Chapter 19: Security: Secure Sensitive Data Management286
Introduction 286
SSD Management287
SSD Rules287
Elements of an SSD Rule288
SSD Rules and User Authentication 291
Default SSD Rules291
SSD Default Read Mode Session Override 292
SSD Properties292
Passphrase293
Default and User-defined Passphrases 293
Local Passphrase 293
Configuration File Passphrase Control294
Configuration File Integrity Control 294
Read Mode295
Configuration Files295
File SSD Indicator295
SSD Control Block296
Startup Configuration File 296
Cisco Small Business 200 Series Smart Switch Administration Guide 10
Contents
Running Configuration File 297
Backup and Mirror Configuration File298
Sensitive Data Zero-Touch Auto Configuration 299
SSD Management Channels300
Menu CLI and Password Recovery 301
Configuring SSD301
SSD Properties301
SSD Rules302
Chapter 20: Quality of Service 304
QoS Features and Components305
QoS Operation305
QoS Workflow306
Configuring QoS - General306
Setting QoS Properties306
Interface QoS Settings308
Configuring QoS Queues 308
Mapping CoS/802.1p to a Queue310
Mapping DSCP to Queue312
Configuring Bandwidth315
Configuring Egress Shaping per Queue316
Managing QoS Statistics317
Viewing Queues Statistics317
Chapter 21: SNMP320
SNMP Versions and Workflow320
SNMPv1 and v2321
SNMPv3321
SNMP Workflow321
Supported MIBs323
Model OIDs323
SNMP Engine ID324
Cisco Small Business 200 Series Smart Switch Administration Guide 11
Contents
Configuring SNMP Views325
Creating SNMP Groups 327
Managing SNMP Users329
Defining SNMP Communities331
Defining Trap Settings333
Notification Recipients333
Defining SNMPv1,2 Notification Recipients334
Defining SNMPv3 Notification Recipients335
SNMP Notification Filters337
Cisco Small Business 200 Series Smart Switch Administration Guide 12
Contents
Cisco Small Business 200 Series Smart Switch Administration Guide 13
Getting Started
This section provides an introduction to the web-based configuration utility, and
covers the following topics:
•Starting the Web-based Configuration Utility
•Quick Start Device Configuration
•Interface Naming Conventions
1
•Window Navigation
Starting the Web-based Configuration Utility
This section describes how to navigate the web-based switch configuration utility.
If you are using a pop-up blocker, make sure it is disabled.
Browser Restrictions
•If you are using older versions of Internet Explorer, you cannot directly use
an IPv6 address to access the device. You can, however, use the DNS
(Domain Name System) server to create a domain name that contains the
IPv6 address, and then use that domain name in the address bar in place of
the IPv6 address.
•If you have multiple IPv6 interfaces on your management station, use the
IPv6 global address instead of the IPv6 link local address to access the
device from your browser.
Cisco Small Business 200 Series Smart Switch Administration Guide 1
Getting Started
Starting the Web-based Configuration Utility
Launching the Configuration Utility
To open the web-based configuration utility:
STEP 1 Open a Web browser.
STEP 2 Enter the IP address of the device you are configuring in the address bar on the
browser, and then press Enter.
NOTE When the device is using the factory default IP address of 192.168.1.254, its power
LED flashes continuously. When the device is using a DHCP assigned IP address or
an administrator-configured static IP address, the power LED is on solid.
Logging In
1
The default username is cisco and the default password is cisco. The first time
that you log in with the default username and password, you are required to enter
a new password.
NOTE If you have not previously selected a language for the GUI, the language of the Login
page is determined by the language(s) requested by your browser and the
languages configured on your device. If your browser requests Chinese, for
example, and Chinese has been loaded into your device, the Login page is
automatically displayed in Chinese. If Chinese has not been loaded into your
device, the Login page appears in English.
The languages loaded into the device have a language and country code (en-US,
en-GB and so on). For the Login page to be automatically displayed in a particular
language, based on the browser request, both the language and country code of
the browser request must match those of the language loaded on the device. If the
browser request contains only the language code without a country code (for
example: fr). The first embedded language with a matching language code is
taken (without matching the country code, for example: fr_CA).
To log in to the device configuration utility:
STEP 1 Enter the username/password. The password can contain up to 64 ASCII
characters. Password-complexity rules are described in the Setting Password
Complexity Rules section of the Configuring Security chapter.
STEP 2 If you are not using English, select the desired language from the Language drop-
down menu. To add a new language to the device or update a current one, refer to
the Upgrade/Backup Firmware/Language section.
Cisco Small Business 200 Series Smart Switch Administration Guide 2
1
Getting Started
Starting the Web-based Configuration Utility
STEP 3 If this is the first time that you logged on with the default user ID (cisco) and the
default password (cisco) or your password has expired, the Change Password
Page appears. See Password Expiration for additional information.
STEP 4 Choose whether to select Disable Password Complexity Enforcement or not.
For more information on password complexity, see the Setting Password
Complexity Rules section.
STEP 5 Enter the new password and click Apply.
When the login attempt is successful, the Getting Started page appears.
If you entered an incorrect username or password, an error message appears and
the Login page remains displayed on the window. If you are having problems
logging in, please see the Launching the Configuration Utility section in the
Administration Guide for additional information.
Select Don’t show this page on startup to prevent the Getting Started page from
being displayed each time that you log on to the system. If you select this option,
the System Summary page is opened instead of the Getting Started page.
HTTP/HTTPS
You can either open an HTTP session (not secured) by clicking Log In, or you can
open an HTTPS (secured) session, by clicking Secure Browsing (HTTPS). You are
asked to approve the logon with a default RSA key, and an HTTPS session is
opened.
NOTE There is no need to input the username/password prior to clicking the Secure
Browsing (HTTPS) button.
For information on how to configure HTTPS, see SSL Server.
Password Expiration
The New Password page appears:
•The first time you access the device with the default username cisco and
password cisco. This page forces you to replace the factory default
password.
•When the password expires, this page forces you to select a new
password.
3Cisco Small Business 200 Series Smart Switch Administration Guide
Getting Started
!
Starting the Web-based Configuration Utility
Logging Out
By default, the application logs out after ten minutes of inactivity. You can change
this default value as described in the Defining Idle Session Timeout section.
CAUTION Unless the Running Configuration is copied to the Startup Configuration, rebooting
the device will remove all changes made since the last time the file was saved.
Save the Running Configuration to the Startup Configuration before logging off to
preserve any changes you made during this session.
A flashing red X icon to the left of the Save application link indicates that Running
Configuration changes have not yet been saved to the Startup Configuration file.
The flashing can be disabled by clicking on the Disable Save Icon Blinking button
on the Copy/Save Configuration page
1
When the device auto-discovers a device, such as an IP phone (see What is a
Smartport), and it configures the port appropriately for the device. These
configuration commands are written to the Running Configuration file. This causes
the Save icon to begin blinking when the you log on even though you did not make
any configuration changes.
When you click Save, the Copy/Save Configuration page appears. Save the
Running Configuration file by copying it to the Startup Configuration file. After this
save, the red X icon and the Save application link are no longer displayed.
To logout, click Logout in the top right corner of any page. The system logs out of
the device.
When a timeout occurs or you intentionally log out of the system, a message
appears and the Login page appears, with a message indicating the logged-out
state. After you log in, the application returns to the initial page.
The initial page displayed depends on the “Do not show this page on startup”
option in the Getting Started page. If you did not select this option, the initial page
is the Getting Started page. If you did select this option, the initial page is the
System Summary page.
Cisco Small Business 200 Series Smart Switch Administration Guide 4
1
Quick Start Device Configuration
To simplify device configuration through quick navigation, the Getting Started
page provides links to the most commonly used pages.
Configure Port MirroringPort and VLAN Mirroring page
There are two hot links on the Getting Started page that take you to Cisco web
pages for more information. Clicking on the Support link takes you to the device
product support page, and clicking on the Forums link takes you to the Small
Business Support Community page.
Interface Naming Conventions
Within the GUI, interfaces are denoted by concatenating the following elements:
5Cisco Small Business 200 Series Smart Switch Administration Guide
Getting Started
Interface Naming Conventions
1
•Type of interface: The following types of interfaces are found on the various
types of devices:
-Fast Ethernet (10/100 bits)—These are displayed as FE.
-Gigabit Ethernet ports (10/100/1000 bits)—These are displayed as
GE.
-LAG (Port Channel)—These are displayed as LAG.
-VLAN—These are displayed as VLAN.
-Tunnel —These are displayed as Tunnel.
•Interface Number: Port, LAG, tunnel or VLAN ID
Cisco Small Business 200 Series Smart Switch Administration Guide 6
1
Window Navigation
This section describes the features of the web-based switch configuration utility.
Application Header
The Application Header appears on every page. It provides the following
application links:
Application Links
Getting Started
Window Navigation
Application Link
Name
UsernameDisplays the name of the user logged on to the device. The
Description
A flashing red X icon displayed to the left of the Save
application link indicates that Running Configuration
changes have been made that have not yet been saved to
the Startup Configuration file. The flashing of the red X can
be disabled on the Copy/Save Configuration page.
Click Save to display the Copy/Save Configuration page.
Save the Running Configuration file by copying it to the
Startup Configuration file type on the device. After this
save, the red X icon and the Save application link are no
longer displayed. When the device is rebooted, it copies
the Startup Configuration file type to the Running
Configuration and sets the device parameters according
to the data in the Running Configuration.
default username is cisco. (The default password is cisco).
7Cisco Small Business 200 Series Smart Switch Administration Guide
Getting Started
Window Navigation
1
Application Links (Continued)
Application Link
Name
Language MenuThis menu provides the following options:
Description
•Select a language: Select one of the languages that
appear in the menu. This language will be the webbased configuration utility language.
•Download Language: Add a new language to the
device.
•Delete Language: Deletes the second language on
the device. The first language (English) cannot be
deleted.
•Debug: Used for translation purposes. If you select
this option, all web-based configuration utility labels
disappear and in their place are the IDs of the
strings that correspond to the IDs in the language
file.
NOTE To upgrade a language file, use the Upgrade/
Backup Firmware/Language page.
LogoutClick to log out of the web-based switch configuration
utility.
AboutClick to display the device name and device version
number.
HelpClick to display the online help.
The SYSLOG Alert Status icon appears when a SYSLOG
message, above the critical severity level, is logged. Click
the icon to open the RAM Memory page. After you access
this page, the SYSLOG Alert Status icon is no longer
displayed. To display the page when there is not an active
SYSLOG message, Click Status and Statistics > View Log > RAM Memory.
Cisco Small Business 200 Series Smart Switch Administration Guide 8
1
Getting Started
Window Navigation
Management Buttons
The following table describes the commonly-used buttons that appear on various
pages in the system.
Management Buttons
Button NameDescription
Use the pull-down menu to configure the number of
entries per page.
Indicates a mandatory field.
AddClick to display the related Add page and add an entry to a
table. Enter the information and click Apply to save it to the
Running Configuration. Click Close to return to the main
page. Click Save to display the Copy/Save Configuration
page and save the Running Configuration to the Startup
Configuration file type on the device.
ApplyClick to apply changes to the Running Configuration on the
device. If the device is rebooted, the Running
Configuration is lost, unless it is saved to the Startup
Configuration file type or another file type. Click Save to
display the Copy/Save Configuration page and save the
Running Configuration to the Startup Configuration file
type on the device.
CancelClick to reset changes made on the page.
Clear All
Interfaces
Counters
Clear Interface
Counters
Clear LogsClears log files.
Clear TableClears table entries.
CloseReturns to main page. If any changes were not applied to
Click to clear the statistic counters for all interfaces.
Click to clear the statistic counters for the selected
interface.
the Running Configuration, a message appears.
9Cisco Small Business 200 Series Smart Switch Administration Guide
Getting Started
Window Navigation
1
Management Buttons (Continued)
Button NameDescription
Copy SettingsA table typically contains one or more entries containing
configuration settings. Instead of modifying each entry
individually, it is possible to modify one entry and then
copy the selected entry to multiple entries, as described
below:
1. Select the entry to be copied. Click Copy Settings to
display the popup.
2. Enter the destination entry numbers in the to field.
3. Click Apply to save the changes and click Close to
return to the main page.
DeleteAfter selecting an entry in the table, click Delete to
remove.
DetailsClick to display the details associated with the entry
selected.
EditSelect the entry and click Edit. The Edit page appears,
and the entry can be modified.
1. C li ck Apply to save the changes to the Running
Configuration.
2. Click Close to return to the main page.
GoEnter the query filtering criteria and click Go. The results
are displayed on the page.
Te stClick Te s t to perform the related tests.
Cisco Small Business 200 Series Smart Switch Administration Guide 10
1
Getting Started
Window Navigation
11Cisco Small Business 200 Series Smart Switch Administration Guide
Status and Statistics
This section describes how to view device statistics.
It covers the following topics:
•Viewing Ethernet Interfaces
•Viewing Etherlike Statistics
•Viewing 802.1X EAP Statistics
2
•Managing RMON
Viewing Ethernet Interfaces
The Interface page displays traffic statistics per port. The refresh rate of the
information can be selected.
This page is useful for analyzing the amount of traffic that is both sent and
received and its dispersion (Unicast, Multicast, and Broadcast).
To display Ethernet statistics and/or set the refresh rate:
STEP 1 Click Status and Statistics > Interface.
STEP 2 Enter the parameters.
•Interface—Select the type of interface and specific interface for which
Ethernet statistics are to be displayed.
•Refresh Rate—Select the time period that passes before the interface
Ethernet statistics are refreshed. The available options are:
-No Refresh—Statistics are not refreshed.
-15 Sec—Statistics are refreshed every 15 seconds.
-30 Sec—Statistics are refreshed every 30 seconds.
Cisco Small Business 200 Series Smart Switch Administration Guide 12
2
Status and Statistics
Viewing Etherlike Statistics
-60 Sec—Statistics are refreshed every 60 seconds.
The Receive Statistics area displays information about incoming packets.
•Tot al By te s (O c te t s) —Octets received, including bad packets and FCS
•Click Clear Interface Counters to clear counters for the interface displayed.
•Click View All Interfaces Statistics to see all ports on a single page.
Viewing Etherlike Statistics
The Etherlike page displays statistics per port according to the Etherlike MIB
standard definition. The refresh rate of the information can be selected. This page
provides more detailed information regarding errors in the physical layer (Layer 1),
which might disrupt traffic.
To view Etherlike Statistics and/or set the refresh rate:
STEP 1 Click Status and Statistics > Etherlike.
STEP 2 Enter the parameters.
13Cisco Small Business 200 Series Smart Switch Administration Guide
Status and Statistics
Viewing 802.1X EAP Statistics
2
•Interface—Select the type of interface and specific interface for which
Ethernet statistics are to be displayed.
•Refresh Rate—Select the amount of time that passes before the Etherlike
statistics are refreshed.
The fields are displayed for the selected interface.
•Frame Check Sequence (FCS) Errors—Received frames that failed the
CRC (cyclic redundancy checks).
•Single Collision Frames—Frames that were involved in a single collision,
but were successfully transmitted.
•Late Collisions—Collisions that have been detected after the first 512 bits
of data.
•Excessive Collisions—Number of transmissions rejected due to excessive
collisions.
•Oversize Packets—Packets greater than 2000 octets received.
•Internal MAC Receive Errors—Frames rejected because of receiver errors.
•Pause Frames Received—Received flow control pause frames.
•Pause Frames Transmitted—Flow control pause frames transmitted from
the selected interface.
To clear statistics counters:
•Click Clear Interface Counters to clear the selected interfaces counters.
•Click View All Interfaces Statistics to see all ports on a single page.
Viewing 802.1X EAP Statistics
The 802.1x EAP page displays detailed information regarding the EAP (Extensible
Authentication Protocol) frames that were sent or received. To configure the
802.1X feature, see the 802.1X Properties page.
To view the EAP Statistics and/or set the refresh rate:
Cisco Small Business 200 Series Smart Switch Administration Guide 14
2
Status and Statistics
Viewing 802.1X EAP Statistics
STEP 1 Click Status and Statistics > 802.1x EAP.
STEP 2 Select the Interface that is polled for statistics.
STEP 3 Select the time period (Refresh Rate) that passes before the EAP statistics are
refreshed.
The values are displayed for the selected interface.
•EAPOL Frames Received—Valid EAPOL frames received on the port.
•EAPOL Frames Transmitted—Valid EAPOL frames transmitted by the port.
•EAPOL Start Frames Received—EAPOL Start frames received on the port.
•EAPOL Logoff Frames Received—EAPOL Logoff frames received on the
port.
•EAP Response/ID Frames Received—EAP Resp/ID frames received on the
port.
•EAP Response Frames Received—EAP Response frames received by the
port (other than Resp/ID frames).
•EAP Request/ID Frames Transmitted—EAP Req/ID frames transmitted by
the port.
•EAP Request Frames Transmitted—EAP Request frames transmitted by
the port.
•Invalid EAPOL Frames Received—Unrecognized EAPOL frames received
on this port.
•EAP Length Error Frames Received—EAPOL frames with an invalid Packet
Body Length received on this port.
•Last EAPOL Frame Version—Protocol version number attached to the most
recently received EAPOL frame.
•Last EAPOL Frame Source—Source MAC address attached to the most
recently received EAPOL frame.
To clear statistics counters:
•Click Clear Interface Counters to clear the selected interfaces counters.
•Click Clear All Interface Counters to clear the counters of all interfaces.
15Cisco Small Business 200 Series Smart Switch Administration Guide
Status and Statistics
Managing RMON
Managing RMON
RMON (Remote Networking Monitoring) is an SNMP specification that enables an
SNMP agent in the device to proactively monitor traffic statistics over a given
period and send traps to an SNMP manager. The local SNMP agent compares
actual, real-time counters against predefined thresholds and generates alarms,
without the need for polling by a central SNMP management platform. This is an
effective mechanism for proactive management, provided that you have the
correct thresholds set relative to your network’s base line.
RMON decreases the traffic between the manager and the device because the
SNMP manager does not have to poll the device frequently for information, and
enables the manager to get timely status reports, because the device reports
events as they occur.
With this feature, you can perform the following actions:
2
•View the current statistics (since the counter values were cleared). You can
also collect the values of these counters over a period of time, and then
view the table of collected data, where each collected set is a single line of
the History tab.
•Define interesting changes in counter values, such as “reached a certain
number of late collisions” (defines the alarm), and then specify what action
to perform when this event occurs (log, trap, or log and trap).
Viewing RMON Statistics
The Statistics page displays detailed information regarding packet sizes and
information regarding physical layer errors. The information displayed is according
to the RMON standard. An oversized packet is defined as an Ethernet frame with
the following criteria:
•Packet length is greater than MRU byte size.
•Collision event has not been detected.
•Late collision event has not been detected.
•Received (Rx) error event has not been detected.
•Packet has a valid CRC.
Cisco Small Business 200 Series Smart Switch Administration Guide 16
2
Status and Statistics
Managing RMON
To view RMON statistics and/or set the refresh rate:
STEP 1 Click Status and Statistics > RMON > Statistics.
STEP 2 Select the Interface for which Ethernet statistics are to be displayed.
STEP 3 Select the Refresh Rate, the time period that passes before the interface
statistics are refreshed.
The statistics are displayed for the selected interface.
•Bytes Received—Number of octets received, including bad packets and
FCS octets, but excluding framing bits.
•Drop Events—Number of packets dropped.
•PacketsReceived—Number of good packets received, including Multicast
and Broadcast packets.
•Broadcast Packets Received—Number of good Broadcast packets
received. This number does not include Multicast packets.
•Multicast Packets Received—Number of good Multicast packets received.
•CRC & Align Errors—Number of CRC and Align errors that have occurred.
•Undersize Packets—Number of undersized packets (less than 64 octets)
received.
•Oversize Packets—Number of oversized packets (over 2000 octets)
received.
•Fragments—Number of fragments (packets with less than 64 octets,
excluding framing bits, but including FCS octets) received.
•Jabbers—Total number received packets that were longer than 1632
octets. This number excludes frame bits, but includes FCS octets that had
either a bad FCS (Frame Check Sequence) with an integral number of octets
(FCS Error) or a bad FCS with a non-integral octet (Alignment Error) number.
A Jabber packet is defined as an Ethernet frame that satisfies the following
criteria:
-Packet data length is greater than MRU.
-Packet has an invalid CRC.
-Received (Rx) Error Event has not been detected.
17Cisco Small Business 200 Series Smart Switch Administration Guide
Loading...
+ 321 hidden pages
You need points to download manuals.
1 point = 1 manual.
You can buy points or you can get point for every manual you upload.