Alcatel OmniSwitch 6600-P24 Management Manual Download Page 176

Page: 176 / 264

Switch Security Specifications

Managing Switch Security

page 8-2

OmniSwitch 6600 Family Switch Management Guide

April 2006

Switch Security Specifications

Switch Security Defaults

Access to managing the switch is always available for the

admin

user through the console port, even if

management access to the console port is disabled for other users.

Telnet sessions allowed

4 concurrent sessions

FTP sessions allowed

4 concurrent sessions

HTTP (Web browser) sessions allowed

4 concurrent sessions

Secure Shell session (including SFTP) allowed

8 concurrent sessions

Total sessions (Telnet, FTP, HTTP, console)

13 concurrent sessions

SNMP sessions allowed

50 concurrent sessions

Summary of Contents for OmniSwitch 6600-P24

Page 1: ...Part No 060180 10 Rev F April 2006 OmniSwitch 6600 Family Switch Management Guide www alcatel com...

Page 2: ...stered trademarks of Alcatel Internetworking Inc OmniAccess Omni Switch Router PolicyView RouterView SwitchManager VoiceView WebView X Cell X Vision and the Xylan logo are trademarks of Alcatel Intern...

Page 3: ...ions 1 2 Login Defaults 1 2 Quick Steps for Logging Into the Switch 1 3 Overview of Switch Login Components 1 4 Management Interfaces 1 4 Logging Into the CLI 1 4 Using the WebView Management Tool 1 5...

Page 4: ...2 7 Single Characters 2 7 Directory Commands 2 8 Determining Your Location in the File Structure 2 8 Changing Directories 2 9 Displaying Directory Contents 2 10 Making a New Directory 2 11 Displaying...

Page 5: ...ng Date and Time 2 35 Date 2 35 Time Zone 2 35 Time 2 36 Daylight Savings Time Configuration 2 37 Enabling DST 2 38 Chapter 3 Configuring Network Time Protocol NTP 3 1 In This Chapter 3 1 NTP Specific...

Page 6: ...ile 4 30 Can I Restore the boot file While Running from Certified 4 30 Displaying CMM Conditions 4 31 Chapter 5 Using the CLI 5 1 CLI Specifications 5 2 CLI Overview 5 2 Online Configuration 5 2 Offli...

Page 7: ...2 Quick Steps for Applying Configuration Files 6 4 Setting a File for Immediate Application 6 4 Setting an Application Session for a Date and Time 6 5 Setting an Application Session for a Specified Ti...

Page 8: ...Access From a User 7 13 Setting Up End User Profiles 7 14 Creating End User Profiles 7 15 Setting Up Port Ranges in a Profile 7 15 Setting Up VLAN Ranges in a Profile 7 15 Associating a Profile With...

Page 9: ...ome Page 9 8 Configuration Page 9 9 Global Configuration Page 9 9 Table Configuration Page 9 10 Table Features 9 12 Adjacencies 9 16 WebView Help 9 17 General WebView Help 9 17 Specific page Help 9 17...

Page 10: ...31 MIB Tables 10 31 MIB Table Description 10 31 Industry Standard MIBs 10 32 Enterprise Proprietary MIBs 10 36 Verifying the SNMP Configuration 10 39 Appendix A Software License and Copyright Statemen...

Page 11: ...niSwitch 6600 Family switches are next generation enterprise edge workgroup switches The OmniSwitch 6624 and 6602 24 offer 24 copper 10 100 ports the 6600 P24 offers 24 copper 10 100 Power over Ethern...

Page 12: ...d in the OmniSwitch 6600 Family will benefit from the material in this configuration guide When Should I Read this Manual Read this guide as soon as your switch is up and running and you are ready to...

Page 13: ...des a complete context sensitive on line help system This guide provides overview material on software features how to procedures and tutorials that will enable you to begin configuring your OmniSwitc...

Page 14: ...uded with your switch this guide provides all the information you need to get your switch up and running the first time This guide provides information on unpacking the switch rack mounting the switch...

Page 15: ...h Management Guide and OmniSwitch 6624 6648 Hardware Users Guide respectively Stage 3 Integrating the Switch Into a Network Pertinent Documentation OmniSwitch 6600 Family Network Configuration Guide O...

Page 16: ...e to all CLI commands supported on the OmniSwitch 6600 7700 7800 and 8800 Includes syntax definitions default values examples usage guidelines and CLI to MIB variable mappings OmniSwitch 6600 Family S...

Page 17: ...in the advanced routing software package OSPF Note The OmniSwitch 6600 Family Advanced Routing Configuration Guide was originally known as the OmniSwitch 66 24 6648 Advanced Routing Configuration Gui...

Page 18: ...h slightly smaller margins Technical Support An Alcatel service agreement brings your company the assurance of 7x24 no excuses technical support You ll also receive regular software updates to maintai...

Page 19: ...managing sessions and specifying a DNS resolver For more details about the syntax of referenced commands see the OmniSwitch CLI Reference Guide Configuration procedures described in this chapter incl...

Page 20: ...Netscape for Windows NT Windows XP and Windows 2000 version 4 7 Netscape for Sun OS 2 8 version 4 7 Netscape for HP UX 11 0 version 4 7 Secure Shell clients supported Any standard Secure Shell client...

Page 21: ...nal will automatically display the switch login prompt If you are connected remotely you must enter the switch IP address in your Telnet FTP or Secure Shell client typically the IP address of the EMP...

Page 22: ...Authenticated Switch Access ASA Authenticated Switch Access is described in detail in Chapter 8 Managing Switch Security An overview of management methods is listed here Logging Into the CLI Console p...

Page 23: ...servers The accounts include a username and password In addition they also specify the user s privileges or end user profile depending on the type of user account In either case the user is given rea...

Page 24: ...for the EMP The switch s welcome banner and login prompt display Note A Telnet connection is not secure Secure Shell is recommended instead of Telnet or FTP as a secure method of accessing the switch...

Page 25: ...ogin to the switch start your FTP client Where the FTP client asks for Name enter the IP address of your switch Where the FTP client asks for User ID enter the username of your login account on the sw...

Page 26: ...terface and SFTP are recommended instead of the Telnet program or the FTP protocol for communications over TCP IP for sending file transfers Both Telnet and FTP are available on the OmniSwitch but the...

Page 27: ...a Secure Shell client and also as an entry point into the network In this scenario the client portion of the Secure Shell software is used on the connecting OmniSwitch and the server portion of Secure...

Page 28: ...e is completed the client and the server turn encryption on using the selected algorithm and key The following elements are supported Note The OmniSwitch generates a 512 bit DSA host key at initial st...

Page 29: ...e device you are logging into will request your password as shown here ssh 11 333 10 135 login as rrlogin1 rrlogin1 s password for keyboard interactive method Once the Secure Shell session is establis...

Page 30: ...ure Shell session Closing a Secure Shell Session To terminate the Secure Shell session issue the exit command The following will display exit Connection to 11 333 30 135 closed Using the example shown...

Page 31: ...ting mkdir path Create remote directory put local path remote path Upload file pwd Display remote working directory exit Quit sftp quit Quit sftp rename oldpath newpath Rename remote file rmdir path R...

Page 32: ...ted States Patent and Trademark Office LOGIN ALERT This switch is a secure device Unauthorized use of this switch will go on your permanent record Two steps are required to change the login banner The...

Page 33: ...h will break the TCP connection You may also set the length of time allowed for a successful login by using the session login timeout command as follows session login timeout 20 In this example the us...

Page 34: ...meout for new FTP sessions to 5 minutes Current FTP sessions are not affected For more information about FTP sessions see Using FTP on page 1 7 The http option sets the timeout for WebView sessions Fo...

Page 35: ...You must perform three steps on the switch to enable the DNS resolver service 1 Set the default domain name for DNS lookups with the ip domain name CLI command ip domain name mycompany1 com 2 Specify...

Page 36: ...Verifying Login Settings Logging Into the Switch page 1 18 OmniSwitch 6600 Family Switch Management Guide April 2006...

Page 37: ...opy move remove rename and display directory information System Date and Time set system clock CLI commands are used in the configuration examples for more details about the syntax of commands see the...

Page 38: ...h memory available for switch files and directories Contains the certified and working directories File Directory Name Metrics 32 characters maximum for directory and file names 255 character maximum...

Page 39: ...also want to establish a file directory structure to help organize your files on the switch All of the files and directories on the switch bear a time stamp This is useful for switch administration be...

Page 40: ...you to organize your config uration and text files on the switch You can also use the vi command to create files This chapter tells you how to make copy move and delete both files and directories Swit...

Page 41: ...tributes Utility commands display memory and system diagnostic information The following illustration represents a sample flash directory that contains three directories and six files at the top level...

Page 42: ...nd write rw permissions The second entry shows a file for which the user has read and write rw permissions The second column indicates the number of bytes of flash memory the row entry occupies drw 51...

Page 43: ...21 19 49 swlog1 log rw 64000 Aug 12 19 06 swlog2 log The following command lists all entries in the current directory that contain the i character ls i Listing Directory flash drw 2048 Aug 21 17 49 ce...

Page 44: ...g drawing is a logical representation of the file directory shown in the illustration on page 2 5 Sample Switch Directory Tree Determining Your Location in the File Structure Use the pwd command to di...

Page 45: ...certified To move up the directory tree use the cd command Enter cd cd dot dot without specifying a direc tory name and your current directory will move up one directory level If you enter cd without...

Page 46: ...ul 15 14 59 NETWORK drw 512 Oct 25 14 17 WORKING rw 321 Oct 25 14 39 boot params rw 163258 Oct 2 11 04 cs_system pmd rw 11 Jul 30 14 09 boot slot cfg rw 693 Oct 9 11 55 boot cfg 1 err rw 0 Oct 28 11 1...

Page 47: ...nd requires a slash and no space between the path and the new directory name Also a slash is required at the beginning of your path specification The following command makes a new directory in the wor...

Page 48: ...4 Hweb img Listing Directory flash working newdir drw 2048 Oct 14 17 14 drw 2048 Oct 14 17 14 Copying an Existing Directory The cp r command recursively copies directories as well as any associated su...

Page 49: ...25 14 21 Hrelease img rw 193819 Oct 25 14 21 Hwebsecu im Listing Directory flash certified working drw 2048 Oct 14 17 14 drw 2048 Oct 14 17 12 drw 2048 Oct 14 17 14 newdir1 rw 4347 Oct 2 12 25 boot c...

Page 50: ...r the new copy being created If no path is specified the command assumes the current directory The following syntax copies the Hos img file from the working directory to the certified directory cp fla...

Page 51: ...working testfile2 WARNING renaming file flash testfiles testfile2 flash working testfile2 In the next example the user s current directory is the flash testfiles directory as shown in the illustration...

Page 52: ...ivileges for any file being deleted delete flash config txt Managing Files on Non Primary Switches You can copy a file from a non primary switch to the primary switch in a stack with the rcp command T...

Page 53: ...rw 68559 Mar 9 06 58 Hwebadvrout img rw 16730 Feb 27 13 21 boot cfg rw 105613 Feb 26 15 54 certs pem rw 105613 Feb 26 15 54 certs pem bak Utility Commands The utility commands include freespace fsck a...

Page 54: ...total free space 19 242 Kb max contiguous free space 7 454 720 bytes of files 28 of folders 4 total bytes in files 10 262 Kb of lost chains 0 total bytes in lost chains 0 Deleting the Entire File Syst...

Page 55: ...iles may take several minutes to complete For details see Using Zmodem on page 2 24 Using the Switch as an FTP Server The switch can act as an FTP server for receiving files transferred from your work...

Page 56: ...onfiguration file you must specify the ASCII transfer mode 3 Transfer the file Use the FTP put command or click the client s download button to send the file to the switch When you use FTP to transfer...

Page 57: ...ftp command to start its FTP client 1 Establish a connection to the switch as explained in your Getting Started Guide 2 Log on to the switch and enter the ftp command to start the FTP client Next ente...

Page 58: ...t bye Close session gracefully cd Change to a new directory on the remote machine delete Delete a file on the remote machine dir Obtain a long listing on the remote machine get Retrieve a file from th...

Page 59: ...h Change local directory to path chmod mode path Change permissions of file path to mode help Display this help text get remote path local path Download file lls path Display local directory listing l...

Page 60: ...are for details Note If a file you are transferring already exists in the switch s flash memory you must remove the file before transferring the new file via Zmodem To transfer a file via Zmodem compl...

Page 61: ...600 Family Switch Management Guide April 2006 page 2 25 Note Files transferred via Zmodem are loaded into the flash directory Before the new files can be used by the switch you must transfer them to t...

Page 62: ...iles that are certified as the default start up files for the switch These are the trusted configuration and binary image files They will be used in the event of a non specified reload Do not attempt...

Page 63: ...ollowing command install img For more information refer to Using Wildcards on page 2 7 Executing the install command adds comments to the Release archive and package name in addition version numbers a...

Page 64: ...outing Hbase img Base Software Base Software Hdiag img Base Software Diagnostics Heni img Base Software Ethernet Images Hl2eth img Base Software Layer 2 and Ethernet drivers Hos img Base Software Oper...

Page 65: ...FTP client asks for Name enter the IP address of your switch Where the FTP client asks for User ID enter admin Where the FTP client asks for Password enter switch or your custom config ured password...

Page 66: ...ow to transfer files into the directory and how to list the files 1 Log onto the switch and use the mkdir command to create a new directory called resources mkdir resources 2 Verify that the new direc...

Page 67: ...itch as an FTP client 1 Log into the switch Use the ls command to verify that your current directory is flash ls Listing Directory flash rw 272 Jun 12 15 57 boot params drw 2048 Jun 12 17 52 certified...

Page 68: ...IP address 4 Enter a valid user name and password for the host you specified with the ftp command A screen similar to the following displays Name d Jsmith 331 Password required for Jsmith Password 23...

Page 69: ...30 125 login as rrlogin2 rrlogin2 s password for keyboard interactive method Once the correct password is given and the login is completed the sftp prompt displays This indicates that you are in the...

Page 70: ...ile1 rr 2 To verify that the file was transferred to the correct destination use the Secure Shell FTP cd command to move your log the newssdir directory Then use the ls command to list the contents of...

Page 71: ...tent Date To display the current system date for your switch use the system date command If you do not specify a new date in the command line the switch will display the current system date To modify...

Page 72: ...mber of hours offset from UTC such as ten hours use the following command syntax system timezone 10 Values to specify hours for offset range from 13 through 12 Time To display the current local time f...

Page 73: ...ition of that day in the month e g first second third fourth or last Sunday of the month The hour and minute of the day at which DST will begin The day of the week and month of the year when DST will...

Page 74: ...ollowing command system daylight savings time enable Note If your time zone shows No default in the Time Zone and DST Information Table below under the DST parameters refer to Daylight Savings Time Co...

Page 75: ...default zm3 No standard name 03 00 No default No default No default nst Newfoundland 03 30 1st Sunday in Apr at 2 00 a m Last Sunday in Oct at 2 00 a m 1 00 ast Atlantic Standard Time 04 00 1st Sunday...

Page 76: ...Setting the System Clock Managing System Files page 2 40 OmniSwitch 6600 Family Switch Management Guide April 2006...

Page 77: ...for example In This Chapter This chapter describes the basic components of the OmniSwitch implementation of Network Time Proto col and how to configure it through the Command Line Interface CLI CLI c...

Page 78: ...Cs supported 1305 Network Time Protocol Maximum number of NTP servers per client 3 Parameter Description Command Default Value Comments Specifies an NTP server from which this switch will receive upda...

Page 79: ...heck the server status using the show ntp server status command as shown show ntp server status IP address 1 2 5 6 Prefer yes Version 4 Key 0 Stratum 2 Minpoll 6 Maxpoll 10 Delay 0 016 seconds Offset...

Page 80: ...ut its axis and the Gregorian Calendar representing the Earth s rotation about the Sun The UTC timescale is disciplined with respect to International Atomic Time TAI by inserting leap seconds at inter...

Page 81: ...everal servers claiming synchronization to the standard time are in disagreement then one or more of them must be out of synchronization or not functioning correctly The stratum gradiation is used to...

Page 82: ...hen check the time information with peers at the same stratum The stratum 2 machines synchronize to the stratum 1 servers but do not send time information to the stratum 1 machines Machines 2a and 2b...

Page 83: ...tion This is done by using a key file The key file is loaded into the switch memory and consists of a text file that lists key identifiers that correspond to particular NTP entities If authentication...

Page 84: ...operate in broadcast mode Broadcast mode specifies a client switch listens on all interfaces for server broadcast timestamp information It uses these messages to update its time To set an OmniSwitch...

Page 85: ...ng 2 to the power of the number entered using the ntp server command with the server IP address or domain name and the minpoll keyword For example to set the minimum poll time to 128 seconds enter the...

Page 86: ...ion 2 Make sure the key file with the NTP server s MD5 key is loaded into the switch memory by issuing the ntp key load command as shown ntp key load 3 Set the server authentication key identification...

Page 87: ...ter in the OmniSwitch CLI Reference Guide Examples of the show ntp client show ntp server status and show ntp client server list command outputs are given in the section NTP Quick Steps on page 3 3 s...

Page 88: ...Verifying NTP Configuration Configuring Network Time Protocol NTP page 3 12 OmniSwitch 6600 Family Switch Management Guide April 2006...

Page 89: ...tack configuration software A detailed description of the stack configuration software and how it works is given in Managing Stacks in the OmniSwitch 6600 Family Hardware Users Guide In This Chapter T...

Page 90: ...Switch 6600 Family Switch Management Guide April 2006 CMM Specifications Size of Flash Memory 64 Megabytes Size of RAM Memory 128 Megabytes Maximum Length of File Names 32 Characters Maximum Length of...

Page 91: ...and revised with future releases or enhancements Image and configuration files are stored in the Flash memory which is equivalent to a hard drive memory in specified directories When the switch is run...

Page 92: ...nitially when normally booting the switch the software is loaded from the certified directory This is the repository for the most reliable software When the switch is booted the certified directory is...

Page 93: ...the certified directory the contents of which are loaded into the running configuration Since the working and certified directories are exactly the same the switch is running from the working directo...

Page 94: ...is is illustrated in the diagram below Running Configuration Saved to Working Directory It is important to note that in the above scenario the switch is using the configuration file from the certi fie...

Page 95: ...ot Since the working and certified directories are exactly the same the switch is running from the working directory Running Configuration is Saved to Working then Certified Directory R W C R W C R W...

Page 96: ...corrupted during the FTP transfer Rather than having a disabled switch the network administrator can reboot the switch from the certified directory which has the previous more reliable version of the...

Page 97: ...in the OmniSwitch 6600 Family Hardware Users Guide Note A redundant stacking cable is required to fully support redundancy Redundancy Scenarios The following scenarios demonstrate how the CMM software...

Page 98: ...d is a three switch stack Booting from the Working Directory This synchronization process occurs automatically on a working directory reboot Note It is important to certify the working directory and s...

Page 99: ...ied Directory on page 4 25 Note It is important to certify the working directory and synchronize the stack as soon as the validity of the software is established Stacks booted from the working directo...

Page 100: ...am illustrates this idea The diagram shows a stack of three switches to which a fourth switch is added Synchronizing a Stack with more three Switches W C W C W C W C 1 Stack is pow ered up and boots f...

Page 101: ...4 24 See the OmniSwitch 6600 Family Hardware Users Guide for more information on switch redundancy Rebooting the Switch When booting the switch the software in the certified directory is loaded into...

Page 102: ...using the in or at keywords To schedule a reboot of the primary CMM in 3 hours and 3 minutes you would enter reload primary in 3 03 To schedule a reboot of the primary CMM for June 30 at 8 00pm you w...

Page 103: ...ration and the boot cfg file in the working directory are iden tical Should the switch go down or reboot the configuration changes made can be restored Note If the switch is rebooted at this point in...

Page 104: ...planation The copy running config working and write memory commands are described in detail in the OmniSwitch CLI Reference Guide Note The saved boot cfg file will be overwritten if the takeover comma...

Page 105: ...used to initially boot the switch 2 Changes are made to the configuration file and are saved to the configuration file in the working direc tory using the copy running config working command described...

Page 106: ...ions of switch software Certifying the working directory is described in Copying the Working Directory to the Certified Directory on page 4 20 while synchronizing the switch is described in Synchroniz...

Page 107: ...ch 6600 Family Switch Management Guide April 2006 page 4 19 Cancelling a Rollback Timeout To cancel a rollback timeout enter the reload cancel command as shown reload primary cancel or reload cancel T...

Page 108: ...ots from the certified directory and changes are made to the running configuration 2 The changes are saved to the working directory as the boot cfg file 3 The contents of the working directory are sav...

Page 109: ...ed Only image files the boot cfg file and the certs pem file should be kept in the working directory Note It is important to synchronize the stack as soon as the validity of the software is establishe...

Page 110: ...witch is currently running enter the following command show running directory CONFIGURATION STATUS Running CMM PRIMARY CMM Mode DUAL CMMs Current CMM Slot 1 Running configuration WORKING Certify Resto...

Page 111: ...1 1088725 Alcatel Operating System Hqos img 5 4 1 231 R01 242661 Alcatel Quality of Service Hrout img 5 4 1 231 R01 640161 Alcatel Routing Hsecu img 5 4 1 231 R01 129974 Alcatel Security Hweb img 5 4...

Page 112: ...etting time parame ters in conjuction with the reload command For example to schedule a reboot of the secondary CMM in 8 hours and 15 minutes on the same day enter the following at the prompt reload s...

Page 113: ...To copy the working directory to the certified directory of the primary CMM and at the same time synchronize the software of the primary and secondary CMM use the following command copy working certif...

Page 114: ...o the working direc tory 2 A reboot of the secondary CMM must be initiated either immediately or at a later time loading the new contents of the working directory to the running configuration 3 If no...

Page 115: ...t the boot params file and the switch date and time are not automatically synchronized See the OmniSwitch 6600 Family Getting Started Guide for information on the boot params file and Chapter 2 Managi...

Page 116: ...ce Guide In a stack with three or more switches the secondary CMM takes over as primary and the original primary becomes idle The next available idle switch becomes the new secondary CMM For more info...

Page 117: ...the working and certified directories are the same and if a synchronization is needed between the primary and secondary CMM In addition the command output displays how many modules in the stack will b...

Page 118: ...tion changes while running from the certified directory you can perform an emergency restore of your configuration by following the steps 1 Copy your current configuration to a manually generated boot...

Page 119: ...the resulting displays from these commands see the OmniSwitch CLI Reference Guide An example of the output for the show microcode command is given in Show Switch Files on page 4 23 show running direc...

Page 120: ...Displaying CMM Conditions Managing CMM Directory Content page 4 32 OmniSwitch 6600 Family Switch Management Guide April 2006...

Page 121: ...in the OmniSwitch CLI Reference Guide All command descriptions listed in the Reference Guide include command syntax definitions defaults usage guidelines example screen output and release history Thi...

Page 122: ...Switch 6600 Family Getting Started Guide Note If you are using the OmniSwitch 6600 Family switch in a stacked configuration you must be connected to the console port of the primary switch For detailed...

Page 123: ...and Entry Rules and Syntax When you start a session on the switch you can execute CLI commands as soon as you are logged in The following rules apply Enter only one command per line No command may be...

Page 124: ...the interval back to its default value with the ip multicast no leave timeout command Using Alias Commands You may define substitute text for the switch s CLI commands by using the alias command There...

Page 125: ...ntify a group of keywords such that all keywords in the group share a common prefix In this case pressing Tab will cause the CLI to complete the common prefix and place the cursor at the end of the pr...

Page 126: ...HISTORY FTP FSCK FREESPACE EXIT DSHELL DIR DELETE DEBUG CP COMMAND LOG CHMOD CD ATTRIB ALIAS CMM Chassis Supervision COPY WRITE POWER TEMP THRESHOLD TAKEOVER SYSTEM SHOW RELOAD NO DEBUG CONFIGURE Sour...

Page 127: ...can presume the proper command for this task will be shown in the VLAN Manager Command Set This set shows two possible keywords to follow the vlan syntax ROUTER and num Because you are assigning an I...

Page 128: ...s case the name selected for the VLAN includes spaces so you should use the syntax enclosed in quotes 4 At the command prompt enter the name of the VLAN enclosed in quotes followed by a space and a qu...

Page 129: ...leting Characters You can delete CLI command characters by using the Backspace key or the Delete key The Backspace key deletes each character in the line one at a time from right to left Note the foll...

Page 130: ...t To issue the ls command press Enter ls The Up Arrow key and the bang bang command will display the last command line entered even if the command was rejected by the switch For more details on using...

Page 131: ...y In order to enable IP routing you must find another command keyword because set is not valid Prefix Recognition Prefix Recognition is a CLI feature that reduces redundant command line entry by stori...

Page 132: ...me VLAN you are only required to enter suffix information In this case you can enter the commands to accomplish tasks 2 and 3 as follows stp enable authentication enable Prefix information will be rem...

Page 133: ...iew commands you have recently issued to the switch The switch has a history buffer that stores up to 30 of the most recently executed commands Note The command history feature differs from the comman...

Page 134: ...nge for the history size value is 1 to 30 To view the history parameters use the show history parameters command history size 30 show history parameters History size 30 CurrentSize 10 Index Range 1 10...

Page 135: ...ference Guide Enabling Command Logging By default command logging is disabled To enable command logging on the switch enter the following command command log enable When command logging is enabled via...

Page 136: ...es 1 23 speed 100 UserName admin Date WED FEB 09 10 56 40 Ip Addr 128 251 16 185 Result SUCCESS Command command log enable UserName admin Date WED FEB 09 10 55 44 Ip Addr 128 251 16 185 Result SUCCESS...

Page 137: ...fter tty defines the number of columns on the screen It must be a number between 20 and 150 You may view the current setting for your screen by using the show tty command Changing the CLI Prompt You c...

Page 138: ...ng command enables the more feature more After these commands are executed the CLI will display no more than 6 lines to the screen at a time followed by the More prompt The following is a sample displ...

Page 139: ...to your search The switch will then display the information you identified This saves you the trouble of scanning long lists of data unnecessarily The filter mode filters unwanted information from a C...

Page 140: ...ghts 0x00000000 0x00000000 Read only domains None Read only families Read Write domains None Read Write families Session number 1 User name admin Access type http Access port NS IP address 123 251 12...

Page 141: ...Number The session number assigned to the user User name User name Access type Type of access protocol used to connect to the switch Access port Switch port used for access during this session Ip Addr...

Page 142: ...mmand syntax requires you to specify the number of the session you want to kill You can use the who command for a list of all current user sessions and their numbers The kill command takes effect imme...

Page 143: ...ng show more The more feature is enabled and the number of line is set to 10 2 Enter the show snmp mib family command Note that 10 lines of information are displayed The switch is now in the More mode...

Page 144: ...exit the table type the q character and the CLI will exit the more mode and return you to the system prompt Verifying CLI Usage To display information about CLI commands and the configuration status...

Page 145: ...ltiple switches must be managed and monitored This chapter describes how configuration files are created how they are applied to the switch and how they can be used to enhance OmniSwitch usability In...

Page 146: ...and the maximum number of hops to 3 The IP address of the DHCP server is 128 251 16 52 ip helper address 128 251 16 52 ip helper forward delay 15 ip helper maximum hops 3 2 Transfer the configuration...

Page 147: ...in no changes to the saved configuration the message will state that the running configuration and saved configuration are identical To synchronize the running configuration and the saved configurati...

Page 148: ...ccepted with no errors the CLI responds with a system prompt configuration apply flash configfile_1 txt Note Optional You can specify verbose mode when applying a configuration file to the switch When...

Page 149: ...splay see Configuration File Manager Commands in the OmniSwitch CLI Reference Guide Setting an Application Session for a Specified Time Period You can set a future timed session to apply a configurati...

Page 150: ...ecify a timer session In a timer session you schedule a file to be applied in the future at a specific date and time or after a specific period of time has passed like a countdown Timer sessions are v...

Page 151: ...eyword authkey along with a related alpha numeric text string are automatically included in many snapshot files e g configuration snapshot all The text string following the authkey keyword represents...

Page 152: ...file use the configuration syntax check command For example configuration syntax check asc 1 snap Errors 3 Log file name check asc 1 snap 1 err In this example the proposed asc 1 snap configuration fi...

Page 153: ...ing command will display the textfile rtf text file located in the flash working directory more flash working textfile rtf The switch will display the file text on your terminal screen until the entir...

Page 154: ...file so it will capture the CLI commands for one or more switch features or for all network features To generate a snapshot file for all network features use the following syntax configuration snapsho...

Page 155: ...uces a snapshot file with the name testfile snap configuration snapshot testfile snap Editing Snapshot Files Snapshot files can be viewed edited and reused as a configuration file You also have the op...

Page 156: ...an 10 mtu 1500 ifindex 2 ip interface vlan 11 address 172 11 1 2 mask 255 255 0 0 vlan 11 mtu 1500 ifin dex 3 ip interface vlan 21 address 172 21 1 2 mask 255 255 0 0 vlan 21 mtu 1500 ifin dex 4 ip in...

Page 157: ...Health monitor Interface Link Aggregate static linkagg 1 size 8 admin state enable lacp linkagg 2 size 8 admin state enable lacp linkagg 2 actor admin key 1 VLAN AGG vlan 11 port default 1 vlan 21 po...

Page 158: ...indicates whether the running configuration and the saved configuration files are identical or different This command also displays the number of error files that will be held in the flash directory s...

Page 159: ...details about the syntax of commands see the OmniSwitch CLI Reference Guide This chapter provides an overview of user accounts In addition configuration procedures described in this chapter include Cr...

Page 160: ...vileges for the user are not config ured the default user is modifiable Password defaults are as follows Maximum number of alphanumeric characters in a username 47 Maximum number of alphanumeric chara...

Page 161: ...ands see page 7 14 Functional privileges network administration and end user profiles customer login are mutually exclu sive Both types of users may exist on the switch but any given user account can...

Page 162: ...d by default See Configuring Password Expiration on page 7 9 In addition another account default is available on the switch for default settings only this account cannot be used to log into the switch...

Page 163: ...write domain network ip helper telnet For information about the default user settings see the next section For information about setting up priv ileges see Configuring Privileges for a User on page 7...

Page 164: ...display is similar to the following End user profile Profile1 Area accessible with read and write rights physical basic ip routing Slot 1 ports allowed 1 2 4 5 Slot 2 ports allowed 1 8 Vlan Id 3 8 Fo...

Page 165: ...rite access to all CLI commands unless a specific privilege or SNMP access is configured for the new user For more information about configur ing privileges see Setting Up End User Profiles on page 7...

Page 166: ...ord will not display in clear text in an ASCII configuration file produced by the snapshot command Instead it will display in encrypted form See Chapter 6 Working With Configura tion Files for informa...

Page 167: ...n individual user Note When the current user s password has less than one week before expiration the switch will display an expiration warning after login If a user s password expires the user will be...

Page 168: ...s command gives user bert a password expiration of five days To set a specific date for password expiration include the date in mm dd yyyy hh mm format For example user bert password techpubs expirati...

Page 169: ...An example of setting up user privileges user thomas read write domain network ip helper telnet User thomas will have write access to all the configuration commands and show commands in the network do...

Page 170: ...ed for authenticating and encrypting SNMP PDU for the user The user s level of SNMP authentication is superseded by the SNMP version allowed globally on the switch By default the switch allows all SNM...

Page 171: ...information about configuring SNMP globally on the switch see Chapter 10 Using SNMP SNMP Access With Authentication Encryption To configure a user with SNMP access and authentication enter the user co...

Page 172: ...rt link flow flow wait interfaces admin interfaces alias interfaces interfaces no L2 statistics show interfaces vlan table vlan vlan stp vlan authentication vlan router ipx vlan port default show vlan...

Page 173: ...file port list command with the relevant profile name and the desired slots ports For example end user profile Profile3 port list 2 3 1 4 In this example the port list includes all ports in slot 2 and...

Page 174: ...file command with the name of the profile you want to delete For example no end user profile Profile3 Profile3 is deleted from the configuration Note If the profile name is associated with a user and...

Page 175: ...curity is given in this chapter In addition configuration procedures described in this chapter include Configuring Authenticated Switch Access on page 8 7 Setting Up Management Interfaces for ASA on p...

Page 176: ...the admin user through the console port even if management access to the console port is disabled for other users Telnet sessions allowed 4 concurrent sessions FTP sessions allowed 4 concurrent sessi...

Page 177: ...bout user sessions For information about configuring the switch to communicate with external servers see the Managing Authentication Servers chapter in the OmniSwitch 6600 Family Network Configura tio...

Page 178: ...ication Dial In User Service RADIUS or Lightweight Directory Access Protocol LDAP servers User login infor mation and user privileges may be stored on the servers Privileges are used for network admin...

Page 179: ...ser database If external servers are configured for other management interfaces such as Telnet or HTTP but the servers become unavailable the switch will poll the local user database for login informa...

Page 180: ...cess authenticates users into the switch to manage it The features are independent of each other however user databases for each feature may be located on the same authenti cation server For more info...

Page 181: ...mentioned in this chapter and described in detail in the Manag ing Authentication Servers chapter of the OmniSwitch 6600 Family Network Configuration Guide If you are using the local switch database t...

Page 182: ...rvers to be used for checking user login and privilege information Multiple servers of different types may be speci fied For example aaa authentication telnet rad1 ldap2 local The order of the server...

Page 183: ...n here Service type Default 1rst authentication server rad1 2nd authentication server local Service type Console Authentication Use Default 1rst authentication server rad1 2nd authentication server lo...

Page 184: ...tch via the aaa radius server and aaa ldap server commands ACE Servers do not require any configuration but you must FTP the sdconf rec file from the server to the switch s network directory For more...

Page 185: ...no aaa authentication ftp FTP access is now denied on the switch Note The admin user always has switch access through the console port even if access is denied through the console port To remove a se...

Page 186: ...e FTP application that may be used after a Secure Shell session is initiated Telnet and FTP are not secure If Secure Shell is enabled it is recommended that Telnet and FTP be disabled For example no a...

Page 187: ...g logging a user session for Authenticated Switch Access use the aaa accounting session command with the relevant server name s In this example the RADIUS and LDAP servers have already been configured...

Page 188: ...resulting displays from these commands see the OmniSwitch CLI Refer ence Guide An example of the output for the show aaa authentication command is also given in Quick Steps for Setting Up ASA on page...

Page 189: ...ion about setting up browser preferences and options see Browser Setup on page 9 2 In This Chapter This chapter provides an overview of WebView and WebView functionality and includes information about...

Page 190: ...s the default JavaScript must be enabled supported Java must be enabled Style sheets must be enabled that is the colors fonts backgrounds etc of web pages should always be used rather than any user co...

Page 191: ...essary use the http server command to enable WebView For example http server Use the no http server command to disable WebView on the switch If web management is disabled you will not be able to acces...

Page 192: ...the browser and press Enter The WebView login screen appears 5 Enter the appropriate user ID and password the initial user name is admin and the initial password is switch After successful login the...

Page 193: ...gh which you can access the switch for CLI config uration Log Out Logs the user out of the switch and ends the user session After logout the login screen appears The user can log back into the switch...

Page 194: ...mation on using the drop down menus see Configuration Page on page 9 9 View Configuration Area The View Configuration area is where switch configuration information is displayed and where configura ti...

Page 195: ...web browser 2 Enter the IP address of the switch you want to configure in the browser Address field and press Enter The login screen appears 3 Enter the appropriate user ID and password at the login p...

Page 196: ...he feature s current configuration and can also be used to configure global parameters Each Home Page also provides a Site Map shown below which displays all of the configuration options available for...

Page 197: ...eters The fields display the current configuration To change the configuration 1 Select a new value from one of the drop down lists or enter a new value in a field 2 Click Apply to apply the changes t...

Page 198: ...can delete multiple entries but you can only modify one entry at a time Adding a New Entry To add a new entry to the table 1 Click Add on the Configuration page The Add window appears e g Add IP Stati...

Page 199: ...Apply If successful the Modify window disappears The new configuration takes effect immediately and the modified entry appears in the table If there is an error the window will remain and an error mes...

Page 200: ...ion is available a toggle switch appears at the bottom left corner of the table To change views click on the toggle switch e g Expanded View For example if the table is in summary view click on Expand...

Page 201: ...To sort in descending order click on the column heading Click again to return to ascending order To sort on a different column click on the column heading the table will sort on that column and the n...

Page 202: ...pper right corner of the table the column head ings are highlighted Next click on the primary and secondary column headings the numbers 1 and 2 appear in the primary and secondary columns Click again...

Page 203: ...loads the table data in increments of 50 or 100 entries If the table reaches this threshold the first group of entries is displayed and a Next button appears at the bottom of the page Click Next to vi...

Page 204: ...port By clicking on a device the Web based device manager if available is displayed for that device If a Web based device manager is not available a Telnet session may be launched A route to the adja...

Page 205: ...the information given in this chapter Specific page Help Each help page provides a description of the page and a description for each field To access help from any global configuration page table pag...

Page 206: ...WebView Help Using WebView page 9 18 OmniSwitch 6600 Family Switch Management Guide April 2006...

Page 207: ...er describes the SNMP and how to use it through the Command Line Interface CLI CLI commands are used in the configuration examples for more details about the syntax of commands see the OmniSwitch CLI...

Page 208: ...with SNMPv1 and v2 and supports all the SNMPv1 and SNMPv2 PDUs SNMPv1 and SNMPv2 Authentication Community Strings SNMPv1 SNMPv2 Encryption None SNMPv1 and SNMPv2 Security requests accepted by the swi...

Page 209: ...ify the UDP destination port number in this case 8010 the IP address of the management station 199 199 100 200 a user account name NMSuserV3MD5DES and the SNMP version number v3 For example snmp stati...

Page 210: ...s for the snmp chassis and interface command families user usermark2 read only snmp chassis interface Note Optional To verify the user account enter the show user command A partial display is shown he...

Page 211: ...aps will be passed through 1 Specify the IP address for the SNMP management station and the trap identification numbers show snmp trap filter 210 1 2 1 0 1 2 3 Note Optional You can verify which traps...

Page 212: ...age that can be monitored by the NMS The SNMP agent contains MIB variables which have values the NMS can request or change using Get GetNext GetBulk or Set operations The agent can also send unsolicit...

Page 213: ...t identify this station to the switch by using the snmp station CLI command The following information is needed to define an SNMP management station The IP address of the SNMP management station devic...

Page 214: ...acteristics and capability characteristics Protocol Operations SNMPv2 has two new PDUs not supported by SNMPv1 The GetBulkRequest PDU enables the manager to retrieve large blocks of data efficiently I...

Page 215: ...if the interface is ready to transmit and receive net work traffic it should change to dormant 5 if the interface is waiting for external actions such as a serial line waiting for an incoming connecti...

Page 216: ...GMAP update to not be applied Valid reasons are 1 Target VLAN is an authenticated VLAN 2 update would conflict with a binding rule 3 update would create two different VLAN entries for the same protoco...

Page 217: ...d the detected fault and allows a mapping of the data contained in chassisTrapsdataInfo chassisTrapsStrcomments Comment text explaining the fault chassisTrapsStrdataInfo Additional data provided to he...

Page 218: ...tes the operational status of installed modules includes empty slots 12 chassisTrapsMacOverlap physicalIndex chasTrapMac RangeIndex module A MAC range overlap was found in the backplane eeprom physica...

Page 219: ...no change 16 healthMonModuleTrap healthModule Slot healthMonRx Status healthMonRx TxStatus healthMon MemorySta tus healthMonC puStatus health Indicates a module level thresh old was crossed healthModu...

Page 220: ...p esmPortIF The on board interface number for this Ethernet port The port number has been added to be used by the private trap ifInErrors For packet oriented interfaces the number of inbound packets t...

Page 221: ...ted at most once per gen eration ID of the neighbor For example it should be generated at the time a neighbor is first heard from if the prune bit is not set It should also be generated if the local s...

Page 222: ...al to risingAlarm 1 or risin gOrFallingAlarm 3 25 fallingAlarm alarmIndex alarmVariable alarmSample Type alarmValue alarmFallingTh reshold rmon An Ethernet statistical variable has dipped below its fa...

Page 223: ...mirmonPrima ryPort mirroringSlot mirroringPort mirMonErrorNi pmm The mirroring configuration is deleted due to the swapping of different NI board type The Port Mirroring session which was active on a...

Page 224: ...r example when it is being initialized If the MAU is not jabbering the agent returns noJabber 3 This is the normal state If the MAU is in jabber state the agent returns the jabbering 4 value 35 sessio...

Page 225: ...apSwitch Port lpsTrapViolat ingMac lpsTrapViola tionType systemServices Date systemServices Time bridge A Learned Port Security LPS violation has occurred lpsTrapSwitchName The name of the switch lpsT...

Page 226: ...ype Ethertype value for generic Ethertype or snap rule This value has no meaning for vProtoRuleProtoClass set to values other than 9 or 11 gmBindRuleDsapSsap DSAP and SSAP values for generic DSAP SSAP...

Page 227: ...ected The value mPSAbsent 3 indicates that the Power Maintenance Signature is absent Note This trap is not supported on OmniSwitch 6600 Family switches in the current release 49 pethMainPowerUsageOnNo...

Page 228: ...Service attack The HTTP and HTTPS connections are sampled at a 15 second interval This trap is sent every 1 minute while the HTTP server detects it is under attack httpConnectionStats The number of H...

Page 229: ...MgrSlotNI Number chassis The element identified by alaStackMgrSlotNINumber will enter the pass through mode because there are no tokens available to be assigned to this element alaStackMgrSlotNINumbe...

Page 230: ...Indicates that the link aggregate is not active This trap is sent when all ports of the link aggre gate group are no longer in the attached state traplnkaggId Index value of the Link Aggregate group t...

Page 231: ...r equal to 512 bytes of the dropped packet dsmac 12 tag 4 etype 2 pay load 512 0 if DropCount only 66 monitorFileWritten mirmonPrima rySlot mirmonPrima ryPort monitorFile Name monitorFileSize pmm A Fi...

Page 232: ...s For detailed information on setting up user accounts refer to the Using Switch Security chapter of this manual 2 Map the user account to a community string A community string works like a password s...

Page 233: ...ed via the snmp station CLI syntax The username and password are used by the SNMP management station along with an authentication algorithm SHA or MD5 to compute a hash that is transmitted in the PDU...

Page 234: ...he table below snmp security authentication all The command parameters shown in the following table define security from the lowest level no security to the highest level traps only as shown Security...

Page 235: ...s Designation of particular command families for user access is sometimes referred to as partition management SNMP traps are divided into functional families as shown in the SNMP Traps Table on page 1...

Page 236: ...r testing or troubleshooting purposes This is useful in the event that any traps are lost in the network To replay stored traps use the snmp trap replay command followed by the IP address for an SNMP...

Page 237: ...erface 77828 healthModuleTable rmon 77829 healthPortTable rmon 77830 healthThreshInfo rmon 78849 vrrpAssoIpAddrTable vrrp 78850 vrrpOperTable vrrp 78851 vrrpOperations vrrp 78852 vrrpRouterStatsTable...

Page 238: ...Types SNMPv2 SMI SNMPv2 CONF IF MIB HCNUM TC RFC 2856 A MIB module containing textual conventions for high capacity data types This module addresses an immediate need for data types not directly supp...

Page 239: ...NMPv2 TC SNMPv2 CONF Novell RIPSAP MIB This MIB defines the management information for the Routing Information Protocol RIP and Service Advertising Protocol SAP protocols running in a Novell Internetw...

Page 240: ...NMP SNMPv2 SMI SNMPv2 CONF SNMP NOTIFICATION MIB RFC 2573 SNMP Applications Notifications SNMP Entity Remote Configuration SNMPv2 SMI SNMPv2 TC SNMPv2 CONF SNMP FRAMEWORK MIB SNMP TARGET MIB SNMP PROX...

Page 241: ...RFC 2012 SNMPv2 Management Information Base for the Transmission Control Protocol using SMIv2 SNMPv2 SMI SNMPv2 CONF TUNNEL MIB RFC 2667 IP Tunnel MIB SNMPv2 SMI SNMPv2 TC SNMPv2 CONF IF MIB UDP MIB R...

Page 242: ...P FRAMEWORK MIB ENTITY MIB ALCATEL IND1 CONFG MGR MIB Definitions of managed objects for the Configuration Manager subsystem SNMPv2 SMI SNMPv2 TC SNMPv2 CONF ALCATEL IND1 DEVICES Definitions of chassi...

Page 243: ...ntity SNMPv2 SMI SNMPv2 TC IF MIB Q BRIDGE MIB ALCATEL IND1 SYSTEM MIB SNMPv2 CONF ALCATEL IND1 MAC ADDRESS MIB Definitions of managed objects for the Source Learn ing MAC Address subsystem SNMPv2 SMI...

Page 244: ...ed objects for the Simple Net work Management Protocol SNMP Agent sub system SNMPv2 SMI SNMPv2 TC SNMPv2 CONF ALCATEL IND1 STACK MANAGER Definitions of the managed objects for Stack Manager Chassis St...

Page 245: ...show snmp statistics Displays SNMP statistics Each MIB object is listed along with its status show snmp mib family Displays SNMP MIB information Information includes MIP ID num ber MIB table name and...

Page 246: ...Verifying the SNMP Configuration Using SNMP page 10 40 OmniSwitch 6600 Family Switch Management Guide April 2006...

Page 247: ...Licensee s system Licensee agrees not to assign sublicense transfer pledge lease rent or share their rights under this License Agreement Licensee may retain the program media for backup purposes with...

Page 248: ...NOT APPLY TO LICENSEE THIS WARRANTY GIVES THE LICENSEE SPECIFIC LEGAL RIGHTS LICENSEE MAY ALSO HAVE OTHER RIGHTS WHICH VARY FROM STATE TO STATE 6 Limitation of Liability AII s cumulative liability to...

Page 249: ...nforcement of rights or subsequent actions in the event of future breaches 13 Notes to United States Government Users Software and documentation are provided with restricted rights Use duplication or...

Page 250: ...edistributions must contain a verbatim copy of this document 4 The names and trademarks of the authors and copyright holders must not be used in advertising or otherwise to promote the sale use or oth...

Page 251: ...ghts These restrictions translate to certain responsibilities for you if you distribute copies of the software or if you modify it For example if you distribute copies of such a program whether gratis...

Page 252: ...modified program normally reads commands interactively when run you must cause it when started running for such interactive use in the most ordinary way to print or display an announcement including...

Page 253: ...compliance 5 You are not required to accept this License since you have not signed it However nothing else grants you permission to modify or distribute the Program or its derivative works These acti...

Page 254: ...published by the Free Software Foundation 10 If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different write to the author to ask for permis...

Page 255: ...ss Ave Cambridge MA 02139 USA Also add information on how to contact you by electronic and paper mail If the program is interactive make it output a short notice like this when it starts in an interac...

Page 256: ...ght notice and the entire permission notice in its entirety including the disclaimer of warranties 2 Redistributions in binary form must reproduce the above copyright notice this list of conditions an...

Page 257: ...ware EMWEB PRODUCT licensed from Agranat Systems Inc Agranat Agranat has granted to AII certain warranties of performance which warran ties or portion thereof AII now extends to Licensee IN NO EVENT H...

Page 258: ...BILITY FOR ANY SPECIAL INDIRECT PUNITIVE INCIDENTAL AND CONSEQUENTIAL DAMAGES and iv any further distribution of the Run Time Module shall be subject to the same restric tions set forth herein With re...

Page 259: ...nt Module see CMM chmod command 2 16 CLI 5 1 application example 5 23 domains and families 7 11 logging commands 5 15 5 16 CMM 4 1 application examples 4 5 boot cfg file 4 3 cancelling a reboot 4 14 4...

Page 260: ...see DNS resolver DSA key Secure Shell 8 12 DST 2 37 E editor vi 6 9 encryption DES 10 27 errors 6 7 exit command 1 12 1 13 F file configuration verify information about 6 14 file management specificat...

Page 261: ...version number 3 9 ntp server command 3 3 P partition management 10 29 password command 6 7 passwords expiration 7 9 minimum length 7 9 user configured 7 8 pre_banner txt file 1 15 prefixes 5 11 prim...

Page 262: ...aults 10 2 management station 10 7 manager 10 6 security 10 26 10 28 specifications 10 2 traps 10 29 versions 10 7 SNMP configuration verify information about 10 39 snmp security command 10 28 snmp se...

Page 263: ...View 9 7 adjacencies 9 16 application example 9 4 browser setup 9 2 CLI commands 9 3 configuring the switch with 9 7 defaults 9 2 disabling 9 3 enabling 9 3 on line help 9 17 Secure Socket Layer 9 3 w...

Page 264: ...Index Index 6 OmniSwitch 6600 Family Switch Management Guide April 2006...

Search results

Summary of Contents for OmniSwitch 6600-P24

Reviews:

Related manuals for OmniSwitch 6600-P24

Brands by name

Popular brands

Alcatel OmniSwitch 6600-P24, Management Manual

Search results

Summary of Contents for OmniSwitch 6600-P24

Reviews:

Related manuals for OmniSwitch 6600-P24

Brands by name

Popular brands