3COM 3CBLSG16 User Manual

Download

3Com® Baseline Switch 2916-SFP Plus and Baseline Switch 2924-SFP Plus

User Guide

3CBLSG16 / 3CBLSG24

www.3Com.com

Part Number 10016143 Rev. AA Published May 2007

3Com Corporation 350 Campus Drive Marlborough, MA 01752-3064

Copyright © 2007, 3Com Corporation. All rights reserved. No part of this documentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without written permission from 3Com Corporation.

3Com Corporation reserves the right to revise this documentation and to make changes in content from time to time without obligation on the part of 3Com Corporation to provide notification of such revision or change.

3Com Corporation provides this documentation without warranty, term, or condition of any kind, either implied or expressed, including, but not limited to, the implied warranties, terms or conditions of merchantability, satisfactory quality, and fitness for a particular purpose. 3Com may make improvements or changes in the product(s) and/or the program(s) described in this documentation at any time.

If there is any software on removable media described in this documentation, it is furnished under a license agreement included with the product as a separate document, in the hard copy documentation, or on the removable media in a directory file named LICENSE.TXT or !LICENSE.TXT. If you are unable to locate a copy, please contact 3Com and a copy will be provided to you.

UNITED STATES GOVERNMENT LEGEND

If you are a United States government agency, then this documentation and the software described herein are provided to you subject to the following:

All technical data and computer software are commercial in nature and developed solely at private expense. Software is delivered as “Commercial Computer Software” as defined in DFARS 252.227-7014 (June 1995) or as a “commercial item” as defined in FAR 2.101(a) and as such is provided with only such rights as are provided in 3Com’s standard commercial license for the Software. Technical data is provided with limited rights only as provided in DFAR 252.227-7015 (Nov 1995) or FAR 52.227-14 (June 1987), whichever is applicable. You agree not to remove or deface any portion of any legend provided on any licensed program or documentation contained in, or delivered to you in conjunction with, this User Guide.

Unless otherwise indicated, 3Com registered trademarks are registered in the United States and may or may not be registered in other countries.

3Com and the 3Com logo are registered trademarks of 3Com Corporation.

Intel and Pentium are registered trademarks of Intel Corporation. Microsoft, MS-DOS, Windows, and Windows NT are registered trademarks of Microsoft Corporation. Novell and NetWare are registered trademarks of Novell, Inc. UNIX is a registered trademark in the United States and other countries, licensed exclusively through X/Open Company, Ltd.

IEEE and 802 are registered trademarks of the Institute of Electrical and Electronics Engineers, Inc.

All other company and product names may be trademarks of the respective companies with which they are associated.

ENVIRONMENTAL STATEMENT

It is the policy of 3Com Corporation to be environmentally friendly in all operations. To uphold our policy, we are committed to:

Establishing environmental performance standards that comply with national legislation and regulations.

Conserving energy, materials and natural resources in all operations.

Reducing the waste generated by all operations. Ensuring that all waste conforms to recognized environmental standards. Maximizing the recyclable and reusable content of all products.

Ensuring that all products can be recycled, reused and disposed of safely.

Ensuring that all products are labelled according to recognized environmental standards.

Improving our environmental record on a continual basis.

End of Life Statement

3Com processes allow for the recovery, reclamation and safe disposal of all end-of-life electronic components.

Regulated Materials Statement

3Com products do not contain any hazardous or ozone-depleting material.

Environmental Statement about the Documentation

The documentation for this product is printed on paper that comes from sustainable, managed forests; it is fully biodegradable and recyclable, and is completely chlorine-free. The varnish is environmentally friendly, and the inks are vegetable-based with a low heavy-metal content.

ABOUT THIS GUIDE

This guide provides information about the Web user interface for the 3Com® Baseline Switch 2916-SFP Plus and Baseline Switch 2924-SFP Plus. The Web interface is a network management system that allows you to configure, monitor, and troubleshoot your switch from a remote web browser. The Web interface web pages are easy-to-use and easy-to-navigate.

User Guide Overview

This section provides an overview to the User Guide. The User Guide provides the following sections:

■ Getting Started — Provides introductory information about the

Switch 2916 and 2924 and how they can be used in your network. It covers summaries of hardware and software features.

■ Using the 3Com Web Interface — Provides information for using

the Web interface including adding, editing, and deleting device configuration information.

■ Viewing Basic Settings — provides information for viewing and

configuring essential information required for setting up and maintaining device settings.

■ Managing Device Security — Provides information for configuring

both system and network security, including traffic control, ACLs, and device access methods.

■ General System Information — Provides information for

configuring general system information including the user-defined system name, the user-defined system location, and the system contact person.

■ Configuring Ports — Provides information for configuring port

settings.

4 ABOUT THIS GUIDE

■ Aggregating Ports — Provides information for configuring Link

Aggregation which optimizes port usage by linking a group of ports together to form a single LAG.

■ Configuring VLANs — Provides information for configuring VLANs.

VLANs are logical subgroups with a Local Area Network (LAN) which combine user stations and network devices into a single virtual LAN segment, regardless of the physical LAN segment to which they are attached.

■ Configuring IP and MAC Address Information — Provides

information for configuring IP addresses, DHCP and ARP.

■ Configuring IGMP Snooping — Provides information for

configuring IGMP Snooping.

■ Configuring Spanning Tree — Provides information for configuring

Classic and Rapid Spanning Tree.

■ Configuring SNMP — Provides information for configuring the

Simple Network Management Protocol (SNMP) which provides a method for managing network devices.

■ Configuring Quality of Service — Provides information defining

Quality of Service, including DSCP and CoS mapping, policies, and configuring Trust mode.

■ Managing System Files — Provides information for defining file

maintenance.

■ Managing System Logs — Provides information for viewing system

logs, and configuring device log servers.

■ Viewing Statistics — Provides information for viewing RMON and

interface statistics.

■ Managing Device Diagnostics — Provides information for

managing device diagnostics.

Intended Audience 5

Intended Audience This guide is intended for network administrators familiar with IT

concepts and terminology.

If release notes are shipped with your product and the information there differs from the information in this guide, follow the instructions in the release notes.

Most user guides and release notes are available in Adobe Acrobat Reader Portable Document Format (PDF) or HTML on the 3Com Web site:

■ http://www.3Com.com

Conventions Table 1 lists conventions that are used throughout this guide.

Tab le 1 Notice Icons

Icon Notice Type Description

Information note

Information that describes important features or instructions.

GETTING STARTED

This chapter contains introductory information about the 3Com® Baseline Switch 2916-SFP Plus and the Baseline Switch 2924-SFP Plus and how they can be used in your network. It covers summaries of hardware and software features and also the following topics:

■ About the Switch 2916 and 2924

■ Front Panel Detail

■ LED Status Indicators

■ System Specifications

■ Installing the Switch

■ Setting Up for Management

■ Methods of Managing a Switch

■ Switch Setup Overview

■ Using the Command Line Interface (CLI)

■ Setting Up Web Interface Management

■ Setting Up SNMP Management V1 or V2

■ Default Users and Passwords

■ Upgrading Software using the CLI

12 CHAPTER 1: GETTING STARTED

About the Switch 2916 and 2924

Summary of

Hardware Features

The Switch 2916 and Switch 2924 are Gigabit Ethernet switching products that deliver flexible three-speed performance (10/100/1000) and advanced voice-optimized features such as auto-QoS and auto-voice VLAN. This makes the switches ideal for medium businesses and small enterprises seeking to build a secure converged network.

The Switch 2916 and 2924 includes the following models:

■ Baseline Switch 2916-SFP Plus 16-Port

■ Baseline Switch 2924-SFP Plus 24-Port

The Switch 2916 and 2924 feature the following advantages:

■ Full Gigabit speed access ports

■ Jumbo frames

■ Port security

■ Link aggregation control protocol (LACP)

■ Up to 256 VLANs

■ Access control lists (ACLs)

■ Port-based mirroring

Table 1 summarizes the hardware features supported by the Switch 2916 and 2924.

Tab le 1 Hardware Features

Feature Switch 2916 and 2924

Addresses Up to 8,000 supported

Auto-negotiation Supported on all ports

Forwarding Modes Store and Forward

Duplex Modes Half and full duplex on all front panel ports

Auto MDI/MDIX Supported on all ports. If fiber SFP transceivers are used,

Auto MDIX is not supported.

Flow Control In full duplex operation all ports are supported.

The Switch 2916 and 2924 ports are capable of receiving, but not sending pause frames.

Traffic Prioritization Supported (using the IEEE Std 802.ID, 1998 Edition):

Eight traffic queues per port

Front Panel Detail 13

Tab le 1 Hardware Features (continued)

Feature Switch 2916 and 2924

Ethernet, Fast Ethernet,

Auto-negotiating 10/100/1000BASE-T ports

and Gigabit Ethernet Ports

SFP Ethernet Ports Supports fiber Gigabit Ethernet long-wave (LX), and

fiber Gigabit Ethernet short-wave (SX) transceivers in any combination.

Mounting 19-inch rack or standalone mounting

Front Panel Detail Figure 1 shows the front panel of the Switch 2916-SFP Plus 16-Port unit.

Figure 1 Switch 2916 SFP 16-Port—front panel

Figure 2 shows the front panel of the Switch 2924-SFP Plus 24-Port unit.

Figure 2 Switch 2924 SFP Plus 24-Port—front panel

14 CHAPTER 1: GETTING STARTED

LED Status Indicators

The 2916-SFP Plus 16-Port and 24-Port Ethernet switches provide LED indicators on the front panel for your convenience to monitor the switch. Table 2 describes the meanings of the LEDs.

Tab le 2 Description on the LEDs of the Switch 2916 and 2924

LED Label Status Description

Power Power Green The switch starts normally. The LED flashes

when the system is performing power-on self test (POST).

Yellow The system has failed the POST.

OFF The switch is powered off.

10/100/1000 BASE-T Ethernet port status

Duplex mode Duplex Yellow The port is in full duplex mode.

1000Base SFP port status

Link/ Activity

SFP Module Active

Green The port works at the rate of 1000 Mbps; the

LED flashes quickly when the port is sending or receiving data.

Yellow The port works at the rate of 10/100 Mbps;

the LED flashes quickly when the port is sending or receiving data.

OFF The port is not connected.

OFF The port is not connected, or is in half duplex

mode.

Green The SFP module is inserted.

OFF The SFP module is not inserted or is not

recognized.

System Specifications 15

System Specifications

Table 3 contains the system specifications of the Switch 2916 and 2924 series switches.

Tab le 3 System specifications of the Switch 2916 and 2924 series switches

Specification

Physical dimensions (H×W×D)

Weight 2.0 kg (4.4 lb)

Console port One Console port

Gigabit Ethernet ports on the front panel

AC Input voltage Rated voltage range: 100–240 VAC, 50/60 Hz

Power consumption (full load)

Operating temperature 0 to 40 °C (32 to 113 °F)

Relative humidity 10 to 90% noncondensing

Switch 2916-SFP Plus 16-Port 3CBLSG16

44×440×173 mm (1.73 17.3 6.81 in.)

16 × 10/100/100 Mbps Ethernet ports

Four Gigabit SFP Combo ports

58 W 84 W

Switch 2924-SFP Plus 24-Port 3CBLSG24

24 × 10/100/100 Mbps Ethernet ports

Four Gigabit SFP Combo ports

Additional specifications can be found in Appendix B “Device Specifications and Features”.

16 CHAPTER 1: GETTING STARTED

Installing the Switch

This section contains information that you need to install and set up your 3Com switch.

WARNING: Safety Information. Before you install or remove any components from the Switch or carry out any maintenance procedures, you must read the 3Com Switch Family Safety and Regulatory Information document enclosed.

AVERTISSEMENT: Consignes de securite. Avant d'installer ou d'enlever tout composant de Switch ou d'entamer une procedure de maintenance, lisez les informations relatives a la securite qui se trouvent dans 3Com Switch Family Safety and Regulatory Information.

VORSICHT: Sicherheitsinformationen. Bevor Sie Komponenten aus dem Switch entfernen oder den Switch hinzufugen oder Instandhaltungsarbeiten verrichten, lesen Sie die 3Com Switch Family Safety and Regulatory Information.

ADVERTENCIA: Informacion de seguridad. Antes de instalar o extraer cualquier componente del Switch o de realizar tareas de mantenimiento, debe leer la informacion de seguridad facilitada en el 3Com Switch Family Safety and Regulatory Information.

AVVERTENZA: Informazioni di sicurezza. Prima di installare o rimuovere qualsiasi componente dal Switch o di eseguire qualsiasi procedura di manutenzione, leggere le informazioni di sicurezza riportate 3Com Switch Family Safety and Regulatory Information.

OSTRZEŻENIE: Informacje o zabezpieczeniach. Przed instalacją lub usunięciem jakichkolwiek elementów z product lub przeprowadzeniem prac konserwacyjnych należy zapoznać się z informacjami o bezpieczeństwie zawartymi w 3Com Switch Family Safety and Regulatory Information.

CAUTION: Opening the switch or tampering with the warranty sticker can void your warranty.

Setting Up for Management 17

Setting Up for Management

Methods of Managing a Switch

To make full use of the features offered by your switch, and to change and monitor the way it works, you have to access the management software that resides on the switch. This is known as managing the switch. Managing the switch can help you to improve the efficiency of the switch and therefore the overall performance of your network.

This section explains the initial set up of the switch and the different methods of accessing the management software to manage a switch. It covers the following topics:

■ Methods of Managing a Switch

■ Switch Setup Overview

■ Manually set the IP Address using the Console Port

■ Viewing IP Information using the Console Port

■ Setting Up Web Interface Management

■ Setting Up SNMP Management V1 or V2

■ Default Users and Passwords

To manage your switch you can use one of the following methods:

■ Web Interface Management

Web Interface

Management

■ SNMP Management

In addition, you can use the Command Line Interface through the Console port for basic operations of the switch including setting and viewing the IP address, configuring user accounts, upgrading switch firmware, and more. Refer to “3Com CLI Reference Guide” on page 195.

Each switch has an internal set of web pages that allow you to manage the switch using a Web browser remotely over an IP network (see Figure 3).

18 CHAPTER 1: GETTING STARTED

Figure 3 Web Interface Management over the Network

Workstation

Connect over Network

via web browser

Switch

Refer to “Setting Up Web Interface Management” on page 25.

SNMP Management You can manage a switch using any network management workstation

running the Simple Network Management Protocol (SNMP) as shown in Figure 4. For example, you can use the 3Com Network Director software, available from the 3Com website.

Figure 4 SNMP Management over the Network

Switch Setup Overview

SNMP Network Management

Workstation

Connect over Network

using SNMP

Switch

Refer to “Setting Up SNMP Management V1 or V2” on page 26.

This section gives an overview of what you need to do to get your switch set up and ready for management when it is in its default state. The whole setup process is summarized in Figure 5. Detailed procedural steps are contained in the sections that follow. In brief, you need to:

■ Configure IP information manually for your switch or view the

automatically configured IP information

■ Prepare for your chosen method of management

Switch Setup Overview 19

Figure 5 Initial Switch Setup and Management Flow Diagram

Power Up the Switch.

Plug and Play Setup

Connect to the

console port and use

the Command Line

Initial IP Information Setup

Yes

IP Information is automatically

configured using DHCP

See page 20

Yes

How do you want to connect to the Switch?

Connect to a front panel

port and use the Web

Interface.

See page 21

Command Line Interface

(basic setup only)

See page 25

How do you want to manage your Switch? See page 17

Is a DHCP server present?

Do you want to manually

configure the IP information?

Refer to the label on

the rear of the switch

which details the

default IP address.

SNMP

See page 26

The switch uses its default IP

information

See page 20

How do you want to view the automatically

configured IP information?

Connect to the

console port and use

the Command Line

Interface.

See page 23

Web Interface

Feature Management

Connect using the

console port.

See page 21

Connect over the

network.

See page 26

CAUTION: To protect your switch from unauthorized access, you must change the default password as soon as possible, even if you do not intend to actively manage your switch. For more information on default users and changing default passwords, see “Default Users and Passwords” on page 27.

20 CHAPTER 1: GETTING STARTED

IP Configuration The switch’s IP configuration is determined automatically using DHCP, or

manually using values you assign.

Automatic IP Configuration using DHCP

By default the switch tries to configure its IP Information without requesting user intervention. It tries to obtain an IP address from a DHCP server on the network.

Default IP Address If no DHCP server is detected, the switch will use its default IP information. The default IP address is 169.254.x.y, where x and y are the last two bytes of its MAC address.

Note: The switch’s default IP address is listed on a label located on the rear of the switch.

If you use automatic IP configuration it is important that the IP address of the switch is static, otherwise the DHCP server can change the switch’s IP addresses and it will be difficult to manage. Most DHCP servers allow static IP addresses to be configured so that you know what IP address will be allocated to the switch. Refer to the documentation that accompanies your DHCP server.

You should use the automatic IP configuration method if:

■ your network uses DHCP to allocate IP information, or

■ flexibility is needed. If the switch is deployed onto a different subnet, it

will automatically reconfigure itself with an appropriate IP address, instead of you having to manually reconfigure the switch.

If you use the automatic IP configuration method, you need to discover the automatically allocated IP information before you can begin management. Work through the “Viewing IP Information using the Console Port” on page 23.

Manual IP Configuration

When you configure the IP information manually, the switch remembers the information that you enter until you change it again.

You should use the Manual IP configuration method if:

■ You do not have a DHCP server on your network, or

■ You want to remove the risk of the IP address ever changing, or

Using the Command Line Interface (CLI) 21

■ Your DHCP server does not allow you to allocate static IP addresses.

(Static IP addresses are necessary to ensure that the switch is always allocated the same IP information.)

For most installations, 3Com recommends that you configure the switch IP information manually. This makes management simpler and more reliable as it is not dependent on a DHCP server, and eliminates the risk of the IP address changing.

To manually enter IP information for your switch, work through the “Manually set the IP Address using the Console Port” on page 22.

Using the Command Line Interface (CLI)

Connecting to the

Console Port

You can access the switch through the Console port to manually set the IP address, or to view the IP address that was assigned automatically (for example, by a DHCP server).

For more information about the CLI, refer to “3Com CLI Reference Guide” on page 195.

This section describes how to connect to your switch through the Console port.

Prerequisites

■ A workstation with terminal emulation software installed, such as

Microsoft Hyperterminal. This software allows you to communicate with the switch using the console port directly.

■ Documentation supplied with the terminal emulation software.

■ The console cable (RJ-45) supplied with your switch.

You can find pin-out diagrams for the cable in Appendix C on page 189.

22 CHAPTER 1: GETTING STARTED

Connecting the Workstation to the Switch

1 Connect the workstation to the console port using the console cable as

shown in Figure 6.

Figure 6 Connecting a Workstation to the Switch using the Console Port

To connect the cable:

a Attach the cable’s RJ-45 connector to the Console port of the switch.

b Attach the other end of the cable to the workstation.

2 Open your terminal emulation software and configure the COM port

settings to which you have connected the cable. The settings must be set to match the default settings for the switch, which are:

■ 38,400 baud (bits per second)

Workstation

(with terminal emulation

software installed)

Console Cable

Switch

Console Port

Connection

Manually set the IP

Address using the

Console Port

■ 8 data bits

■ no parity

■ 1 stop bit

■ no hardware flow control

Refer to the documentation that accompanies the terminal emulation software for more information.

3 Power up the switch. The Power on Self Test (POST) will be performed.

The Switch 2916 and 2924 takes approximately one minute to boot.

You are now ready to manually set up the switch with IP information using the command line interface.

■ You need to have the following information:

■ IP address

■ subnet mask

■ default gateway

Using the Command Line Interface (CLI) 23

1 Connect to the switch Console port as described in “Connecting to the

Console Port” page 21.

2 The command line interface login sequence begins as soon as the switch

detects a connection to its console port. When the process completes, the Login prompt displays.

Viewing IP

Information using the

Console Port

3 At the login prompt, enter

admin as your user name and press Return.

The Password prompt displays.

4 Press Return. If you have logged on correctly, Select menu option#

should be displayed.

5 Enter the IP address and subnet mask for the switch as follows:

ipSetup xxx.xxx.xxx.xxx mmm.mmm.mmm.mmm

and then press Enter.

(Note: xxx.xxx.xxx.xxx is the IP address and mmm.mmm.mmm.mmm is the subnet mask of the switch.)

6 Enter the logout command to terminate the CLI session.

The initial setup of your switch is now complete and the switch is ready for you to set up your chosen management method. See “Methods of Managing a Switch” on page 17.

This section describes how to view the automatically allocated IP information using the command line interface. The automatic IP configuration process usually completes within one minute after the switch is connected to the network and powered up.

1 Connect to the switch Console port as described in “Connecting to the

Console Port” page 21.

The automatic IP configuration process usually completes within one minute.

2 The command line interface login sequence begins as soon as the switch

detects a connection to its console port.

3 At the login prompt, enter

admin as your user name and press Return.

4 At the password prompt, press Return.If you have logged on correctly,

Select menu option# is displayed.

24 CHAPTER 1: GETTING STARTED

5 Enter Summary to view a summary of allocated IP addresses. The

following is an example of the display from the Summary command.

Select menu option# summary IP Method: default IP address: 169.254.99.51 Subnet mask: 255.255.0.0 Runtime version: 00_00_38 (date 01-Apr-2007 time 15:31:29) Bootcode version: 1.0.0.12 (date 01-Apr-2007 time 17:44:52) Select menu option#

The initial set up of your switch is now complete and the switch is ready for you to set up your chosen management method. See “Methods of Managing a Switch” on page 17.

For more information about the CLI, refer to “3Com CLI Reference Guide” on page 195.

If you do not intend to use the command line interface using the console port to manage the switch, you can logout, disconnect the serial cable and close the terminal emulator software.

Setting Up Web Interface Management 25

Setting Up Web Interface Management

This section describes how you can set up web interface management over the network.

Prerequisites

■ Ensure you have already set up the switch with IP information as

described in “Methods of Managing a Switch” on page 17.

■ Ensure that the switch is connected to the network using a Category 5

twisted pair Ethernet cable with RJ-45 connectors.

■ A suitable Web browser.

Choosing a Browser

To display the web interface correctly, use one of the following Web browser and platform combinations:

Tab le 4 Supported Web Browsers and Platforms

Platform

Browser

Internet Explorer 6 Yes Yes Yes

Internet Explorer 7 Yes Yes Yes

Firefox 1.5 Yes Yes Yes

Firefox 2 Yes Yes Yes

Netscape 8 Yes Yes Yes

Windows 2000 Windows XP Windows Vista

For the browser to operate the web interface correctly, JavaScript and Cascading Style Sheets must be enabled on your browser. These features are enabled on a browser by default. You will only need to enable them if you have changed your browser settings.

The switch’s Web interface supports both secure (HTTPS) and non-secure (HTTP) connections.

26 CHAPTER 1: GETTING STARTED

Web Management

Over the Network

To manage a switch using the web interface over an IP network:

1 Be sure that you know your switch’s IP address. See “IP Configuration”

on page 20, and “Viewing IP Information using the Console Port” on page 23.

2 Check that your management workstation is on the same subnet as your

switch.

3 Check you can communicate with the switch by entering a ping

command at the DOS or CMD prompt in the following format:

c:\ ping xxx.xxx.xxx.xxx

(where xxx.xxx.xxx.xxx is the IP address of the switch)

If you get an error message, check that your IP information has been entered correctly and the switch is powered up.

4 Open your web browser and enter the IP address of the switch that you

wish to manage in the URL locator, for example, in the following format:

http://xxx.xxx.xxx.xxx

5 At the login and password prompts, enter admin as your user name and

press Return at the password prompt (or the password of your choice if you have already modified the default passwords).

The main Web interface page is displayed.

Setting Up SNMP Management V1 or V2

You can use any network management application running the Simple Network Management Protocol (SNMP) to manage the switch. 3Com offers a range of network management applications to address networks of all sizes and complexity. See “3Com Network Management” on page 181.

Be sure the management workstation is connected to the switch using a port in VLAN 1 (the Default VLAN). By default, all ports on the switch are in VLAN 1.

To display and configure SNMP management parameters, refer to “Configuring SNMP” on page 135.

Default Users and Passwords 27

Default Users and Passwords

Upgrading Software using the CLI

If you intend to manage the switch or to change the default passwords, you must log in with a valid user name and password. The switch has one default user name. The default user is listed in Table 5.

Tab le 5 Default Users

User Name

admin (no password) Management — The user can access and change

Default Password

Access Level

all manageable parameters

Use the admin default user name (no password) to login and carry out initial switch setup.

This section describes how to upgrade software to your Switch from the Command Line Interface (CLI).

Note: You can also upgrade the software using the switch Web user interface. See “Upgrade the Firmware Image” page 165. Bootcode can only be upgraded using the CLI.

1 To download the runtime application file, enter:

upgrade aaa.aaa.aaa.aaa rrr runtime

where aaa.aaa.aaa.aaa is the IP address of the TFTP server and rrr is the source runtime filename.

2 To download the bootcode file, enter:

upgrade aaa.aaa.aaa.aaa bbb bootcode

where aaa.aaa.aaa.aaa is the IP address of the TFTP server and bbb is the source bootcode filename.

The bootcode firmware may not require upgrading for every software upgrade, therefore there may not be a new bootcode file to download.

3 To set the switch to boot from the new software you have downloaded,

enter the following:

reboot

The following prompt displays:

Are you sure you want to reboot the system (yes, no):

4 Enter yes and press Return. The system reboots the switch.

USING THE 3COM WEB INTERFACE

This section provides an introduction to the user interface, and includes the following topics:

■ Starting the 3Com Web Interface

■ Understanding the 3Com Web Interface

■ Saving the Configuration

■ Resetting the Device

■ Restoring Factory Defaults

■ Logging Off the Device

Starting the 3Com Web Interface

Multi-Session Web

Connections

This section includes the following topics:

■ Multi-Session Web Connections

■ Accessing the 3Com Web Interface

The Multi-Session web connections feature enables 10 users to be created and access the switch concurrently. Access levels provide read or read/write permissions to users for configuring the switch. Users and access levels are described in Configuring System Access Section. Login information is always handled in the local database. A unique password is required of each user. Two access levels exist on the 3Com Web Interface:

■ Management access level — Provides the user with read/write

access. There is always one management level user configured for the switch. The factory default is be username: admin with no Password.

■ Monitor access level — Provides the user with read-only access.

Starting the 3Com Web Interface 29

Accessing the 3Com

Web Interface

This section contains information on starting the 3Com Web interface.

To access the 3Com user interface:

1 Open an Internet browser.

2 Enter the device IP address in the address bar and press Enter. The Enter

Network Password Page opens:

Figure 7 Enter Network Password Page

3 Enter your user name and password. The device default factory settings is

configured with a User Name that is admin and a password that is blank. Passwords are case sensitive.

4 Click Login. The 3Com Web Interface Home Page opens:

30 CHAPTER 2: USING THE 3COM WEB INTERFACE

Figure 8 3Com Web Interface Home Page

Understanding the 3Com Web Interface

The 3Com Web Interface Home Page contains the following views:

■ Tab V ie w — Provides the device summary configuration located at

the top of the home page.

■ Tree Vie w — Provides easy navigation through the configurable

device features. The main branches expand to display the sub-features.

■ Port Indicators — Located under the Device View at the top of the

home page, the port indicators provide a visual representation of the ports on the front panel.

Understanding the 3Com Web Interface 31

Figure 9 Web Interface Components

The following table lists the user interface components with their corresponding numbers:

Tab le 6 Interface Components

View Description

1 Tree View Tree View provides easy navigation through the configurable

device features. The main branches expand to display the sub-features.

2 Tab View The Tab Area enables navigation through the different device

3 Web Interface Information

features. Click the tabs to view all the components under a specific feature.

Provides access to online help, and contains information about the Web Interface.

This section provides the following additional information:

■ Device Representation — Provides an explanation of the user

interface buttons, including both management buttons and task icons.

■ Using the Web Interface Management Buttons — Provides

instructions for adding, modifying, and deleting configuration parameters.

32 CHAPTER 2: USING THE 3COM WEB INTERFACE

Device

Representation

Using the Web

Interface

Management Buttons

The 3Com Web Interface Home Page contains a graphical panel representation of the device that appears within the Device View Tab.

To access the Device Representation:

1 Click Device Summary > Device View.

Figure 10 Device Representation

2 By selecting a specific port with your mouse, you can view the port

statistics.

For detailed information on configuring ports, please refer to “Configuring Ports” page 85.

Configuration Management buttons and icons provide an easy method of configuring device information, and include the following:

Tab le 7 3Com Web Interface Configuration Buttons

Button Button Name Description

Clear Logs Clears system logs.

Create Creates configuration

Apply Applies configuration

Delete Deletes configuration

Tab le 8 3Com Web Interface Information Tabs

Tab Tab Name Description

Help Opens the online help.

Logout Logs the user out and

entries.

changes to the device.

settings.

terminates the current session.

Using Screen and Table Options 33

Using Screen and Table Options

3Com contains screens and tables for configuring devices. This section contains the following topics:

■ Viewing Configuration Information

■ Adding Configuration Information

■ Modifying Configuration Information

■ Removing Configuration Information

Viewing Configuration Information

To view configuration information:

1 Click Port > Administration > Summary. The Port Settings Summary

Page opens:

Figure 11 Port Settings Summary Page

34 CHAPTER 2: USING THE 3COM WEB INTERFACE

Adding Configuration Information

User-defined information can be added to specific 3Com Web Interface pages, by opening the IP Setup Page.

For example, to configure IP Setup:

1 Click Administration > IP Setup. The IP Setup Page opens:

Figure 12 IP Setup Page

2 Enter requisite information in the text field.

3 Click Apply. The IP information is configured, and the device is updated.

Using Screen and Table Options 35

Modifying Configuration Information

1 Click Administration > System Access > Modify. The System Access

Modify Page opens:

Figure 13 System Access Modify Page

2 Modify the fields.

3 Click Apply. The access fields are modified.

36 CHAPTER 2: USING THE 3COM WEB INTERFACE

Removing Configuration Information

1 Click Administration > System Access > Remove. The System Access

Remove Page opens:

Figure 14 System Access Remove Page

2 Select the user account to be deleted.

3 Click Remove. The user account is deleted, and the device is updated.

Saving the Configuration 37

Saving the Configuration

Configuration changes are only saved to the device once the user saves the changes to the flash memory.

The Save Configuration tab allows the

latest configuration to be saved to the flash memory.

To save the device configuration:

1 Click Save Configuration. The Save Configuration Page opens:

Figure 15 Save Configuration Page

A message appears: The operation saves your configuration. Do you wish to continue?

2 Click OK. A Configuration is saved to flash memory successful message

appears.

3 Click OK. The configuration is saved.

38 CHAPTER 2: USING THE 3COM WEB INTERFACE

Resetting the Device

The Reset Page enables resetting the device from a remote location.

To prevent the current configuration from being lost, use the Save Configuration Page to save all user-defined changes to the flash memory before resetting the device.

To reset the device:

1 Click Administration > Reset. The Reset Page opens:

Figure 16 Reset Page

2 Click Reboot. A confirmation message is displayed.

3 Click OK. The device is reset, and a prompt for a user name and

password is displayed.

Figure 17 User Name and Password Page

4 Enter a user name and password to reconnect to the web interface.

Restoring Factory Defaults 39

Restoring Factory Defaults

The Restore option appears on the Reset Page. The Restore option restores device factory defaults.

To restore the device:

1 Click Administration > Reset. The Reset Page opens:

Figure 18 Reset Page

The Reset Page contains the following fields:

■ Initialize with Current IP Address — Resets the device with the

factory default settings, but maintains the current IP Address, subnet mask, and default gateway address.

■ Initialize with Default IP Address — Resets the device with the

factory default settings, including the factory default IP Address.

2 Click the Initialize button. The system is restored to factory defaults.

40 CHAPTER 2: USING THE 3COM WEB INTERFACE

Logging Off the Device

To log off the device:

1 Click Logout. The Logout Page opens.

2 The following message appears:

3 Click OK. The 3Com Web Interface Home Page closes.

VIEWING BASIC SETTINGS

This section contains information about viewing basic settings available from the Web interface home page, including the Device Summary page and the Color Keys page.

Viewing Device Settings

The Device Summary Page displays general information, including the system name, location, and contact, the system MAC address, System Object ID, System Up Time, and software, boot, and hardware versions. To view the Device Summary Settings:

1 Click Device Summary. The Device Summary Page opens:

Figure 19 Device Summary Page

The Device Summary Page contains the following fields:

42 CHAPTER 3: VIEWING BASIC SETTINGS

■ Product Description — Displays the device model number and name

■ System Name — Defines the user-defined device name. The field

range is 0-160 characters.

■ System Location — Defines the location where the system is

currently running. The field range is 0-160 characters.

■ System Contact — Defines the name of the contact person. The field

range is 0-160 characters.

■ Serial Number — Displays the device serial number.

■ Product 3C Number — Displays the 3Com device 3C number.

■ System Object ID — Displays the vendor’s authoritative identification

of the network management subsystem contained in the entity.

■ MAC Address — Displays the device MAC address.

■ System Up Time — Displays the amount of time since the most

recent device reset. The system time is displayed in the following format: Days, Hours, Minutes, and Seconds. For example, 41 days, 2 hours, 22 minutes and 15 seconds.

■ Software Version — Displays the installed software version number.

■ Boot Version — Displays the current boot version running on the

device.

■ Hardware Version — Displays the current hardware version of the

device.

■ Poll Now — Enables polling the ports for port information including

speed, utilization and port status.

Viewing Color Keys 43

Viewing Color Keys The Color Key Page provides information about the RJ45 or SFP port

status. To view color keys:

1 Click Device Summary > Color Key. The Color Key Page opens:

Figure 20 Color Key Page

The Color Key Page contains the following fields:

■ RJ45 — Displays the port status of the RJ45 connections which are the

physical interface used for terminating twisted pair type cable.

■ SFP — Displays the port status of the Small Form Factor (SFP) optical

transmitter modules that combine transmitter and receiver functions.

Table 9 describes the color and the port status:

Tab le 9 Color Key Definitions

Color Port Status

White Unconnected. No link detected.

Yellow Lower speed on 10/100/1000M port.

Green Maximum speed 10/100/1000M RJ45 or RJ45 SFP. Indicates that a

link was detected.

Light Blue SX/LX SFP. Indicates that a link was detected.

Light Gray Port has been set to inactive by User or Protocol.

Dark Blue Port has been selected by user.

Red Port or Transceiver has failed POST or Transceivers not recognized.

MANAGING DEVICE SECURITY

The Management Security section provides information for configuring system access, defining RADIUS authentication, port-based authentication and defining access control lists.

This section includes the following topics:

■ Configuring System Access

■ Defining RADIUS Clients

■ Defining Port-Based Authentication (802.1X)

■ Defining Access Control Lists

■ Enabling Broadcast Storm

Configuring System Access 45

Configuring System Access

Network administrators can users using the System Access Interface.

define users, passwords, and access levels for

The Multi-Session web feature is enabled on device and allows 10 users to be created and access the switch concurrently. Access levels provide read or read/write permissions to users for configuring the switch. Login information is managed in the local database. A unique password is required of each user. Two access levels exist on the 3Com Web Interface:

■ Management access level — Provides the user with read/write

access. There is always one management level user configured for the switch. The factory default is be user name: admin with no Password.

■ Monitor access level — Provides the user with read-only system

access.

This section contains the following topics:

■ Viewing System Access Settings

■ Defining System Access

■ Modifying System Access

■ Removing System Access

46 CHAPTER 4: MANAGING DEVICE SECURITY

Viewing System

Access Settings

The System Access Summary Page displays

the current users and access

levels defined on the device.

To view System Access settings:

1 Click Administration > System Access > Summary. The System Access

Summary Page opens:

Figure 21 System Access Summary Page

The System Access Summary Page contains the following fields:

■ User Name — Displays the user name. The possible predefined field

value is:

■ Admin — Displays the predefined Administrative user name.

■ Access Level — Displays the user access level. The lowest user access

level is Monitor and the highest is Management.

■ Management — Provides the user with read and write access

rights.

■ Monitor — Provides the user with read access rights.

Configuring System Access 47

Defining System

Access

The System Access Setup Page allows network administrators to

define users, passwords, and access levels for users using the System Access Interface.

Monitor users have no access to this page.

1 Click Administration > System Access > Setup. The System Access

Setup Page opens:

Figure 22 System Access Setup Page

The System Access Setup Page contains the following fields:

■ User Name — Defines the user name.

■ Access Level — Defines the user access level. The lowest user access

level is Monitor and the highest is Management.

■ Management — Provides users with read and write access rights.

■ Monitor — Provides users with read access rights.

■ Password — Defines the user password. User passwords can contain

up to 10 characters.

■ Confirm Password — Verifies the password.

2 Define the fields.

3 Click Apply. The Users are created, and the device is updated.

48 CHAPTER 4: MANAGING DEVICE SECURITY

Modifying System

Access

The System Access Modify Page allows network administrators to

modify

users, passwords, and access levels using the System Access Interface.

Monitor users have no access to this page.

1 Click Administration > System Access > Modify. The System Access

Modify Page opens:

Figure 23 System Access Modify Page

The System Access Modify Page contains the following fields:

■ User Name — Displays the user name.

■ Access Level — Displays the user access level. The lowest user access

level is Monitoring and the highest is Management.

■ Management — Provides users with read and write access rights.

■ Monitor — Provides users with read access rights.

■ Password Modify — Changes a password for an existing user.

■ Password — Defines the local user password. Local user passwords

can contain up to 8 characters.

■ Confirm Password — Verifies the password.

2 Select a User Name to be modified.

3 Modify the fields.

4 Click Apply. The User settings are modified, and the device is updated.

Configuring System Access 49

Removing System

Access

The System Access Remove Page allows network administrators to remove users from the System Access Interface.

Monitor users have no access to this page.

To r em ov e us er s :

1 Click Administration > System Access > Remove. The System Access

Remove Page opens:

Figure 24 System Access Remove Page

The System Access Remove Page contains the following fields:

■ Remove User(s) — Select user(s) from the list below to be removed.

■ User Name — Displays the user name.

■ Access Level — Displays the user access level. The lowest user access

level is Monitoring and the highest is Management.

■ Management — Provides users with read and write access rights.

■ Monitoring — Provides users with read access rights.

2 Select a User to be deleted.

The last user with management access may not be deleted.

3 Click Remove. The User is deleted, and the device is updated.

50 CHAPTER 4: MANAGING DEVICE SECURITY

Defining RADIUS Clients

Remote Authorization Dial-In User Service (RADIUS) servers provide additional security for networks. RADIUS servers provide a centralized authentication method for 802.1X.

The default parameters are user-defined, and are applied to newly defined RADIUS servers. If new default parameters are not defined, the system default values are applied to newly defined RADIUS servers.

Monitor users have no access to this page.

To configure the RADIUS client:

1 Click Security > RADIUS Client > Setup. The Radius Client Setup Page

opens:

Figure 25 Radius Client Setup Page

The Radius Client Setup Page contains the following fields:

■ Primary Server — Defines the RADIUS Primary Server authentication

fields.

■ Backup Server — Defines the RADIUS Backup Server authentication

fields.

■ Host IP Address — Defines the RADIUS Server IP address.

Defining RADIUS Clients 51

■ Authentication Port — Identifies the authentication port. The

authentication port is used to verify the RADIUS server authentication. The authenticated port default is 1812.

■ Number of Retries — Defines the number of transmitted requests

sent to the RADIUS server before a failure occurs. Possible field values are 1-10. The default value is 3.

■ Timeout for Reply — Defines the amount of time (in seconds) the

device waits for an answer from the RADIUS server before retrying the query, or switching to the next server. Possible field values are 1-30. The default value is 3.

■ Dead Time — Defines the default amount of time (in minutes) that a

RADIUS server is bypassed for service requests. The range is 0-2000. The default value is 0.

■ Key String — Defines the default key string used for authenticating

and encrypting all RADIUS-communications between the device and the RADIUS server. This key must match the RADIUS encryption.

2 Define the fields.

3 Click OK. The RADIUS client is enabled, and the system is updated.

52 CHAPTER 4: MANAGING DEVICE SECURITY

Defining Port-Based Authentication (802.1X)

Port-based authentication authenticates users on a per-port basis via an external server. Only authenticated and approved system users can transmit and receive data. Ports are authenticated via the RADIUS server using the Extensible Authentication Protocol (EAP). Port-based authentication includes:

■ Authenticators — Specifies the device port which is authenticated

before permitting system access.

■ Supplicants — Specifies the host connected to the authenticated

port requesting to access the system services.

■ Authentication Server — Specifies the server that performs the

authentication on behalf of the authenticator, and indicates whether the supplicant is authorized to access system services.

Port-based authentication creates two access states:

■ Controlled Access — Permits communication between the

supplicant and the system, if the supplicant is authorized.

■ Uncontrolled Access — Permits uncontrolled communication

regardless of the port state.

This section includes the following topics:

■ Viewing 802.1X Authentication

■ Defining 802.1X Authentication

Defining Port-Based Authentication (802.1X) 53

Viewing 802.1X

Authentication

The 802.1X Summary Page allows the network administrator to view port-based authentication settings.

To view Port-based Authentication:

1 Click Security > 802.1X > Summary. The 802.1X Summary Page opens:

Figure 26 802.1X Summary Page

The 802.1X Summary Page contains the following fields:

■ Port — Displays a list of interfaces.

■ User Name — Displays the supplicant user name.

■ Admin Port Control — Displays the admin port authorization state.

■ ForceUnauthorized — Indicates that either the port control is force

Unauthorized and the port link is down, or the port control is Auto but a client has not been authenticated via the port.

■ ForceAuthorized — Indicates that the port control is Forced

Authorized, and clients have full port access.

■ Auto — Indicates that the port control is Auto and a single client

has been authenticated via the port.

■ Current Port Control — Displays the current port authorization state.

54 CHAPTER 4: MANAGING DEVICE SECURITY

■ Guest VLAN — Indicates whether an unauthorized port is allowed to

join the Guest VLAN. The possible field values are:

■ Enable — Enables an unauthorized port to join the Guest VLAN.

■ Disable — Disables an unauthorized port to join the Guest VLAN.

■ Periodic Reauthentication — Enables periodic reauthentication on

the port.

■ Enable — Enables the periodic reauthentication on the port.

■ Disable — Disables the periodic reauthentication on the port. This

is the default.

■ Reauthentication Period — Displays the time span (in seconds) in

which the selected port is reauthenticated. The field default is 3600 seconds.

■ Authenticator State — Displays the current authenticator state.

■ Termination Cause — Indicates the reason for which the port

authentication was terminated.

2 Click Apply. Port Authentication is enabled, and the device is updated.

Defining 802.1X

Authentication

The 802.1X Setup Page contains information for configuring 802.1X global settings on the device and defining specific 802.1X setting for each port individually.

Monitor users have no access to this page.

Defining Port-Based Authentication (802.1X) 55

To configure 802.1X Settings:

1 Click Security > 802.1X > Setup. The 802.1X Setup Page opens:

Figure 27 802.1X Setup Page

The

802.1X Setup Page contains the following fields:

802.1X Global Settings

■ Port Based Authentication State — Indicates if Port Authentication

is enabled on the device. The possible field values are:

■ Enable — Enables port-based authentication on the device.

■ Disable — Disables port-based authentication on the device. This is

the default value.

■ Authentication Method — Specifies the authentication method

used for port authentication. The possible field values are:

■ RADIUS — Provides port authentication using the RADIUS server.

■ RADIUS, None — Provides port authentication, first using the

RADIUS server. If the port is not authenticated, then no authentication method is used, and the session is permitted.

■ None — Indicates that no authentication method is used to

authenticate the port.

■ Enable Guest VLAN — Provides limited network access to authorized

ports. If a port is denied network access via port-based authorization, but the Guest VLAN is enabled, the port receives limited network

56 CHAPTER 4: MANAGING DEVICE SECURITY

access. For example, a network administrator can use Guest VLANs to deny network access via port-based authentication, but grant Internet access to unauthorized users.

■ Guest VLAN ID — Specifies the guest VLAN ID.

802.1X Port Settings

■ Admin Port Control — Displays the admin port authorization state.

■ Auto — Enables port based authentication on the device. The

interface moves between an authorized or unauthorized state based on the authentication exchange between the device and the client.

■ Force Authorized — Places the interface into an authorized state

without being authenticated. The interface re-sends and receives normal traffic without client port based authentication.

■ Force Unauthorized — Denies the selected interface system access

by moving the interface into unauthorized state. The device cannot provide authentication services to the client through the interface.

■ Guest VLAN — Specifies whether the Guest VLAN is enabled on the

port. The possible field values are:

■ Enable — Enables using a Guest VLAN for unauthorized ports. If a

Guest VLAN is enabled, the unauthorized port automatically joins the VLAN selected from the Guest VLAN ID dropdown list.

■ Disable — Disables Guest VLAN on the port. This is the default.

■ Periodic Reauthentication — Enables periodic reauthentication on

the port.

■ Enable — Enables the periodic reauthentication on the port.

■ Disable — Disables the periodic reauthentication on the port.

■ Reauthentication Period — Displays the time span (in seconds) in

which the selected port is reauthenticated. The field default is 3600 seconds.

2 Define the fields.

3 Click Apply. The

802.1X Settings are enabled, and the device is updated.

Defining Access Control Lists 57

Defining Access Control Lists

Access Control Lists (ACL) allow network managers to define classification actions and rules for specific ingress ports. Packets entering an ingress port, with an active ACL are either admitted or denied entry. If they are denied entry, the port can be disabled.

For example, an ACL rule is defined states that port number 20 can receive TCP packets, however, if a UDP packet is received, the packet is dropped. ACLs are composed of access control entries (ACEs) that are made of the filters that determine traffic classifications.

The following are examples of filters that can be defined as ACEs:

■ Source Port IP Address and Wildcard Mask — Filters the packets

by the Source port IP address and wildcard mask.

■ Destination Port IP Address and Wildcard Mask — Filters the

packets by the Source port IP address and wildcard mask.

■ ACE Priority — Filters the packets by the ACE priority.

■ Protocol — Filters the packets by the IP protocol.

■ DSCP — Filters the packets by the DiffServ Code Point (DSCP) value.

■ IP Precendence — Filters the packets by the IP Precedence.

■ Action — Indicates the action assigned to the packet matching the

ACL. Packets are forwarded or dropped. In addition, the port can be shut down, a trap can be sent to the network administrator, or packet is assigned rate limiting restrictions for forwarding.

This section includes the following topics:

■ Viewing MAC Based ACLs

■ Configuring MAC Based ACLs

■ Removing MAC Based ACLs

■ Viewing IP Based ACLs

■ Defining IP Based ACLs

■ Modifying IP Based ACLs

■ Removing IP Based ACLs

■ Viewing ACL Binding

■ Configuring ACL Binding

■ Removing ACL Binding

58 CHAPTER 4: MANAGING DEVICE SECURITY

Viewing MAC Based

ACLs

The MAC Based ACL Summary Page displays information regarding MAC Based ACLs configured on the device. Ports are reactivated from the Interface Configuration Page.

To view MAC Based ACLs:

1 Click Device > ACL > MAC Based ACL > Summary. The MAC Based

ACL Summary Page opens:

Figure 28 MAC Based ACL Summary Page

The MAC Based ACL Summary Page contains the following fields:

■ ACL Name — Contains a list of the MAC-based ACLs.

■ Priority — Indicates the rule priority, which determines which rule is

matched to a packet on a first match basis.

■ Source Address — Indicates the source MAC address.

■ Source Mask — Indicates the source MAC address Mask.

■ Destination Address — Indicates the destination MAC address.

■ Destination Mask — Indicates the destination MAC address Mask.

■ VLAN ID — Matches the packet's VLAN ID to the ACE. The possible

field values are 1 to 4095.

■ CoS — Classifies traffic based on the CoS tag value.

■ CoS Mask — Displays the CoS mask used to filter CoS tags.

Defining Access Control Lists 59

■ Ethertype — Provides an identifier that differentiates between

various types of protocols.

■ Action — Indicates the ACL forwarding action. In addition, the port

can be shut down, a trap can be sent to the network administrator, or packet is assigned rate limiting restrictions for forwarding. The options are as follows:

■ Permit — Forwards packets which meet the ACL criteria.

■ Deny — Drops packets which meet the ACL criteria.

■ Shutdown — Drops packet that meets the ACL criteria, and

disables the port to which the packet was addressed. Ports are reactivated from the Port Administration Setup Page.

Configuring MAC

Based ACLs

The MAC Based ACL Setup Page allows the network administrator to select, create and define rules for MAC-based Access Control Lists.

Monitor users have no access to this page.

1 Click Device > ACL > MAC Based ACL > Setup. The MAC Based ACL

Setup Page opens:

Figure 29 MAC Based ACL Setup Page

The MAC Based ACL Setup Page contains the following fields:

■ Selection ACL — Lists previously defined Access Control Lists.

■ Create ACL — Create a new user-defined MAC based ACL.

60 CHAPTER 4: MANAGING DEVICE SECURITY

Add Rules to ACL

■ Priority — Indicates the ACE priority, which determines which ACE is

matched to a packet on a first-match basis. The possible field values are 1-2147483647.

■ Source MAC Address — Matches the source MAC address to which

packets are addressed to the ACE.

■ Source Mask — Indicates the source MAC Address wildcard mask.

Wildcards are used to mask all or part of a source MAC address. Wildcard masks specify which bits are used and which are ignored. A wildcard mask of FF:FF:FF:FF:FF:FF indicates that no bit is important. A wildcard of 00.00.00.00.00.00.00 indicates that all bits are important. For example, if the source MAC address is 00:AB:22:11:33:00 and the wildcard mask is 00:00:00:00:00:FF, the first five bytes of the MAC are used, while the last byte is ignored. For the source MAC address 00:AB:22:11:33:00, this wildcard mask matches all MAC addresses in the range 00:AB:22:11:33:00 to 00:AB:22:11:33:FF.

■ Destination MAC Address — Matches the destination MAC address

to which packets are addressed to the ACE.

■ Destination Mask — Indicates the destination MAC Address

wildcard mask. Wildcards are used to mask all or part of a destination MAC address. Wildcard masks specify which bits are used and which are ignored. A wildcard mask of FF:FF:FF:FF:FF:FF indicates that no bit is important. A wildcard mask of 00.00.00.00.00.00 indicates that all bits are important. For example, if the destination MAC address is 00:AB:22:11:33:00 and the wildcard mask is 00:00:00:00:00:FF, the first five bytes of the MAC are used, while the last byte is ignored. For the destination MAC address 00:AB:22:11:33:00, this wildcard mask matches all MAC addresses in the range 00:AB:22:11:33:00 to 00:AB:22:11:33:FF.

■ VLAN ID — Matches the packet's VLAN ID to the ACE. The possible

field values are 1 to 4093.

■ CoS — Classifies traffic based on the CoS tag value.

■ CoS Mask — Defines the CoS mask used to classify network traffic.

■ Ethertype — Provides an identifier that differentiates between

various types of protocols.

■ Action — Indicates the ACL forwarding action. In addition, the port

can be shut down, a trap can be sent to the network administrator, or

Defining Access Control Lists 61

packet is assigned rate limiting restrictions for forwarding. The options are as follows:

■ Permit — Forwards packets which meet the ACL criteria.

■ Deny — Drops packets which meet the ACL criteria.

■ Shutdown — Drops packet that meets the ACL criteria, and

disables the port to which the packet was addressed. Ports are reactivated from the Port Administration Setup Page.

2 Define the fields.

3 Click Apply. The Rule Setup settings are configured, and the device is

updated.

Modifying MAC

Based ACLs

The MAC Based ACL Modify Page allows the network administrator to modify MAC Based ACLs settings.

Monitor users have no access to this page.

1 Click Device > ACL > MAC Based ACL > Modify. The MAC Based ACL

Modify Page opens:

Figure 30 MAC Based ACL Modify Page

The MAC Based ACL Modify Page contains the following fields:

■ Select ACL — Selects the ACL to be bound.

■ Select Rule — Indicates the rule for which Access Control Entries are

defined.

62 CHAPTER 4: MANAGING DEVICE SECURITY

Modify

■ Priority — Indicates the rule priority, which determines which rule is

matched to a packet on a firstmatch basis.

■ Source MAC Address — Matches the source MAC address to which

packets are addressed to the ACE.

■ Source Mask — Indicates the source MAC Address wildcard mask.

Wildcards are used to mask all or part of a source address by specifying which bits are used and which are ignored. A wildcard mask of FF:FF:FF:FF:FF:FF indicates that no bit is important. A wildcard of 00.00.00.00.00.00.00 indicates that all bits are important. For example, if the source MAC address is E0:3B:4A:C2:CA:E2 and the wildcard mask is 00:00:00:00:00:FF, the first five bytes of the MAC are used, while the last byte is ignored. For the source MAC address E0:3B:4A:C2:CA:E2, this wildcard mask matches all MAC addresses in the range E0:3B:4A:C2:CA:00 to E0:3B:4A:C2:CA:FF.

■ Destination MAC Address — Matches the destination MAC address

to which packets are addressed to the ACE.

■ Destination Mask — Indicates the destination MAC Address

wildcard mask. Wildcards are used to mask all or part of a destination address by specifying which bits are used and which are ignored. A wildcard mask of FF:FF:FF:FF:FF indicates that no bit is important. A wildcard mask of 00.00.00.00.00.00 indicates that all bits are important. For example, if the destination MAC address is E0:3B:4A:C2:CA:E2 and the wildcard mask is 00:00:00:00:00:FF, the first five bytes of the MAC are used, while the last byte is ignored. For the destination MAC address E0:3B:4A:C2:CA:E2, this wildcard mask matches all MAC addresses in the range E0:3B:4A:C2:CA:00 to E0:3B:4A:C2:CA:FF.

■ VLAN ID — Matches the packet's VLAN ID to the ACE. The possible

field values are 1 to 4093.

■ CoS — Classifies traffic based on the CoS tag value.

■ CoS Mask — Defines the CoS mask used to classify network traffic.

■ Ethertype — Provides an identifier that differentiates between

various types of protocols.

■ Action — Indicates the ACL forwarding action. The port can be shut

down, a trap can be sent to the network administrator, or packet is assigned rate-limiting restrictions for forwarding. The options are:

Defining Access Control Lists 63

■ Permit — Forwards packets which meet the ACL criteria.

■ Deny — Drops packets which meet the ACL criteria.

■ Shutdown — Drops packet that meets the ACL criteria, and

disables the port to which the packet was addressed. Ports are reactivated from the Port Administration Setup Page.

2 Define the fields.

3 Click Apply. The MAC based settings are modified, and the device is

updated.

Removing MAC Based

ACLs

The MAC Based ACL Remove Page allows the user to remove MAC Based ACLs.

Monitor users have no access to this page.

To remove MAC Based ACLs:

1 Click Device > ACL > MAC Based ACL > Remove. The MAC Based ACL

Remove Page opens:

Figure 31 MAC Based ACL Remove Page

The MAC Based ACL Remove Page contains the following fields:

■ ACL Name — Contains a list of the MAC-based ACLs.

■ Remove ACL — Enables the ACL to be removed.

64 CHAPTER 4: MANAGING DEVICE SECURITY

■ Priority — Indicates the rule priority, which determines which rule is

matched to a packet on a firstmatch basis.

■ Source Address — Matches the source MAC address to which

packets are addressed to the ACE.

■ Destination Address — Matches the destination MAC address to

which packets are addressed to the ACE.

■ VLAN ID — Matches the packet's VLAN ID to the ACE. The possible

field values are 1 to 4093.

■ CoS — Classifies Class of Service of the packet.

■ CoS Mask — Defines the wildcard bits to be applied to the CoS.

■ Ethertype — Provides an identifier that differentiates between

various types of protocols.

■ Action — Indicates the ACL forwarding action. In addition, the port

can be shut down, a trap can be sent to the network administrator, or packet is assigned rate limiting restrictions for forwarding. The options are as follows:

■ Permit — Forwards packets which meet the ACL criteria.

■ Deny — Drops packets which meet the ACL criteria.

■ Shutdown — Drops packet that meets the ACL criteria, and

disables the port to which the packet was addressed. Ports are reactivated from the Port Administration Setup Page.

2 Select the ACL Name to be deleted.

3 Select the ACL to be removed from the table.

4 Click the Remove checkbox.

5 Click Apply. The selected ACLs are deleted, and the device is updated.

Defining Access Control Lists 65

Viewing IP Based

ACLs

The IP Based ACL Summary Page displays information regarding IP Based ACLs configured on the device.

To view IP Based ACLs:

1 Click Device > ACL > IP Based ACL > Summary. The IP Based ACL

Summary Page opens:

Figure 32 IP Based ACL Summary Page

The IP Based ACL Summary Page contains the following fields:

■ ACL Name — Contains a list of the IP Based ACLs.

■ Priority — Indicates the ACE priority, which determines which ACE is

matched to a packet on a first-match basis. The possible field values are 1-2147483647, with 1 being the highest priority.

■ Protocol — Indicates the protocol in the ACE to which the packet is

matched.

■ Destination Port — Indicates the destination port that is matched

packets. Enabled only when TCP or UDP are selected in the Protocol list.

■ Source Port — Indicates the source port that is matched packets.

Enabled only when TCP or UDP are selected in the Protocol list.

■ Flag Set — Indicates the TCP flag to which the packet is mapped.

■ ICMP Type — Specifies an ICMP message type for filtering ICMP

packets.

66 CHAPTER 4: MANAGING DEVICE SECURITY

■ ICMP Code — Specifies an ICMP message code for filtering ICMP

packets. ICMP packets that are filtered by ICMP message type can also be filtered by the ICMP message code.

■ IGMP Type — IGMP packets can be filtered by IGMP message type.

■ Source Address — Matches the source IP address to which packets

are addressed to the ACL.

■ Source Mask — Indicates the source IP address mask.

■ Destination Address — Matches the destination IP address to which

packets are addressed to the ACL.

■ Destination Mask — Indicates the destination IP address mask.

■ DSCP — Matches the packet DSCP value to the ACL. Either the DSCP

value or the IP Precedence value is used to match packets to ACLs.

■ IP - Prec. — Indicates matching ip-precedence with the packet IP

precedence value.

■ Action — Indicates the ACL forwarding action. In addition, the port

can be shut down, a trap can be sent to the network administrator, or packet is assigned rate limiting restrictions for forwarding. The options are as follows:

Defining IP Based

ACLs

■ Permit — Forwards packets which meet the ACL criteria.

■ Deny — Drops packets which meet the ACL criteria.

■ Shutdown — Drops packet that meets the ACL criteria, and

disables the port to which the packet was addressed. Ports are reactivated from the Port Administration Setup Page.

Access Control Lists (ACL) allow network managers to define classification actions and rules for specific ingress ports. Your switch supports up to 256 ACLs. Packets entering an ingress port, with an active ACL, are either admitted or denied entry. If they are denied entry, the user can disable the port. ACLs are composed of access control entries (ACEs) that are made of the filters that determine traffic classifications. The total number of ACEs that can be defined in all ACLs together is 256.

Monitor users have no access to this page.

Defining Access Control Lists 67

To configure IP Based Access Control Lists:

1 Click Device > ACL > IP Based ACL > Setup. The IP Based ACL Setup

Page opens:

Figure 33 IP Based ACL Setup Page

The IP Based ACL Setup Page contains the following fields:

■ Selection ACL — Selects the ACL to be bound.

■ Create ACL — Defines a new user-defined IP based ACL.

Add Rules to ACL

■ Priority — Defines the ACL priority. ACLs are checked on the first fit

basis. The ACL priority defines the ACL order in the ACL list.

■ Protocol — Indicates the protocol in the ACE to which the packet is

matched. The possible fields are:

■ Select from List — Selects a protocol on which ACE can be based.

■ Protocol ID — Adds user-defined protocols by which packets are

matched to the ACE. Each protocol has a specific protocol number which is unique. The possible field range is 0-255.

■ Source Port — Indicates the source port that is used for matched

packets. Enabled only when TCP or UDP are selected in the Protocol list. The field value is either user defined or Any. If Any is selected the IP based ACL is applied to any source port.

68 CHAPTER 4: MANAGING DEVICE SECURITY

■ Destination Port — Indicates the destination port that is used for

matched packets. Enabled only when TCP or UDP are selected in the Protocol list. The field value is either user defined or Any. If Any is selected, the IP based ACL is applied to any destination port.

■ TCP Flags — If checked, enables configuration of TCP flags matched

to the packet. The possible fields are:

■ Urg — Urgent pointer field significant. The urgent pointer points to

the sequence number of the octet following the urgent data.

■ Ack — Acknowledgement field significant. The acknowledgement

field is the byte number of the next byte that the sender expects to receive from the receiver.

■ Psh — Push (send) the data as soon as possible, without buffering.

This is used for interactive traffic.

■ Rst — Reset the connection. This invalidates the sequence numbers

and aborts the session between the sender and receiver.

■ Syn — Synchronize Initial Sequence Numbers (ISNs). This is used to

initialize a new connection.

■ Fin — Finish. This indicates there is no more data from the sender.

This marks a normal closing of the session between the sender and receiver.

For each TCP flag, the possible field values are:

■ Set — Enables the TCP flag.

■ Unset — Disables the TCP flag.

■ Don’t Care — Does not check the packet’s TCP flag.

■ ICMP — If checked, enables filtering ICMP packets for an ICMP

message type. The possible values are:

■ Select from List — Selects an ICMP message type from a list.

■ ICMP Type — Specifies an ICMP message type.

■ Any — Does not filter for an ICMP message type.

■ ICMP Code — If checked, enables specifying an ICMP message code

for filtering ICMP packets. ICMP packets that are filtered by ICMP message type can also be filtered by the ICMP message code.

■ IGMP — If checked, enables filtering IGMP packets for an IGMP

message type. The possible values are:

■ Select from List — Selects an IGMP message type from a list.

Defining Access Control Lists 69

■ IGMP Type — Specifies an IGMP message type.

■ Any — Does not filter for an IGMP message type.

■ Source IP Address — If selected, enables matching the source port IP

address to which packets are addressed to the ACE, according to a wildcard mask. The field value is either user defined or Any. If Any is selected, accepts any source IP address and disables wildcard mask filtering.

■ Wild Card Mask — Defines the source IP address wildcard mask.

Wildcard masks specify which bits are used and which bits are ignored. A wildcard mask of 255.255.255.255 indicates that no bit is important. A wildcard mask of 0.0.0.0 indicates that all the bits are important. For example, if the source IP address is

149.36.184.198 and the wildcard mask is 0.0.0.255, the first three bytes of the IP address are matched, while the last eight bits are ignored. For the source IP address 149.36.184.198, this wildcard mask matches all IP addresses in the range 149.36.184.0 to

149.36.184.255. A wildcard mask must not contain leading zeroes. For example, a wildcard mask of 010.010.011.010 is invalid, but a wildcard mask of 10.10.11.10 is valid.

■ Destination IP Address — If selected, enables matching the

destination port IP address to which packets are addressed to the ACE, according to a wildcard mask. The field value is either user defined or Any. If Any is selected, accepts any destination IP address and disables wildcard mask filtering.

■ Wild Card Mask — Indicates the destination IP Address wildcard

mask. Wildcards are used to mask all or part of a destination IP Address. Wildcard masks specify which bits are used and which bits are ignored. A wildcard mask of 255.255.255.255 indicates that no bit is important. A wildcard mask of 0.0.0.0 indicates that all bits are important. For example, if the destination IP address

149.36.184.198 and the wildcard mask is 0.0.0.255, the first three bytes of the IP address are matched, while the last eight bits are ignored. For the destination IP address 149.36.184.198, this wildcard mask matches all IP addresses in the range 149.36.184.0 to 149.36.184.255. A wildcard mask must not contain leading zeroes. For example, a wildcard mask of 056.022.075.032 is invalid, but a wildcard mask of 56.22.75.32 is valid.

■ Match DSCP — Matches the packet DSCP value to the ACL. Either

the DSCP value or the IP Precedence value is used to match packets to ACLs.

70 CHAPTER 4: MANAGING DEVICE SECURITY

■ Match IP Precedence — Matches the packet IP Precedence value to

the ACE. Either the DSCP value or the IP Precedence value is used to match packets to ACLs.

■ Action — Indicates the ACL forwarding action. In addition, the port

can be shut down, a trap can be sent to the network administrator, or packet is assigned rate limiting restrictions for forwarding. The options are as follows:

■ Permit — Forwards packets which meet the ACL criteria.

■ Deny — Drops packets which meet the ACL criteria.

■ Shutdown — Drops packet that meets the ACL criteria, and

disables the port to which the packet was addressed. Ports are reactivated from the Port Administration Setup Page.

2 Select an ACL from the ACL Name drop-down list.

3 Define the rule setup fields.

4 Click Apply. The ACL rule setup is enabled, and the device is updated.

Modifying IP Based

ACLs

The IP Based ACL Modify Page allows the network administrator to modify IP Based ACLs settings.

Monitor users have no access to this page.

Figure 34 IP Based ACL Modify Page

Defining Access Control Lists 71

The IP Based ACL Modify Page contains the following fields:

■ Selection ACL — Selects the ACL to be modified.

Modify Rule

■ Priority — Defines the ACL priority. ACLs are checked on the first fit

basis. The ACL priority defines the ACL order in the ACL list.

■ Protocol — Indicates the protocol in the ACE to which the packet is

matched.

■ Select from List — Selects a protocol from a list on which ACE can

be based.

■ Protocol ID — Adds user-defined protocols by which packets are

matched to the ACE. Each protocol has a specific protocol number which is unique. The possible field range is 0-255.

■ Source Port — Enables creating an ACL based on a specific protocol.

■ Any — Enables creating an ACL based on any protocol.

■ Destination Port — Indicates the destination port that is matched

packets. Enabled only when TCP or UDP are selected in the Protocol list.

■ Any — Enables creating an ACL Based on any protocol.

■ TCP Flags — If checked, enables configuration of TCP flags matched

to the packet. The possible fields are:

■ Urg — Urgent pointer field significant. The urgent pointer points to

the sequence number of the octet following the urgent data.

■ Ack — Acknowledgement field significant. The acknowledgement

field is the byte number of the next byte that the sender expects to receive from the receiver.

■ Psh — Push (send) the data as soon as possible, without buffering.

This is used for interactive traffic.

■ Rst — Reset the connection. This invalidates the sequence numbers

and aborts the session between the sender and receiver.

■ Syn — Synchronize Initial Sequence Numbers (ISNs). This is used to

initialize a new connection.

■ Fin — Finish. This indicates there is no more data from the sender.

This marks a normal closing of the session between the sender and receiver.

72 CHAPTER 4: MANAGING DEVICE SECURITY

For each TCP flag, the possible field values are:

■ Set — Enables the TCP flag.

■ Unset — Disables the TCP flag.

■ Don’t Care — Does not check the packet’s TCP flag.

■ ICMP — If checked, enables filtering ICMP packets for an ICMP

message type. The possible values are:

■ Select from List — Selects an ICMP message type from a list.

■ ICMP Type — Specifies an ICMP message type.

■ Any — Does not filter for an ICMP message type.

■ ICMP Code — If checked, enables specifying an ICMP message code

for filtering ICMP packets. ICMP packets that are filtered by ICMP message type can also be filtered by the ICMP message code.

■ IGMP — If checked, enables filtering IGMP packets for an IGMP

message type. The possible values are:

■ Select from List — Selects an IGMP message type from a list.

■ IGMP Type — Specifies an IGMP message type.

■ Any — Does not filter for an IGMP message type.

■ Source IP Address — Matches the source IP address to which

packets are addressed to the ACL.

■ Wild Card Mask — Defines the source IP address wildcard mask.

Wildcard masks specify which bits are used and which bits are ignored. A mask of 255.255.255.255 indicates that no bit is important. A mask of 0.0.0.0 indicates that all the bits are important. For example, if the source IP address is 149.36.184.198 and the wildcard mask is 255.255.255.00, the first three bytes of the IP address are ignored, while the last eight bits are used.

■ Destination IP Address — Matches the destination IP address to

which packets are addressed to the ACL.

■ Wild Card Mask — Indicates the destination IP Address wildcard

mask. Wildcards are used to filter a destination IP Address. Masks specify which bits are used and which bits are ignored. A wildcard mask of 255.255.255.255 indicates that no bit is important. A wildcard mask of 0.0.0.0 indicates that all bits are important. For example, if the destination IP address 149.36.184.198 and the wildcard mask is 255.255.0.0, the first two bytes of the IP address are used, while the last two bytes are ignored.

Defining Access Control Lists 73

■ Match DSCP — Matches the packet DSCP value to the ACL. Either

the DSCP value or the IP Precedence value is used to match packets to ACLs.

■ Match IP Precedence — Matches the packet IP Precedence value to

the ACE. Either the DSCP value or the IP Precedence value is used to match packets to ACLs.

■ Action — Indicates the ACL forwarding action. In addition, the port

can be shut down, a trap can be sent to the network administrator, or packet is assigned rate limiting restrictions for forwarding. The options are as follows:

■ Permit — Forwards packets which meet the ACL criteria.

■ Deny — Drops packets which meet the ACL criteria.

■ Shutdown — Drops packet that meets the ACL criteria, and

disables the port to which the packet was addressed. Ports are reactivated from the Port Administration Setup Page.

Removing IP Based

ACLs

The IP Based ACL Remove Page allows the user to remove IP Based ACLs.

Monitor users have no access to this page.

1 Click Device > ACL > IP Based ACL > Remove. The IP Based ACL

Remove Page opens:

Figure 35 IP Based ACL Remove Page

74 CHAPTER 4: MANAGING DEVICE SECURITY

The IP Based ACL Remove Page contains the following fields:

■ ACL Name — Contains a list of the IP-based ACLs.

■ Remove ACL — Removes an ACL. The possible field values are:

■ Checked — Removes the selected IP-based ACL.

■ Unchecked — Maintains the IP-based ACL.

■ Priority — Indicates the ACL priority, which determines which ACL is

matched to a packet on a first-match basis. The possible field values are 1-2147483647.

■ Protocol — Indicates the protocol in the ACE to which the packet is

matched.

■ Destination Port — Defines the TCP/UDP destination port.

■ Source Port — Defines the TCP/UDP source port to which the ACL is

matched.

■ Flag Set — Sets the indicated TCP flag matched to the packet.

■ ICMP Type — Specifies an ICMP message type for filtering ICMP

packets.

■ ICMP Code — Specifies an ICMP message code for filtering ICMP

packets. ICMP packets that are filtered by ICMP message type can also be filtered by the ICMP message code.

■ IGMP Type — IGMP packets can be filtered by IGMP message type.

■ Source Address — Indicates the source IP address.

■ Source Mask — Indicates the source IP address mask.

■ Destination Address — Indicates the destination IP address.

■ Destination Mask — Indicates the destination IP address mask.

■ DSCP — Matches the packet DSCP value to the ACL. Either the DSCP

value or the IP Precedence value is used to match packets to ACLs.

■ IP - Prec. — Indicates matching ip-precedence with the packet IP

precedence value.

■ Action — Indicates the ACL forwarding action. In addition, the port

can be shut down, a trap can be sent to the network administrator, or packet is assigned rate limiting restrictions for forwarding. The options are as follows:

■ Permit — Forwards packets which meet the ACL criteria.

■ Deny — Drops packets which meet the ACL criteria.

Defining Access Control Lists 75

■ Shutdown — Drops packet that meets the ACL criteria, and

disables the port to which the packet was addressed. Ports are reactivated from the Port Administration Setup Page.

2 Select an ACL to be removed.

3 Click Apply. The selected ACLs are deleted, and the device is updated.

Viewing ACL Binding The ACL Binding Summary Page displays the user-defined ACLs mapped

to the interfaces.

To view ACL Binding:

1 Click Device > ACL > ACL Binding > Summary. The ACL Binding

Summary Page opens:

Figure 36 ACL Binding Summary Page

The ACL Binding Summary Page contains the following fields:

■ Interface — Displays the port or LAG number to which the ACL is

bound.

■ ACL Name — Displays the name of ACL which is bound to a selected

port.

76 CHAPTER 4: MANAGING DEVICE SECURITY

Configuring ACL

Binding

The ACL Binding Setup Page allows the network administrator to bind specific ports to MAC or IP Based ACLs.

The monitor user has no access to this page.

To define ACL Binding:

1 Click Device > ACL > ACL Binding > Summary. The ACL Binding

Summary Page opens:

Figure 37 ACL Binding Setup Page

The ACL Binding Setup Page contains the following fields:

■ Select Port(s) — Indicates the ports to be configured.

■ Bind ACL — Assigns an Access Control List to a port or LAG.

■ MAC-based ACL — Displays the MAC based ACL to which the

interface is assigned.

■ IP-based ACL — Displays the IP based ACL to which the interface is

assigned.

■ Select ACL — Contains a list of previously defined Access Control

Lists to which the port or LAG can be bound. To bind an ACL to a LAG, the ACL should be bound to its port members.

2 Define the relevant fields.

3 Click Apply. ACL Binding is defined, and the device is updated.

Defining Access Control Lists 77

Removing ACL

Binding

The ACL Binding Remove Page allows the network administrator to remove user-defined ACLs from a selected interface.

Monitor users have no access to this page.

To remove ACL Binding:

1 Click Device > ACL > ACL Binding > Remove. The ACL Binding Remove

Page opens:

Figure 38 ACL Binding Remove Page

The ACL Binding Remove Page contains the following fields:

■ Interface — Displays the port interface to which the ACL is bound.

■ ACL Name — Displays the name of ACL to be removed from the

selected port.

2 Select an ACL to be removed.

3 Click Apply. The selected ACLs are removed, and the device is updated.

78 CHAPTER 4: MANAGING DEVICE SECURITY

Enabling Broadcast Storm

Broadcast Storm limits the amount of Multicast and Broadcast frames accepted and forwarded by the device. When Layer 2 frames are forwarded, Broadcast and Multicast frames are flooded to all ports on the relevant VLAN. This occupies bandwidth, and loads all nodes on all ports.

A Broadcast Storm is a result of an excessive amount of broadcast messages simultaneously transmitted across a network by a single port. Forwarded message responses are heaped onto the network, straining network resources or causing the network to time out.

Broadcast Storm is enabled for all Gigabit ports by defining the packet type and the rate the packets are transmitted. The system measures the incoming Broadcast and Multicast frame rates separately on each port, and discards the frames when the rate exceeds a user-defined rate.

Packet threshold is ignored if Broadcast Storm Control is Disabled.

Monitor users have no access to this page.

1 Click Device > Broadcast Storm > Setup. The Broadcast Storm Setup

Page opens:

Figure 39 Broadcast Storm Setup Page

Enabling Broadcast Storm 79

The Broadcast Storm Setup Page contains the following fields:

■ Broadcast Storm Control — Indicates if forwarding Broadcast

packet types is enabled on the interface.

■ Disabled — Disables broadcast control on the selected port.

■ Broadcast — Enables broadcast control on the selected port.

■ Broadcast&Multicast — Enables broadcast and multicast control on

the selected port.

■ Packet Rate Threshold (3500-1,000,000) — Indicates the maximum

rate (kilobits per second) at which unknown packets are forwarded. The range is 3,500-1,000,000. The default value is 3500.

2 Define the relevant fields.

3 Click Apply. Broadcast Storm is defined, and the device is updated.

GENERAL SYSTEM INFORMATION

This section contains information about configuring general system parameters, and includes the following:

■ Viewing System Description

■ Configuring System Name Information

■ Configuring System Time

Viewing System Description

The Device View Page displays parameters for configuring general device information, including the system name, MAC Address, software and hardware versions, and more.

1 Click Device Summary. The Device View Page opens.

Figure 40 Device View Page

Viewing System Description 81

The Device View Page contains the following fields:

■ Product Description — Displays the device model number and

name. Not user-editable.

■ System Name — Displays the user-defined device name. See

“Configuring System Name Information” page 82.

■ System Location — Displays the location where the system is

currently running. See page 82.

■ System Contact — Displays the name of the contact person. See

“Configuring System Name Information” page 82.

■ Serial Number — Displays the device serial number. Not editable.

■ Product 3C Number — Displays the 3Com device model number.

Not editable.

■ System Object ID — Displays the vendor’s authoritative identification

of the network management subsystem contained in the entity. Not editable.

■ MAC Address — Displays the device MAC address. Not editable.

■ System Up Time — Displays the amount of time since the device was

reset.

■ Software Version — Displays the installed software version number.

■ Boot Version — Displays the current boot version running on the

device.

■ Hardware Version — Displays the current hardware version of the

device.

■ Poll Now — This button immediately polls the switch ports for

information including speed, use and status. The information is displayed by clicking the port icons at the top of the Device View tab. “Device Representation” page 32.

82 CHAPTER 5: GENERAL SYSTEM INFORMATION

Configuring System Name Information

The System Name Page allows the Network Administrator to provide a user-defined system name, location, and contact information for the device.

Monitor users have read-only permissions on this page.

To configure the System Name:

1 Click Administration > System Name. The System Name Page opens:

Figure 41 System Name Page

The System Name Page includes the following fields:

■ System Name — Defines the user-defined device name. The field

range is 0-100 characters.

■ System Location — Defines the location where the system is

currently running. The field range is 0-100 characters.

■ System Contact — Defines the name of the contact person. The field

range is 0-100 characters.

2 Define the fields.

3 Click Apply. The System Name is enabled, and the device is updated.

4 Be sure to save your configuration, or you changes will be lost when the

switch is rebooted. To save the configuration, refer to “Saving the Configuration” on page 37.

Configuring System Time 83

Configuring System Time

The System Time Setup Page contains fields for defining system time parameters for the local hardware clock. Daylight Savings Time can be enabled on the device.

Monitor users have limited permissions on this page.

Country specific times need to be added manually.

To configure the System Time:

1 Click Administration > System Time. The System Time Setup Page

opens:

Figure 42 System Time Setup Page

The System Time Setup Page contains the following sections:

■ Local Settings — Displays the system time in the following format:

■ Time — Indicates the system time. You can configure the Hours (in

24-hour format), Minutes, and Seconds.

■ Date — Displays the month of the year. You can configure the

Month, Day, and Year.

■ Daylight Saving — This check box enables and disables automatic

Daylight Saving Time (DST) on the switch. When checked, the DST setup parameters are displayed.

84 CHAPTER 5: GENERAL SYSTEM INFORMATION

■ DST Region — Selects USA or European standard DST, or

customizable DST.

■ USA — The device switches to DST at 2:00 a.m. from the second

Sunday in March, and reverts to standard time at 2:00 a.m. on the First Sunday of November

■ European — The device switches to DST at 1:00 am on the last

Sunday in March and reverts to standard time at 1:00 am on the last Sunday in October. The European option applies to EU members, and other European countries using the EU standard.

■ Other — The DST definitions are user-defined and can be

customized to your location. If Other is selected, the From and To fields must be defined.

■ Time Set Offset — Sets the amount of time adjusted for DST (in

minutes). The default time is 60 minutes.

■ From — Indicates the non-recurring time that DST begins when the

region is set to Other. Enter the Hours, Minutes, Month, day, and Year for DST to begin.

■ To — Indicates the non-recurring time that DST ends when the region

is set to Other. Enter the Hours, Minutes, Month, day, and Year for DST to end.

■ Recurring — When the region is set to Other, this check box enables

user-defined DST that is constant from year to year.

■ Recurring From — The recurring time that DST begins each year.

Select or type the Day, Week, Month, and Time.

■ Recurring To — The recurring time that DST ends each year. Select or

type the Day, Week, Month, and Tim.:

2 Define the local Time and Date.

3 Enable or disable automatic DST by clicking the Daylight Savings box.

4 Configure the region, Time Set Offset, Recurring, From and To fields as

appropriate for your location.

5 Click Apply. The DST settings are saved, and the device is updated.

6 Be sure to save your configuration, or you changes will be lost when the

switch is rebooted. To save the configuration, refer to “Saving the Configuration” on page 37.

CONFIGURING PORTS

This section contains information for configuring Port Settings, and includes the following sections:

■ Viewing Port Settings

■ Defining Port Settings

■ Viewing Port Details

Viewing Port Settings

The Port Administration Summary Page permits the network manager to view the current port and LAG setting configuration. The Port Administration Summary Page also displays to which LAGs the port belongs. When configuring the port speed and port Duplex mode, please note the following:

■ Setting the port speed to 10/100/1000 and the Duplex mode to Half =

admin speed is = 10/100/1000 half and no advertisement.

■ Setting the port speed to 10/100/1000 and the Duplex mode to Full =

admin speed is = 10/100/1000 full and no advertisement.

■ Setting the port speed to 10/100/1000 and the Duplex mode to Auto

= admin speed is = Admin Advertisement = 10/100/1000 full and half.

■ Setting the port speed to Auto and Duplex mode to Half = Admin

Advertisement = 10+100+1000 half.

■ Setting the port speed to Auto and Duplex mode to Full = Auto -

Admin Advertisement = 10+100+1000 and Full.

■ Setting the port speed to 10/100/1000 and the Duplex mode to Auto

= Admin Advertisement = 10/100/1000 Full+Half.

86 CHAPTER 6: CONFIGURING PORTS

To view Port Settings:

1 Click Port > Administration > Summary. The Port Administration

Summary Page opens:

Figure 43 Port Administration Summary Page

The Port Administration Summary Page contains the following fields:

■ Port — Indicates the selected port number.

■ Port Status — Indicates whether the port is currently operational or

non-operational. The possible field values are:

■ Up — Indicates the port is currently operating.

■ Down — Indicates the port is currently not operating.

■ Suspended — Indicates the port has been shutdown through a

device security option

■ Port Speed — Displays the configured rate for the port. The port type

determines what speed setting options are available. Port speeds can only be configured when auto negotiation is disabled. The possible field values are:

Viewing Port Settings 87

■ 10M — Indicates the port is currently operating at 10 Mbps.

■ 100M — Indicates the port is currently operating at 100 Mbps.

■ 1000M — Indicates the port is currently operating at 1000 Mbps.

■ Duplex Mode — Displays the port duplex mode. This field is

configurable only when auto negotiation is disabled, and the port speed is set to 10M or 100M or 1000M per second. This field cannot be configured on LAGs. The possible field values are:

■ Full — The interface supports transmission between the device and

its link partner in both directions simultaneously.

■ Half — The interface supports transmission between the device

and the client in only one direction at a time.

■ Flow Control — Displays the flow control status on the port.

Operates when the port is in full duplex mode. The possible field values are:

■ Enable — Enables flow control on the port.

■ Disable — Disables flow control on the port.

88 CHAPTER 6: CONFIGURING PORTS

Defining Port Settings

The Port Administration Setup Page allows network managers to configure port parameters for specific ports.

Monitor users have no access to this page.

To configure Port Settings:

1 Click Port > Administration > Setup. The Port Administration Setup

Page opens:

Figure 44 Port Administration Setup Page

The Port Administration Setup Page contains the following fields:

■ Port State — Defines the port state. The possible values are:

■ No Change — Retains the current port status.

■ Enable — Enables the port.

■ Disable — Disables the port.

■ Speed — Defines the configured rate for the port. The port speed

determines what speed setting options are available. Port speeds can only be configured when auto negotiation is disabled. The possible field values are:

Defining Port Settings 89

■ 10 — Indicates the port is currently operating at 10 Mbps.

■ 100 — Indicates the port is currently operating at 100 Mbps.

■ 1000 — Indicates the port is currently operating at 1000 Mbps.

■ Auto — Use to automatically configure the port.

■ No Change — Retains the current port speed.

■ Duplex — Displays the port duplex mode. This field is configurable

only when auto negotiation is disabled, and the port speed is set to 10M or 100M. This field cannot be configured on LAGs. The possible field values are:

■ Auto — Use to automatically configure the port.

■ Full — The interface supports transmission between the device and

its link partner in both directions simultaneously.

■ Half — The interface supports transmission between the device

and the client in only one direction at a time.

■ No Change — Retains the current port duplex mode.

■ Flow Control — Displays the flow control status on the port.

Operates when the port is in full duplex mode. The possible field values are:

■ Enable — Enables flow control on the port.

■ Disable — Disables flow control on the port.

■ No Change — Retains the current flow control status on port.

■ Reactivate — Reactivates a port if the port has been shutdown

through a device security option. The possible field values are:

■ Reactivate — Reactivates a port.

■ No Change — Retains the current port status.

■ Select Ports — Displays the ports to be configured.

2 Define the fields.

3 Click Apply. The ports are enabled, and the device is updated.

90 CHAPTER 6: CONFIGURING PORTS

Viewing Port Details

The Port Detail Page displays current port parameters for specific ports.

Monitor users have no access to this page.

To view Port Details:

1 Click Port > Administration > Detail. The Port Detail Page opens:

Figure 45 Port Detail Page

The Port Detail Page contains the following fields:

■ Select a Port — Displays the current port settings.

■ Port State — Indicates the port state. The possible field values are:

■ Enable — Enables the port.

■ Disable — Disables the port.

■ Flow Control — Displays the flow control status on the port.

Operates when the port is in full duplex mode. The possible field values are:

■ Enable — Enables flow control on the port.

■ Disable — Disables flow control on the port.

Viewing Port Details 91

■ Speed — Displays the configured rate for the port. The port type

determines what speed setting options are available. Port speeds can only be configured when auto negotiation is disabled. The possible field values are:

■ 10 — Indicates the port is currently operating at 10 Mbps.

■ 100 — Indicates the port is currently operating at 100 Mbps.

■ 1000 — Indicates the port is currently operating at 1000 Mbps.

■ Auto — Use to automatically configure the port.

■ Duplex — Displays the port duplex mode. This field is configurable

only when auto negotiation is disabled, and the port speed is set to 10M or 100M. This field cannot be configured on LAGs. The possible field values are:

■ Auto — Use to automatically configure the port.

■ Full — The interface supports transmission between the device and

its link partner in both directions simultaneously.

■ Half — The interface supports transmission between the device

and the client in only one direction at a time.

2 Define the fields.

3 Click Apply. The ports are enabled, and the device is updated.

AGGREGATING PORTS

This section contains information for configuring Link Aggregation, which optimizes port usage by linking a group of ports together to form a single LAG. A Link Aggregated Group (LAG) aggregates ports or VLANs into a single virtual port or VLAN bandwidth between the devices, increases port flexibility, and provides link redundancy. Ensure the following:

■ All ports within a LAG must be the same media type.

■ All ports added to an existing LAG which are part of a tagged VLAN

inherit the existing VLAN tags.

■ Auto-negotiation mode is not configured on the port.

■ The port is in full-duplex mode.

■ All ports in the LAG have the same ingress filtering and tagged modes.

■ All ports in the LAG have the same back pressure and flow control

modes.

■ All ports in the LAG have the same priority.

■ All ports in the LAG have the same transceiver type.

■ The device supports up to eight LAGs, and eight ports in each LAG.

■ Ports added to a LAG lose their individual port configuration. When

ports are removed from the LAG, the original port configuration is applied to the ports.

. Aggregating ports multiplies the

This section contains the following topics:

■ Viewing Link Aggregation

■ Configuring Link Aggregation

■ Modifying Link Aggregation

■ Removing Link Aggregation

■ Viewing LACP

■ Modifying LACP

Viewing Link Aggregation 93

Viewing Link Aggregation

The Link Aggregation Summary Page displays port usage by linking a group of ports together to form a single LAG. Aggregating ports multiplies the bandwidth between the devices, increases port flexibility, and provides link redundancy.

To view Link Aggregation:

1 Click Ports > Link Aggregation > Summary. The Link Aggregation

Summary Page opens:

Figure 46 Link Aggregation Summary Page

Configuring Link Aggregation

The Link Aggregation Summary Page includes the following fields:

■ Group ID — Displays the Link Aggregated Group ID.

■ Ty pe — Displays the type of link aggregation for the Group ID.

■ Ports — Displays the member ports included in the specified LAG.

The Link Aggregation Create Page optimizes port usage by linking a group of ports together to form a single LAG. Aggregating ports multiplies the bandwidth between the devices, increases port flexibility, and provides link redundancy.

Monitor users have no access to this page.

94 CHAPTER 7: AGGREGATING PORTS

1 Click Ports > Link Aggregation > Create. The Link Aggregation Create

Page opens:

Figure 47 Link Aggregation Create Page

The Link Aggregation Create Page includes the following fields:

■ Enter aggregation Group ID — Displays the group ID. The range is

1-8 groups.

■ Static — Selects the link aggregation type to be static.

■ LACP — Selects the link aggregation type to be LACP.

■ Select ports for the new aggregation — Displays the ports for

which the link aggregation parameters are defined.

■ Blue — Displays a member of the aggregation being created.

■ White — Displays a non existent member of any aggregation.

■ Grey — Displays a member of an existing aggregation or VLAN.

Summary

■ Group ID — Displays the Link Aggregated Group ID.

■ Member Ports — Displays the ports configured to the LAG.

2 Define the fields.

3 Click Apply. The LAG configuration is defined, and the device is updated.

Modifying Link Aggregation 95

Modifying Link Aggregation

The Link Aggregation Modify Page optimizes port usage by linking a group of ports together to form a single LAG. Aggregating ports multiplies the bandwidth between the devices, increases port flexibility, and provides link redundancy.

Monitor users have no access to this page.

To modify Link Aggregation:

1 Click Ports > Link Aggregation > Modify. The Link Aggregation

Modify Page opens:

Figure 48 Link Aggregation Modify Page

The Link Aggregation Modify Page includes the following fields:

■ Select Aggregation to Modify — Selects the Link Aggregation

Group ID to modify.

■ Selected Ports — Allows the network manager to select ports to be

added or removed from a current aggregation. The selected or de-selected ports are color-coded as follows:

■ Blue — Displays a member of the modified aggregation.

■ White — Not a member of any aggregation.

■ Grey — Displays a member of an existing aggregation or VLAN.

96 CHAPTER 7: AGGREGATING PORTS

Summary

■ Group ID — Displays the Link Aggregated Group ID.

■ Ty pe — Displays the link aggregation type.

■ Member Ports — Displays the ports configured to the LAG.

2 Define the fields.

3 Click Apply. Link Aggregation is configured, and the application is

updated.

Removing Link Aggregation

The Link Aggregation Remove Page allows the network manager to remove group IDs containing member ports.

Monitor users have no access to this page.

To remove Link Aggregation:

1 Click Ports > Link Aggregation > Remove. The Link Aggregation

Remove Page opens:

Figure 49 Link Aggregation Remove Page

Viewing LACP 97

The Link Aggregation Remove Page includes the following fields:

■ Select Aggregation(s) to Remove — Displays the Link Aggregation

table. Each row corresponds to a Link Aggregated Group ID. The fields in the table are:

■ Group ID — Displays the Link Aggregated Group ID.

■ Typ e — Displays the Link Aggregation type.

■ Member Ports — Displays the ports for which the link aggregation

parameters are defined.

2 Select a group ID to be removed

3 Click Remove. The Link aggregation is removed, and the device is

updated.

Viewing LACP LAG ports can contain different media types if the ports are operating at

the same speed. Aggregated links can be set up manually or automatically established by enabling LACP on the relevant links. Aggregate ports can be linked into link-aggregation port-groups. The LACP Summary Page contains fields for viewing LACP LAGs.

1 Click Port > LACP > Summary. The LACP Summary Page opens:

Figure 50 LACP Summary Page

98 CHAPTER 7: AGGREGATING PORTS

The LACP Summary Page contains the following fields:

■ Port — Displays the port number to which timeout and priority values

are assigned.

■ Port-Priority — Displays the LACP priority value for the port. The field

range is 1-65535.

■ LACP Timeout — Displays the administrative LACP timeout. The

possible field values are:

■ Long — Specifies the long timeout value.

■ Short — Specifies the short timeout value.

Modifying LACP LAG ports can contain different media types if the ports are operating at

the same speed. Aggregated links can be set up manually or automatically established by enabling LACP on the relevant links. Aggregate ports can be linked into link-aggregation port-groups. The LACP Modify Page contains fields for modifying LACP LAGs.

1 Click Port > LACP > Summary. The LACP Modify Page opens:

Figure 51 LACP Modify Page

Modifying LACP 99

The LACP Modify Page contains the following fields:

■ LACP System Priority — Specifies system priority value. The field

range is 1-65535. The field default is 1

■ Select Port — Displays the port number to which timeout and priority

values are assigned.

■ LACP Port Priority — Displays the LACP priority value for the port.

The field range is 1-65535.

■ LACP Timeout — Displays the administrative LACP timeout. The

possible field values are:

■ Long — Specifies the long timeout value.

■ Short — Specifies the short timeout value.

2 Define the fields.

3 Click Apply. Link Aggregation is modified, and the application is

updated.

CONFIGURING VLANS

This section contains the following topics:

■ VLAN Overview

■ Viewing VLAN Details

■ Viewing VLAN Port Details

■ Creating VLANs

■ Modifying VLAN Settings

■ Modifying Port VLAN Settings

■ Removing VLANs

VLAN Overview VLANs are logical subgroups with a Local Area Network (LAN) which

combine user stations and network devices into a single unit, regardless of the physical LAN segment to which they are attached. VLANs allow network traffic to flow more efficiently within subgroups. VLANs use software to reduce the amount of time it takes for network changes, additions, and moves to be implemented. VLANs restrict traffic within the VLAN.

VLAN1 is the management VLAN. You can only manage the switch through a port that is an untagged member of VLAN1.

VLANs have no minimum number of ports, and can be created per unit, per device, or through any other logical connection combination, since they are software-based and not defined by physical attributes.

VLANs function at Layer 2. Since VLANs isolate traffic within the VLAN, a Layer 3 router working at a protocol level is required to allow traffic flow between VLANs. Layer 3 routers identify segments and coordinate with VLANs. VLANs are Broadcast and Multicast domains. Broadcast and Multicast traffic is transmitted only in the VLAN in which the traffic is generated.

3COM 3CBLSG16 User Manual

Specifications and Main Features

Frequently Asked Questions

User Manual

ABOUT THIS GUIDE

User Guide Overview

Intended Audience 5

Conventions Table 1 lists conventions that are used throughout this guide.

Related Documentation

CONTENTS

GETTING STARTED

About the Switch 2916 and 2924

Front Panel Detail 13

LED Status Indicators

System Specifications

Installing the Switch

Setting Up for Management

Methods of Managing a Switch

Switch Setup Overview

Using the Command Line Interface (CLI)

Setting Up Web Interface Management

Setting Up SNMP Management V1 or V2

Default Users and Passwords

Upgrading Software using the CLI

USING THE 3COM WEB INTERFACE

Starting the 3Com Web Interface

Understanding the 3Com Web Interface

Using Screen and Table Options

Saving the Configuration

Resetting the Device

Restoring Factory Defaults

Logging Off the Device

VIEWING BASIC SETTINGS

Viewing Device Settings

Viewing Color Keys 43

MANAGING DEVICE SECURITY

Configuring System Access

Defining RADIUS Clients

Defining Port-Based Authentication (802.1X)

Defining Access Control Lists

Enabling Broadcast Storm

GENERAL SYSTEM INFORMATION

Viewing System Description

Configuring System Name Information

Configuring System Time

CONFIGURING PORTS

Viewing Port Settings

Defining Port Settings

Viewing Port Details

AGGREGATING PORTS

Viewing Link Aggregation

Configuring Link Aggregation

Modifying Link Aggregation

Removing Link Aggregation

Viewing LACP 97

Modifying LACP LAG ports can contain different media types if the ports are operating at

CONFIGURING VLANS