Accton Technology ES4548D, ES4524D, Direk Tronik 24-48-Port User Manual

Download

ES4524D ES4548D

24/48-Port Gigabit Ethernet Switch

Management Guide

e-mail: info@direktronik.se tel: 08-52 400 700 fax: 08-520 18121

Management Guide

ES4524D Gigabit Ethernet Switch

Layer 2 Switch with 20 10/100/1000BASE-T (RJ-45) Ports, and 4 Gigabit Combination Ports (RJ-45/SFP)

ES4548D Gigabit Ethernet Switch

Layer 2 Switch with 44 10/100/1000BASE-T (RJ-45) Ports, and 4 Gigabit Combination Ports (RJ-45/SFP)

ES4524D ES4548D F0.0.0.4 E112006-CS-R01 149100030400A

Contents

Section I: Getting Started

Chapter 1: Introduction 1-1

Key Features 1-1 Description of Software Features 1-2 System Defaults 1-6

Chapter 2: Initial Configuration 2-1

Connecting to the Switch 2-1

Configuration Options 2-1 Required Connections 2-2 Remote Connections 2-2

Basic Configuration 2-3

Console Connection 2-3 Setting Passwords 2-3 Setting an IP Address 2-4

Manual Configuration 2-4 Dynamic Configuration 2-8

Enabling SNMP Management Access 2-10

Community Strings (for SNMP version 1 and 2c clients) 2-10 Trap Receivers 2-11 Configuring Access for SNMP Version 3 Clients 2-12

Managing System Files 2-12

Saving Configuration Settings 2-13

Section II: Switch Management

Chapter 3: Configuring the Switch 3-1

Using the Web Interface 3-1 Navigating the Web Browser Interface 3-2

Home Page 3-2 Configuration Options 3-3 Panel Display 3-3 Main Menu 3-4

Chapter 4: Basic System Settings 4-1

Displaying System Information 4-1 Displaying Switch Hardware/Software Versions 4-3 Displaying Bridge Extension Capabilities 4-5 Configuring Support for Jumbo Frames 4-6 Renumbering the Stack 4-7 Resetting the System 4-7

Contents

Chapter 5: Setting an IP Address 5-1

Setting the Switch’s IP Address (IP Version 4) 5-1

Manual Configuration 5-2 Using DHCP/BOOTP 5-3

Setting the Switch’s IP Address (IP Version 6) 5-4

Configuring an IPv6 Address 5-4 Configuring an IPv6 General Network Prefix 5-10 Configuring the Neighbor Detection Protocol and Static Entries 5-11

Chapter 6: Managing System Files 6-1

Managing Firmware 6-1

Downloading System Software from a Server 6-2

Saving or Restoring Configuration Settings 6-4

Downloading Configuration Settings from a Server 6-5

Chapter 7: Console Port Settings 7-1

Chapter 8: Telnet Settings 8-1

Chapter 9: Configuring Event Logging 9-1

System Log Configuration 9-1 Remote Log Configuration 9-2 Displaying Log Messages 9-4 Sending Simple Mail Transfer Protocol Alerts 9-4

Chapter 10: Setting the System Clock 10-1

Configuring SNTP 10-1 Setting the Time Zone 10-2

Chapter 11: Simple Network Management Protocol 11-1

SNMP Overview 11-1 Enabling the SNMP Agent 11-2 Setting Community Access Strings 11-3 Specifying Trap Managers and Trap Types 11-4 Configuring SNMPv3 Management Access 11-6

Setting a Local Engine ID 11-7 Specifying a Remote Engine ID 11-7 Configuring SNMPv3 Users 11-8 Configuring Remote SNMPv3 Users 11-10 Configuring SNMPv3 Groups 11-12 Setting SNMPv3 Views 11-16

Chapter 12: User Authentication 12-1

Configuring User Accounts 12-1 Configuring Local/Remote Logon Authentication 12-2 Configuring HTTPS 12-5

Replacing the Default Secure-site Certificate 12-6

Configuring the Secure Shell 12-8

Generating the Host Key Pair 12-10

Contents

Configuring the SSH Server 12-12

Filtering IP Addresses for Management Access 12-13

Chapter 13: Configuring Port Security 13-1

Chapter 14: Configuring 802.1X Port Authentication 14-1

Displaying 802.1X Global Settings 14-2 Configuring 802.1X Global Settings 14-3 Configuring Port Settings for 802.1X 14-3 Displaying 802.1X Statistics 14-6

Chapter 15: Access Control Lists 15-1

Overview 15-1 Setting an ACL Name and Type 15-1 Configuring a Standard IPv4 ACL 15-2 Configuring an Extended IPv4 ACL 15-3 Configuring a MAC ACL 15-6 Configuring a Standard IPv6 ACL 15-7 Configuring an Extended IPv6 ACL 15-8 Binding a Port to an Access Control List 15-11

Chapter 16: Port Configuration 16-1

Displaying Connection Status 16-1 Configuring Interface Connections 16-4 Showing Port Statistics 16-6

Chapter 17: Creating Trunk Groups 17-1

Statically Configuring a Trunk 17-2 Setting a Load-Balance Mode for Trunks 17-3 Enabling LACP on Selected Ports 17-5 Configuring LACP Parameters 17-7 Displaying LACP Port Counters 17-9 Displaying LACP Settings and Status for the Local Side 17-11 Displaying LACP Settings and Status for the Remote Side 17-13

Chapter 18: Broadcast Storm Control 18-1

Setting Broadcast Storm Thresholds 18-1

Chapter 19: Configuring Port Mirroring 19-1

Chapter 20: Configuring Rate Limits 20-1

Chapter 21: Address Table Settings 21-1

Setting Static Addresses 21-1 Displaying the Address Table 21-2 Changing the Aging Time 21-4

Chapter 22: Spanning Tree Algorithm Configuration 22-1

Overview 22-1 Displaying Global Settings 22-3

vii

Contents

Configuring Global Settings 22-6 Displaying Interface Settings 22-10 Configuring Interface Settings 22-13 Configuring Multiple Spanning Trees 22-15 Displaying Interface Settings for MSTP 22-18 Configuring Interface Settings for MSTP 22-19

Chapter 23: VLAN Configuration 23-1

Assigning Ports to VLANs 23-1 Enabling or Disabling GVRP (Global Setting) 23-4 Displaying Basic VLAN Information 23-4 Displaying Current VLANs 23-5 Creating VLANs 23-6 Adding Static Members to VLANs (VLAN Index) 23-7 Adding Static Members to VLANs (Port Index) 23-9 Configuring VLAN Behavior for Interfaces 23-10 Configuring IEEE 802.1Q Tunneling 23-12

Enabling QinQ Tunneling on the Switch 23-16 Adding an Interface to a QinQ Tunnel 23-17

Chapter 24: Configuring Private VLANs 24-1

Enabling Private VLANs 24-1 Configuring Uplink and Downlink Ports 24-2

Chapter 25: Configuring Protocol-Based VLANs 25-1

Configuring Protocol Groups 25-1 Mapping Protocols to VLANs 25-2

Chapter 26: Class of Service Configuration 26-1

Layer 2 Queue Settings 26-1

Setting the Default Priority for Interfaces 26-1 Mapping CoS Values to Egress Queues 26-3 Selecting the Queue Mode 26-4 Setting the Service Weight for Traffic Classes 26-5

Layer 3/4 Priority Settings 26-7

Mapping Layer 3/4 Priorities to CoS Values 26-7 Selecting IP Precedence/DSCP Priority 26-7 Mapping IP Precedence 26-8 Mapping DSCP Priority 26-9 Mapping IP Port Priority 26-11

Chapter 27: Quality of Service 27-1

Configuring Quality of Service Parameters 27-1 Configuring a Class Map 27-2 Creating QoS Policies 27-4 Attaching a Policy Map to Ingress Queues 27-7

viii

Contents

Chapter 28: Multicast Filtering 28-1

Layer 2 IGMP (Snooping and Query) 28-1

Configuring IGMP Snooping and Query Parameters 28-2 Displaying Interfaces Attached to a Multicast Router 28-4 Specifying Static Interfaces for a Multicast Router 28-5 Displaying Port Members of Multicast Services 28-6 Assigning Ports to Multicast Services 28-7

Chapter 29: Configuring Domain Name Service 29-1

Configuring General DNS Service Parameters 29-1 Configuring Static DNS Host to Address Entries 29-3 Displaying the DNS Cache 29-5

Chapter 30: Switch Clustering 30-1

Cluster Configuration 30-1 Cluster Member Configuration 30-2 Cluster Member Information 30-3 Cluster Candidate Information 30-4

Section III: Command Line Interface

Chapter 31: Using the Command Line Interface 31-1

Accessing the CLI 31-1

Console Connection 31-1 Telnet Connection 31-1

Entering Commands 31-3

Keywords and Arguments 31-3 Minimum Abbreviation 31-3 Command Completion 31-3 Getting Help on Commands 31-3

Showing Commands 31-4 Partial Keyword Lookup 31-5 Negating the Effect of Commands 31-5 Using Command History 31-5 Understanding Command Modes 31-6 Exec Commands 31-6 Configuration Commands 31-7 Command Line Processing 31-9

Chapter 32: CLI Command Groups 32-1

Chapter 33: General Commands 33-1

enable 33-1 disable 33-2 configure 33-2 show history 33-3 prompt 33-4

Contents

end 33-4 exit 33-4 quit 33-5

Chapter 34: System Management Commands 34-1

hostname 34-1 reload 34-2 switch renumber 34-2 jumbo frame 34-3 show startup-config 34-3 show running-config 34-5 show system 34-7 show users 34-7 show version 34-8

Chapter 35: File Management Commands 35-1

copy 35-2 delete 35-4 dir 35-5 whichboot 35-6 boot system 35-7

Chapter 36: Line Commands 36-1

line 36-1 login 36-2 password 36-3 timeout login response 36-4 exec-timeout 36-4 password-thresh 36-5 silent-time 36-6 databits 36-6 parity 36-7 speed 36-8 stopbits 36-8 disconnect 36-9 show line 36-9

Chapter 37: Event Logging Commands 37-1

logging on 37-1 logging history 37-2 logging host 37-3 logging facility 37-3 logging trap 37-4 clear log 37-5 show logging 37-5 show log 37-7

Contents

Chapter 38: SMTP Alert Commands 38-1

logging sendmail host 38-1 logging sendmail level 38-2 logging sendmail source-email 38-2 logging sendmail destination-email 38-3 logging sendmail 38-3 show logging sendmail 38-4

Chapter 39: Time Commands 39-1

sntp client 39-1 sntp server 39-2 sntp poll 39-3 show sntp 39-3 clock timezone 39-4 calendar set 39-5 show calendar 39-5

Chapter 40: SNMP Commands 40-1

snmp-server 40-2 show snmp 40-2 snmp-server community 40-3 snmp-server contact 40-4 snmp-server location 40-4 snmp-server host 40-5 snmp-server enable traps 40-7 snmp-server engine-id 40-8 show snmp engine-id 40-9 snmp-server view 40-10 show snmp view 40-11 snmp-server group 40-11 show snmp group 40-13 snmp-server user 40-14 show snmp user 40-15

Chapter 41: User Authentication Commands 41-1

User Account Commands 41-1

username 41-1 enable password 41-2

Authentication Sequence 41-3

authentication login 41-3 authentication enable 41-4

RADIUS Client 41-5

radius-server host 41-6 radius-server port 41-6 radius-server key 41-7 radius-server retransmit 41-7

Contents

radius-server timeout 41-8 show radius-server 41-8

TACACS+ Client 41-9

tacacs-server host 41-9 tacacs-server port 41-9 tacacs-server key 41-10 show tacacs-server 41-10

Web Server Commands 41-11

ip http port 41-11 ip http server 41-11 ip http secure-server 41-12 ip http secure-port 41-13

Telnet Server Commands 41-14

ip telnet server 41-14

Secure Shell Commands 41-15

ip ssh server 41-17 ip ssh timeout 41-18 ip ssh authentication-retries 41-19 ip ssh server-key size 41-19 delete public-key 41-20 ip ssh crypto host-key generate 41-20 ip ssh crypto zeroize 41-21 ip ssh save host-key 41-21 show ip ssh 41-22 show ssh 41-22 show public-key 41-23

IP Filter Commands 41-24

management 41-24 show management 41-25

Chapter 42: Port Security Commands 42-1

port security 42-1

Chapter 43: 802.1X Port Authentication 43-1

dot1x system-auth-control 43-1 dot1x default 43-2 dot1x max-req 43-2 dot1x port-control 43-2 dot1x operation-mode 43-3 dot1x re-authenticate 43-4 dot1x re-authentication 43-4 dot1x timeout quiet-period 43-5 dot1x timeout re-authperiod 43-5 dot1x timeout tx-period 43-6 show dot1x 43-6

xii

Contents

Chapter 44: Access Control List Commands 44-1

IPv4 ACLs 44-1

access-list ip 44-2 permit, deny (Standard IPv4 ACL) 44-2 permit, deny (Extended IPv4 ACL) 44-3 show ip access-list 44-5 ip access-group 44-6 show ip access-group 44-6

IPv6 ACLs 44-7

access-list ipv6 44-7 permit, deny (Standard IPv6 ACL) 44-8 permit, deny (Extended IPv6 ACL) 44-9 show ipv6 access-list 44-10 ipv6 access-group 44-11 show ipv6 access-group 44-11

MAC ACLs 44-12

access-list mac 44-12 permit, deny (MAC ACL) 44-13 show mac access-list 44-14 mac access-group 44-15 show mac access-group 44-15

ACL Information 44-16

show access-list 44-16 show access-group 44-16

Chapter 45: Interface Commands 45-1

interface 45-1 description 45-2 speed-duplex 45-2 negotiation 45-3 capabilities 45-4 flowcontrol 45-5 media-type 45-6 shutdown 45-6 clear counters 45-7 show interfaces status 45-8 show interfaces counters 45-9 show interfaces switchport 45-10

Chapter 46: Link Aggregation Commands 46-1

channel-group 46-2 port channel load-balance 46-3 lacp 46-4 lacp system-priority 46-5 lacp admin-key (Ethernet Interface) 46-6 lacp admin-key (Port Channel) 46-7

xiii

Contents

lacp port-priority 46-8 show lacp 46-8 show port-channel load-balance 46-11

Chapter 47: Broadcast Storm Control Commands 47-1

switchport broadcast packet-rate 47-1

Chapter 48: Mirror Port Commands 48-1

port monitor 48-1 show port monitor 48-2

Chapter 49: Rate Limit Commands 49-1

rate-limit 49-1

Chapter 50: Address Table Commands 50-1

mac-address-table static 50-1 clear mac-address-table dynamic 50-2 show mac-address-table 50-3 mac-address-table aging-time 50-4 show mac-address-table aging-time 50-4

Chapter 51: Spanning Tree Commands 51-1

spanning-tree 51-2 spanning-tree mode 51-2 spanning-tree forward-time 51-3 spanning-tree hello-time 51-4 spanning-tree max-age 51-5 spanning-tree priority 51-5 spanning-tree pathcost method 51-6 spanning-tree transmission-limit 51-7 spanning-tree mst-configuration 51-7 mst vlan 51-8 mst priority 51-9 name 51-9 revision 51-10 max-hops 51-11 spanning-tree spanning-disabled 51-11 spanning-tree cost 51-12 spanning-tree port-priority 51-13 spanning-tree edge-port 51-13 spanning-tree portfast 51-14 spanning-tree link-type 51-15 spanning-tree mst cost 51-16 spanning-tree mst port-priority 51-17 spanning-tree protocol-migration 51-17 show spanning-tree 51-18 show spanning-tree mst configuration 51-20

xiv

Contents

Chapter 52: VLAN Commands 52-1

GVRP and Bridge Extension Commands 52-1

bridge-ext gvrp 52-2 show bridge-ext 52-2 switchport gvrp 52-3 show gvrp configuration 52-3 garp timer 52-4 show garp timer 52-5

Editing VLAN Groups 52-5

vlan database 52-5 vlan 52-6

Configuring VLAN Interfaces 52-7

interface vlan 52-7 switchport mode 52-8 switchport acceptable-frame-types 52-9 switchport ingress-filtering 52-9 switchport native vlan 52-10 switchport allowed vlan 52-11 switchport forbidden vlan 52-12

Configuring IEEE 802.1Q Tunneling 52-13

dot1q-tunnel system-tunnel-control 52-14 switchport dot1q-tunnel mode 52-14 switchport dot1q-tunnel tpid 52-15 show dot1q-tunnel 52-16

Displaying VLAN Information 52-16

show vlan 52-17

Chapter 53: Private VLAN Commands 53-1

pvlan 53-1 show pvlan 53-2

Chapter 54: Protocol-based VLAN Commands 54-1

protocol-vlan protocol-group (Configuring Groups) 54-1 protocol-vlan protocol-group (Configuring Interfaces) 54-2 show protocol-vlan protocol-group 54-3 show interfaces protocol-vlan protocol-group 54-4

Chapter 55: Class of Service Commands 55-1

Priority Commands (Layer 2) 55-1

queue mode 55-2 switchport priority default 55-3 queue bandwidth 55-4 queue cos-map 55-4 show queue mode 55-5 show queue bandwidth 55-6 show queue cos-map 55-6

Contents

Priority Commands (Layer 3 and 4) 55-7

map ip port (Global Configuration) 55-7 map ip port (Interface Configuration) 55-8 map ip precedence (Global Configuration) 55-8 map ip precedence (Interface Configuration) 55-9 map ip dscp (Global Configuration) 55-10 map ip dscp (Interface Configuration) 55-10 show map ip port 55-11 show map ip precedence 55-12 show map ip dscp 55-13

Chapter 56: Quality of Service Commands 56-1

class-map 56-2 match 56-3 policy-map 56-4 class 56-4 set 56-5 police 56-6 service-policy 56-7 show class-map 56-8 show policy-map 56-8 show policy-map interface 56-9

Chapter 57: Multicast Filtering Commands 57-1

IGMP Snooping Commands 57-1

ip igmp snooping 57-1 ip igmp snooping vlan static 57-2 ip igmp snooping version 57-2 show ip igmp snooping 57-3 show mac-address-table multicast 57-3

IGMP Query Commands 57-4

ip igmp snooping querier 57-4 ip igmp snooping query-count 57-5 ip igmp snooping query-interval 57-5 ip igmp snooping query-max-response-time 57-6 ip igmp snooping router-port-expire-time 57-7

Static Multicast Routing Commands 57-8

ip igmp snooping vlan mrouter 57-8 show ip igmp snooping mrouter 57-9

Chapter 58: Domain Name Service Commands 58-1

ip host 58-1 clear host 58-2 ip domain-name 58-3 ip domain-list 58-3 ip name-server 58-4

xvi

Contents

ip domain-lookup 58-5 show hosts 58-6 show dns 58-7 show dns cache 58-7 clear dns cache 58-8

Chapter 59: IPv4 Interface Commands 59-1

ip address 59-1 ip default-gateway 59-2 ip dhcp restart 59-3 show ip interface 59-4 show ip redirects 59-4 ping 59-5

Chapter 60: IPv6 Interface Commands 60-1

ipv6 enable 60-2 ipv6 general-prefix 60-3 show ipv6 general-prefix 60-4 ipv6 address 60-4 ipv6 address autoconfig 60-6 ipv6 address eui-64 60-7 ipv6 address link-local 60-9 show ipv6 interface 60-10 ipv6 default-gateway 60-12 show ipv6 default-gateway 60-12 ipv6 mtu 60-13 show ipv6 mtu 60-14 show ipv6 traffic 60-14 clear ipv6 traffic 60-20 ping ipv6 60-21 ipv6 neighbor 60-22 ipv6 nd dad attempts 60-23 ipv6 nd ns interval 60-25 show ipv6 neighbors 60-26 clear ipv6 neighbors 60-27

Chapter 61: Switch Cluster Commands 61-1

cluster 61-1 cluster commander 61-2 cluster ip-pool 61-2 cluster member 61-3 rcommand 61-4 show cluster 61-4 show cluster members 61-5 show cluster candidates 61-5

xvii

Contents

Section IV: Appendices

Appendix A: Software Specifications A-1

Software Features A-1 Management Features A-2 Standards A-2 Management Information Bases A-3

Appendix B: Troubleshooting B-1

Problems Accessing the Management Interface B-1 Using System Logs B-2

Glossary

Index

xviii

Tables

Table 1-1 Key Features 1-1 Table 1-2 System Defaults 1-6 Table 3-1 Web Page Configuration Buttons 3-3 Table 3-2 Switch Main Menu 3-4 Table 9-1 Logging Levels 9-1 Table 11-1 SNMPv3 Security Models and Levels 11-2 Table 11-2 Supported Notification Messages 11-13 Table 12-1 HTTPS System Support 12-6 Table 14-1 802.1X Statistics 14-6 Table 16-1 Port Statistics 16-6 Table 17-1 LACP Port Counters 17-9 Table 17-2 LACP Internal Configuration Information 17-11 Table 17-3 LACP Neighbor Configuration Information 17-13 Table 26-1 Mapping CoS Values to Egress Queues 26-3 Table 26-2 CoS Priority Levels 26-3 Table 26-3 Mapping IP Precedence 26-8 Table 26-4 Mapping DSCP Priority 26-9 Table 31-1 General Command Modes 31-6 Table 31-2 Configuration Command Modes 31-8 Table 31-3 Keystroke Commands 31-9 Table 32-1 Command Group Index 32-1 Table 33-1 General Commands 33-1 Table 34-1 System Management Commands 34-1 Table 35-1 Flash/File Commands 35-1 Table 35-2 File Directory Information 35-6 Table 36-1 Line Commands 36-1 Table 37-1 Event Logging Commands 37-1 Table 37-2 Logging Levels 37-2 Table 37-3 show logging flash/ram - display description 37-6 Table 37-4 show logging trap - display description 37-6 Table 38-1 SMTP Alert Commands 38-1 Table 39-1 Time Commands 39-1 Table 40-1 SNMP Commands 40-1 Table 40-2 show snmp engine-id - display description 40-9 Table 40-3 show snmp view - display description 40-11 Table 40-4 show snmp group - display description 40-13 Table 40-5 show snmp user - display description 40-16 Table 41-1 Authentication Commands 41-1 Table 41-2 User Access Commands 41-1 Table 41-3 Default Login Settings 41-2 Table 41-4 Authentication Sequence Commands 41-3

xix

Tables

Table 41-5 RADIUS Client Commands 41-5 Table 41-6 TACACS+ Client Commands 41-9 Table 41-7 Web Server Commands 41-11 Table 41-8 HTTPS System Support 41-13 Table 41-9 Telnet Server Commands 41-14 Table 41-10 Secure Shell Commands 41-15 Table 41-11 show ssh - display description 41-22 Table 41-12 IP Filter Commands 41-24 Table 42-1 Port Security Commands 42-1 Table 43-1 802.1X Port Authentication Commands 43-1 Table 44-1 Access Control List Commands 44-1 Table 44-2 IPv4 ACL Commands 44-1 Table 44-3 IPv6 ACL Commands 44-7 Table 44-4 MAC ACL Commands 44-12 Table 44-5 ACL Information Commands 44-16 Table 45-1 Interface Commands 45-1 Table 45-2 show interfaces switchport - display description 45-10 Table 46-1 Link Aggregation Commands 46-1 Table 46-2 show lacp counters - display description 46-9 Table 46-3 show lacp internal - display description 46-10 Table 46-4 show lacp neighbors - display description 46-10 Table 46-5 show lacp sysid - display description 46-11 Table 47-1 Broadcast Storm Control Commands 47-1 Table 48-1 Mirror Port Commands 48-1 Table 49-1 Rate Limit Commands 49-1 Table 50-1 Address Table Commands 50-1 Table 51-1 Spanning Tree Commands 51-1 Table 52-1 VLAN Commands 52-1 Table 52-2 GVRP and Bridge Extension Commands 52-1 Table 52-3 Commands for Editing VLAN Groups 52-5 Table 52-4 Commands for Configuring VLAN Interfaces 52-7 Table 52-1 IEEE 802.1Q Tunneling Commands 52-13 Table 52-1 Commands for Displaying VLAN Information 52-16 Table 53-1 Private VLAN Commands 53-1 Table 54-1 Protocol-based VLAN Commands 54-1 Table 55-1 Priority Commands 55-1 Table 55-2 Priority Commands (Layer 2) 55-1 Table 55-3 Default CoS Priority Levels 55-5 Table 55-4 Priority Commands (Layer 3 and 4) 55-7 Table 55-5 Mapping IP Precedence to CoS Values 55-9 Table 55-6 Mapping IP DSCP to CoS Values 55-11 Table 56-1 Quality of Service Commands 56-1 Table 57-1 Multicast Filtering Commands 57-1 Table 57-2 IGMP Snooping Commands 57-1 Table 57-3 IGMP Query Commands 57-4

Tables

Table 57-4 Static Multicast Routing Commands 57-8 Table 58-1 DNS Commands 58-1 Table 58-2 show dns cache - display description 58-7 Table 59-1 IPv4 Configuration Commands 59-1 Table 60-1 IPv6 Configuration Commands 60-1 Table 60-2 show ipv6 interface - display description 60-10 Table 60-3 show ipv6 mtu - display description 60-14 Table 60-4 show ipv6 traffic - display description 60-16 Table 60-5 show ipv6 neighbors - display description 60-26 Table 61-1 Switch Cluster Commands 61-1 Table B-1 Troubleshooting Chart B-1

xxi

Tables

xxii

Figures

Figure 3-1 Home Page 3-2 Figure 3-2 Front Panel Indicators 3-3 Figure 4-1 System Information 4-2 Figure 4-2 Switch Information 4-4 Figure 4-3 Displaying Bridge Extension Configuration 4-5 Figure 4-4 Configuring Support for Jumbo Frames 4-6 Figure 4-5 Renumbering the Stack 4-7 Figure 4-6 Resetting the System 4-7 Figure 5-1 IPv4 Interface Configuration - Manual 5-2 Figure 5-2 IPv4 Interface Configuration - DHCP 5-3 Figure 5-3 IPv6 Interface Configuration 5-9 Figure 5-4 IPv6 General Prefix Configuration 5-11 Figure 5-5 IPv6 Neighbor Detection and Neighbor Cache 5-14 Figure 6-1 Copy Firmware 6-2 Figure 6-2 Setting the Startup Code 6-2 Figure 6-3 Deleting Files 6-3 Figure 6-4 Downloading Configuration Settings for Start-Up 6-5 Figure 6-5 Setting the Startup Configuration Settings 6-5 Figure 7-1 Configuring the Console Port 7-2 Figure 8-1 Configuring the Telnet Interface 8-2 Figure 9-1 System Logs 9-2 Figure 9-2 Remote Logs 9-3 Figure 9-3 Displaying Logs 9-4 Figure 9-4 Enabling and Configuring SMTP Alerts 9-5 Figure 10-1 SNTP Configuration 10-1 Figure 10-2 Clock Time Zone 10-2 Figure 11-1 Enabling the SNMP Agent 11-2 Figure 11-2 Configuring SNMP Community Strings 11-3 Figure 11-3 Configuring SNMP Trap Managers 11-6 Figure 11-4 Setting the SNMPv3 Engine ID 11-7 Figure 11-5 Setting an Engine ID 11-8 Figure 11-6 Configuring SNMPv3 Users 11-9 Figure 11-7 Configuring Remote SNMPv3 Users 11-11 Figure 11-8 Configuring SNMPv3 Groups 11-15 Figure 11-9 Configuring SNMPv3 Views 11-16 Figure 12-1 User Accounts 12-2 Figure 12-2 Authentication Server Settings 12-4 Figure 12-3 HTTPS Settings 12-6 Figure 12-4 Copy HTTPS Certificate 12-7 Figure 12-5 SSH Host-Key Settings 12-11 Figure 12-6 SSH Server Settings 12-12

xxiii

Figures

Figure 12-7 IP Filter 12-14 Figure 13-1 Port Security 13-2 Figure 14-1 802.1X Global Information 14-2 Figure 14-2 802.1X Global Configuration 14-3 Figure 14-3 802.1X Port Configuration 14-4 Figure 14-4 802.1X Port Statistics 14-7 Figure 15-1 Selecting ACL Type 15-2 Figure 15-2 ACL Configuration - Standard IPv4 15-3 Figure 15-3 ACL Configuration - Extended IPv4 15-5 Figure 15-4 ACL Configuration - MAC 15-7 Figure 15-5 ACL Configuration - Standard IPv6 15-8 Figure 15-6 ACL Configuration - Extended IPv6 15-10 Figure 15-7 ACL Port Binding 15-11 Figure 16-1 Port - Port Information 16-1 Figure 16-2 Port - Port Configuration 16-5 Figure 16-3 Port Statistics 16-9 Figure 17-1 Static Trunk Configuration 17-2 Figure 17-2 Trunk Load Balance Mode 17-4 Figure 17-3 LACP Trunk Configuration 17-6 Figure 17-4 LACP - Aggregation Port 17-8 Figure 17-5 LACP - Port Counters Information 17-10 Figure 17-6 LACP - Port Internal Information 17-12 Figure 17-7 LACP - Port Neighbors Information 17-13 Figure 18-1 Port Broadcast Control 18-1 Figure 19-1 Mirror Port Configuration 19-2 Figure 20-1 Rate Limit Configuration 20-1 Figure 21-1 Static Addresses 21-1 Figure 21-2 Dynamic Addresses 21-3 Figure 21-3 Address Aging 21-4 Figure 22-1 STA Information 22-5 Figure 22-2 STA Global Configuration 22-9 Figure 22-3 STA Port Information 22-12 Figure 22-4 STA Port Configuration 22-15 Figure 22-5 MSTP VLAN Configuration 22-16 Figure 22-6 MSTP Port Information 22-18 Figure 22-7 MSTP Port Configuration 22-20 Figure 23-1 Globally Enabling GVRP 23-4 Figure 23-2 VLAN Basic Information 23-4 Figure 23-3 VLAN Current Table 23-5 Figure 23-4 VLAN Static List - Creating VLANs 23-7 Figure 23-5 VLAN Static Table - Adding Static Members 23-8 Figure 23-6 VLAN Static Membership by Port 23-9 Figure 23-7 VLAN Port Configuration 23-11 Figure 23-1 802.1Q Tunnel Status 23-16 Figure 23-1 Tunnel Port Configuration 23-18

xxiv

Figures

Figure 24-1 Private VLAN Status 24-1 Figure 24-2 Private VLAN Link Status 24-2 Figure 25-1 Protocol VLAN Configuration 25-2 Figure 25-2 Protocol VLAN Port Configuration 25-3 Figure 26-1 Default Port Priority 26-2 Figure 26-2 Traffic Classes 26-4 Figure 26-3 Queue Mode 26-5 Figure 26-4 Queue Scheduling 26-6 Figure 26-5 IP Precedence/DSCP Priority Status 26-7 Figure 26-6 IP Precedence Priority 26-8 Figure 26-7 IP DSCP Priority 26-10 Figure 26-8 IP Port Priority Status 26-11 Figure 26-9 IP Port Priority 26-11 Figure 27-1 Configuring Class Maps 27-3 Figure 27-2 Configuring Policy Maps 27-6 Figure 27-3 Service Policy Settings 27-7 Figure 28-1 IGMP Configuration 28-3 Figure 28-2 Multicast Router Port Information 28-4 Figure 28-3 Static Multicast Router Port Configuration 28-5 Figure 28-4 IP Multicast Registration Table 28-6 Figure 28-5 IGMP Member Port Table 28-7 Figure 29-1 DNS General Configuration 29-2 Figure 29-2 DNS Static Host Table 29-4 Figure 29-3 DNS Cache 29-5 Figure 30-1 Cluster Configuration 30-2 Figure 30-2 Cluster Member Configuration 30-3 Figure 30-3 Cluster Member Information 30-3 Figure 30-4 Cluster Candidate Information 30-4

xxv

Figures

xxvi

Section I: Getting Started

This section provides an overview of the switch, and introduces some basic concepts about network switches. It also describes the basic settings required to access the management interface.

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1

Initial Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-1

Getting Started

Chapter 1: Introduction

This switch provides a broad range of features for Layer 2 switching. It includes a management agent that allows you to configure the features listed in this manual. The default configuration can be used for most of the features provided by this switch. However, there are many options that you should configure to maximize the switch’s performance for your particular network environment.

Key Features

Table 1-1 Key Features

Feature Description

Configuration Backup and Restore

Authentication Console, Telnet, web – User name / password, RADIUS, TACACS+

Access Control Lists Supports up to 32 ACLs, 96 MAC rules, 96 IP rules, and 96 IPv6 rules

DHCP Client Supported

DNS Proxy service

Port Configuration Speed and duplex mode and flow control

Rate Limiting Input and output rate limiting per port

Port Mirroring One or more ports mirrored to single analysis port

Port Trunking Supports up to 24 trunks using either static or dynamic trunking (LACP)

Broadcast Storm Control

Address Table Up to 8K MAC addresses in the forwarding table, 1024 static MAC addresses

IP Version 4 and 6 Supports IPv4 and IPv6 addressing, management, and QoS

IEEE 802.1D Bridge Supports dynamic data switching and addresses learning

Store-and-Forward Switching

Spanning Tree Algorithm

Virtual LANs Up to 256 using IEEE 802.1Q, port-based, protocol-based, private VLANs, and

Backup to TFTP server

Web – HTTPS Telnet – SSH SNMP v1/2c - Community strings SNMP version 3 – MD5 or SHA password Port – IEEE 802.1X, MAC address filtering

Supported

Supported to ensure wire-speed switching while eliminating bad frames

Supports standard STP, Rapid Spanning Tree Protocol (RSTP), and Multiple Spanning Trees (MSTP)

802.1Q tunneling (QinQ)

1-1

Introduction

Table 1-1 Key Features (Continued)

Feature Description

Traffic Prioritization Default port priority, traffic class map, queue scheduling, IP Precedence, or

Qualify of Service Supports Differentiated Services (DiffServ)

Multicast Filtering Supports IGMP snooping and query

Switch Clustering Supports up to 36 member switches in a cluster

Differentiated Services Code Point (DSCP), and TCP/UDP Port

Description of Software Features

The switch provides a wide range of advanced performance enhancing features. Flow control eliminates the loss of packets due to bottlenecks caused by port saturation. Broadcast storm suppression prevents broadcast traffic storms from engulfing the network. Untagged (port-based), tagged, and protocol-based VLANs, plus support for automatic GVRP VLAN registration provide traffic security and efficient use of network bandwidth. CoS priority queueing ensures the minimum delay for moving real-time multimedia data across the network. While multicast filtering provides support for real-time network applications. Some of the management features are briefly described below.

Configuration Backup and Restore – You can save the current configuration settings to a file on a TFTP server, and later download this file to restore the switch configuration settings.

Authentication – This switch authenticates management access via the console port, Telnet or web browser. User names and passwords can be configured locally or can be verified via a remote authentication server (i.e., RADIUS or TACACS+). Port-based authentication is also supported via the IEEE 802.1X protocol. This protocol uses Extensible Authentication Protocol over LANs (EAPOL) to request user credentials from the 802.1X client, and then uses the EAP between the switch and the authentication server to verify the client’s right to access the network via an authentication server (i.e., RADIUS server).

Other authentication options include HTTPS for secure management access via the web, SSH for secure management access over a Telnet-equivalent connection, SNMP Version 3, IP address filtering for SNMP/web/Telnet management access, and MAC address filtering for port access.

Access Control Lists – ACLs provide packet filtering for IP frames (based on address, protocol, TCP/UDP port number or TCP control code) or any frames (based on MAC address or Ethernet type). ACLs can by used to improve performance by blocking unnecessary network traffic or to implement security controls by restricting access to specific network resources or protocols.

1-2

Description of Software Features

Port Configuration – You can manually configure the speed and duplex mode, and flow control used on specific ports, or use auto-negotiation to detect the connection settings used by the attached device. Use the full-duplex mode on ports whenever possible to double the throughput of switch connections. Flow control should also be enabled to control network traffic during periods of congestion and prevent the loss of packets when port buffer thresholds are exceeded. The switch supports flow control based on the IEEE 802.3x standard.

Rate Limiting – This feature controls the maximum rate for traffic transmitted or received on an interface. Rate limiting is configured on interfaces at the edge of a network to limit traffic into or out of the network. Traffic that falls within the rate limit is transmitted, while packets that exceed the acceptable amount of traffic are dropped.

Port Mirroring – The switch can unobtrusively mirror traffic from any port to a monitor port. You can then attach a protocol analyzer or RMON probe to this port to perform traffic analysis and verify connection integrity.

Port Trunking – Ports can be combined into an aggregate connection. Trunks can be manually set up or dynamically configured using IEEE 802.3-2005 (formerly IEEE 802.3ad) Link Aggregation Control Protocol (LACP). The additional ports dramatically increase the throughput across any connection, and provide redundancy by taking over the load if a port in the trunk should fail. The switch supports up to 24 trunks.

Broadcast Storm Control – Broadcast suppression prevents broadcast traffic from overwhelming the network. When enabled on a port, the level of broadcast traffic passing through the port is restricted. If broadcast traffic rises above a pre-defined threshold, it will be throttled until the level falls back beneath the threshold.

Static Addresses – A static address can be assigned to a specific interface on this switch. Static addresses are bound to the assigned interface and will not be moved. When a static address is seen on another interface, the address will be ignored and will not be written to the address table. Static addresses can be used to provide network security by restricting access for a known host to a specific port.

IEEE 802.1D Bridge – The switch supports IEEE 802.1D transparent bridging. The address table facilitates data switching by learning addresses, and then filtering or forwarding traffic based on this information. The address table supports up to 8K addresses.

Store-and-Forward Switching – The switch copies each frame into its memory before forwarding them to another port. This ensures that all frames are a standard Ethernet size and have been verified for accuracy with the cyclic redundancy check (CRC). This prevents bad frames from entering the network and wasting bandwidth.

To avoid dropping frames on congested ports, the switch provides 0.75 MB for frame buffering. This buffer can queue packets awaiting transmission on congested networks.

1-3

Introduction

Spanning Tree Algorithm – The switch supports these spanning tree protocols:

Spanning Tree Protocol (STP, IEEE 802.1D) – This protocol provides loop detection. When there are multiple physical paths between segments, this protocol will choose a single path and disable all others to ensure that only one route exists between any two stations on the network. This prevents the creation of network loops. However, if the chosen path should fail for any reason, an alternate path will be activated to maintain the connection.

Rapid Spanning Tree Protocol (RSTP, IEEE 802.1w) – This protocol reduces the convergence time for network topology changes to about 3 to 5 seconds, compared to 30 seconds or more for the older IEEE 802.1D STP standard. It is intended as a complete replacement for STP, but can still interoperate with switches running the older standard by automatically reconfiguring ports to STP-compliant mode if they detect STP protocol messages from attached devices.

Multiple Spanning Tree Protocol (MSTP, IEEE 802.1s) – This protocol is a direct extension of RSTP. It can provide an independent spanning tree for different VLANs. It simplifies network management, provides for even faster convergence than RSTP by limiting the size of each region, and prevents VLAN members from being segmented from the rest of the group (as sometimes occurs with IEEE 802.1D STP).

Virtual LANs – The switch supports up to 256 VLANs. A Virtual LAN is a collection of network nodes that share the same collision domain regardless of their physical location or connection point in the network. The switch supports tagged VLANs based on the IEEE 802.1Q standard. Members of VLAN groups can be dynamically learned via GVRP, or ports can be manually assigned to a specific set of VLANs. This allows the switch to restrict traffic to the VLAN groups to which a user has been assigned. By segmenting your network into VLANs, you can:

• Eliminate broadcast storms which severely degrade performance in a flat network.

• Simplify network management for node changes/moves by remotely configuring VLAN membership for any port, rather than having to manually change the network connection.

• Provide data security by restricting all traffic to the originating VLAN.

• Use private VLANs to restrict traffic to pass only between data ports and the uplink ports, thereby isolating adjacent ports within the same VLAN, and allowing you to limit the total number of VLANs that need to be configured.

• Use protocol VLANs to restrict traffic to specified interfaces based on protocol type.

IEEE 802.1Q Tunneling (QinQ) – This feature is designed for service providers carrying traffic for multiple customers across their networks. QinQ tunneling is used to maintain customer-specific VLAN and Layer 2 protocol configurations even when different customers use the same internal VLAN IDs. This is accomplished by inserting Service Provider VLAN (SPVLAN) tags into the customer’s frames when they enter the service provider’s network, and then stripping the tags when the frames leave the network.

1-4

Description of Software Features

Traffic Prioritization – This switch prioritizes each packet based on the required level of service, using eight priority queues with strict or Weighted Round Robin Queuing. It uses IEEE 802.1p and 802.1Q tags to prioritize incoming traffic based on input from the end-station application. These functions can independent priorities for delay-sensitive data and best-effort data.

This switch also supports several common methods of prioritizing layer 3/4 traffic to meet application requirements. Traffic can be prioritized based on the priority bits in the IP frame’s Type of Service (ToS) octet or the number of the TCP/UDP port. When these services are enabled, the priorities are mapped to a Class of Service value by the switch, and the traffic then sent to the corresponding output queue.

Quality of Service – Differentiated Services (DiffServ) provides policy-based management mechanisms used for prioritizing network resources to meet the requirements of specific traffic types on a per-hop basis. Each packet is classified upon entry into the network based on access lists, IP Precedence or DSCP values, or VLAN lists. Using access lists allows you select traffic based on Layer 2, Layer 3, or Layer 4 information contained in each packet. Based on network policies, different kinds of traffic can be marked for different kinds of forwarding.

Multicast Filtering – Specific multicast traffic can be assigned to its own VLAN to ensure that it does not interfere with normal network traffic and to guarantee real-time delivery by setting the required priority level for the designated VLAN. The switch uses IGMP Snooping and Query to manage multicast group registration.

Switch Clustering – Switches can be grouped together in a “cluster” to enable centralized management through a single unit. This enables switches to be grouped and managed together regardless of physical location or switch type, as long as they are connected to the same local network.

be used to provide

1-5

Introduction

System Defaults

The switch’s system defaults are provided in the configuration file “Factory_Default_Config.cfg.” To reset the switch defaults, this file should be set as the startup configuration file (page 6-5).

The following table lists some of the basic system defaults.

Table 1-2 System Defaults

Function Parameter Default

Console Port Connection

Authentication Privileged Exec Level Username “admin”

Web Management HTTP Server Enabled

Baud Rate auto

Data bits 8

Stop bits 1

Parity none

Local Console Timeout 0 (disabled)

Password “admin”

Normal Exec Level Username “guest”

Enable Privileged Exec from Normal Exec Level

RADIUS Authentication Disabled

TACACS Authentication Disabled

802.1X Port Authentication Disabled

HTTPS Enabled

SSH Disabled

Port Security Disabled

IP Filtering Disabled

HTTP Port Number 80

HTTP Secure Server Enabled

HTTP Secure Port Number 443

Password “guest”

Password “super”

1-6

Table 1-2 System Defaults (Continued)

Function Parameter Default

SNMP SNMP Agent Enabled

Community Strings “public” (read only)

Traps Authentication traps: enabled

SNMP V3 View: defaultview

Port Configuration Admin Status Enabled

Auto-negotiation Enabled

Flow Control Disabled

Rate Limiting Input and output limits Disabled

Port Trunking Static Trunks None

LACP (all ports) Disabled

Broadcast Storm Protection

Spanning Tree Algorithm

Address Table Aging Time 300 seconds

Virtual LANs Default VLAN 1

Status Enabled (all ports)

Broadcast Limit Rate 500 packets per second

Status Enabled, RSTP

Fast Forwarding (Edge Port) Disabled

PVID 1

Acceptable Frame Type All

Ingress Filtering Disabled

Switchport Mode (Egress Mode) Hybrid: tagged/untagged frames

GVRP (global) Disabled

GVRP (port interface) Disabled

QinQ Tunneling Disabled

“private” (read/write)

Link-up-down events: enabled

Group: public (read only); private (read/write)

(Defaults: All values based on IEEE 802.1w)

System Defaults

1-7

Introduction

Table 1-2 System Defaults (Continued)

Function Parameter Default

Traffic Prioritization Ingress Port Priority 0

Queue Mode WRR

Weighted Round Robin Queue: 0 1 2 3 4 5 6 7

IP Precedence Priority Disabled

IP DSCP Priority Disabled

IP Port Priority Disabled

IP Settings Router Redundancy Multicast Filtering

System Log Status Enabled

SMTP Email Alerts Event Handler Enabled (but no server defined)

SNTP Clock Synchronization Disabled

Switch Clustering Status Enabled

Management. VLAN Any VLAN configured with an IP address

IP Address 0.0.0.0

Subnet Mask 255.0.0.0

Default Gateway 0.0.0.0

DHCP Client: Enabled

DNS Disabled

BOOTP Disabled

IGMP Snooping Snooping: Enabled

Messages Logged Levels 0-7 (all)

Messages Logged to Flash Levels 0-3

Commander Disabled

Weight: 1 2 4 6 8 10 12 14

Querier: Disabled

1-8

Chapter 2: Initial Configuration

Connecting to the Switch

Configuration Options

The switch includes a built-in network management agent. The agent offers a variety of management options, including SNMP, RMON and a web-based interface. A PC may also be connected directly to the switch for configuration and monitoring via a command line interface (CLI).

Note: An IPv4 address for this switch is obtained via DHCP by default. To change this

address, see “Setting an IP Address” on page 2-4.

The switch’s HTTP web agent allows you to configure switch parameters, monitor port connections, and display statistics using a standard web browser such as Netscape version 6.2 and higher or Microsoft IE version 5.0 and higher. The switch’s web management interface can be accessed from any computer attached to the network.

The CLI program can be accessed by a direct connection to the RS-232 serial console port on the switch, or remotely by a Telnet connection over the network.

The switch’s management agent also supports SNMP (Simple Network Management Protocol). This SNMP agent permits the switch to be managed from any system in the network using network management software such as HP OpenView.

The switch’s web interface, CLI configuration program, and SNMP agent allow you to perform the following management functions:

• Set user names and passwords

• Set an IP interface for a management VLAN

• Configure SNMP parameters

• Enable/disable any port

• Set the speed/duplex mode for any port

• Configure the bandwidth of any port by limiting input or output rates

• Control port access through IEEE 802.1X security or static address filtering

• Filter packets using Access Control Lists (ACLs)

• Configure up to 256 IEEE 802.1Q VLANs

• Enable GVRP automatic VLAN registration

• Configure IGMP multicast filtering

• Upload and download system firmware via TFTP

• Upload and download switch configuration files via TFTP

• Configure Spanning Tree parameters

• Configure Class of Service (CoS) priority queuing

2-1

Initial Configuration

• Configure up to 32 static or LACP trunks per switch

• Enable port mirroring

• Set broadcast storm control on any port

• Display system information and statistics

Required Connections

The switch provides an RS-232 serial port that enables a connection to a PC or terminal for monitoring and configuring the switch. A null-modem console cable is provided with the switch.

Attach a VT100-compatible terminal, or a PC running a terminal emulation program to the switch. You can use the console cable provided with this package, or use a null-modem cable that complies with the wiring assignments shown in the Installation Guide.

To connect a terminal to the console port, complete the following steps:

1. Connect the console cable to the serial port on a terminal, or a PC running

terminal emulation software, and tighten the captive retaining screws on the DB-9 connector.

2. Connect the other end of the cable to the RS-232 serial port on the switch.

3. Make sure the terminal emulation software is set as follows:

• Select the appropriate serial port (COM port 1 or COM port 2).

• Set to any of the following baud rates: 9600, 19200, 38400, 57600, 115200 (Note: Set to 9600 baud if want to view all the system initialization messages.).

• Set the data format to 8 data bits, 1 stop bit, and no parity.

• Set flow control to none.

• Set the emulation mode to VT100.

• When using HyperTerminal, select Terminal keys, not Windows keys.

Notes: 1. Refer to “Line Commands” on page 36-1 for a complete description of

For a description of how to use the CLI, see “Using the Command Line Interface” on page 31-1. For a list of all the CLI commands and detailed information on using the CLI, refer to “CLI Command Groups” on page 32-1.

console configuration options.

2. Once you have set up the terminal correctly, the console login screen will be displayed.

Remote Connections

Prior to accessing the switch’s onboard agent via a network connection, you must first configure it with a valid IP address, subnet mask, and default gateway using a console connection, DHCP or BOOTP protocol.

An IPv4 address for this switch is obtained via DHCP by default. To manually configure this address or enable dynamic address assignment via DHCP or BOOTP, see “Setting an IP Address” on page 2-4.

2-2

Basic Configuration

Note: This switch supports four concurrent Telnet/SSH sessions.

After configuring the switch’s IP parameters, you can access the onboard configuration program from anywhere within the attached network. The onboard configuration program can be accessed using Telnet from any computer attached to the network. The switch can also be managed by any computer using a web browser (Internet Explorer 5.0 or above, or Netscape 6.2 or above), or from a network computer using SNMP network management software.

Note: The onboard program only provides access to basic configuration functions. To

access the full range of SNMP management functions, you must use SNMP-based network management software.

Basic Configuration

Console Connection

The CLI program provides two different command levels — normal access level (Normal Exec) and privileged access level (Privileged Exec). The commands available at the Normal Exec level are a limited subset of those available at the Privileged Exec level and allow you to only display information and use basic utilities. To fully configure the switch parameters, you must access the CLI at the Privileged Exec level.

Access to both CLI levels are controlled by user names and passwords. The switch has a default user name and password for each level. To log into the CLI at the Privileged Exec level using the default user name and password, perform these steps:

1. To initiate your console connection, press <Enter>. The “User Access Verification” procedure starts.

2. At the Username prompt, enter “admin.”

3. At the Password prompt, also enter “admin.” (The password characters are not displayed on the console screen.)

4. The session is opened and the CLI displays the “Console#” prompt indicating you have access at the Privileged Exec level.

Setting Passwords

Note: If this is your first time to log into the CLI program, you should define new

passwords for both default user names using the “username” command, record them and put them in a safe place.

Passwords can consist of up to 8 alphanumeric characters and are case sensitive. To prevent unauthorized access to the switch, set the passwords as follows:

1. Open the console interface with the default user name and password “admin” to access the Privileged Exec level.

2. Type “configure” and press <Enter>.

2-3

Initial Configuration

3. Type “username guest password 0 password,” for the Normal Exec level, where password is your new password. Press <Enter>.

4. Type “username admin password 0 password,” for the Privileged Exec level, where password is your new password. Press <Enter>.

Username: admin Password:

CLI session with the 24/48 L2/L4 GE Switch is opened. To end the CLI session, enter [Exit].

Console#configure 33-2 Console(config)#username guest password 0 [password] 41-1 Console(config)#username admin password 0 [password] Console(config)#

Setting an IP Address

You must establish IP address information for the switch to obtain management access through the network. This can be done in either of the following ways:

Manual — You have to input the information, including IP address and subnet mask. If your management station is not in the same IP subnet as the switch, you will also need to specify the default gateway router.

Dynamic — The switch sends IP configuration requests to BOOTP or DHCP address allocation servers on the network.

Manual Configuration

You can manually assign an IP address to the switch. You may also need to specify a default gateway that resides between this device and management stations that exist on another network segment. Valid IP addresses consist of four decimal numbers, 0 to 255, separated by periods. Anything outside this format will not be accepted by the CLI program.

Note: An IPv4 address for this switch is obtained via DHCP by default.

Assigning an IPv4 Address

Before you can assign an IP address to the switch, you must obtain the following information from your network administrator:

• IP address for the switch

• Network mask for this network

• Default gateway for the network

To assign an IPv4 address to the switch, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to access the interface-configuration mode. Press <Enter>.

2. Type “ip address ip-address netmask,” where “ip-address” is the switch IP address and “netmask” is the network mask for the network. Press <Enter>.

2-4

Basic Configuration

3. Type “exit” to return to the global configuration mode prompt. Press <Enter>.

4. To set the IP address of the default gateway for the network to which the switch belongs, type “ip default-gateway gateway,” where “gateway” is the IP address of the default gateway. Press <Enter>.

Console(config)#interface vlan 1 45-1 Console(config-if)#ip address 192.168.1.5 255.255.255.0 59-1 Console(config-if)#exit Console(config)#ip default-gateway 192.168.1.254 59-2 Console(config)#

Assigning an IPv6 Address

There are several ways to manually configure IPv6 addresses. This section describes how to configure a “link local” address for connectivity within the local subnet only, and another option that allows you to specify a “global unicast” address by first configuring a network prefix for use on a multi-segment network, and then configuring the host address portion of the address.

An IPv6 prefix or address must be formatted according to RFC 2373 “IPv6 Addressing Architecture,” using 8 colon-separated 16-bit hexadecimal values. One double colon may be used to indicate the appropriate number of zeros required to fill the undefined fields. For detailed information on the other ways to assign IPv6 addresses, see “Setting the Switch’s IP Address (IP Version 6)” on page 5-4.

Link Local Address — All link-local addresses must be configured with a prefix of FE80. Remember that this address type makes the switch accessible over IPv6 for all devices attached to the same local subnet only. Also, if the switch detects that the address you configured conflicts with that in use by another device on the subnet, it will stop using the address in question, and automatically generate a link local address that does not conflict with any other devices on the local subnet.

2-5

Initial Configuration

To configure an IPv6 link local address for the switch, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to access the interface-configuration mode. Press <Enter>.

2. Type “ipv6 address” followed by up to 8 colon-separated 16-bit hexadecimal values for the ipv6-address similar to that shown in the example, followed by the “link-local” command parameter. Then press <Enter>.

Console(config)#interface vlan 1 45-1 Console(config-if)#ipv6 address FE80::260:3EFF:FE11:6700

link-local 60-4 Console(config-if)#end Console#show ipv6 interface 60-10 Vlan 1 is up IPv6 is enable. Link-local address: FE80::260:3EFF:FE11:6700/64 Global unicast address(es): Joined group address(es): FF01::1/16 FF02::1/16 FF02::1:FF11:6700/104 MTU is 1500 bytes. ND DAD is enabled, number of DAD attempts: 1. ND retransmit interval is 1000 milliseconds Console#

Address for Multi-segment Network — Before you can assign an IPv6 address to the switch that will be used to connect to a multi-segment network, you must obtain the following information from your network administrator:

• Prefix for this network

• IP address for the switch

• Default gateway for the network

For most networks that encompass several different subnets, it’s easier to first define a network prefix, and then configure the host address for the switch. An IPv6 network prefix is composed of an IPv6-address and prefix length. The prefix length is the number of bits (from the left) of the prefix that form the network address, and is expressed as a decimal number. For example, all IPv6 address that start with the first byte of 73 (hexadecimal) could be expressed as 73:0:0:0:0:0:0:0/8 or 73::/8.

2-6

Basic Configuration

To generate an IPv6 global unicast address for the switch using a general network prefix, complete the following steps:

1. From the Global Configuration mode prompt, type “ipv6 general prefix prefix-name ipv6-prefix/prefix-length,” where the “prefix-name” is a label identifying the network segment, “ipv6-prefix” specifies the high-order bits of the network address, and “prefix length” indicates the actual number of bits used in the network prefix. Press <Enter>.

2. From the global configuration mode prompt, type “interface vlan 1” to access the interface-configuration mode. Press <Enter>.

3. From the interface prompt, type “ipv6 address prefix-name ipv6-address/ prefix-length,” where “prefix-length” indicates the address bits used to form the network portion of the address. (The network address starts from the left of the general prefix and should encompass some of the ipv6-address bits.) The remaining bits are assigned to the host interface. Press <Enter>.

4. Type “exit” to return to the global configuration mode prompt. Press <Enter>.

5. To set the IP address of the IPv6 default gateway for the network to which the switch belongs, type “ipv6 default-gateway gateway,” where “gateway” is the IPv6 address of the default gateway. Press <Enter>.

Console(config)#ipv6 general-prefix rd 2001:DB8:2222::/48 60-3 Console(config)#interface vlan 1 45-1 Console(config-if)#ipv6 address rd 0:0:0:7272::72/64 60-4 Console(config-if)#exit Console(config)ipv6 default-gateway

2001:DB8:2222:7272::254 60-12 Console(config)end Console#show ipv6 interface 60-10 Vlan 1 is up IPv6 is enable. Link-local address: FE80::200:E8FF:FE90:0/64 Global unicast address(es): 2001:DB8:2222:7272::72, subnet is 2001:DB8:2222:7272::/64 Joined group address(es): FF01::1/16 FF02::1/16 FF02::1:FF72:64/104 FF02::1:FF90:0/104 MTU is 1500 bytes. ND DAD is enabled, number of DAD attempts: 1. ND retransmit interval is 1000 milliseconds Console#show ipv6 default-gateway 60-12 ipv6 default gateway: 2001:DB8:2222:7272::254

2-7

Initial Configuration

Dynamic Configuration

Obtaining an IPv4 Address

If you select the “bootp” or “dhcp” option, IP will be enabled but will not function until a BOOTP or DHCP reply has been received. You therefore need to use the “ip dhcp restart” command to start broadcasting service requests. Requests will be sent periodically in an effort to obtain IP configuration information. (BOOTP and DHCP values can include the IP address, subnet mask, and default gateway.)

If the “bootp” or “dhcp” option is saved to the startup-config file (step 6), then the switch will start broadcasting service requests as soon as it is powered on.

To automatically configure the switch by communicating with BOOTP or DHCP address allocation servers on the network, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to access the interface-configuration mode. Press <Enter>.

2. At the interface-configuration mode prompt, use one of the following commands:

• To obtain IP settings via DHCP, type “ip address dhcp” and press <Enter>.

• To obtain IP settings via BOOTP, type “ip address bootp” and press <Enter>.

3. Type “end” to return to the Privileged Exec mode. Press <Enter>.

4. Type “ip dhcp restart” to begin broadcasting service requests. Press <Enter>.

5. Wait a few minutes, and then check the IP configuration settings by typing the “show ip interface” command. Press <Enter>.

6. Then save your configuration changes by typing “copy running-config startup-config.” Enter the startup file name and press <Enter>.

Console(config)#interface vlan 1 45-1 Console(config-if)#ip address dhcp 59-1 Console(config-if)#end Console#ip dhcp restart 59-3 Console#show ip interface 59-4 IP address and netmask: 192.168.1.54 255.255.255.0 on VLAN 1, and address mode: DHCP Console#copy running-config startup-config 35-2 Startup configuration file name []: startup \Write to FLASH Programming.

\Write to FLASH finish. Success.

2-8

Basic Configuration

Obtaining an IPv6 Address

Link Local Address — There are several ways to dynamically configure IPv6 addresses. The simplest method is to automatically generate a “link local” address (identified by an address prefix of FE80). This address type makes the switch accessible over IPv6 for all devices attached to the same local subnet.

To generate an IPv6 link local address for the switch, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to access the interface-configuration mode. Press <Enter>.

2. Type “ipv6 enable” and press <Enter>.

Console(config)#interface vlan 1 45-1 Console(config-if)#ipv6 enable 60-2 Console(config-if)#end Console#show ipv6 interface 60-10 Vlan 1 is up IPv6 is enable. Link-local address: FE80::200:E8FF:FE90:0/64 Global unicast address(es): Joined group address(es): FF01::1/16 FF02::1/16 FF02::1:FF90:0/104 MTU is 1500 bytes. ND DAD is enabled, number of DAD attempts: 1. ND retransmit interval is 1000 milliseconds Console#

Address for Multi-segment Network — To generate an IPv6 address that can be used in a network containing more than one subnet, the switch can be configured to automatically generate a unique host address based on the local subnet address prefix received in router advertisement messages. (DHCP for IPv6 will also be supported in future software releases.)

To dynamically generate an IPv6 host address for the switch, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to access the interface-configuration mode. Press <Enter>.

2-9

Initial Configuration

2. From the interface prompt, type “ipv6 address autoconfig” and press <Enter>.

Console(config)#interface vlan 1 45-1 Console(config-if)#ipv6 address autoconfig 60-6 Console(config-if)#end Console#show ipv6 interface 60-10 Vlan 1 is up IPv6 is enable. Link-local address: FE80::212:CFFF:FE0B:4600/64 Global unicast address(es): 2005::212:CFFF:FE0B:4600, subnet is 2005:0:0:0::/64 3FFE:501:FFFF:100:212:CFFF:FE0B:4600, subnet is 3FFE:501:FFFF:100::/64 Joined group address(es): FF01::1/16 FF02::1/16 FF02::1:FF0B:4600/104 MTU is 1500 bytes. ND DAD is enabled, number of DAD attempts: 1. ND retransmit interval is 1000 milliseconds Console#

Enabling SNMP Management Access

The switch can be configured to accept management commands from Simple Network Management Protocol (SNMP) applications such as HP OpenView. You can configure the switch to (1) respond to SNMP requests or (2) generate SNMP traps.

When SNMP management stations send requests to the switch (either to return information or to set a parameter), the switch provides the requested data or sets the specified parameter. The switch can also be configured to send information to SNMP managers (without being requested by the managers) through trap messages, which inform the manager that certain events have occurred.

The switch includes an SNMP agent that supports SNMP version 1, 2c, and 3 clients. To provide management access for version 1 or 2c clients, you must specify a community string. The switch provides a default MIB View (i.e., an SNMPv3 construct) for the default “public” community string that provides read access to the entire MIB tree, and a default view for the “private” community string that provides read/write access to the entire MIB tree. However, you may assign new views to version 1 or 2c community strings that suit your specific security requirements (see “Setting SNMPv3 Views” on page 11-16).

Community Strings (for SNMP version 1 and 2c clients)

Community strings are used to control management access to SNMP version 1 and 2c stations, as well as to authorize SNMP stations to receive trap messages from the switch. You therefore need to assign community strings to specified users, and set the access level.

2-10

Basic Configuration

The default strings are:

• public - with read-only access. Authorized management stations are only able to

retrieve MIB objects.

• private - with read-write access. Authorized management stations are able to both

retrieve and modify MIB objects.

To prevent unauthorized access to the switch from SNMP version 1 or 2c clients, it is recommended that you change the default community strings.

To configure a community string, complete the following steps:

1. From the Privileged Exec level global configuration mode prompt, type “snmp-server community string mode,” where “string” is the community access string and “mode” is rw (read/write) or ro (read only). Press <Enter>. (Note that the default mode is read only.)

2. To remove an existing string, simply type “no snmp-server community string,” where “string” is the community access string to remove. Press <Enter>.

Console(config)#snmp-server community admin rw 40-3 Console(config)#snmp-server community private Console(config)#

Note: If you do not intend to support access to SNMP version 1 and 2c clients, we

recommend that you delete both of the default community strings. If there are no community strings, then SNMP management access from SNMP v1 and v2c clients is disabled.

Trap Receivers

You can also specify SNMP stations that are to receive traps from the switch. To configure a trap receiver, use the “snmp-server host” command. From the Privileged Exec level global configuration mode prompt, type:

“snmp-server host host-address community-string

[version {1 | 2c | 3 {auth | noauth | priv}}]”

where “host-address” is the IP address for the trap receiver, “community-string” specifies access rights for a version 1/2c host, or is the user name of a version 3 host, “version” indicates the SNMP client version, and “auth | noauth | priv” means that authentication, no authentication, or authentication and privacy is used for v3 clients. Then press <Enter>. For a more detailed description of these parameters, see “snmp-server host” on page 40-5. The following example creates a trap host for each type of SNMP client.

Console(config)#snmp-server host 10.1.19.23 batman 40-5 Console(config)#snmp-server host 10.1.19.98 robin version 2c Console(config)#snmp-server host 10.1.19.34 barbie version 3 auth Console(config)#

2-11

Initial Configuration

Configuring Access for SNMP Version 3 Clients

To configure management access for SNMPv3 clients, you need to first create a view that defines the portions of MIB that the client can read or write, assign the view to a group, and then assign the user to a group. The following example creates one view called “mib-2” that includes the entire MIB-2 tree branch, and then another view that includes the IEEE 802.1d bridge MIB. It assigns these respective read and read/ write views to a group call “r&d” and specifies group authentication via MD5 or SHA. In the last step, it assigns a v3 user to this group, indicating that MD5 will be used for authentication, provides the password “greenpeace” for authentication, and the password “einstien” for encryption.

Console(config)#snmp-server view mib-2 1.3.6.1.2.1 included 40-10 Console(config)#snmp-server view 802.1d 1.3.6.1.2.1.17 included Console(config)#snmp-server group r&d v3 auth mib-2 802.1d 40-11 Console(config)#snmp-server user steve group r&d v3 auth md5

greenpeace priv des56 einstien 40-14

Console(config)#

For a more detailed explanation on how to configure the switch for access from SNMP v3 clients, refer to “Simple Network Management Protocol” on page 11-1, or refer to the specific CLI commands for SNMP starting on page 40-1.

Managing System Files

The switch’s flash memory supports three types of system files that can be managed by the CLI program, web interface, or SNMP. The switch’s file system allows files to be uploaded and downloaded, copied, deleted, and set as a start-up file.

The three types of files are:

• Configuration — This file type stores system configuration information and is created when configuration settings are saved. Saved configuration files can be selected as a system start-up file or can be uploaded via TFTP to a server for backup. The file named “Factory_Default_Config.cfg” contains all the system default settings and cannot be deleted from the system. If the system is booted with the factory default settings, the switch will also create a file named “startup1.cfg” that contains system settings for initialization. The configuration settings from the factory defaults configuration file are copied to this file, which is then used to boot the switch. See “Saving or Restoring Configuration Settings” on page 6-4 for more information.

• Operation Code — System software that is executed after boot-up, also known as run-time code. This code runs the switch operations and provides the CLI and web management interfaces. See “Managing Firmware” on page 6-1 for more information.

• Diagnostic Code — Software that is run during system boot-up, also known as POST (Power On Self-Test).

2-12

Managing System Files

Due to the size limit of the flash memory, the switch supports only two operation code files. However, you can have as many diagnostic code files and configuration files as available flash memory space allows. The switch has a total of 32 Mbytes of flash memory for system files.

In the system flash memory, one file of each type must be set as the start-up file. During a system boot, the diagnostic and operation code files set as the start-up file are run, and then the start-up configuration file is loaded.

Note that configuration files should be downloaded using a file name that reflects the contents or usage of the file settings. If you download directly to the running-config, the system will reboot, and the settings will have to be copied from the running-config to a permanent file.

Saving Configuration Settings

Configuration commands only modify the running configuration file and are not saved when the switch is rebooted. To save all your configuration changes in nonvolatile storage, you must copy the running configuration file to the start-up configuration file using the “copy” command.

New startup configuration files must have a name specified. File names on the switch are case-sensitive, can be from 1 to 31 characters, must not contain slashes (\ or /), and the leading letter of the file name must not be a period (.). (Valid characters: A-Z, a-z, 0-9, “.”, “-”, “_”)

There can be more than one user-defined configuration file saved in the switch’s flash memory, but only one is designated as the “startup” file that is loaded when the switch boots. The copy running-config startup-config command always sets the new file as the startup file. To select a previously saved configuration file, use the boot system config:<filename> command.

The maximum number of saved configuration files depends on available flash memory, with each configuration file normally requiring less than 20 kbytes. The amount of available flash memory can be checked by using the dir command.

To save the current configuration settings, enter the following command:

1. From the Privileged Exec mode prompt, type “copy running-config

startup-config” and press <Enter>.

2. Enter the name of the start-up file. Press <Enter>.

Console#copy running-config startup-config 35-2 Startup configuration file name []: startup \Write to FLASH Programming.

\Write to FLASH finish. Success.

Console#

2-13

Initial Configuration

2-14

Section II: Switch Management

This section describes the basic switch features, along with a detailed description of how to configure each feature via a web browser, and a brief example for the Command Line Interface.

Configuring the Switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1

Basic System Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1

Setting an IP Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1

Managing System Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-1

Console Port Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-1

Telnet Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-1

Configuring Event Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-1

Setting the System Clock . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-1

Simple Network Management Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-1

User Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-1

Configuring Port Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-1

Configuring 802.1X Port Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . 14-1

Access Control Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15-1

Port Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16-1

Creating Trunk Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17-1

Broadcast Storm Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18-1

Configuring Port Mirroring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19-1

Configuring Rate Limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20-1

Address Table Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21-1

Spanning Tree Algorithm Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . 22-1

VLAN Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23-1

Configuring Private VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24-1

Configuring Protocol-Based VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25-1

Class of Service Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26-1

Quality of Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27-1

Multicast Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28-1

Switch Management

Configuring Domain Name Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29-1

Switch Clustering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30-1

Chapter 3: Configuring the Switch

Using the Web Interface

This switch provides an embedded HTTP web agent. Using a web browser you can configure the switch and view statistics to monitor network activity. The web agent can be accessed by any computer on the network using a standard web browser (Internet Explorer 5.0 or above, or Netscape 6.2 or above).

Note: You can also use the Command Line Interface (CLI) to manage the switch over a

serial connection to the console port or via Telnet. For more information on using the CLI, refer to Chapter 31: “Using the Command Line Interface.”

Prior to accessing the switch from a web browser, be sure you have first performed the following tasks:

1. Configure the switch with a valid IP address, subnet mask, and default gateway

using an out-of-band serial connection, BOOTP or DHCP protocol. (See “Setting an IP Address” on page 2-4.)

2. Set user names and passwords using an out-of-band serial connection. Access

to the web agent is controlled by the same user names and passwords as the onboard configuration program. (See “Setting Passwords” on page 2-3.)

3. After you enter a user name and password, you will have access to the system

configuration program.

Notes: 1.

You are allowed three attempts to enter the correct password; on the third failed attempt the current connection is terminated.

2. If you log into the web interface as guest (Normal Exec level), you can view

the configuration settings or change the guest password. If you log in as “admin” (Privileged Exec level), you can change the settings on any page.

3. If the path between your management station and this switch does not pass

through any device that uses the Spanning Tree Algorithm, then you can set the switch port attached to your management station to fast forwarding (i.e., enable Admin Edge Port) to improve the switch’s response time to management commands issued through the web interface. See “Configuring Interface Settings” on page 22-13.

3-1

Configuring the Switch

Navigating the Web Browser Interface

To access the web-browser interface you must first enter a user name and password. The administrator has Read/Write access to all configuration parameters and statistics. The default user name and password “admin” is used for the administrator.

Home Page

When your web browser connects with the switch’s web agent, the home page is displayed as shown below. The home page displays the Main Menu on the left side of the screen and System Information on the right side. The Main Menu links are used to navigate to other menus, and display configuration parameters and statistics.

Figure 3-1 Home Page

Note: The examples in this chapter are based on the ES4524D. Other than the number

of fixed ports, there are no other differences between the ES4524D and ES4548D. The panel graphics for both switch types are shown on the following page.

3-2

Navigating the Web Browser Interface

Configuration Options

Configurable parameters have a dialog box or a drop-down list. Once a configuration change has been made on a page, be sure to click on the Apply button to confirm the new setting. The following table summarizes the web page configuration buttons.

Table 3-1 Web Page Configuration Buttons

Button Action

Apply Sets specified values to the system.

Revert Cancels specified values and restores current values prior to

Help Links directly to web help.

pressing “Apply.”

Notes: 1.

To ensure proper screen refresh, be sure that Internet Explorer 5.x is configured as follows: Under the menu “Tools / Internet Options / General / Temporary Internet Files / Settings,” the setting for item “Check for newer versions of stored pages” should be “Every visit to the page.”

2. When using Internet Explorer 5.0, you may have to manually refresh the

screen after making configuration changes by pressing the browser’s refresh button.

Panel Display

The web agent displays an image of the switch’s ports. The Mode can be set to display different information for the ports, including Active (i.e., up or down), Duplex (i.e., half or full duplex), or Flow Control (i.e., with or without flow control). Clicking on the image of a port opens the Port Configuration page as described on page 16-1.

ES4524D

ES4548D

Figure 3-2 Front Panel Indicators

3-3

Configuring the Switch

Main Menu

Using the onboard web agent, you can define system parameters, manage and control the switch, and all its ports, or monitor network conditions. The following table briefly describes the selections available from this program.

Table 3-2 Switch Main Menu

Menu Description Page

System 4-1

System Information Provides basic system description, including contact information 4-1

Switch Information Shows the number of ports, hardware/firmware version

Bridge Extension Shows the bridge extension parameters 4-5

IP Configuration Sets the IPv4 address for management access 5-1

IPv6 Configuration Configures IPv6 interface addresses and static neighbors 5-4

IPv6 Configuration Configures IPv6 interface address and protocol settings 5-4

IPv6 General Prefix Configures IPv6 general prefix for network portion of addresses 5-10

IPv6 Neighbor Configures IPv6 neighbor discover protocol and static neighbors 5-11

Jumbo Frames Enables support for jumbo frames 4-6

File Management 6-1

Copy Operation Allows the transfer and copying files 6-1

Delete Allows deletion of files from the flash memory 6-1

Set Startup Sets the startup file 6-1

Line 7-1

Console Sets console port connection parameters 7-1

Telnet Sets Telnet connection parameters 8-1

Log 9-1

Logs Sends error messages to a logging process 9-1

System Logs Stores and displays error messages 9-1

Remote Logs Configures the logging of messages to a remote logging process 9-2

SMTP Sends an SMTP client message to a participating server 9-4

Renumbering Renumbers the units in the stack 4-7

Reset Restarts the switch 4-7

SNTP 10-1

Configuration Configures SNTP client settings, including a specified list of

Clock Time Zone Sets the local time zone for the system clock 10-2

numbers, and power status

servers

4-3

10-1

3-4

Navigating the Web Browser Interface

Table 3-2 Switch Main Menu (Continued)

Menu Description Page

SNMP 11- 1

Configuration Configures community strings and related trap functions 11-3

Agent Status Enables or disables SNMP 11-2

SNMPv3 11- 6

Engine ID Sets the SNMP v3 engine ID 11-7

Remote Engine ID Sets the SNMP v3 engine ID on a remote device 11-7

Users Configures SNMP v3 users 11-8

Remote Users Configures SNMP v3 users on a remote device 11-10

Groups Configures SNMP v3 groups 11-12

Views Configures SNMP v3 views 11-16

Security 12-1

User Accounts Configures user names, passwords, and access levels 12-1

Authentication Settings Configures authentication sequence, RADIUS and TACACS 12-2

HTTPS Settings Configures secure HTTP settings 12-5

SSH 12-8

Settings Configures Secure Shell server settings 12-12

Host-Key Settings Generates the host key pair (public and private) 12-10

Port Security Configures per port security, including status, response for

security breach, and maximum allowed MAC addresses

802.1X Port authentication 14-1

Information Displays global configuration settings 14-2

Configuration Configures global configuration parameters 14-3

Port Configuration Sets the authentication mode for individual ports 14-3

Statistics Displays protocol statistics for the selected port 14-6

ACL 15-1

Configuration Configures packet filtering based on IP or MAC addresses 15-1

Port Binding Binds a port to the specified ACL 15-11

IP Filter Configures IP addresses that are allowed management access 12-13

Port 16-1

Port Information Displays port connection status 16-1

Trunk Information Displays trunk connection status 16-1

Port Configuration Configures port connection settings 16-4

Trunk Configuration Configures trunk connection settings 16-4

13-1

3-5

Configuring the Switch

Table 3-2 Switch Main Menu (Continued)

Menu Description Page

Trunk Membership Specifies ports to group into static trunks 17-2

LACP 17-1

Configuration Allows ports to dynamically join trunks 17-5

Aggregation Port Configures parameters for link aggregation group members 17-7

Port Counters Information Displays statistics for LACP protocol messages 17-9

Port Internal Information Displays settings and operational state for the local side 17-11

Port Neighbors Information Displays settings and operational state for the remote side 17-13

Port Broadcast Control Sets the broadcast storm threshold for each port 18-1

Trunk Broadcast Control Sets the broadcast storm threshold for each trunk 18-1

Mirror Port Configuration Sets the source and target ports for mirroring 19-1

Rate Limit 20-1

Input Port Configuration Sets the input rate limit for each port 20-1

Input Trunk Configuration Sets the input rate limit for each trunk 20-1

Output Port Configuration Sets the output rate limit for each port 20-1

Output Trunk Configuration Sets the output rate limit for each trunk 20-1

Port Statistics Lists Ethernet and RMON port statistics 16-6

Address Table 21-1

Static Addresses Displays entries for interface, address or VLAN 21-1

Dynamic Addresses Displays or edits static entries in the Address Table 21-2

Address Aging Sets timeout for dynamically learned entries 21-4

Spanning Tree 22-1

STA

Information Displays STA values used for the bridge 22-3

Configuration Configures global bridge settings for STP, RSTP and MSTP 22-6

Port Information Displays individual port settings for STA 22-10

Trunk Information Displays individual trunk settings for STA 22-10

Port Configuration Configures individual port settings for STA 22-13

Trunk Configuration Configures individual trunk settings for STA 22-13

MSTP

VLAN Configuration Configures priority and VLANs for a spanning tree instance 22-15

Port Information Displays port settings for a specified MST instance 22-18

Trunk Information Displays trunk settings for a specified MST instance 22-18

3-6

Navigating the Web Browser Interface

Table 3-2 Switch Main Menu (Continued)

Menu Description Page

Port Configuration Configures port settings for a specified MST instance 22-19

Trunk Configuration Configures trunk settings for a specified MST instance 22-19

VLAN 23-1

802.1Q VLAN

GVRP Status Enables GVRP VLAN registration protocol 23-4

802.1Q Tunnel Status Enables QinQ tunneling mode 23-16

Basic Information Displays information on the VLAN type supported by this switch 23-4

Current Table Shows the current port members of each VLAN and whether or

Static List Used to create or remove VLAN groups 23-6

Static Table Modifies the settings for an existing VLAN 23-7

Static Membership by Port Configures membership type for interfaces, including tagged,

Port Configuration Specifies default PVID and VLAN attributes 23-10

Trunk Configuration Specifies default trunk VID and VLAN attributes 23-10

Tunnel Configuration Adds ports to a QinQ tunnel 23-17

Tunnel Trunk Configuration Adds trunks to a QinQ tunnel 23-17

Private VLAN

Status Enables or disables the private VLAN 24-1

Link Status Configures the private VLAN 24-2

Protocol VLAN

Configuration Creates a protocol group, specifying the supported protocols 25-1

Port Configuration Maps a protocol group to a VLAN 25-2

Priority 26-1

Default Port Priority Sets the default priority for each port 26-1

Default Trunk Priority Sets the default priority for each trunk 26-1

Traffic Classes Maps IEEE 802.1p priority tags to output queues 26-3

Traffic Classes Status Enables/disables traffic class priorities (not implemented) NA

Queue Mode Sets queue mode to strict priority or Weighted Round-Robin 26-4

Queue Scheduling Configures Weighted Round Robin queueing 26-5

IP Precedence/ DSCP Priority Status

IP Precedence Priority Sets IP Type of Service priority, mapping the precedence tag to

not the port is tagged or untagged

untagged or forbidden

Globally selects IP Precedence or DSCP Priority, or disables both.

a class-of-service value

23-5

23-9

26-7

26-8

3-7

Configuring the Switch

Table 3-2 Switch Main Menu (Continued)

Menu Description Page

IP DSCP Priority Sets IP Differentiated Services Code Point priority, mapping a

IP Port Priority Status Globally enables or disables IP Port Priority 26-11

IP Port Priority Sets TCP/UDP port priority, defining the socket number and

QoS 27-1

DiffServ Configure QoS classification criteria and service policies 27-1

Class Map Creates a class map for a type of traffic 27-1

Policy Map Creates a policy map for multiple interfaces 27-4

Service Policy Applies a policy map defined to an ingress port 27-7

IGMP Snooping 28-1

IGMP Configuration Enables multicast filtering; configures parameters for multicast

Multicast Router Port Information

Static Multicast Router Port Configuration

IP Multicast Registration Table

IGMP Member Port Table Indicates multicast addresses associated with the selected

DNS 29-1

General Configuration Enables DNS; configures domain name and domain list; and

Static Host Table Configures static entries for domain name to address mapping 29-3

Cache Displays cache entries discovered by designated name servers 29-5

Cluster 30-1

Configuration Globally enables clustering for the switch 30-1

Member Configuration Adds switch Members to the cluster 30-2

Member Information Displays cluster Member switch information 30-3

Candidate Information Displays network Candidate switch information 30-4

DSCP tag to a class-of-service value

associated class-of-service value

query

Displays the ports that are attached to a neighboring multicast router for each VLAN ID

Assigns ports that are attached to a neighboring multicast router 28-5

Displays all multicast groups active on this switch, including multicast IP addresses and VLAN ID

VLAN

specifies IP address of name servers for dynamic lookup

26-9

26-11

28-2

28-4

28-6

28-7

29-1

3-8

Chapter 4: Basic System Settings

This chapter describes the basic functions required to set up management access to the switch, display or upgrade operating software, or reset the system.

Displaying System Information

You can easily identify the system by displaying the device name, location and contact information.

Field Attributes

• System Name – Name assigned to the switch system.

• Object ID – MIB II object ID for switch’s network management subsystem.

• Location – Specifies the system location.

• Contact – Administrator responsible for the system.

• System Up Time – Length of time the management agent has been up.

These additional parameters are displayed for the CLI.

• System Description – Brief description of device type.

• MAC Address – The physical layer address for this switch.

• Web Server – Shows if management access via HTTP is enabled.

• Web Server Port – Shows the TCP port number used by the web interface.

• Web Secure Server – Shows if management access via HTTPS is enabled.

• Web Secure Server Port – Shows the TCP port used by the HTTPS interface.

• Telnet Server – Shows if management access via Telnet is enabled.

• Telnet Server Port – Shows the TCP port used by the Telnet interface.

• Authentication Login – Shows the user login authentication sequence.

• Jumbo Frame – Shows if jumbo frames are enabled.

• POST Result – Shows results of the power-on self-test

4-1

Basic System Settings

Web – Click System, System Information. Specify the system name, location, and contact information for the system administrator, then click Apply. (This page also includes a Telnet button that allows access to the Command Line Interface via Telnet.)

Figure 4-1 System Information

4-2

Displaying Switch Hardware/Software Versions

CLI – Specify the hostname, location and contact information.

Console(config)#hostname R&D 5 34-1 Console(config)#snmp-server location WC 9 40-4 Console(config)#snmp-server contact Ted 40-4 Console(config)#exit Console#show system

34-7

System Description: 24/48 L2/L4 IPV4/IPV6 GE Switch System OID String: 1.3.6.1.4.1.259.6.10.95 System Information System Up Time: 0 days, 1 hours, 28 minutes, and 0.51 seconds System Name: R&D 5 System Location: WC 9 System Contact: Ted MAC Address (Unit1): 00-12-34-56-78-9A Web Server: Enabled Web Server Port: 80 Web Secure Server: Enabled Web Secure Server Port: 443 Telnet Server: Enable Telnet Server Port: 23 Authentication Login: Local RADIUS None Jumbo Frame: Disabled

POST Result:

DUMMY Test 1 ................. PASS

DRAM Test .................... PASS

Timer Test ................... PASS

PCI Device 1 Test ............ PASS

I2C Bus Initialization ....... PASS

Switch Int Loopback Test ..... PASS

Fan Speed Test ............... PASS

Done All Pass. Console#

Displaying Switch Hardware/Software Versions

Use the Switch Information page to display hardware/firmware version numbers for the main board and management software, as well as the power status of the system.

Field Attributes

Main Board

• Serial Number – The serial number of the switch.

• Number of Ports – Number of built-in ports.

• Hardware Version – Hardware version of the main board.

• Internal Power Status – Displays the status of the internal power supply.

Management Software

• EPLD Version – Version number of EEPROM Programmable Logic Device.

• Loader Version – Version number of loader code.

4-3

Basic System Settings

• Boot-ROM Version – Version of Power-On Self-Test (POST) and boot code.

• Operation Code Version – Version number of runtime code.

• Role – Shows that this switch is operating as Master or Slave.

These additional parameters are displayed for the CLI.

• Unit ID – Unit number in stack.

• Redundant Power Status – Displays the status of the redundant power supply.

Web – Click System, Switch Information.

Figure 4-2 Switch Information

CLI – Use the following command to display version information.

Console#show version 34-8 Unit 1 Serial Number: Hardware Version: EPLD Version: 1.02 Number of Ports: 24 Main Power Status: Up Redundant Power Status: Not present

Agent (Master) Unit ID: 1 Loader Version: 0.0.0.2 Boot ROM Version: 0.0.0.2 Operation Code Version: 0.0.0.4

Console#

4-4

Displaying Bridge Extension Capabilities

The Bridge MIB includes extensions for managed devices that support Multicast Filtering, Traffic Classes, and Virtual LANs. You can access these extensions to display default settings for the key variables.

Field Attributes

• Extended Multicast Filtering Services – This switch does not support the filtering

of individual multicast addresses based on GMRP (GARP Multicast Registration Protocol).

• Traffic Classes – This switch provides mapping of user priorities to multiple traffic

classes. (Refer to “Class of Service Configuration” on page 26-1.)

• Static Entry Individual Port – This switch allows static filtering for unicast and

multicast addresses. (Refer to “Setting Static Addresses” on page 21-1.)

• VLAN Learning – This switch uses Independent VLAN Learning (IVL), where each

port maintains its own filtering database.

• Configurable PVID Tagging – This switch allows you to override the default Port

VLAN ID (PVID used in frame tags) and egress status (VLAN-Tagged or Untagged) on each port. (Refer to “VLAN Configuration” on page 23-1.)

• Local VLAN Capable – This switch does not support multiple local bridges outside

of the scope of 802.1Q defined VLANs.

• GMRP – GARP Multicast Registration Protocol (GMRP) allows network devices to

register endstations with multicast groups. This switch does not support GMRP; it uses the Internet Group Management Protocol (IGMP) to provide automatic multicast filtering.

Web – Click System, Bridge Extension.

Figure 4-3 Displaying Bridge Extension Configuration

4-5

Basic System Settings

CLI – Enter the following command.

Console#show bridge-ext 52-2 Max support VLAN numbers: 256 Max support VLAN ID: 4093 Extended multicast filtering services: No Static entry individual port: Yes VLAN learning: IVL Configurable PVID tagging: Yes Local VLAN capable: No Traffic classes: Enabled Global GVRP status: Disabled GMRP: Disabled Console#

Configuring Support for Jumbo Frames

The switch provides more efficient throughput for large sequential data transfers by supporting jumbo frames up to 9216 bytes. Compared to standard Ethernet frames that run only up to 1.5 KB, using jumbo frames significantly reduces the per-packet overhead required to process protocol encapsulation fields.

Command Usage

To use jumbo frames, both the source and destination end nodes (such as a computer or server) must support this feature. Also, when the connection is operating at full duplex, all switches in the network between the two end nodes must be able to accept the extended frame size. And for half-duplex connections, all devices in the collision domain would need to support jumbo frames.

Command Attributes

Jumbo Packet Status – Configures support for jumbo frames. (Default: Disabled)

Web – Click System, Jumbo Frames. Enable or disable support for jumbo frames,

and click Apply.

Figure 4-4 Configuring Support for Jumbo Frames

CLI – This example enables jumbo frames globally for the switch.

Console(config)#jumbo frame 34-3 Console(config)#

4-6

Renumbering the Stack

If the units are no longer numbered sequentially after several topology changes or failures, you can reset the unit numbers using the “Renumbering” command. Just remember to save the new configuration settings to a startup configuration file prior to powering off the stack Master.

Note: This switch does not support stacking.

Command Usage

• The startup configuration file maps configuration settings to each switch in the

stack based on the unit identification number. You should therefore remember to save the current configuration after renumbering the stack.

• For a line topology, the stack is numbered from top to bottom, with the first unit in

the stack designated at unit 1. For a ring topology, the Master unit taken as the top of the stack and is numbered as unit 1, and all other units are numbered sequentially down through the ring.

Web – Click System, Renumbering.

Figure 4-5 Renumbering the Stack

CLI – This example renumbers all units in the stack.

Console#switch all renumber 34-2 Console#

Resetting the System

Web – Click System, Reset. Click the Reset button to restart the switch. When prompted, confirm that you want reset the switch.

Figure 4-6 Resetting the System

CLI – Use the reload command to restart the switch.

Console#reload 34-2 System will be restarted, continue <y/n>?

When restarting the system, it will always run the Power-On Self-Test.

Note:

4-7

Basic System Settings

4-8

Chapter 5: Setting an IP Address

This chapter describes how to configure an IPv4 interface for management access over the network. This switch supports both IPv4 and IPv6, and can be managed through either of these address types. For information on configuring the switch with an IPv6 address, see “Setting the Switch’s IP Address (IP Version 6)” on page 5-4.

Setting the Switch’s IP Address (IP Version 4)

The IPv4 address for the switch is obtained via DHCP by default. To manually configure an address, you need to change the switch’s default settings to values that are compatible with your network. You may also need to a establish a default gateway between the switch and management stations that exist on another network segment.

You can manually configure a specific IP address, or direct the device to obtain an address from a BOOTP or DHCP server. Valid IP addresses consist of four decimal numbers, 0 to 255, separated by periods. Anything other than this format will not be accepted by the CLI program.

Command Attributes

• Management VLAN – ID of the configured VLAN (1-4093). By default, all ports on

the switch are members of VLAN 1. However, the management station can be attached to a port belonging to any VLAN, as long as that VLAN has been assigned an IP address.

• IP Address Mode – Specifies whether IP functionality is enabled via manual

configuration (Static), Dynamic Host Configuration Protocol (DHCP), or Boot Protocol (BOOTP). If DHCP/BOOTP is enabled, IP will not function until a reply has been received from the server. Requests will be broadcast periodically by the switch for an IP address. (DHCP/BOOTP values can include the IP address, subnet mask, and default gateway.)

• IP Address – Address of the VLAN to which the management station is attached.

Valid IP addresses consist of four numbers, 0 to 255, separated by periods. (Default: 0.0.0.0)

• Subnet Mask – This mask identifies the host address bits used for routing to

specific subnets. (Default: 255.0.0.0)

• Gateway IP Address – IP address of the gateway router between the switch and

management stations that exist on other network segments. (Default: 0.0.0.0)

• MAC Address – The physical layer address for this switch.

5-1

Setting an IP Address

Manual Configuration

Web – Click System, IP Configuration. Select the VLAN through which the

management station is attached, set the IP Address Mode to “Static,” Enter the IP address, subnet mask and gateway, then click Apply.

Figure 5-1 IPv4 Interface Configuration - Manual

CLI – Specify the management interface, IP address and default gateway.

Console#config Console(config)#interface vlan 1 45-1 Console(config-if)#ip address 10.1.0.253 255.255.255.0 59-1 Console(config-if)#exit Console(config)#ip default-gateway 10.1.0.254 59-2 Console(config)#

5-2

Setting the Switch’s IP Address (IP Version 4)

Using DHCP/BOOTP

If your network provides DHCP/BOOTP services, you can configure the switch to be dynamically configured by these services.

Web – Click System, IP Configuration. Specify the VLAN to which the management station is attached, set the IP Address Mode to DHCP or BOOTP. Click Apply to save your changes. Then click Restart DHCP to immediately request a new address. Note that the switch will also broadcast a request for IP configuration settings on each power reset.

Figure 5-2 IPv4 Interface Configuration - DHCP

Note: If you lose your management connection, make a console connection to the

switch and enter “show ip interface” to determine the new switch address.

CLI – Specify the management interface, and set the IP address mode to DHCP or BOOTP, and then enter the “ip dhcp restart” command.

Console#config Console(config)#interface vlan 1 45-1 Console(config-if)#ip address dhcp 59-1 Console(config-if)#end Console#ip dhcp restart 59-3 Console#show ip interface 59-4 IP Address and Netmask: 192.168.0.100 255.255.255.0 on VLAN 1, Address Mode: DHCP Console#

Renewing DCHP – DHCP may lease addresses to clients indefinitely or for a specific period of time. If the address expires or the switch is moved to another network segment, you will lose management access to the switch. In this case, you can reboot the switch or submit a client request to restart DHCP service via the CLI.

5-3

Setting an IP Address

Web – If the address assigned by DHCP is no longer functioning, you will not be able to renew the IP settings via the web interface. You can only restart DHCP service via the web interface if the current address is still available.

CLI – Enter the following command to restart DHCP service.

Console#ip dhcp restart 59-3 Console#

Setting the Switch’s IP Address (IP Version 6)

This section describes how to configure an IPv6 interface for management access over the network. This switch supports both IPv4 and IPv6, and can be managed through either of these address types. For information on configuring the switch with an IPv4 address, see “Setting the Switch’s IP Address (IP Version 4)” on page 5-1.

Configuring an IPv6 Address

IPv6 includes two distinct address types – link-local unicast and global unicast. A link-local address makes the switch accessible over IPv6 for all devices attached to the same local subnet. Management traffic using this kind of address cannot be passed by any router outside of the subnet. A link-local address is easy to set up, and may be useful for simple networks or basic troubleshooting tasks. However, to connect to a larger network with multiple segments, the switch must be configured with a global unicast address. Both link-local and global unicast address types can either be manually configured or dynamically assigned.

Command Usage

• All IPv6 addresses must be formatted according to RFC 2373 “IPv6 Addressing Architecture,” using 8 colon-separated 16-bit hexadecimal values. One double colon may be used in the address to indicate the appropriate number of zeros required to fill the undefined fields.

• The switch must always be configured with a link-local address. Therefore any configuration process that enables IPv6 functionality, or assigns a global unicast address to the switch, will also automatically generate a link-local unicast address. The prefix length for a link-local address is fixed at 64 bits, and the host portion of the default address is based on the modified EUI-64 (Extended Universal Identifier) form of the interface identifier (i.e., the physical MAC address). Alternatively, you can manually configure the link-local address by entering the full address with the network prefix FE80.

• To connect to a larger network with multiple subnets, you must configure a global unicast address. There are several alternatives to configuring this address type:

- The global unicast address can be automatically configured by taking the

network prefix from router advertisements observed on the local interface, and using the modified EUI-64 form of the interface identifier to automatically create the host portion of the address.

- It can be manually configured by specifying the entire network prefix and prefix

5-4

Setting the Switch’s IP Address (IP Version 6)

length, and using the EUI-64 form of the interface identifier to automatically create the low-order 64 bits in the host portion of the address.

- You can also manually configure the global unicast address by entering the full address and prefix length.

- Or you can include a general prefix for the network portion of the address (as described under “Configuring an IPv6 General Network Prefix” on page 5-10). When using this method, remember that the prefix length specified on the IPv6 Configuration page must include both the length of the general prefix and any contiguous bits (from the left of the specified address) that are added to the general prefix to form the extended network portion of the address.

• You can configure multiple IPv6 global unicast addresses per interface, but only one link-local address per interface.

• If a duplicate link-local address is detected on the local segment, this interface is disabled and a warning message displayed on the console. If a duplicate global unicast address is detected on the network, the address is disabled on this interface and a warning message displayed on the console.

Command Attributes

• (Management) VLAN – ID of the configured VLAN (1-4093). By default, all ports on the switch are members of VLAN 1. However, the management station can be attached to a port belonging to any VLAN, as long as that VLAN has been assigned an IP address.

• IPv6 Enabled – Enables IPv6 on an interface. Note that when an explicit address is assigned to an interface, IPv6 is automatically enabled, and cannot be disabled until all assigned addresses have been removed.

• IPv6 Default Gateway – Sets the IPv6 address of the default next hop router.

- An IPv6 default gateway must be defined if the management station is located

in a different IPv6 segment.

- An IPv6 default gateway can only be successfully set when a network interface

that directly connects to the gateway has been configured on the switch.

• IPv6 MTU – Sets the size of the maximum transmission unit (MTU) for IPv6 packets sent on an interface. (Range: 1280-65535 bytes, Default: 1500 bytes)

- IPv6 routers do not fragment IPv6 packets forwarded from other routers.

However, traffic originating from an end-station connected to an IPv6 router may be fragmented.

- All devices on the same physical medium must use the same MTU in order to

operate correctly.

- IPv6 must be enabled on an interface before the MTU can be set.

5-5

Setting an IP Address

IP Address

• Auto Configuration – Enables stateless autoconfiguration of IPv6 addresses on an interface and enables IPv6 functionality on the interface. The network portion of the address is based on prefixes received in IPv6 router advertisement messages, and the host portion is automatically generated using the modified EUI-64 form of the interface identifier (i.e., the switch’s MAC address).

- If the router advertisements have the “other stateful configuration” flag set, the

switch will attempt to acquire other non-address configuration information (such as a default gateway).

• Manual Configuration – Manually configures an IPv6 address.

• IPv6 Address – An IPv6 address can be configured in any of these ways:

- A link-local address can be manually configured by specifying the entire address in the IPv6 Address field, and selecting the Address Type “Link Local.” The network prefix length is fixed at 64 bits and cannot be changed.

- A global unicast address can be configured by specifying the network prefix and the length of the prefix (in the IPv6 Address and Prefix Length fields), and then selecting the Address Type “EUI-64” to automatically create the host portion of the address in the low order 64 bits based on the modified EUI-64 interface identifier.

- A global unicast address can be manually configured by specifying the full address and network prefix length (in the IP Address and Prefix Length fields), and selecting the Address Type “Global.”

- A global unicast address can also be set by selecting a preconfigured general prefix for the network portion of the address from the Based on General Prefix scroll-down list and marking the check box next to this field to enable your choice (see “Configuring an IPv6 General Network Prefix” on page 5-10), and then specifying the address (in the IPv6 Address field) and the full network prefix length which includes the general prefix and any contiguous bits from the left of the address that are appended to the network prefix (in the Prefix Length field).

• Prefix Length – A decimal value indicating how many contiguous bits (from the left) of the address comprise the prefix (i.e., the network portion of the address).

When used with a general network prefix to configure a global unicast address, this length includes both that specified by the general prefix and any contiguous prefix bits (from the left of the specified address) that exceed the length of the general prefix. If the prefix length specified by this parameter is shorter than the general prefix, then the length of the general prefix takes precedence.

• Based on General Prefix – Defines a general prefix for the network segment of the address (see “Configuring an IPv6 General Network Prefix” on page 5-10).

When configuring a global unicast address based on a general network prefix, the Prefix Length includes both that specified by the general prefix and any number of subsequent prefix bits that exceed the length of the general prefix. Therefore, depending on the value specified by the Prefix Length, some of the address bits entered in the IPv6 Address field may be appended to the general prefix. However, if the Prefix Length is shorter than the general prefix, then the

5-6

Setting the Switch’s IP Address (IP Version 6)

length of the general prefix takes precedence, and some of the address bits entered in the IPv6 Address field will be ignored.

• Address Type – Defines the address type configured for this interface.

• Link Local – Configures an IPv6 link-local address.

- The address prefix must be FE80.

- You can configure only one link-local address per interface.

- The specified address replaces a link-local address that was automatically generated for the interface.

• EUI-64 (Extended Universal Identifier) – Configures an IPv6 address for an interface using an EUI-64 interface ID in the low order 64 bits.

- When using EUI-64 format for the low-order 64 bits in the host portion of the

address, the value entered in the IPv6 Address field includes the network portion of the address, and the value in the Prefix Length field indicates how many contiguous bits (from the left) of the address comprise the prefix (i.e., the network portion of the address). Note that the value specified in the IPv6 Address field may include some of the high-order host bits if the specified prefix length is less than 64 bits. If the specified prefix length exceeds 64 bits, then the bits used in the network portion of the address will take precedence over the interface identifier.

- IPv6 addresses are 16 bytes long, of which the bottom 8 bytes typically form

a unique host identifier based on the device’s MAC address. The EUI-64 specification is designed for devices that use an extended 8-byte MAC address. For devices that still use a 6-byte MAC address (also known as EUI-48 format), it must be converted into EUI-64 format by inverting the universal/local bit in the address and inserting the hexadecimal number FFFE between the upper and lower three bytes of the MAC address.

For example, if a device had an EUI-48 address of 28-9F-18-1C-82-35, the global/local bit must first be inverted to meet EUI-64 requirements (i.e., 1 for globally defined addresses and 0 for locally defined addresses), changing 28 to 2A. Then the two bytes FFFE are inserted between the OUI (i.e., organizationally unique identifier, or company identifier) and the rest of the address, resulting in a modified EUI-64 interface identifier of 2A-9F-18-FF-FE-1C-82-35.

- This host addressing method allows the same interface identifier to be used

on multiple IP interfaces of a single device, as long as those interfaces are attached to different subnets.

• Global – Configures an IPv6 global unicast address based on values entered in the IPv6 Address and Prefix Length fields.

- Auto Detect – System will automatically detect the address type according to the address/prefix entered in the IPv6 Address field.

5-7

Setting an IP Address

Current Address Table

• IPv6 Address – IPv6 address assigned to this interface.

In addition to the unicast addresses assigned to an interface, a node is required to join the all-nodes multicast addresses FF01::1 and FF02::1 for all IPv6 nodes within scope 1 (interface-local) and scope 2 (link-local), respectively.

FF01::1/16 is the transient node-local multicast address for all attached IPv6 nodes, and FF02::1/16 is the link-local multicast address for all attached IPv6 nodes. The node-local multicast address is only used for loopback transmission of multicast traffic. Link-local multicast addresses cover the same types as used by link-local unicast addresses, including all nodes (FF02::1), all routers (FF02::2), and solicited nodes (FF02::1:FFXX:XXXX) as described below.

A node is also required to compute and join the associated solicited-node multicast addresses for every unicast and anycast address it is assigned. IPv6 addresses that differ only in the high-order bits, e.g. due to multiple high-order prefixes associated with different aggregations, will map to the same solicited-node address, thereby reducing the number of multicast addresses a node must join. In this example, FF02::1:FF90:0/104 is the solicited-node multicast address which is formed by taking the low-order 24 bits of the address and appending those bits to the prefix.

Note that the solicited-node multicast address (link-local scope FF02) is used to resolve the MAC addresses for neighbor nodes since IPv6 does not support the broadcast method used by the Address Resolution Protocol in IPv4.

• Prefix Length – This field includes the prefix length, address type (Global, Link-local, Multicast), and configuration method if manually set.

• Address Type – Global, Link-local or Multicast.

5-8

Setting the Switch’s IP Address (IP Version 6)

Web – Click System, IPv6 Configuration, IPv6 Configuration. Set the IPv6 default gateway, specify the VLAN to configure, enable IPv6, and set the MTU. Then enter a global unicast or link-local address and click Add IPv6 Address.

Figure 5-3 IPv6 Interface Configuration

5-9

Setting an IP Address

CLI – This example configures an IPv6 gateway, specifies the management interface, configures a global unicast address, and then sets the MTU.

Console#config Console(config)ipv6 default-gateway 2009:DB9:2229::240 60-12 Console(config)#interface vlan 1 45-1 Console(config-if)#ipv6 address rd 7279::79/64 60-4 Console(config-if)#ipv6 mtu 1280 60-13 Console(config-if)#end Console#show ipv6 default-gateway 60-12 ipv6 default gateway: 2009:DB9:2229::240 Console#show ipv6 interface 60-10 Vlan 1 is up IPv6 is enable. Link-local address: FE80::200:E8FF:FE90:0/64 Global unicast address(es): 2009:DB9:2229::79, subnet is 2009:DB9:2229:0::/64 Joined group address(es): FF01::1/16 FF02::1/16 FF02::1:FF00:79/104 FF02::1:FF90:0/104 MTU is 1280 bytes. ND DAD is enabled, number of DAD attempts: 1. ND retransmit interval is 1000 milliseconds Console#show ipv6 mtu 60-14 MTU Since Destination Address 1400 00:04:21 5000:1::3 1280 00:04:50 FE80::203:A0FF:FED6:141D Console#

Configuring an IPv6 General Network Prefix

The IPv6 General Prefix page is used to configure general prefixes that are subsequently used on the IPv6 Configuration web page (see page 5-4) to specify the network address portion of an interface address.

Command Usage

• Prefixes may contain zero-value fields or end in zeros.

• A general prefix holds a short prefix that indicates the high-order bits used in the network portion of the address. Longer, more specific, prefixes can be based on the general prefix to specify any number of subnets. When the general prefix is changed, all of the more specific prefixes based on this prefix will also change.

Command Attributes

• General Prefix Name – The label assigned to the general prefix.

• Prefix Value – The high-order bits of the network address segment assigned to the general prefix. The prefix must be formatted according to RFC 2373 “IPv6 Addressing Architecture,” using 8 colon-separated 16-bit hexadecimal values. One double colon may be used in the address to indicate the appropriate number of zeros required to fill the undefined fields.

• Prefix Length – A decimal value indicating how many of the contiguous bits (from the left) of the address comprise the prefix (i.e., the network portion of the address).

5-10

Setting the Switch’s IP Address (IP Version 6)

Web – Click System, IPv6 Configuration, IPv6 General Prefix. Click Add to open the editing fields for a prefix entry. Enter a name for the general prefix, the value for the general prefix, and the prefix length. Then click Add to enable the entry.

Figure 5-4 IPv6 General Prefix Configuration

CLI – This example creates a general network prefix of 2009:DB9:2229::/48.

Console(config)#ipv6 general-prefix rd 2009:DB9:2229::/48 60-3 Console(config)#end Console#show ipv6 general-prefix 60-4 IPv6 general prefix: rd 2009:DB9:2229::/48 Console#

Configuring the Neighbor Detection Protocol and Static Entries

IPv6 Neighbor Discovery Protocol supersedes IPv4 Address Resolution Protocol in IPv6 networks. IPv6 nodes on the same network segment use Neighbor Discovery to discover each other's presence, to determine each other's link-layer addresses, to find routers and to maintain reachability information about the paths to active neighbors. The key parameters used to facilitate this process are the number of attempts made to verify whether or not a duplicate address exists on the same network segment, and the interval between neighbor solicitations used to verify reachability information.

Command Attributes

Protocol Settings

• VLAN – VLAN ID (Range: 1-4093)

• IPv6 ND DAD Attempts – The number of consecutive neighbor solicitation

messages sent on an interface during duplicate address detection. (Range: 0-600, Default: 1)

5-11

Setting an IP Address

- Configuring a value of 0 disables duplicate address detection.

- Duplicate address detection determines if a new unicast IPv6 address already

exists on the network before it is assigned to an interface.

- Duplicate address detection is stopped on any interface that has been

suspended (see “Creating VLANs” on page 23-6). While an interface is suspended, all unicast IPv6 addresses assigned to that interface are placed in a “pending” state. Duplicate address detection is automatically restarted when the interface is administratively re-activated.

- An interface that is re-activated restarts duplicate address detection for all

unicast IPv6 addresses on the interface. While duplicate address detection is performed on the interface’s link-local address, the other IPv6 addresses remain in a “tentative” state. If no duplicate link-local address is found, duplicate address detection is started for the remaining IPv6 addresses.

- If a duplicate address is detected, it is set to “duplicate” state, and a warning

message is sent to the console. If a duplicate link-local address is detected, IPv6 processes are disabled on the interface. If a duplicate global unicast address is detected, it is not used. All configuration commands associated with a duplicate address remain configured while the address is in “duplicate” state.

- If the link-local address for an interface is changed, duplicate address detection

is performed on the new link-local address, but not for any of the IPv6 global unicast addresses already associated with the interface.

Current Neighbor Cache Table

• IPv6 Address – IPv6 address of neighbor device.

• Age – The time since the address was verified as reachable (in minutes). A static entry is indicated by the value “Permanent.”

• Link-layer Address – Physical layer MAC address.

• State – The current state for an entry.

The following states are used for dynamic entries:

- INCMP (Incomplete) - Address resolution is being carried out on the entry.

A neighbor solicitation message has been sent to the multicast address of the target, but it has not yet returned a neighbor advertisement message.

- REACH (Reachable) - Positive confirmation was received within the last

ReachableTime interval that the forward path to the neighbor was functioning. While in REACH state, the device takes no special action when sending packets.

- STALE - More than the ReachableTime interval has elapsed since the last

positive confirmation was received that the forward path was functioning. While in STALE state, the device takes no action until a packet is sent.

- DELAY - More than the ReachableTime interval has elapsed since the last

positive confirmation was received that the forward path was functioning. A packet was sent within the last DELAY_FIRST_PROBE_TIME interval. If no reachability confirmation is received within this interval after entering the DELAY state, the switch will send a neighbor solicitation message and change the state to PROBE.

5-12

Setting the Switch’s IP Address (IP Version 6)

- PROBE - A reachability confirmation is actively sought by resending neighbor solicitation messages every RetransTimer interval until confirmation of reachability is received.

- ???? - Unknown state.

The following states are used for static entries:

- INCMP (Incomplete) -The interface for this entry is down.

- REACH (Reachable) - The interface for this entry is up. Reachability detection is not applied to static entries in the IPv6 neighbor discovery cache.

• VLAN – VLAN interface from which the address was reached.

Adding Static Neighbors (IPv6 Neighbor -- Add)

• IPv6 Address – The IPv6 address of a neighbor device that can be reached through one of the network interfaces configured on this switch. You can specify either a link-local or global unicast address formatted according to RFC 2373 “IPv6 Addressing Architecture,” using 8 colon-separated 16-bit hexadecimal values. One double colon may be used in the address to indicate the appropriate number of zeros required to fill the undefined fields.

• VLAN – VLAN ID (Range: 1-4093)

• Hardware Address – The 48-bit MAC layer address for the neighbor device. This address must be formatted as six hexadecimal pairs separated by hyphens.

5-13

Setting an IP Address

Web – Click System, IPv6 Configuration, IPv6 ND Neighbor. To configure the Neighbor Detection protocol settings, select a VLAN interface, set the number of attempts allowed for duplicate address detection, set the interval for neighbor solicitation messages, and click Apply. To configure static neighbor entries, click Add, fill in the IPv6 address, VLAN interface and hardware address. Then click Add.

Figure 5-5 IPv6 Neighbor Detection and Neighbor Cache

CLI – This example maps a static entry for a global unicast address to a MAC address.

Console(config)#ipv6 general-prefix rd 2009:DB9:2229::/48 60-3 Console(config)#ipv6 neighbor 2009:0DB9::49A vlan 1 30-65-14-01-11-87 60-22 Console(config)#end Console#show ipv6 neighbors 60-26 IPv6 Address Age Link-layer Addr State Vlan 2009:DB9:2229::77 Permanent 30-65-14-01-11-87 REACH 1 Console#

5-14

Chapter 6: Managing System Files

This chapter describes how to upgrade the switch operating software, save and restore switch configuration files, and set the system start-up files.

Managing Firmware

You can upload/download firmware to or from a TFTP server. By saving runtime code to a file on a TFTP server, that file can later be downloaded to the switch to restore operation. You can also set the switch to use new firmware without overwriting the previous version. You must specify the method of file transfer, along with the file type and file names as required.

Command Attributes

• File Transfer Method – The firmware copy operation includes these options:

- file to file – Copies a file within the switch directory, assigning it a new name.

- file to tftp – Copies a file from the switch to a TFTP server.

- tftp to file – Copies a file from a TFTP server to the switch.

- file to unit – Copies a file from this switch to another unit in the stack.

- unit to file – Copies a file from another unit in the stack to this switch.

• TFTP Server IP Address – The IP address of a TFTP server.

• File Type – Specify opcode (operational code) to copy firmware.

• File Name – the file name should not be a period (.), and the maximum length for file names on the TFTP server is 127 characters or 31 characters for files on the switch. (Valid characters: A-Z, a-z, 0-9, “.”, “-”, “_”)

• Source/Destination Unit – Stack unit. (Range: Always 1)

Note:

Up to two copies of the system software (i.e., the runtime firmware) can be stored in the file directory on the switch. The currently designated startup version of this file cannot be deleted.

The file name should not contain slashes (\ or /),

the leading letter of

6-1

Managing System Files

Downloading System Software from a Server

When downloading runtime code, you can specify the destination file name to replace the current image, or first download the file using a different name from the current runtime code file, and then set the new file as the startup file.

Web – Click System, File Management, Copy Operation. Select “tftp to file” as the file transfer method, enter the IP address of the TFTP server, set the file type to “opcode,” enter the file name of the software to download, select a file on the switch to overwrite or specify a new file name, then click Apply. If you replaced the current firmware used for startup and want to start using the new operation code, reboot the system via the System/Reset menu.

Figure 6-1 Copy Firmware

If you download to a new destination file, go to the File Management, Set Start-Up menu, mark the operation code file used at startup, and click Apply. To start the new firmware, reboot the system via the System/Reset menu.

Figure 6-2 Setting the Startup Code

6-2

Managing Firmware

To delete a file select System, File Management, Delete. Select the file name from the given list by checking the tick box and click Apply. Note that the file currently designated as the startup code cannot be deleted.

Figure 6-3 Deleting Files

CLI – To download new firmware form a TFTP server, enter the IP address of the TFTP server, select “config” as the file type, then enter the source and destination file names. When the file has finished downloading, set the new file to start up the system, and then restart the switch.

To start the new firmware, enter the “reload” command or reboot the system.

Console#copy tftp file 35-2 TFTP server ip address: 10.1.0.19 Choose file type:

1. config: 2. opcode: <1-2>: 2 Source file name: V1.0.0.28.bix Destination file name: V10028 \Write to FLASH Programming.

-Write to FLASH finish. Success. Console#config Console(config)#boot system opcode:V10028 35-7 Console(config)#exit Console#reload 34-2

6-3

Managing System Files

Saving or Restoring Configuration Settings

You can upload/download configuration settings to/from a TFTP server. The configuration file can be later downloaded to restore the switch’s settings.

Command Attributes

• File Transfer Method – The configuration copy operation includes these options:

- file to file – Copies a file within the switch directory, assigning it a new name.

- file to running-config – Copies a file in the switch to the running configuration.

- file to startup-config – Copies a file in the switch to the startup configuration.

- file to tftp – Copies a file from the switch to a TFTP server.

- running-config to file – Copies the running configuration to a file.

- running-config to startup-config – Copies the running config to the startup config.

- running-config to tftp – Copies the running configuration to a TFTP server.

- startup-config to file – Copies the startup configuration to a file on the switch.

- startup-config to running-config – Copies the startup config to the running config.

- startup-config to tftp – Copies the startup configuration to a TFTP server.

- tftp to file – Copies a file from a TFTP server to the switch.

- tftp to running-config – Copies a file from a TFTP server to the running config.

- tftp to startup-config – Copies a file from a TFTP server to the startup config.

- file to unit – Copies a file from this switch to another unit in the stack.

- unit to file – Copies a file from another unit in the stack to this switch.

• TFTP Server IP Address – The IP address of a TFTP server.

• File Type – Specify config (configuration) to copy configuration settings.

File Name

• leading letter of the file name should not be a period (.), and the maximum length for file names on the TFTP server is 127 characters or 31 characters for files on the switch. (Valid characters: A-Z, a-z, 0-9, “.”, “-”, “_”)

• Source/Destination Unit – Stack unit. (Range: Always 1)

Note:

— The configuration file name should not contain slashes (\ or /),

The maximum number of user-defined configuration files is limited only by available flash memory space.

the

6-4

Saving or Restoring Configuration Settings

Downloading Configuration Settings from a Server

You can download the configuration file under a new file name and then set it as the startup file, or you can specify the current startup configuration file as the destination file to directly replace it. Note that the file “Factory_Default_Config.cfg” can be copied to the TFTP server, but cannot be used as the destination on the switch.

Web – Click System, File Management, Copy Operation. Choose “tftp to startup-config” or “tftp to file,” and enter the IP address of the TFTP server. Specify the name of the file to download, select a file on the switch to overwrite or specify a new file name, and then click Apply.

Figure 6-4 Downloading Configuration Settings for Start-Up

If you download to a new file name using “tftp to startup-config” or “tftp to file,” the file is automatically set as the start-up configuration file. To use the new settings, reboot the system via the System/Reset menu. You can also select any configuration file as the start-up configuration by using the System/File Management/Set Start-Up page.

Figure 6-5 Setting the Startup Configuration Settings

6-5

Managing System Files

CLI – Enter the IP address of the TFTP server, specify the source file on the server, set the startup file name on the switch, and then restart the switch.

Console#copy tftp startup-config 35-2 TFTP server ip address: 192.168.1.19 Source configuration file name: config-1 Startup configuration file name [] : startup \Write to FLASH Programming.

-Write to FLASH finish. Success.

Console#reload

To select another configuration file as the start-up configuration, use the boot system command and then restart the switch.

Console#config Console(config)#boot system config: startup 35-7 Console(config)#exit Console#reload 34-2

6-6

Chapter 7: Console Port Settings

You can access the onboard configuration program by attaching a VT100 compatible device to the switch’s serial console port. Management access through the console port is controlled by various parameters, including a password, timeouts, and basic communication settings. These parameters can be configured via the web or CLI interface.

Command Attributes

• Login Timeout – Sets the interval that the system waits for a user to log into the

CLI. If a login attempt is not detected within the timeout interval, the connection is terminated for the session. (Range: 0 - 300 seconds; Default: 0)

• Exec Timeout – Sets the interval that the system waits until user input is detected.

If user input is not detected within the timeout interval, the current session is terminated. (Range: 0 - 65535 seconds; Default: 0 seconds)

• Password Threshold – Sets the password intrusion threshold, which limits the

number of failed logon attempts. When the logon attempt threshold is reached, the system interface becomes silent for a specified amount of time (set by the Silent Time parameter) before allowing the next logon attempt. (Range: 0-120; Default: 3 attempts)

• Silent Time – Sets the amount of time the management console is inaccessible

after the number of unsuccessful logon attempts has been exceeded. (Range: 0-65535; Default: 0)

• Data Bits – Sets the number of data bits per character that are interpreted and

generated by the console port. If parity is being generated, specify 7 data bits per character. If no parity is required, specify 8 data bits per character. (Default: 8 bits)

• Parity – Defines the generation of a parity bit. Communication protocols provided

by some terminals can require a specific parity bit setting. Specify Even, Odd, or None. (Default: None)

• Speed – Sets the terminal line’s baud rate for transmit (to terminal) and receive

(from terminal). Set the speed to match the baud rate of the device connected to the serial port. (Range: 9600, 19200, 38400, 57600, or 115200 baud, Auto; Default: Auto)

• Stop Bits – Sets the number of the stop bits transmitted per byte.

(Range: 1-2; Default: 1 stop bit)

• Password

started on a line with password protection, the system prompts for the password. If you enter the correct password, the system shows a prompt. (Default: No password)

• Login

single global password as configured for the Password parameter, or by passwords set up for specific user-name accounts. (Default: Local)

– Specifies a password for the line connection. When a connection is

– Enables password checking at login. You can select authentication by a

1. CLI only.

7-1

Console Port Settings

Web – Click System, Line, Console. Specify the console port connection parameters as required, then click Apply.

Figure 7-1 Configuring the Console Port

CLI – Enter Line Configuration mode for the console, then specify the connection parameters as required. To display the current console port settings, use the show line command from the Normal Exec level.

Console(config)#line console 36-1 Console(config-line)#login local 36-2 Console(config-line)#password 0 secret 36-3 Console(config-line)#timeout login response 0 36-4 Console(config-line)#exec-timeout 0 36-4 Console(config-line)#password-thresh 5 36-5 Console(config-line)#silent-time 60 36-6 Console(config-line)#databits 8 36-6 Console(config-line)#parity none 36-7 Console(config-line)#speed auto 36-8 Console(config-line)#stopbits 1 36-8 Console(config-line)#end Console#show line console 36-9 Console configuration: Password threshold: 5 times Interactive timeout: Disabled Login timeout: Disabled Silent time: 60 Baudrate: auto Databits: 8 Parity: none Stopbits: 1 Console#

7-2

Chapter 8: Telnet Settings

You can access the onboard configuration program over the network using Telnet (i.e., a virtual terminal). Management access via Telnet can be enabled/disabled and other various parameters set, including the TCP port number, timeouts, and a password. These parameters can be configured via the web or CLI interface.

Command Attributes

• Telnet Status – Enables or disables Telnet access to the switch.

(Default: Enabled)

• Telnet Port Number – Sets the TCP port number for Telnet on the switch.

(Default: 23)

• Login Timeout – Sets the interval that the system waits for a user to log into the

CLI. If a login attempt is not detected within the timeout interval, the connection is terminated for the session. (Range: 0 - 300 seconds; Default: 300 seconds)

• Exec Timeout – Sets the interval that the system waits until user input is detected.

If user input is not detected within the timeout interval, the current session is terminated. (Range: 0 - 65535 seconds; Default: 600 seconds)

• Password Threshold – Sets the password intrusion threshold, which limits the

• Password

started on a line with password protection, the system prompts for the password. If you enter the correct password, the system shows a prompt. (Default: No password)

• Login

single global password as configured for the Password parameter, or by passwords set up for specific user-name accounts. (Default: Local)

– Specifies a password for the line connection. When a connection is

– Enables password checking at login. You can select authentication by a

Web – Click System, Line, Telnet. Specify the connection parameters for Telnet

access, then click Apply.

1. CLI only.

8-1

Telnet Settings

Figure 8-1 Configuring the Telnet Interface

CLI – Enter Line Configuration mode for a virtual terminal, then specify the connection parameters as required. To display the current virtual terminal settings, use the show line command from the Normal Exec level.

Console(config)#line vty 36-1 Console(config-line)#login local 36-2 Console(config-line)#password 0 secret 36-3 Console(config-line)#timeout login response 300 36-4 Console(config-line)#exec-timeout 600 36-4 Console(config-line)#password-thresh 3 36-5 Console(config-line)#end Console#show line vty 36-9 VTY configuration: Password threshold: 3 times Interactive timeout: 600 sec Login timeout: 300 sec Console#

8-2

Chapter 9: Configuring Event Logging

The switch allows you to control the logging of error messages, including the type of events that are recorded in switch memory, logging to a remote System Log (syslog) server, and displays a list of recent event messages.

System Log Configuration

The system allows you to enable or disable event logging, and specify which levels are logged to RAM or flash memory.

Severe error messages that are logged to flash memory are permanently stored in the switch to assist in troubleshooting network problems. Up to 4096 log entries can be stored in the flash memory, with the oldest entries being overwritten first when the available log memory (256 kilobytes) has been exceeded.

The System Logs page allows you to configure and limit system messages that are logged to flash or RAM memory. The default is for event levels 0 to 3 to be logged to flash and levels 0 to 7 to be logged to RAM.

Command Attributes

• System Log Status – Enables/disables the logging of debug or error messages to

the logging process. (Default: Enabled)

• Flash Level – Limits log messages saved to the switch’s permanent flash memory

for all levels up to the specified level. For example, if level 3 is specified, all

messages from level 0 to level 3 will be logged to flash. (Range: 0-7, Default: 3)

Table 9-1 Logging Levels

Level Severity Name Description

7 Debug Debugging messages

6 Informational Informational messages only

5 Notice Normal but significant condition, such as cold start

4 Warning Warning conditions (e.g., return false, unexpected return)

3 Error Error conditions (e.g., invalid input, default used)

2 Critical Critical conditions (e.g., memory allocation, or free memory

1 Alert Immediate action needed

0 Emergency System unusable

* There are only Level 2, 5 and 6 error messages for the current firmware release.

error - resource exhausted)

• RAM Level – Limits log messages saved to the switch’s temporary RAM memory

for all levels up to the specified level. For example, if level 7 is specified, all messages from level 0 to level 7 will be logged to RAM. (Range: 0-7, Default: 7)

The Flash Level must be equal to or less than the RAM Level.

Note:

9-1

Configuring Event Logging

Web – Click System, Logs, System Logs. Specify System Log Status, set event messages to be logged to RAM and flash memory, then click Apply.

Figure 9-1 System Logs

CLI – Enable system logging and then specify the level of messages to be logged to RAM and flash memory. Use the show logging command to display the current settings.

Console(config)#logging on 37-1 Console(config)#logging history ram 0 37-2 Console(config)# Console#show logging ram 37-5 Syslog logging: Disabled History logging in RAM: level emergencies Console#

the level of

Remote Log Configuration

The Remote Logs page allows you to configure the logging of messages that are sent to syslog servers or other management stations. You can also limit the event messages sent to only those messages at or above a specified level.

Command Attributes

• Remote Log Status – Enables/disables the logging of debug or error messages to the remote logging process. (Default: Disabled)

• Logging Facility – Sets the facility type for remote logging of syslog messages. There are eight facility types specified by values of 16 to 23. The facility type is used by the syslog server to dispatch log messages to an appropriate service.

The attribute specifies the facility type tag sent in syslog messages. (See RFC

3164.) This type has no effect on the kind of messages reported by the switch. However, it may be used by the syslog server to process messages, such as sorting or storing messages in the corresponding database. (Range: 16-23, Default: 23)

• Logging Trap – Limits log messages that are sent to the remote syslog server for all levels up to the specified level. For example, if level 3 is specified, all messages from level 0 to level 3 will be sent to the remote server. (Range: 0-7, Default: 7)

• Host IP List – Displays the list of remote server IP addresses that will receive syslog messages. The maximum number of host IP addresses allowed is five.

9-2

Remote Log Configuration

• Host IP Address – Specifies a new server IP address to add to the Host IP List.

Web – Click System, Logs, Remote Logs. To add an IP address to the Host IP List,

type the new IP address in the Host IP Address box, and then click Add. To delete an IP address, click the entry in the Host IP List, and then click Remove.

Figure 9-2 Remote Logs

CLI – Enter the syslog server host IP address, choose the facility type and set the logging trap.

Console(config)#logging host 10.1.0.9 37-3 Console(config)#logging facility 23 37-3 Console(config)#logging trap 4 37-4 Console(config)#logging trap Console(config)#exit Console#show logging trap 37-5 Syslog logging: Enabled REMOTELOG status: Disabled REMOTELOG facility type: local use 7 REMOTELOG level type: Warning conditions REMOTELOG server ip address: 10.1.0.9 REMOTELOG server ip address: 0.0.0.0 REMOTELOG server ip address: 0.0.0.0 REMOTELOG server ip address: 0.0.0.0 REMOTELOG server ip address: 0.0.0.0 Console#

9-3

Configuring Event Logging

Displaying Log Messages

Use the Logs page to scroll through the logged system and event messages. The switch can store up to 2048 log entries in temporary random access memory (RAM; i.e., memory flushed on power reset) and up to 4096 entries in permanent flash memory.

Web – Click System, Log, Logs.

Figure 9-3 Displaying Logs

CLI – This example shows the event message stored in RAM.

Console#show log ram 37-7 [1] 00:01:30 2001-01-01 "VLAN 1 link-up notification." level: 6, module: 5, function: 1, and event no.: 1 [0] 00:01:30 2001-01-01 "Unit 1, Port 1 link-up notification." level: 6, module: 5, function: 1, and event no.: 1 Console#

Sending Simple Mail Transfer Protocol Alerts

To alert system administrators of problems, the switch can use SMTP (Simple Mail Transfer Protocol) to send email messages when triggered by logging events of a specified level. The messages are sent to specified SMTP servers on the network and can be retrieved using POP or IMAP clients.

Command Attributes

• Admin Status – Enables/disables the SMTP function. (Default: Enabled)

• Email Source Address – Sets the email address used for the “From” field in alert messages. You may use a symbolic email address that identifies the switch, or the address of an administrator responsible for the switch.

• Severity – Sets the syslog severity threshold level (see table on page 9-1) used to trigger alert messages. All events at this level or higher will be sent to the configured email recipients. For example, using Level 7 will report all events from level 7 to level 0. (Default: Level 7)

9-4

Sending Simple Mail Transfer Protocol Alerts

• SMTP Server List – Specifies a list of up to three recipient SMTP servers. The

switch attempts to connect to the other listed servers if the first fails. Use the New SMTP Server text field and the Add/Remove buttons to configure the list.

• Email Destination Address List – Specifies the email recipients of alert

messages. You can specify up to five recipients. Use the New Email Destination Address text field and the Add/Remove buttons to configure the list.

Web – Click System, Log, SMTP. Enable SMTP, specify a source email address, and select the minimum severity level. To add an IP address to the SMTP Server List, type the new IP address in the SMTP Server field and click Add. To delete an IP address, click the entry in the SMTP Server List and click Remove. Specify up to five email addresses to receive the alert messages, and click Apply.

Figure 9-4 Enabling and Configuring SMTP Alerts

9-5

Configuring Event Logging

CLI – Enter the IP address of at least one SMTP server, set the syslog severity level to trigger an email message, and specify the switch (source) and up to five recipient (destination) email addresses. Enable SMTP with the logging sendmail command to complete the configuration. Use the show logging sendmail command to display the current SMTP configuration.

Console(config)#logging sendmail host 192.168.1.4 38-1 Console(config)#logging sendmail level 3 38-2 Console(config)#logging sendmail source-email

big-wheels@matel.com 38-2

Console(config)#logging sendmail destination-email

chris@matel.com 38-3 Console(config)#logging sendmail 38-3 Console(config)#exit Console#show logging sendmail 38-4 SMTP servers

-----------------------------------------------

1. 192.168.1.4

SMTP minimum severity level: 4

SMTP destination email addresses

-----------------------------------------------

1. chris@matel.com

SMTP source email address: big-wheels@matel.com

SMTP status: Enabled Console#

9-6

Chapter 10: Setting the System Clock

Simple Network Time Protocol (SNTP) allows the switch to set its internal clock based on periodic updates from a time server (SNTP or NTP). Maintaining an accurate time on the switch enables the system log to record meaningful dates and times for event entries. You can also manually set the clock using the CLI. (See “calendar set” on page 39-5.) If the clock is not set, the switch will only record the time from the factory default set at the last bootup.

When the SNTP client is enabled, the switch periodically sends a request for a time update to a configured time server. You can configure up to three time server IP addresses. The switch will attempt to poll each server in the configured sequence.

Configuring SNTP

You can configure the switch to send time synchronization requests to time servers.

Command Attributes

• SNTP Client – Configures the switch to operate as an SNTP client. This requires at least one time server to be specified in the SNTP Server field. (Default: Disabled)

• SNTP Poll Interval – Sets the interval between sending requests for a time update from a time server. (Range: 16-16384 seconds; Default: 16 seconds)

• SNTP Server – Sets the IP address for up to three time servers. The switch attempts to update the time from the first server, if this fails it attempts an update from the next server in the sequence.

Web – Select SNTP, Configuration. Modify any of the required parameters, and click Apply.

Figure 10-1 SNTP Configuration

10-1

Setting the System Clock

CLI – This example configures the switch to operate as an SNTP client and then displays the current time and settings.

Console(config)#sntp client 39-1 Console(config)#sntp poll 16 39-3 Console(config)#sntp server 10.1.0.19 137.82.140.80 128.250.36.2 39-2 Console(config)#exit Console#show sntp 39-3 Current time: Jan 6 14:56:05 2004 Poll interval: 60 Current mode: unicast SNTP status : Enabled SNTP server 10.1.0.19 137.82.140.80 128.250.36.2 Current server: 128.250.36.2 Console#

Setting the Time Zone

SNTP uses Coordinated Universal Time (or UTC, formerly Greenwich Mean Time, or GMT) based on the time at the Earth’s prime meridian, zero degrees longitude. To display a time corresponding to your local time, you must indicate the number of hours and minutes your time zone is east (before) or west (after) of UTC.

Command Attributes

• Current Time – Displays the current time.

• Name – Assigns a name to the time zone. (Range: 1-29 characters)

• Hours (0-13) – The number of hours before/after UTC.

• Minutes (0-59) – The number of minutes before/after UTC.

• Direction – Configures the time zone to be before (east) or after (west) UTC.

Web – Select SNTP, Clock Time Zone. Set the offset for your time zone relative to the UTC, and click Apply.

Figure 10-2 Clock Time Zone

CLI - This example shows how to set the time zone for the system clock.

Console(config)#clock timezone Dhaka hours 6 minute 0 after-UTC 39-4 Console#

10-2

Accton Technology ES4548D, ES4524D, Direk Tronik 24-48-Port User Manual

Specifications and Main Features

Frequently Asked Questions

User Manual

Section I: Getting Started

Chapter 1: Introduction

Key Features

Description of Software Features

System Defaults

Chapter 2: Initial Configuration

Connecting to the Switch

Configuration Options

Required Connections

Remote Connections

Basic Configuration

Console Connection

Setting Passwords

Setting an IP Address

Manual Configuration

Dynamic Configuration

Enabling SNMP Management Access

Community Strings (for SNMP version 1 and 2c clients)

Trap Receivers

Configuring Access for SNMP Version 3 Clients

Managing System Files

Saving Configuration Settings

Section II: Switch Management

Chapter 3: Configuring the Switch

Using the Web Interface

Navigating the Web Browser Interface

Home Page

Configuration Options

Panel Display

Main Menu

Chapter 4: Basic System Settings

Displaying System Information

Displaying Switch Hardware/Software Versions

Displaying Bridge Extension Capabilities

Configuring Support for Jumbo Frames

Renumbering the Stack

Resetting the System

Chapter 5: Setting an IP Address

Setting the Switch’s IP Address (IP Version 4)

Manual Configuration

Using DHCP/BOOTP

Setting the Switch’s IP Address (IP Version 6)

Configuring an IPv6 Address

Configuring an IPv6 General Network Prefix

Configuring the Neighbor Detection Protocol and Static Entries

Chapter 6: Managing System Files

Managing Firmware

Downloading System Software from a Server

Saving or Restoring Configuration Settings

Downloading Configuration Settings from a Server

Chapter 7: Console Port Settings

Chapter 8: Telnet Settings

Chapter 9: Configuring Event Logging

System Log Configuration

Remote Log Configuration

Displaying Log Messages

Sending Simple Mail Transfer Protocol Alerts

Chapter 10: Setting the System Clock

Configuring SNTP

Setting the Time Zone