABEL DESCRIPTION Trap Destination IP Select one of your configured trap destination IP addresses. These are the IP addresses of the SNMP managers. You must first configure a trap destination IP address in the SNMP Setting screen. Use the rest of the screen to select which traps the Switch sends to that SNMP manager.
PAGE 295
Chapter 36 Access Control • A non-administrator (username is something other than admin) is someone who can view but not configure Switch settings. Click Access Control from the navigation panel and then click Logins from this screen. Figure 178 Access Control: Logins The following table describes the labels in this screen. Table 120 Access Control: Logins LABEL DESCRIPTION Administrator This is the default administrator account with the “admin” user name.
PAGE 296
Chapter 36 Access Control 36.4 SSH Overview Unlike Telnet or FTP, which transmit data in clear text, SSH (Secure Shell) is a secure communication protocol that combines authentication and data encryption to provide secure encrypted communication between two hosts over an unsecured network. Figure 179 SSH Communication Example 36.5 How SSH works The following table summarizes how a secure connection is established between two remote hosts.
PAGE 297
Chapter 36 Access Control 2 Encryption Method Once the identification is verified, both the client and server must agree on the type of encryption method to use. 3 Authentication and Data Transmission After the identification is verified and data encryption activated, a secure tunnel is established between the client and the server. The client then sends its authentication information (user name and password) to the server to log in to the server. 36.
PAGE 298
Chapter 36 Access Control Figure 181 HTTPS Implementation " If you disable HTTP in the Service Access Control screen, then the Switch blocks all HTTP connection attempts. 36.8 HTTPS Example If you haven’t changed the default HTTPS port on the Switch, then in your browser enter “https://Switch IP Address/” as the web site address where “Switch IP Address” is the IP address or domain name of the Switch you wish to access. 36.8.
PAGE 299
Chapter 36 Access Control 36.8.2 Netscape Navigator Warning Messages When you attempt to access the Switch HTTPS server, a Website Certified by an Unknown Authority screen pops up asking if you trust the server certificate. Click Examine Certificate if you want to verify that the certificate is from the Switch. If Accept this certificate temporarily for this session is selected, then click OK to continue in Netscape.
PAGE 300
Chapter 36 Access Control Figure 185 Example: Lock Denoting a Secure Connection 36.9 Service Port Access Control Service Access Control allows you to decide what services you may use to access the Switch. You may also change the default service port and configure “trusted computer(s)” for each service in the Remote Management screen (discussed later). Click Access Control to go back to the main Access Control screen.
PAGE 301
Chapter 36 Access Control The following table describes the fields in this screen. Table 121 Access Control: Service Access Control LABEL DESCRIPTION Services Services you may use to access the Switch are listed here. Active Select this option for the corresponding services that you want to allow to access the Switch. Service Port For Telnet, SSH, FTP, HTTP or HTTPS services, you may change the default service port by typing the new port number in the Server Port field.
PAGE 302
Chapter 36 Access Control Table 122 Access Control: Remote Management (continued) 302 LABEL DESCRIPTION Telnet/FTP/ HTTP/ICMP/ SNMP/SSH/ HTTPS Select services that may be used for managing the Switch from the specified trusted computers. Apply Click Apply to save your changes to the Switch’s run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Save link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
PAGE 303
CHAPTER 37 Diagnostic This chapter explains the Diagnostic screen. 37.1 Diagnostic Click Management, Diagnostic in the navigation panel to open this screen. Use this screen to check system logs, ping IP addresses or perform port tests. Figure 188 Diagnostic The following table describes the labels in this screen. Table 123 Diagnostic LABEL DESCRIPTION System Log Click Display to display a log of events in the multi-line text box. Click Clear to empty the text box and reset the syslog entry.
PAGE 304
Chapter 37 Diagnostic 304 GS-4012F/4024 User’s Guide
PAGE 305
CHAPTER 38 Syslog This chapter explains the syslog screens. 38.1 Syslog Overview The syslog protocol allows devices to send event notification messages across an IP network to syslog servers that collect the event messages. A syslog-enabled device can generate a syslog message and send it to a syslog server. Syslog is defined in RFC 3164. The RFC defines the packet format, content and system log related information of syslog messages. Each syslog message has a facility and severity level.
PAGE 306
Chapter 38 Syslog Figure 189 Syslog The following table describes the labels in this screen. Table 125 Syslog LABEL DESCRIPTION Syslog Select Active to turn on syslog (system logging) and then configure the syslog setting Logging Type This column displays the names of the categories of logs that the device can generate. Active Select this option to set the device to generate logs for the corresponding category.
PAGE 307
Chapter 38 Syslog Figure 190 Syslog: Server Setup The following table describes the labels in this screen. Table 126 Syslog: Server Setup LABEL DESCRIPTION Active Select this check box to have the device send logs to this syslog server. Clear the check box if you want to create a syslog server entry but not have the device send logs to it (you can edit the entry later). Server Address Enter the IP address of the syslog server.
PAGE 308
Chapter 38 Syslog 308 GS-4012F/4024 User’s Guide
PAGE 309
CHAPTER 39 Cluster Management This chapter introduces cluster management. 39.1 Cluster Management Status Overview Cluster Management allows you to manage switches through one Switch, called the cluster manager. The switches must be directly connected and be in the same VLAN group so as to be able to communicate with one another.
PAGE 310
Chapter 39 Cluster Management Figure 191 Clustering Application Example 39.2 Cluster Management Status Click Management, Cluster Management in the navigation panel to display the following screen. " A cluster can only have one manager.
PAGE 311
Chapter 39 Cluster Management The following table describes the labels in this screen. Table 128 Cluster Management: Status LABEL DESCRIPTION Status This field displays the role of this Switch within the cluster. Manager Member (you see this if you access this screen in the cluster member switch directly and not via the cluster manager) None (neither a manager nor a member of a cluster) Manager This field displays the cluster manager switch’s hardware MAC address.
PAGE 312
Chapter 39 Cluster Management Figure 194 Example: Uploading Firmware to a Cluster Member Switch C:\>ftp 192.168.1.1 Connected to 192.168.1.1. 220 Switch FTP version 1.0 ready at Thu Jan 1 00:58:46 1970 User (192.168.0.
PAGE 313
Chapter 39 Cluster Management Figure 195 Clustering Management Configuration The following table describes the labels in this screen. Table 130 Clustering Management Configuration LABEL DESCRIPTION Clustering Manager Active Select Active to have this Switch become the cluster manager switch. A cluster can only have one manager. Other (directly connected) switches that are set to be cluster managers will not be visible in the Clustering Candidates list.
PAGE 314
Chapter 39 Cluster Management Table 130 Clustering Management Configuration (continued) LABEL DESCRIPTION Apply Click Apply to save your changes to the Switch’s run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Save link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Cancel Click Cancel to begin configuring this screen afresh.
PAGE 315
CHAPTER 40 MAC Table This chapter introduces the MAC Table screen. 40.1 MAC Table Overview The MAC Table screen (a MAC table is also known as a filtering database) shows how frames are forwarded or filtered across the Switch’s ports. It shows what device MAC address, belonging to what VLAN group (if any) is forwarded to which port(s) and whether the MAC address is dynamic (learned by the Switch) or static (manually entered in the Static MAC Forwarding screen).
PAGE 316
Chapter 40 MAC Table 40.2 Viewing the MAC Table Click Management, MAC Table in the navigation panel to display the following screen. Figure 197 MAC Table The following table describes the labels in this screen. Table 131 MAC Table 316 LABEL DESCRIPTION Sort by Click one of the following buttons to display and arrange the data according to that button type. The information is then displayed in the summary table below. MAC Click this button to display and arrange the data according to MAC address.
PAGE 317
CHAPTER 41 IP Table This chapter introduces the IP table. 41.1 IP Table Overview The IP Table screen shows how packets are forwarded or filtered across the Switch’s ports. It shows what device IP address, belonging to what VLAN group (if any) is forwarded to which port(s) and whether the IP address is dynamic (learned by the Switch) or static (belonging to the Switch). The Switch uses the IP table to determine how to forward packets. See the following figure.
PAGE 318
Chapter 41 IP Table 41.2 Viewing the IP Table Click Management, IP Table in the navigation panel to display the following screen. Figure 199 IP Table The following table describes the labels in this screen. Table 132 IP Table 318 LABEL DESCRIPTION Sort by Click one of the following buttons to display and arrange the data according to that button type. The information is then displayed in the summary table below. IP Click this button to display and arrange the data according to IP address.
PAGE 319
CHAPTER 42 ARP Table This chapter introduces ARP Table. 42.1 ARP Table Overview Address Resolution Protocol (ARP) is a protocol for mapping an Internet Protocol address (IP address) to a physical machine address, also known as a Media Access Control or MAC address, on the local area network. An IP (version 4) address is 32 bits long. In an Ethernet LAN, MAC addresses are 48 bits long. The ARP Table maintains an association between each MAC address and its corresponding IP address. 42.1.
PAGE 320
Chapter 42 ARP Table Figure 200 ARP Table The following table describes the labels in this screen. Table 133 ARP Table 320 LABEL DESCRIPTION Index This is the ARP Table entry number. IP Address This is the learned IP address of a device connected to a Switch port with corresponding MAC address below. MAC Address This is the MAC address of the device with corresponding IP address above.
PAGE 321
CHAPTER 43 Routing Table This chapter introduces the routing table. 43.1 Overview The routing table contains the route information to the network(s) that the Switch can reach. The Switch automatically updates the routing table with the RIP information received from other Ethernet devices. 43.2 Viewing the Routing Table Use this screen to view routing table information. Click Management, Routing Table in the navigation panel to display the screen as shown.
PAGE 322
Chapter 43 Routing Table 322 GS-4012F/4024 User’s Guide
PAGE 323
CHAPTER 44 Configure Clone This chapter shows you how you can copy the settings of one port onto other ports. 44.1 Configure Clone Cloning allows you to copy the basic and advanced settings from a source port to a destination port or ports. Click Management, Configure Clone to open the following screen.
PAGE 324
Chapter 44 Configure Clone The following table describes the labels in this screen. Table 135 Configure Clone 324 LABEL DESCRIPTION Source/ Destination Port Enter the source port under the Source label. This port’s attributes are copied. Enter the destination port or ports under the Destination label. These are the ports which are going to have the same attributes as the source port. You can enter individual ports separated by a comma or a range of ports by using a dash.
PAGE 325
CHAPTER 45 Introducing Commands This chapter introduces commands and gives a summary of commands available. 45.1 Overview In addition to the web configurator, you can use commands to configure the Switch. Use commands for advanced Switch diagnosis and troubleshooting. If you have problems with your Switch, customer support may request that you issue some of these commands to assist them in troubleshooting.
PAGE 326
Chapter 45 Introducing Commands • • • • • 9600 bps No parity 8 data bits 1 stop bit No flow control 45.2.1.1 Initial Screen When you turn on your Switch, it performs several internal tests as well as line initialization. You can view the initialization information using the console port. After the initialization, the login screen displays (refer to Section 45.3 on page 326). Copyright (c) 1994 - 2007 ZyXEL Communications Corp.
PAGE 327
Chapter 45 Introducing Commands • The required fields in a command are enclosed in angle brackets <>, for instance, ping means that you must specify an IP number for this command. • The optional fields in a command are enclosed in square brackets [], for instance, configure snmp-server [contact ] [location ] • • • • • • • means that the contact and location fields are optional. “Command” refers to a command used in the command line interface (CLI command).
PAGE 328
Chapter 45 Introducing Commands 45.7 Privilege Levels You can use a command whose privilege level is equal to or less than that of your login account. For example, if your login account has a privilege level of 12, you can use all commands with privilege levels from 0 to 12. 0 privilege level commands are available to all login accounts.
PAGE 329
Chapter 45 Introducing Commands The following table describes command interpreter modes and how to access them. Table 136 Command Interpreter Mode Summary MODE .DESCRIPTION HOW TO LOGIN/ ACCESS PROMPT User Commands available in this mode are a subset of enable mode. You can perform basic tests and display general system information. Default login level for a read-only account. sysname> The first part of the prompt is the system name.
PAGE 330
Chapter 45 Introducing Commands 45.9.1 List of Available Commands Enter “help” to display a list of available commands and the corresponding sub commands. sysname> help Commands available: help logout exit history enable show ip show hardware-monitor show system-information show alarm-status show cpu-utilization show version flash show version ping ping [vlan ][..
PAGE 331
Chapter 45 Introducing Commands Enter help to display detailed sub commands and parameters. sysname> ping help Commands available: ping < [ in-band|out-of-band|vlan ] [ size <0-1472> ] [ -t ] > sysname> Enter ? to display detailed help information about the sub commands and parameters. sysname> ping ? help destination ip address Description of ping help sysname> 45.
PAGE 332
Chapter 45 Introducing Commands " You must save your changes after each CLI session. All unsaved configuration changes are lost once you restart the Switch. sysname# write memory 45.11.1 Switch Configuration File When you configure the Switch using either the CLI (Command Line Interface) or web configurator, the settings are saved as a series of commands in a configuration file on the Switch.
PAGE 333
Chapter 45 Introducing Commands 45.12.1 User Mode The following table describes the commands available for User mode. Table 137 Command Summary: User Mode COMMAND DESCRIPTION PRIVILEG E help Displays help information. 0 logout Exits from the CLI. 0 exit Logs out from the CLI. 0 history Displays a list of previously command(s) that you have executed. The Switch stores up to 256 commands in history. 0 Accesses Enable (or privileged) mode. See Section 45.12.2 on page 334.
PAGE 334
Chapter 45 Introducing Commands 45.12.2 Enable Mode The following table describes the commands available for Enable mode. Table 138 Command Summary: Enable Mode COMMAND DESCRIPTION PRIVILEGE baudrate <1|2|3|4|5> Changes the console port speed. Choices are 1 (9600), 2 (19200), 3(38400), 4 (57600) and 5 (115200). 13 Restarts the system with the specified configuration file. 13 boot config clear arp inspection filter Delete all ARP inspection filters from the Switch.
PAGE 335
Chapter 45 Introducing Commands Table 138 Command Summary: Enable Mode (continued) COMMAND DESCRIPTION PRIVILEGE <0-14> Accesses Enable mode commands up to the privilege level specified. 0 running-config Resets to the factory default settings. 13 help Displays help information for this command. 13 interface portchannel [bandwidthlimit...] Resets to the factory default settings on a per port basis and optionally on a per feature configuration basis.
PAGE 336
Chapter 45 Introducing Commands Table 138 Command Summary: Enable Mode (continued) COMMAND DESCRIPTION PRIVILEGE Loads dynamic bindings from the specified DHCP snooping database. 13 authentication Displays whether authentication and privilege checking is enabled on the Switch and what methods are used for authentication. 3 authentication enable Displays the authentication method(s) for checking privilege level of admnistrators.
PAGE 337
Chapter 45 Introducing Commands Table 138 Command Summary: Enable Mode (continued) COMMAND DESCRIPTION PRIVILEGE statistics Displays statistics regarding the total number of ARP packets received on the Switch. 3 statistics vlan Displays statistics regarding the total number of ARP packets received on the Switch based on the VLAN(s) specified. 3 vlan Displays ARP inspection settings for the specified VLAN(s). 3 Displays all classifier related information.
PAGE 338
Chapter 45 Introducing Commands Table 138 Command Summary: Enable Mode (continued) COMMAND DESCRIPTION PRIVILEGE Displays the configuration details of each OAM activated port. 3 Displays GARP information. 3 Displays current hardware monitor information with the specified temperature unit (Celsius C or Fahrenheit F). 0 Displays the HTTPS information. 3 certificate Displays the HTTPS certificates. 3 key Displays the HTTPS key. 3 session Displays current HTTPS session(s).
PAGE 339
Chapter 45 Introducing Commands Table 138 Command Summary: Enable Mode (continued) COMMAND DESCRIPTION PRIVILEGE dvmrp neighbor Displays DVMRP neighbor information. 3 dvmrp prune Displays the DVMRP prune information. 3 dvmrp route Displays the DVMRP routes. 3 igmp group Displays multicast group details for each port(s). 3 igmp interface Displays IGMP settings for each IP interface.
PAGE 340
Chapter 45 Introducing Commands Table 138 Command Summary: Enable Mode (continued) COMMAND DESCRIPTION PRIVILEGE logins Displays login account information. 3 loopguard Displays which ports have loopguard enabled as well as their status. 3 address-table Displays MAC address table. You can sort by MAC address, VID or port. 3 address-table count Displays the total number of MAC addresses in the MAC address table.
PAGE 341
Chapter 45 Introducing Commands Table 138 Command Summary: Enable Mode (continued) COMMAND DESCRIPTION PRIVILEGE Displays the specified MVR group settings. 3 Displays all policy related information. 3 Displays the specified policy related information. 3 Displays all port authentication settings. 3 Displays port authentication settings on the specified port(s). 3 Displays all port security settings. 3 Displays port security settings on the specified port(s).
PAGE 342
Chapter 45 Introducing Commands Table 138 Command Summary: Enable Mode (continued) COMMAND DESCRIPTION PRIVILEGE known-hosts Displays known SSH hosts information. 3 key Displays internal SSH public and private key information. 3 session Displays current SSH session(s). 3 subnet-vlan Displays subnet based VLAN settings on the Switch. 3 systeminformation Displays general system information. 0 tacacs-server Displays TACACS+ server settings.
PAGE 343
Chapter 45 Introducing Commands Table 138 Command Summary: Enable Mode (continued) COMMAND write memory DESCRIPTION PRIVILEGE Saves current configuration to the configuration file the Switch is currently using. 13 Saves current configuration to the specified configuration file on the Switch. 13 45.12.3 General Configuration Mode The following table lists the commands in Configuration (or Config) mode.
PAGE 344
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND authentication adminpassword DESCRIPTION PRIVILEGE update periodic <1-2147483647> Sets the update period for accounting sessions. This is the time the Switch waits to send an update to an accounting server after a session starts. 13 enable [ []] Enables authorization for executing commands on the Switch and specifies which method should be used first second and third.
PAGE 345
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND DESCRIPTION PRIVILEGE Enables logging of ARP inspection events on the specified VLAN(s). Optionally specifies which types of events to log. 13 bandwidthcontrol Enables bandwidth control. 13 bcptransparenc y Enables Bridge Control Protocol (BCP) transparency. 13 <[packetformat <802.3untag|802.
PAGE 346
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND DESCRIPTION PRIVILEGE member password Sets the cluster member. 13 name Sets a descriptive name for the cluster. 13 rcommand Logs into the CLI of the specified cluster member. 13 defaultmanagement Specifies through which traffic flow the Switch is to send packets.
PAGE 347
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND DESCRIPTION PRIVILEGE helper-address [] [] Sets the IP addresses of up to 3 DHCP servers. 13 information Allows the Switch to add system name to agent information. 13 option Allows the Switch to add DHCP relay agent information. 13 Enables DHCP Snooping on the Switch.
PAGE 348
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND DESCRIPTION PRIVILEGE help Displays help information. 0 history Displays a list of previous command(s) that you have executed. 0 hostname Sets the Switch’s name for identification purposes. 13 https cert-regeneration Re-generates a certificate. 13 timeout <0-65535> Sets the HTTPS timeout period. 13 Enables IGMP filtering on the Switch.
PAGE 349
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND DESCRIPTION PRIVILEGE default-gateway Sets the default gateway’s IP address for the out-of-band management port. 13 name-server Sets the IP address of a domain name server. 13 route Creates a static route. 13 [metric ] [name ] [inactive] Sets the metric of a static route or deactivates a static route.
PAGE 350
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND DESCRIPTION PRIVILEGE Configures a static MAC address port filtering rule. 13 Disables a static MAC address port filtering rule. 13 Configures a static MAC address forwarding rule. 13 Disables a static MAC address forwarding rule. 13 Enables port mirroring. 13 Enables port mirroring on a specified port. 13 mode zynos Changes the CLI mode to the ZyNOS format.
PAGE 351
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND DESCRIPTION PRIVILEGE interface portchannel path-cost <1-65535> Assigns the path cost to the specified ports. 13 interface portchannel priority <1-255> Assigns priority to the specified ports. 13 max-hop <1-255> Sets the maximum hop value before BPDUs are discarded in the MST Region. 13 revision <0-65535> Sets the revision number for this MST Region configuration.
PAGE 352
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND DESCRIPTION PRIVILEGE log-buffer logs Resets the maximum number of syslog messages the Switch can send to the syslog server in one batch to the default value (4). 13 vlan Disables ARP inspection on the specified VLAN(s). 13 vlan logging Disables logging of messages generated by ARP inspection for the specified VLAN(s).
PAGE 353
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND DESCRIPTION PRIVILEGE vlan Specifies the VLAN IDs for VLANs you want to disable DHCP snooping on. 13 vlan information Sets the Switch to not add the system name to DHCP requests that it broadcasts to the DHCP VLAN, if specified, or VLAN.
PAGE 354
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND DESCRIPTION PRIVILEGE Enables a specified IP static route. 13 lacp Disables the link aggregation control protocol (dynamic trunking) on the Switch. 13 logins Disables login access to the specified name. 14 loopguard Disables loopguard on the Switch. 13 mac-authentication Disables MAC authentication on the Switch.
PAGE 355
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND DESCRIPTION PRIVILEGE Disables the assignment of specific ports from an MST instance. 13 multi-login Disables another administrator from logging into Telnet or the CLI. 14 mvr Removes an MVR configuration from the Switch. 13 password privilege <0-14> Disables a password to execute commands of the specified privilege level. 14 policy Deletes the policy.
PAGE 356
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND service-control snmp-server 356 DESCRIPTION PRIVILEGE ftp Disables FTP access to the Switch. 13 http Disables web browser control to the Switch. 13 https Disables secure web browser access to the Switch. 13 icmp Disables ICMP access to the Switch such as pinging and tracerouting. 13 snmp Disables SNMP management. 13 ssh Disables SSH (Secure Shell) server access to the Switch.
PAGE 357
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND DESCRIPTION PRIVILEGE Disables STP. 13 Disables STP on listed ports. 13 key Disables the secure shell server encryption key. Your Switch supports SSH versions 1 and 2 using RSA and DSA authentication. 13 known-hosts Removes the specified remote hosts from the list of all known hosts.
PAGE 358
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND DESCRIPTION PRIVILEGE interface Removes ports from the specified trunk group. 13 lacp Disables LACP in the specified trunk group. 13 vlan Deletes the static VLAN entry. 13 vlan1q gvrp Disables GVRP on the Switch. 13 port-isolation Disables port isolation. 13 vlan-stacking Disables VLAN stacking.
PAGE 359
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND policy DESCRIPTION PRIVILEGE Configures a policy. A classifier distinguishes traffic into flows based on the configured criteria. A policy rule ensures that a traffic flow gets the requested treatment in the network. 13 Enables 802.1x authentication on the Switch. 13 Enables 802.1x authentication on the specified port(s).
PAGE 360
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND DESCRIPTION PRIVILEGE portsecurity Enables port security on the device. 13 Enables port security on the specified port(s). 13 learn inactive Disables MAC address learning on the specified port(s). 13 address-limit Limits the number of (dynamic) MAC addresses that may be learned on a port.
PAGE 361
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND DESCRIPTION PRIVILEGE Enables and enters the IGMP configuration mode. 13 exit Leaves the IGMP configuration mode. 13 non-querier Sets the Switch to Non-Querier mode. (If a multicast router with a lower IP address, it will stop sending Query messages on that network.) 13 no non-querier Disables non-querier mode on the Switch, (a multicast router always sends Query messages).
PAGE 362
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND 362 DESCRIPTION PRIVILEGE area virtual-link message-digestkey md5 Enables MD5 authentication and sets the key ID and key for the virtual link in the area. 13 area virtual-link name Sets a descriptive name for the virtual link for identification purposes. 13 exit Leaves the router OSPF configuration mode.
PAGE 363
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND DESCRIPTION PRIVILEGE no network Deletes the OSPF network. 13 no redistribute rip Sets the Switch not to learn RIP routing information. 13 no redistribute static Sets the Switch not to learn static routing information. 13 redistribute Sets the Switch to learn RIP rip metric-type routing information which will use <1|2> metric <0- the specified metric information.
PAGE 364
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND servicecontrol snmp-server DESCRIPTION PRIVILEGE priority <1254> Sets the priority of the uplinkgateway. 13 secondaryvirtual-ip Sets the secondary VRRP virtual gateway IP address. 13 ftp Allows FTP access on the specified service port. 13 http Allows HTTP access on the specified service port and defines the timeout period.
PAGE 365
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND username version spanningtree DESCRIPTION PRIVILEGE interface Enables sending all interface type traps to a manager. 13 interface Enables sending all interface type traps to a manager. The options are “linkup”, “linkdown” and “autonegotiation”. 13 ip Enables sending all IP type traps to a manager. 13 ip Enables sending all IP type traps to a manager.
PAGE 366
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND DESCRIPTION PRIVILEGE priority <0-61440> Sets the bridge priority of the Switch. 13 known-hosts <1024|sshrsa|ssh-dsa> Adds a remote host to which the Switch can access using SSH service. 13 stormcontrol Enables broadcast storm control on the Switch. 13 subnetbased-vlan Enables subnet based VLAN on the Switch.
PAGE 367
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND DESCRIPTION PRIVILEGE Specifies the mode for TACACS+ server selection. 13 Sets the time in hour, minute and second format. 13 date Sets the date in year, month and day format. 13 daylight-savingtime Enables daylight saving time. 13 end-date Sets the day and time when Daylight Saving Time ends.
PAGE 368
Chapter 45 Introducing Commands Table 139 Command Summary: Configuration Mode (continued) COMMAND vlan-type DESCRIPTION PRIVILEGE Sets the SP TPID (Service Provider Tag Protocol Identifier). 13 <802.1q|portbased> Specifies the VLAN type. 13 45.12.4 interface port-channel Commands The following table lists the interface port-channel commands in configuration mode. Use these commands to configure the ports.
PAGE 369
Chapter 45 Introducing Commands Table 140 interface port-channel Commands (continued) COMMAND DESCRIPTION PRIVILEGE Sets the maximum bandwidth allowed for outgoing traffic on the port(s). 13 bpdu-control Sets how Bridge Protocol Data Units (BPDUs) are used in STP port states. 13 broadcast-limit Enables broadcast storm control limit on the port(s). 13 Specifies the maximum number of broadcast packets to allow through the port.
PAGE 370
Chapter 45 Introducing Commands Table 140 interface port-channel Commands (continued) COMMAND DESCRIPTION PRIVILEGE Enables strict priority queuing starting with the specified queue and subsequent higher queues on the Gigabit ports. 13 gvrp Enables this function to permit VLAN groups beyond the local Switch. 13 help Displays a description of the 13 interface port-channel commands. ge-spq Applies the specified IGMP filtering profile. 13 Enables the IGMP group limiting feature.
PAGE 371
Chapter 45 Introducing Commands Table 140 interface port-channel Commands (continued) COMMAND DESCRIPTION PRIVILEGE Sets a name for the port(s). Enter a descriptive name (up to nine printable ASCII characters). 13 arp inspection trust Disables this port from being a trusted port for ARP inspection. 13 arp inspection limit Resets the ARP inspection rate to the default (0). 13 bandwidth-limit Disables bandwidth limit on the port(s).
PAGE 372
Chapter 45 Introducing Commands Table 140 interface port-channel Commands (continued) COMMAND DESCRIPTION PRIVILEGE ingress-check Disables ingress checking on the port(s). 13 intrusion-lock Disables intrusion-lock on a port so that a port can be connected again after you disconnected the cable. 13 ipmc egressuntag-vlan Disables the port(s) from removing specified VLAN tag from IP multicasting packets before forwarding. 13 loopguard Disables the loop guard feature on the port(s).
PAGE 373
Chapter 45 Introducing Commands Table 140 interface port-channel Commands (continued) COMMAND DESCRIPTION PRIVILEGE priority <0-7> Sets the priority of the specified port(s) in VLAN stacking. 13 role Sets the VLAN stacking port roles of the specified port(s). 13 SPVID Sets the service provider VID of the specified port(s).
PAGE 374
Chapter 45 Introducing Commands Table 141 interface route-domain Commands (continued) COMMAND no 374 DESCRIPTION PRIVILEGE igmp query-maxresponse-time <1-25> Sets the maximum time that the router waits for a response to an general query message. 13 igmp last-memberquery-interval <1-25> Sets the amount of time in seconds that the router waits for a response to a group specific query message. 13 ospf authenticationkey Enables OSPF authentication in this routing domain.
PAGE 375
Chapter 45 Introducing Commands 45.12.6 config-vlan Commands The following table lists the vlan commands in configuration mode. Table 142 Command Summary: config-vlan Commands COMMAND DESCRIPTION PRIVILEGE vlan Creates a new VLAN group. 13 exit Leaves the VLAN configuration mode. 13 fixed Specifies the port(s) to be a permanent member of this VLAN group. 13 forbidden Specifies the port(s) you want to prohibit from joining this VLAN group.
PAGE 376
Chapter 45 Introducing Commands 45.13 mvr Commands The following table lists the mvr commands in configuration mode. Table 143 Command Summary: mvr Commands COMMAND DESCRIPTION PRIVILEG E mvr Enters the MVR (Multicast VLAN Registration) configuration mode. 13 exit Exist from the MVR configuration mode. 13 group start-address end-address Sets the multicast group range for the MVR. 13 inactive Disables MVR settings.
PAGE 377
CHAPTER 46 User and Enable Mode Commands This chapter describes some commands which you can perform in the User and Enable modes. 46.1 Overview The following command examples show how you can use User and Enable modes to diagnose and manage your Switch. 46.2 show Commands These are the commonly used show commands. 46.2.1 show system-information Syntax: show system-information This command shows the general system information (such as the firmware version and system up time). An example is shown next.
PAGE 378
Chapter 46 User and Enable Mode Commands 46.2.2 show ip Syntax: show ip This command displays the IP related information (such as IP address and subnet mask) on all Switch interfaces. The following figure shows the default interface settings. sysname> show ip Management IP Address IP[192.168.0.1], Netmask[255.255.255.0], VID[0] IP Interface IP[192.168.1.1], Netmask[255.255.255.0], VID[1] sysname> 46.2.3 show logging Syntax: show logging This command displays the system logs.
PAGE 379
Chapter 46 User and Enable Mode Commands This command displays statistics of a port. The following example shows that port 2 is up and the related information. sysname# show interface 2 Port Info Port NO.
PAGE 380
Chapter 46 User and Enable Mode Commands 46.3 ping Syntax: ping < [in-band|out-of-band|vlan ] [size -> <0-1472>] [-t]> where = The IP address or host name of an Ethernet device. [in-band|out-ofband|vlan ] = Specifies the network interface or the VLAN ID to which the Ethernet device belongs. out-of-band refers to the management port while in-band means the other ports on the Switch. [size <0-1472>] = Specifies the packet size to send.
PAGE 381
Chapter 46 User and Enable Mode Commands This command displays information about the route to an Ethernet device. The following example displays route information to an Ethernet device with an IP address of 192.168.1.100. sysname> traceroute 192.168.1.100 traceroute to 192.168.1.100, 30 hops max, 40 byte packet 1:192.168.1.100 (10 ms) (10 ms) (0 ms) traceroute done: sysname> 46.5 Copy Port Attributes Use the copy running-config command to copy attributes of one port to another port or ports.
PAGE 382
Chapter 46 User and Enable Mode Commands 46.6.1 Using a Different Configuration File You can store up to two configuration files on the Switch. Only one configuration file is used at a time. By default the Switch uses the first configuration file (with an index number of 1). You can set the Switch to use a different configuration file. There are two ways in which you can set the Switch to use a different configuration file: restart the Switch (cold reboot) and restart the system (warm reboot).
PAGE 383
CHAPTER 47 Configuration Mode Commands This chapter describes how to enable and configure your Switch’s features using commands. For more background information, see the feature specific chapters which proceed the commands chapters. 47.1 Change the Out of Band Management IP Address Use the ip address command to change the IP address of the out of band management port on the Switch. Syntax: ip address An example is shown next.
PAGE 384
Chapter 47 Configuration Mode Commands Syntax: igmp-snooping igmp-snooping igmp-snooping igmp-snooping igmp-snooping igmp-snooping 8021p-priority <0-7> host-timeout <1-16711450> leave-timeout <1-16711450> unknown-multicast-frame reserved-multicast-group where igmp-snooping = Enables IGMP snooping on the Switch. 8021p-priority = Sets a priority level (0-7) to which the Switch changes the priority in outgoing IGMP control packets.
PAGE 385
Chapter 47 Configuration Mode Commands where igmp filtering = Enables IGMP filtering on the Switch profile = Specifies a name (up to 32 alphanumeric characters) for this IGMP profile. If you want to edit an existing IGMP profile enter the existing profile name followed by start-address and end-address parameters. start-address = Specifies the starting multicast IP address for a range of multicast IP addresses that you want to belong to the IGMP filter profile. IP address in the range 224.0.0.
PAGE 386
Chapter 47 Configuration Mode Commands where spanning-tree = Enables a specific tree configuration. mrstp priority <0-61440> Enables STP on the Switch. = Specifies the bridge priority for the Switch. The lower the numeric value you assign, the higher the priority for this bridge. Bridge priority is used in determining the root switch, root port and designated port. The Switch with the highest priority (lowest numeric value) becomes the STP root switch.
PAGE 387
Chapter 47 Configuration Mode Commands • Enable STP on port 5 with a path cost of 150. • Set the priority for port 5 to 20. sysname(config)# sysname(config)# 15 sysname(config)# sysname(config)# spanning-tree priority 0 spanning-tree hello-time 4 maximum-age 20 forward-delay spanning-tree 5 path-cost 150 spanning-tree 5 priority 20 47.5 no Command Examples These are the commonly used command examples that belong to the no group of commands.
PAGE 388
Chapter 47 Configuration Mode Commands where = inactive Re-enables an ip route with the specified IP address and subnet mask. An example is shown next. • Enable the IP route with the IP address of 192.168.11.1 and subnet mask of 255.255.255.0. This ip route must have already been created and made inactive prior to re-enable command being applied. sysname(config)# no ip route 192.168.11.1 255.255.255.0 inactive 47.5.
PAGE 389
Chapter 47 Configuration Mode Commands where = Disables port authentication on the Switch. reauthenticate = Disables the re-authentication mechanism on the listed port(s). = Disables authentication on the listed ports. An example is shown next. • Disable authentication on the Switch. • Disable re-authentication on ports one, three, four and five. • Disable authentication on ports one, six and seven.
PAGE 390
Chapter 47 Configuration Mode Commands 47.6 Static Route Commands You can create and configure static routes on the Switch by using the ip route command. Syntax: ip route ip route [metric ][name ] --> [inactive] where = Specifies the network IP address of the final destination. = Specifies the subnet mask of this destination. = Specifies the IP address of the gateway.
PAGE 391
Chapter 47 Configuration Mode Commands where name = Names the filtering rule. mac = Specifies the MAC address you want to filter. vlan = Specifies which VLAN this rule applies to. drop = Selects the behavior of the rule. • src - drop packets coming from the specified MAC address • dst- drop packets going to the specified MAC address • both - drop packets coming from or going to the specified MAC address An example is shown next.
PAGE 392
Chapter 47 Configuration Mode Commands • Enable dynamic link aggregation (LACP) on trunk 1. sysname(config)# trunk t1 sysname(config)# trunk t1 interface 5-8 sysname(config)# trunk t1 lacp 47.9 Enabling Port Authentication To enable a port authentication, you need to specify your RADIUS server details and select the ports which require external authentication. You can set up multiple RADIUS servers and specify how the Switch will process authentication requests. 47.9.
PAGE 393
Chapter 47 Configuration Mode Commands radius-server timeout <11000> = Specifies the timeout period (in seconds) the Switch will wait for a response from a RADIUS server. If 2 RADIUS servers are configured, this is the total time the Switch will wait for a response from either server. mode = Specifies the way the Switch will process requests from the clients to the RADIUS server. (Only applicable with multiple RADIUS servers configured.
PAGE 394
Chapter 47 Configuration Mode Commands • Specify RADIUS server 1 with IP address 10.10.10.1, port 1890 and the string secretKey as the password. See Section 47.9.1 on page 392 for more information on RADIUS server commands. • Specify the timeout period of 30 seconds that the Switch will wait for a response from the RADIUS server. • Enable port authentication on ports 4 to 8. • Activate reauthentication on the ports. • Specify 1800 seconds as the interval for client reauthentication.
PAGE 395
CHAPTER 48 Interface Commands These are some commonly used configuration commands that belong to the interface group of commands. 48.1 Overview The interface commands allow you to configure the Switch on a port by port basis. 48.2 Interface Command Examples This section provides examples of some frequently used interface commands. 48.2.1 interface port-channel Use this command to enable the specified ports for configuration. Indicate multiple, nonsequential ports separated by a comma.
PAGE 396
Chapter 48 Interface Commands where = Type peer to process any BPDUs received on these ports. Type tunnel to forward BPDUs received on these ports. Type discard to drop any BPDUs received on these ports. Type network to process a BPDU with no VLAN tag and forward a tagged BPDU. An example is shown next. • Enable ports 1, 3, 4 and 5 for configuration. • Set the BPDU control to tunnel, to forward BPDUs received on ports one, three, four and five.
PAGE 397
Chapter 48 Interface Commands where pir = Sets the maximum bandwidth allowed for incoming traffic. cir = Sets the guaranteed bandwidth allowed for incoming traffic. egress = Sets the maximum bandwidth allowed for outgoing traffic (egress) on the Switch. An example is shown next. • • • • • Enable port one for configuration. Enable bandwidth control. Set the outgoing traffic bandwidth limit to 5000Kbps. Set the guaranteed bandwidth allowed for incoming traffic to 4000Kbps.
PAGE 398
Chapter 48 Interface Commands • Enable port mirroring for outgoing traffic. Traffic is copied from ports 1, 4, 5 and 6 to port three in order to examine it in more detail without interfering with the traffic flow on the original ports. sysname(config)# mirror-port sysname(config)# mirror-port 3 sysname(config)# interface port-channel 1,4-6 sysname(config-interface)# mirror sysname(config-interface)# mirror dir egress 48.2.
PAGE 399
Chapter 48 Interface Commands where = Choose to accept both tagged and untagged incoming frames, just tagged incoming frames or just untagged incoming frames on a port. An example is shown next. • Enable ports one, three, four and five for configuration. • Enable ingress checking on the ports. • Enable tagged frame-types on the interface. sysname(config)# interface port-channel 1,3-5 sysname(config-interface)# ingress-check sysname(config-interface)# frame-type tagged 48.2.
PAGE 400
Chapter 48 Interface Commands • Set the outgoing traffic ports as the CPU (0), seven (7) and eight (8). sysname(config)# vlan-type port-based sysname(config)# interface port-channel 1,3-5 sysname(config-interface)# egress set 0,7,8 48.2.11 qos priority Syntax: qos priority <0 .. 7> where <0 .. 7> = Sets the quality of service priority for a port. An example is shown next. • Enable ports one, three, four and five for configuration. • Set the IEEE 802.1p quality of service priority as four (4).
PAGE 401
Chapter 48 Interface Commands where = Sets the duplex mode (half or full) and speed (10, 100 or 1000 Mbps) of the connection on the port. Selecting auto (autonegotiation) makes one port able to negotiate with a peer automatically to obtain the connection speed and duplex mode that both ends support. An example is shown next. • Enable ports one, three, four and five for configuration. • Set the speed to 100 Mbps in half duplex mode.
PAGE 402
Chapter 48 Interface Commands Syntax: no bandwidth-limit An example is shown next: • Disable bandwidth limit on port1 sysname(config)# interface port-channel 1 sysname(config-interface)# no bandwidth-limit 402 GS-4012F/4024 User’s Guide
PAGE 403
CHAPTER 49 IEEE 802.1Q Tagged VLAN Commands This chapter describes the IEEE 802.1Q Tagged VLAN and associated commands. 49.1 Configuring Tagged VLAN The following procedure shows you how to configure tagged VLAN. 1 Use the IEEE 802.1Q tagged VLAN commands to configure tagged VLAN for the Switch. • Use the vlan command to configure or create a VLAN on the Switch. The Switch automatically enters the config-vlan mode.Use the inactive command to deactivate the VLAN(s).
PAGE 404
Chapter 49 IEEE 802.1Q Tagged VLAN Commands 49.2 Global VLAN1Q Tagged VLAN Configuration Commands This section shows you how to configure and monitor the IEEE 802.1Q Tagged VLAN. 49.2.1 GARP Status Syntax: show garp This command shows the Switch’s GARP timer settings, including the join, leave and leave all timers. An example is shown next. sysname# show garp GARP Timer -----------------------Join Timer = 200 Leave Timer = 600 Leave All Timer = 10000 sysname# 49.2.
PAGE 405
Chapter 49 IEEE 802.1Q Tagged VLAN Commands The following example sets the Join Timer to 300 milliseconds, the Leave Timer to 800 milliseconds and the Leave All Timer to 11000 milliseconds. sysname (config)# garp join 300 leave 800 leaveall 11000 49.2.3 GVRP Timer Syntax: show vlan1q gvrp This command shows the Switch’s GVRP settings. An example is shown next. sysname# show vlan1q gvrp GVRP Support --------------------gvrpEnable = YES sysname # 49.2.
PAGE 406
Chapter 49 IEEE 802.1Q Tagged VLAN Commands The following example sets the default VID to 200 on ports 1 to 5. sysname (config)# interface port-channel 1-5 sysname (config-interface)# pvid 200 49.3.2 Set Acceptable Frame Type Syntax: frame-type where = Specifies all Ethernet frames (tagged and untagged), only tagged Ethernet frames or only untagged Ethernet frames.
PAGE 407
Chapter 49 IEEE 802.1Q Tagged VLAN Commands where = The VLAN ID [1 – 4094]. = A name to identify the SVLAN entry. = This is the Switch port list. • Enter fixed to register the to the static VLAN table with . • Enter normal to confirm registration of the to the static VLAN table with . • Enter forbidden to block a from joining the static VLAN table with .
PAGE 408
Chapter 49 IEEE 802.1Q Tagged VLAN Commands 49.3.5 Delete VLAN ID Syntax: no vlan where = The VLAN ID [1 – 4094]. This command deletes the specified VLAN ID entry from the static VLAN table. The following example deletes entry 2 in the static VLAN table. sysname (config)# no vlan 2 49.4 Enable VLAN Syntax: vlan This command enables the specified VLAN ID in the SVLAN (Static VLAN) table. 49.
PAGE 409
Chapter 49 IEEE 802.1Q Tagged VLAN Commands • The TagCtl section of the last column shows which ports are tagged and which are untagged. sysname# show vlan The Number of VLAN: 3 Idx.
PAGE 410
Chapter 49 IEEE 802.
PAGE 411
CHAPTER 50 Multicast VLAN Registration Commands This chapter shows you how to use Multicast VLAN Registration (mvr) commands. 50.1 Overview Use the mvr commands in the configuration mode to create and configure multicast VLANs. " If you want to enable IGMP snooping see Section 47.2 on page 383. 50.2 Create Multicast VLAN Use the following commands in the config-mvr mode to configure a multicast VLAN group.
PAGE 412
Chapter 50 Multicast VLAN Registration Commands mode = Specifies dynamic (sends IGMP reports to all source ports in the multicast VLAN) or compatible (does not send IGMP reports). group name = A name to identify the MVR IP multicast group. start-address = Specifies the starting IP multicast address of the multicast group in dotted decimal notation. end-address = Specifies the ending IP multicast address of the multicast group in dotted decimal notation.
PAGE 413
CHAPTER 51 Routing Domain Command Examples 51.0.1 interface route-domain Syntax: interface route-domain / where = This is the IP address of the Switch in the routing domain. Specify the IP address is dotted decimal notation. For example, 192.168.1.1. = The number of bits in the subnet mask. Enter the subnet mask number preceded with a “/”. To find the bit number, convert the subnet mask to binary and add all of the 1’s together. Take “255.255.255.
PAGE 414
Chapter 51 Routing Domain Command Examples 414 GS-4012F/4024 User’s Guide
PAGE 415
CHAPTER 52 Troubleshooting This chapter covers potential problems and possible remedies. 52.1 Problems Starting Up the Switch Table 144 Troubleshooting the Start-Up of Your Switch PROBLEM CORRECTIVE ACTION None of the LEDs turn on when you turn on the Switch. Check the power connection and make sure the power source is turned on. If the error persists, you may have a hardware problem. In this case, you should contact your vendor. 52.
PAGE 416
Chapter 52 Troubleshooting 52.2.1 Pop-up Windows, JavaScripts and Java Permissions In order to use the web configurator you need to allow: • Web browser pop-up windows from your device. • JavaScripts (enabled by default). • Java permissions (enabled by default). " Internet Explorer 6 screens are used here. Screens for other Internet Explorer versions may vary. 52.2.1.1 Internet Explorer Pop-up Blockers You may have to disable pop-up blocking to log into your device.
PAGE 417
Chapter 52 Troubleshooting Figure 205 Internet Options 3 Click Apply to save this setting. 52.2.1.1.2 Enable pop-up Blockers with Exceptions Alternatively, if you only want to allow pop-up windows from your device, see the following steps. 1 In Internet Explorer, select Tools, Internet Options and then the Privacy tab. 2 Select Settings…to open the Pop-up Blocker Settings screen.
PAGE 418
Chapter 52 Troubleshooting Figure 206 Internet Options 3 Type the IP address of your device (the web page that you do not want to have blocked) with the prefix “http://”. For example, http://192.168.1.1. 4 Click Add to move the IP address to the list of Allowed sites. Figure 207 Pop-up Blocker Settings 5 Click Close to return to the Privacy screen.
PAGE 419
Chapter 52 Troubleshooting 6 Click Apply to save this setting. 52.2.1.2 JavaScripts If pages of the web configurator do not display properly in Internet Explorer, check that JavaScripts are allowed. 1 In Internet Explorer, click Tools, Internet Options and then the Security tab. Figure 208 Internet Options 2 3 4 5 6 Click the Custom Level... button. Scroll down to Scripting. Under Active scripting make sure that Enable is selected (the default).
PAGE 420
Chapter 52 Troubleshooting Figure 209 Security Settings - Java Scripting 52.2.1.3 Java Permissions 1 2 3 4 5 From Internet Explorer, click Tools, Internet Options and then the Security tab. Click the Custom Level... button. Scroll down to Microsoft VM. Under Java permissions make sure that a safety level is selected. Click OK to close the window.
PAGE 421
Chapter 52 Troubleshooting 52.2.1.3.1 JAVA (Sun) 1 From Internet Explorer, click Tools, Internet Options and then the Advanced tab. 2 Make sure that Use Java 2 for under Java (Sun) is selected. 3 Click OK to close the window. Figure 211 Java (Sun) 52.3 Problems with the Password Table 146 Troubleshooting the Password PROBLEM CORRECTIVE ACTION Cannot access the Switch. The password field is case sensitive. Make sure that you enter the correct password using the proper casing.
PAGE 422
Chapter 52 Troubleshooting 422 GS-4012F/4024 User’s Guide
PAGE 423
P ART VI Appendices and Index Product Specifications (425) IP Addresses and Subnetting (431) Common Services (441) Legal Information (445) Customer Support (449) Index (453) 423
PAGE 424
PAGE 425
APPENDIX A Product Specifications The following tables summarize the Switch’s hardware and firmware features. Table 147 Hardware Specifications SPECIFICATION DESCRIPTION Dimensions Standard 19” rack mountable GS-4012F: 438 mm (W) x 225 mm (D) x 44.45 mm (H) GS-4024: 438 mm (W) x 300 mm (D) x 44.45 mm (H) Weight GS-4012F: 3.1 Kg GS-4024: 4.2 Kg Power Specification One Backup Power Supply (BPS) connector GS-4012F AC: 100-240 VAC 50/60 Hz, 1.5 A Max. DC: -48 VDC ~ -60 VDC, 1.6 A Max.
PAGE 426
Appendix A Product Specifications Table 147 Hardware Specifications Power Wire Gauge 18 AWG or larger Fuse Specification 250 VAC, T2A Table 148 Firmware Specifications 426 FEATURE DESCRIPTION Default IP Address In band: 192.168.1.1 Out of band (Management port): 192.168.0.1 Default Subnet Mask 255.255.255.0 (24 bits) Administrator User Name admin Default Password 1234 Number of Login Accounts Configurable on the Switch 4 management accounts configured on the Switch.
PAGE 427
Appendix A Product Specifications Table 148 Firmware Specifications FEATURE DESCRIPTION Multicast VLAN Registration (MVR) Multicast VLAN Registration (MVR) is designed for applications (such as Media-on-Demand (MoD)) using multicast traffic across a network. MVR allows one single multicast VLAN to be shared among different subscriber VLANs on the network. This improves bandwidth utilization by reducing multicast traffic in the subscriber VLANs and simplifies multicast group management.
PAGE 428
Appendix A Product Specifications Table 148 Firmware Specifications FEATURE DESCRIPTION Firmware Upgrade Download new firmware (when available) from the ZyXEL web site and use the web configurator, CLI or an FTP/TFTP tool to put it on the Switch. Note: Only upload firmware for your specific model! Configuration Backup & Restoration Make a copy of the Switch’s configuration and put it back on the Switch later if you decide you want to revert back to an earlier configuration.
PAGE 429
Appendix A Product Specifications Table 149 Feature Specifications (continued) Layer 3 Features IP Capability IPV4 support 64 IP routing domains 8K IP address table Wire speed IP forwarding Routing protocols Unicast: RIP-V1/V2, OSPF V2 Multicast: DVMRP, IGMP V1/V2/V3 Static Routing VRRP IP services DHCP relay; VLAN based DHCP server/relay DHCP Snooping Security IEEE 802.
PAGE 430
Appendix A Product Specifications Table 150 Standards Supported (continued) 430 STANDARD DESCRIPTION RFC 3164 Syslog RFC 3376 Internet Group Management Protocol, Version 3 RFC 3414 User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMP v3) RFC 3580 RADIUS - Tunnel Protocol Attribute IEEE 802.1x Port Based Network Access Control IEEE 802.1D MAC Bridges IEEE 802.1p Traffic Types - Packet Priority IEEE 802.1Q Tagged VLAN IEEE 802.
PAGE 431
APPENDIX B IP Addresses and Subnetting This appendix introduces IP addresses and subnet masks. IP addresses identify individual devices on a network. Every networking device (including computers, servers, routers, printers, etc.) needs an IP address to communicate across the network. These networking devices are also known as hosts. Subnet masks determine the maximum number of possible hosts on a network. You can also use subnet masks to divide one network into multiple sub-networks.
PAGE 432
Appendix B IP Addresses and Subnetting Figure 212 Network Number and Host ID How much of the IP address is the network number and how much is the host ID varies according to the subnet mask. Subnet Masks A subnet mask is used to determine which bits are part of the network number, and which bits are part of the host ID (using a logical AND operation). The term “subnet” is short for “subnetwork”. A subnet mask has 32 bits.
PAGE 433
Appendix B IP Addresses and Subnetting Subnet masks are expressed in dotted decimal notation just like IP addresses. The following examples show the binary and decimal notation for 8-bit, 16-bit, 24-bit and 29-bit subnet masks. Table 152 Subnet Masks BINARY DECIMAL 1ST OCTET 2ND OCTET 3RD OCTET 4TH OCTET 8-bit mask 11111111 00000000 00000000 00000000 255.0.0.0 16-bit mask 11111111 11111111 00000000 00000000 255.255.0.0 24-bit mask 11111111 11111111 11111111 00000000 255.255.255.
PAGE 434
Appendix B IP Addresses and Subnetting Table 154 Alternative Subnet Mask Notation (continued) SUBNET MASK ALTERNATIVE NOTATION LAST OCTET (BINARY) LAST OCTET (DECIMAL) 255.255.255.192 /26 1100 0000 192 255.255.255.224 /27 1110 0000 224 255.255.255.240 /28 1111 0000 240 255.255.255.248 /29 1111 1000 248 255.255.255.252 /30 1111 1100 252 Subnetting You can use subnetting to divide one network into multiple sub-networks.
PAGE 435
Appendix B IP Addresses and Subnetting Figure 214 Subnetting Example: After Subnetting In a 25-bit subnet the host ID has 7 bits, so each sub-network has a maximum of 27 – 2 or 126 possible hosts (a host ID of all zeroes is the subnet’s address itself, all ones is the subnet’s broadcast address). 192.168.1.0 with mask 255.255.255.128 is subnet A itself, and 192.168.1.127 with mask 255.255.255.128 is its broadcast address.
PAGE 436
Appendix B IP Addresses and Subnetting Table 156 Subnet 2 IP/SUBNET MASK NETWORK NUMBER LAST OCTET BIT VALUE IP Address 192.168.1. 64 IP Address (Binary) 11000000.10101000.00000001. 01000000 Subnet Mask (Binary) 11111111.11111111.11111111. 11000000 Subnet Address: 192.168.1.64 Lowest Host ID: 192.168.1.65 Broadcast Address: 192.168.1.127 Highest Host ID: 192.168.1.126 Table 157 Subnet 3 IP/SUBNET MASK NETWORK NUMBER LAST OCTET BIT VALUE IP Address 192.168.1.
PAGE 437
Appendix B IP Addresses and Subnetting Table 159 Eight Subnets (continued) SUBNET SUBNET ADDRESS FIRST ADDRESS LAST ADDRESS BROADCAST ADDRESS 5 128 129 158 159 6 160 161 190 191 7 192 193 222 223 8 224 225 254 255 Subnet Planning The following table is a summary for subnet planning on a network with a 24-bit network number. Table 160 24-bit Network Number Subnet Planning NO. “BORROWED” HOST BITS SUBNET MASK NO. SUBNETS NO. HOSTS PER SUBNET 1 255.255.255.
PAGE 438
Appendix B IP Addresses and Subnetting Table 161 16-bit Network Number Subnet Planning (continued) NO. “BORROWED” HOST BITS SUBNET MASK NO. SUBNETS NO. HOSTS PER SUBNET 14 255.255.255.252 (/30) 16384 2 15 255.255.255.254 (/31) 32768 1 Configuring IP Addresses Where you obtain your network number depends on your particular situation.
PAGE 439
Appendix B IP Addresses and Subnetting IP Address Conflicts Each device on a network must have a unique IP address. Devices with duplicate IP addresses on the same network will not be able to access the Internet or other resources. The devices may also be unreachable through the network. Conflicting Computer IP Addresses Example More than one device can not use the same IP address.
PAGE 440
Appendix B IP Addresses and Subnetting Conflicting Computer and Router IP Addresses Example More than one device can not use the same IP address. In the following example, the computer and the router’s LAN port both use 192.168.1.1 as the IP address. The computer cannot access the Internet. This problem can be solved by assigning a different IP address to the computer or the router’s LAN port.
PAGE 441
APPENDIX C Common Services The following table lists some commonly-used services and their associated protocols and port numbers. For a comprehensive list of port numbers, ICMP type/code numbers and services, visit the IANA (Internet Assigned Number Authority) web site. • Name: This is a short, descriptive name for the service. You can use this one or create a different one, if you like. • Protocol: This is the type of IP protocol used by the service.
PAGE 442
Appendix C Common Services Table 162 Commonly Used Services (continued) 442 NAME PROTOCOL PORT(S) DESCRIPTION FTP TCP TCP 20 21 File Transfer Program, a program to enable fast transfer of files, including large files that may not be possible by e-mail. H.323 TCP 1720 NetMeeting uses this protocol. HTTP TCP 80 Hyper Text Transfer Protocol - a client/ server protocol for the world wide web. HTTPS TCP 443 HTTPS is a secured http session often used in e-commerce.
PAGE 443
Appendix C Common Services Table 162 Commonly Used Services (continued) NAME PROTOCOL PORT(S) DESCRIPTION RTELNET TCP 107 Remote Telnet. RTSP TCP/UDP 554 The Real Time Streaming (media control) Protocol (RTSP) is a remote control for multimedia on the Internet. SFTP TCP 115 Simple File Transfer Protocol. SMTP TCP 25 Simple Mail Transfer Protocol is the message-exchange standard for the Internet. SMTP enables you to move messages from one e-mail server to another.
PAGE 444
Appendix C Common Services 444 GS-4012F/4024 User’s Guide
PAGE 445
APPENDIX D Legal Information Copyright Copyright © 2007 by ZyXEL Communications Corporation. The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. Published by ZyXEL Communications Corporation.
PAGE 446
Appendix D Legal Information FCC Warning This device has been tested and found to comply with the limits for a Class A digital switch, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a commercial environment. This device generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications.
PAGE 447
Appendix D Legal Information condition. Any replacement will consist of a new or re-manufactured functionally equivalent product of equal or higher value, and will be solely at the discretion of ZyXEL. This warranty shall not apply if the product has been modified, misused, tampered with, damaged by an act of God, or subjected to abnormal working conditions. Note Repair or replacement, as provided under this warranty, is the exclusive remedy of the purchaser.
PAGE 448
Appendix D Legal Information 448 GS-4012F/4024 User’s Guide
PAGE 449
APPENDIX E Customer Support Please have the following information ready when you contact customer support. Required Information • • • • Product model and serial number. Warranty Information. Date that you received your device. Brief description of the problem and the steps you took to solve it. Corporate Headquarters (Worldwide) • • • • • • • Support E-mail: support@zyxel.com.tw Sales E-mail: sales@zyxel.com.tw Telephone: +886-3-578-3942 Fax: +886-3-578-2439 Web Site: www.zyxel.com, www.europe.zyxel.
PAGE 450
Appendix E Customer Support Denmark • • • • • • Support E-mail: support@zyxel.dk Sales E-mail: sales@zyxel.dk Telephone: +45-39-55-07-00 Fax: +45-39-55-07-07 Web Site: www.zyxel.dk Regular Mail: ZyXEL Communications A/S, Columbusvej, 2860 Soeborg, Denmark Finland • • • • • • Support E-mail: support@zyxel.fi Sales E-mail: sales@zyxel.fi Telephone: +358-9-4780-8411 Fax: +358-9-4780 8448 Web Site: www.zyxel.
PAGE 451
Appendix E Customer Support • • • • Telephone: +7-3272-590-698 Fax: +7-3272-590-689 Web Site: www.zyxel.kz Regular Mail: ZyXEL Kazakhstan, 43, Dostyk ave.,Office 414, Dostyk Business Centre, 050010, Almaty, Republic of Kazakhstan North America • • • • • • • Support E-mail: support@zyxel.com Sales E-mail: sales@zyxel.com Telephone: +1-800-255-4101, +1-714-632-0882 Fax: +1-714-632-0858 Web Site: www.us.zyxel.com FTP Site: ftp.us.zyxel.com Regular Mail: ZyXEL Communications Inc., 1130 N. Miller St.
PAGE 452
Appendix E Customer Support • Web Site: www.zyxel.es • Regular Mail: ZyXEL Communications, Arte, 21 5ª planta, 28033 Madrid, Spain Sweden • • • • • • Support E-mail: support@zyxel.se Sales E-mail: sales@zyxel.se Telephone: +46-31-744-7700 Fax: +46-31-744-7701 Web Site: www.zyxel.se Regular Mail: ZyXEL Communications A/S, Sjöporten 4, 41764 Göteborg, Sweden Ukraine • • • • • • Support E-mail: support@ua.zyxel.com Sales E-mail: sales@ua.zyxel.
PAGE 453
Index Index Numerics 802.1P priority 87 A AAA 185 AAA (Authentication, Authorization and Accounting) 185 access control limitations 285 login account 294 remote management 301 service port 300 SNMP 286 accounting 185 setup 190 accounts and modes 328 address learning, MAC 99 Address Resolution Protocol (ARP) 319, 323, 324 administrator password 295 age 123 aggregator ID 135, 136 aging time 82 alternative subnet mask notation 433 applications backbone 37 bridging 38 IEEE 802.
PAGE 454
Index classifier 151, 153 and QoS 151 editing 154 example 155 overview 151 setup 151, 153, 154 viewing 154 CLI syntax conventions 326 cloning a port See port cloning cluster management 309 and switch passwords 314 cluster manager 309, 313 cluster member 309, 314 cluster member firmware upgrade 311 network example 309 setup 312 specification 309 status 310 switch models 309 VID 313 web configurator 311 cluster manager 309 cluster member 309 Command Line Interface introduction 325 Command Line Interface (CLI
PAGE 455
Index disclaimer 445 double-tagged frames 165 DR (Designated Router) 230 DS (Differentiated Services) 251 DSCP DSCP-to-IEEE802.
PAGE 456
Index humidity 425 I IANA 438 IEEE 802.1p, priority 83 IEEE 802.1x activate 143, 144, 188, 190 reauthentication 144 IEEE 802.
PAGE 457
Index maintanence configuration backup 282 firmware 281 restoring configuration 282 maintenance 279 current configuration 279 main screen 279 Management Information Base (MIB) 286 management port 103 managementmanagement interface, See also CLI man-in-the-middle attacks 201 max age 123 hops 123 metric 234 MIB and SNMP 286 supported MIBs 287 MIB (Management Information Base) 286 mini GBIC ports 47 connection speed 47 connector type 47 transceiver installation 47 transceiver removal 48 mirroring ports 131 mo
PAGE 458
Index router types 229 status 231 stub area 229, 236 virtual link 230 virtual links 238 vs RIP 229 OSPF (Open Shortest Path First) 229 P password 61 administrator 295 Peak Information Rate (PIR) 127 PHB (Per-Hop Behavior) 251 ping, test connection 303 PIR (Peak Information Rate) 127 policy 159, 160 and classifier 159 and DiffServ 157 configuration 159 example 161 overview 157 rules 157, 158 viewing 160 policy configuration 160 port authentication 141 and RADIUS 186 IEEE802.
PAGE 459
Index server 186 settings 186 setup 186 Rapid Spanning Tree Protocol, See RSTP.
PAGE 460
Index how it works 110 Max Age 117, 118, 120, 121 path cost 110, 117, 120 port priority 117, 120 port state 111 root port 110 status 117, 120 terminology 109 vs loop guard 219 stub area 229, 236 stub area, See also OSPF 236 subnet 431 subnet based VLAN and DHCP VLAN 99 setup 99 subnet based VLANs 98 subnet mask 432 subnetting 434 switch lockout 61 switch reset 62 switch setup 81 switching 428 syntax conventions 4 syslog 202, 305 protocol 305 server setup 306 settings 305 setup 305 severity levels 305 syste
PAGE 461
Index Virtual Router (VR) 267 Virtual Router Redundancy Protocol (VRRP) 267 VLAN 81, 91, 428 acceptable frame type 97 and DHCP 264 automatic registration 92 ID 91 IGMP snooping 172 ingress filtering 97 introduction 81 number of VLANs 94 port isolation 97 port number 95 port settings 96 port-based VLAN 100 port-based, all connected 102 port-based, isolation 102 port-based, wizard 102 static VLAN 95 status 94, 95 subnet based 98 tagged 91 trunking 93, 98 type 82, 93 VLAN (Virtual Local Area Network) 81 VLAN
PAGE 462
Index 462 GS-4012F/4024 User’s Guide
Who We Are
About Us
Company
Careers
Terms & Privacy
Resources
List of Manufacturers
Support
For the Press
Media assets
FAQ
Get in touch
Blog
Email
DMCA
ManualShelf © 2013-2025