Milan Technology MIL-SM24004TG User Manual

3RUW&RPER6)36ORWV

*LJDELW(WKHUQHW0XOWL/D\HU

0DQDJHPHQW6ZLWFK

0,/607*

8VHU0DQXDO

Regulatory Approval

- FCC Class A

- UL 60950

- CSA C22.2 No. 60950

- EN60950-1 4

- CE

- EN55022 Class A

- EN55024

Canadian EMI Notice
This Class A digital apparatus meets all the requirements of the Canadian
Interference-Causing Equipment Regulations.

Cet appareil numerique de la classe A respecte toutes les exigences du Reglement sur le
materiel brouilleur du Canada.

European Notice
Products with the CE Marking comply with both the EMC Directive (89/336/EEC) and the
Low Voltage Directive (73/23/EEC) issued by the Commission of the European Community
Compliance with these directives imply conformity to the following European Norms:

EN55022 (CISPR 22) - Radio Frequency Interference
EN61000-X - Electromagnetic Immunity
EN60950-1 - Product Safety

MiLAN Technology warrants to the original consumer or purchaser that each of it's
products, and all components thereof, will be free from defects in material and/or
workmanship for a period of five years from the original factory shipment date. Any
warranty hereunder is extended to the original consumer or purchaser and is not
assignable.
MiLAN Technology makes no express or implied warranties including, but not limited to,
any implied warranty of merchantability or fitness for a particular purpose, except as
expressly set forth in this warranty. In no event shall MiLAN Technology be liable for
incidental or consequential damages, costs, or expenses arising out of or in connection
with the performance of the product delivered hereunder. MiLAN Technology will in no
case cover damages arising out of the product being used in a negligent fashion or
manner.

Trademarks

The MiLAN logo and MiLAN Technology trademarks are registered trademarks of
MiLAN Technology in the United States and/or other countries.

To Contact MiLAN Technology

For prompt response when calling for service information, have the following information
ready:

- Product serial number and revision

- Date of purchase

- Vendor or place of purchase

Five-Year Limited Warranty

i

You can reach MiLAN Technology technical support at:

E-mail: [e-mail]
Telephone: [phone]
Fax: [phone]
MiLAN Technology
1329 Moffett Park Drive
Sunnyvale, CA 94089
United States of America
Telephone: [phone]
Fax: [phone]

http://www.milan.com
[e-mail]
© Copyright 2005 MiLAN Technology P/N: 90000441 REV. A

ii

Contents

Chapter 1: Introduction 1-1

Key Features 1-1
Description of Software Features 1-2
System Defaults 1-5

Chapter 2: Initial Configuration 2-1

Connecting to the Switch 2-1

Configuration Options 2-1
Required Connections 2-2
Remote Connections 2-3

Basic Configuration 2-3

Console Connection 2-3
Setting Passwords 2-4
Setting an IP Address 2-4

Manual Configuration 2-4
Dynamic Configuration 2-5

Enabling SNMP Management Access 2-6

Community Strings 2-6
Trap Receivers 2-7

Saving Configuration Settings 2-7

Managing System Files 2-8

Chapter 3: Configuring the Switch 3-1

Using the Web Interface 3-1
Navigating the Web Browser Interface 3-2

Home Page 3-2
Configuration Options 3-3
Panel Display 3-3
Main Menu 3-4

Basic Configuration 3-9

Displaying System Information 3-9
Displaying Switch Hardware/Software Versions 3-10
Displaying Bridge Extension Capabilities 3-11
Setting the Switch’s IP Address 3-13

Manual Configuration 3-14
Using DHCP/BOOTP 3-15

Managing Firmware 3-16

Downloading System Software from a Server 3-16

Saving or Restoring Configuration Settings 3-17

Downloading Configuration Settings from a Server 3-18

Configuring Event Logging 3-19

iii

Contents

System Log Configuration 3-19
Remote Log Configuration 3-20
Displaying Log Messages 3-22

Sending Simple Mail Transfer Protocol Alerts 3-23
Resetting the System 3-25
Setting the System Clock 3-26

Configuring SNTP 3-26

Setting the Time Zone 3-27

Simple Network Management Protocol 3-28

Setting Community Access Strings 3-28
Specifying Trap Managers and Trap Types 3-29

User Authentication 3-30

Configuring the Logon Password 3-30
Configuring Local/Remote Logon Authentication 3-31
Configuring HTTPS 3-34

Replacing the Default Secure-site Certificate 3-35
Configuring the Secure Shell 3-36

Generating the Host Key Pair 3-38

Configuring the SSH Server 3-40
Configuring Port Security 3-41
Configuring 802.1X Port Authentication 3-43

Displaying 802.1X Global Settings 3-44

Configuring 802.1X Global Settings 3-46

Configuring Port Authorization Mode 3-47

Displaying 802.1X Statistics 3-48
Filtering IP Addresses for Management Access 3-50

Access Control Lists 3-52

Configuring Access Control Lists 3-52

Setting the ACL Name and Type 3-53

Configuring a Standard IP ACL 3-53

Configuring an Extended IP ACL 3-54

Configuring a MAC ACL 3-57
Configuring ACL Masks 3-59

Specifying the Mask Type 3-59

Configuring an IP ACL Mask 3-60

Configuring a MAC ACL Mask 3-62
Binding a Port to an Access Control List 3-63

Port Configuration 3-64

Displaying Connection Status 3-64
Configuring Interface Connections 3-67
Creating Trunk Groups 3-69

Statically Configuring a Trunk 3-70

Enabling LACP on Selected Ports 3-71

Configuring LACP Parameters 3-73

Displaying LACP Port Counters 3-76

iv

Contents

Displaying LACP Settings and Status for the Local Side 3-77

Displaying LACP Settings and Status for the Remote Side 3-79
Setting Broadcast Storm Thresholds 3-80
Configuring Port Mirroring 3-82
Configuring Rate Limits 3-83
Showing Port Statistics 3-84

Address Table Settings 3-88

Setting Static Addresses 3-88
Displaying the Address Table 3-89
Changing the Aging Time 3-91

Spanning Tree Algorithm Configuration 3-91

Displaying Global Settings 3-92
Configuring Global Settings 3-96
Displaying Interface Settings 3-100
Configuring Interface Settings 3-103
Configuring Multiple Spanning Trees 3-105
Displaying Interface Settings for MSTP 3-108
Configuring Interface Settings for MSTP 3-109

VLAN Configuration 3-111

IEEE 802.1Q VLANs 3-111

Enabling or Disabling GVRP (Global Setting) 3-114

Displaying Basic VLAN Information 3-114

Displaying Current VLANs 3-115

Creating VLANs 3-116

Adding Static Members to VLANs (VLAN Index) 3-117

Adding Static Members to VLANs (Port Index) 3-119

Configuring VLAN Behavior for Interfaces 3-119
Configuring Private VLANs 3-122

Enabling Private VLANs 3-122

Configuring Uplink and Downlink Ports 3-123
Configuring Protocol-Based VLANs 3-123

Configuring Protocol Groups 3-124

Mapping Protocols to VLANs 3-124

Class of Service Configuration 3-126

Layer 2 Queue Settings 3-126

Setting the Default Priority for Interfaces 3-126

Mapping CoS Values to Egress Queues 3-128

Selecting the Queue Mode 3-129

Setting the Service Weight for Traffic Classes 3-130
Layer 3/4 Priority Settings 3-132

Mapping Layer 3/4 Priorities to CoS Values 3-132

Selecting IP Precedence/DSCP Priority 3-132

Mapping IP Precedence 3-133

Mapping DSCP Priority 3-134

Mapping IP Port Priority 3-136

v

Contents

Mapping CoS Values to ACLs 3-137
Changing Priorities Based on ACL Rules 3-138

Multicast Filtering 3-140

Layer 2 IGMP (Snooping and Query) 3-140

Configuring IGMP Snooping and Query Parameters 3-141
Displaying Interfaces Attached to a Multicast Router 3-143
Specifying Static Interfaces for a Multicast Router 3-143
Displaying Port Members of Multicast Services 3-144
Assigning Ports to Multicast Services 3-145

Configuring Domain Name Service 3-146

Configuring General DNS Server Parameters 3-147
Configuring Static DNS Host to Address Entries 3-149
Displaying the DNS Cache 3-151

Chapter 4: Command Line Interface 4-1

Using the Command Line Interface 4-1

Accessing the CLI 4-1
Console Connection 4-1
Telnet Connection 4-1

Entering Commands 4-3

Keywords and Arguments 4-3
Minimum Abbreviation 4-3
Command Completion 4-3
Getting Help on Commands 4-3

Showing Commands 4-4
Partial Keyword Lookup 4-5
Negating the Effect of Commands 4-5
Using Command History 4-5
Understanding Command Modes 4-6
Exec Commands 4-6
Configuration Commands 4-7
Command Line Processing 4-9

Command Groups 4-10
Line Commands 4-11

line 4-12
login 4-12
password 4-13
exec-timeout 4-14
password-thresh 4-15
silent-time 4-15
databits 4-16
parity 4-17
speed 4-17
stopbits 4-18

vi

Contents

disconnect 4-18
show line 4-19

General Commands 4-20

enable 4-20
disable 4-21
configure 4-21
show history 4-22
reload 4-22
end 4-23
exit 4-23
quit 4-24

System Management Commands 4-24

Device Designation Commands 4-25

prompt 4-25
hostname 4-25

User Access Commands 4-26

username 4-26
enable password 4-27

IP Filter Commands 4-28

management 4-28
show management 4-29

Web Server Commands 4-30

ip http port 4-30
ip http server 4-30
ip http secure-server 4-31
ip http secure-port 4-32

Telnet Server Commands 4-33

ip telnet port 4-33
ip telnet server 4-33

Secure Shell Commands 4-34

ip ssh server 4-36
ip ssh timeout 4-37
ip ssh authentication-retries 4-37
ip ssh server-key size 4-38
delete public-key 4-38
ip ssh crypto host-key generate 4-39
ip ssh crypto zeroize 4-39
ip ssh save host-key 4-40
show ip ssh 4-40
show ssh 4-41
show public-key 4-42

Event Logging Commands 4-43

logging on 4-43
logging history 4-44
logging host 4-45

vii

Contents

logging facility 4-45

logging trap 4-46

clear logging 4-46

show logging 4-47
SMTP Alert Commands 4-48

logging sendmail host 4-49

logging sendmail level 4-49

logging sendmail source-email 4-50

logging sendmail destination-email 4-50

logging sendmail 4-51

show logging sendmail 4-51
Time Commands 4-52

sntp client 4-52

sntp server 4-53

sntp poll 4-54

show sntp 4-54

clock timezone 4-55

calendar set 4-55

show calendar 4-56
System Status Commands 4-57

show startup-config 4-57

show running-config 4-58

show system 4-60

show users 4-61

show version 4-61
Frame Size Commands 4-62

jumbo frame 4-62

Flash/File Commands 4-63

copy 4-63
delete 4-65
dir 4-66
whichboot 4-67
boot system 4-67

Authentication Commands 4-68

Authentication Sequence 4-69

authentication login 4-69

authentication enable 4-70
RADIUS Client 4-71

radius-server host 4-71

radius-server port 4-71

radius-server key 4-72

radius-server retransmit 4-72

radius-server timeout 4-73

show radius-server 4-73

viii

Contents

TACACS+ Client 4-74

tacacs-server host 4-74
tacacs-server port 4-74
tacacs-server key 4-75
show tacacs-server 4-75

Port Security Commands 4-76

port security 4-76

802.1X Port Authentication 4-78
dot1x system-auth-control 4-78
authentication dot1x default 4-79
dot1x default 4-79
dot1x max-req 4-79
dot1x port-control 4-80
dot1x operation-mode 4-81
dot1x re-authenticate 4-82
dot1x re-authentication 4-82
dot1x timeout quiet-period 4-82
dot1x timeout re-authperiod 4-83
dot1x timeout tx-period 4-83
show dot1x 4-84

Access Control List Commands 4-86

IP ACLs 4-87

access-list ip 4-88
permit, deny (Standard ACL) 4-89
permit, deny (Extended ACL) 4-90
show ip access-list 4-92
access-list ip mask-precedence 4-92
mask (IP ACL) 4-93
show access-list ip mask-precedence 4-96
ip access-group 4-97
show ip access-group 4-97
map access-list ip 4-98
show map access-list ip 4-99
match access-list ip 4-99
show marking 4-100

MAC ACLs 4-101

access-list mac 4-101
permit, deny (MAC ACL) 4-102
show mac access-list 4-103
access-list mac mask-precedence 4-104
mask (MAC ACL) 4-105
show access-list mac mask-precedence 4-107
mac access-group 4-107
show mac access-group 4-108
map access-list mac 4-108

ix

Contents

show map access-list mac 4-109
match access-list mac 4-110

ACL Information 4-111

show access-list 4-111
show access-group 4-111

SNMP Commands 4-112

snmp-server community 4-112
snmp-server contact 4-113
snmp-server location 4-113
snmp-server host 4-114
snmp-server enable traps 4-115
show snmp 4-115

DNS Commands 4-117

ip host 4-117
clear host 4-118
ip domain-name 4-118
ip domain-list 4-119
ip name-server 4-120
ip domain-lookup 4-121
show hosts 4-122
show dns 4-123
show dns cache 4-123
clear dns cache 4-124

Interface Commands 4-125

interface 4-125
description 4-126
speed-duplex 4-126
negotiation 4-127
capabilities 4-128
flowcontrol 4-129
combo-forced-mode 4-130
shutdown 4-130
switchport broadcast packet-rate 4-131
clear counters 4-132
show interfaces status 4-133
show interfaces counters 4-134
show interfaces switchport 4-135

Mirror Port Commands 4-136

port monitor 4-136
show port monitor 4-137

Rate Limit Commands 4-138

rate-limit 4-138

Link Aggregation Commands 4-139

channel-group 4-140
lacp 4-141

x

Contents

lacp system-priority 4-142
lacp admin-key (Ethernet Interface) 4-143
lacp admin-key (Port Channel) 4-144
lacp port-priority 4-144
show lacp 4-145

Address Table Commands 4-149

mac-address-table static 4-150
clear mac-address-table dynamic 4-151
show mac-address-table 4-151
mac-address-table aging-time 4-152
show mac-address-table aging-time 4-152

Spanning Tree Commands 4-153

spanning-tree 4-154
spanning-tree mode 4-154
spanning-tree forward-time 4-155
spanning-tree hello-time 4-156
spanning-tree max-age 4-157
spanning-tree priority 4-157
spanning-tree pathcost method 4-158
spanning-tree transmission-limit 4-159
spanning-tree mst configuration 4-159
mst vlan 4-160
mst priority 4-161
name 4-161
revision 4-162
max-hops 4-163
spanning-tree spanning-disabled 4-163
spanning-tree cost 4-164
spanning-tree port-priority 4-164
spanning-tree edge-port 4-165
spanning-tree portfast 4-166
spanning-tree link-type 4-167
spanning-tree mst cost 4-167
spanning-tree mst port-priority 4-168
spanning-tree protocol-migration 4-169
show spanning-tree 4-170
show spanning-tree mst configuration 4-171

VLAN Commands 4-172

Editing VLAN Groups 4-172

vlan database 4-172
vlan 4-173

Configuring VLAN Interfaces 4-174

interface vlan 4-174
switchport mode 4-175
switchport acceptable-frame-types 4-176

xi

Contents

switchport ingress-filtering 4-176
switchport native vlan 4-177
switchport allowed vlan 4-178
switchport forbidden vlan 4-179

Displaying VLAN Information 4-180

show vlan 4-180

Configuring Private VLANs 4-181

pvlan 4-181
show pvlan 4-182

Configuring Protocol-based VLANs 4-182

protocol-vlan protocol-group (Configuring Groups) 4-183
protocol-vlan protocol-group (Configuring Interfaces) 4-183
show protocol-vlan protocol-group 4-184
show interfaces protocol-vlan protocol-group 4-185

GVRP and Bridge Extension Commands 4-186

bridge-ext gvrp 4-186
show bridge-ext 4-187
switchport gvrp 4-187
show gvrp configuration 4-188
garp timer 4-188
show garp timer 4-189

Priority Commands 4-190

Priority Commands (Layer 2) 4-190

queue mode 4-191
switchport priority default 4-192
queue bandwidth 4-193
queue cos-map 4-193
show queue mode 4-194
show queue bandwidth 4-195
show queue cos-map 4-195

Priority Commands (Layer 3 and 4) 4-196

map ip port (Global Configuration) 4-196
map ip port (Interface Configuration) 4-197
map ip precedence (Global Configuration) 4-197
map ip precedence (Interface Configuration) 4-198
map ip dscp (Global Configuration) 4-199
map ip dscp (Interface Configuration) 4-199
show map ip port 4-200
show map ip precedence 4-201
show map ip dscp 4-202

Multicast Filtering Commands 4-203

IGMP Snooping Commands 4-204

ip igmp snooping 4-204
ip igmp snooping vlan static 4-204
ip igmp snooping version 4-205

xii

Contents

show ip igmp snooping 4-205
show mac-address-table multicast 4-206

IGMP Query Commands (Layer 2) 4-207

ip igmp snooping querier 4-207
ip igmp snooping query-count 4-207
ip igmp snooping query-interval 4-208
ip igmp snooping query-max-response-time 4-209
ip igmp snooping router-port-expire-time 4-209

Static Multicast Routing Commands 4-210

ip igmp snooping vlan mrouter 4-210
show ip igmp snooping mrouter 4-211

IP Interface Commands 4-212

ip address 4-212
ip dhcp restart 4-213
ip default-gateway 4-214
show ip interface 4-214
show ip redirects 4-215
ping 4-215

Appendix A: Software Specifications A-1

Software Features A-1
Management Features A-2
Standards A-2
Management Information Bases A-3

Appendix B: Troubleshooting B-1

Problems Accessing the Management Interface B-1
Using System Logs B-2

Glossary

Index

xiii

Contents

xiv

Tables

Table 1-1. Key Features 1-1
Table 1-2. System Defaults 1-5
Table 3-1 Web Page Configuration Buttons 3-3
Table 3-2 Switch Main Menu 3-4
Table 3-3 Logging Levels 3-19
Table 3-4 HTTPS System Support 3-35
Table 3-5 802.1X Statistics 3-48
Table 3-6 LACP Port Counters 3-76
Table 3-7 LACP Internal Configuration Information 3-77
Table 3-8 LACP Neighbor Configuration Information 3-79
Table 3-9 Port Statistics 3-84
Table 3-10 Mapping CoS Values to Egress Queues 3-128
Table 3-11 CoS Priority Levels 3-128
Table 3-12 Mapping IP Precedence 3-133
Table 3-13 Mapping DSCP Priority 3-134
Table 3-14 Mapping CoS Values to IP ACLs 3-137
Table 4-1 General Command Modes 4-6
Table 4-2 Configuration Command Modes 4-8
Table 4-3 Keystroke Commands 4-9
Table 4-4 Command Group Index 4-10
Table 4-5 Line Commands 4-11
Table 4-6 General Commands 4-20
Table 4-7 System Management Commands 4-24
Table 4-8 Device Designation Commands 4-25
Table 4-9 User Access Commands 4-26
Table 4-10 Default Login Settings 4-26
Table 4-11 IP Filter Commands 4-28
Table 4-12 Web Server Commands 4-30
Table 4-13 HTTPS System Support 4-31
Table 4-14 Telnet Server Commands 4-33
Table 4-15 Secure Shell Commands 4-34
Table 4-16 show ssh - display description 4-41
Table 4-17 Event Logging Commands 4-43
Table 4-18 Logging Levels 4-44
Table 4-19 show logging flash/ram- display description 4-47
Table 4-20 show logging trap - display description 4-48
Table 4-21 SMTP Alert Commands 4-48
Table 4-22 Time Commands 4-52
Table 4-23 System Status Commands 4-57
Table 4-24 Frame Size Commands 4-62
Table 4-25 Flash/File Commands 4-63
Table 4-26 File Directory Information 4-66

xv

Tables

Table 4-27 Authentication Commands 4-68
Table 4-28 Authentication Sequence Commands 4-69
Table 4-29 RADIUS Client Commands 4-71
Table 4-30 TACACS+ Client Commands 4-74
Table 4-31 Port Security Commands 4-76
Table 4-32 802.1X Port Authentication Commands 4-78
Table 4-33 Access Control List Commands 4-87
Table 4-34 IP ACL Commands 4-87
Table 4-35 Mapping CoS Values to IP ACLs 4-98
Table 4-36 MAC ACL Commands 4-101
Table 4-37 Mapping CoS Values to MAC ACLs 4-108
Table 4-38 ACL Information Commands 4-111
Table 4-39 SNMP Commands 4-112
Table 4-40 DNS Commands 4-117
Table 4-41 show dns cache - display description 4-123
Table 4-42 Interface Commands 4-125
Table 4-43 interfaces switchport - display description 4-135
Table 4-44 Mirror Port Commands 4-136
Table 4-45 Rate Limit Commands 4-138
Table 4-46 Link Aggregation Commands 4-139
Table 4-47 show lacp counters - display description 4-146
Table 4-48 show lacp internal - display description 4-147
Table 4-49 show lacp neighbors - display description 4-148
Table 4-51 Address Table Commands 4-149
Table 4-50 show lacp sysid - display description 4-149
Table 4-52 Spanning Tree Commands 4-153
Table 4-53 VLAN Commands 4-172
Table 4-54 Editing VLAN Groups 4-172
Table 4-55 Configuring VLAN Interfaces 4-174
Table 4-56 Show VLAN Commands 4-180
Table 4-57 Private VLAN Commands 4-181
Table 4-58 Protocol VLAN Commands 4-182
Table 4-59 GVRP and Bridge Extension Commands 4-186
Table 4-60 Priority Commands 4-190
Table 4-61 Priority Commands (Layer 2) 4-190
Table 4-62 Default CoS Priority Levels 4-194
Table 4-63 Priority Commands (Layer 3 and 4) 4-196
Table 4-64 Mapping IP Precedence to CoS Values 4-198
Table 4-65 Mapping IP DSCP to CoS Values 4-200
Table 4-66 Multicast Filtering Commands 4-203
Table 4-67 IGMP Snooping Commands 4-204
Table 4-68 IGMP Query Commands (Layer 2) 4-207
Table 4-69 Static Multicast Routing Commands 4-210
Table 4-70 IP Interface Commands 4-212
Table B-1 Troubleshooting Chart B-1

xvi

Figures

Figure 3-1 Home Page 3-2
Figure 3-2 Front Panel Indicators 3-3
Figure 3-3 System Information 3-9
Figure 3-4 Switch Information 3-11
Figure 3-5 Displaying Bridge Extension Configuration 3-12
Figure 3-6 IP Interface Configuration - Manual 3-14
Figure 3-7 IP Interface Configuration - DHCP 3-15
Figure 3-8 Downloading Firmware to the Switch 3-16
Figure 3-9 Setting the Startup Code 3-17
Figure 3-10 Downloading Configuration Settings 3-18
Figure 3-11 Setting the Startup Configuration Settings 3-18
Figure 3-12 System Logs 3-20
Figure 3-13 Remote Logs 3-21
Figure 3-14 Displaying Logs 3-22
Figure 3-15 Enabling and Configuring SMTP Alerts 3-24
Figure 3-16 Resetting the System 3-25
Figure 3-17 Configuring SNTP 3-26
Figure 3-18 Clock Time Zone 3-27
Figure 3-19 Configuring SNMP Community Strings 3-29
Figure 3-20 Configuring SNMP Trap Managers 3-30
Figure 3-21 Authentication Server Settings 3-33
Figure 3-22 HTTPS Settings 3-35
Figure 3-23 SSH Host-Key Settings 3-39
Figure 3-24 SSH Server Settings 3-40
Figure 3-25 Port Security 3-42
Figure 3-26 802.1X Information 3-45
Figure 3-27 802.1X Configuration 3-47
Figure 3-28 802.1X Port Configuration 3-48
Figure 3-29 802.1X Port Statistics 3-49
Figure 3-30 IP Filter 3-51
Figure 3-31 Selecting ACL Type 3-53
Figure 3-32 ACL Configuration - Standard IP 3-54
Figure 3-33 ACL Configuration - Extended IP 3-56
Figure 3-34 ACL Configuration - MAC 3-58
Figure 3-35 Selecting ACL Mask Types 3-59
Figure 3-36 ACL Mask Configuration - IP 3-61
Figure 3-37 ACL Mask Configuration - MAC 3-62
Figure 3-38 ACL Port Binding 3-64
Figure 3-39 Port - Port Information 3-65
Figure 3-40 Port - Port Configuration 3-68
Figure 3-41 Static Trunk Configuration 3-70
Figure 3-42 LACP Trunk Configuration 3-72

xvii

Figures

Figure 3-43 LACP - Aggregation Port 3-74
Figure 3-44 LACP - Port Counters Information 3-76
Figure 3-45 LACP - Port Internal Information 3-78
Figure 3-46 LACP - Port Neighbors Information 3-79
Figure 3-47 Port Broadcast Control 3-81
Figure 3-48 Mirror Port Configuration 3-82
Figure 3-49 Rate Limit Configuration 3-83
Figure 3-50 Port Statistics 3-87
Figure 3-51 Static Addresses 3-89
Figure 3-52 Dynamic Addresses 3-90
Figure 3-53 Address Aging 3-91
Figure 3-54 STA Information 3-94
Figure 3-55 STA Configuration 3-99
Figure 3-56 STA Port Information 3-102
Figure 3-57 STA Port Configuration 3-105
Figure 3-58 MSTP VLAN Configuration 3-106
Figure 3-59 MSTP Port Information 3-108
Figure 3-60 MSTP Port Configuration 3-110
Figure 3-61 Globally Enabling GVRP 3-114
Figure 3-62 VLAN Basic Information 3-114
Figure 3-63 VLAN Current Table 3-115
Figure 3-64 VLAN Static List - Creating VLANs 3-117
Figure 3-65 VLAN Static Table - Adding Static Members 3-118
Figure 3-66 VLAN Static Membership by Port 3-119
Figure 3-67 VLAN Port Configuration 3-121
Figure 3-68 Private VLAN Status 3-122
Figure 3-69 Private VLAN Link Status 3-123
Figure 3-70 Protocol VLAN Configuration 3-124
Figure 3-71 Protocol VLAN Port Configuration 3-125
Figure 3-72 Default Port Priority 3-127
Figure 3-73 Traffic Classes 3-129
Figure 3-74 Queue Mode 3-130
Figure 3-75 Queue Scheduling 3-131
Figure 3-76 IP Precedence/DSCP Priority Status 3-132
Figure 3-77 IP Precedence Priority 3-133
Figure 3-78 IP DSCP Priority 3-135
Figure 3-79 IP Port Priority Status 3-136
Figure 3-80 IP Port Priority 3-136
Figure 3-81 ACL CoS Priority 3-138
Figure 3-82 ACL Marker 3-139
Figure 3-83 IGMP Configuration 3-142
Figure 3-84 Multicast Router Port Information 3-143
Figure 3-85 Static Multicast Router Port Configuration 3-144
Figure 3-86 IP Multicast Registration Table 3-145
Figure 3-87 IGMP Member Port Table 3-146

xviii

Figures

Figure 3-88 DNS General Configuration 3-148
Figure 3-89 DNS Static Host Table 3-150
Figure 3-90 DNS Cache 3-151

xix

Figures

xx

Chapter 1: Introduction

This switch provides a broad range of features for Layer 2 switching. It includes a
management agent that allows you to configure the features listed in this manual.
The default configuration can be used for most of the features provided by this
switch. However, there are many options that you should configure to maximize the
switch’s performance for your particular network environment.

Key Features

Table 1-1. Key Features

Feature Description

Configuration Backup
and Restore

Authentication Console, Telnet, web – User name / password, RADIUS, TACACS+

Access Control Lists Supports up to 32 IP or MAC ACLs

DHCP Client Supported

DNS Server Supported

Port Configuration Speed, duplex mode and flow control

Rate Limiting Input and output rate limiting per port

Port Mirroring One or more ports mirrored to single analysis port

Port Trunking Supports up to 6 trunks using either static or dynamic trunking (LACP)

Broadcast Storm
Control

Static Address Up to 16K MAC addresses in the forwarding table

IEEE 802.1D Bridge Supports dynamic data switching and addresses learning

Store-and-Forward
Switching

Spanning Tree
Protocol

Virtual LANs Up to 255 using IEEE 802.1Q, port-based, protocol-based, or private VLANs

Traffic Prioritization Default port priority, traffic class map, queue scheduling, IP Precedence, or

Multicast Filtering Supports IGMP snooping and query

Backup to TFTP server

Web – HTTPS; Telnet – SSH
SNMP – Community strings, IP address filtering
Port – IEEE 802.1X, MAC address filtering

Supported

Supported to ensure wire-speed switching while eliminating bad frames

Supports standard STP, Rapid Spanning Tree Protocol (RSTP), and Multiple
Spanning Tree Protocol (MSTP)

Differentiated Services Code Point (DSCP), and TCP/UDP Port

1-1

Introduction

1

Description of Software Features

The switch provides a wide range of advanced performance enhancing features.
Flow control eliminates the loss of packets due to bottlenecks caused by port
saturation. Broadcast storm suppression prevents broadcast traffic storms from
engulfing the network. Untagged (port-based), tagged, and protocol-based VLANs,
plus support for automatic GVRP VLAN registration provide traffic security and
efficient use of network bandwidth. CoS priority queueing ensures the minimum
delay for moving real-time multimedia data across the network. While multicast
filtering provides support for real-time network applications. Some of the
management features are briefly described below.

Configuration Backup and Restore – You can save the current configuration
settings to a file on a TFTP server, and later download this file to restore the switch
configuration settings.

Authentication – This switch authenticates management access via the console
port, Telnet or web browser. User names and passwords can be configured locally or
can be verified via a remote authentication server (i.e., RADIUS or TACACS+).
Port-based authentication is also supported via the IEEE 802.1X protocol. This
protocol uses the Extensible Authentication Protocol over LANs (EAPOL) to request
user credentials from the 802.1X client, and then verifies the client’s right to access
the network via an authentication server.

Other authentication options include HTTPS for secure management access via the
web, SSH for secure management access over a Telnet-equivalent connection, IP
address filtering for SNMP/web/Telnet management access, and MAC address
filtering for port access.

Access Control Lists – ACLs provide packet filtering for IP frames (based on
address, protocol, TCP/UDP port number or TCP control code) or any frames
(based on MAC address or Ethernet type). ACLs can by used to improve
performance by blocking unnecessary network traffic or to implement security
controls by restricting access to specific network resources or protocols.

Port Configuration – You can manually configure the speed, duplex mode, and
flow control used on specific ports, or use auto-negotiation to detect the connection
settings used by the attached device. Use the full-duplex mode on ports whenever
possible to double the throughput of switch connections. Flow control should also be
enabled to control network traffic during periods of congestion and prevent the loss
of packets when port buffer thresholds are exceeded. The switch supports flow
control based on the IEEE 802.3x standard.

Rate Limiting – This feature controls the maximum rate for traffic transmitted or
received on an interface. Rate limiting is configured on interfaces at the edge of a
network to limit traffic into or out of the network. Traffic that falls within the rate limit is
transmitted, while packets that exceed the acceptable amount of traffic are dropped.

1-2

Description of Software Features

Port Mirroring – The switch can unobtrusively mirror traffic from any port to a
monitor port. You can then attach a protocol analyzer or RMON probe to this port to
perform traffic analysis and verify connection integrity.

Port Trunking – Ports can be combined into an aggregate connection. Trunks can
be manually set up or dynamically configured using IEEE 802.3ad Link Aggregation
Control Protocol (LACP). The additional ports dramatically increase the throughput
across any connection, and provide redundancy by taking over the load if a port in
the trunk should fail. The switch supports up to 6 trunks.

Broadcast Storm Control – Broadcast suppression prevents broadcast traffic from
overwhelming the network. When enabled on a port, the level of broadcast traffic
passing through the port is restricted. If broadcast traffic rises above a pre-defined
threshold, it will be throttled until the level falls back beneath the threshold.

Static Addresses – A static address can be assigned to a specific interface on this
switch. Static addresses are bound to the assigned interface and will not be moved.
When a static address is seen on another interface, the address will be ignored and
will not be written to the address table. Static addresses can be used to provide
network security by restricting access for a known host to a specific port.

IEEE 802.1D Bridge – The switch supports IEEE 802.1D transparent bridging. The
address table facilitates data switching by learning addresses, and then filtering or
forwarding traffic based on this information. The address table supports up to 16K
addresses.

Store-and-Forward Switching – The switch copies each frame into its memory
before forwarding them to another port. This ensures that all frames are a standard
Ethernet size and have been verified for accuracy with the cyclic redundancy check
(CRC). This prevents bad frames from entering the network and wasting bandwidth.

To avoid dropping frames on congested ports, the switch provides 1 MB for frame
buffering for the ES4524C and 2 MB for the ES4548C. This buffer can queue
packets awaiting transmission on congested networks.

Spanning Tree Protocol – The switch supports these spanning tree protocols:

Spanning Tree Protocol (STP, IEEE 802.1D) – This protocol adds a level of fault
tolerance by allowing two or more redundant connections to be created between a
pair of LAN segments. When there are multiple physical paths between segments,
this protocol will choose a single path and disable all others to ensure that only one
route exists between any two stations on the network. This prevents the creation of
network loops. However, if the chosen path should fail for any reason, an alternate
path will be activated to maintain the connection.

Rapid Spanning Tree Protocol (RSTP, IEEE 802.1w) – This protocol reduces the
convergence time for network topology changes to about 10% of that required by the
older IEEE 802.1D STP standard. It is intended as a complete replacement for STP,
but can still interoperate with switches running the older standard by automatically
reconfiguring ports to STP-compliant mode if they detect STP protocol messages
from attached devices.

1

1-3

Introduction

1

Multiple Spanning Tree Protocol (MSTP, IEEE 802.1s) – This protocol is a direct
extension of RSTP. It can provide an independent spanning tree for different VLANs.
It simplifies network management, provides for even faster convergence than RSTP
by limiting the size of each region, and prevents VLAN members from being
segmented from the rest of the group (as sometimes occurs with IEEE 802.1D STP).

Virtual LANs – The switch supports up to 255 VLANs. A Virtual LAN is a collection
of network nodes that share the same collision domain regardless of their physical
location or connection point in the network. The switch supports tagged VLANs
based on the IEEE 802.1Q standard. Members of VLAN groups can be dynamically
learned via GVRP, or ports can be manually assigned to a specific set of VLANs.
This allows the switch to restrict traffic to the VLAN groups to which a user has been
assigned. By segmenting your network into VLANs, you can:

• Eliminate broadcast storms which severely degrade performance in a flat network.

• Simplify network management for node changes/moves by remotely configuring
VLAN membership for any port, rather than having to manually change the network
connection.

• Provide data security by restricting all traffic to the originating VLAN.

• Use private VLANs to restrict traffic to pass only between data ports and the uplink
ports, thereby isolating adjacent ports within the same VLAN, and allowing you to
limit the total number of VLANs that need to be configured.

• Use protocol VLANs to restrict traffic to specified interfaces based on protocol type

Traffic Prioritization – This switch prioritizes each packet based on the required
level of service, using eight priority queues with strict or Weighted Round Robin
Queuing. It uses IEEE 802.1p and 802.1Q tags to prioritize incoming traffic based on
input from the end-station application. These functions can
independent priorities for delay-sensitive data and best-effort data.

This switch also supports several common methods of prioritizing layer 3/4 traffic to
meet application requirements. Traffic can be prioritized based on the priority bits in
the IP frame’s Type of Service (ToS) octet or the number of the TCP/UDP port.
When these services are enabled, the priorities are mapped to a Class of Service
value by the switch, and the traffic then sent to the corresponding output queue.

Multicast Filtering – Specific multicast traffic can be assigned to its own VLAN to
ensure that it does not interfere with normal network traffic and to guarantee
real-time delivery by setting the required priority level for the designated VLAN. The
switch uses IGMP Snooping and Query to manage multicast group registration.

be used to provide

1-4

System Defaults

1

System Defaults

The switch’s system defaults are provided in the configuration file
“Factory_Default_Config.cfg.” To reset the switch defaults, this file should be set as
the startup configuration file (page 3-18).

The following table lists some of the basic system defaults.

Table 1-2. System Defaults

Function Parameter Default

Console Port
Connection

Authentication Privileged Exec Level Username “admin”

Web Management HTTP Server Enabled

SNMP Community Strings “public” (read only)

Baud Rate auto

Data bits 8

Stop bits 1

Parity none

Local Console Timeout 0 (disabled)

Password “admin”

Normal Exec Level Username “guest”

Enable Privileged Exec from Normal
Exec Level

RADIUS Authentication Disabled

TACACS Authentication Disabled

802.1X Port Authentication Disabled

HTTPS Enabled

SSH Disabled

Port Security Disabled

IP Filtering Disabled

HTTP Port Number 80

HTTP Secure Server Enabled

HTTP Secure Port Number 443

Traps Authentication traps: enabled

Password “guest”

Password “super”

“private” (read/write)

Link-up-down events: enabled

1-5

Introduction

1

Table 1-2. System Defaults

Function Parameter Default

Port Configuration Admin Status Enabled

Auto-negotiation Enabled

Flow Control Disabled

Port Capability 1000BASE-T –

Module Port Capability 1000BASE-SX/LX/LH –

Rate Limiting Input and output limits Disabled

Port Trunking Static Trunks None

LACP (all ports) Disabled

Broadcast Storm
Protection

Spanning Tree
Protocol

Address Table Aging Time 300 seconds

Virtual LANs Default VLAN 1

Traffic Prioritization Ingress Port Priority 0

Status Enabled (all ports)

Broadcast Limit Rate 500 packets per second

Status Enabled, MSTP

Fast Forwarding (Edge Port) Disabled

PVID 1

Acceptable Frame Type All

Ingress Filtering Disabled

Switchport Mode (Egress Mode) Hybrid: tagged/untagged frames

GVRP (global) Disabled

GVRP (port interface) Disabled

Weighted Round Robin Queue: 0 1 2 3 4 5 6 7

IP Precedence Priority Disabled

IP DSCP Priority Disabled

10 Mbps half duplex
10 Mbps full duplex
100 Mbps half duplex
100 Mbps full duplex
1000 Mbps full duplex
Full-duplex flow control disabled
Symmetric flow control disabled

1000 Mbps full duplex
Full-duplex flow control disabled
Symmetric flow control disabled

(Defaults: All values based on IEEE 802.1s)

Weight: 1 2 4 6 8 10 12 14

1-6

Table 1-2. System Defaults

Function Parameter Default

IP Settings IP Address 0.0.0.0

Subnet Mask 255.0.0.0

Default Gateway 0.0.0.0

DHCP Client: Enabled

BOOTP Disabled

DNS Server Lookup Disabled

Multicast Filtering IGMP Snooping Snooping: Enabled

Querier: Enabled

System Log Status Enabled

Messages Logged Levels 0-7 (all)

Messages Logged to Flash Levels 0-3

SMTP Email Alerts Event Handler Disabled

SNTP Clock Synchronization Disabled

System Defaults

1

1-7

1

Introduction

1-8