LevelOne GTL-2690 User Manual

Download

LevelOne

GTL-2690

20GE + 4GE Combo SFP+2 10GE XFP Module slot

L3 SNMP Stackable Switch

Management Guide

version 1.0

ANAGEMENT

GTL-2690

Layer 3 SNMP Stackable Switch

UIDE

GTL-2690

E112009/AP-R01

149100000053A

About This Guide

Purpose

This guide gives specific information on how to operate and use the management functions of the switch.

Audience

The guide is intended for use by network administrators who are responsible for operating and maintaining network equipment; consequently, it assumes a basic working knowledge of general switch functions, the Internet Protocol (IP), and Simple Network Management Protocol (SNMP).

Conventions

The following conventions are used throughout this guide to show information:

Note: Emphasizes important information or calls your attention to related features or

instructions.

Caution: Alerts you to a potential hazard that could cause loss of data, or damage the

system or equipment.

Warning: Alerts you to a potential hazard that could cause personal injury.

Related Publications

The following publication details the hardware features of the switch, including the physical and performance-related characteristics, and how to install the switch:

The Installation Guide

Also, as part of the switch’s software, there is an online web-based help that describes all management related features.

Revision History

This section summarizes the changes in each revision of this guide.

November 2009 Revision

This is the first release of this guide.

Contents

Section I: Getting Started

Chapter 1: Introduction 1-1

Key Features 1-1 Description of Software Features 1-2 System Defaults 1-7

Chapter 2: Initial Configuration 2-1

Connecting to the Switch 2-1

Configuration Options 2-1 Required Connections 2-2 Remote Connections 2-3

Stack Operations 2-3

Selecting the Stack Master 2-3 Selecting the Backup Unit 2-4 Recovering from Stack Failure or Topology Change 2-4

Broken Link for Line and Wrap-around Topologies 2-4 Resilient IP Interface for Management Access 2-5

Resilient Configuration 2-5 Renumbering the Stack 2-5 Ensuring Consistent Code is Used Across the Stack 2-5

Basic Configuration 2-6

Console Connection 2-6 Setting Passwords 2-7 Setting an IP Address 2-7

Manual Configuration 2-8

Dynamic Configuration 2-11 Enabling SNMP Management Access 2-13

Community Strings (for SNMP version 1 and 2c clients) 2-13

Trap Receivers 2-14

Configuring Access for SNMP Version 3 Clients 2-15

Managing System Files 2-15

Saving Configuration Settings 2-16

Section II: Switch Management

Chapter 3: Configuring the Switch 3-1

Using the Web Interface 3-1 Navigating the Web Browser Interface 3-2

Home Page 3-2 Configuration Options 3-3 Panel Display 3-3

iii

Contents

Main Menu 3-4

Chapter 4: Basic Management Tasks 4-1

Displaying System Information 4-1 Displaying Switch Hardware/Software Versions 4-3 Displaying Bridge Extension Capabilities 4-4 Setting the Switch’s IP Address (IP Version 4) 4-5

Manual Configuration 4-7 Using DHCP/BOOTP 4-8

Setting the Switch’s IP Address (IP Version 6) 4-9

Configuring an IPv6 Address 4-9 Configuring an IPv6 General Network Prefix 4-15

Configuring Neighbor Detection Protocol and Static Entries 4-17 Configuring Support for Jumbo Frames 4-21 Managing Firmware 4-21

Downloading System Software from a Server 4-22 Saving or Restoring Configuration Settings 4-24

Downloading Configuration Settings from a Server 4-25 Console Port Settings 4-26 Telnet Settings 4-28 Configuring Event Logging 4-30

System Log Configuration 4-30

Remote Log Configuration 4-31

Displaying Log Messages 4-33

Sending Simple Mail Transfer Protocol Alerts 4-33 Renumbering the Stack 4-35 Resetting the System 4-36 Setting the System Clock 4-36

Setting the Current Time 4-37

Configuring SNTP 4-37

Setting the Time Zone 4-39

Configuring Summer Time 4-40

Chapter 5: Simple Network Management Protocol 5-1

Enabling the SNMP Agent 5-2 Setting Community Access Strings 5-3 Specifying Trap Managers and Trap Types 5-4 Configuring SNMPv3 Management Access 5-7

Setting a Local Engine ID 5-7

Specifying a Remote Engine ID 5-8

Configuring SNMPv3 Users 5-9

Configuring Remote SNMPv3 Users 5-11

Configuring SNMPv3 Groups 5-13

Setting SNMPv3 Views 5-17

Contents

Chapter 6: User Authentication 6-1

Configuring User Accounts 6-1 Configuring Local/Remote Logon Authentication 6-2 Configuring HTTPS 6-5

Replacing the Default Secure-site Certificate 6-7

Configuring the Secure Shell 6-8

Generating the Host Key Pair 6-10 Importing User Public Keys 6-12

Configuring the SSH Server 6-14 Configuring Port Security 6-16 Configuring 802.1X Port Authentication 6-18

Displaying 802.1X Global Settings 6-19

Configuring 802.1X Global Settings 6-20

Configuring Port Settings for 802.1X 6-20

Displaying 802.1X Statistics 6-24 Filtering IP Addresses for Management Access 6-26

Chapter 7: Access Control Lists 7-1

Configuring Access Control Lists 7-1

Setting the ACL Name and Type 7-1

Configuring a Standard IPv4 ACL 7-2

Configuring an Extended IPv4 ACL 7-3

Configuring a MAC ACL 7-6

Configuring a Standard IPv6 ACL 7-7

Configuring an Extended IPv6 ACL 7-8 Binding a Port to an Access Control List 7-11

Chapter 8: Port Configuration 8-1

Displaying Connection Status 8-1 Configuring Interface Connections 8-3 Creating Trunk Groups 8-6

Statically Configuring a Trunk 8-7

Enabling LACP on Selected Ports 8-8

Configuring LACP Parameters 8-10

Displaying LACP Port Counters 8-13

Displaying LACP Settings and Status for the Local Side 8-14

Displaying LACP Settings and Status for the Remote Side 8-16 Setting Broadcast Storm Thresholds 8-17 Configuring Port Mirroring 8-19 Configuring Rate Limits 8-20 Showing Port Statistics 8-22

Chapter 9: Address Table Settings 9-1

Setting Static Addresses 9-1 Displaying the Address Table 9-2 Changing the Aging Time 9-4

Contents

Chapter 10: Spanning Tree Algorithm 10-1

Displaying Global Settings 10-3 Configuring Global Settings 10-6 Displaying Interface Settings 10-10 Configuring Interface Settings 10-13 Configuring Multiple Spanning Trees 10-16 Displaying Interface Settings for MSTP 10-19 Configuring Interface Settings for MSTP 10-20

Chapter 11: VLAN Configuration 11-1

IEEE 802.1Q VLANs 11-1

Enabling or Disabling GVRP (Global Setting) 11-4 Displaying Basic VLAN Information 11-4 Displaying Current VLANs 11-5 Creating VLANs 11-6 Adding Static Members to VLANs (VLAN Index) 11-7 Adding Static Members to VLANs (Port Index) 11-9 Configuring VLAN Behavior for Interfaces 11-10

Configuring IEEE 802.1Q Tunneling 11-12

Enabling QinQ Tunneling on the Switch 11-16 Adding an Interface to a QinQ Tunnel 11-17

Configuring Private VLANs 11-18

Enabling Private VLANs 11-19 Configuring Uplink and Downlink Ports 11-19

Configuring Protocol-Based VLANs 11-20

Configuring Protocol Groups 11-20 Mapping Protocols to VLANs 11-21

Chapter 12: Link Layer Discovery Protocol 12-1

Setting Basic LLDP Timing Attributes 12-1 Configuring LLDP Interface Attributes 12-3 Displaying LLDP Local Device Information 12-5 Displaying LLDP Remote Port Information 12-8 Displaying LLDP Remote Information Details 12-9 Displaying Device Statistics 12-11 Displaying Detailed Device Statistics 12-13

Chapter 13: Class of Service 13-1

Layer 2 Queue Settings 13-1

Setting the Default Priority for Interfaces 13-1 Mapping CoS Values to Egress Queues 13-3 Selecting the Queue Mode 13-5 Setting the Service Weight for Traffic Classes 13-6

Layer 3/4 Priority Settings 13-7

Mapping Layer 3/4 Priorities to CoS Values 13-7 Selecting IP Precedence/DSCP Priority 13-7

Contents

Mapping IP Precedence 13-8

Mapping DSCP Priority 13-10

Mapping IP Port Priority 13-11

Chapter 14: Quality of Service 14-1

Configuring Quality of Service Parameters 14-1

Configuring a Class Map 14-2

Creating QoS Policies 14-4

Attaching a Policy Map to Ingress Queues 14-7

Chapter 15: Multicast Filtering 15-1

Layer 2 IGMP (Snooping and Query) 15-2

Configuring IGMP Snooping and Query Parameters 15-3

Enabling IGMP Immediate Leave 15-5

Displaying Interfaces Attached to a Multicast Router 15-6

Specifying Static Interfaces for a Multicast Router 15-7

Displaying Port Members of Multicast Services 15-8

Assigning Ports to Multicast Services 15-9

Chapter 16: Domain Name Service 16-1

Configuring General DNS Service Parameters 16-1 Configuring Static DNS Host to Address Entries 16-3 Displaying the DNS Cache 16-5

Chapter 17: Dynamic Host Configuration Protocol 17-1

Configuring DHCP Relay Service 17-1 Configuring the DHCP Server 17-2

Enabling the Server, Setting Excluded Addresses 17-3

Configuring Address Pools 17-4

Displaying Address Bindings 17-9

Chapter 18: Configuring Router Redundancy 18-1

Virtual Router Redundancy Protocol 18-2

Configuring VRRP Groups 18-2

Displaying VRRP Global Statistics 18-7

Displaying VRRP Group Statistics 18-8

Chapter 19: IP Routing 19-1

Overview 19-1

Initial Configuration 19-1 IP Switching 19-2

Routing Path Management 19-3

Routing Protocols 19-4 Basic IP Interface Configuration 19-4 Configuring IP Routing Interfaces 19-5 Address Resolution Protocol 19-8

Basic ARP Configuration 19-9

Configuring Static ARP Addresses 19-11

vii

Contents

Displaying Dynamically Learned ARP Entries 19-12 Displaying Local ARP Entries 19-13 Displaying ARP Statistics 19-14

Displaying Statistics for IP Protocols 19-16

IP Statistics 19-16 ICMP Statistics 19-17 UDP Statistics 19-19

TCP Statistics 19-20 Configuring Static Routes 19-21 Displaying the Routing Table 19-22

Chapter 20: Unicast Routing 20-1

Configuring the Routing Information Protocol 20-2

Configuring General Protocol Settings 20-3

Specifying Network Interfaces for RIP 20-5

Configuring Network Interfaces for RIP 20-6

Redistributing Routing Information from Other Domains 20-9

Displaying RIP Information and Statistics 20-11 Configuring the Open Shortest Path First Protocol 20-14

Configuring General Protocol Settings 20-15

Configuring OSPF Areas 20-19

Configuring Area Ranges (Route Summarization for ABRs) 20-23

Configuring OSPF Interfaces 20-25

Configuring Virtual Links 20-29

Configuring Network Area Addresses 20-31

Configuring Summary Addresses (for External AS Routes) 20-33

Redistributing External Routes 20-35

Configuring NSSA Settings 20-36

Displaying Link State Database Information 20-38

Displaying Information on Border Routers 20-40

Displaying Information on Neighbor Routers 20-41

Section III: Command Line Interface

Chapter 21: Overview of the Command Line Interface 21-1

Using the Command Line Interface 21-1

Accessing the CLI 21-1

Console Connection 21-1

Telnet Connection 21-1 Entering Commands 21-3

Keywords and Arguments 21-3

Minimum Abbreviation 21-3

Command Completion 21-3

Getting Help on Commands 21-3

Showing Commands 21-4

viii

Contents

Partial Keyword Lookup 21-5 Negating the Effect of Commands 21-5 Using Command History 21-5 Understanding Command Modes 21-6 Exec Commands 21-6 Configuration Commands 21-7 Command Line Processing 21-9

Command Groups 21-10

Chapter 22: General Commands 22-1

enable 22-1 disable 22-2 configure 22-2 show history 22-3 reload 22-4 prompt 22-4 end 22-4 exit 22-5 quit 22-5

Chapter 23: System Management Commands 23-1

Device Designation Commands 23-1

hostname 23-1 switch renumber 23-2

System Status Commands 23-3

show startup-config 23-3 show running-config 23-5 show system 23-7 show users 23-8 show version 23-8

Frame Size Commands 23-9

jumbo frame 23-9

File Management Commands 23-10

copy 23-11 delete 23-13 dir 23-14 whichboot 23-15 boot system 23-16

Line Commands 23-17

line 23-17 login 23-18 password 23-19 timeout login response 23-20 exec-timeout 23-20 password-thresh 23-21 silent-time 23-22

Contents

databits 23-22

parity 23-23

speed 23-23

stopbits 23-24

disconnect 23-24

show line 23-25 Event Logging Commands 23-26

logging on 23-26

logging history 23-27

logging host 23-28

logging facility 23-28

logging trap 23-29

clear log 23-29

show logging 23-30

show log 23-31 SMTP Alert Commands 23-32

logging sendmail host 23-32

logging sendmail level 23-33

logging sendmail source-email 23-33

logging sendmail destination-email 23-34

logging sendmail 23-34

show logging sendmail 23-35 Time Commands 23-35

sntp client 23-36

sntp server 23-37

sntp poll 23-37

sntp update-time 23-38

show sntp 23-38

clock timezone 23-39

clock timezone-predefined 23-39

clock summer-time (date) 23-40

clock summer-time (predefined) 23-41

clock summer-time (recurring) 23-42

show clock 23-43

calendar set 23-44

show calendar 23-44

Chapter 24: SNMP Commands 24-1

snmp-server 24-2 show snmp 24-2 snmp-server community 24-3 snmp-server contact 24-4 snmp-server location 24-4 snmp-server host 24-5 snmp-server enable traps 24-7

Contents

snmp-server engine-id 24-8 show snmp engine-id 24-9 snmp-server view 24-10 show snmp view 24-11 snmp-server group 24-11 show snmp group 24-12 snmp-server user 24-14 show snmp user 24-15

Chapter 25: User Authentication Commands 25-1

User Account Commands 25-1

username 25-2 enable password 25-3

Authentication Sequence 25-4

authentication login 25-4 authentication enable 25-5

RADIUS Client 25-6

radius-server host 25-6 radius-server port 25-7 radius-server key 25-7 radius-server retransmit 25-8 radius-server timeout 25-8 show radius-server 25-8

TACACS+ Client 25-9

tacacs-server host 25-9 tacacs-server port 25-10 tacacs-server key 25-10 show tacacs-server 25-11

Web Server Commands 25-11

ip http port 25-11 ip http server 25-12 ip http secure-server 25-12 ip http secure-port 25-13

Telnet Server Commands 25-14

ip telnet server 25-14

Secure Shell Commands 25-15

ip ssh server 25-17 ip ssh timeout 25-18 ip ssh authentication-retries 25-19 ip ssh server-key size 25-19 delete public-key 25-20 ip ssh crypto host-key generate 25-20 ip ssh crypto zeroize 25-21 ip ssh save host-key 25-21 show ip ssh 25-22

Contents

show ssh 25-22

show public-key 25-23 Port Security Commands 25-24

port security 25-25

802.1X Port Authentication 25-26

dot1x system-auth-control 25-27

dot1x default 25-27

dot1x max-req 25-27

dot1x port-control 25-28

dot1x operation-mode 25-29

dot1x re-authenticate 25-30

dot1x re-authentication 25-30

dot1x timeout quiet-period 25-31

dot1x timeout re-authperiod 25-31

dot1x timeout tx-period 25-32

show dot1x 25-32 Management IP Filter Commands 25-35

management 25-35

show management 25-36

Chapter 26: Access Control List Commands 26-1

IPv4 ACLs 26-1

access-list ip 26-2

permit, deny (Standard IPv4 ACL) 26-2

permit, deny (Extended IPv4 ACL) 26-3

show ip access-list 26-5

ip access-group 26-6

show ip access-group 26-6 IPv6 ACLs 26-7

access-list ipv6 26-7

permit, deny (Standard IPv6 ACL) 26-8

permit, deny (Extended IPv6 ACL) 26-9

show ipv6 access-list 26-11

ipv6 access-group 26-11

show ipv6 access-group 26-12 MAC ACLs 26-12

access-list mac 26-12

permit, deny (MAC ACL) 26-13

show mac access-list 26-15

mac access-group 26-15

show mac access-group 26-16 ACL Information 26-16

show access-list 26-16

show access-group 26-17

xii

Contents

Chapter 27: Interface Commands 27-1

interface 27-1 description 27-2 speed-duplex 27-3 negotiation 27-4 capabilities 27-4 flowcontrol 27-5 media-type 27-6 shutdown 27-7 switchport broadcast packet-rate 27-7 clear counters 27-8 show interfaces status 27-9 show interfaces counters 27-10 show interfaces switchport 27-11

Chapter 28: Link Aggregation Commands 28-1

channel-group 28-2 lacp 28-3 lacp system-priority 28-4 lacp admin-key (Ethernet Interface) 28-5 lacp admin-key (Port Channel) 28-6 lacp port-priority 28-6 show lacp 28-7

Chapter 29: Mirror Port Commands 29-1

port monitor 29-1 show port monitor 29-2

Chapter 30: Rate Limit Commands 30-1

rate-limit 30-1

Chapter 31: Address Table Commands 31-1

mac-address-table static 31-1 clear mac-address-table dynamic 31-2 show mac-address-table 31-3 mac-address-table aging-time 31-4 show mac-address-table aging-time 31-4

Chapter 32: LLDP Commands 32-1

lldp 32-2 lldp holdtime-multiplier 32-3 lldp notification-interval 32-3 lldp refresh-interval 32-4 lldp reinit-delay 32-5 lldp tx-delay 32-5 lldp admin-status 32-6 lldp notification 32-6

xiii

Contents

lldp basic-tlv management-ip-address 32-7 lldp basic-tlv port-description 32-8 lldp basic-tlv system-capabilities 32-8 lldp basic-tlv system-description 32-9 lldp basic-tlv system-name 32-9 lldp dot1-tlv proto-ident 32-10 lldp dot1-tlv proto-vid 32-10 lldp dot1-tlv pvid 32-11 lldp dot1-tlv vlan-name 32-11 lldp dot3-tlv link-agg 32-12 lldp dot3-tlv mac-phy 32-12 lldp dot3-tlv max-frame 32-13 lldp dot3-tlv poe 32-13 show lldp config 32-14 show lldp info local-device 32-15 show lldp info remote-device 32-16 show lldp info statistics 32-18

Chapter 33: Spanning Tree Commands 33-1

spanning-tree 33-2 spanning-tree mode 33-2 spanning-tree forward-time 33-4 spanning-tree hello-time 33-4 spanning-tree max-age 33-5 spanning-tree priority 33-6 spanning-tree pathcost method 33-6 spanning-tree transmission-limit 33-7 spanning-tree mst-configuration 33-7 mst vlan 33-8 mst priority 33-9 name 33-9 revision 33-10 max-hops 33-11 spanning-tree spanning-disabled 33-11 spanning-tree cost 33-12 spanning-tree port-priority 33-13 spanning-tree edge-port 33-13 spanning-tree portfast 33-14 spanning-tree link-type 33-15 spanning-tree mst cost 33-16 spanning-tree mst port-priority 33-17 spanning-tree protocol-migration 33-17 show spanning-tree 33-18 show spanning-tree mst configuration 33-20

xiv

Contents

Chapter 34: VLAN Commands 34-1

GVRP and Bridge Extension Commands 34-1

bridge-ext gvrp 34-2 show bridge-ext 34-2 switchport gvrp 34-3 show gvrp configuration 34-3 garp timer 34-4 show garp timer 34-5

Editing VLAN Groups 34-5

vlan database 34-5 vlan 34-6

Configuring VLAN Interfaces 34-7

interface vlan 34-7 switchport mode 34-8 switchport acceptable-frame-types 34-9 switchport ingress-filtering 34-9 switchport native vlan 34-10 switchport allowed vlan 34-11 switchport forbidden vlan 34-12

Displaying VLAN Information 34-12

show vlan 34-13

Configuring IEEE 802.1Q Tunneling 34-14

dot1q-tunnel system-tunnel-control 34-15 switchport dot1q-tunnel mode 34-15 switchport dot1q-tunnel tpid 34-16 show dot1q-tunnel 34-17

Configuring Private VLANs 34-18

pvlan 34-18 show pvlan 34-19

Configuring Protocol-based VLANs 34-20

protocol-vlan protocol-group (Configuring Groups) 34-20 protocol-vlan protocol-group (Configuring Interfaces) 34-21 show protocol-vlan protocol-group 34-22 show interfaces protocol-vlan protocol-group 34-22

Chapter 35: Class of Service Commands 35-1

Priority Commands (Layer 2) 35-1

queue mode 35-2 switchport priority default 35-3 queue bandwidth 35-4 queue cos-map 35-4 show queue mode 35-5 show queue bandwidth 35-6 show queue cos-map 35-6

Contents

Priority Commands (Layer 3 and 4) 35-7

map ip port (Global Configuration) 35-7

map ip port (Interface Configuration) 35-8

map ip precedence (Global Configuration) 35-8

map ip precedence (Interface Configuration) 35-9

map ip dscp (Global Configuration) 35-10

map ip dscp (Interface Configuration) 35-10

show map ip port 35-11

show map ip precedence 35-12

show map ip dscp 35-13

Chapter 36: Quality of Service Commands 36-1

class-map 36-2 match 36-3 rename 36-4 description 36-4 policy-map 36-5 class 36-5 set 36-6 police 36-7 service-policy 36-8 show class-map 36-9 show policy-map 36-9 show policy-map interface 36-10

Chapter 37: Multicast Filtering Commands 37-1

IGMP Snooping Commands 37-1

ip igmp snooping 37-1

ip igmp snooping vlan static 37-2

ip igmp snooping version 37-2

ip igmp snooping immediate-leave 37-3

show ip igmp snooping 37-4

show mac-address-table multicast 37-4 IGMP Query Commands 37-5

ip igmp snooping querier 37-5

ip igmp snooping query-count 37-6

ip igmp snooping query-interval 37-7

ip igmp snooping query-max-response-time 37-7

ip igmp snooping router-port-expire-time 37-8 Static Multicast Routing Commands 37-9

ip igmp snooping vlan mrouter 37-9

show ip igmp snooping mrouter 37-10

Chapter 38: Domain Name Service Commands 38-1

ip host 38-1 clear host 38-2

xvi

Contents

ip domain-name 38-3 ip domain-list 38-3 ip name-server 38-4 ip domain-lookup 38-5 show hosts 38-6 show dns 38-7 show dns cache 38-7 clear dns cache 38-8

Chapter 39: DHCP Commands 39-1

DHCP Client 39-1

ip dhcp client-identifier 39-1 ip dhcp restart client 39-2

DHCP Relay 39-3

ip dhcp restart relay 39-3 ip dhcp relay server 39-4

DHCP Server 39-5

service dhcp 39-5 ip dhcp excluded-address 39-6 ip dhcp pool 39-6 network 39-7 default-router 39-8 domain-name 39-8 dns-server 39-9 next-server 39-9 bootfile 39-10 netbios-name-server 39-10 netbios-node-type 39-11 lease 39-11 host 39-12 client-identifier 39-13 hardware-address 39-14 clear ip dhcp binding 39-14 show ip dhcp binding 39-15

Chapter 40: Router Redundancy Commands 40-1

Virtual Router Redundancy Protocol Commands 40-1

vrrp ip 40-2 vrrp authentication 40-3 vrrp priority 40-3 vrrp timers advertise 40-4 vrrp preempt 40-5 show vrrp 40-6 show vrrp interface 40-8 show vrrp router counters 40-9 show vrrp interface counters 40-9

xvii

Contents

clear vrrp router counters 40-10

clear vrrp interface counters 40-10

Chapter 41: IP Interface Commands 41-1

Basic IP Configuration 41-1

ip address 41-3

ip default-gateway 41-4

show ip interface 41-5

show ip redirects 41-5

ping 41-6

ipv6 enable 41-7

ipv6 general-prefix 41-8

show ipv6 general-prefix 41-9

ipv6 address 41-9

ipv6 address autoconfig 41-10

ipv6 address eui-64 41-12

ipv6 address link-local 41-13

show ipv6 interface 41-14

ipv6 default-gateway 41-17

show ipv6 default-gateway 41-17

ipv6 mtu 41-18

show ipv6 mtu 41-19

show ipv6 traffic 41-19

clear ipv6 traffic 41-25

ping ipv6 41-25

ipv6 neighbor 41-26

ipv6 nd dad attempts 41-27

ipv6 nd ns interval 41-29

show ipv6 neighbors 41-30

clear ipv6 neighbors 41-32 Address Resolution Protocol (ARP) 41-32

arp 41-32

arp timeout 41-33

clear arp-cache 41-34

show arp 41-34

ip proxy-arp 41-35

Chapter 42: IP Routing Commands 42-1

Global Routing Configuration 42-1

ip routing 42-1

ip route 42-2

clear ip route 42-3

show ip route 42-3

show ip host-route 42-4

show ip traffic 42-5

xviii

Contents

Routing Information Protocol (RIP) 42-5

router rip 42-6 default-metric 42-7 timers basic 42-8 network 42-9 neighbor 42-9 version 42-10 redistribute 42-11 ip rip receive version 42-12 ip rip send version 42-13 ip split-horizon 42-14 ip rip authentication key 42-14 ip rip authentication mode 42-15 show rip globals 42-16 show ip rip 42-16

Open Shortest Path First (OSPF) 42-18

router ospf 42-19 router-id 42-20 compatible rfc1583 42-20 default-information originate 42-21 timers spf 42-22 area range 42-23 area default-cost 42-24 summary-address 42-24 redistribute 42-25 network area 42-26 area stub 42-27 area nssa 42-28 area virtual-link 42-30 ip ospf authentication 42-32 ip ospf authentication-key 42-33 ip ospf message-digest-key 42-34 ip ospf cost 42-35 ip ospf dead-interval 42-36 ip ospf hello-interval 42-36 ip ospf priority 42-37 ip ospf retransmit-interval 42-38 ip ospf transmit-delay 42-38 show ip ospf 42-39 show ip ospf border-routers 42-40 show ip ospf database 42-41 show ip ospf interface 42-49 show ip ospf neighbor 42-50 show ip ospf summary-address 42-51 show ip ospf virtual-links 42-51

xix

Contents

Section IV: Appendices

Appendix A: Software Specifications A-1

Software Features A-1 Management Features A-2 Standards A-2 Management Information Bases A-3

Appendix B: Troubleshooting B-1

Problems Accessing the Management Interface B-1 Using System Logs B-2

Glossary

Index

Tables

Table 1-1 Key Features 1-1 Table 1-2 System Defaults 1-7 Table 3-1 Web Page Configuration Buttons 3-3 Table 3-2 Switch Main Menu 3-4 Table 4-1 Logging Levels 4-30 Table 5-1 SNMPv3 Security Models and Levels 5-2 Table 5-2 Supported Notification Messages 5-14 Table 6-1 HTTPS System Support 6-6 Table 6-2 802.1X Statistics 6-24 Table 8-1 LACP Port Counters 8-13 Table 8-2 LACP Internal Configuration Information 8-14 Table 8-3 LACP Neighbor Configuration Information 8-16 Table 8-4 Port Statistics 8-22 Table 10-4 Recommended STA Path Cost Range 10-14 Table 10-5 Default STA Path Costs 10-14 Table 10-9 Recommended STA Path Cost Range 10-21 Table 10-10 Default STA Path Costs 10-21 Table 13-1 Mapping CoS Values to Egress Queues 13-3 Table 13-2 CoS Priority Levels 13-3 Table 13-3 Mapping IP Precedence 13-8 Table 13-4 Mapping DSCP Priority 13-10 Table 19-1 Address Resolution Protocol 19-8 Table 19-2 ARP Statistics 19-14 Table 19-3 IP Statistics 19-16 Table 19-4 ICMP Statistics 19-17 Table 19-5 USP Statistics 19-19 Table 19-6 TCP Statistics 19-20 Table 20-1 RIP Information and Statistics 20-11 Table 21-1 General Command Modes 21-6 Table 21-2 Configuration Command Modes 21-8 Table 21-3 Keystroke Commands 21-9 Table 21-4 Command Group Index 21-10 Table 22-1 General Commands 22-1 Table 23-1 System Management Commands 23-1 Table 23-2 Device Designation Commands 23-1 Table 23-3 System Status Commands 23-3 Table 23-4 Frame Size Commands 23-9 Table 23-5 Flash/File Commands 23-10 Table 23-6 File Directory Information 23-15 Table 23-7 Line Commands 23-17 Table 23-8 Event Logging Commands 23-26 Table 23-9 Logging Levels 23-27

xxi

Tables

Table 23-10 show logging flash/ram - display description 23-30 Table 23-11 show logging trap - display description 23-31 Table 23-12 SMTP Alert Commands 23-32 Table 23-13 Time Commands 23-35 Table 24-1 SNMP Commands 24-1 Table 24-2 show snmp engine-id - display description 24-9 Table 24-3 show snmp view - display description 24-11 Table 24-4 show snmp group - display description 24-13 Table 24-5 show snmp user - display description 24-15 Table 25-1 Authentication Commands 25-1 Table 25-2 User Access Commands 25-1 Table 25-3 Default Login Settings 25-2 Table 25-4 Authentication Sequence Commands 25-4 Table 25-5 RADIUS Client Commands 25-6 Table 25-6 TACACS+ Client Commands 25-9 Table 25-7 Web Server Commands 25-11 Table 25-8 HTTPS System Support 25-13 Table 25-9 Telnet Server Commands 25-14 Table 25-10 Secure Shell Commands 25-15 Table 25-11 show ssh - display description 25-22 Table 25-12 Port Security Commands 25-24 Table 25-13 802.1X Port Authentication Commands 25-26 Table 25-14 IP Filter Commands 25-35 Table 26-1 Access Control List Commands 26-1 Table 26-2 IPv4 ACL Commands 26-1 Table 26-3 IPv6 ACL Commands 26-7 Table 26-4 MAC ACL Commands 26-12 Table 26-5 ACL Information Commands 26-16 Table 27-1 Interface Commands 27-1 Table 27-2 show interfaces switchport - display description 27-11 Table 28-1 Link Aggregation Commands 28-1 Table 28-2 show lacp counters - display description 28-8 Table 28-3 show lacp internal - display description 28-8 Table 28-4 show lacp neighbors - display description 28-9 Table 28-5 show lacp sysid - display description 28-10 Table 29-1 Mirror Port Commands 29-1 Table 30-1 Rate Limit Commands 30-1 Table 31-1 Address Table Commands 31-1 Table 33-1 Spanning Tree Commands 33-1 Table 33-2 Recommended STA Path Cost Range 33-12 Table 33-3 Default STA Path Costs 33-12 Table 34-1 VLAN Commands 34-1 Table 34-2 GVRP and Bridge Extension Commands 34-1 Table 34-3 Commands for Editing VLAN Groups 34-5 Table 34-4 Commands for Configuring VLAN Interfaces 34-7

xxii

Tables

Table 34-5 Commands for Displaying VLAN Information 34-12 Table 34-7 Private VLAN Commands 34-18 Table 34-8 Protocol-based VLAN Commands 34-20 Table 35-1 Priority Commands 35-1 Table 35-2 Priority Commands (Layer 2) 35-1 Table 35-3 Default CoS Priority Levels 35-5 Table 35-4 Priority Commands (Layer 3 and 4) 35-7 Table 35-5 Mapping IP Precedence to CoS Values 35-9 Table 35-6 Mapping IP DSCP to CoS Values 35-11 Table 36-1 Quality of Service Commands 36-1 Table 37-1 Multicast Filtering Commands 37-1 Table 37-2 IGMP Snooping Commands 37-1 Table 37-3 IGMP Query Commands 37-5 Table 37-4 Static Multicast Routing Commands 37-9 Table 38-1 DNS Commands 38-1 Table 38-2 show dns cache - display description 38-7 Table 39-1 DHCP Commands 39-1 Table 39-2 DHCP Client Commands 39-1 Table 39-3 DHCP Relay Commands 39-3 Table 39-4 DHCP Server Commands 39-5 Table 40-1 Router Redundancy Commands 40-1 Table 40-2 VRRP Commands 40-1 Table 40-3 show vrrp - display description 40-7 Table 40-4 show vrrp brief - display description 40-8 Table 41-1 IP Interface Commands 41-1 Table 41-2 Basic IP Configuration Commands 41-1 Table 41-3 show ipv6 interface - display description 41-15 Table 41-4 show ipv6 mtu - display description 41-19 Table 41-5 show ipv6 traffic - display description 41-21 Table 41-6 show ipv6 neighbors - display description 41-31 Table 41-7 Address Resolution Protocol Commands 41-32 Table 42-1 IP Routing Commands 42-1 Table 42-2 Global Routing Configuration Commands 42-1 Table 42-3 show ip route - display description 42-4 Table 42-4 show ip host-route - display description 42-4 Table 42-5 Routing Information Protocol Commands 42-5 Table 42-6 show rip globals - display description 42-16 Table 42-7 show ip rip - display description 42-17 Table 42-8 Open Shortest Path First Commands 42-18 Table 42-9 show ip ospf - display description 42-39 Table 42-10 show ip ospf border-routers - display description 42-40 Table 42-11 show ip ospf database - display description 42-42 Table 42-12 show ip ospf asbr-summary - display description 42-43 Table 42-13 show ip ospf database-summary - display description 42-44 Table 42-14 show ip ospf external - display description 42-45

xxiii

Tables

Table 42-15 show ip ospf network - display description 42-46 Table 42-16 show ip ospf router - display description 42-47 Table 42-17 show ip ospf summary - display description 42-48 Table 42-18 show ip ospf interface - display description 42-49 Table 42-19 show ip ospf neighbor - display description 42-50 Table 42-20 show ip ospf virtual-links - display description 42-51 Table B-1 Troubleshooting Chart B-1

xxiv

Figures

Figure 3-1 Home Page 3-2 Figure 3-2 Front Panel Indicators 3-3 Figure 4-1 System Information 4-2 Figure 4-2 Switch Information 4-3 Figure 4-3 Displaying Bridge Extension Configuration 4-5 Figure 4-4 IPv4 Interface Configuration - Manual 4-7 Figure 4-5 Default Gateway 4-7 Figure 4-6 IPv4 Interface Configuration - DHCP 4-8 Figure 4-7 IPv6 Interface Configuration 4-14 Figure 4-8 IPv6 General Prefix Configuration 4-16 Figure 4-9 IPv6 Neighbor Detection and Neighbor Cache 4-19 Figure 4-10 Configuring Support for Jumbo Frames 4-21 Figure 4-11 Copy Firmware 4-22 Figure 4-12 Setting the Startup Code 4-23 Figure 4-13 Deleting Files 4-23 Figure 4-14 Downloading Configuration Settings for Start-Up 4-25 Figure 4-15 Setting the Startup Configuration Settings 4-25 Figure 4-16 Configuring the Console Port 4-27 Figure 4-17 Configuring the Telnet Interface 4-29 Figure 4-18 System Logs 4-31 Figure 4-19 Remote Logs 4-32 Figure 4-20 Displaying Logs 4-33 Figure 4-21 Enabling and Configuring SMTP Alerts 4-34 Figure 4-22 Renumbering the Stack 4-36 Figure 4-23 Resetting the System 4-36 Figure 4-24 Current Time 4-37 Figure 4-25 SNTP Configuration 4-38 Figure 4-26 Clock Time Zone 4-39 Figure 4-27 Summer Time 4-41 Figure 5-1 Enabling the SNMP Agent 5-2 Figure 5-2 Configuring SNMP Community Strings 5-3 Figure 5-3 Configuring SNMP Trap Managers 5-6 Figure 5-4 Setting the SNMPv3 Engine ID 5-7 Figure 5-5 Setting an Engine ID 5-8 Figure 5-6 Configuring SNMPv3 Users 5-10 Figure 5-7 Configuring Remote SNMPv3 Users 5-12 Figure 5-8 Configuring SNMPv3 Groups 5-16 Figure 5-9 Configuring SNMPv3 Views 5-17 Figure 6-1 User Accounts 6-2 Figure 6-2 Authentication Server Settings 6-4 Figure 6-3 HTTPS Settings 6-6 Figure 6-4 HTTPS Settings 6-7

xxv

Figures

Figure 6-5 SSH Host-Key Settings 6-11 Figure 6-6 SSH User Public-Key Settings 6-13 Figure 6-7 SSH Server Settings 6-15 Figure 6-8 Port Security 6-17 Figure 6-9 802.1X Global Information 6-19 Figure 6-10 802.1X Global Configuration 6-20 Figure 6-11 802.1X Port Configuration 6-22 Figure 6-12 802.1X Port Statistics 6-25 Figure 6-13 IP Filter 6-27 Figure 7-1 Selecting ACL Type 7-2 Figure 7-2 ACL Configuration - Standard IPv4 7-3 Figure 7-3 ACL Configuration - Extended IPv4 7-5 Figure 7-4 ACL Configuration - MAC 7-7 Figure 7-5 ACL Configuration - Standard IPv6 7-8 Figure 7-6 ACL Configuration - Extended IPv6 7-10 Figure 7-7 ACL Port Binding 7-11 Figure 8-1 Port - Port Information 8-1 Figure 8-2 Port - Port Configuration 8-5 Figure 8-3 Static Trunk Configuration 8-7 Figure 8-4 LACP Trunk Configuration 8-9 Figure 8-5 LACP - Aggregation Port 8-11 Figure 8-6 LACP - Port Counters Information 8-13 Figure 8-7 LACP - Port Internal Information 8-15 Figure 8-8 LACP - Port Neighbors Information 8-16 Figure 8-9 Port Broadcast Control 8-18 Figure 8-10 Mirror Port Configuration 8-19 Figure 8-11 Rate Limit Configuration 8-21 Figure 8-12 Port Statistics 8-25 Figure 9-1 Static Addresses 9-2 Figure 9-2 Dynamic Addresses 9-3 Figure 9-3 Address Aging 9-4 Figure 10-1 STA Information 10-4 Figure 10-2 STA Global Configuration 10-9 Figure 10-3 STA Port Information 10-12 Figure 10-6 STA Port Configuration 10-15 Figure 10-7 MSTP VLAN Configuration 10-17 Figure 10-8 MSTP Port Information 10-19 Figure 10-11 MSTP Port Configuration 10-21 Figure 11-1 Globally Enabling GVRP 11-4 Figure 11-2 VLAN Basic Information 11-4 Figure 11-3 VLAN Current Table 11-5 Figure 11-4 VLAN Static List - Creating VLANs 11-7 Figure 11-5 VLAN Static Table - Adding Static Members 11-8 Figure 11-6 VLAN Static Membership by Port 11-9 Figure 11-7 VLAN Port Configuration 11-11

xxvi

Figures

Figure 11-1 802.1Q Tunnel Status and Ethernet Type 11-16 Figure 11-2 Tunnel Port Configuration 11-18 Figure 11-8 Private VLAN Status 11-19 Figure 11-9 Private VLAN Link Status 11-19 Figure 11-10 Protocol VLAN Configuration 11-21 Figure 11-11 Protocol VLAN Port Configuration 11-22 Figure 12-4 LLDP Configuration 12-2 Figure 12-5 LLDP Port Configuration 12-4 Figure 12-6 LLDP Local Device Information 12-7 Figure 12-7 LLDP Remote Port Information 12-8 Figure 12-8 LLDP Remote Information Details 12-10 Figure 12-9 LLDP Device Statistics 12-12 Figure 12-10 LLDP Device Statistics Details 12-13 Figure 13-1 Default Port Priority 13-2 Figure 13-2 Traffic Classes 13-4 Figure 13-3 Queue Mode 13-5 Figure 13-4 Queue Scheduling 13-6 Figure 13-5 IP Precedence/DSCP Priority Status 13-8 Figure 13-6 IP Precedence Priority 13-9 Figure 13-7 IP DSCP Priority 13-10 Figure 13-8 IP Port Priority Status 13-11 Figure 13-9 IP Port Priority 13-12 Figure 14-1 Configuring Class Maps 14-3 Figure 14-2 Configuring Policy Maps 14-6 Figure 14-3 Service Policy Settings 14-7 Figure 15-1 IGMP Configuration 15-4 Figure 15-1 IGMP Immediate Leave 15-5 Figure 15-2 Multicast Router Port Information 15-6 Figure 15-3 Static Multicast Router Port Configuration 15-7 Figure 15-4 IP Multicast Registration Table 15-8 Figure 15-5 IGMP Member Port Table 15-9 Figure 16-1 DNS General Configuration 16-2 Figure 16-2 DNS Static Host Table 16-4 Figure 16-3 DNS Cache 16-5 Figure 17-1 DHCP Relay Configuration 17-2 Figure 17-2 DHCP Server General Configuration 17-3 Figure 17-3 DHCP Server Pool Configuration 17-6 Figure 17-4 DHCP Server Pool - Network Configuration 17-7 Figure 17-5 DHCP Server Pool - Host Configuration 17-8 Figure 17-6 DHCP Server - IP Binding 17-9 Figure 18-1 VRRP Group Configuration 18-5 Figure 18-2 VRRP Group Configuration Detail 18-6 Figure 18-3 VRRP Global Statistics 18-7 Figure 18-4 VRRP Group Statistics 18-9 Figure 19-1 IP Global Settings 19-5

xxvii

Figures

Figure 19-2 IP Routing Interface 19-7 Figure 19-3 ARP General 19-10 Figure 19-4 ARP Static Addresses 19-11 Figure 19-5 ARP Dynamic Addresses 19-13 Figure 19-6 ARP Other Addresses 19-14 Figure 19-7 ARP Statistics 19-15 Figure 19-8 IP Statistics 19-17 Figure 19-9 ICMP Statistics 19-18 Figure 19-10 UDP Statistics 19-19 Figure 19-11 TCP Statistics 19-20 Figure 19-12 IP Static Routes 19-22 Figure 19-13 IP Routing Table 19-23 Figure 20-1 RIP General Settings 20-4 Figure 20-2 RIP Network Addresses 20-5 Figure 20-3 RIP Interface Settings 20-8 Figure 20-4 RIP Redistribution Configuration 20-10 Figure 20-5 RIP Statistics 20-12 Figure 20-6 OSPF General Configuration 20-18 Figure 20-7 OSPF Area Configuration 20-22 Figure 20-8 OSPF Range Configuration 20-24 Figure 20-9 OSPF Interface Configuration 20-28 Figure 20-10 OSPF Interface Configuration - Detailed 20-28 Figure 20-11 OSPF Virtual Link Configuration 20-30 Figure 20-12 OSPF Network Area Address Configuration 20-32 Figure 20-13 OSPF Summary Address Configuration 20-34 Figure 20-14 OSPF Redistribute Configuration 20-36 Figure 20-15 OSPF NSSA Settings 20-37 Figure 20-16 OSPF Link State Database Information 20-39 Figure 20-17 OSPF Border Router Information 20-40 Figure 20-18 OSPF Neighbor Information 20-41

xxviii

Section I: Getting Started

This section provides an overview of the switch, and introduces some basic concepts about network switches. It also describes the basic settings required to access the management interface.

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1

Initial Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-1

Getting Started

Chapter 1: Introduction

This switch provides a broad range of features for Layer 2 switching and Layer 3 routing. It includes a management agent that allows you to configure the features listed in this manual. The default configuration can be used for most of the features provided by this switch. However, there are many options that you should configure to maximize the switch’s performance for your particular network environment.

Key Features

Table 1-1 Key Features

Feature Description

Configuration Backup

and Restore

Authentication Console, Telnet, web – User name / password, RADIUS, TACACS+

Access Control Lists Supports up to 256 ACLs, 96 MAC rules, 96 IP rules, and 96 IPv6 rules

DHCP Client, Relay

and Server

DNS Client and Proxy service

Port Configuration Speed and duplex mode and flow control

Rate Limiting Input and output rate limiting per port

Port Mirroring One or more ports mirrored to single analysis port

Port Trunking Supports up to 32 trunks using either static or dynamic trunking (LACP)

Broadcast Storm

Control

Address Table Up to 16K MAC addresses in the forwarding table, 1024 static MAC addresses;

IP Version 4 and 6 Supports IPv4 and IPv6 addressing, management, and QoS

IEEE 802.1D Bridge Supports dynamic data switching and addresses learning

Store-and-Forward

Switching

Backup to TFTP server

Web – HTTPS Telnet – SSH SNMP v1/2c - Community strings SNMP version 3 – MD5 or SHA password Port – IEEE 802.1X, MAC address filtering

Supported

Up to 2K IPv4 and 1K IPv6 entries in the host table, 4K entries in the ARP cache; 256 IPv4 and 256 IPv6 entries in the IP routing table, 64 static IP routes; 32 IP interfaces

Supported to ensure wire-speed switching while eliminating bad frames

1-1

Introduction

Table 1-1 Key Features (Continued)

Feature Description

Spanning Tree Algorithm

Virtual LANs Up to 256 using IEEE 802.1Q, port-based, protocol-based, or private VLANs

Traffic Prioritization Default port priority, traffic class map, queue scheduling, IP Precedence, or

Qualify of Service Supports Differentiated Services (DiffServ)

Router Redundancy Router backup is provided with the Virtual Router Redundancy Protocol (VRRP)

IP Routing Routing Information Protocol (RIP), Open Shortest Path First (OSPF), static routes

ARP Static and dynamic address configuration, proxy ARP

Multicast Filtering Supports IGMP snooping and query

Supports standard STP, Rapid Spanning Tree Protocol (RSTP), and Multiple Spanning Trees (MSTP)

Differentiated Services Code Point (DSCP), and TCP/UDP Port

Description of Software Features

The switch provides a wide range of advanced performance enhancing features. Flow control eliminates the loss of packets due to bottlenecks caused by port saturation. Broadcast storm suppression prevents broadcast traffic storms from engulfing the network. Untagged (port-based), tagged, and protocol-based VLANs, plus support for automatic GVRP VLAN registration provide traffic security and efficient use of network bandwidth. CoS priority queueing ensures the minimum delay for moving real-time multimedia data across the network. While multicast filtering provides support for real-time network applications. Some of the management features are briefly described below.

Configuration Backup and Restore – You can save the current configuration settings to a file on a TFTP server, and later download this file to restore the switch configuration settings.

Authentication – This switch authenticates management access via the console port, Telnet or web browser. User names and passwords can be configured locally or can be verified via a remote authentication server (i.e., RADIUS or TACACS+). Port-based authentication is also supported via the IEEE 802.1X protocol. This protocol uses Extensible Authentication Protocol over LANs (EAPOL) to request user credentials from the 802.1X client, and then uses the EAP between the switch and the authentication server to verify the client’s right to access the network via an authentication server (i.e., RADIUS server).

Other authentication options include HTTPS for secure management access via the web, SSH for secure management access over a Telnet-equivalent connection, SNMP Version 3, IP address filtering for SNMP/web/Telnet management access, and MAC address filtering for port access.

1-2

Description of Software Features

Access Control Lists – ACLs provide packet filtering for IP frames (based on address, protocol, TCP/UDP port number or TCP control code) or any frames (based on MAC address or Ethernet type). ACLs can by used to improve performance by blocking unnecessary network traffic or to implement security controls by restricting access to specific network resources or protocols.

DHCP Server and DHCP Relay – A DHCP server is provided to assign IP addresses to host devices. Since DHCP uses a broadcast mechanism, a DHCP server and its client must physically reside on the same subnet. Since it is not practical to have a DHCP server on every subnet, DHCP Relay is also supported to allow dynamic configuration of local clients from a DHCP server located in a different network.

Port Configuration – You can manually configure the speed and duplex mode, and flow control used on specific ports, or use auto-negotiation to detect the connection settings used by the attached device. Use the full-duplex mode on ports whenever possible to double the throughput of switch connections. Flow control should also be enabled to control network traffic during periods of congestion and prevent the loss of packets when port buffer thresholds are exceeded. The switch supports flow control based on the IEEE 802.3x standard.

Rate Limiting – This feature controls the maximum rate for traffic transmitted or received on an interface. Rate limiting is configured on interfaces at the edge of a network to limit traffic into or out of the network. Traffic that falls within the rate limit is transmitted, while packets that exceed the acceptable amount of traffic are dropped.

Port Mirroring – The switch can unobtrusively mirror traffic from any port to a monitor port. You can then attach a protocol analyzer or RMON probe to this port to perform traffic analysis and verify connection integrity.

Port Trunking – Ports can be combined into an aggregate connection. Trunks can be manually set up or dynamically configured using IEEE 802.3-2005 (formerly IEEE 802.3ad) Link Aggregation Control Protocol (LACP). The additional ports dramatically increase the throughput across any connection, and provide redundancy by taking over the load if a port in the trunk should fail. The switch supports up to 32 trunks.

Broadcast Storm Control – Broadcast suppression prevents broadcast traffic from overwhelming the network. When enabled on a port, the level of broadcast traffic passing through the port is restricted. If broadcast traffic rises above a pre-defined threshold, it will be throttled until the level falls back beneath the threshold.

Static Addresses – A static address can be assigned to a specific interface on this switch. Static addresses are bound to the assigned interface and will not be moved. When a static address is seen on another interface, the address will be ignored and will not be written to the address table. Static addresses can be used to provide network security by restricting access for a known host to a specific port.

1-3

Introduction

IEEE 802.1D Bridge – The switch supports IEEE 802.1D transparent bridging. The address table facilitates data switching by learning addresses, and then filtering or forwarding traffic based on this information. The address table supports up to 16K addresses.

Store-and-Forward Switching – The switch copies each frame into its memory before forwarding them to another port. This ensures that all frames are a standard Ethernet size and have been verified for accuracy with the cyclic redundancy check (CRC). This prevents bad frames from entering the network and wasting bandwidth.

To avoid dropping frames on congested ports, the switch provides 2 MB for frame buffering. This buffer can queue packets awaiting transmission on congested networks.

Spanning Tree Algorithm – The switch supports these spanning tree protocols:

Spanning Tree Protocol (STP, IEEE 802.1D) – This protocol provides loop detection. When there are multiple physical paths between segments, this protocol will choose a single path and disable all others to ensure that only one route exists between any two stations on the network. This prevents the creation of network loops. However, if the chosen path should fail for any reason, an alternate path will be activated to maintain the connection.

Rapid Spanning Tree Protocol (RSTP, IEEE 802.1w) – This protocol reduces the convergence time for network topology changes to about 3 to 5 seconds, compared to 30 seconds or more for the older IEEE 802.1D STP standard. It is intended as a complete replacement for STP, but can still interoperate with switches running the older standard by automatically reconfiguring ports to STP-compliant mode if they detect STP protocol messages from attached devices.

Multiple Spanning Tree Protocol (MSTP, IEEE 802.1s) – This protocol is a direct extension of RSTP. It can provide an independent spanning tree for different VLANs. It simplifies network management, provides for even faster convergence than RSTP by limiting the size of each region, and prevents VLAN members from being segmented from the rest of the group (as sometimes occurs with IEEE 802.1D STP).

Virtual LANs – The switch supports up to 255 VLANs. A Virtual LAN is a collection of network nodes that share the same collision domain regardless of their physical location or connection point in the network. The switch supports tagged VLANs based on the IEEE 802.1Q standard. Members of VLAN groups can be dynamically learned via GVRP, or ports can be manually assigned to a specific set of VLANs. This allows the switch to restrict traffic to the VLAN groups to which a user has been assigned. By segmenting your network into VLANs, you can:

• Eliminate broadcast storms which severely degrade performance in a flat network.

• Simplify network management for node changes/moves by remotely configuring VLAN membership for any port, rather than having to manually change the network connection.

• Provide data security by restricting all traffic to the originating VLAN, except where a connection is explicitly defined via the switch’s routing service.

1-4

Description of Software Features

• Use private VLANs to restrict traffic to pass only between data ports and the uplink

ports, thereby isolating adjacent ports within the same VLAN, and allowing you to limit the total number of VLANs that need to be configured.

• Use protocol VLANs to restrict traffic to specified interfaces based on protocol type.

Traffic Prioritization – This switch prioritizes each packet based on the required level of service, using eight priority queues with strict or Weighted Round Robin Queuing. It uses IEEE 802.1p and 802.1Q tags to prioritize incoming traffic based on input from the end-station application. These functions can independent priorities for delay-sensitive data and best-effort data.

This switch also supports several common methods of prioritizing layer 3/4 traffic to meet application requirements. Traffic can be prioritized based on the priority bits in the IP frame’s Type of Service (ToS) octet or the number of the TCP/UDP port. When these services are enabled, the priorities are mapped to a Class of Service value by the switch, and the traffic then sent to the corresponding output queue.

IP Routing – The switch provides Layer 3 IP routing. To maintain a high rate of throughput, the switch forwards all traffic passing within the same segment, and routes only traffic that passes between different subnetworks. The wire-speed routing provided by this switch lets you easily link network segments or VLANs together without having to deal with the bottlenecks or configuration hassles normally associated with conventional routers.

Routing for unicast traffic is supported with the Routing Information Protocol (RIP) and the Open Shortest Path First (OSPF) protocol.

RIP – This protocol uses a distance-vector approach to routing. Routes are determined on the basis of minimizing the distance vector, or hop count, which serves as a rough estimate of transmission cost.

OSPF – This approach uses a link state routing protocol to generate a shortest-path tree, then builds up its routing table based on this tree. OSPF produces a more stable network because the participating routers act on network changes predictably and simultaneously, converging on the best route more quickly than RIP.

Router Redundancy – The Virtual Router Redundancy Protocol (VRRP) uses a virtual IP address to support a primary router and multiple backup routers. The backups can be configured to take over the workload if the master fails or to load share the traffic. The primary goal of this protocol is to allow a host device which has been configured with a fixed gateway to maintain network connectivity in case the primary gateway goes down.

Address Resolution Protocol – The switch uses ARP and Proxy ARP to convert between IP addresses and MAC (i.e., hardware) addresses. This switch supports conventional ARP, which locates the MAC address corresponding to a given IP address. This allows the switch to use IP addresses for routing decisions and the corresponding MAC addresses to forward packets from one hop to the next. You can configure either static or dynamic entries in the ARP cache.

Proxy ARP allows hosts that do not support routing to determine the MAC address of a device on another network or subnet. When a host sends an ARP request for a

be used to provide

1-5

Introduction

remote network, the switch checks to see if it has the best route. If it does, it sends its own MAC address to the host. The host then sends traffic for the remote destination via the switch, which uses its own routing table to reach the destination on the other network.

Quality of Service – Differentiated Services (DiffServ) provides policy-based management mechanisms used for prioritizing network resources to meet the requirements of specific traffic types on a per-hop basis. Each packet is classified upon entry into the network based on access lists, IP Precedence or DSCP values, or VLAN lists. Using access lists allows you select traffic based on Layer 2, Layer 3, or Layer 4 information contained in each packet. Based on network policies, different kinds of traffic can be marked for different kinds of forwarding.

Multicast Filtering – Specific multicast traffic can be assigned to its own VLAN to ensure that it does not interfere with normal network traffic and to guarantee real-time delivery by setting the required priority level for the designated VLAN. The switch uses IGMP Snooping and Query to manage multicast group registration.

1-6

System Defaults

The switch’s system defaults are provided in the configuration file “Factory_Default_Config.cfg.” To reset the switch defaults, this file should be set as the startup configuration file (page 4-24).

The following table lists some of the basic system defaults.

Table 1-2 System Defaults

Function Parameter Default

Console Port Connection

Authentication Privileged Exec Level Username “admin”

Web Management HTTP Server Enabled

Baud Rate auto

Data bits 8

Stop bits 1

Parity none

Local Console Timeout 0 (disabled)

Password “admin”

Normal Exec Level Username “guest”

Enable Privileged Exec from Normal Exec Level

RADIUS Authentication Disabled

TACACS Authentication Disabled

802.1X Port Authentication Disabled

HTTPS Enabled

SSH Disabled

Port Security Disabled

IP Filtering Disabled

HTTP Port Number 80

HTTP Secure Server Enabled

HTTP Secure Port Number 443

Password “guest”

Password “super”

1-7

Introduction

Table 1-2 System Defaults (Continued)

Function Parameter Default

SNMP SNMP Agent Enabled

Community Strings “public” (read only)

Traps Authentication traps: enabled

SNMP V3 View: defaultview

Port Configuration Admin Status Enabled

Auto-negotiation Enabled

Flow Control Disabled

Rate Limiting Input and output limits Disabled

Port Trunking Static Trunks None

LACP (all ports) Disabled

Broadcast Storm Protection

Spanning Tree Algorithm

Address Table Aging Time 300 seconds

Virtual LANs Default VLAN 1

Status Enabled (all ports)

Broadcast Limit Rate 500 packets per second

Status Enabled, RSTP

Fast Forwarding (Edge Port) Disabled

PVID 1

Acceptable Frame Type All

Ingress Filtering Disabled

Switchport Mode (Egress Mode) Hybrid: tagged/untagged frames

GVRP (global) Disabled

GVRP (port interface) Disabled

“private” (read/write)

Link-up-down events: enabled

Group: public (read only); private (read/write)

(Defaults: All values based on IEEE 802.1w)

1-8

System Defaults

Table 1-2 System Defaults (Continued)

Function Parameter Default

Traffic Prioritization Ingress Port Priority 0

Queue Mode WRR

Weighted Round Robin Queue: 0 1 2 3 4 5 6 7

IP Precedence Priority Disabled

IP DSCP Priority Disabled

IP Port Priority Disabled

IP Settings Management. VLAN Any VLAN configured with an IP address

IP Address 0.0.0.0

Subnet Mask 255.0.0.0

Default Gateway 0.0.0.0

DHCP Client: Enabled

DNS Client/Proxy service: Disabled

BOOTP Disabled

ARP Enabled

Unicast Routing RIP Disabled

OSPF Disabled

Router Redundancy VRRP Disabled

Multicast Filtering IGMP Snooping Snooping: Enabled

System Log Status Enabled

Messages Logged Levels 0-7 (all)

Messages Logged to Flash Levels 0-3

SMTP Email Alerts Event Handler Enabled (but no server defined)

SNTP Clock Synchronization Disabled

Weight: 1 2 4 6 8 10 12 14

Relay: Disabled Server: Disabled

Cache Timeout: 20 minutes Proxy: Disabled

Querier: Disabled

1-9

Introduction

1-10

Chapter 2: Initial Configuration

Connecting to the Switch

Configuration Options

The switch includes a built-in network management agent. The agent offers a variety of management options, including SNMP, RMON (Groups 1, 2, 3, 9) and a web-based interface. A PC may also be connected directly to the switch for configuration and monitoring via a command line interface (CLI).

Note: An IPv4 address for this switch is obtained via DHCP by default. To change this

address, see “Setting an IP Address” on page 2-7.

The switch’s HTTP web agent allows you to configure switch parameters, monitor port connections, and display statistics using a standard web browser such as Internet Explorer 5.x or above, Netscape 6.2 or above, and Mozilla Firefox 2.0.0.0 or above. The switch’s web management interface can be accessed from any computer attached to the network.

The CLI program can be accessed by a direct connection to the RS-232 serial console port on the switch, or remotely by a Telnet connection over the network.

The switch’s management agent also supports SNMP (Simple Network Management Protocol). This SNMP agent permits the switch to be managed from any system in the network using network management software.

The switch’s web interface, CLI configuration program, and SNMP agent allow you to perform the following management functions:

• Set user names and passwords

• Set an IP interface for any VLAN

• Configure SNMP parameters

• Enable/disable any port

• Set the speed/duplex mode for any port

• Configure the bandwidth of any port by limiting input or output rates

• Control port access through IEEE 802.1X security or static address filtering

• Filter packets using Access Control Lists (ACLs)

• Configure up to 255 IEEE 802.1Q VLANs

• Enable GVRP automatic VLAN registration

• Configure IP routing for unicast traffic

• Configure router redundancy

• Configure IGMP multicast filtering

• Upload and download system firmware via TFTP

• Upload and download switch configuration files via TFTP

2-1

Initial Configuration

• Configure Spanning Tree parameters

• Configure Class of Service (CoS) priority queuing

• Configure up to 6 static or LACP trunks per switch, up to 32 per stack

• Enable port mirroring

• Set broadcast storm control on any port

• Display system information and statistics

• Configure any stack unit through the same IP address

Required Connections

The switch provides an RS-232 serial port that enables a connection to a PC or terminal for monitoring and configuring the switch. A null-modem console cable is provided with the switch.

Note: When configuring a stack, connect to the console port on the Master unit.

Attach a VT100-compatible terminal, or a PC running a terminal emulation program to the switch. You can use the console cable provided with this package, or use a null-modem cable that complies with the wiring assignments shown in the Installation Guide.

To connect a terminal to the console port, complete the following steps:

1. Connect the console cable to the serial port on a terminal, or a PC running

terminal emulation software, and tighten the captive retaining screws on the DB-9 connector.

2. Connect the other end of the cable to the RS-232 serial port on the switch.

3. Make sure the terminal emulation software is set as follows:

• Select the appropriate serial port (COM port 1 or COM port 2).

• Set to any of the following baud rates: 9600, 19200, 38400, 57600, 115200 (Note: Set to 9600 baud if want to view all the system initialization messages.).

• Set the data format to 8 data bits, 1 stop bit, and no parity.

• Set flow control to none.

• Set the emulation mode to VT100.

• When using HyperTerminal, select Terminal keys, not Windows keys.

Notes: 1. Refer to “Line Commands” on page 23-17 for a complete description of

console configuration options.

2. Once you have set up the terminal correctly, the console login screen will be displayed.

For a description of how to use the CLI, see “Using the Command Line Interface” on page 21-1. For a list of all the CLI commands and detailed information on using the CLI, refer to “Command Groups” on page 21-10.

2-2

Stack Operations

Remote Connections

Prior to accessing the switch’s onboard agent via a network connection, you must first configure it with a valid IP address, subnet mask, and default gateway using a console connection, DHCP or BOOTP protocol.

An IPv4 address for this switch is obtained via DHCP by default. To manually configure this address or enable dynamic address assignment via DHCP or BOOTP, see “Setting an IP Address” on page 2-7.

Notes: 1. This switch supports four concurrent Telnet/SSH sessions.

2. Each VLAN group can be assigned its own IP interface address (page 2-7).

You can manage the stack via any IP interface in the stack. In other words, the Master unit does not have to include an active port member of a VLAN interface used for management access.

3. Any VLAN group can be assigned an IP interface address (page 2-7) for managing the stack. Also, note that the Master unit does not have to include an active port member in the VLAN interface used for management access.

After configuring the switch’s IP parameters, you can access the onboard configuration program from anywhere within the attached network. The onboard configuration program can be accessed using Telnet from any computer attached to the network. The switch can also be managed by any computer using a web browser (Internet Explorer 5.0 or above, Netscape 6.2 or above, or Mozilla Firefox

2.0.0.0 or above), or from a network computer using SNMP network management software.

Note: The onboard program only provides access to basic configuration functions. To

access the full range of SNMP management functions, you must use SNMP-based network management software.

Stack Operations

Up to eight 24-port switches can be stacked together as described in the Installation Guide. One unit in the stack acts as the Master for configuration tasks and firmware

upgrade. All of the other units function in Slave mode, but can automatically take over management of the stack if the Master unit fails.

To configure any unit in the stack, first verify the unit number from the front panel of the switch, and then select the appropriate unit number from the web or console management interface.

Selecting the Stack Master

Note the following points about unit numbering:

• When the stack is initially powered on, the Master unit is selected based on the following rules:

- If the Master/Slave push button is depressed on only one unit in the stack, that unit will serve as the stack Master.

2-3

Initial Configuration

- If Master/Slave push button is depressed on more than one unit, the system will select the unit with the lowest MAC address from those with the push button depressed as the stack Master.

- If Master/Slave push button is not depressed on any unit, the system will select the unit with the lowest MAC address as the stack Master.

• When the stack is initially powered on, the Master unit is designated as unit 1 for a ring topology. For a line topology, the stack is simply numbered from top to bottom, with the first unit in the stack designated at unit 1. This unit identification number appears on the Stack Unit ID LED on the front panel of the switch. It can also be selected on the front panel graphic of the web interface, or from the CLI.

• If the Master unit fails and another unit takes over control of the stack, the unit numbering will not change.

• If a unit in the stack fails or is removed from the stack, the unit numbers will not change. This means that when you replace a unit in the stack, the original configuration for the failed unit will be restored to the replacement unit.

• If a unit is removed from the stack and later reattached to the stack, it will retain the original unit number obtained during stacking.

• If a unit is removed from the stack, and powered up as a stand-alone unit, it will also retain the original unit number obtained during stacking.

Selecting the Backup Unit

Once the Master unit finishes booting up, it continues to synchronize configuration information to all of the Slave units in the stack. If the Master unit fails or is powered off, a new master unit will be selected based on the election rules described in the preceding section. The backup unit elected to serve as the new stack Master will take control of the stack without any loss of configuration settings. To ensure a logical fail over to next unit down in the stack, place the Slave unit with the lowest MAC address directly beneath the Master unit in the stack.

Recovering from Stack Failure or Topology Change

When a link or unit in the stack fails, a trap message is sent and a failure event is logged. The stack will be rebooted after any system failure or topology change. It takes two to three minutes to for the stack to reboot. If the Master unit fails, the backup unit will take over operations as the new Master unit, reboot the stack, and then select another backup unit after the stack finishes rebooting. Also note that powering down a unit or inserting a new unit in the stack will cause the stack to reboot. If a unit is removed from the stack (due to a power down or failure) or a new unit added to the stack, the original unit IDs are not affected after rebooting, and a new unit is assigned the lowest available unit ID.

Broken Link for Line and Wrap-around Topologies

All units in the stack must be connected via stacking cable. You can connect the units in a simple cascade configuration from the top to the bottom unit. Using this kind of line topology, if any link or unit in the stack fails, the stack will be broken in

2-4

Stack Operations

two. The Stack Link LED on the unit that is no longer receiving traffic from the next unit up or down in the stack will begin flashing to indicate that the stack link is broken.

When the stack fails, a Master unit is selected from the two stack segments, either the unit with the Master button depressed, or the unit with the lowest MAC address if the Master button is not depressed on any unit. The stack reboots and resumes operations. However, note that the IP address will be the same for any common VLANs (with active port connections) that appear in both of the new stack segments. To resolve the conflicting IP addresses, you should manually replace the failed link or unit as soon as possible. If you are using a wrap-around stack topology, a single point of failure in the stack will not cause the stack to fail. It would take two or more points of failure to break the stack apart.

Note: If a stack breaks apart, the IP address will be the same for any common VLANs

(with active port connections) that appear in both stack segments.

Resilient IP Interface for Management Access

The stack functions as one integral system for management and configuration purposes. You can therefore manage the stack through any IP interface configured on the stack. The Master unit does not even have to include an active port member in the VLAN interface used for management access. However, if the unit to which you normally connect for management access fails, and there are no active port members on the other units within this VLAN interface, then this IP address will no longer be available. To retain a constant IP address for management access across fail over events, you should include port members on several units within the primary VLAN used for stack management.

Resilient Configuration

If a unit in the stack fails, the unit numbers will not change. This means that when you replace a unit in the stack, the original configuration for the failed unit will be restored to the replacement unit. This applies to both the Master and Slave units.

Renumbering the Stack

The startup configuration file maps configuration settings to each switch in the stack based on the unit identification number. If the units are no longer numbered sequentially after several topology changes or failures, you can reset the unit numbers using the “Renumbering” command in the web interface or CLI. Just remember to save the new configuration settings to a startup configuration file prior to powering off the stack Master.

Ensuring Consistent Code is Used Across the Stack

Consistent Runtime Code in Each Switch – The main board runtime firmware version for each unit in the stack must be the same as the Master unit’s runtime firmware. After Auto-ID assignment is completed, the Master unit checks the image versions for consistency. If the firmware versions (i.e., runtime code) configured for bootup on any slave units are not the same as those on the Master Unit, the stack

2-5

Initial Configuration

will operate in Special Stacking Mode in which all backup units are disabled as described below:

• The master unit starts normal operation mode in standalone mode.

• The master unit can see all units in the stack and maintain stack topology.

• None of the other units can function (all ports will be disabled).

• All user-initiated commands to configure the non-functioning units are dropped. The master unit, however, will be able to communicate the following information to the non-functioning units:

- Image downloads

- Stack topology information

- System configuration information already stored on the master.

In Special Stacking mode, the master unit displays warning messages whenever you log into the system through the CLI that inform you that an image download is required.

You can use the CLI, web or SNMP to download the runtime image from a TFTP server to the master unit. The master unit stores the image as its “Next boot image” and downloads the image to those backup units that are running a different image version. For information on downloading firmware, see “Managing Firmware” on page 4-21 or “File Management Commands” on page 23-10.

Basic Configuration

Console Connection

The CLI program provides two different command levels — normal access level (Normal Exec) and privileged access level (Privileged Exec). The commands available at the Normal Exec level are a limited subset of those available at the Privileged Exec level and allow you to only display information and use basic utilities. To fully configure the switch parameters, you must access the CLI at the Privileged Exec level.

Note: You can only access the console interface through the Master unit in the stack.

Access to both CLI levels are controlled by user names and passwords. The switch has a default user name and password for each level. To log into the CLI at the Privileged Exec level using the default user name and password, perform these steps:

1. To initiate your console connection, press <Enter>. The “User Access

Verification” procedure starts.

2. At the Username prompt, enter “admin.”

3. At the Password prompt, also enter “admin.” (The password characters are not

displayed on the console screen.)

2-6

Basic Configuration

4. The session is opened and the CLI displays the “Console#” prompt indicating

you have access at the Privileged Exec level.

Setting Passwords

Note: If this is your first time to log into the CLI program, you should define new

passwords for both default user names using the “username” command, record them and put them in a safe place.

Passwords can consist of up to 8 alphanumeric characters and are case sensitive. To prevent unauthorized access to the switch, set the passwords as follows:

1. Open the console interface with the default user name and password “admin” to

access the Privileged Exec level.

2. Type “configure” and press <Enter>.

3. Type “username guest password 0 password,” for the Normal Exec level, where

password is your new password. Press <Enter>.

4. Type “username admin password 0 password,” for the Privileged Exec level,

where password is your new password. Press <Enter>.

Note: ‘0’ specifies a password in plain text, ‘7’ specifies a password in encrypted form.

Username: admin Password:

CLI session with the GTL-2690 is opened. To end the CLI session, enter [Exit].

Console#configure 22-2 Console(config)#username guest password 0 [password] 25-2 Console(config)#username admin password 0 [password] Console(config)#

Setting an IP Address

You must establish IP address information for the stack to obtain management access through the network. This can be done in either of the following ways:

Manual — You have to input the information, including IP address and subnet mask. If your management station is not in the same IP subnet as the stack’s master unit, you will also need to specify the default gateway router.

Dynamic — The switch sends IP configuration requests to BOOTP or DHCP address allocation servers on the network.

2-7

Initial Configuration

Manual Configuration

You can manually assign an IP address to the switch. You may also need to specify a default gateway that resides between this device and management stations that exist on another network segment (if routing is not enabled on this switch). Valid IP addresses consist of four decimal numbers, 0 to 255, separated by periods. Anything outside this format will not be accepted by the CLI program.

Note: An IPv4 address for this switch is obtained via DHCP by default.

Assigning an IPv4 Address

Before you can assign an IP address to the switch, you must obtain the following information from your network administrator:

• IP address for the switch

• Network mask for this network

• Default gateway for the network

To assign an IPv4 address to the switch, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2. Type “ip address ip-address netmask,” where “ip-address” is the switch IP

address and “netmask” is the network mask for the network. Press <Enter>.

3. Type “exit” to return to the global configuration mode prompt. Press <Enter>.

4. To set the IP address of the default gateway for the network to which the switch

belongs, type “ip default-gateway gateway,” where “gateway” is the IP address of the default gateway. Press <Enter>.

Console(config)#interface vlan 1 27-1 Console(config-if)#ip address 192.168.1.5 255.255.255.0 41-3 Console(config-if)#exit Console(config)#ip default-gateway 192.168.1.254 41-4 Console(config)#

Assigning an IPv6 Address

There are several ways to manually configure IPv6 addresses. This section describes how to configure a “link local” address for connectivity within the local subnet only, and another option that allows you to specify a “global unicast” address by first configuring a network prefix for use on a multi-segment network, and then configuring the host address portion of the address.

An IPv6 prefix or address must be formatted according to RFC 2373 “IPv6 Addressing Architecture,” using 8 colon-separated 16-bit hexadecimal values. One double colon may be used to indicate the appropriate number of zeros required to fill

2-8

Basic Configuration

the undefined fields. For detailed information on the other ways to assign IPv6 addresses, see “Setting the Switch’s IP Address (IP Version 6)” on page 4-9.

Link Local Address — All link-local addresses must be configured with a prefix of FE80. Remember that this address type makes the switch accessible over IPv6 for all devices attached to the same local subnet only. Also, if the switch detects that the address you configured conflicts with that in use by another device on the subnet, it will stop using the address in question, and automatically generate a link local address that does not conflict with any other devices on the local subnet.

To configure an IPv6 link local address for the switch, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2. Type “ipv6 address” followed by up to 8 colon-separated 16-bit hexadecimal

values for the ipv6-address similar to that shown in the example, followed by the “link-local” command parameter. Then press <Enter>.

Console(config)#interface vlan 1 27-1 Console(config-if)#ipv6 address FE80::260:3EFF:FE11:6700 link-local 41-9 Console(config-if)#end Console#show ipv6 interface 41-14 Vlan 1 is up IPv6 is enable. Link-local address: FE80::260:3EFF:FE11:6700/64 Global unicast address(es): Joined group address(es): FF01::1/16 FF02::1/16 FF02::1:FF11:6700/104 MTU is 1500 bytes. ND DAD is enabled, number of DAD attempts: 1. ND retransmit interval is 1000 milliseconds Console#

Address for Multi-segment Network — Before you can assign an IPv6 address to the switch that will be used to connect to a multi-segment network, you must obtain the following information from your network administrator:

• Prefix for this network

• IP address for the switch

• Default gateway for the network

For most networks that encompass several different subnets, it’s easier to first define a network prefix, and then configure the host address for the switch. An IPv6 network prefix is composed of an IPv6-address and prefix length. The prefix length is the number of bits (from the left) of the prefix that form the network address, and is expressed as a decimal number. For example, all IPv6 address that start with the first byte of 73 (hexadecimal) could be expressed as 73:0:0:0:0:0:0:0/8 or 73::/8.

2-9

Initial Configuration

To generate an IPv6 global unicast address for the switch using a general network prefix, complete the following steps:

1. From the Global Configuration mode prompt, type “ipv6 general prefix

prefix-name ipv6-prefix/prefix-length,” where the “prefix-name” is a label identifying the network segment, “ipv6-prefix” specifies the high-order bits of the network address, and “prefix length” indicates the actual number of bits used in the network prefix. Press <Enter>.

2. From the global configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

3. From the interface prompt, type “ipv6 address prefix-name ipv6-address/

prefix-length,” where “prefix-length” indicates the address bits used to form the network portion of the address. (The network address starts from the left of the general prefix and should encompass some of the ipv6-address bits.) The remaining bits are assigned to the host interface. Press <Enter>.

4. Type “exit” to return to the global configuration mode prompt. Press <Enter>.

5. To set the IP address of the IPv6 default gateway for the network to which the

switch belongs, type “ipv6 default-gateway gateway,” where “gateway” is the IPv6 address of the default gateway. Press <Enter>.

Console(config)#ipv6 general-prefix rd 2001:DB8:2222::/48 41-8 Console(config)#interface vlan 1 27-1 Console(config-if)#ipv6 address rd 0:0:0:7272::72/64 41-9 Console(config-if)#exit Console(config)ipv6 default-gateway 2001:DB8:2222:7272::254

41-17

Console(config)end Console#show ipv6 interface 41-14 Vlan 1 is up IPv6 is enable. Link-local address: FE80::200:E8FF:FE90:0/64 Global unicast address(es): 2001:DB8:2222:7272::72, subnet is 2001:DB8:2222:7272::/64 Joined group address(es): FF01::1/16 FF02::1/16 FF02::1:FF72:64/104 FF02::1:FF90:0/104 MTU is 1500 bytes. ND DAD is enabled, number of DAD attempts: 1. ND retransmit interval is 1000 milliseconds Console#show ipv6 default-gateway 41-17 ipv6 default gateway: 2001:DB8:2222:7272::254

2-10

Basic Configuration

Dynamic Configuration

Obtaining an IPv4 Address

If you select the “bootp” or “dhcp” option, IP will be enabled but will not function until a BOOTP or DHCP reply has been received. Requests will be sent periodically in an effort to obtain IP configuration information. BOOTP and DHCP values can include the IP address, subnet mask, and default gateway. If the DHCP/BOOTP server is slow to respond, you may need to use the “ip dhcp restart client” command to re-start broadcasting service requests.

If the “bootp” or “dhcp” option is saved to the startup-config file (step 6), then the switch will start broadcasting service requests as soon as it is powered on.

To automatically configure the switch by communicating with BOOTP or DHCP address allocation servers on the network, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2. At the interface-configuration mode prompt, use one of the following commands:

• To obtain IP settings via DHCP, type “ip address dhcp” and press <Enter>.

• To obtain IP settings via BOOTP, type “ip address bootp” and press <Enter>.

3. Type “end” to return to the Privileged Exec mode. Press <Enter>.

4. Type “ip dhcp restart client” to begin broadcasting service requests.

Press <Enter>.

5. Wait a few minutes, and then check the IP configuration settings by typing the

“show ip interface” command. Press <Enter>.

6. Then save your configuration changes by typing “copy running-config

startup-config.” Enter the startup file name and press <Enter>.

Console(config)#interface vlan 1 27-1 Console(config-if)#ip address dhcp 41-3 Console(config-if)#end Console#ip dhcp restart client 39-2 Console#show ip interface 41-5 IP address and netmask: 192.168.1.54 255.255.255.0 on VLAN 1, and address mode: DHCP Console#copy running-config startup-config 23-11 Startup configuration file name []: startup \Write to FLASH Programming.

\Write to FLASH finish. Success.

2-11

Initial Configuration

Obtaining an IPv6 Address

Link Local Address — There are several ways to dynamically configure IPv6 addresses. The simplest method is to automatically generate a “link local” address (identified by an address prefix of FE80). This address type makes the switch accessible over IPv6 for all devices attached to the same local subnet.

To generate an IPv6 link local address for the switch, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2. Type “ipv6 enable” and press <Enter>.

Console(config)#interface vlan 1 27-1 Console(config-if)#ipv6 enable 41-7 Console(config-if)#end Console#show ipv6 interface 41-5 Vlan 1 is up IPv6 is enable. Link-local address: FE80::200:E8FF:FE90:0/64 Global unicast address(es): Joined group address(es): FF01::1/16 FF02::1/16 FF02::1:FF90:0/104 MTU is 1500 bytes. ND DAD is enabled, number of DAD attempts: 1. ND retransmit interval is 1000 milliseconds Console#

Address for Multi-segment Network — To generate an IPv6 address that can be used in a network containing more than one subnet, the switch can be configured to automatically generate a unique host address based on the local subnet address prefix received in router advertisement messages. (DHCP for IPv6 will also be supported in future software releases.)

To dynamically generate an IPv6 host address for the switch, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2-12

Basic Configuration

2. From the interface prompt, type “ipv6 address autoconfig” and press <Enter>.

Console(config)#interface vlan 1 27-1 Console(config-if)#ipv6 address autoconfig 41-10 Console(config-if)#end Console#show ipv6 interface 41-14 Vlan 1 is up IPv6 is enable. Link-local address: FE80::212:CFFF:FE0B:4600/64 Global unicast address(es): 2005::212:CFFF:FE0B:4600, subnet is 2005:0:0:0::/64 3FFE:501:FFFF:100:212:CFFF:FE0B:4600, subnet is 3FFE:501:FFFF:100::/64 Joined group address(es): FF01::1/16 FF02::1/16 FF02::1:FF0B:4600/104 MTU is 1500 bytes. ND DAD is enabled, number of DAD attempts: 1. ND retransmit interval is 1000 milliseconds Console#

Enabling SNMP Management Access

The switch can be configured to accept management commands from Simple Network Management Protocol (SNMP) applications. You can configure the switch to (1) respond to SNMP requests or (2) generate SNMP traps.

When SNMP management stations send requests to the switch (either to return information or to set a parameter), the switch provides the requested data or sets the specified parameter. The switch can also be configured to send information to SNMP managers (without being requested by the managers) through trap messages, which inform the manager that certain events have occurred.

The switch includes an SNMP agent that supports SNMP version 1, 2c, and 3 clients. To provide management access for version 1 or 2c clients, you must specify a community string. The switch provides a default MIB View (i.e., an SNMPv3 construct) for the default “public” community string that provides read access to the entire MIB tree, and a default view for the “private” community string that provides read/write access to the entire MIB tree. However, you may assign new views to version 1 or 2c community strings that suit your specific security requirements (see page 5-16).

Community Strings (for SNMP version 1 and 2c clients)

Community strings are used to control management access to SNMP version 1 and 2c stations, as well as to authorize SNMP stations to receive trap messages from the switch. You therefore need to assign community strings to specified users, and set the access level.

2-13

Initial Configuration

The default strings are:

• public - with read-only access. Authorized management stations are only able to retrieve MIB objects.

• private - with read-write access. Authorized management stations are able to both retrieve and modify MIB objects.

To prevent unauthorized access to the switch from SNMP version 1 or 2c clients, it is recommended that you change the default community strings.

To configure a community string, complete the following steps:

1. From the Privileged Exec level global configuration mode prompt, type

“snmp-server community string mode,” where “string” is the community access string and “mode” is rw (read/write) or ro (read only). Press <Enter>. (Note that the default mode is read only.)

2. To remove an existing string, simply type “no snmp-server community string,”

where “string” is the community access string to remove. Press <Enter>.

Console(config)#snmp-server community admin rw 24-3 Console(config)#snmp-server community private Console(config)#

Note: If you do not intend to support access to SNMP version 1 and 2c clients, we

recommend that you delete both of the default community strings. If there are no community strings, then SNMP management access from SNMP v1 and v2c clients is disabled.

Trap Receivers

You can also specify SNMP stations that are to receive traps from the switch. To configure a trap receiver, use the “snmp-server host” command. From the Privileged Exec level global configuration mode prompt, type:

“snmp-server host host-address community-string

[version {1 | 2c | 3 {auth | noauth | priv}}]”

where “host-address” is the IP address for the trap receiver, “community-string” specifies access rights for a version 1/2c host, or is the user name of a version 3 host, “version” indicates the SNMP client version, and “auth | noauth | priv” means that authentication, no authentication, or authentication and privacy is used for v3 clients. Then press <Enter>. For a more detailed description of these parameters, see “snmp-server host” on page 24-5. The following example creates a trap host for each type of SNMP client.

Console(config)#snmp-server host 10.1.19.23 batman 24-5 Console(config)#snmp-server host 10.1.19.98 robin version 2c Console(config)#snmp-server host 10.1.19.34 barbie version 3 auth Console(config)#

2-14

Managing System Files

Configuring Access for SNMP Version 3 Clients

To configure management access for SNMPv3 clients, you need to first create a view that defines the portions of MIB that the client can read or write, assign the view to a group, and then assign the user to a group. The following example creates one view called “mib-2” that includes the entire MIB-2 tree branch, and then another view that includes the IEEE 802.1d bridge MIB. It assigns these respective read and read/ write views to a group call “r&d” and specifies group authentication via MD5 or SHA. In the last step, it assigns a v3 user to this group, indicating that MD5 will be used for authentication, provides the password “greenpeace” for authentication, and the password “einstien” for encryption.

Console(config)#snmp-server view mib-2 1.3.6.1.2.1 included 24-10 Console(config)#snmp-server view 802.1d 1.3.6.1.2.1.17 included Console(config)#snmp-server group r&d v3 auth mib-2 802.1d 24-11 Console(config)#snmp-server user steve group r&d v3 auth md5 greenpeace priv des56 einstien 24-14 Console(config)#

For a more detailed explanation on how to configure the switch for access from SNMP v3 clients, refer to “Simple Network Management Protocol” on page 5-1, or refer to the specific CLI commands for SNMP starting on page 24-1.

Managing System Files

The switch’s flash memory supports three types of system files that can be managed by the CLI program, web interface, or SNMP. The switch’s file system allows files to be uploaded and downloaded, copied, deleted, and set as a start-up file.

The three types of files are:

• Configuration — This file type stores system configuration information and is

created when configuration settings are saved. Saved configuration files can be selected as a system start-up file or can be uploaded via TFTP to a server for backup. The file named “Factory_Default_Config.cfg” contains all the system default settings and cannot be deleted from the system. If the system is booted with the factory default settings, the master unit will also create a file named “startup1.cfg” that contains system settings for stack initialization, including information about the unit identifier, MAC address, and installed module type for each unit the stack. The configuration settings from the factory defaults configuration file are copied to this file, which is then used to boot the stack. See “Saving or Restoring Configuration Settings” on page 4-24 for more information.

• Operation Code — System software that is executed after boot-up, also known as

run-time code. This code runs the switch operations and provides the CLI and web management interfaces. See “Managing Firmware” on page 4-21 for more information.

2-15

Initial Configuration

• Diagnostic Code — Software that is run during system boot-up, also known as POST (Power On Self-Test).

Due to the size limit of the flash memory, the switch supports only two operation code files. However, you can have as many diagnostic code files and configuration files as available flash memory space allows. The switch has a total of 32 Mbytes of flash memory for system files.

In the system flash memory, one file of each type must be set as the start-up file. During a system boot, the diagnostic and operation code files set as the start-up file are run, and then the start-up configuration file is loaded.

Note that configuration files should be downloaded using a file name that reflects the contents or usage of the file settings. If you download directly to the running-config, the system will reboot, and the settings will have to be copied from the running-config to a permanent file.

Saving Configuration Settings

Configuration commands only modify the running configuration file and are not saved when the switch is rebooted. To save all your configuration changes in nonvolatile storage, you must copy the running configuration file to the start-up configuration file using the “copy” command.

New startup configuration files must have a name specified. File names on the switch are case-sensitive, can be from 1 to 31 characters, must not contain slashes (\ or /), and the leading letter of the file name must not be a period (.). (Valid characters: A-Z, a-z, 0-9, “.”, “-”, “_”)

There can be more than one user-defined configuration file saved in the switch’s flash memory, but only one is designated as the “startup” file that is loaded when the switch boots. The copy running-config startup-config command always sets the new file as the startup file. To select a previously saved configuration file, use the boot system config:<filename> command.

The maximum number of saved configuration files depends on available flash memory, with each configuration file normally requiring less than 20 kbytes. The amount of available flash memory can be checked by using the dir command.

2-16

Managing System Files

To save the current configuration settings, enter the following command:

1. From the Privileged Exec mode prompt, type “copy running-config

startup-config” and press <Enter>.

2. Enter the name of the start-up file. Press <Enter>.

Console#copy running-config startup-config 23-11 Startup configuration file name []: startup \Write to FLASH Programming.

\Write to FLASH finish. Success.

Console#

2-17

Initial Configuration

2-18

Section II: Switch Management

This section describes the basic switch features, along with a detailed description of how to configure each feature via a web browser, and a brief example for the Command Line Interface.

Configuring the Switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1

Basic Management Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1

Simple Network Management Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1

User Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-1

Access Control Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-1

Port Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-1

Address Table Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-1

Spanning Tree Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-1

VLAN Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-1

Link Layer Discovery Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-1

Class of Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-1

Quality of Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14-1

Multicast Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15-1

Domain Name Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16-1

Dynamic Host Configuration Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17-1

Configuring Router Redundancy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18-1

IP Routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19-1

Unicast Routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20-1

Switch Management

Chapter 3: Configuring the Switch

Using the Web Interface

This switch provides an embedded HTTP web agent. Using a web browser you can configure the switch and view statistics to monitor network activity. The web agent can be accessed by any computer on the network using a standard web browser (Internet Explorer 5.0, Netscape 6.2, Mozilla Firefox 2.0.0.0, or more recent versions).

Note: You can also use the Command Line Interface (CLI) to manage the switch over a

serial connection to the console port or via Telnet. For more information on using the CLI, refer to Chapter 21: “Overview of the Command Line Interface.”

Prior to accessing the switch from a web browser, be sure you have first performed the following tasks:

1. Configure the switch with a valid IP address, subnet mask, and default gateway

using an out-of-band serial connection, BOOTP or DHCP protocol. (See “Setting an IP Address” on page 2-7.)

2. Set user names and passwords using an out-of-band serial connection. Access

to the web agent is controlled by the same user names and passwords as the onboard configuration program. (See “Setting Passwords” on page 2-7.)

3. After you enter a user name and password, you will have access to the system

configuration program.

Notes: 1.

You are allowed three attempts to enter the correct password; on the third failed attempt the current connection is terminated.

2. If you log into the web interface as guest (Normal Exec level), you can view

the configuration settings or change the guest password. If you log in as “admin” (Privileged Exec level), you can change the settings on any page.

3. If the path between your management station and this switch does not pass

through any device that uses the Spanning Tree Algorithm, then you can set the switch port attached to your management station to fast forwarding (i.e., enable Admin Edge Port) to improve the switch’s response time to management commands issued through the web interface. See “Configuring Interface Settings” on page 10-13.

3-1

Configuring the Switch

Navigating the Web Browser Interface

To access the web-browser interface you must first enter a user name and password. The administrator has Read/Write access to all configuration parameters and statistics. The default user name and password “admin” is used for the administrator.

Home Page

When your web browser connects with the switch’s web agent, the home page is displayed as shown below. The home page displays the Main Menu on the left side of the screen and System Information on the right side. The Main Menu links are used to navigate to other menus, and display configuration parameters and statistics.

Figure 3-1 Home Page

Note: The examples in this chapter are based on the GTL-2690. The panel graphic is

shown on the following page.

3-2

Navigating the Web Browser Interface

Configuration Options

Configurable parameters have a dialog box or a drop-down list. Once a configuration change has been made on a page, be sure to click on the Apply button to confirm the new setting. The following table summarizes the web page configuration buttons.

Table 3-1 Web Page Configuration Buttons

Button Action

Apply Sets specified values to the system.

Revert Cancels specified values and restores current values prior to pressing Apply.

Help Links directly to web help.

Notes: 1.

To ensure proper screen refresh, be sure that Internet Explorer is configured so that the setting “Check for newer versions of stored pages” reads “Every visit to the page”. Internet Explorer 6.x and earlier: This option is available under the menu “Tools / Internet Options / General / Temporary Internet Files / Settings”. Internet Explorer 7.x: This option is available under “Tools / Internet Options / General / Browsing History / Settings / Temporary Internet Files”.

2. You may have to manually refresh the screen after making configuration

changes by pressing the browser’s refresh button.

Panel Display

The web agent displays an image of the switch’s ports. The Mode can be set to display different information for the ports, including Active (i.e., up or down), Duplex (i.e., half or full duplex), or Flow Control (i.e., with or without flow control). Clicking on the image of a port opens the Port Configuration page as described on page 8-3.

Figure 3-2 Front Panel Indicators

3-3

Configuring the Switch

Main Menu

Using the onboard web agent, you can define system parameters, manage and control the switch, and all its ports, or monitor network conditions. The following table briefly describes the selections available from this program.

Table 3-2 Switch Main Menu

Menu Description Page

System 4-1

System Information Provides basic system description, including contact information 4-1

Switch Information Shows the number of ports, hardware/firmware version

Bridge Extension Shows the bridge extension parameters 4-4

IP Configuration Sets the IPv4 address for management access 4-5

IPv6 Configuration Configures IPv6 interface addresses and static neighbors 4-9

IPv6 Configuration Configures IPv6 interface address and protocol settings 4-9

IPv6 General Prefix Configures IPv6 general prefix for network portion of addresses 4-15

IPv6 ND Neighbor Configures IPv6 neighbor discover protocol and static neighbors 4-17

Jumbo Frames Enables support for jumbo frames 4-21

File Management 4-21

Copy Operation Allows the transfer and copying files 4-22

Delete Allows deletion of files from the flash memory 4-22

Set Startup Sets the startup file 4-22

Line 4-26

Console Sets console port connection parameters 4-26

Telnet Sets Telnet connection parameters 4-28

Log 4-30

Logs Sends error messages to a logging process 4-33

System Logs Stores and displays error messages 4-30

Remote Logs Configures the logging of messages to a remote logging process 4-31

SMTP Sends an SMTP client message to a participating server 4-33

Renumbering Renumbers the units in the stack 4-35

Reset Restarts the switch 4-36

numbers, and power status

4-3

3-4

Navigating the Web Browser Interface

Table 3-2 Switch Main Menu (Continued)

Menu Description Page

SNTP Simple Network Time Protocol 4-36

Current Time Sets the time for the system clock 4-36

Configuration Configures SNTP client settings, including a list of servers 4-37

Time Zone Sets the local time zone for the system clock 4-39

Summer Time Configures summer-time settings 4-40

SNMP Simple Network Management Protocol 5-1

Configuration Configures community strings and related trap functions 5-3

Agent Status Enables or disables SNMP 5-2

SNMPv3 5-7

Engine ID Sets the SNMP v3 engine ID 5-7

Remote Engine ID Sets the SNMP v3 engine ID on a remote device 5-8

Users Configures SNMP v3 users 5-9

Remote Users Configures SNMP v3 users on a remote device 5-11

Groups Configures SNMP v3 groups 5-13

Views Configures SNMP v3 views 5-17

Security 6-1

User Accounts Configures user names, passwords, and access levels 6-1

Authentication Settings Configures authentication sequence, RADIUS and TACACS 6-2

HTTPS Settings Configures secure HTTP settings 6-5

SSH Secure Shell 6-8

Settings Configures Secure Shell server settings 6-14

Host-Key Settings Generates the host key pair (public and private) 6-10

User Public-Key Settings Imports and manages user RSA and DSA public keys 6-12

Port Security Configures per port security, including status, response for

802.1X Port authentication 6-18

Information Displays global configuration settings 6-19

Configuration Configures global configuration parameters 6-20

Port Configuration Sets the authentication mode for individual ports 6-20

Statistics Displays protocol statistics for the selected port 6-24

ACL Access Control Lists 7-1

Configuration Configures packet filtering based on IP or MAC addresses 7-1

Port Binding Binds a port to the specified ACL 7-11

security breach, and maximum allowed MAC addresses

6-16

3-5

Configuring the Switch

Table 3-2 Switch Main Menu (Continued)

Menu Description Page

IP Filter Configures IP addresses that are allowed management access 6-26

Port 8-1

Port Information Displays port connection status 8-1

Trunk Information Displays trunk connection status 8-1

Port Configuration Configures port connection settings 8-3

Trunk Configuration Configures trunk connection settings 8-3

Trunk Membership Specifies ports to group into static trunks 8-7

LACP Link Aggregation Control Protocol 8-8

Configuration Allows ports to dynamically join trunks 8-8

Aggregation Port Configures parameters for link aggregation group members 8-10

Port Counters Information Displays statistics for LACP protocol messages 8-13

Port Internal Information Displays settings and operational state for the local side 8-14

Port Neighbors Information Displays settings and operational state for the remote side 8-16

Port Broadcast Control Sets the broadcast storm threshold for each port 8-17

Trunk Broadcast Control Sets the broadcast storm threshold for each trunk 8-17

Mirror Port Configuration Sets the source and target ports for mirroring 8-19

Rate Limit 8-20

Input Port Configuration Sets the input rate limit for each port 8-20

Input Trunk Configuration Sets the input rate limit for each trunk 8-20

Output Port Configuration Sets the output rate limit for each port 8-20

Output Trunk Configuration Sets the output rate limit for each trunk 8-20

Port Statistics Lists Ethernet and RMON port statistics 8-22

Address Table 9-1

Static Addresses Displays entries for interface, address or VLAN 9-1

Dynamic Addresses Displays or edits static entries in the Address Table 9-2

Address Aging Sets timeout for dynamically learned entries 9-4

Spanning Tree 10-1

STA Spanning Tree Algorithm

Information Displays STA values used for the bridge 10-3

Configuration Configures global bridge settings for STP, RSTP and MSTP 10-6

Port Information Displays individual port settings for STA 10-10

Trunk Information Displays individual trunk settings for STA 10-10

3-6

Navigating the Web Browser Interface

Table 3-2 Switch Main Menu (Continued)

Menu Description Page

Port Configuration Configures individual port settings for STA 10-13

Trunk Configuration Configures individual trunk settings for STA 10-13

MSTP Multiple Spanning Tree Algorithm

VLAN Configuration Configures priority and VLANs for a spanning tree instance 10-16

Port Information Displays port settings for a specified MST instance 10-19

Trunk Information Displays trunk settings for a specified MST instance 10-19

Port Configuration Configures port settings for a specified MST instance 10-20

Trunk Configuration Configures trunk settings for a specified MST instance 10-20

VLAN 11- 1

802.1Q VLAN 11-1

GVRP Status Enables GVRP VLAN registration protocol 11-4

Basic Information Displays information on the VLAN type supported by this switch 11-4

Current Table Shows the current port members of each VLAN and whether or

Static List Used to create or remove VLAN groups 11-6

Static Table Modifies the settings for an existing VLAN 11-7

Static Membership by Port Configures membership type for interfaces, including tagged,

Port Configuration Specifies default PVID and VLAN attributes 11-10

Trunk Configuration Specifies default trunk VID and VLAN attributes 11-10

802.1Q Tunnel Configuration

Tunnel Port Configuration Sets the tunnel mode for an interface 11-17

Tunnel Trunk Configuration Sets the tunnel mode for an interface 11-17

Private VLAN 11-18

Status Enables or disables the private VLAN 11-19

Link Status Configures the private VLAN 11-19

Protocol VLAN 11-20

Configuration Creates a protocol group, specifying the supported protocols 11-20

Port Configuration Maps a protocol group to a VLAN 11-21

not the port is tagged or untagged

untagged or forbidden

Enables 802.1Q (QinQ) Tunneling 11-16

11- 5

11- 9

3-7

Configuring the Switch

Table 3-2 Switch Main Menu (Continued)

Menu Description Page

LLDP Link Layer Discovery Protocol 12-1

Configuration Configures global LLDP timing parameters 12-1

Port Configuration Configures parameters for individual ports 12-3

Trunk Configuration Configures parameters for trunks 12-3

Local Information Displays LLDP information about the local device 12-5

Remote Port Information Displays LLDP information about a remote device connected to

Remote Trunk Information Displays LLDP information about a remote device connected to

Remote Information Details Displays detailed LLDP information about a remote device

Device Statistics Displays LLDP statistics for all connected remote devices 12-11

Device Statistics Details Displays LLDP statistics for remote devices on a selected port or

Priority 13-1

Default Port Priority Sets the default priority for each port 13-1

Default Trunk Priority Sets the default priority for each trunk 13-1

Traffic Classes Maps IEEE 802.1p priority tags to output queues 13-3

Traffic Classes Status Enables/disables traffic class priorities (not implemented) NA

Queue Mode Sets queue mode to strict priority or Weighted Round-Robin 13-5

Queue Scheduling Configures Weighted Round Robin queueing 13-6

IP Precedence/ DSCP Priority Status

IP Precedence Priority Sets IP Type of Service priority, mapping the precedence tag to

IP DSCP Priority Sets IP Differentiated Services Code Point priority, mapping a

IP Port Priority Status Globally enables or disables IP Port Priority 13-11

IP Port Priority Sets TCP/UDP port priority, defining the socket number and

QoS Quality of Service 14-1

DiffServ Configure QoS classification criteria and service policies 14-1

Class Map Creates a class map for a type of traffic 14-2

Policy Map Creates a policy map for multiple interfaces 14-4

Service Policy Applies a policy map defined to an ingress port 14-7

a port on this switch

a trunk on this switch

connected to this switch

trunk

Globally selects IP Precedence or DSCP Priority, or disables both.

a class-of-service value

DSCP tag to a class-of-service value

associated class-of-service value

12-8

12-9

12-13

13-7

13-8

13-10

13-8

3-8

Navigating the Web Browser Interface

Table 3-2 Switch Main Menu (Continued)

Menu Description Page

IGMP Snooping Internet Group Management Protocol – Snooping 15-2

IGMP Configuration Enables multicast filtering; configures parameters for multicast

IGMP Immediate Leave Configures immediate leave for multicast services no longer

Multicast Router Port Information

Static Multicast Router Port Configuration

IP Multicast Registration Table

IGMP Member Port Table Indicates multicast addresses associated with the selected

DNS Domain Name Service 16-1

General Configuration Enables DNS; configures domain name and domain list; and

Static Host Table Configures static entries for domain name to address mapping 16-3

Cache Displays cache entries discovered by designated name servers 16-5

DHCP Dynamic Host Configuration Protocol 17-1

Relay Configuration Specifies DHCP relay servers; enables or disables relay service 17-1

Server Configures DHCP server parameters 17-2

General Enables DHCP server; configures excluded address range 17-3

Pool Configuration Configures address pools for network groups or a specific host 17-4

IP Binding Displays addresses currently bound to DHCP clients 17-9

VRRP Virtual Router Redundancy Protocol 18-2

Group Configuration Configures VRRP groups, including virtual interface address,

Global Statistics Displays global statistics for VRRP protocol packet errors 18-7

Group Statistics Displays statistics for VRRP protocol events and errors on the

IP Internet Protocol 19-1

General 19-4

Global Settings Enables or disables routing, specifies the default gateway 19-4

Routing Interface Configures the IP interface for the specified VLAN 19-5

query

required

Displays the ports that are attached to a neighboring multicast router for each VLAN ID

Assigns ports that are attached to a neighboring multicast router 15-7

Displays all multicast groups active on this switch, including multicast IP addresses and VLAN ID

VLAN

specifies IP address of name servers for dynamic lookup

advertisement interval, preemption, priority, and authentication

specified VRRP group and interface

15-3

15-5

15-6

15-8

16-1

18-2

18-8

3-9

Configuring the Switch

Table 3-2 Switch Main Menu (Continued)

Menu Description Page

ARP Address Resolution Protocol 19-8

General Sets the protocol timeout, and enables or disables proxy ARP for

Static Addresses Statically maps a physical address to an IP address 19-11

Dynamic Addresses Shows dynamically learned entries in the IP routing table 19-12

Other Addresses Shows internal addresses used by the switch 19-13

Statistics Shows statistics on ARP requests sent and received 19-14

Statistics 19-16

IP Shows statistics for IP traffic, including the amount of traffic,

ICMP Shows statistics for ICMP traffic, including the amount of traffic,

UDP Shows statistics for UDP, including the amount of traffic and

TCP Shows statistics for TCP, including the amount of traffic and TCP

Routing 19-21

Static Routes Configures and display static routing entries 19-21

Routing Table Shows all routing entries, including local, static and dynamic

Routing Protocol 20-1

RIP Routing Information Protocol 20-2

General Settings Enables or disables RIP, sets the global RIP version and timer

Network Addresses Configures the network interfaces that will use RIP 20-5

Interface Settings Configures RIP parameters for each interface, including send

Redistribute Configuration Imports external routing information from other routing domains

Statistics Displays general information on update time, route changes and

the specified VLAN

address errors, routing, fragmentation and reassembly

protocol errors, and the number of echoes, timestamps, and address masks

errors

connection activity

routes

values

and receive versions, message loopback prevention, and authentication

into the autonomous system

number of queries, as well as a list of statistics for known interfaces and neighbors

19-9

19-16

19-17

19-19

19-20

19-22

20-3

20-6

20-9

20-11

3-10

Navigating the Web Browser Interface

Table 3-2 Switch Main Menu (Continued)

Menu Description Page

OSPF Open Shortest Path First 20-14

General Configuration Enables or disables OSPF; also configures the Router ID and

Area Configuration Specifies rules for importing routes into each area 20-19

Area Range Configuration Configures route summaries to advertise at an area boundary 20-23

Interface Configuration Shows area ID and designated router; also configures OSPF

Virtual Link Configuration Configures a virtual link through a transit area to the backbone 20-29

Network Area Address Configuration

Summary Address Configuration

Redistribute Configuration Redistributes routes from one routing domain to another 20-35

NSSA Settings Configures settings for importing routes into or exporting routes

Link State Database Information

Border Router Information Displays routing table entries for area border routers and

Neighbor Information Displays information about neighboring routers on each

various other global settings

protocol settings and authentication for each interface

Defines OSPF areas and associated interfaces 20-31

Aggregates routes learned from other protocols for advertising into other autonomous systems

out of not-so-stubby areas

Shows information about different OSPF Link State Advertisements (LSAs) stored in this router’s database

autonomous system boundary routers

interface within an OSPF area

20-15

20-25

20-33

20-36

20-38

20-40

20-41

3-11

Configuring the Switch

3-12

Chapter 4: Basic Management Tasks

This chapter describes the basic functions required to set up management access to the switch, display or upgrade operating software, or reset the system.

Displaying System Information

You can easily identify the system by displaying the device name, location and contact information.

Field Attributes

• System Name – Name assigned to the switch system.

• Object ID – MIB II object ID for switch’s network management subsystem.

• Location – Specifies the system location.

• Contact – Administrator responsible for the system.

• System Up Time – Length of time the management agent has been up.

These additional parameters are displayed for the CLI.

• System Description – Brief description of device type.

• MAC Address – The physical layer address for this switch.

• Web Server – Shows if management access via HTTP is enabled.

• Web Server Port – Shows the TCP port number used by the web interface.

• Web Secure Server – Shows if management access via HTTPS is enabled.

• Web Secure Server Port – Shows the TCP port used by the HTTPS interface.

• Telnet Server – Shows if management access via Telnet is enabled.

• Telnet Server Port – Shows the TCP port used by the Telnet interface.

• Authentication Login – Shows the user login authentication sequence.

• Jumbo Frame – Shows if jumbo frames are enabled.

• Jumbo Frame Size – Configured size of jumbo frame.

• POST Result – Shows results of the power-on self-test

4-1

Basic Management Tasks

Web – Click System, System Information. Specify the system name, location, and contact information for the system administrator, then click Apply. (This page also includes a Telnet button that allows access to the Command Line Interface via Telnet.)

Figure 4-1 System Information

CLI – Specify the hostname, location and contact information.

Console(config)#hostname R&D 5 23-1 Console(config)#snmp-server location WC 9 24-4 Console(config)#snmp-server contact Ted 24-4 Console(config)#exit Console#show system 23-7 System Description: 20 GE + 4 GE Combo SFP + 2 10GE XFP Module slot L3 SNMP Sta ckable Switch System OID String: 1.3.6.1.4.1.22426.1.1.8 System Information System Up Time: 0 days, 1 hours, 39 minutes, and 31.55 seconds System Name: [NONE] System Location: [NONE] System Contact: [NONE] MAC Address (Unit1): 00-12-CF-D3-86-E0 Web Server: Enabled Web Server Port: 80 Web Secure Server: Enabled Web Secure Server Port: 443 Telnet Server: Enable Telnet Server Port: 23 Jumbo Frame: Disabled Jumbo Frame Size: 1522

POST Result:

DUMMY Test 1 ................. PASS

PCI Device 1 Test ............ PASS

I2C Bus Initialization ....... PASS

Fan Speed Test ............... PASS

Done All Pass.Console#

4-2

Displaying Switch Hardware/Software Versions

Use the Switch Information page to display hardware/firmware version numbers for the main board and management software, as well as the power status of the system.

Field Attributes

Main Board

• Serial Number – The serial number of the switch.

• Number of Ports – Number of built-in ports.

• Hardware Version – Hardware version of the main board.

• Internal Power Status – Displays the status of the internal power supply.

Management Software

• EPLD Version – Version number of EEPROM Programmable Logic Device.

• Loader Version – Version number of loader code.

• Boot-ROM Version – Version of Power-On Self-Test (POST) and boot code.

• Operation Code Version – Version number of runtime code.

• Role – Shows that this switch is operating as Master or Slave.

These additional parameters are displayed for the CLI.

• Unit ID – Unit number in stack.

• Redundant Power Status – Displays the status of the redundant power supply.

Web – Click System, Switch Information.

Figure 4-2 Switch Information

4-3

Basic Management Tasks

CLI – Use the following command to display version information.

Console#sh version Unit 1 Serial Number: 917000437 Hardware Version: R02 EPLD Version: 1.06 Number of Ports: 26 Main Power Status: Up Redundant Power Status: Not present

Agent (Master) Unit ID: 1 Loader Version: 1.1.0.2 Boot ROM Version: 1.1.0.4 Operation Code Version: 1.1.4.0 Console#

Displaying Bridge Extension Capabilities

The Bridge MIB includes extensions for managed devices that support Multicast Filtering, Traffic Classes, and Virtual LANs. You can access these extensions to display default settings for the key variables.

Field Attributes

• Extended Multicast Filtering Services – This switch does not support the filtering of individual multicast addresses based on GMRP (GARP Multicast Registration Protocol).

• Traffic Classes – This switch provides mapping of user priorities to multiple traffic classes. (Refer to “Class of Service” on page 13-1.)

• Static Entry Individual Port – This switch allows static filtering for unicast and multicast addresses. (Refer to “Setting Static Addresses” on page 9-1.)

• VLAN Learning – This switch uses Independent VLAN Learning (IVL), where each port maintains its own filtering database.

• Configurable PVID Tagging – This switch allows you to override the default Port VLAN ID (PVID used in frame tags) and egress status (VLAN-Tagged or Untagged) on each port. (Refer to “VLAN Configuration” on page 11-1.)

• Local VLAN Capable – This switch does not support multiple local bridges outside of the scope of 802.1Q defined VLANs.

• GMRP – GARP Multicast Registration Protocol (GMRP) allows network devices to register endstations with multicast groups. This switch does not support GMRP; it uses the Internet Group Management Protocol (IGMP) to provide automatic multicast filtering.

4-4

Setting the Switch’s IP Address (IP Version 4)

Web – Click System, Bridge Extension.

Figure 4-3 Displaying Bridge Extension Configuration

CLI – Enter the following command.

Console#show bridge-ext 34-2 Max support VLAN numbers: 4096 Max support VLAN ID: 4093 Extended multicast filtering services: No Static entry individual port: Yes VLAN learning: IVL Configurable PVID tagging: Yes Local VLAN capable: No Traffic classes: Enabled Global GVRP status: Disabled GMRP: Disabled Console#

Setting the Switch’s IP Address (IP Version 4)

This section describes how to configure an initial IPv4 interface for management access over the network. This switch supports both IPv4 and IPv6, and can be managed through either of these address types. For information on configuring the switch with an IPv6 address, see “Setting the Switch’s IP Address (IP Version 6)” on page 4-9.

The IPv4 address for this stack is obtained via DHCP by default. To manually configure an address, you need to change the stack’s default settings to values that are compatible with your network. You may also need to a establish a default gateway between the stack and management stations that exist on another network segment (if routing is not enabled on this stack).

You can manually configure a specific IP address, or direct the device to obtain an address from a BOOTP or DHCP server. Valid IP addresses consist of four decimal numbers, 0 to 255, separated by periods. Anything outside this format will not be accepted by the CLI program.

4-5

Basic Management Tasks

Command Usage

• This section describes how to configure a single local interface for initial access to the stack. To configure multiple IP interfaces on this stack, you must set up an IP interface for each VLAN (page 19-4).

• To enable routing between the different interfaces on this stack, you must enable IP routing (page 19-4).

• To enable routing between the interfaces defined on this stack and external network interfaces, you must configure static routes (page 19-21) or use dynamic routing; i.e., either RIP or OSPF (page 20-2 and page 20-14, respectively).

• The precedence for configuring IP interfaces is the IP / General / Routing Interface menu (page 19-5), static routes (page 19-21), and then dynamic routing.

Command Attributes

• VLAN – ID of the configured VLAN (1-4093). By default, all ports on the stack are members of VLAN 1. However, the management station can be attached to a port belonging to any VLAN, as long as that VLAN has been assigned an IP address.

• IP Address Mode – Specifies whether IP functionality is enabled via manual configuration (Static), Dynamic Host Configuration Protocol (DHCP), or Boot Protocol (BOOTP). If DHCP/BOOTP is enabled, IP will not function until a reply has been received from the server. Requests will be broadcast periodically by the switch for an IP address. (DHCP/BOOTP values can include the IP address, subnet mask, and default gateway.)

• IP Address – Address of the VLAN to which the management station is attached. (Note that you can manage the stack through any configured IP interface.) Valid IP addresses consist of four numbers, 0 to 255, separated by periods. (Default: 0.0.0.0)

• Subnet Mask – This mask identifies the host address bits used for routing to specific subnets. (Default: 255.0.0.0)

• Gateway IP Address – IP address of the gateway router between the stack and management stations that exist on other network segments. (Default: 0.0.0.0)

• MAC Address – The physical layer address for this switch.

4-6

Setting the Switch’s IP Address (IP Version 4)

Manual Configuration

Web – Click IP, General, Routing Interface. Select the VLAN through which the

management station is attached, set the IP Address Mode to “Static,” and specify a “Primary” interface. Enter the IP address, and subnet mask, then click Apply.

Figure 4-4 IPv4 Interface Configuration - Manual

Click IP, Global Setting. If this stack and management stations exist on other network segments, then specify the default gateway, and click Apply.

Figure 4-5 Default Gateway

CLI – Specify the management interface, IP address and default gateway.

Console#config Console(config)#interface vlan 1 27-1 Console(config-if)#ip address 192.168.1.1 255.255.255.0 41-3 Console(config-if)#exit Console(config)#ip default-gateway 192.168.1.254 41-4 Console(config)#

4-7

Basic Management Tasks

Using DHCP/BOOTP

If your network provides DHCP/BOOTP services, you can configure the stack to be dynamically configured by these services.

Web – Click IP, General, Routing Interface. Specify the VLAN to which the management station is attached, set the IP Address Mode to DHCP or BOOTP. Click Apply to save your changes. Then click Restart DHCP to immediately request a new address. Note that the stack will also broadcast a request for IP configuration settings on each power reset.

Figure 4-6 IPv4 Interface Configuration - DHCP

Note: If you lose your management connection, make a console connection to the

Master unit and enter “show ip interface” to determine the new stack address.

CLI – Specify the management interface, and set the IP address mode to DHCP or BOOTP, and then enter the “ip dhcp restart client” command.

Console#config Console(config)#interface vlan 1 27-1 Console(config-if)#ip address dhcp 41-3 Console(config-if)#end Console#ip dhcp restart client 39-2 Console#show ip interface 41-5

Vlan 1 is up, addressing mode is DHCP Interface address is 192.168.1.253, mask is 255.255.255.0, Primary MTU is 1500 bytes Proxy ARP is disabled Split horizon is enabled Console#

Renewing DCHP – DHCP may lease addresses to clients indefinitely or for a specific period of time. If the address expires or the stack is moved to another network segment, you will lose management access to the stack. In this case, you can reboot the stack or submit a client request to restart DHCP service via the CLI.

Web – If the address assigned by DHCP is no longer functioning, you will not be able to renew the IP settings via the web interface. You can only restart DHCP service via the web interface if the current address is still available.

4-8

Setting the Switch’s IP Address (IP Version 6)

CLI – Enter the following command to restart DHCP service.

Console#ip dhcp restart client 39-2 Console#

Setting the Switch’s IP Address (IP Version 6)

This section describes how to configure an initial IPv6 interface for management access over the network. This switch supports both IPv4 and IPv6, and can be managed through either of these address types. For information on configuring the switch with an IPv4 address, see “Setting the Switch’s IP Address (IP Version 4)” on page 4-5.

Configuring an IPv6 Address

IPv6 includes two distinct address types – link-local unicast and global unicast. A link-local address makes the switch accessible over IPv6 for all devices attached to the same local subnet. Management traffic using this kind of address cannot be passed by any router outside of the subnet. A link-local address is easy to set up, and may be useful for simple networks or basic troubleshooting tasks. However, to connect to a larger network with multiple segments, the switch must be configured with a global unicast address. Both link-local and global unicast address types can either be manually configured or dynamically assigned.

Command Usage

• This section describes how to configure a single local interface for initial access to

the stack. To configure multiple IP interfaces on this stack, you must set up an IP interface for each VLAN (page 19-4).

• To enable routing between the different interfaces on this stack, you must enable

IP routing (page 19-4).

• To enable routing between the interfaces defined on this stack and external

network interfaces, you must configure static routes (page 19-21) or use dynamic routing; i.e., either RIP or OSPF (page 20-2 and 20-14, respectively).

• The precedence for configuring IP interfaces is the IP / General / Routing Interface

menu (page 19-5), static routes (page 19-21), and then dynamic routing.

• All IPv6 addresses must be formatted according to RFC 2373 “IPv6 Addressing

Architecture,” using 8 colon-separated 16-bit hexadecimal values. One double colon may be used in the address to indicate the appropriate number of zeros required to fill the undefined fields.

• The switch must always be configured with a link-local address. Therefore any

configuration process that enables IPv6 functionality, or assigns a global unicast address to the switch, will also automatically generate a link-local unicast address. The prefix length for a link-local address is fixed at 64 bits, and the host portion of the default address is based on the modified EUI-64 (Extended Universal Identifier) form of the interface identifier (i.e., the physical MAC address). Alternatively, you can manually configure the link-local address by entering the full address with the network prefix FE80.

4-9

Basic Management Tasks

• To connect to a larger network with multiple subnets, you must configure a global unicast address. There are several alternatives to configuring this address type:

- The global unicast address can be automatically configured by taking the

network prefix from router advertisements observed on the local interface, and using the modified EUI-64 form of the interface identifier to automatically create the host portion of the address.

- It can be manually configured by specifying the entire network prefix and prefix

length, and using the EUI-64 form of the interface identifier to automatically create the low-order 64 bits in the host portion of the address.

- You can also manually configure the global unicast address by entering the full

address and prefix length.

- Or you can include a general prefix for the network portion of the address (as

described under “Configuring an IPv6 General Network Prefix” on page 4-15). When using this method, remember that the prefix length specified on the IPv6 Configuration page must include both the length of the general prefix and any contiguous bits (from the left of the specified address) that are added to the general prefix to form the extended network portion of the address.

• You can configure multiple IPv6 global unicast addresses per interface, but only one link-local address per interface.

• If a duplicate link-local address is detected on the local segment, this interface is disabled and a warning message displayed on the console. If a duplicate global unicast address is detected on the network, the address is disabled on this interface and a warning message displayed on the console.

Command Attributes

• IPv6 Address Processing – Enables IPv6 on an interface. Note that when an explicit address is assigned to an interface, IPv6 is automatically enabled, and cannot be disabled until all assigned addresses have been removed.

• IPv6 Interface Status – Shows if IPv6 interface address configuration state is stable (Enabled) or unstable (Stale).

• IPv6 Default Gateway – Sets the IPv6 address of the default next hop router to use when no other routing information is known about an IPv6 address.

- The specified gateway is only valid if routing is disabled using the IP / General /

Global Settings screen (see page 19-4) or no other routing information is known about the target address. If IP routing is disabled, you must define a gateway if the target device is located in a different subnet.

- If routing is enabled, you can still define a static route using the IP / Routing /

Static Routes screen (see page 19-21) to ensure that traffic to the designated address or subnet passes through a preferred gateway.

- An IPv6 default gateway can only be successfully set when a network interface

that directly connects to the gateway has been configured on the switch.

4-10

Setting the Switch’s IP Address (IP Version 6)

• IPv6 MTU – Sets the size of the maximum transmission unit (MTU) for IPv6

packets sent on an interface. (Range: 1280-65535 bytes, Default: 1500 bytes)

- If a non-default value is configured, an MTU option is included in the router advertisements sent from this device. This option is provided to ensure that all nodes on a link use the same MTU value in cases where the link MTU is not otherwise well known.

- IPv6 routers do not fragment IPv6 packets forwarded from other routers. However, traffic originating from an end-station connected to an IPv6 router may be fragmented.

- All devices on the same physical medium must use the same MTU in order to operate correctly.

- IPv6 must be enabled on an interface before the MTU can be set.

IPv6 Address Configuration

Configuration Mode – Selects Auto Configuration or Manual Configuration.

• Auto Configuration – Enables stateless autoconfiguration of IPv6 addresses on an interface and enables IPv6 functionality on the interface. The network portion of the address is based on prefixes received in IPv6 router advertisement messages, and the host portion is automatically generated using the modified EUI-64 form of the interface identifier (i.e., the switch’s MAC address).

- If the router advertisements have the “other stateful configuration” flag set, the

switch will attempt to acquire other non-address configuration information (such as a default gateway) from a DHCP for IPv6 server.

• Manual Configuration – Enables IPv6 on an interface. Note that when an explicit address is assigned to an interface, IPv6 is automatically enabled, and cannot be disabled until all assigned addresses have been removed.

• IPv6 Address – An IPv6 address can be configured in any of these ways:

- A link-local address can be manually configured by specifying the entire address in the IPv6 Address field, and selecting the Address Type “Link Local.” The network prefix length is fixed at 64 bits and cannot be changed.

- A global unicast address can be configured by specifying the network prefix and the length of the prefix (in the IPv6 Address field), and then selecting the Address Type “EUI-64” to automatically create the host portion of the address in the low order 64 bits based on the modified EUI-64 interface identifier.

- A global unicast address can be manually configured by specifying the full address and network prefix length (in the IP Address field), and selecting the Address Type “Others.”

- A global unicast address can also be set by selecting a preconfigured general prefix for the network portion of the address from the Based on General Prefix scroll-down list and marking the check box next to this field to enable your choice (see “Configuring an IPv6 General Network Prefix” on page 4-15), and then specifying the address (in the IPv6 Address field) and the full network prefix length (e.g., /64 appended to the end of the specified address) which includes the general prefix and any contiguous bits starting at the left of the address that are appended to the network prefix.

4-11

Basic Management Tasks

Note About Prefix Length – To specify the prefix length, enter a forward slash followed by a decimal value indicating how many contiguous bits (starting at the left) of the address comprise the prefix (i.e., the network portion of the address).

When used with a general network prefix to configure a global unicast address, this length includes both that specified by the general prefix and any contiguous prefix bits (starting at the left of the specified address) that exceed the length of the general prefix. If the prefix length specified by this parameter is shorter than the general prefix, then the length of the general prefix takes precedence.

• Based on General Prefix – Defines a general prefix for the network segment of the address (see “Configuring an IPv6 General Network Prefix” on page 4-15).

When configuring a global unicast address based on a general network prefix, the prefix length includes both that specified by the general prefix and any number of subsequent prefix bits that exceed the length of the general prefix. Therefore, depending on the specified prefix length, some of the address bits entered in the IPv6 Address field may be appended to the general prefix. However, if the prefix length is shorter than the general prefix, then the length of the general prefix takes precedence, and some of the address bits entered in the IPv6 Address field will be ignored.

• Address Type – Defines the address type configured for this interface.

• Link Local – Configures an IPv6 link-local address.

- The address prefix must be FE80.

- You can configure only one link-local address per interface.

- The specified address replaces a link-local address that was automatically generated for the interface.

• EUI-64 (Extended Universal Identifier) – Configures an IPv6 address for an interface using an EUI-64 interface ID in the low order 64 bits.

- When using EUI-64 format for the low-order 64 bits in the host portion of the

address, the value entered in the IPv6 Address field includes the network portion of the address, and the prefix length indicates how many contiguous bits (starting at the left) of the address comprise the prefix (i.e., the network portion of the address). Note that the value specified in the IPv6 Address field may include some of the high-order host bits if the specified prefix length is less than 64 bits. If the specified prefix length exceeds 64 bits, then the bits used in the network portion of the address will take precedence over the interface identifier.

- IPv6 addresses are 16 bytes long, of which the bottom 8 bytes typically form

a unique host identifier based on the device’s MAC address. The EUI-64 specification is designed for devices that use an extended 8-byte MAC address. For devices that still use a 6-byte MAC address (also known as EUI-48 format), it must be converted into EUI-64 format by inverting the universal/local bit in the address and inserting the hexadecimal number FFFE between the upper and lower three bytes of the MAC address.

For example, if a device had an EUI-48 address of 28-9F-18-1C-82-35, the global/local bit must first be inverted to meet EUI-64 requirements (i.e., 1 for globally defined addresses and 0 for locally defined addresses), changing

4-12

Setting the Switch’s IP Address (IP Version 6)

28 to 2A. Then the two bytes FFFE are inserted between the OUI (i.e., organizationally unique identifier, or company identifier) and the rest of the address, resulting in a modified EUI-64 interface identifier of 2A-9F-18-FF-FE-1C-82-35.

- This host addressing method allows the same interface identifier to be used on multiple IP interfaces of a single device, as long as those interfaces are attached to different subnets.

• Others – System will automatically detect the address type according to the address/prefix entered in the IPv6 Address field.

Current Address Table

• IPv6 Address – IPv6 address assigned to this interface.

In addition to the unicast addresses assigned to an interface, a node is required to join the all-nodes multicast addresses FF01::1 and FF02::1 for all IPv6 nodes within scope 1 (interface-local) and scope 2 (link-local), respectively.

FF01::1/16 is the transient node-local multicast address for all attached IPv6 nodes, and FF02::1/16 is the link-local multicast address for all attached IPv6 nodes. The node-local multicast address is only used for loopback transmission of multicast traffic. Link-local multicast addresses cover the same types as used by link-local unicast addresses, including all nodes (FF02::1), all routers (FF02::2), and solicited nodes (FF02::1:FFXX:XXXX) as described below.

A node is also required to compute and join the associated solicited-node multicast addresses for every unicast and anycast address it is assigned. IPv6 addresses that differ only in the high-order bits, e.g. due to multiple high-order prefixes associated with different aggregations, will map to the same solicited-node address, thereby reducing the number of multicast addresses a node must join. In this example, FF02::1:FF90:0/104 is the solicited-node multicast address which is formed by taking the low-order 24 bits of the address and appending those bits to the prefix.

Note that the solicited-node multicast address (link-local scope FF02) is used to resolve the MAC addresses for neighbor nodes since IPv6 does not support the broadcast method used by the Address Resolution Protocol in IPv4.

• Address Type – Global, Link-local or Multicast.

• Configuration Mode – Shows if address is set manually or auto configured.

4-13

Basic Management Tasks

Web – Click System, IPv6 Configuration, IPv6 Configuration. Set the IPv6 default gateway, specify the VLAN to configure, enable IPv6, and set the MTU. Then enter a global unicast or link-local address and click Add IPv6 Address.

4-14

Figure 4-7 IPv6 Interface Configuration

Setting the Switch’s IP Address (IP Version 6)

CLI – This example configures an IPv6 gateway, specifies the management interface, configures a global unicast address, and then sets the MTU.

Console#config Console(config)#ipv6 default-gateway 2009:DB9:2229::240 41-17 Console(config)#ipv6 general-prefix rd 2009:DB9:2229::/48 41-8 Console(config)#interface vlan 1 27-1 Console(config-if)#ipv6 address rd 7279::79/64 41-9 Console(config-if)#ipv6 mtu 1280 41-18 Console(config-if)#ipv6 enable 41-7 Console(config-if)#end Console#show ipv6 default-gateway 41-17 ipv6 default gateway: 2009:DB9:2229::240 Console#show ipv6 interface 41-14 Vlan 1 is up IPv6 is enable. Link-local address: FE80::200:E8FF:FE90:0/64 Global unicast address(es): 2009:DB9:2229::79, subnet is 2009:DB9:2229:0::/64 Joined group address(es): FF01::1/16 FF02::1/16 FF02::1:FF00:79/104 FF02::1:FF11:4321/104 MTU is 1280 bytes. ND DAD is enabled, number of DAD attempts: 1. ND retransmit interval is 1000 milliseconds Console#show ipv6 mtu 41-19 MTU Since Destination Address 1400 00:04:21 5000:1::3 1280 00:04:50 FE80::203:A0FF:FED6:141D Console#

Configuring an IPv6 General Network Prefix

The IPv6 General Prefix page is used to configure general prefixes that are subsequently used on the IPv6 Configuration web page (see page 4-9) to specify the network address portion of an interface address.

Command Usage

• Prefixes may contain zero-value fields or end in zeros.

• A general prefix holds a short prefix that indicates the high-order bits used in the network portion of the address. Longer, more specific, prefixes can be based on the general prefix to specify any number of subnets. When the general prefix is changed, all of the more specific prefixes based on this prefix will also change.

Command Attributes

• General Prefix Name – The label assigned to the general prefix.

• IPv6-Prefix/Prefix-length – The high-order bits of the network address segment assigned to the general prefix. The prefix must be formatted according to RFC 2373 “IPv6 Addressing Architecture,” using 8 colon-separated 16-bit hexadecimal values. One double colon may be used in the address to indicate the appropriate number of zeros required to fill the undefined fields.

4-15

Basic Management Tasks

Follow the prefix by a forward slash and a decimal value indicating how many of the contiguous bits (from the left) of the address comprise the prefix (i.e., the network portion of the address).

Web – Click System, IPv6 Configuration, IPv6 General Prefix. Click Add to open the editing fields for a prefix entry. Enter a name for the general prefix, the value for the general prefix, and the prefix length. Then click Add to enable the entry.

Figure 4-8 IPv6 General Prefix Configuration

CLI – This example creates a general network prefix of 2009:DB9:2229::/48.

Console(config)#ipv6 general-prefix rd 2009:DB9:2229::/48 41-8 Console(config)#end Console#show ipv6 general-prefix 41-9 IPv6 general prefix: rd 2009:DB9:2229::/48 Console#

4-16

Setting the Switch’s IP Address (IP Version 6)

Configuring Neighbor Detection Protocol and Static Entries

IPv6 Neighbor Discovery Protocol supersedes IPv4 Address Resolution Protocol in IPv6 networks. IPv6 nodes on the same network segment use Neighbor Discovery to discover each other's presence, to determine each other's link-layer addresses, to find routers and to maintain reachability information about the paths to active neighbors. The key parameters used to facilitate this process are the number of attempts made to verify whether or not a duplicate address exists on the same network segment, and the interval between neighbor solicitations used to verify reachability information.

Command Attributes

Protocol Settings

• VLAN – VLAN ID (Range: 1-4093)

• IPv6 ND DAD Attempts – The number of consecutive neighbor solicitation messages sent on an interface during duplicate address detection. (Range: 0-600, Default: 1)

- Configuring a value of 0 disables duplicate address detection.

- Duplicate address detection determines if a new unicast IPv6 address already

exists on the network before it is assigned to an interface.

- Duplicate address detection is stopped on any interface that has been

suspended (see “Creating VLANs” on page 11-6). While an interface is suspended, all unicast IPv6 addresses assigned to that interface are placed in a “pending” state. Duplicate address detection is automatically restarted when the interface is administratively re-activated.

- An interface that is re-activated restarts duplicate address detection for all

unicast IPv6 addresses on the interface. While duplicate address detection is performed on the interface’s link-local address, the other IPv6 addresses remain in a “tentative” state. If no duplicate link-local address is found, duplicate address detection is started for the remaining IPv6 addresses.

- If a duplicate address is detected, it is set to “duplicate” state, and a warning

message is sent to the console. If a duplicate link-local address is detected, IPv6 processes are disabled on the interface. If a duplicate global unicast address is detected, it is not used. All configuration commands associated with a duplicate address remain configured while the address is in “duplicate” state.

- If the link-local address for an interface is changed, duplicate address detection

is performed on the new link-local address, but not for any of the IPv6 global unicast addresses already associated with the interface.

• IPv6 ND NS Interval – The interval between transmitting IPv6 neighbor solicitation messages on an interface. (Range: 1000-3600000 milliseconds; Default: 1000 milliseconds is used for neighbor discovery operations, 0 milliseconds is advertised in router advertisements)

- This attribute specifies the interval between transmitting neighbor solicitation

messages when resolving an address, or when probing the reachability of a neighbor. Therefore, avoid using very short intervals for normal IPv6 operations.

4-17

Basic Management Tasks

- When a non-default value is configured, the specified interval is used both for router advertisements and by the router itself.

Current Neighbor Cache Table

• IPv6 Address – IPv6 address of neighbor device.

• Age – The time since the address was verified as reachable (in minutes). A static entry is indicated by the value “Permanent.”

• Link-layer Address – Physical layer MAC address.

• State – The current state for an entry.

The following states are used for dynamic entries:

- INCMP (Incomplete) - Address resolution is being carried out on the entry.

A neighbor solicitation message has been sent to the multicast address of the target, but it has not yet returned a neighbor advertisement message.

- REACH (Reachable) - Positive confirmation was received within the last

ReachableTime interval that the forward path to the neighbor was functioning. While in REACH state, the device takes no special action when sending packets.

- STALE - More than the ReachableTime interval has elapsed since the last

positive confirmation was received that the forward path was functioning. While in STALE state, the device takes no action until a packet is sent.

- DELAY - More than the ReachableTime interval has elapsed since the last

positive confirmation was received that the forward path was functioning. A packet was sent within the last DELAY_FIRST_PROBE_TIME interval. If no reachability confirmation is received within this interval after entering the DELAY state, the switch will send a neighbor solicitation message and change the state to PROBE.

- PROBE - A reachability confirmation is actively sought by resending neighbor

solicitation messages every RetransTimer interval until confirmation of reachability is received.

- ???? - Unknown state. The following states are used for static entries:

- INCMP (Incomplete) -The interface for this entry is down.

- REACH (Reachable) - The interface for this entry is up. Reachability detection

is not applied to static entries in the IPv6 neighbor discovery cache.

• VLAN – VLAN interface from which the address was reached.

Adding Static Neighbors (IPv6 Neighbor -- Add)

• IPv6 Address – The IPv6 address of a neighbor device that can be reached through one of the network interfaces configured on this switch. You can specify either a link-local or global unicast address formatted according to RFC 2373 “IPv6 Addressing Architecture,” using 8 colon-separated 16-bit hexadecimal values. One double colon may be used in the address to indicate the appropriate number of zeros required to fill the undefined fields.

• VLAN – VLAN ID (Range: 1-4093)

• Hardware Address – The 48-bit MAC layer address for the neighbor device. This address must be formatted as six hexadecimal pairs separated by hyphens.

4-18

Setting the Switch’s IP Address (IP Version 6)

Web – Click System, IPv6 Configuration, IPv6 ND Neighbor. To configure the Neighbor Detection protocol settings, select a VLAN interface, set the number of attempts allowed for duplicate address detection, set the interval for neighbor solicitation messages, and click Apply. To configure static neighbor entries, click Add, fill in the IPv6 address, VLAN interface and hardware address. Then click Add.

Figure 4-9 IPv6 Neighbor Detection and Neighbor Cache

4-19

Basic Management Tasks

CLI – This example maps a static entry for a global unicast address to a MAC address.

Console(config)#interface vlan 1 27-1 Console(config-if)#ipv6 nd dad attempts 5 41-28 Console(config-if)#ipv6 nd ns-interval 30000 41-29 Console(config-if)#end Console#show ipv6 interface Vlan 1 is up IPv6 is enable. Link-local address: FE80::1034:11FF:FE11:4321/64 Global unicast address(es): 2009:DB9:2229::79, subnet is 2009:DB9:2229:0::/64 [ Joined group address(es): FF01::1/16 FF02::1/16 FF02::1:FF00:79/104 FF02::1:FF11:4321/104 MTU is 1280 bytes. ND DAD is enabled, number of DAD attempts: 5. ND retransmit interval is 30000 milliseconds Console#configure Console(config)#ipv6 neighbor 2009:0DB9::49A vlan 1 30-65-14-01-11-87 41-26 Console(config)#end Console#show ipv6 neighbors 41-30 IPv6 Address Age Link-layer Addr State Vlan 2009:DB9:2229::77 Permanent 30-65-14-01-11-87 REACH 1 Console#

4-20

Configuring Support for Jumbo Frames

The switch provides more efficient throughput for large sequential data transfers by supporting jumbo frames up to 9216 bytes. Compared to standard Ethernet frames that run only up to 1.5 KB, using jumbo frames significantly reduces the per-packet overhead required to process protocol encapsulation fields.

Command Usage

To use jumbo frames, both the source and destination end nodes (such as a computer or server) must support this feature. Also, when the connection is operating at full duplex, all switches in the network between the two end nodes must be able to accept the extended frame size. And for half-duplex connections, all devices in the collision domain would need to support jumbo frames.

Command Attributes

Jumbo Packet Status – Configures support for jumbo frames. (Default: Disabled)

Web – Click System, Jumbo Frames. Enable or disable support for jumbo frames,

and click Apply.

Figure 4-10 Configuring Support for Jumbo Frames

CLI – This example enables jumbo frames globally for the switch.

Console(config)#jumbo frame 23-9 Console(config)#

Managing Firmware

You can upload/download firmware to or from a TFTP server, or copy files to and from switch units in a stack. By saving runtime code to a file on a TFTP server, that file can later be downloaded to the switch to restore operation. You can also set the switch to use new firmware without overwriting the previous version. You must specify the method of file transfer, along with the file type and file names as required.

Command Attributes

• File Transfer Method – The firmware copy operation includes these options:

- file to file – Copies a file within the switch directory, assigning it a new name.

- file to tftp – Copies a file from the switch to a TFTP server.

- tftp to file – Copies a file from a TFTP server to the switch.

- file to unit – Copies a file from this switch to another unit in the stack.

- unit to file – Copies a file from another unit in the stack to this switch.

• TFTP Server IP Address – The IP address of a TFTP server.

• File Type – Specify opcode (operational code) to copy firmware.

4-21

Basic Management Tasks

• File Name – the file name should not be a period (.), and the maximum length for file names on the TFTP server is 127 characters or 31 characters for files on the switch. (Valid characters: A-Z, a-z, 0-9, “.”, “-”, “_”)

• Source/Destination Unit – Stack unit. (Range: 1 - 8)

Note:

Up to two copies of the system software (i.e., the runtime firmware) can be stored in the file directory on the switch. The currently designated startup version of this file cannot be deleted.

The file name should not contain slashes (\ or /),

the leading letter of

Downloading System Software from a Server

When downloading runtime code, you can specify the destination file name to replace the current image, or first download the file using a different name from the current runtime code file, and then set the new file as the startup file.

Web – Click System, File Management, Copy Operation. Select “tftp to file” as the file transfer method, enter the IP address of the TFTP server, set the file type to “opcode,” enter the file name of the software to download, select a file on the switch to overwrite or specify a new file name, then click Apply. If you replaced the current firmware used for startup and want to start using the new operation code, reboot the system via the System/Reset menu.

Figure 4-11 Copy Firmware

If you download to a new destination file, go to the File Management, Set Start-Up menu, mark the operation code file used at startup, and click Apply. To start the new firmware, reboot the system via the System/Reset menu.

Figure 4-12 Setting the Startup Code

4-22

Managing Firmware

To delete a file select System, File Management, Delete. Select the file name from the given list by checking the tick box and click Apply. Note that the file currently designated as the startup code cannot be deleted.

Figure 4-13 Deleting Files

CLI – To download new firmware form a TFTP server, enter the IP address of the TFTP server, select “config” as the file type, then enter the source and destination file names. When the file has finished downloading, set the new file to start up the system, and then restart the switch.

To start the new firmware, enter the “reload” command or reboot the system.

Console#copy tftp file 23-11 TFTP server ip address: 192.168.1.19 Choose file type:

1. config: 2. opcode: <1-2>: 2 Source file name: GTL-2690-OP-V1.1.4.0.BIX Destination file name: GTL-2690-OP-V1.1.4.0.BIX \Write to FLASH Programming.

-Write to FLASH finish. Success. Console#config Console(config)#boot system opcode:V311620 23-16 Console(config)#exit Console#reload 22-4

4-23

Basic Management Tasks

Saving or Restoring Configuration Settings

You can upload/download configuration settings to/from a TFTP server, or copy files to and from switch units in a stack. The configuration file can be later downloaded to restore the switch’s settings.

Command Attributes

• File Transfer Method – The configuration copy operation includes these options:

- file to file – Copies a file within the switch directory, assigning it a new name.

- file to running-config – Copies a file in the switch to the running configuration.

- file to startup-config – Copies a file in the switch to the startup configuration.

- file to tftp – Copies a file from the switch to a TFTP server.

- running-config to file – Copies the running configuration to a file.

- running-config to startup-config – Copies the running config to the startup config.

- running-config to tftp – Copies the running configuration to a TFTP server.

- startup-config to file – Copies the startup configuration to a file on the switch.

- startup-config to running-config – Copies the startup config to the running config.

- startup-config to tftp – Copies the startup configuration to a TFTP server.

- tftp to file – Copies a file from a TFTP server to the switch.

- tftp to running-config – Copies a file from a TFTP server to the running config.

- tftp to startup-config – Copies a file from a TFTP server to the startup config.

- file to unit – Copies a file from this switch to another unit in the stack.

- unit to file – Copies a file from another unit in the stack to this switch.

• TFTP Server IP Address – The IP address of a TFTP server.

• File Type – Specify config (configuration) to copy configuration settings.

•

File Name

leading letter of the file name should not be a period (.), and the maximum length for file names on the TFTP server is 127 characters or 31 characters for files on the switch. (Valid characters: A-Z, a-z, 0-9, “.”, “-”, “_”)

• Source/Destination Unit – Stack unit. (Range: 1 - 8)

Note:

— The configuration file name should not contain slashes (\ or /),

The maximum number of user-defined configuration files is limited only by available flash memory space.

the

4-24

LevelOne GTL-2690 User Manual

Specifications and Main Features

Frequently Asked Questions

User Manual

GTL-2690

Section I: Getting Started

Chapter 1: Introduction

Key Features

Description of Software Features

System Defaults

Chapter 2: Initial Configuration

Connecting to the Switch

Configuration Options

Required Connections

Stack Operations

Remote Connections

Selecting the Stack Master

Selecting the Backup Unit

Recovering from Stack Failure or Topology Change

Broken Link for Line and Wrap-around Topologies

Resilient IP Interface for Management Access

Resilient Configuration

Renumbering the Stack

Ensuring Consistent Code is Used Across the Stack

Basic Configuration

Console Connection

Setting Passwords

Setting an IP Address

Manual Configuration

Dynamic Configuration

Enabling SNMP Management Access

Community Strings (for SNMP version 1 and 2c clients)

Trap Receivers

Managing System Files

Configuring Access for SNMP Version 3 Clients

Saving Configuration Settings

Section II: Switch Management

Chapter 3: Configuring the Switch

Using the Web Interface

Navigating the Web Browser Interface

Home Page

Configuration Options

Panel Display

Main Menu

Chapter 4: Basic Management Tasks

Displaying System Information

Displaying Switch Hardware/Software Versions

Displaying Bridge Extension Capabilities

Setting the Switch’s IP Address (IP Version 4)

Manual Configuration

Using DHCP/BOOTP

Setting the Switch’s IP Address (IP Version 6)

Configuring an IPv6 Address

Configuring an IPv6 General Network Prefix

Configuring Neighbor Detection Protocol and Static Entries

Configuring Support for Jumbo Frames

Managing Firmware

Downloading System Software from a Server

Saving or Restoring Configuration Settings