Hirschmann RS20, RS30, MS30, OCTOPUS, MS20 Basic Configuration

...

Download

User Manual

Basic Configuration Industrial ETHERNET (Gigabit) Switch

RS20/RS30/RS40, MS20/MS30, OCTOPUS, PowerMICE, RSR20/RSR30, MACH 100, MACH 1000, MACH 4000

Basic Configuration

Release 6.0 07/2010

Technical Support

HAC.Support@Belden.com

The naming of copyrighted trademarks in this manual, even when not specially indicated, should not be taken to mean that these names may be considered as free in the sense of the trademark and tradename protection law and hence that they may be freely used by anyone.

Manuals and software are protected by copyright. All rights reserved. The copying, reproduction, translation, conversion into any electronic medium or machine scannable form is not permitted, either in whole or in part. An exception is the preparation of a backup copy of the software for your own use. For devices with embedded software, the end-user license agreement on the enclosed CD applies.

The performance features described here are binding only if they have been expressly agreed when the contract was made. This document was produced by Hirschmann Automation and Control GmbH according to the best of the company's knowledge. Hirschmann reserves the right to change the contents of this document without prior notice. Hirschmann can give no guarantee in respect of the correctness or accuracy of the information in this document.

Hirschmann can accept no responsibility for damages, resulting from the use of the network components or the associated operating software. In addition, we refer to the conditions of use specified in the license contract.

You can get the latest version of this manual on the Internet at the Hirschmann product site (www.hirschmann-ac.de).

Printed in Germany Hirschmann Automation and Control GmbH Stuttgarter Str. 45-51 72654 Neckartenzlingen Germany Tel.: +49 1805 141538

Rel. 6.0 1-01-07/2010 13.7.10

Contents

About this Manual 9

Key 11

Introduction 13

1 Access to the user interfaces 15

1.1 System Monitor 16

1.2 Command Line Interface 18

1.3 Web-based Interface 21

2 Entering the IP Parameters 25

2.1 IP Parameter Basics 27

2.1.1 IP address (version 4) 27

2.1.2 Netmask 28

2.1.3 Classless Inter-Domain Routing 31

2.2 Entering IP parameters via CLI 33

2.3 Entering the IP Parameters via HiDiscovery 36

2.4 Loading the system configuration from the ACA 39

2.5 System configuration via BOOTP 41

2.6 System Configuration via DHCP 46

2.7 System Configuration via DHCP Option 82 49

2.8 Web-based IP Configuration 50

2.9 Faulty Device Replacement 52

3 Loading/saving settings 53

3.1 Loading settings 54

3.1.1 Loading from the local non-volatile memory 55

3.1.2 Loading from the AutoConfiguration Adapter 55

3.1.3 Loading from a file 56

3.1.4 Resetting the configuration to the state on delivery 58

3.2 Saving settings 59

3.2.1 Saving locally (and on the ACA) 59

Basic Configuration

Release 6.0 07/2010

Contents

3.2.2 Saving to a file on URL 60

3.2.3 Saving to a binary file on the PC 61

3.2.4 Saving as a script on the PC 62

4 Loading Software Updates 63

4.1 Loading the Software manually from the ACA 65

4.1.1 Selecting the software to be loaded 66

4.1.2 Starting the software 67

4.1.3 Performing a cold start 67

4.2 Automatic software update by ACA 68

4.3 Loading the software from the tftp server 70

4.4 Loading the Software via File Selection 72

5 Configuring the Ports 73

6 Protection from Unauthorized Access 77

6.1 Protecting the device 78

6.2 Password for SNMP access 79

6.2.1 Description of password for SNMP access 79

6.2.2 Entering the password for SNMP access 80

6.3 Telnet/Web/SSH Access 84

6.3.1 Description of Telnet Access 84

6.3.2 Description of Web Access 84

6.3.3 Description of SSH Access 85

6.3.4 Enabling/disabling Telnet/Web/SSH Access 85

6.4 Restricted Management Access 87

6.5 HiDiscovery Access 89

6.5.1 Description of the HiDiscovery Protocol 89

6.5.2 Enabling/disabling the HiDiscovery Function 89

6.6 Port Authentication IEEE 802.1X 94

6.6.1 Description of Port Authentication according to IEEE 802.1X 94

6.6.2 Authentication Process according to IEEE 802.1X 95

6.6.3 Preparing the Device for the IEEE 802.1X Port Authentication 95

6.6.4 IEEE 802.1X Settings 96

7 Synchronizing the System Time in the Network 97

7.1 Entering the Time 98

Basic Configuration

Release 6.0 07/2010

Contents

7.2 SNTP 100

7.2.1 Description of SNTP 100

7.2.2 Preparing the SNTP Configuration 101

7.2.3 Configuring SNTP 102

7.3 Precision Time Protocol 106

7.3.1 Description of PTP Functions 106

7.3.2 Preparing the PTP Configuration 110

7.3.3 Application Example 112

7.4 Interaction of PTP and SNTP 117

8 Network Load Control 119

8.1 Direct Packet Distribution 120

8.1.1 Store-and-forward 120

8.1.2 Multi-Address Capability 120

8.1.3 Aging of Learned Addresses 121

8.1.4 Entering Static Addresses 122

8.1.5 Disabling the Direct Packet Distribution 123

8.2 Multicast Application 125

8.2.1 Description of the Multicast Application 125

8.2.2 Example of a Multicast Application 126

8.2.3 Description of IGMP Snooping 127

8.2.4 Setting IGMP Snooping 128

8.2.5 Description of GMRP 133

8.2.6 Setting GMRP 135

8.3 Rate Limiter 137

8.3.1 Description of the Rate Limiter 137

8.3.2 Rate Limiter Settings (PowerMICE and MACH 4000) 138

8.3.3 Rate Limiter settings for RS20/RS30/40, MS20/MS30, RSR20/RSR30, MACH 100, MACH 1000 and OCTOPUS 139

8.4 QoS/Priority 141

8.4.1 Description of Prioritization 141

8.4.2 VLAN tagging 142

8.4.3 IP ToS / DiffServ 144

8.4.4 Management prioritization 148

8.4.5 Handling of Received Priority Information 148

8.4.6 Handling of Traffic Classes 149

8.4.7 Setting prioritization 149

8.5 Flow Control 154

8.5.1 Description of Flow Control 154

8.5.2 Setting the Flow Control 156

8.6 VLANs 157

Basic Configuration

Release 6.0 07/2010

Contents

8.6.1 VLAN Description 157

8.6.2 Examples of VLANs 158

9 Operation Diagnosis 175

9.1 Sending Traps 176

9.1.1 List of SNMP Traps 177

9.1.2 SNMP Traps during Boot 178

9.1.3 Configuring Traps 179

9.2 Monitoring the Device Status 181

9.2.1 Configuring the Device Status 182

9.2.2 Displaying the Device Status 183

9.3 Out-of-band Signaling 184

9.3.1 Controlling the Signal Contact 185

9.3.2 Monitoring the Device Status via the Signal Contact 185

9.3.3 Monitoring the Device Functions via the Signal Contact 186

9.3.4 Monitoring the Fan 187

9.4 Port Status Indication 190

9.5 Event Counter at Port Level 191

9.5.1 Detecting Non-matching Duplex Modes 192

9.6 Displaying the SFP Status 196

9.7 TP Cable Diagnosis 197

9.8 Topology Discovery 198

9.8.1 Description of Topology Discovery 198

9.8.2 Displaying the Topology Discovery Results 200

9.9 Detecting IP Address Conflicts 203

9.9.1 Description of IP Address Conflicts 203

9.9.2 Configuring ACD 204

9.9.3 Displaying ACD 205

9.10 Detecting Loops 206

9.11 Reports 207

9.12 Monitoring Data Traffic at Ports (Port Mirroring) 209

9.13 Syslog 212

Basic Configuration

Release 6.0 07/2010

Contents

9.14 Event Log 215

A Setting up the Configuration Environment 217

B General Information 239

C Index 247

D Further Support 251

Basic Configuration

Release 6.0 07/2010

Contents

Basic Configuration

Release 6.0 07/2010

About this Manual

The “Basic Configuration” user manual contains the information you need to start operating the device. It takes you step by step from the first startup operation through to the basic settings for operation in your environment.

The following thematic sequence has proven itself in practice:

X Set up device access for operation by entering the IP parameters

X Check the status of the software and update it if necessary

X If a configuration already exists, load/store it

X Configure the ports

X Set up protection from unauthorized access

X Optimize the data transmission with network load control

X Synchronize system time in the network

X Function diagnosis

X Store the newly created configuration to nonvolatile memory

The “Installation” user manual contains a device description, safety instructions, a description of the display, and the other information that you need to install the device.

The “Redundancy Configuration” user manual contains the information you need to select a suitable redundancy procedure and configure that procedure.

The “Industry Protocols” user manual describes how the device is connected by means of a communication protocol commonly used in the industry, such as EtherNet/IP and PROFINET IO.

The "Web-based Interface" reference manual contains detailed information on using the Web interface to operate the individual functions of the device.

Basic Configuration

Release 6.0 07/2010

About this Manual

The "Command Line Interface" reference manual contains detailed information on using the Command Line Interface to operate the individual functions of the device.

The Network Management Software HiVision/Industrial HiVision provides you with additional options for smooth configuration and monitoring:

X Configuration of multiple devices simultaneously. X Graphical interface with network layouts. X Auto-topology discovery. X Event log. X Event handling. X Client / Server structure. X Browser interface X ActiveX control for SCADA integration X SNMP/OPC gateway

Basic Configuration

Release 6.0 07/2010

Key

The designations used in this manual have the following meanings:

X List

 Work step



Link Indicates a cross-reference with a stored link

Note: A note emphasizes an important fact or draws your

Courier ASCII representation in user interface

Execution in the Web-based Interface user interface Execution in the Command Line Interface user interface

Subheading

attention to a dependency.

Symbols used:

WLAN access point

Router with firewall

Switch with firewall

Router

Switch

Basic Configuration

Release 6.0 07/2010

Key

Bridge

Hub

A random computer

Configuration Computer

Server

PLC Programmable logic controller

I/O Robot

Basic Configuration

Release 6.0 07/2010

Introduction

The device has been developed for practical application in a harsh industrial environment. Accordingly, the installation process has been kept simple. Thanks to the selected default settings, you only have to enter a few settings before starting to operate the device.

Note: The changes you make in the dialogs are copied into the volatile memory of the device when you click on "Set". To save the changes into the permanent memory of the device select the non-volatile memory location in the Basic Settings:Load/Save dialog and click "Save".

Basic Configuration

Release 6.0 07/2010

Introduction

Basic Configuration

Release 6.0 07/2010

Access to the user interfaces

1 Access to the user interfaces

The device has 3 user interfaces, which you can access via different interfaces:

X System monitor via the V.24 interface (out-of-band)

X Command Line Interface (CLI) via the V.24 connection (out-of-band) as

well as Telnet or SSH (in-band)

X Web-based interface via Ethernet (in-band).

Basic Configuration

Release 6.0 07/2010

Access to the user interfaces

1.1 System Monitor

The system monitor enables you to

X select the software to be loaded

X perform a software update

X start the selected software

X shut down the system monitor

X delete the configuration saved and

X display the boot code information.

1.1 System Monitor

 Opening the system monitor

 Use the terminal cable (see accessories) to connect

– the V.24 socket (RJ11) to – a terminal or a COM port of a PC with terminal emulation based on

VT100

(for the physical connection, see the "Installation" user manual).

Speed 9,600 Baud Data 8 bit Parity none Stopbit 1 bit Handshake off

Table 1: Data transfer parameters

 Start the terminal program on the PC and set up a connection with the

device.

When you boot the device, the message "Press <1> to enter System Monitor 1" appears on the terminal.

Basic Configuration

Release 6.0 07/2010

Access to the user interfaces

< Device Name (Boot) Release: 1.00 Build: 2005-09-17 15:36 >

Press <1> to enter System Monitor 1 ... 1

1.1 System Monitor

Figure 1: Screen display during the boot process

 Press the <1> key within one second to start system monitor 1.

System Monitor

(Selected OS: L3P-01.0.00-K16 (2005-10-31 19:32))

1 Select Boot Operating System 2 Update Operating System 3 Start Selected Operating System 4 End (reset and reboot) 5 Erase main configuration file

sysMon1>

Figure 2: System monitor 1 screen display

 Select a menu item by entering the number.  To leave a submenu and return to the main menu of system monitor 1,

press the <ESC> key.

Basic Configuration

Release 6.0 07/2010

Access to the user interfaces

1.2 Command Line Interface

The Command Line Interface enables you to use the functions of the device via a local or remote connection. The Command Line Interface provides IT specialists with a familiar environment for configuring IT devices. The script compatibility of the Command Line Interface enables you, among other things, to feed multiple devices with the same configuration data, to create and apply partial configurations or to compare 2 configuration by comparing the script files.

You will find a detailed description of the Command Line Interface in the "Command Line Interface" reference manual.

You can access the Command Line Interface via

X the V.24 port (out-of-band) X Telnet (in-band) X SSH (in-band)

Note: To facilitate making entries, CLI gives you the option of abbreviating keywords. Type in the beginning of a keyword. When you press the tab key, CLI completes the keyword.

 Opening the Command Line Interface

 Connect the device to a terminal or to the COM port of a PC using

terminal emulation based on VT100 and press any key (see on

page 16 “Opening the system monitor“) or

call up the Command Line Interface via Telnet. A window for entering the user name appears on the screen. Up to five users can access the Command Line Interface.

Basic Configuration

Release 6.0 07/2010

Access to the user interfaces

PowerMICE Release L3P-05.1.00

(Build date 2009-10-11 12:13)

System Name: PowerMICE Mgmt-IP : 10.0.1.105

1.Router-IP: 0.0.0.0

Base-MAC : 00:80:63:51:74:00 System Time: 2009-10-11 13:14:15

User:

1.2 Command Line Interface

Figure 3: Logging in to the Command Line Interface program

 Enter a user name. The default setting for the user name is admin .

Press the Enter key.

 Enter the password. The default setting for the password is private .

Press the Enter key. You can change the user name and the password later in the Command Line Interface. Please note that these entries are case-sensitive.

The start screen appears.

Basic Configuration

Release 6.0 07/2010

Access to the user interfaces

NOTE: Enter '?' for Command Help. Command help displays all options that are valid for the 'normal' and 'no' command forms. For the syntax of a particular command form, please consult the documentation.

(Hirschmann Product) >

1.2 Command Line Interface

Figure 4: CLI screen after login

Basic Configuration

Release 6.0 07/2010

Access to the user interfaces

1.3 Web-based Interface

The user-friendly Web-based interface gives you the option of operating the device from any location in the network via a standard browser such as Mozilla Firefox or Microsoft Internet Explorer. As a universal access tool, the Web browser uses an applet which communicates with the device via the Simple Network Management Protocol (SNMP). The Web-based interface allows you to graphically configure the device.

 Opening the Web-based Interface

To open the Web-based interface, you need a Web browser (a program that can read hypertext), for example Mozilla Firefox version 1 or later, or Microsoft Internet Explorer version 6 or later.

Note: The Web-based interface uses Java software 6 (“Java™ Runtime Environment Version 1.6.x”).

Install the software from the enclosed CD-ROM. To do this, you go to “Additional Software”, select Java Runtime Environment and click on “Installation”.

Figure 5: Installing Java

Basic Configuration

Release 6.0 07/2010

Access to the user interfaces

1.3 Web-based Interface

 Start your Web browser.  Check that you have activated JavaScript and Java in your browser

settings.

 Establish the connection by entering the IP address of the device

which you want to administer via the Web-based management in the address field of the Web browser. Enter the address in the following form:

http://xxx.xxx.xxx.xxx

The login window appears on the screen.

Figure 6: Login window

 Select the desired language.  In the drop-down menu, you select

– user, to have read access, or – admin, to have read and write access to the device.

 The password "public", with which you have read access, appears in

the password field. If you wish to have write access to the device, then highlight the contents of the password field and overwrite it with the password "private" (default setting).

 Click on OK.

Basic Configuration

Release 6.0 07/2010

Access to the user interfaces

1.3 Web-based Interface

The website of the device appears on the screen.

Note: The changes you make in the dialogs are copied to the device when you click "Set". Click "Reload" to update the display.

Note: You can block your access to the device by entering an incorrect configuration. Activating the function "Cancel configuration change" in the "Load/Save" dialog enables you to return automatically to the last configuration after a set time period has elapsed. This gives you back your access to the device.

Basic Configuration

Release 6.0 07/2010

Access to the user interfaces

1.3 Web-based Interface

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

2 Entering the IP Parameters

The IP parameters must be entered when the device is installed for the first time.

The device provides 7 options for entering the IP parameters during the first installation:

X Entry using the Command Line Interface (CLI).

You choose this “out of band” method if

X you preconfigure your device outside its operating environment X you do not have network access (“in-band”) to the device

(see page 33 “Entering IP parameters via CLI“).

X Entry using the HiDiscovery protocol.

You choose this “in-band” method if the device is already installed in the network or if you have another Ethernet connection between your PC and the device

(see page 36 “Entering the IP Parameters via HiDiscovery“).

X Configuration using the AutoConfiguration Adapter (ACA).

You choose this method if you are replacing a device with a device of the same type and have already saved the configuration on an ACA(see

page 39 “Loading the system configuration from the ACA“).

X Using BOOTP.

You choose this “in-band” method if you want to configure the installed device using BOOTP. You need a BOOTP server for this. The BOOTP server assigns the configuration data to the device using its MAC address

(see page 41 “System configuration via BOOTP“). Because the device is

delivered with “DHCP mode” as the entry for the configuration data reference, you have to reset this to the BOOTP mode for this method.

X Configuration via DHCP.

You choose this “in-band” method if you want to configure the installed device using DHCP. You need a DHCP server for this. The DHCP server assigns the configuration data to the device using its MAC address or its system name (see page 46 “System Configuration via DHCP“).

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

X Using DHCP Option 82.

You choose this “in-band” method if you want to configure the installed device using DHCP Option 82. You need a DHCP server with Option 82 for this. The DHCP server assigns the configuration data to the device using its physical connection (see page 49 “System Configuration via

DHCP Option 82“).

X Configuration via the Web-based interface.

If the device already has an IP address and can be reached via the network, then the Web-based interface provides you with another option for configuring the IP parameters.

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

2.1 IP Parameter Basics

2.1.1 IP address (version 4)

The IP addresses consist of 4 bytes. These 4 bytes are written in decimal notation, separated by a decimal point.

Since 1992, five classes of IP address have been defined in the RFC 1340.

Class Network

address

A 1 byte 3 bytes 1.0.0.0 to 126.255.255.255 B 2 bytes 2 bytes 128.0.0.0 to 191.255.255.255 C 3 bytes 1 byte 192.0.0.0 to 223.255.255.255 D 224.0.0.0 to 239.255.255.255 E 240.0.0.0 to 255.255.255.255

Table 2: IP address classes

Host address Address range

The network address is the fixed part of the IP address. The worldwide leading regulatory board for assigning network addresses is the IANA (Internet Assigned Numbers Authority). If you require an IP address block, contact your Internet service provider. Internet service providers should contact their local higher-level organization:

X APNIC (Asia Pacific Network Information Center) - Asia/Pacific Region

X ARIN (American Registry for Internet Numbers) - Americas and Sub-

Sahara Africa

X LACNIC (Regional Latin-American and Caribbean IP Address Registry) –

Latin America and some Caribbean Islands

X RIPE NCC (Réseaux IP Européens) - Europe and Surrounding Regions

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

Net ID - 7 bits Host ID - 24 bits0

III

III0

Net ID - 14 bits

Net ID - 21 bits

Multicast Group ID - 28 bits

reserved for future use - 28 b its

Class A

Class B

Host ID - 16 bits

Host ID - 8 bit s

Class C

Class D

Class E

2.1 IP Parameter Basics

Figure 7: Bit representation of the IP address

An IP address belongs to class A if its first bit is a zero, i.e. the first decimal number is less than 128. The IP address belongs to class B if the first bit is a one and the second bit is a zero, i.e. the first decimal number is between 128 and 191. The IP address belongs to class C if the first two bits are a one, i.e. the first decimal number is higher than 191.

Assigning the host address (host id) is the responsibility of the network operator. He alone is responsible for the uniqueness of the IP addresses he assigns.

2.1.2 Netmask

Routers and gateways subdivide large networks into subnetworks. The netmask assigns the IP addresses of the individual devices to a particular subnetwork.

The division into subnetworks with the aid of the netmask is performed in much the same way as the division of the network addresses (net id) into classes A to C.

The bits of the host address (host id) that represent the mask are set to one. The remaining bits of the host address in the netmask are set to zero (see the following examples).

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

255.255.192.0

Decimal notation

11111111.11111111.11000000.00000000

Binary notation

Subnetwork mask bits Class B

129.218.65.17

Decimal notation

10000001.11011010.01000001.00010001

binary notation

128 < 129 ≤ 191 ➝ Class B

Subnetwork 1 Network address

129.218.129.17

Decimal notation

10000001.11011010.10000001.00010001

binary notation

128 < 129 ≤ 191 ➝ Class B

Subnetwork 2 Network address

Example of a netmask:

2.1 IP Parameter Basics

Example of IP addresses with subnetwork assignment when the above subnet mask is applied:

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

Romeo

LAN 1

Lorenzo

LAN 2

Juliet

2.1 IP Parameter Basics

 Example of how the network mask is used

In a large network it is possible that gateways and routers separate the management agent from its management station. How does addressing work in such a case?

Figure 8: Management agent that is separated from its management station by a

router

The management station "Romeo" wants to send data to the management agent "Juliet". Romeo knows Juliet's IP address and also knows that the router "Lorenzo" knows the way to Juliet.

Romeo therefore puts his message in an envelope and writes Juliet's IP address as the destination address. For the source address he writes his own IP address on the envelope.

Romeo then places this envelope in a second one with Lorenzo's MAC address as the destination and his own MAC address as the source. This process is comparable to going from layer 3 to layer 2 of the ISO/OSI base reference model.

Finally, Romeo puts the entire data packet into the mailbox. This is comparable to going from layer 2 to layer 1, i.e. to sending the data packet over the Ethernet.

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

2.1 IP Parameter Basics

Lorenzo receives the letter and removes the outer envelope. From the inner envelope he recognizes that the letter is meant for Juliet. He places the inner envelope in a new outer envelope and searches his address list (the ARP table) for Juliet's MAC address. He writes her MAC address on the outer envelope as the destination address and his own MAC address as the source address. He then places the entire data packet in the mail box.

Juliet receives the letter and removes the outer envelope. She finds the inner envelope with Romeo's IP address. Opening the inner envelope and reading its contents corresponds to transferring the message to the higher protocol layers of the SO/OSI layer model.

Juliet would now like to send a reply to Romeo. She places her reply in an envelope with Romeo's IP address as destination and her own IP address as source. But where is she to send the answer? For she did not receive Romeo's MAC address. It was lost when Lorenzo replaced the outer envelope.

In the MIB, Juliet finds Lorenzo listed under the variable hmNetGatewayIPAddr as a means of communicating with Romeo. She therefore puts the envelope with the IP addresses in a further envelope with Lorenzo's MAC destination address.

The letter now travels back to Romeo via Lorenzo, the same way the first letter traveled from Romeo to Juliet.

2.1.3 Classless Inter-Domain Routing

Class C with a maximum of 254 addresses was too small, and class B with a maximum of 65534 addresses was too large for most users, as they would never require so many addresses. This resulted in ineffective usage of the class B addresses available. Class D contains reserved multicast addresses. Class E is reserved for experimental purposes. A gateway not participating in these experiments ignores datagrams with these destination addresses.

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

IP address, decimal

149.218.112.1

149.218.112.127

CIDR notation: 149.218.112.0/25

Mask bits

Network mask, decimal

255.255.255.128

IP address, hexadecimal

10010101 11011010 01110000 00000001

10010101 11011010 01110000 01111111

25 mask bits

2.1 IP Parameter Basics

Since 1993, RFC 1519 has been using Classless Inter Domain Routing (CIDR) to provide a solution to get around these problems. CIDR overcomes these class boundaries and supports classless address ranges.

With CIDR, you enter the number of bits that designate the IP address range. You represent the IP address range in binary form and count the mask bits that designate the netmask. The netmask indicates the number of bits that are identical to the network part for all IP addresses in a given address range. Example:

The combination of a number of class C address ranges is known as “supernetting”. This enables you to subdivide class B address ranges to a very fine degree.

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

Entering IP addresses

Connect the PC with terminal

program started to the RJ11 socket

Command Line Interface

starts after key press

Privileged EXEC Mode

Switch off DHCP,

enter and save IP parameters

End of entering IP addresses

2.2 Entering IP parameters via CLI

2.2 Entering IP parameters via

CLI

If you do not configure the system via BOOTP/DHCP, DHCP Option 82, the HiDiscovery protocol or the AutoConfiguration AdapterACA, then you perform the configuration via the V.24 interface using the CLI.

Figure 9: Flow chart for entering IP addresses

Note: If there is no terminal or PC with terminal emulation available in the vicinity of the installation location, you can configure the device at your own workstation, then take it to its final installation location.

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

2.2 Entering IP parameters via CLI

 Set up a connection to the device (see on page 18 “Opening the

Command Line Interface“).

The start screen appears.

(Hirschmann PowerMICE) >

 Deactivate DHCP.

 Enter the IP parameters.

X Local IP address

On delivery, the device has the local IP address 0.0.0.0.

X Netmask

If your network has been divided up into subnetworks, and if these are identified with a netmask, then the netmask is to be entered here. The default setting of the netmask is 0.0.0.0.

X IP address of the gateway

This entry is only required if the device and the management station or tftp server are located in different subnetworks (see page 30

“Example of how the network mask is used“).

Enter the IP address of the gateway between the subnetwork with the device and the path to the management station. The default setting of the IP address is 0.0.0.0.

 Save the configuration entered using

copy system:running-config nvram:startup-config.

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

enable Switch to the Privileged EXEC mode. network protocol none Deactivate DHCP.

network parms 10.0.1.23

255.255.255.0

copy system:running-config nvram:startup-config

2.2 Entering IP parameters via CLI

Assign the device the IP address 10.0.1.23 and the netmask 255.255.255.0. You have the option of also assigning a gateway address.

Save the current configuration to the non-volatile memory.

After entering the IP parameters, you can easily configure the device via the Web-based interface (see the “Web-based Interface” reference manual).

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

2.3 Entering the IP Parameters via HiDiscovery

The HiDiscovery protocol enables you to assign IP parameters to the device via the Ethernet. You can easily configure other parameters via the Web-based interface (see the "Web-based Interface" reference manual).

Install the HiDiscovery software on your PC. The software is on the CD supplied with the device.

 To install it, you start the installation program on the CD.

Note: The installation of HiDiscovery includes the installation of the software package WinPcap Version 3.1. If an earlier version of WinPcap is on the PC, the follow the suggestion in the set-up to uninstall it. A newer version remains intact during the installationHiDiscovery. However, this cannot be guaranteed for all future versions of WinPcap. In the event that the installation of HiDiscovery has overwritten a newer version of WinPcap, you uninstall WinPcap 3.1 and then re-install the new version.

 Start the HiDiscovery program.

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

2.3 Entering the IP Parameters via HiDiscovery

Figure 10: HiDiscovery

When HiDiscovery is started, it automatically searches the network for those devices which support the HiDiscovery protocol. HiDiscovery uses the first PC network card found. If your computer has several network cards, you can select these in HiDiscovery on the toolbar.

HiDiscovery displays a line for every device which reacts to the HiDiscovery protocol.

HiDiscovery enables you to identify the devices displayed.

 Select a device line.  Click on the signal symbol in the tool bar to set the LEDs for the selected

device flashing. To switch off the flashing, click on the symbol again.

 By double-clicking a line, you open a window in which you can enter the

device name and the IP parameters.

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

Figure 11: HiDiscovery - assigning IP parameters

2.3 Entering the IP Parameters via Hi-

Note: When the IP address is entered, the device copies the local configuration settings (see on page 53 “Loading/saving settings“).

Discovery

Note: For security reasons, switch off the HiDiscovery function for the device in the Web-based interface, after you have assigned the IP parameters to the device (see on page 50 “Web-based IP Configuration“).

Note: Save the settings so that you will still have the entries after a restart

(see on page 53 “Loading/saving settings“).

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

2.4 Loading the system configuration from the ACA

The AutoConfiguration Adapter (ACA) is a device for

X storing the configuration data of a device and X storing the device software.

In the case of a device becoming inoperative, the ACA makes it possible to easily transfer the configuration data by means of a substitute device of the same type.

When you start the device, it checks for an ACA. If it finds an ACA with a valid password and valid software, the device loads the configuration data from the ACA.

The password is valid if

X the password in the device matches the password in the ACA or X the preset password is entered in the device.

To save the configuration data on the ACA(see on page 59 “Saving locally

(and on the ACA)“).

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

2.4 Loading the system configuration from the ACA

Figure 12: Flow chart of loading configuration dats from the ACA

1 – Device start-up 2 – ACA plugged-in? 3 – Password in device and ACA identical? 3a – Default password in device? 4 – Load configuration from ACA, ACA LEDs flashing synchronously 4a –Load configuration from local memory, ACA LEDs flashing alternately 5 – Configuration data loaded

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

2.5 System configuration via BOOTP

When it is started up via BOOTP (bootstrap protocol), a device receives its configuration data in accordance with the “BOOTP process” flow chart (see

fig. 13).

Note: In its delivery state, the device gets its configuration data from the DHCP server.

 Activate BOOTP to receive the configuration data (see on page 50 “Web-

based IP Configuration“), or see the CLI:

enable Switch to the Privileged EXEC mode. network protocol bootp Activate BOOTP.

copy system:running-config nvram:startup-config

y Confirm save.

Activate BOOTP.

 Provide the BOOTP server with the following data for a device:

# /etc/bootptab for BOOTP-daemon bootpd # # gw -- gateway # ha -- hardware address # ht -- hardware type # ip -- IP address # sm -- subnet mask # tc -- template

.global:\ :gw=0.0.0.0:\ :sm=255.255.240.0:

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

switch_01:ht=ethernet:ha=008063086501:ip=10.1.112.83:tc=.global: switch_02:ht=ethernet:ha=008063086502:ip=10.1.112.84:tc=.global: . .

2.5 System configuration via BOOTP

Lines that start with a ‘#’ character are comment lines.

The lines under “.global:” make the configuration of several devices easier. With the template (tc) you allocate the global configuration data (tc=.global:) to each device . The direct allocation of hardware address and IP address is performed in the device lines (switch-0...).

 Enter one line for each device.  After ha= enter the hardware address of the device.  After ip= enter the IP address of the device.

In the appendix under “Setting up a DHCP/BOOTP Server“ on page 218, you will find an example for the configuration of a BOOTP/DHCP server.

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

DHCP

BOOTP?

Send

DHCP/

BOOTP

Requests

Reply from

DHCP/BOOTP

server?

Ye s

Save IP parameter

and config file URL

locally

initialize IP stack

with IP parameters

No*

Start-up

Device in initalization

Device runs with settings from local flash

Device is manageable

Load default

configuration

2.5 System configuration via BOOTP

Figure 13: Flow chart for the BOOTP/DHCP process, part 1

* see fig. 14

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

Load transferred

config file

Yes

Load remote

configuration from

URL of DHCP?

No*

Yes

Start tftp process

with config

file URL of DHCP

tftp

successful?

Save transferred

config file local

and set

boot configuration

to local

Loading of

configurations data

is complete

2.5 System configuration via BOOTP

Figure 14: Flow chart for the BOOTP/DHCP process, part 2

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

2.5 System configuration via BOOTP

Note: The loading process started by DHCP/BOOTP (see on page 218

“Setting up a DHCP/BOOTP Server“) shows the selection of "from URL &

save locally" in the "Load" frame. If you get an error message when saving a configuration, this could be due to an active loading process. DHCP/BOOTP only finishes a loading process when a valid configuration has been loaded. If DHCP/BOOTP does not find a valid configuration, then finish the loading process by loading the local configuration in the "Load" frame.

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

2.6 System Configuration via DHCP

The DHCP (Dynamic Host Configuration Protocol) is a further development of BOOTP, which it has replaced. The DHCP additionally allows the configuration of a DHCP client via a name instead of via the MAC address. For the DHCP, this name is known as the “client identifier” in accordance with rfc 2131. The device uses the name entered under sysName in the system group of the MIB II as the client identifier. You can enter this system name directly via SNMP, the Web-based management (see system dialog), or the Command Line Interface.

During startup operation, a device receives its configuration data according to the “DHCP process” flowchart (see fig. 13).

The device sends its system name to the DHCP server. The DHCP server can then use the system name to allocate an IP address as an alternative to the MAC address. In addition to the IP address, the DHCP server sends – the netmask – the default gateway (if available) – the tftp URL of the configuration file (if available).

The device accepts this data as configuration parameters (see on page 50

“Web-based IP Configuration“).

If an IP address was assigned by a DHCP server, it will be permanently saved locally.

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

Option Meaning

1 Subnet Mask 2 Time Offset 3Router 4 Time server 12 Host Name 61 Client Identifier 66 TFTP Server Name 67 Bootfile Name

Table 3: DHCP options which the device requests

2.6 System Configuration via DHCP

The advantage of using DHCP instead of BOOTP is that the DHCP server can restrict the validity of the configuration parameters (“Lease”) to a specific time period (known as dynamic address allocation). Before this period (“Lease Duration”) elapses, the DHCP client can attempt to renew this lease. Alternatively, the client can negotiate a new lease. The DHCP server then allocates a random free address. To avoid this, most DHCP servers provide the explicit configuration option of always assigning a specific client the same IP address based on a unique hardware ID (known as static address allocation).

On delivery, DHCP is activated. As long as DHCP is activated, the device attempts to obtain an IP address. If it cannot find a DHCP server after restarting, it will not have an IP address. To activate/deactivate DHCP (see on page 50 “Web-based IP

Configuration“).

Note: When using HiVision network management, ensure that DHCP always allocates the original IP address to each device.

In the appendix, you will find an example for the configuration of a BOOTP/ DHCP server (see on page 218 “Setting up a DHCP/BOOTP Server“).

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

2.6 System Configuration via DHCP

Example of a DHCP configuration file:

# /etc/dhcpd.conf for DHCP Daemon # subnet 10.1.112.0 netmask 255.255.240.0 { option subnet-mask 255.255.240.0; option routers 10.1.112.96; } # # Host berta requests IP configuration # with her MAC address # host berta { hardware ethernet 00:80:63:08:65:42; fixed-address 10.1.112.82; } # # Host hugo requests IP configuration # with his client identifier. # host hugo { # option dhcp-client-identifier "hugo"; option dhcp-client-identifier 00:68:75:67:6f; fixed-address 10.1.112.83; server-name "10.1.112.11"; filename "/agent/config.dat"; }

Lines that start with a '#' character are comment lines. The lines preceding the individually listed devices refer to settings that apply to all the following devices. The fixed-address line assigns a permanent IP address to the device. For further information, please refer to the DHCP server manual.

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

PLC

Switch (Option 82)

IP =

10.0.1.100

IP =

10.0.1.100

MAC address = 00:80:63:10:9a:d7

DHCP server IP =

10.0.1.1

MACH 4002

2.7 System Configuration via DHCP Option 82

As with the classic DHCP, on startup an agent receives its configuration data according to the “BOOTP/DHCP process” flow chart (see fig. 13).

While the system configuration is based on the classic DHCP protocol on the device being configured (see on page 46 “System Configuration via DHCP“), Option 82 is based on the network topology. This procedure gives you the option of always assigning the same IP address to any device which is connected to a particular location (port of a device) on the LAN. The installation of a DHCP server is described in the chapter “Setting up a

DHCP Server with Option 82“ on page 224.

Figure 15: Application example of using Option 82

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

2.8 Web-based IP Configuration

With the Basic Settings:Network dialog you define the source from which the device gets its IP parameters after starting, and you assign the IP parameters and VLAN ID and configure the HiDiscovery access.

Figure 16: Network Parameters Dialog

 Under “Mode”, you enter where the device gets its IP parameters:

X In the BOOTP mode, the configuration is via a BOOTP or DHCP

server on the basis of the MAC address of the device (see page 218

“Setting up a DHCP/BOOTP Server“).

X In the DHCP mode, the configuration is via a DHCP server on the

basis of the MAC address or the name of the device (see page 224

“Setting up a DHCP Server with Option 82“).

X In the “local” mode the net parameters in the device memory are used.

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

2.8 Web-based IP Configuration

 Enter the parameters on the right according to the selected mode.

 You enter the name applicable to the DHCP protocol in the “Name” line in

the system dialog of the Web-based interface.

 The “VLAN” frame enables you to assign a VLAN to the agent. If you enter

0 here as the VLAN ID (not included in the VLAN standard version), the agent will then be accessible from all VLANs.

 The HiDiscovery protocol allows you to allocate an IP address to the

device on the basis of its MAC address. Activate the HiDiscovery protocol if you want to allocate an IP address to the device from your PC with the enclosed HiDiscovery software (state on delivery: operation “on”, access “read-write”).

Note: Save the settings so that you will still have the entries after a restart

(see on page 53 “Loading/saving settings“).

Basic Configuration

Release 6.0 07/2010

Entering the IP Parameters

2.9 Faulty Device Replacement

The device provides 2 plug-and-play solutions for replacing a faulty device with a device of the same type (faulty device replacement):

X Configuring the new device using an AutoConfiguration Adapter(see on

page 39 “Loading the system configuration from the ACA“) or

X configuration via DHCP Option 82 (see on page 224 “Setting up a DHCP

Server with Option 82“)

In both cases, when the new device is started, it is given the same configuration data that the replaced device had.

Note: If you replace a device with DIP switches, please ensure that the DIP switch settings are identical.

Note: If you want to access the device via SSH, you also need an SSH key. To transfer the SSH key of the old device to the new one, you have the following options:

- If you have already created the key and saved it outside the device (e.g. on your administration workstation), load the saved key onto the new device

(see on page 234 “Uploading the SSH Host Key“).

- Otherwise create a new SSH key and load it onto the new device (see on

page 233 “Preparing Access via SSH“). Note that the new device now

identifies itself by means of another key.

Basic Configuration

Release 6.0 07/2010

Loading/saving settings

3 Loading/saving settings

The device saves settings such as the IP parameters and the port configuration in the temporary memory. These settings are lost when you switch off orreboot the device. The device enables you to

X load settings from a non-volatile memory into the temporary memory

X save settings from the temporary memory in a non-volatile memory.

If you change the current configuration (for example, by switching a port off), the Web-based interface changes the “load/save” symbol in the navigation tree from a disk symbol to a yellow triangle. After saving the configuration, the Web-based interface displays the “load/save” symbol as a disk again.

Basic Configuration

Release 6.0 07/2010

Loading/saving settings

3.1 Loading settings

When it is restarted, the device loads its configuration data from the local non-volatile memory, provided you have not activated BOOTP/DHCP and no ACA is connected to the device.

During operation, the device allows you to load settings from the following sources:

X the local non-volatile memory

X from the AutoConfiguration Adapter. If an ACA is connected to the device,

the device automatically loads its configuration from the ACA during the boot procedure.

X a file in the connected network (setting on delivery)

X a binary file or an editable and readable script on the PC and

X the firmware (restoration of the configuration on delivery).

Note: When loading a configuration, do not access the device until it has loaded the configuration file and has made the new configuration settings. Depending on the complexity of the configuration settings, this procedure may take 10 to 200 seconds.

Basic Configuration

Release 6.0 07/2010

Loading/saving settings

3.1 Loading settings

3.1.1 Loading from the local non-volatile memory

When loading the configuration data locally, the device loads the configuration data from the local non-volatile memory if no ACA is connected to the device.

 Select the

Basics: Load/Save dialog.

 In the "Load" frame, click "from Device".  Click "Restore".

enable Switch to the Privileged EXEC mode.

copy nvram:startup-config system:running-config

The device loads the configuration data from the local non-volatile memory.

3.1.2 Loading from the AutoConfiguration Adapter

If a ACA is connected to the device, the device automatically loads its configuration from the ACA during the boot procedure. The chapter “Saving locally (and on the ACA)“ on page 59 describes how to save a configuration file on an ACA.

Note: The device allows you to trigger the following events when the configuration stored on the ACA does not match that in the device:

X an alarm (trap) is sent (see on page 179 “Configuring Traps“), X the device status is updated (see on page 181 “Monitoring the Device

Status“),

X the status of the signal contacts is updated (see on page 185 “Controlling

the Signal Contact“).

Basic Configuration

Release 6.0 07/2010

Loading/saving settings

3.1 Loading settings

3.1.3 Loading from a file

The device allows you to load the configuration data from a file in the connected network if there is no AutoConfiguration Adapter connected to the device.

 Select the

Basics: Load/Save dialog.

 In the "Load" frame, click

X "from URL" if you want the device to load the configuration data

from a file and retain the locally saved configuration.

X "from URL & save to Switch" if you want the device to load the

configuration data from a file and save this configuration locally.

X "via PC" if you want the device to load the configuration data from

a file from the PC and retain the locally saved configuration.

 In the "URL" frame, enter the path under which the device will find

the configuration file, if you want to load from the URL.

 Click "Restore".

The URL identifies the path to the tftp server from which the device loads the configuration file. The URL is in the format tftp://IP address of the tftp server/path name/file name (e.g. tftp://10.1.112.5/switch/config.dat).

Example of loading from a tftp server  Before downloading a file from the tftp server, you have to save the

configuration file in the corresponding path of the tftp servers with the file name, e.g. switch/switch_01.cfg (see on page 60

“Saving to a file on URL“)

 In the "URL" line, enter the path of the tftp server, e.g. tftp://

10.1.112.214/switch/switch_01.cfg.

Basic Configuration

Release 6.0 07/2010

Loading/saving settings

3.1 Loading settings

Figure 17: Load/Save dialog

enable Switch to the Privileged EXEC mode.

copy tftp://10.1.112.159/ switch/config.dat nvram:startup-config

The device loads the configuration data from a tftp server in the connected network.

Note: The loading process started by DHCP/BOOTP (see on page 41

“System configuration via BOOTP“) shows the selection of "from URL & save

locally" in the "Load" frame. If you get an error message when saving a configuration, this could be due to an active loading process. DHCP/BOOTP only finishes a loading process when a valid configuration has been loaded. If DHCP/BOOTP does not find a valid configuration, then finish the loading process by loading the local configuration in the "Load" frame.

Basic Configuration

Release 6.0 07/2010

Loading/saving settings

3.1 Loading settings

3.1.4 Resetting the configuration to the state on delivery

The device enables you to

X reset the current configuration to the state on delivery. The locally saved

configuration is kept.

X reset the device to the state on delivery. After the next restart, the IP

address is also in the state on delivery.

 Select the

Basics: Load/Save dialog.

 Make your selection in the "Delete" frame.  Click "Delete configuration".

Setting in the system monitor

 Select 5 “Erase main configuration file”

This menu item allows you to reset the device to its state on delivery. The device saves configurations other than the original one in its Flash memory in the configuration file *.cfg.

 Press the Enter key to delete the configuration file.

Basic Configuration

Release 6.0 07/2010

Loading/saving settings

3.2 Saving settings

In the "Save" frame, you have the option to

X save the current configuration on the device X save the current configuration in binary form in a file under the specified

URL, or as an editable and readable script

X save the current configuration in binary form or as an editable and

readable script on the PC.

3.2.1 Saving locally (and on the ACA)

The device allows you to save the current configuration data in the local nonvolatile memory and the ACA.

 Select the

Basics: Load/Save dialog.

 In the “Save” frame, click “to Device”.  Click on “Save”.

The device saves the current configuration data in the local nonvolatile memory and, if an ACA is connected, also in the ACA.

enable Switch to the Privileged EXEC mode.

copy system:running-config nvram:startup-config

The device saves the current configuration data in the local non-volatile memory and, if an ACA is connected, also on the ACA.

Basic Configuration

Release 6.0 07/2010

Loading/saving settings

3.2 Saving settings

Note: After you have successfully saved the configuration on the device, the device sends an alarm (trap) hmConfigurationSavedTrap together with the information about the AutoConfiguration Adapter (ACA), if one is connected. When you change the configuration for the first time after saving it, the device sends a trap hmConfigurationChangedTrap.

Note: The device allows you to trigger the following events when the configuration stored on the ACA does not match that in the device:

X an alarm (trap) is sent (see on page 179 “Configuring Traps“), X the device status is updated (see on page 182 “Configuring the Device

Status“),

X the status of the signal contacts is updated (see on page 185 “Controlling

the Signal Contact“).

3.2.2 Saving to a file on URL

The device allows you to save the current configuration data in a file in the connected network.

Note: The configuration file includes all configuration data, including the password. Therefore pay attention to the access rights on the tftp server.

Basic Configuration

Release 6.0 07/2010

Loading/saving settings

3.2 Saving settings

 Select the

Basics: Load/Save dialog.

 In the “Save” frame, click “to URL (binary)”

to receive a binary file, or “to URL (script)” to receive an editable and readable script.

 In the “URL” frame, enter the path under which you want the device

to save the configuration file.

The URL identifies the path to the tftp server on which the device saves the configuration file. The URL is in the format tftp://IP address of the tftp server/path name/file name (e.g. tftp://10.1.112.5/switch/config.dat).

 Click "Save".

enable Switch to the Privileged EXEC mode. copy nvram:startup-config

tftp://10.1.112.159/ switch/config.dat

copy nvram:script tftp://10.0.1.159/switch/ config.txt

The device saves the configuration data in a binary file on a tftp server in the connected network

The device saves the configuration data in a script file on a tftp server in the connected network.

3.2.3 Saving to a binary file on the PC

The device allows you to save the current configuration data in a binary file on your PC.

 Select the

Basics: Load/Save dialog.

 In the "Save" frame, click "on the PC (binary)".

Basic Configuration

Release 6.0 07/2010

Loading/saving settings

3.2 Saving settings

 In the save dialog, enter the name of the file in which you want the

device to save the configuration file.

 Click "Save".

3.2.4 Saving as a script on the PC

The device allows you to save the current configuration data in an editable and readable file on your PC.

 Select the

Basics: Load/Save dialog.

 In the "Save" frame, click "on the PC (script)".  In the save dialog, enter the name of the file in which you want the

device to save the configuration file.

 Click "Save".

Basic Configuration

Release 6.0 07/2010

Loading Software Updates

4 Loading Software Updates

Hirschmann never stops working on improving the performance of its products. So it is possible that you may find a more up to date release of the device software on the Hirschmann Internet site (www.hirschmann.com) than the release saved on your device.

 Checking the installed software release

 Select the Basics:Software dialog.  This dialog shows you the variant, the release number and the date

of the software saved on the device.

X “Stored Version”: the software in the non-volatile memory X “Running Version”: the software currently being used X “Backup Version”: the backup software in the non-volatile

memory

enable Switch to the Privileged EXEC mode. show sysinfo Display the system information.

Alarm...................................... None

System Description......................... Hirschmann Railswitch

System Name................................ RS-1F1054

System Location............................ Hirschmann Railswitch

System Contact............................. Hirschmann Automation

and Control GmbH

System Up Time............................. 0 days 0 hrs 45 mins

57 secs

System Date and Time (local time zone)..... 2009-11-12 14:15:16

System IP Address.......................... 10.0.1.13

Boot Software Release...................... L2B-05.2.00

Boot Software Build Date................... 2009-11-12 13:14

OS Software Release........................ L2B-03.1.00

OS Software Build Date..................... 2009-11-12 13:14

Hardware Revision.......................... 1.22 / 4 / 0103

Hardware Description....................... RS20-1600T1T1SDAEHH

Serial Number.............................. 943434023000001191

Base MAC Address........................... 00:80:63:1F:10:54

Number of MAC Addresses.................... 32 (0x20)

Basic Configuration

Release 6.0 07/2010

Loading Software Updates

 Loading the software

The device gives you 4 options for loading the software:

X manually from the ACA 21 USB (out-of-band), X automatically from the ACA 21 USB (out-of-band), X via TFTP from a tftp server (in-band) and X via a file selection dialog from your PC.

Note: The existing configuration of the device is still there after the new software is installed.

Basic Configuration

Release 6.0 07/2010

Loading Software Updates

4.1 Loading the Software manually from the ACA

You can connect the ACA 21-USB to a USB port of your PC like a conventional USB stick and copy the device software into the main directory of the ACA 12-USB.

 Connect the ACA 21-USB onto which you copied the device software with

the USB port of the device.

 Open the system monitor (see page 16 “Opening the system monitor“).

 Select 2 and press the Enter key to copy the software from the ACA 21-

USB into the local memory of the device. At the end of the update, the system monitor asks you to press any key to continue.

 Select 3 to start the new software on the device.

The system monitor offers you additional options in connection with the software on your device:

X selecting the software to be loaded X starting the software X performing a cold start

Basic Configuration

Release 6.0 07/2010

Loading Software Updates

4.1 Loading the Software manually from the ACA

4.1.1 Selecting the software to be loaded

In this menu item of the system monitor, you select one of two possible software releases that you want to load. The following window appears on the screen:

Select Operating System Image

(Available OS: Selected: 05.0.00 (2009-08-07 06:05), Backup: 04.2.00 (2009-07-06 06:05 (Locally selected: 05.0.00 (2009-08-07 06:05))

1 Swap OS images 2 Copy image to backup 3 Test stored images in Flash mem. 4 Test stored images in USB mem. 5 Apply and store selection 6 Cancel selection

Figure 18: Update operating system screen display

 Swap OS images

The memory of the device provides space for two images of the software. This gives you the ability to load a new version of the software without deleting the existing version.

 Select 1 to load the other software in the next booting process.

 Copy image to backup

 Select 2 to save a copy of the active software.

Basic Configuration

Release 6.0 07/2010

Loading Software Updates

4.1 Loading the Software manually from the ACA

 Test stored images in flash memory

 Select 3 to check whether the images of the software stored in the

flash memory contain valid codes.

 Test stored images in USB memory

 Select 4, to check whether the images of the software stored in the

ACA 21-USB contain valid codes.

 Apply and store selection

 Select 5 to confirm the software selection and to save it.

 Cancel selection

 Select 6 to leave this dialog without making any changes.

4.1.2 Starting the software

This menu item (Start Selected Operating System) of the system monitor allows you to start the software selected.

4.1.3 Performing a cold start

This menu item (End (reset and reboot)) of the system monitor allows you to reset the hardware of the device and perform a restart.

Basic Configuration

Release 6.0 07/2010

Loading Software Updates

4.2 Automatic software update by ACA

 For a software update via the ACA, first copy the new device software into

the main directory of the AutoConfiguration Adapter. If the version of the software on the ACA is newer or older than the version on the device, the device performs a software update.

Note: Software versions with release 06.0.00 and higher in the non-

volatile memory of the device support the software update via the ACA. If the device software is older, you have the option of loading the software manually from the ACA(see page 65).

 Give the file the name that matches the device type and the software

variant, e.g. rsL2P.bin for device type RS2 with the software variant L2P. Please note the case-sensitivity here. If you have copied the software from a CD-ROM or from a Web server of the manufacturer, the software already has the correct file name.

 Also create an empty file with the name “autoupdate.txt” in the main

directory of the ACA. Please note the case-sensitivity here.

 Connect the AutoConfiguration Adapter to the device and restart the

device.

 The device automatically performs the following steps:

– During the booting process, it checks whether an ACA is connected. – It checks whether the ACA has a file with the name “autoupdate.txt” in

the main directory.

– It checks whether the ACA has a software file with a name that

matches the device type in the main directory.

– If compares the software version stored on the ACA with the one

stored on the device.

– If these conditions are fulfilled, the device loads the software from the

ACA to its non-volatile memory as the main software.

– The device keeps a backup of the existing software in the non-volatile

memory.

– The device then performs a cold start, during which it loads the new

software from the non-volatile memory.

Basic Configuration

Release 6.0 07/2010

Loading Software Updates

4.2 Automatic software update by ACA

One of the following messages in the log file indicates the result of the update process:

X S_watson_AUTOMATIC_SWUPDATE_SUCCESSFUL: Update

completed successfully.

X S_watson_AUTOMATIC_SWUPDATE_FAILED_WRONG_FILE: Update

failed. Reason: incorrect file.

X S_watson_AUTOMATIC_SWUPDATE_FAILED_SAVING_FILE: Update

failed. Reason: error when saving.

 In your browser, click on “Reload” so that you can use the Web-based

interface to access the device again after it is booted.

Basic Configuration

Release 6.0 07/2010

Loading Software Updates

4.3 Loading the software from the tftp server

For a tftp update, you need a tftp server on which the software to be loaded is stored (see on page 228 “TFTP Server for Software Updates“).

 Select the Basics:Software dialog.

The URL identifies the path to the software stored on the tftp server. The URL is in the format tftp://IP address of the tftp server/path name/file name (e.g. tftp://192.168.1.1/device/device.bin).

Basic Configuration

Release 6.0 07/2010

Loading Software Updates

4.3 Loading the software from the tftp

 Enter the path of the device software.

 Click on "Update" to load the software from the tftp server to the

device.

server

Figure 19: Software update dialog

 After successfully loading it, you activate the new software: Select

the dialog Basic Settings:Restart and perform a cold start. In a cold start, the device reloads the software from the non-volatile memory, restarts, and performs a self-test.

 After booting the device, click "Reload" in your browser to access the

device again.

enable Switch to the Privileged EXEC mode.

copy tftp://10.0.1.159/ rsL2E.bin system:image

Transfer the "rsL2E.bin" software file to the device from the tftp server with the IP address 10.0.1.159.

Basic Configuration

Release 6.0 07/2010

Loading Software Updates

4.4 Loading the Software via File Selection

For an HTTP software update (via a file selection window), the device software must be on a data carrier that you can access via a file selection window from your workstation.

 Select the Basics:Software dialog.  In the file selection frame, click on “...”.

 In the file selection window, select the device software (name type:

*.bin, e.g. device.bin) and click on “Open”.

 Click on “Update” to transfer the software to the device.

The end of the update is indicated by one of the following messages:

X Update completed successfully. X Update failed. Reason: incorrect file. X Update failed. Reason: error when saving. X File not found (reason: file name not found or does not exist). X Connection error (reason: path without file name).

 After the update is completed successfully, you activate the new

software: Select the Basic settings: Restart dialog and perform a cold start. In a cold start, the device reloads the software from the non-volatile memory, restarts, and performs a self-test.

 In your browser, click on “Reload” so that you can access the device

again after it is booted.

Basic Configuration

Release 6.0 07/2010

Configuring the Ports

5 Configuring the Ports

The port configuration consists of:

X Switching the port on and off X Selecting the operating mode X Activating the display of connection error messages X Configuring Power over ETHERNET.

 Switching the port on and off

In the state on delivery, all the ports are switched on. For a higher level of access security, switch off the ports at which you are not making any connection.

 Select the

Basics:Port Configuration dialog.

 In the "Port on" column, select the ports that are connected to

another device.

 Selecting the operating mode

In the state on delivery, all the ports are set to the “Automatic configuration” operating mode.

Note: The active automatic configuration has priority over the manual configuration.

 Select the

Basics:Port Configuration dialog.

 If the device connected to this port requires a fixed setting

– select the operating mode (transmission rate, duplex mode) in

the "Manual configuration" column and

– deactivate the port in the "Automatic configuration" column.

Basic Configuration

Release 6.0 07/2010

Configuring the Ports

 Displaying connection error messages

In the state on delivery, the device displays connection errors via the signal contact and the LED display. The device allows you to suppress this display, because you do not want to interpret a switched off device as an interrupted connection, for example.

 Select the

Basics:Port Configuration dialog.

 In the "Propagate connection error" column, select the ports for

which you want to have link monitoring.

 Configuring Power over ETHERNET

Devices with Power over ETHERNET (PoE) media modules or PoE ports enable you to supply current to terminal devices such as IP phones via the twisted-pair cable. PoE media modules and PoE ports support Power over ETHERNET according to IEEE 802.3af. On delivery, the Power over ETHERNET function is activated globally and at all ports.

Nominal power for MS20/30, MACH 1000 and PowerMICE: The device provides the nominal power for the sum of all PoE ports plus a surplus. Because the PoE media module gets its PoE voltage externally, the device does not know the possible nominal power. The device therefore assumes a “nominal power” of 60 Watt per PoE media module for now.

Nominal power for HS600x: The device provides the nominal power for the sum of all PoE ports plus a surplus. Because the PoE media module gets its PoE voltage externally, the device does not know the possible nominal power. The device therefore assumes a “nominal power” of 60 Watts per PoE media module for now.

Nominal power for OCTOPUS 8M-PoE: The device provides the nominal power for the sum of all PoE ports plus a surplus. Because the device gets its PoE voltage externally, the device does not know the possible nominal power. The device therefore assumes a “nominal power” of 15 Watt per PoE port for now.

Basic Configuration

Release 6.0 07/2010

Configuring the Ports

Nominal power for MACH 4000: The device provides the nominal power for the sum of all PoE ports plus a surplus. Should the connected devices require more PoE power than is provided, the device then switches PoE off at the ports. Initially, the device switches PoE off at the ports with the lowest PoE priority. If multiple ports have the same priority, the device first switches PoE off at the ports with the higher port number.

 Select the

Basics:Power over Ethernet dialog.

 With “Function on/off” you turn the PoE on or off.  With “Send Trap” you can get the device to send a trap in the

following cases: – If a value exceeds/falls below the performance threshold. – If the PoE supply voltage is switched on/off at at least one port.

 Enter the power threshold in “Threshold”. When this value is

exceeded/not achieved, the device will send a trap, provided that “Send trap” is enabled. For the power threshold you enter the power yielded as a percentage of the nominal power.

 “Nominal Power” displays the power that the device nominally

provides for all PoE ports together.

 “Reserved Power” displays the maximum power that the device

provides to all the connected PoE devices together on the basis of their classification.

 “Delivered Power” shows how large the current power requirement

is at all PoE ports.

Basic Configuration

Release 6.0 07/2010

Configuring the Ports

The difference between the "nominal" and "reserved" power indicates how much power is still available to the free PoE ports.

 In the “POE on” column, you can enable/disable PoE at this port.  The “Status” column indicates the PoE status of the port.  In the “Priority” column (MACH 4000), set the PoE priority of the port

to “low”, “high” or “critical”.

 The “Class” column shows the class of the connected device:

ClassMaximum power delivered 0: 15.4 W = state on delivery 1: 4.0 W 2: 7.0 W 3: 15,4 W 4: reserved, treat as class 0

 The “Name” column indicates the name of the port, see

Basic settings:Port configuration.

Figure 20: Power over Ethernet dialog

Basic Configuration

Release 6.0 07/2010

Protection from Unauthorized Access

6 Protection from Unauthorized

Access

The device provides you with the following functions to help you protect it against unauthorized access.

X Password for SNMP access X Telnet/Web/SSH access disabling X Restricted management access X HiDiscovery function disabling X Port access control via IP or MAC address X Port authentication according to IEEE 802.1X

Basic Configuration

Release 6.0 07/2010

Protection from Unauthorized Access

6.1 Protecting the device

If you want to maximize the protection of the device against unauthorized access in just a few steps, you can perform some or all of the following steps on the device:

 Deactivate SNMPv1 and SNMPv2 and select a password for SNMPv3

access other than the standard password (see on page 80 “Entering the

password for SNMP access“).

 Deactivate Telnet access.

Deactivate web access after you have downloaded the applet for the webbased interface onto your management station. You can start the webbased interface as an independent program and thus have SNMP access to the device. If necessary, deactivate SSH access (see on page 85 “Enabling/disabling

Telnet/Web/SSH Access“).

 Deactivate HiDiscovery access.

Note: Make sure to retain at least one option to access the device. V.24 access is always possible, since it cannot be deactivated.

Basic Configuration

Release 6.0 07/2010

Protection from Unauthorized Access

6.2 Password for SNMP access

6.2.1 Description of password for SNMP access

A network management station communicates with the device via the Simple Network Management Protocol (SNMP). Every SNMP packet contains the IP address of the sending computer and the password with which the sender of the packet wants to access the device MIB.

The device receives the SNMP packet and compares the IP address of the sending computer and the password with the entries in the device MIB. If the password has the appropriate access right, and if the IP address of the sending computer has been entered, then the device will allow access.

In the delivery state, the device is accessible via the password "public" (read only) and "private" (read and write) to every computer.

To help protect your device from unwanted access:

 First define a new password with which you can access from your

computer with all rights.

 Treat this password as confidential, because everyone who knows the

password can access the device MIB with the IP address of your computer.

 Limit the access rights of the known passwords or delete their entries.

Basic Configuration

Release 6.0 07/2010

Protection from Unauthorized Access

6.2 Password for SNMP access

6.2.2 Entering the password for SNMP access

 Select the Security:Password/SNMP Access dialog. This dialog gives you the option of changing the read and read/write

passwords for access to the device via the Web-based interface, via the CLI, and via SNMPv3 (SNMP version 3). Please note that passwords are case-sensitive. Set different passwords for the read password and the read/write password so that a user that only has read access (user name “user”) does not know, or cannot guess, the password for read/write access (user name “admin”). If you set identical passwords, when you attempt to write this data the device reports a general error.

The Web-based interface and the user interface (CLI) use the same passwords as SNMPv3 for the users “admin” and “user”.

 Select “Modify Read-Only Password (User)” to enter the read

password.

 Enter the new read password in the “New Password” line and repeat

your entry in the “Please retype” line.

 Select “Modify Read-Write Password (Admin)” to enter the read/

write password.

 Enter the read/write password and repeat your entry.  "Data encryption" encrypts the data of the Web-based management

that is transferred between your PC and the device with SNMPv3. You can set the "Data encryption" differently for access with a read password and access with a read/write password.

Basic Configuration

Release 6.0 07/2010

Protection from Unauthorized Access

6.2 Password for SNMP access

Figure 21: Password/SNMP Access dialog

Note: If you do not know a password with “read/write” access, you will not have write access to the device.

Note: For security reasons, the device does not display the passwords. Make a note of every change. You cannot access the device without a valid password.

Note: For security reasons, SNMPv3 encrypts the password. With the “SNMPv1” or “SNMPv2” setting in the dialog Security:SNMPv1/v2 access, the device transfers the password unencrypted, so that this can also be read.

Note: Use between 5 and 32 characters for the password in SNMPv3, since many applications do not accept shorter passwords.

Basic Configuration

Release 6.0 07/2010

Protection from Unauthorized Access

6.2 Password for SNMP access

 Select the Security:SNMPv1/v2 access dialog.

With this dialog you can select the access via SNMPv1 or SNMPv2. In the state on delivery, both protocols are activated. You can thus manage the device with HiVision and communicate with earlier versions of SNMP.

If you select SNMPv1 or SNMPv2, you can specify in the table via which IP addresses the device may be accessed, and what kinds of passwords are to be used. Up to 8 entries can be made in the table. For security reasons, the read password and the read/write password must not be identical. Please note that passwords are case-sensitive.

Index Serial number for this table entry Password Password with which this computer can access the

device. This password is independent of the SNMPv2

password. IP address IP address of the computer that can access the device. IP mask IP mask for the IP address Access

mode

The access mode determines whether the computer has

read-only or read-write access. Active Enable/disable this table entry.

Basic Configuration

Release 6.0 07/2010

Protection from Unauthorized Access

6.2 Password for SNMP access

Figure 22: SNMPv1/v2 access dialog

 To create a new line in the table click "Create entry".  To delete an entry, select the line in the table and click "Delete".

Basic Configuration

Release 6.0 07/2010

Protection from Unauthorized Access

6.3 Telnet/Web/SSH Access

6.3.1 Description of Telnet Access

The Telnet server of the device allows you to configure the device by using the Command Line Interface (in-band). You can deactivate the Telnet server if you do not want Telnet access to the device. On delivery, the server is activated. After the Telnet server has been deactivated, you will no longer be able to access the device via a new Telnet connection. If a Telnet connection already exists, it is kept.

Note: The Command Line Interface (out-of-band) and the Security:Telnet/Web access dialog in the Web-based interface allow you to reactivate the Telnet server.

6.3.2 Description of Web Access

The Web server of the device allows you to configure the device by using the Web-based interface. Deactivate the Web server if you do not want the device to be accessed from the Web. On delivery, the server is activated.

Basic Configuration

Release 6.0 07/2010

Protection from Unauthorized Access

6.3 Telnet/Web/SSH Access

After the Web server has been switched off, it is no longer possible to log in via a Web browser. The login in the open browser window remains active.

6.3.3 Description of SSH Access

The SSH server of the device allows you to configure the device by using the Command Line Interface (in-band). You can deactivate the SSH server to disable SSH access to the device. On delivery, the server is deactivated. After the SSH server has been deactivated, you will no longer be able to access the device via a new SSH connection. If an SSH connection already exists, it is kept.

Note: The Command Line Interface (out-of-band) and the Security:Telnet/Web access dialog in the Web-based interface allow you to reactivate the SSH server.

Note: To be able to access the device via SSH, you need a key that has to be installed on the device (see the "Basic Configuration" user manual).

6.3.4 Enabling/disabling Telnet/Web/SSH Access

 Select the Security:Telnet/Web/SHH access dialog.

 Disable the server to which you want to refuse access.

Basic Configuration

Release 6.0 07/2010

Protection from Unauthorized Access

enable Switch to the Privileged EXEC mode. configure Switch to the Configuration mode. lineconfig Switch to the configuration mode for CLI. transport input telnet Enable Telnet server. no transport input telnet Disable Telnet server. exit Switch to the Configuration mode. ip http server Enable Web server. no ip http server Disable Web server. ip ssh Enable SSH function on Switch no ip ssh Disable SSH function on Switch

6.3 Telnet/Web/SSH Access

Basic Configuration

Release 6.0 07/2010

Protection from Unauthorized Access

6.4 Restricted Management Access

The device allows you to differentiate the management access to the device based on IP address ranges, and to differentiate these based on management services (http, snmp, telnet, ssh). You thus have the option to set finely differentiated management access rights.

If you only want the device, which is located, for example, in a production plant, to be managed from the network of the IT department via the Web interface, but also want the administrator to be able to access it remotely via SSH, you can achieve this with the “Restricted management access” function.

You can configure this function using the Web-based interface or the CLI. The Web-based interface provides you with an easy configuration option. Make sure you do not unintentionally block your access to the device. The CLI access to the device via V.24 provided at all times is excluded from the function and cannot be restricted.

In the following example, the IT network has the address range 192.168.1.0/ 24 and the remote access is from a mobile phone network with the IP address range 109.237.176.0 - 109.237.176.255.

The device is always ready for the SSH access (see on page 233 “Preparing

Access via SSH“) and the SSH client application already knows the

fingerprint of the host key on the device.

Parameter Value

IT network address 192.168.1.0 IT network netmask 255.255.255.0 Desired management access from the IT network http, snmp Mobile phone network address 109.237.176.0 Mobile phone network netmask 255.255.255.0 Desired management access from the mobile phone

network

ssh

Table 4: Example parameter for the restricted management access

Basic Configuration

Release 6.0 07/2010

Protection from Unauthorized Access886.4 Restricted Management Access

enable Switch to the Privileged EXEC mode. show network mgmt-access Display the current configuration. network mgmt-access add Create an entry for the IT network. This is given

the smallest free ID - in the example, 2.

network mgmt-access modify 2 ip 192.168.1.0

network mgmt-access modify 2 netmask 255.255.255.0

network mgmt-access modify 2 telnet disable

network mgmt-access modify 2 ssh disable

network mgmt-access add Create an entry for the mobile phone network. In

network mgmt-access modify 3 ip 109.237.176.0

network mgmt-access modify 3 netmask 255.255.255.0

network mgmt-access modify 3 http disable

network mgmt-access modify 3 snmp disable

network mgmt-access modify 3 telnet disable

network mgmt-access status 1 disable

network mgmt-access operation enable

show network mgmt-access Display the current configuration of the function.

copy system:running-config nvram:startup-config

Set the IP address of the entry for the IT network.

Set the netmask of the entry for the IT network.

Deactivate telnet for the entry of the IT network.

Deactivate SSH for the entry of the IT network.

the example, this is given the ID 3. Set the IP address of the entry for the mobile

phone network. Set the netmask of the entry for the mobile phone

network. Deactivate http for the entry of the mobile phone

network. Deactivate snmp for the entry of the mobile phone

network. Deactivate telnet for the entry of the mobile phone

network. Deactivate the preset entry.

Activates the function immediately.

Save the entire configuration in the non-volatile memory.

Basic Configuration

Release 6.0 07/2010

Protection from Unauthorized Access

6.5 HiDiscovery Access

6.5.1 Description of the HiDiscovery Protocol

The HiDiscovery protocol allows you to allocate an IP address to the device on the basis of its MAC address (see on page 36 “Entering the IP Parameters

via HiDiscovery“). HiDiscovery is a Layer 2 protocol.

Note: For security reasons, restrict the HiDiscovery function for the device or disable it after you have assigned the IP parameters to the device.

6.5.2 Enabling/disabling the HiDiscovery Function

 Select the Basics:Network dialog.

 Disable the HiDiscovery function in the "HiDiscovery Protocol" frame

or limit the access to "read-only".

enable Switch to the Privileged EXEC mode.

network protocol hidiscovery off

network protocol hidiscovery read-only

network protocol hidiscovery read-write

Disable HiDiscovery function.

Enable HiDiscovery function with "read-only" access

Enable HiDiscovery function with "read-write" access

Basic Configuration

Release 6.0 07/2010

Protection from Unauthorized Access

6.5 HiDiscovery Access

6.5.3 Description of the Port Access Control

You can configure the device in such a way that it helps to protect every port from unauthorized access. Depending on your selection, the device checks the MAC address or the IP address of the connected device. The following functions are available for monitoring every individual port:

X The device can distinguish between authorized and unauthorized access

and supports two types of access control:

X Access for all:

– no access restriction. – MAC address 00:00:00:00:00:00 or – IP address 0.0.0.0.

X Access exclusively for defined MAC and IP addresses:

– only devices with defined MAC or IP addresses have access. – You can define up to 10 IP addresses, MAC addresses or maskable MAC addresses.

X The device can react to an unauthorized access attempt in 3 selectable

ways:

X none: no response X trapOnly: message by sending a trap X portDisable: message by sending a trap and disabling the port

6.5.4 Application Example for Port Access Control

You have a LAN connection in a room that is accessible to everyone. To set the device so that only defined users can use the LAN connection, activate the port access control on this port. An unauthorized access attempt will cause the device to shut down the port and alert you with an alarm message. The following is known:

Basic Configuration

Release 6.0 07/2010

Protection from Unauthorized Access

Parameter Value Explanation

Allowed IP Addresses 10.0.1.228

10.0.1.229

Action portDisable Disable the port with the corresponding entry in the

The defined users are the device with the IP address 10.0.1.228 and the device with the IP address 10.0.1.229

port configuration table (see on page 73

“Configuring the Ports“) and send an alarm

6.5 HiDiscovery Access

Prerequisities for further configuration:

X The port for the LAN connection is enabled and configured correctly (see

on page 73 “Configuring the Ports“)

X Prerequisites for the device to be able to send an alarm (trap) (see on

page 179 “Configuring Traps“):

– You have entered at least one recipient – You have set the flag in the “Active” column for at least one recipient – In the “Selection” frame, you have selected “Port Security”

Basic Configuration

Release 6.0 07/2010

Protection from Unauthorized Access

 Configure the port security.

6.5 HiDiscovery Access

 Select the Security:Port Security dialog.

 In the “Configuration” frame, select “IP-Based Port Security”.  In the table, click on the row of the port to be protected, in the

“Allowed IP addresses” cell.

 Enter in sequence:

– the IP subnetwork group: 10.0.1.228 – a space character as a separator – the IP address: 10.0.1.229 Entry:

10.0.1.228 10.0.1.229

 In the table, click on the row of the port to be protected, in the

“Action” cell, and select portDisable.

Figure 23: Port Security dialog

Basic Configuration

Release 6.0 07/2010

Protection from Unauthorized Access

6.5 HiDiscovery Access

 Save the settings in the non-volatile memory.

 Select the dialog Basic Settings:Load/Save.  In the “Save” frame, select “To Device” for the location and click

“Save” to permanently save the configuration in the active configuration.

Basic Configuration

Release 6.0 07/2010

Protection from Unauthorized Access946.6 Port Authentication IEEE 802.1X

802.1X SupplicantSwitch/AuthenticatorRADIUS Server

6.6 Port Authentication IEEE 802.1X

6.6.1 Description of Port Authentication according to IEEE 802.1X

The port-based network access control is a method described in the standard IEEE 802.1X to protect IEEE 802 networks from unauthorized access. The protocol controls the access to a port by authenticating and authorizing a device that is connected to this port of the device. The authentication and authorization is performed by the authenticator, in this case the device. The device authenticates (or does not authenticate) the supplicant (the querying device, e.g. a PC), which means that it permits the access to the services it provides (e.g. access to the network to which the device is connected), or else refuses it. In the process, the device accesses an external authentication server (RADIUS server), which checks the authentication data of the supplicant. The device exchanges the authentication data with the supplicant via the Extensible Authentication Protocol over LANs (EAPOL), and with the RADIUS server via the RADIUS protocol.

Figure 24: Radius server connection

Basic Configuration

Release 6.0 07/2010

Protection from Unauthorized Access

6.6 Port Authentication IEEE 802.1X

6.6.2 Authentication Process according to IEEE 802.1X

A supplicant attempts to communicate via a device port.

X The device requests authentication from the supplicant. At this time, only

EAPOL traffic is allowed between the supplicant and the device.

X The supplicant replies with its identification data. X The device forwards the identification data to the authentication server. X The authentication server responds to the request in accordance with the

access rights.

X The device evaluates this response and provides the supplicant with

access to this port (or leaves the port in the blocked state).

6.6.3 Preparing the Device for the IEEE 802.1X Port Authentication

 Configure your own IP parameters (for the device).  Globally enable the 802.1X port authentication function.  Set the 802.1X port control to "auto". The default setting is "force-

authorized".

 Enter the "shared secret" between the authenticator and the Radius

server. The shared secret is a text string specified by the RADIUS server administrator.

 Enter the IP address and the port of the RADIUS server. The default UDP

port of the RADIUS server is port 1812.

Basic Configuration

Release 6.0 07/2010

Protection from Unauthorized Access966.6 Port Authentication IEEE 802.1X

6.6.4 IEEE 802.1X Settings

 Configurating the RADIUS Server

 Select the Security:802.1x Port Authentication:RADIUS

Server dialog.

This dialog allows you to enter the data for 1, 2 or 3 RADIUS servers.

 Click "Create entry" to open the dialog window for entering the IP

address of a RADIUS server.

 Confirm the IP address entered using "OK".

You thus create a new row in the table for this RADIUS server.

 In the "Shared secret" column you enter the character string which

you get as a key from the administrator of your RADIUS server.

 With "Primary server" you name this server as the first server which

the device should contact for port authentication queries. If this server is not available, the device contacts the next server in the table.

 "Selected server" shows which server the device actually sends its

queries to.

 With "Delete entry" you delete the selected row in the table.

 Selecting Ports

 Select the Security:802.1x Port Authentication:Port

Configuration dialog.

 In the "Port control" column you select "auto" for the ports for which

you want to activate the port-related network access control.

 Activating Access Control

 Select the Security:802.1x Port

Authentication:Global dialog.

 With "Function" you enable the function.

Basic Configuration

Release 6.0 07/2010

Synchronizing the System Time in the Network

7 Synchronizing the System

Time in the Network

The actual meaning of the term “real time” depends on the time requirements of the application.

The device provides two options with different levels of accuracy for synchronizing the time in your network.

If you only require an accuracy in the order of milliseconds, the Simple Network Time Protocol (SNTP) provides a low-cost solution. The accuracy depends on the signal runtime.

IEEE 1588 with the Precision Time Protocol (PTP) achieves accuracies in the order of fractions of microseconds. This superior method is suitable for process control, for example.

Examples of application areas include:

X log entries X time stamping of production data X production control, etc.

Select the method (SNMP or PTP) that best suits your requirements. You can also use both methods simultaneously if you consider that they interact.

Basic Configuration

Release 6.0 07/2010

Synchronizing the System Time in the Network

7.1 Entering the Time

If no reference clock is available, you have the option of entering the system time in a device and then using it like a reference clock (see on page 102

“Configuring SNTP“), (see on page 112 “Application Example“).

Note: When setting the time in zones with summer and winter times, make an adjustment for the local offset. The device can also get the SNTP server IP address and the local offset from a DHCP server.

 Select the Time dialog.

With this dialog you can enter time-related settings independently of the time synchronization protocol selected.

X The “IEEE 1588 time” displays the time determined using PTP.

The “SNTP time” displays the time with reference to Universal Time Coordinated (UTC). The display is the same worldwide. Local time differences are not taken into account.

X The “System time” uses the “IEEE 1588 / SNTP time”, allowing for

the local time difference from “IEEE 1588 / SNTP time”. “System time” = “IEEE 1588 / SNTP time” + “Local offset”.

X “Time source” displays the source of the following time data. The

device automatically selects the source with the greatest accuracy. Possible sources are: local and sntp. The source is initially local. If SNTP is activated and if the device receives a valid SNTP packet, the device sets its time source to sntp.

Basic Configuration

Release 6.0 07/2010

Synchronizing the System Time in the

7.1 Entering the Time

Network

 With “Set time from PC”, the device takes the PC time as the system

time and calculates the IEEE 1588 / SNTP time using the local time difference. “IEEE 1588 / SNTP time” = “System time” - “Local offset”

 The “Local Offset” is for displaying/entering the time difference

between the local time and the “IEEE 1588 / SNTP time”.

With “Set offset from PC”, the agent determines the time zone on your PC and uses it to calculate the local time difference.

enable Switch to the Privileged EXEC mode. configure Switch to the Configuration mode. sntp time <YYYY-MM-DD

HH:MM:SS>

sntp client offset <-1000 to 1000>

Set the system time of the device.

Enter the time difference between the local time and the "IEEE 1588 / SNTP time".

Basic Configuration

Release 6.0 07/2010

Synchronizing the System Time in the

GPS

NTPServer

ServerClient

Client

Switch

PLC

ServerClient

Switch

ServerClient

Switch

192.168.1.1 192.168.1.2 192.168.1.3

192.168.1.0

7.2 SNTP

Network

7.2 SNTP

7.2.1 Description of SNTP

The Simple Network Time Protocol (SNTP) enables you to synchronize the system time in your network. The device supports the SNTP client and the SNTP server function. The SNTP server makes the UTC (Universal Time Coordinated) available. UTC is the time relating to the coordinated world time measurement. The time displayed is the same worldwide. Local time differences are not taken into account. The SNTP client obtains the UTC from the SNTP server.

Figure 25: SNTP cascade

100

Basic Configuration

Release 6.0 07/2010

Hirschmann RS20, RS30, MS30, OCTOPUS, MS20 Basic Configuration

Specifications and Main Features

Frequently Asked Questions

User Manual

Contents

About this Manual

Introduction

1 Access to the user interfaces

1.1 System Monitor

1.2 Command Line Interface

1.3 Web-based Interface

2 Entering the IP Parameters

2.1 IP Parameter Basics

2.1.1 IP address (version 4)

2.1.2 Netmask

2.1.3 Classless Inter-Domain Routing

2.2 Entering IP parameters via CLI

2.3 Entering the IP Parameters via HiDiscovery

2.4 Loading the system configuration from the ACA

2.5 System configuration via BOOTP

2.6 System Configuration via DHCP

2.7 System Configuration via DHCP Option 82

2.8 Web-based IP Configuration

2.9 Faulty Device Replacement

3 Loading/saving settings

3.1 Loading settings

3.1.1 Loading from the local non-volatile memory

3.1.2 Loading from the AutoConfiguration Adapter

3.1.3 Loading from a file

3.1.4 Resetting the configuration to the state on delivery

3.2 Saving settings

3.2.1 Saving locally (and on the ACA)

3.2.2 Saving to a file on URL

3.2.3 Saving to a binary file on the PC

3.2.4 Saving as a script on the PC

4 Loading Software Updates

4.1 Loading the Software manually from the ACA

4.1.1 Selecting the software to be loaded

4.1.2 Starting the software

4.1.3 Performing a cold start

4.2 Automatic software update by ACA

4.3 Loading the software from the tftp server

4.4 Loading the Software via File Selection

5 Configuring the Ports

Protection from Unauthorized Access

6.1 Protecting the device

6.2 Password for SNMP access

6.2.1 Description of password for SNMP access

6.2.2 Entering the password for SNMP access

6.3 Telnet/Web/SSH Access

6.3.1 Description of Telnet Access

6.3.2 Description of Web Access

6.3.3 Description of SSH Access

6.3.4 Enabling/disabling Telnet/Web/SSH Access

6.4 Restricted Management Access

6.5 HiDiscovery Access

6.5.1 Description of the HiDiscovery Protocol

6.5.2 Enabling/disabling the HiDiscovery Function

6.5.3 Description of the Port Access Control

6.5.4 Application Example for Port Access Control

6.6 Port Authentication IEEE 802.1X

6.6.1 Description of Port Authentication according to IEEE 802.1X

6.6.2 Authentication Process according to IEEE 802.1X

6.6.3 Preparing the Device for the IEEE 802.1X Port Authentication

6.6.4 IEEE 802.1X Settings

Synchronizing the System Time in the Network

7.1 Entering the Time

7.2 SNTP

7.2.1 Description of SNTP