Dell POWERCONNECT 5524 User Manual Download

Page: 564 / 728

564

Dell PowerConnect 55xx Systems User Guide

DHCP Snooping

This section describes DHCP snooping.
It contains the following topics:

•

DHCP Snooping Overview

•

Global Parameters

•

VLAN Settings

•

Trusted Interfaces

•

Snooping Binding Database

DHCP Snooping Overview

DHCP snooping expands network security by providing layer security

between untrusted interfaces and DHCP servers. By enabling DHCP

snooping, network administrators can differentiate between trusted interfaces

connected to end-users or DHCP Servers, and untrusted interfaces located

beyond the network firewall.

How DHCP Snooping Works

DHCP snooping filters untrusted messages, and stores these messages in a

database. Interfaces are untrusted if the packet is received from an interface

outside the network, or from an interface beyond the network firewall.

Trusted interfaces receive packets only from within the network or the

network firewall.
The DHCP Snooping Binding database contains the untrusted interfaces’

MAC address, IP address, Lease Time, VLAN ID, and interface information.
Table 21-1 describes how DHCP packets are handled when DHCP snooping

is enabled on an interface.

Table 19-1. DHCP Packet Handling when DHCP Snooping is Enabled

Packet Type

Arriving from Untrusted
Ingress Interface

Arriving from Trusted
Ingress Interface

DHCPDISCOVER

Forward to trusted

interfaces only.

Forwarded to trusted

interfaces only.

Summary of Contents for POWERCONNECT 5524

Page 1: ...Dell PowerConnect 5500 Series System User Guide Regulatory Models PowerConnect 5524 5524P 5548 5548P ...

Page 2: ...ut the written permission of Dell Inc is strictly forbidden Trademarks used in this text Dell the DELL logo and PowerConnect are trademarks of Dell Inc Intel Pentium and Celeron are registered trademarks of Intel Corporation in the U S and other countries Microsoft and Windows are either trademarks or registered trademarks of Microsoft Corporation in the United States and or other countries Other ...

Page 3: ...v6 Support 15 Stack Support 15 Power over Ethernet 15 Green Ethernet 16 Head of Line Blocking Prevention 16 Flow Control Support IEEE 802 3X 16 Back Pressure Support 16 Virtual Cable Testing VCT 17 Auto Negotiation 17 MDI MDIX Support 17 MAC Address Supported Features 17 Layer 2 Features 19 IGMP Snooping 19 Port Mirroring 19 Broadcast Storm Control 19 VLAN Supported Features 20 ...

Page 4: ...23 Quality of Service Features 23 Device Management Features 24 Security Features 28 Port Profile CLI Macro 30 DHCP Server 31 Protected Ports 31 iSCSI Optimization 31 Proprietary Protocol Filtering 31 3 Hardware Description 33 Device Models 34 Device Structure 34 LED Definitions 38 Power Supplies 42 4 Stacking Overview 43 Stack Overview 44 Stack Members and Unit IDs 47 ...

Page 5: ...guration Using the Setup Wizard 58 6 Advanced Switch Configuration 63 Using the CLI 64 Accessing the Device Through the CLI 67 Retrieving an IP Address 68 Security Management and Password Configuration 71 Configuring Login Banners 74 Startup Menu Procedures 76 Software Download 79 7 Using Dell OpenManage Administrator 83 Starting the Application 84 Understanding the Interface 84 Using the Switch A...

Page 6: ...rk Security 92 Port Security 93 ACLs 98 ACL Binding 118 Proprietary Protocol Filtering 120 Time Range 122 Dot1x Authentication 127 9 Configuring System Information 150 General Switch Information 151 Time Synchronization 162 Logs 188 IP Addressing 202 Diagnostics 248 Management Security 254 DHCP Server 290 SNMP 307 File Management 330 Stack Management 361 ...

Page 7: ...w 369 10 Ports 378 Overview 379 Jumbo Frames 382 Green Ethernet Configuration 384 Protected Ports 388 Port Profile 391 Port Configuration 397 LAG Configuration 403 Storm Control 408 Port Mirroring 411 11 Address Tables 416 Overview 417 Static Addresses 418 Dynamic Addresses 421 12 GARP 424 GARP Overview 425 GARP Timers 426 ...

Page 8: ...29 Global Settings 431 STP Port Settings 436 STP LAG Settings 441 Rapid Spanning Tree 444 Multiple Spanning Tree 448 14 VLANs 459 Virtual LAN Overview 460 VLAN Membership 465 Port Settings 468 LAGs Settings 474 Protocol Groups 477 Protocol Port 481 GVRP Parameters 483 Private VLAN 487 Voice VLAN 491 15 Link Aggregation 500 Link Aggregation Overview 501 LACP Parameters 503 ...

Page 9: ... Global Parameters 511 Bridge Multicast Groups 513 Bridge Multicast Forward All 517 IGMP Snooping 519 Unregistered Multicast 525 Multicast TV VLAN 527 17 LLDP 531 LLDP Overview 532 LLDP Properties 533 LLDP Port Settings 537 MED Network Policy 540 LLDP MED Port Settings 543 Neighbors Information 548 18 Dynamic ARP Inspection 551 Dynamic ARP Inspection Overview 552 Global Settings 553 ...

Page 10: ...55 Dynamic ARP Inspection Entries 557 VLAN Settings 559 Trusted Interfaces 561 19 DHCP Snooping 563 DHCP Snooping 564 DHCP Relay 577 20 iSCSI Optimization 584 Optimizing iSCSI Overview 585 Global Parameters 588 iSCSI Targets 591 iSCSI Sessions 593 Configuring iSCSI Using CLI 595 21 Statistics RMON 596 Table Views 597 RMON Components 615 Charts 633 ...

Page 11: ...ew Maintenance Projects Dell Contax Dell_ContaxUG_PrintTOC fm Contents 11 22 Quality of Service 640 QoS Features and Components 641 General 643 QoS Basic Mode 659 QoS Advanced Mode 668 QoS Statistics 688 Glossary 695 Index 710 Revision History 727 ...

Page 12: ...FILE LOCATION C Users gina Desktop Checkout_new Maintenance Projects Dell Contax Dell_ContaxUG_PrintTOC fm 12 Contents ...

Page 13: ...ion needed for installing configuring and maintaining the device through the web based management system called the OpenManage Switch Administrator This guide describes how to configure each system through the web based management system and through CLI commands The CLI Reference Guide which is available on the Documentation CD provides additional information about the CLI commands ...

Page 14: ... IP Version 6 IPv6 Support Stack Support Power over Ethernet Green Ethernet Head of Line Blocking Prevention Flow Control Support IEEE 802 3X Back Pressure Support Virtual Cable Testing VCT Auto Negotiation MDI MDIX Support MAC Address Supported Features Layer 2 Features IGMP Snooping Port Mirroring Broadcast Storm Control VLAN Supported Features Spanning Tree Protocol Features Link Aggregation Qu...

Page 15: ... HDMI ports are 1 3a specification Category 2 High Speed cables 340 MHz 10 2 Gbit s it is recommended to use HDMI cable version 1 4 The stacking feature supports the following features Fast link failover Software auto synch Improved response time to events such as master failover Auto numbering algorithm when choosing unit number For more information see Stacking Overview on page 43 Power over Eth...

Page 16: ...OL blocking results in traffic delays and frame loss caused by traffic competing for the same egress port resources To prevent HOL blocking the device queues packets and packets at the head of the queue are forwarded before packets at the end of the queue Flow Control Support IEEE 802 3X Flow control enables lower speed devices to communicate with higher speed devices by requesting that the higher...

Page 17: ...inistrator to configure the port speeds that are advertised For more information see Port Configuration on page 397 or LAG Configuration on page 403 MDI MDIX Support Standard wiring for end stations is known as Media Dependent Interface MDI and standard wiring for hubs and switches is known as Media Dependent Interface with Crossover MDIX If auto negotiation is enabled the device automatically det...

Page 18: ...resses on page 421 VLAN Aware MAC Based Switching The device always performs VLAN aware bridging Classic bridging IEEE802 1D in which frames are forwarded based only on their destination MAC address is not performed However a similar functionality can be configured for untagged frames Frames addressed to a destination MAC address that is not associated with any port are flooded to all ports of the...

Page 19: ...router For more information see IGMP Snooping on page 519 Port Mirroring Port mirroring monitors network traffic by forwarding copies of incoming and outgoing packets from a monitored port to a monitoring port Users specify which target port receives copies of all traffic passing through a specified source port For more information see Port Mirroring on page 411 Broadcast Storm Control Storm Contr...

Page 20: ... architecture for virtual bridged LANs the services provided in VLANs and the protocols and algorithms involved in the provision of these services For more information see Virtual LAN Overview on page 460 GVRP Support GARP VLAN Registration Protocol GVRP provides IEEE 802 1Q compliant VLAN pruning and dynamic VLAN creation on 802 1Q trunk ports When GVRP is enabled the device registers and propaga...

Page 21: ...es a point to multipoint Broadcast domain The ports can be located anywhere in the Layer 2 network compared to the Protected Ports feature where the ports must be in the same stack For more information see Private VLAN on page 487 Multicast TV VLAN The Multicast TV VLAN feature provides the ability to supply multicast transmissions to Layer 2 isolated subscribers without replicating the multicast ...

Page 22: ...faster convergence without creating forwarding loops For more information see Spanning Tree on page 428 IEEE 802 1s Multiple Spanning Tree Multiple Spanning Tree MSTP operation maps VLANs into STP instances MSTP provides a different load balancing scenario Packets assigned to various VLANs are transmitted along different paths within MSTP Regions MST Regions Regions are one or more MSTP bridges by...

Page 23: ...ious links and continuously provides the maximum level of aggregation capability achievable between a given pair of devices LACP automatically determines configures binds and monitors the port binding within the system For more information see Link Aggregation on page 500 BootP and DHCP Clients DHCP enables additional setup parameters to be received from a network server upon system startup DHCP s...

Page 24: ... queues in the same way it does for IPv4 The switch detects IPv6 frames by the IPv6 ether type For more information about Advanced QoS see QoS Advanced Mode on page 668 TCP Congestion Avoidance The TCP Congestion Avoidance feature activates an algorithm that breaks up or prevents TCP global synchronization on a congested node where the congestion is due to multiple sources sending packets with the...

Page 25: ...re validates the uniqueness of the switch s IP address whether it is assigned manually or through DHCP If the IP address is not unique the switch performs actions according to the address type If the IP address is static see more information about this in IPv4 Interface Parameters on page 203 If the IP address is dynamic see more information about this in DHCP IPv4 Interface on page 207 Flow Monit...

Page 26: ... Monitoring RMON is an extension to SNMP that provides comprehensive network traffic monitoring capabilities RMON is a standard MIB that defines MAC layer statistics and control objects enabling real time information to be captured across the entire network For more information see Statistics RMON on page 596 Command Line Interface Command Line Interface CLI syntax and semantics conform as much as...

Page 27: ...ding IP addresses For more information see Domain Name System on page 235 802 1ab LLDP MED The Link Layer Discovery Protocol LLDP enables network managers to troubleshoot and enhances network management by discovering and maintaining network topologies over multi vendor environments LLDP discovers network neighbors by standardizing methods for network devices to advertise themselves to other syste...

Page 28: ...ators to automatically assign users to VLANs during the RADIUS server authentication For more information see Dot1x Authentication on page 127 Locked Port Support Locked Port increases network security by limiting access on a specific port to users with specific MAC addresses These addresses are either manually defined or learned on that port When a frame is seen on a locked port and the frame sou...

Page 29: ...es functionality that is similar to an inbound telnet connection SSH uses RSA and DSA Public Key cryptography for device connections and authentication For more information see Security Management and Password Configuration on page 71 TACACS TACACS provides centralized security for validation of users accessing the device TACACS provides a centralized user management system while still retaining c...

Page 30: ...between untrusted interfaces and DHCP servers By enabling DHCP Snooping network administrators can differentiate between trusted interfaces connected to end users or DHCP servers and untrusted interfaces located beyond the network firewall For more information see DHCP Snooping on page 564 ARP Inspection Dynamic ARP inspection is a security feature that validates ARP packets in a network It interc...

Page 31: ...re the same Broadcast domain VLAN with other interfaces For more information see Protected Ports on page 388 iSCSI Optimization iSCSI optimization provides the iSCSI flows with specific priority over other network traffic In addition the feature provides monitoring of iSCSI sessions For more information see iSCSI Optimization on page 584 Proprietary Protocol Filtering This feature enables user con...

Page 32: ...ddress Option 82 specifies the relaying switch s MAC address the port identifier and the VLAN that forwarded the packet For more information see DHCP Relay on page 577 Identifying a Switch via LED The switch provides the ability to turn on a LED through the GUI interface on a specific unit or on all units in a stack for a specific length of time For more information see Unit Identification Locatio...

Page 33: ...PowerConnect 55xx Systems User Guide 33 3 Hardware Description This section describes PowerConnect 5500 hardware It contains the following topics Device Models Device Structure LED Definitions Power Supplies ...

Page 34: ...nect 5548 Provides 48 10 100 1000Mbps Base T ports PowerConnect 5548P with PoE Provides 24 10 100 1000Mbps Base T ports along with Power over Ethernet PoE support Each of these devices provides in addition to the above ports two HDMI ports two SPF ports an RS 232 console port and a USB port as shown in Figure 5 1 NOTE 10 100 1000Mbps Baset T ports are also known as Gigabit ports or G ports Device ...

Page 35: ...ll Form Factor Plugable SFP Ports These are 10 Gigabit ports designated as 1000Base X SFP The SFP ports are fiber transceivers designated as 10000 Base SX or LX They include TWSI Two Wire Serial Interface and internal EPROM RS 232 Console Port This port is used for a terminal connection for debugging and software downloads The default baud rate is 9 600 bps The baud rate can be configured from 240...

Page 36: ...f the front panel which contains buttons and LEDs in addition to ports Figure 3 2 Button LED Panel These LEDs are described in Table 5 1 and Table 5 2 Reset Button The PowerConnect 5500 switches have a reset button located on the front panel that is used for manual reset reboot of the device The single reset circuit of the switch is activated by power up or low voltage conditions Power Status Fan ...

Page 37: ... a Modular Power Supply MPS connector Location LED power connector and two fan outlets Figure 3 3 PowerConnect 5524 48 Back Panel Figure 3 4 PowerConnect 5524 48 P Back Panel The elements on the back panel are used as follows Locator LED This LED is lit when the Unit Identification feature is selected See Unit Identification Location on page 367 for more information about this feature RPS MPS Conn...

Page 38: ...s of links power supplies fans and system diagnostics These are described below System LEDs The system LEDs of the PowerConnect 5500 devices provide information about the power supplies fans thermal conditions and diagnostics Figure 5 2 shows the location of the system LEDS on the device Table 5 1 describes the meaning of the colors of the system LEDs Table 3 1 System LED Indicators LED Color Desc...

Page 39: ... MPS RPS failed Off The MPS RPS is not plugged in Locator Green Flashing Locator function is enabled Green Static Locator function is disabled Master Green Static The device is a master unit Off The device is not a master unit Fan FAN Green Static All device fans are operating normally Red Static One or more of the device fans are not operating Table 3 1 System LED Indicators Continued LED Color D...

Page 40: ...Figure 3 5 Giga Port LEDs Table 5 2 describes the LED indications for the Gigabit ports Table 3 2 Giga Port s on non PoE enabled Devices LEDs LED Color Description LNK Green Flashing Link is up and the port is either transmitting or receiving at 1000 Mbs Yellow Flashing Link is up and the port is either transmitting or receiving data at 100 Mbps Solid green Solid amber Link is up high speed Link i...

Page 41: ... and the port is either transmitting or receiving data at 100 Mbps Solid green Solid amber Link is up high speed Link is up at lower speeds Off Port is currently not operating PoE Flashing green There is activity on the port and the PoE is off Flashing amber There is activity on the port and the PoE is on Amber solid There is no activity on the port and the PoE power is on Off There is no activity...

Page 42: ...r supplies 24 Port non PoE devices 54 Watt 48 Port non PoE devices 100 Watt 24 48 Port PoE devices 600 Watt Operation with both power supply units is regulated through load sharing Power supply LEDs indicate the status of the power supply The AC power supply unit operates from 90 to 264 VAC 47 to 63 Hz The AC power supply unit uses a standard connector A LED shown in Figure 5 3 indicates whether t...

Page 43: ...ect 55xx Systems User Guide 43 4 Stacking Overview This section describes how the Stacking feature of the PowerConnect 5500 series functions It contains the following topics Stack Overview Stack Members and Unit IDs ...

Page 44: ...Operation Modes All stacks must have a Master unit and may have a Master Backup unit All other units are connected to the stack as members slaves A unit in the stack can be in one of the following modes Stack Master Runs the fully operational software of a switch In addition it runs configures and manages all other units in the stack All protocols run in the context of the Master unit It is respon...

Page 45: ...s the Master Backup role Stacking Units PowerConnect 5500 series switches use two HDMI 10G ports for stacking To connect the units in the stack 1 Insert one end of an HDMI cable into the left hand HDMI port on the unit at the top of the stack and the other end into the right hand HDMI port of the unit immediately below it this is called crossover 2 Repeat this process until all units are connected...

Page 46: ...PowerConnect 55xx Systems User Guide The results of this process are shown in Figure Figure 4 1 Stacking Ring Topology HDMI Ports Front Panel HDMI Ports Front Panel HDMI Ports Front Panel Front Panel HDMI Ports ...

Page 47: ... system downtime In chain topology each unit in the stack is connected to neighboring unit except for the last unit which is not connected to any other unit In the chain topology the stack continues to function as long as there is a master or backup enabled unit in each segment of the stack When the ring topology is switched to chain topology an SNMP message is automatically generated but no stack...

Page 48: ...the rest of the stack through the stack link Assigning Unit IDs Each unit in the stack has a unique ID that defines the unit s position and function in the stack as shown in Figure 5 2 The unit that is assigned Unit ID 1 is the Master unit by default The unit that is assigned Unit ID 2 is the Master Backup unit When you power up the stack each unit is assigned a unique Unit ID This is displayed on...

Page 49: ...assigned Unit ID 1 and Unit 2 All other units in the stack slaves have unit IDs of 3 8 The stack master assignment is performed during the configuration boot process One master enabled stack member is elected as Master and the other master enabled stack member is selected as Master Backup according to the following decision process A master is selected from the set of the two Master enabled units ...

Page 50: ...be master enabled and assign it a unit ID 1 using the boot menu The user can force a master enabled unit to be the master unit of the stack even if the master election process did not select it This is done by switching over to the backup unit NOTE Two stacking member are considered the same age if they were inserted within a ten minute interval for example if Unit 2 is inserted in the first minut...

Page 51: ...les are relearned if a failure occurs The Running Configuration file is synchronized between Stack Master and the Master Backup and continues running on the Master Backup Replacing Stacking Members If a unit is removed from the stack and replaced with a unit with the same unit ID the stack member is configured with the original unit configuration Otherwise if the new unit has either more or fewer ...

Page 52: ...reboots the Startup Configuration file in the Master unit is used to configure the stack Managing Configuration Files on the Stack The Startup Configuration and Running Configuration file are stored on the stack master Each port in the stack is referenced in the configuration files by its port type and unit ID 0 port number for example gi1 0 24 which means Giga port 24 on unit 1 the middle 0 is re...

Page 53: ...s to an external TFTP server HTTP client Downloading configuration files from an external TFTP server HTTP client Download upload through the USB port NOTE Stack configuration for all configured ports is saved even if the stack is reset and or the ports are no longer present ...

Page 54: ...on page 63 NOTE Before proceeding further read the release notes for this product You can download the release notes from the Dell Support website at support dell com NOTE We recommend that you obtain the most recent revision of the user documentation from the Dell Support website at support dell com It contains the following topics Configuration Work Flow Connecting the Switch to the Terminal Boo...

Page 55: ... page 57 c Assign a unit ID to the switch as described in Assigning Unit IDs on page 48 2 Connect the units in the stack to each other as described in Configuring the Stack on page 58 3 Connect the Master unit to the terminal reboot the unit and the Setup Wizard is run automatically as described in Configuration Using the Setup Wizard on page 58 4 Respond to the Setup Wizard prompts 5 Continue man...

Page 56: ...nt panel of the switch see Figure 7 1 using an 8 pin RJ 45 male connector Figure 5 1 Front Panel Console Port 3 Set the terminal emulation software as follows a Select the appropriate serial port to connect to the switch b Set the data rate to 9600 baud c Set the data format to 8 data bits 1 stop bit and no parity d Set Flow Control to none e Select VT100 for Emulation mode within your communicati...

Page 57: ...nal before completely booting If the system detects a critical problem the boot process stops If POST passes successfully a valid executable image is loaded into RAM POST messages are displayed on the terminal and indicate test success or failure The boot process runs for approximately 40 45seconds When the boot process completes the following LEDs are lit as shown in Figure 7 2 Power Status Fan s...

Page 58: ...lowing fields SNMP Community String and SNMP Management System IP address optional Username and password Management switch IP address IP subnet mask Default gateway IP address NOTE The Setup Wizard assumes the following The PowerConnect switch was never configured before and is in the same state as when you received it The PowerConnect switch booted successfully The console connection is establish...

Page 59: ...p Wizard and enter CLI mode to manually configure the switch The system will prompt you with a default answer by pressing Enter you accept the default value You must respond to the next question to run the Setup Wizard within 60 seconds otherwise the system will continue with normal operation using the default system configuration Would you like to enter the Setup Wizard you must answer this quest...

Page 60: ...s the switch The wizard automatically assigns the highest access level Privilege Level 15 to this account You can use Dell Network Manager or other management interfaces to change this setting later and to add additional management system later For more information on adding management systems see the user documentation To add a management station Please enter the SNMP community string to be used ...

Page 61: ...t an IP address is setup The IP address is defined on the default VLAN VLAN 1 This is the IP address you use to access the Telnet Web interface or SNMP interface for the switch To set up an IP address Please enter the IP address of the device A B C D Please enter the IP subnet mask A B C D or nn 10 Enter the management IP address and IP subnet mask for example 192 168 2 100 as the IP address and 2...

Page 62: ... the information is incorrect select N to discard configuration and restart the wizard Y N 14 Enter N to restart the wizard or enter Y to complete the Setup Wizard If you enter Y the following is displayed Configuring SNMP management interface Configuring user account Configuring IP and subnet Thank you for using Dell Easy Setup Wizard You will now enter CLI mode The CLI prompt is displayed You ha...

Page 63: ...cribes how to perform various configuration operations through the CLI It includes the following topics Using the CLI Accessing the Device Through the CLI Retrieving an IP Address Security Management and Password Configuration Configuring Login Banners Startup Menu Procedures Software Download ...

Page 64: ... subset of commands is available in User EXEC mode This level is reserved for tasks that do not change the terminal configuration and is used to access configuration sub systems After logging into the device User EXEC command mode is enabled The user level prompt consists of the host name followed by the angle bracket For example console NOTE The default host name is console unless it has been mod...

Page 65: ...the device host name followed by For example console To list the Privileged EXEC commands type a question mark at the command prompt To return from Privileged EXEC mode to User EXEC mode type disable and press Enter The following example illustrates accessing privileged EXEC mode and then returning to the User EXEC mode Use the exit command to return to a previous mode To configure the device ente...

Page 66: ... physical interface level port VLAN or LAG Interface commands that require subcommands have another level called the Subinterface Configuration mode A password is not required to access this level The following example places the CLI in Interface Configuration mode on port 1 0 1 The sntp command is then applied to that port To run a command in a mode which does not contain it use do before the com...

Page 67: ...inals can be virtually connected to the local device through a TCP IP protocol network Telnet is an alternative to a local login terminal where a remote login is required The device supports up to four simultaneous Telnet sessions All CLI commands can be used over a Telnet session If access is via a Telnet connection ensure that the device has an IP address and that software has been downloaded to...

Page 68: ... from a DHCP server perform the following steps 1 Select and connect any port to a DHCP server or to a subnet that has a DHCP server on it 2 Type the following commands to use the selected port for receiving the IP address a Assigning dynamic IP Addresses on a port b Assigning a dynamic IP Addresses on a VLAN The interface receives the IP address automatically console configure console config inte...

Page 69: ...e and the DHCP instructs it to reload the same file NOTE If you configure a DHCP IP address this address is dynamically retrieved and the ip address dhcp command is saved in the configuration file In the event of master failure the backup will again attempt to retrieve a DHCP address This could result in one of the following The same IP address may be assigned A different IP address may be assigne...

Page 70: ...hen the device reboot begins any input at the ASCII terminal or keyboard automatically cancels the BOOTP process before completion and the device does not receive an IP address from the BOOTP server The following example illustrates the process To display the IP address enter the show ip interface command The device is now configured with an IP address console enable console delete startup config ...

Page 71: ...ssword privileged users can access the Web interface with any password NOTE Passwords can be secured by using password management commands to force aging out of passwords or expiration of passwords For more information see Management Security on page 254 Initial Configuration and Password Recovery The system is delivered without a default password and all passwords must be defined by the user If a...

Page 72: ...following commands Configuring an Initial Telnet Password To configure an initial Telnet password enter the following commands console config aaa authentication login default line console config aaa authentication enable default line console config line console console config line login authentication default console config line enable authentication default console config line password george con...

Page 73: ...to be displayed NOTE HTTP and HTTPS services require privilege level 15 access and connect directly to the configuration level access console config aaa authentication login default line console config aaa authentication enable default line console config line ssh console config line login authentication default console config line enable authentication default console config line password jones c...

Page 74: ... can be defined Message of the Day Banner motd Displayed when the user connects to the device before login The following defines a message of the day for the console console configure console config line console console config line motd banner console config line exit console config banner motd Welcome console do show banner motd Welcome Would you like to enable this banner to all lines Y N Y Y co...

Page 75: ...nner for the console console configure console config line console console config line login banner console config line exit console config banner login Please log in console do show banner login Would you like to enable this banner to all lines Y N Y Y Please log in console configure console config line console console config line exec banner console config line exit console config banner exec Su...

Page 76: ...on from the Startup menu take time out into account If no selection is made within 10 seconds default the device times out This default value can be changed through the CLI Download Software Option 1 The software download procedure is used to replace corrupted files or upgrade system software when the device does not have IP connectivity or when both software images of the device are corrupted and...

Page 77: ... 2 In some cases the device Startup Configuration file must be erased If the configuration is erased all parameters configured via CLI web management or SNMP must be reconfigured To erase the device configuration in the Startup Configuration file 1 From the Startup menu select 2 The following message is displayed Warning About to erase a Flash file Are you sure Y N 2 Press Y The following message ...

Page 78: ...2 Continue the regular startup by logging in without a password 3 Enter a new password or press ESC to exit NOTE To ensure device security reconfigure passwords for applicable management methods Set Terminal Baud Rate Option 4 To set the terminal baud rate 1 Type 4 and press Enter 2 Enter the new baud rate The following is displayed Note that after this step your terminal will no longer respond Ad...

Page 79: ...s a slave s software System Image Download When the device boots it decompresses the system image from the flash memory area and runs it When a new image is downloaded it is saved in the other area allocated for the other system image copy On the next boot the device decompresses and runs the image from the currently active system image A system image can be downloaded through a USB port or a TFTP...

Page 80: ...located for the other copy of system image image 2 as shown in the example The following is an example of the information that appears Exclamation symbols indicate that a copying process is in progress Each symbol corresponds to 512 bytes transferred successfully A period indicates that the copying process is timed out Many periods in a row indicate that the copying process failed console show boo...

Page 81: ... the currently active image 6 Enter the reload command The following message is displayed 7 Enter Y The device reboots Boot Image Download Loading a new boot image from the TFTP server or USB port updates the boot image The boot image is loaded when the device is powered on A user has no control over the boot image copies To download a boot image through the TFTP server console boot system image 2...

Page 82: ...wing message is displayed 4 Enter Y The device reboots console show version Unit SW version Boot version HW version 2 1 0 0 24 1 0 0 11 console console copy tftp 50 1 1 7 contax 10014 ros image 01 Oct 2006 11 57 35 COPY I FILECPY Files Copy source URL tftp 50 1 1 7 contax 10014 ros destination URL flash image 01 Sep 2010 11 57 38 INIT I Startup Cold Startup 01 Sep 2010 11 59 05 COPY N The copy ope...

Page 83: ...rator This section provides an introduction to the Dell OpenManage Switch Administrator user interface It contains the following topics Starting the Application Understanding the Interface Using the Switch Administrator Buttons Field Definitions Common GUI Features CLI Commands ...

Page 84: ...heir components The branches in the tree view can be expanded to view all the components under a specific feature or retracted to hide the feature s components By dragging the vertical bar to the right the tree area can be expanded to display the full name of a component Device View Located in on the top center of the home page the device view provides information about device ports current config...

Page 85: ... meaning Table 7 1 Port Colors NOTE For more information about LEDs see LED Definitions on page 38 To configure a port double click on its icon Only ports that are physically present are displayed in the PowerConnect OpenManage Switch Administrator home page and can be configured through the web management system Non present ports can be configured through the CLI or SNMP interfaces Port Represent...

Page 86: ...86 Dell PowerConnect 55xx Systems User Guide gi Giga port te Ten Giga port x Unit ID z Port number ...

Page 87: ...able 9 3 describes the device management buttons Table 7 2 Information Buttons Button Description Support Opens the Dell Support page at support dell com About Contains the version and build number and Dell copyright information Logout Opens the Log Out window Table 7 3 Device Management Icons Button Icon Description Apply Save Saves changes to the Running and Startup Configuration files Help Open...

Page 88: ...88 Dell PowerConnect 55xx Systems User Guide Refresh Refreshes device information from the Running Configuration file Table 7 3 Device Management Icons Continued ...

Page 89: ...ancel Cancel changes entered in GUI page Clear All Counters Delete counters Clear Counters Delete selected counters Clear Log Delete entries from log Clear Statistics Delete statistics Copy parameters from Copy the parameters from a selected row to the selected target rows Copy parameters from port Copy the parameters from a selected port to the selected target ports Details Shows further details ...

Page 90: ...y conventions that apply to all commands The following table describes these conventions Table 7 5 Common GUI Elements Telnet Opens a Telnet window This only works in the Explorer 6 and Firefox browsers Button Description In a command line square brackets indicate an optional entry In a command line curly brackets indicate a selection of compulsory parameters separated by the character One option ...

Page 91: ...e console all When a parameter is required to define a range of ports or parameters and all is an option the default for the command is all when no parameters are defined For example the command interface range port channel has the option of either entering a range of channels or selecting all When the command is entered without a parameter it automatically defaults to all Button Description ...

Page 92: ...ork Security This section describes the various mechanisms for providing security on the switch It contains the following topics Port Security ACLs ACL Binding Proprietary Protocol Filtering Absolute Time Range Time Range Recurrence Dot1x Authentication ...

Page 93: ... either manually defined on the port or learned on that port before it was locked Limited Dynamic Lock When a packet is received on a locked port and the packet s source MAC address is not tied to that port either it was learned on a different port or it is unknown to the system a protection mechanism which provides various options is invoked Unauthorized packets arriving to a locked port are eith...

Page 94: ...rs for a port select it and click Edit 3 Enter the following fields Interface Select the interface to be configured Current Port Status Displays the current port status Set Port Select to either lock or unlock the port Learning Mode Set the locked port type The Learning Mode field is enabled only if Locked is selected in the Set Port field The possible options are Classic Lock Locks the port using...

Page 95: ...ble options are Discard Discard the packets from any unlearned source Forward Forward the packets from an unknown source without learning the MAC address Shutdown Discard the packet from any unlearned source and shut down the port Ports remain shutdown until they are reactivated or the device is reset Trap Enable disable traps being sent when a packet is received on a locked port Trap Frequency 1 ...

Page 96: ...tion port security forward discard discard shutdown trap seconds no port security Enables port security on an interface Use the no form of this command to disable port security on an interface port security forward discard discard shutdown trap seconds no port security Configures port security on an interface Use the no form of this command to disable port security show ports security gigabitether...

Page 97: ...earning Action Maximum Trap Frequency gi1 0 1 Disabled Max Addresses 10 gi1 0 2 Disabled Lock 1 gi1 0 3 Disabled Lock 1 gi1 0 4 Disabled Lock 1 gi1 0 5 Disabled Lock 1 gi1 0 6 Disabled Lock 1 gi1 0 7 Disabled Lock 1 gi1 0 8 Disabled Lock 1 gi1 0 9 Disabled Lock 1 gi1 0 10Disabled Lock 1 gi1 0 11Disabled Lock 1 gi1 0 12Disabled Lock 1 ...

Page 98: ...0 can receive TCP packets however if a UDP packet is received the packet is dropped ACLs are composed of Access Control Entries ACEs that are rules that determine traffic classifications Each ACE is a single rule and up to 256 rules may be defined on each ACL and up to 3000 rules globally Rules are not only used for user configuration purposes they are also used for features like DHCP Snooping Pro...

Page 99: ...Pv6 frames MAC Based ACLs To define a MAC based ACL 1 Click Switching Network Security MAC Based ACL to display the MAC Based ACL Summary page Figure 8 2 MAC Based ACL Summary The currently defined MAC based ACLs are displayed 2 To add a new ACL click Add ACL and enter the name of the new ACL ...

Page 100: ... Based ACL CLI Commands CLI Command Description mac access list extended acl name no mac access list extended acl name Defines an ACL and places the device in MAC extended ACL configuration mode Use the no form of this command to remove the ACL show interfaces access lists Displays access lists applied on interfaces console show access lists Extended IP access list ACL1 permit 234 172 30 40 1 0 0 ...

Page 101: ...nter the priority of the ACE ACEs with higher priority are processed first One is the highest priority Source MAC Address Match the source MAC address from which packets have arrived to this source address In addition to the Source MAC address you can enter a Wildcard Mask that specifies which bits in the source address are used for matching and which bits are ignored A wildcard of 00 00 00 00 00 ...

Page 102: ...matched VLAN ID Match the packet s VLAN ID to this VLAN ID The possible VLAN IDs are 1 to 4095 CoS Match the packet s CoS value to this CoS value Cos Mask Match the packet s CoS value to one of these CoS values Ether type Match the packet s Ethertype to this one Time Range Name Check to associate a time range with the ACE Select one of the time ranges defined in the Time Range page Action Select t...

Page 103: ... aarp amber dec spanning decnet iv diagnostic dsm etype 6000 vlan vlan id cos cos cos wildcard time range time range name Sets permit conditions for an MAC access list in MAC ACL configuration mode deny any source source wildcard any destination destination wildcard eth type 0 aarp amber dec spanning decnet iv diagnostic dsm etype 6000 vlan vlan id cos cos cos wildcard time range time range name d...

Page 104: ...Pv4 based ACL 1 Click Switching Network Security IPv4 Based ACL to display the IPv4 Based ACL Summary page Figure 8 4 IPv4 Based ACL Summary The previously defined IPv4 ACLs are displayed 2 To add a new ACL click Add ACL 3 Enter the name of the new ACL Names are case sensitive ...

Page 105: ... to an ACL 1 Click Switching Network Security IPv4 Based ACE to display the IPv4 Based ACE page Figure 8 5 IPv4 Based ACE Summary Table 8 4 IP Based ACL CLI Commands CLI Command Description ip access list extended acl name no ip access list extended acl name Defines an IPv4 access list and places the device in IPv4 access list configuration mode Use the no form of this command to remove the access...

Page 106: ...ant to receive transmissions assigned to a specific multicast group IPinIP IP in IP Encapsulates IP packets to create tunnels between two routers This ensures that IPIP tunnel appears as a single interface rather than several separate interfaces IPIP enables tunnel intranets occur the internet and provides an alternative to source routing TCP Transmission Control Protocol TCP Enables two hosts to ...

Page 107: ...ork layer protocols OSPF The Open Shortest Path First OSPF protocol is a link state hierarchical interior gateway protocol IGP for network routing Layer Two 2 Tunneling Protocol an extension to the PPP protocol that enables ISPs to operate Virtual Private Networks VPNs IPIP IP over IP IPinIP Encapsulates IP packets to create tunnels between two routers This ensures that IPIP tunnel appears as a si...

Page 108: ...icate that the source address is not matched Dest IP Address Enter the destination IP address to which addresses in the packet are compared Wildcard Mask In addition to the Destination MAC address you can enter a mask that specifies which bits in the source address are used for matching and which bits are ignored A wildcard of 0 0 0 0 means the bits must be matched exactly in addition to the IP de...

Page 109: ...lowing matching options Match DSCP 0 63 Matches the packet DSCP value to the ACL Match IP Precedence 0 7 Check to enable matching IP precedence with the packet IP precedence value IP precedence enables marking frames that exceed the CIR threshold In a congested network frames containing a higher DP value are discarded before frames with a lower DP value If this field is checked enter a value to be...

Page 110: ...rmit igmp any source ip address source wildcard any destination ip address destination wildcard igmp type dscp number precedence number time range time range name permit tcp any source ip address source wildcard any source port port range any destination ip address destination wildcard any destination port port range dscp number precedence number match all list of flags time range time range name ...

Page 111: ...time range time range name disable port log input deny tcp any source ip address source wildcard any source port port range any destination ip address destination wildcard any destination port port range dscp number precedence number match all list of flags time range time range name disable port log input deny udp any source ip address source wildcard any source port port range any destination ip...

Page 112: ...fic IPv6 ACLs do not check IPv6 over IPv4 or ARP packets To define IPv6 based ACLs 1 Click Switching Network Security IPv6 Based ACL to display the IPv6 Based ACL Summary page Figure 8 6 IPv6 Based ACL Summary A list of all of the currently defined IPv6 based ACLs is displayed 2 To add a new ACL click Add ACL 3 Enter the name of the new ACL Names are case sensitive ...

Page 113: ...o an IPv6 based ACL 1 Click Switching Network Security IPv6 Based ACE to display the IPv6 ACE Summary page Figure 8 7 IPv6 Based ACE Summary Table 8 6 IP Based ACL CLI Commands CLI Command Description ipv6 access list access list name no ipv6 access list access list name Defines an IPv6 access list and places the device in IPv6 access list configuration mode Use the no form of this command to remo...

Page 114: ...rotocol that transmits packets but does not guarantee their delivery ICMP Internet Control Message Protocol ICMP The ICMP allows the gateway or destination host to communicate with the source host For example to report a processing error IPV6 Matches the packet to the IPV6 protocol Protocol ID To Match Enter a protocol Any Check to use any protocol Source Port Enter the TCP UDP source port Enter e...

Page 115: ...P address to which addresses in the packet are compared The following options are available Prefix Length The number of bits that comprise the destination IP address prefix of the subnetwork Any Check to indicate that the destination address is not matched Traffic Class Select one of the following options Match DSCP Matches the packet DSCP value to the ACL Match IP Precedence Matches the IP preced...

Page 116: ...ation prefix length dscp number precedence number time range time range name permit icmp any source prefix length any destination prefix length any icmp type any icmp code dscp number precedence number time range time range name permit tcp any source prefix length any source port port range any destination prefix length any destination port port range dscp number precedence number match all list o...

Page 117: ...efix length any source port port range any destination prefix length any destination port port range dscp number precedence number match all list of flags time range time range name disable port log input deny udp any source prefix length any source port port range any destination prefix length any destination port port range dscp number precedence number time range time range name disable port lo...

Page 118: ...to the default rule which is to Drop unmatched packets To change the default action for unmatched packets to an action other than Drop do the following Add an additional ACE to the ACL with Any in all fields Set its action other than Drop Set the priority to the lowest in the ACL To bind ACLs to interfaces 1 Click Switching Network Security ACL Binding to display the ACL Binding Summary page Figur...

Page 119: ...ings The following is an example of some of the CLI commands Table 8 8 ACL Bindings CLI Commands CLI Command Description service acl input acl name1 acl name2 no service acl input Controls access to an interface Use the no form of the command to remove access control show access lists acl name Displays access control lists ACLs configured on the switch console config mac access list extended serve...

Page 120: ...er is enabled on a port you cannot enable a QoS ACL on this port To configure Proprietary Protocol Filtering 1 Click Switching Network Security Proprietary Protocol Filtering to display the Proprietary Protocol Filtering Summary page Figure 8 9 Proprietary Protocol Filtering Summary A list of the ports and their filtered protocols is displayed 2 Click Edit to modify the filtered protocols for a sp...

Page 121: ...hen run again with all the required protocol names The following is an example of some of the CLI commands Table 8 9 Protocol Filtering Protocol Destination Address Protocol Type blockcdp 0100 0ccc cccc 0x2000 blockvtp 0100 0ccc cccc 0x2003 blockdtp 0100 0ccc cccc 0x2004 blockudld 0100 0ccc cccc 0x0111 blockpagp 0100 0ccc cccc 0x0104 blocksstp 0100 0ccc cccd blockall 0100 0ccc ccc0 0100 0ccc cccf ...

Page 122: ...nce pages If a time range includes both absolute and recurring ranges the ACL is activated only if both absolute start time and the recurring time range have been reached The ACL is deactivated when either of the time ranges is reached The switch supports a maximum of 10 absolute time ranges All time specifications are interpreted as local time Daylight Savings Time does not affect this To ensure ...

Page 123: ...ummary page Figure 8 10 Time Range Summary The existing Time Ranges are displayed 2 To add a new time range click Add 3 Enter the name of the time range in the Time Range Name field 4 Define the Absolute Start time To begin the Time Range immediately click Immediate To determine at what time in the future the Time Range will begin enter values in the Date and Time fields ...

Page 124: ...e Configuring Time Ranges Using CLI Commands on page 125 for the CLI commands for creating time ranges Time Range Recurrence To add a recurring time range element to an absolute time range 1 Click Switching Network Security Time Range Recurrence to display the Recurring Time Range Summary page Figure 8 11 Recurring Time Range Summary A daily and weekly recurring element of the time range that is s...

Page 125: ...elect the Day of the Week and Time on which the time range starts End Select the Day of the Week and Time on which the time range ends Configuring Time Ranges Using CLI Commands The following table summarizes the CLI commands for configuring time ranges Table 8 11 Time Range CLI Commands CLI Command Description time range time range name no time range time range name Enables time range configurati...

Page 126: ...c list hh mm to hh mm day of the week1 day of the week2 day of the week7 periodic list hh mm to hh mm all no periodic list all hh mm to hh mm all Adds a recurring time range to the time range Use the no form of the commands to remove the recurring time range console config time range http allowed console config time range absolute start 12 00 1 jan 2005 end 12 00 31 dec 2005 console config time ra...

Page 127: ...e RADIUS server using the Extensible Authentication Protocol EAP Port Authentication includes Authenticators Specifies the device port that is authenticated before permitting system access Supplicants Specifies the host connected to the authenticated port hat is requesting to access the system services Authentication Server Specifies the external server for example a RADIUS server which performs a...

Page 128: ...imultaneously requesting and granting port access However this device can only act as an authenticator and does not take on the role of a supplicant The following varieties of Dot1x exist Single session Dot1x A1 Single session Single Host In this mode the switch as an authenticator supports a single Dot1x session and grants permission to use the port to an authorized supplicant All other access re...

Page 129: ...tch The switch must not be configured to use both a DVA and a MAC based VLAN group A RADIUS server must support DVA with RADIUS attributes tunnel type 64 VLAN 13 tunnel media type 65 802 6 and tunnel private group id a VLAN ID Dynamic Policy ACL Assignment The Dynamic Policy ACL Assignment feature enables specifying a user defined ACL or policy in the RADIUS server After a successful authenticatio...

Page 130: ...cated VLANs and Guest VLANs provide access to services that do not require the subscribing devices or ports to be Dot1x or MAC Based authenticated and authorized An unauthenticated VLAN is a VLAN that allows access by authorized and unauthorized devices or ports You can configure one or more VLAN to be unauthenticated in the VLAN Membership pages in VLANs on page 459 An unauthenticated VLAN has th...

Page 131: ...mode enables providing users who fail authentication with limited network access This enables these users to correct the reason that the authentication failed The following are the main aspects of this feature Enables successful authentications using the returned RADIUS information Provides a mechanism to report unsuccessful authentications without negative repercussions to the user due to adminis...

Page 132: ...k Security Dot1 Authentication Port Based Authentication Global to display the Port Based Authentication Global page Figure 8 12 Port Based Authentication Global 2 Enter the following fields Port Based Authentication State Enable disable port based authentication Authentication Method Select an authentication method The possible options are ...

Page 133: ...pts Monitoring VLAN Enter the ID of the VLAN to which traffic being monitored is routed after unsuccessful Dot1x authentication Accept Supplicant when Dynamic Policy ACL Assignment Has No Resources If no resources remain in the TCAM the system can either reject disable or allow enable successful authentication Enabling Port Based Authentication Globally Using the CLI Commands The following table s...

Page 134: ...the VLAN List Use the no form of this command to disable access show dot1x Displays 802 1X status for the device console config aaa authentication dot1x default none console config interface vlan 5 console show dot1x 802 1x is disabled Admin Oper Reauth Reauth Username Port Mode Mode Control Period gi1 0 1 Force Authorized Authorized Disabled 3600 n a gi1 0 2 Force Authorized Authorized Disabled 3...

Page 135: ...d Authentication Interface Settings Port parameters for the selected unit are displayed 2 Click Edit 3 Select a port for which the authentication parameters apply in the Interface drop down list 4 Enter the parameters User Name Displays the username of the port Admin Interface Control Select the port authorization state The possible options are Auto Enables port based authentication on the interfa...

Page 136: ...on the port 802 1x MAC Both 802 1X and MAC based authentication are performed on the switch The 802 1X authentication takes precedence NOTE For MAC authentication to succeed the RADIUS server supplicant username and password must be the supplicant MAC address The MAC address must be in lower case letters and entered without the or separators for example 0020aa00bbcc Dynamic VLAN Assignment Enable ...

Page 137: ...o VLAN Assignment is not available Guest VLAN Enable disable port access to the Guest VLAN If enabled unauthorized users connected to this interface can access the Guest VLAN Dynamic Policy ACL Assignment Enable disable this feature Periodic Reauthentication Select to enable port re authentication attempts after the specified Reauthentication Period Reauthentication Period 300 4294967295 Enter the...

Page 138: ...thorized force unauthorized no dot1x port control Enables manual control of the port authorization state Use the no form of this command to restore the default configuration dot1x mac authentication mac only mac and 802 1x no dot1x mac authentication Enables authentication based on the station s MAC address Use the no form of this command to disable access dot1x radius attributes vlan no dot1x rad...

Page 139: ...o form of this command to restore the default configuration dot1x timeout server timeout seconds no dot1x timeout server timeout Sets the time for the retransmission of packets to the authentication server Use the no form of this command to restore the default configuration dot1x timeout supp timeout seconds no dot1x timeout supp timeout Sets the time for the retransmission of an EAP request frame...

Page 140: ... console config aaa authentication dot1x default none console config interface vlan 5 console config if dot1x auth not req console config vlan database console config vlan vlan 2 console config vlan exit console config interface vlan 2 console config if dot1x guest vlan console show dot1x Interface Admin Mode Oper Mode Reauth Control Reauth Period Username gi1 0 1 Auto Authorized Enabled 3600 Bob ...

Page 141: ...onitoring Users page Figure 8 14 Monitoring Users 2 Select a supplicant that was authenticated on the port The supplicant s information is displayed User Name Name assigned to this port Port Number of port VLAN Port belongs to this VLAN MAC Address Source of traffic Reject Reason Reason that traffic was rejected See Table 8 14 for a list of the possible reject reasons Time Time that traffic was re...

Page 142: ... IPv6 DIP and MAC addresses IPV6WithNotIP RADIUS accept message contains IPv6 and not IP simultaneously POL BasicMode Policy is not supported in the QoS basic mode POL DEL Policy was deleted by a user POL OVRFL Policy sent by radius server can not be applied because of TCAM overflow RAD APIERR RADIUS API returned error e g No RADIUS server is configured RAD_INVLRES RADIUS server returned invalid p...

Page 143: ...escription show dot1x monitoring result username username Displays the captured information of each interface host on the switch stack console show dot1x monitoring Tom Username Tom Port g1 Quiet period 60 Seconds Tx period 30 Seconds Max req 2 Supplicant timeout 30 Seconds Server timeout 30 Seconds Session Time HH MM SS 08 19 17 MAC Address 00 08 78 32 98 78 Authentication Method Remote Assigned ...

Page 144: ...uthentication Host Authentication to display the Host Authentication Summary page Figure 8 15 Host Authentication Summary A list of the ports and their authentication modes is displayed The fields are defined on the Edit page with the exception of the following field Single Host Status Displays the host status The possible options are Unauthorized The port control is Force Unauthorized the port li...

Page 145: ...y cannot be enabled on a port in single host mode Multiple Host Multiple hosts can be attached to a single 802 1x enabled port Only the first host must be authorized and then the port is wide open for all who want to access the network If the host authentication fails or an EAPOL logoff message is received all attached clients are denied access to the network Multiple Session A number of specific ...

Page 146: ...se the no form of this command to disable the traps dot1x traps mac authentication success no dot1x traps mac authentication success Enables sending traps when MAC address was failed in authentication of the 802 1X MAC authentication access control Use the no form of this command to disable the traps dot1x violation mode restrict protect shutdown no dot1x violation mode Configures the action to be...

Page 147: ...on definitions 1 Click Switching Network Security Dot1 Authentication Port Authentication Users to display the Port Authentication Users page Figure 8 16 Port Authentication Users The ports and their authentication definitions are displayed User Name Supplicant names that were authenticated on each port Port Number of port Session Time Amount of time in seconds that the supplicant was logged on th...

Page 148: ...thenticated by a RADIUS server MAC Address Displays the supplicant MAC address MAC Address MAC address of user who attempted to be authenticated VLAN VLAN assigned to the user Filter Filter that was applied to the user by receiving the policy ACL name from the RADIUS server Dynamic ACL Assignment 2 Click Details to view the names of the VLAN filters Filter 1 and Filter 2 defined on the port in add...

Page 149: ...ctive 802 1x authenticated users for the device console show dot1x users Port User Session Auth MAC VLAN Filter Name Time Method Address gi1 0 1 Bob 1d 03 08 58 Remote 0008 3b79 8787 3 Port User Session Auth MAC VLAN Filter Name Time Method Address gi1 01 Bob 1d 09 07 38 Remote 0008 3b79 8787 3 OK gi1 01 Tim 03 08 58 Remote 0008 3b79 3232 9 OK gi1 03 Paul 02 12 48 Remote 0008 3b89 8237 8 Warning c...

Page 150: ...ow to set system parameters such as security features switch software system time logging parameters and more It contains the following topics General Switch Information Time Synchronization Logs IP Addressing Diagnostics Management Security DHCP Server DHCP Server File Management Stack Management sFlow ...

Page 151: ...s Asset Information System Health Power over Ethernet Asset Information Use the Asset page to view and configure general device information including the system name location contact system MAC Address System Object ID date time and system up time To configure general device parameters 1 Click System General Asset in the tree view to display the Asset page Figure 9 1 Asset ...

Page 152: ...been defined but the SNTP server is not available the switch uses the date and time in this field and the Time field Time Enter the current time mandatory This time can also be entered in the Manual Time Settings page If SNTP has been defined but the SNTP server is not available the switch uses the date and time in this field and the Date field System Up Time Displays the amount of time since the ...

Page 153: ...ontact name Use the no form of the command to remove the system contact information snmp server location text no snmp server location Configures the system location string Use the no form of this command to remove the location string hostname name no hostname Specifies the device host name Use the no form of the command to remove the existing host name clock set hh mm ss month day year Sets the sy...

Page 154: ... Figure 9 2 System Health The System Health page displays the following fields Unit No The unit in the stack for which information is displayed Power Supply Status Displays the following columns PS The power status of the internal power unit The possible options are Checked The power supply is operating normally Unchecked The power supply is not operating normally Not Present The power supply is c...

Page 155: ...tantly on The possible options are Checked The fans are operating normally Unchecked At least one of the fans is not operating normally Fan Admin State On Auto status that user configured in the Edit page Fan Current Level Specifies whether the fan is actually on or off 2 The lower block displays the condition under which a fan will be turned on or off Fan Level The on or off level Condition The t...

Page 156: ...Health Information Using the CLI Commands The following table summarizes the CLI commands for viewing fields displayed on the System Health page Celsius Fahrenheit 0 32 5 41 10 50 15 59 20 68 25 77 30 86 35 95 40 104 Table 9 3 System Health CLI Command CLI Command Description show system unit unit Displays system information system fans always on unit unit no system fans always on Sets the system ...

Page 157: ...work infrastructure Using PoE eliminates the need to Place all network devices next to power sources Deploy double cabling systems significantly decreasing installation costs PoE can be used in any network that deploys relatively low powered devices connected to the Ethernet LAN PDs are devices that receive power from the PowerConnect power supplies such as IP phones console show system Unit Type ...

Page 158: ...s To configure PoE parameters on devices equipped with PoE 1 Click System General Power over Ethernet in the tree view to display the Power Over Ethernet Summary page Figure 9 3 Power Over Ethernet Summary 2 The PoE global parameters are displayed Power Status The inline power source status On The power supply unit is functioning Off The power supply unit is not functioning ...

Page 159: ...e port PoE parameters are displayed for all ports on the unit The fields displayed in this block are described in the Edit page 5 To set PoE settings for a port click Edit 6 Select a port in the Port field and enter the following PoE parameters for the PDs connected to this port PoE Admin Status Select the device PoE mode The possible options are Auto Enables the Device Discovery protocol and prov...

Page 160: ...ter Number of times the power supply was stopped to the PD because it was no longer detected f Invalid Signature Counter Number of times an invalid signature was received Signatures are the means by which the powered device identifies itself to the PSE Signatures are generated during powered device detection classification or maintenance Managing PoE Using the CLI Commands The following table desc...

Page 161: ...e Enables PoE device traps Use the no form of this command to disable traps power inline limit mode class port no power inline limit mode Sets the power limit mode of the system Use the no form of this command to return to default show power inline gigabitethernet tengigabi tethernet port number vlan vlan id port channel LAG number module stack member number Displays PoE configuration information ...

Page 162: ... following sections Manual Time Settings Setting System Time and Daylight Savings Time CLI Commands for Setting Manual Time System Time from an SNTP Server Global Settings Clock Source SNTP Global Settings SNTP Authentication SNTP Servers SNTP Interfaces CLI Script for Receiving Time from an SNTP Server Manual Time Settings This section describes how to set the system time manually on the device I...

Page 163: ...ast weekend of October Austria Last weekend of March until the last weekend of October Bahamas From April to October in conjunction with U S summer hours Belarus Last weekend of March until the last weekend of October Belgium Last weekend of March until the last weekend of October Brazil From the 3rd Sunday in October until the 3rd Saturday in March During the period of Daylight Saving Time Brazil...

Page 164: ...d of March until the last weekend of October Latvia Last weekend of March until the last weekend of October Lebanon Last weekend of March until the last weekend of October Lithuania Last weekend of March until the last weekend of October Luxembourg Last weekend of March until the last weekend of October Macedonia Last weekend of March until the last weekend of October Mexico From the first Sunday ...

Page 165: ...ight Saving Time Spain Last weekend of March until the last weekend of October Sweden Last weekend of March until the last weekend of October Switzerland Last weekend of March until the last weekend of October Syria From 31st March until 30th October Taiwan Taiwan does not operate Daylight Saving Time Turkey Last weekend of March until the last weekend of October United Kingdom Last weekend of Mar...

Page 166: ...The system date Local Time The system time Time Zone Offset The difference between Greenwich Mean Time GMT and local time For example the Time Zone Offset for Paris is GMT 1 00 while the local time in New York is GMT 5 00 3 To set Daylight Savings Time DST select the Daylight Savings field and select one of the possible options USA The device switches to DST at 2 a m on the second Sunday of March ...

Page 167: ... setting complete the Recurring area If Other is selected the From and To fields must be defined either in the Non recurring or Recurring section 4 To enter non recurring DST parameters enter the following fields From The time that DST begins The possible options are DD MMM YY The date month and year at which DST begins HH MM The time hour and minutes at which DST begins To The time that DST ends ...

Page 168: ...l Time The following steps in any order must be completed before setting time manually Set system time Define the time zone in relation to GMT Configure Daylight Savings Time The following table summarizes the CLI commands for setting fields displayed in the Manual Time Setting pages when the clock source is Local Table 9 5 Manual Time Setting CLI Commands CLI Description clock set hh mm ss day mo...

Page 169: ... to automatically switch to summer time Daylight Savings Time for a specific period date month year format Use the no form of the command to configure the system not to switch to summer time Daylight Savings Time clock timezone zone hours offset minutes offset Sets the time zone and names it zone for display purposes show clock Displays the time and date from the system clock Table 9 5 Manual Time...

Page 170: ...0 Set the system time console configure console config clock timezone Ohio 2 Set the time zone to GMT plus 2 hours The name of the zone Ohio is purely for documentation purposes This is not mandatory for manual time but is recommended It enables anyone seeing the time to know what that time is in respect to their timezone console config clock summer time Ohio_Summer recurring usa Set Daylight Savi...

Page 171: ...Unicast Polling for Unicast information is used for polling a server whose IP address is known This is the preferred method for synchronizing device time as it is most secure Up to eight SNTP servers can be defined If this method is selected SNTP information is accepted only from SNTP servers defined in the SNTP Servers page Time levels T1 T4 see the Algorithm for Selecting Designated SNTP Server ...

Page 172: ...f receiving time because it is both unsecured and the time information was not specifically requested by the device Anycast is also unsecured but time information packets are only accepted if they were requested Stratums Each SNTP server is characterized by stratums which define the accuracy of its clock The stratum is the distance in terms of NTP hops from the most authoritative time server The l...

Page 173: ... packet is chosen If a better server is discovered later it is selected to be the designated server at that time Polling You can configure the system to acquire time information in the following ways Enable polling Time information is requested every polling interval Do not enable polling Time information is received when the system is brought up and every time that a topological change is made to...

Page 174: ...ty of the communication and authenticates the origin of the communication Global Settings Clock Source System time can be set manually or it may be received from an external SNTP server You if wish to set the system time manually you do not to use the Global Settings page because the default is manual local system time To set the clock source 1 Click System Time Synchronization Global Settings in ...

Page 175: ...s an example of the CLI commands SNTP Global Settings If SNTP was selected as the clock source in the Global Settings page you must define the mechanism of setting time from an SNTP server This is done in the SNTP pages described below Table 9 7 Clock Source CLI Command CLI Description clock source sntp no clock source Configures an external time source for the system clock Use the no form of this...

Page 176: ...Poll Interval 60 86400 Enter the interval in seconds at which the SNTP servers are polled Receive Broadcast Servers Updates Enable disable receiving time information from Broadcast servers Receive Anycast Servers Updates Enable disable receiving time information from Anycast SNTP servers Receive Unicast Servers Updates Enable disable receiving time information from the SNTP servers defined on the ...

Page 177: ...lient poll timer seconds no sntp client poll timer Sets the polling time for an SNTP client Use the no form of this command to restore the default configuration sntp broadcast client enable no sntp broadcast client enable Enables SNTP Broadcast clients Use the no form of this command to disable SNTP Broadcast clients sntp anycast client enable no sntp anycast client enable Enables SNTP Anycast cli...

Page 178: ...played 2 Enable disable SNTP Authentication This enables disables authenticating SNTP sessions between the device and an SNTP server 3 Multiple keys can be defined To add a new SNTP authentication key click Add and enter the fields Encryption Key ID 1 4294967295 Enter the number used to identify this SNTP authentication key internally Authentication Key 1 8 Characters Enter the key used for authen...

Page 179: ...LI Command Description sntp authenticate no sntp authenticate Defines authentication for received SNTP traffic from servers Use the no form of this command to disable the feature sntp trusted key key number no sntp trusted key key number Authenticates the identity of a system to which SNTP will synchronize Use the no form of this command to disable system identity authentication sntp authenticatio...

Page 180: ...vers in the tree view to display the SNTP Servers Summary page Figure 9 8 SNTP Servers Summary The following is displayed for the previously defined servers SNTP Server IP address of server Polling Polls the selected SNTP server for system time information when enabled Encryption Key ID Key Identification used to communicate between the SNTP server and device ...

Page 181: ...e last time a response was received from the SNTP server Offset The estimated offset of the server s clock relative to the local clock in milliseconds The host determines the value of this offset using the algorithm described in RFC 2030 Delay The estimated round trip delay of the server s clock relative to the local clock over the network path between them in milliseconds The host determines the ...

Page 182: ...NTP Authentication pages Defining SNTP Servers Settings Using CLI Commands The following table summarizes the CLI commands for setting fields displayed in the SNTP Server pages Table 9 10 SNTP Server CLI Commands CLI Command Description sntp server ipv4 address ipv6 address ipv6 address hostname poll key key id no sntp server ipv4 address ipv6 address ipv6 address hostname Configures the device to...

Page 183: ... the Anycast packets are sent and received If no interface is defined Anycast requests are not sent console config sntp server 100 1 1 1 poll key 10 console show sntp status Clock is unsynchronized Unicast servers Server Status Last Response Offset Delay mSec mSec Anycast server Server Interface Status Last Response Offset Delay mSec mSec Broadcast Interface IP Address Last Response gi1 0 1 00 00 ...

Page 184: ...he following fields are displayed for every interface for which an SNTP interface has been enabled Interface The port LAG or VLAN on which SNTP is enabled Receive Servers Updates Displays whether the interface is enabled to receive updates from the SNTP server 2 To add an interface that can receive SNTP server updates click Add 3 Select an interface and enable disable State to indicate that the in...

Page 185: ...t port id vlan vlan id port channel LAG number no sntp client enable gigabitethernet tengigabitethern et port number vlan vlan id port channel LAG number Enables the SNTP client on an interface in Global Configuration mode Use the no form of this command to disable the SNTP client sntp client enable no sntp client enable Enables SNTP client on an interface in Interface Configuration mode Use the n...

Page 186: ...nterface gi1 0 1 console config if sntp client enable console show sntp configuration SNTP port 123 Polling interval 1024 seconds No MD5 authentication keys Authentication is not required for synchronization No trusted keys Unicast Clients Disabled Unicast Clients Polling Disabled Server Polling Encryption Key Broadcast Clients disabled Anycast Clients disabled Broadcast Interfaces gi1 0 1 Table 9...

Page 187: ...defined Unicast clients console config sntp unicast client poll Enable polling predefined Unicast clients console config sntp server 10 4 1 3 poll Define the server that will be used as an SNTP server console config exit console show sntp configuration Display SNTP settings console show sntp status Display SNTP servers Table 9 12 Manual Time Setting CLI Commands Continued CLI Description ...

Page 188: ...e following types of events Authentication Events in the Global Parameters page Copy File Events in the Global Parameters page Management Access Events in the Global Parameters page Login History in the Login History page Event messages have a unique format as per the System Logs SYSLOG protocol recommended message format for all error reporting for example SYSLOG and local device reporting messag...

Page 189: ...n of these destinations Global Parameters Use the Global Parameters page to enable disable logging for the following logging severity levels Emergency If the device is down or not functioning properly an emergency log message is saved to the specified logging location Alert An alert log is saved if there is a serious device malfunction for example all device features are down Critical A critical l...

Page 190: ...System Logs Global Parameters in the tree view to display the Global Parameters page Figure 9 10 Global Parameters 2 Enable disable logging in the Logging drop down list Console logs are enabled by default and cannot be disabled 3 If Logging is enabled select the types of events to be logged in addition to the events that are always logged Log Authentication Events Enable disable generating logs w...

Page 191: ...severity levels above the selection are selected automatically Enabling Logs Using CLI Commands The following table summarizes the CLI commands for setting fields displayed in the Global Parameters page Table 9 13 Global Log Parameters CLI Commands CLI Command Description logging on no logging Enables error message logging Turns off error message logging logging console level no logging console le...

Page 192: ... command to disable logging management access list events aaa logging login no aaa logging login Enables logging authentication login events Use the no form of this command to disable logging authentication login events console configure console config logging on console config logging console errors console config logging file alerts Table 9 13 Global Log Parameters CLI Commands Continued CLI Com...

Page 193: ... Entries 20 400 line which contains the maximum number of RAM log entries permitted is displayed When the log buffer is full the oldest entries are overwritten The Current Setting contains how many entries are currently permitted and you can change this number in the New Setting after reset field The following is displayed for the existing logs Log Index The log number in the RAM Log table ...

Page 194: ...ewing and clearing entries in the RAM log The following is an example of the CLI commands Table 9 14 RAM Log Table CLI Commands CLI Command Description logging buffered size no logging buffered Sets the number of SYSLOG messages stored in the internal buffer RAM Use the no form of this command to cancel using the buffer show logging Displays the RAM logging buffer clear logging Clears the RAM logg...

Page 195: ...gs Log File in the tree view to display the Log File page Figure 9 12 Log File The following is displayed for the existing logs Log Index The log number in the Log file Log Time The time at which the log was entered Severity The log severity Description The log entry text 2 To remove all entries from the log file click Clear Log ...

Page 196: ...5 Log File Table CLI Commands CLI Command Description show logging file Displays the logging state and the SYSLOG messages stored in the logging file console show logging file Logging is enabled Console Logging Level info Console Messages 0 Dropped Buffer Logging Level info Buffer Messages 62 Logged 62 Displayed 200 Max File Logging Level debug File Messages 11 Logged 51 Dropped SysLog server 1 1 ...

Page 197: ...r all users is displayed 2 Enable disable Login History to File to record login history 3 Select a user or All from the User Name drop down list The login history for this user is displayed in the following fields Login Time The time the selected user logged on to the device User Name The user that logged on to the device Protocol The means by which the user logged on to the device Location The IP...

Page 198: ...in History CLI Commands CLI Command Description aaa login history file no aaa login history file Enables writing to the login history file Use the no form of this command to disable writing to the login history file show users login history username Displays the user s login history console config aaa login history file console show users login history Login Time Username Protocol Location 01 Oct ...

Page 199: ...mary page Figure 9 14 Remote Log Server Summary The previously defined remote servers are displayed 2 To add a remote log server click Add and enter the fields Supported IP Format Select whether the IPv4 or IPv6 format is supported IPv6 Address Type When the server supports IPv6 this specifies the type of static address supported The possible options are Link Local A Link Local address that is non...

Page 200: ...y Select a user defined application from which system logs are sent to the remote server Only a single facility can be assigned to a single server If a second facility level is assigned the first facility level is overridden All applications defined for a device utilize the same facility on a server Description 0 64 Characters Enter a server description Severity to Include Check the severity level...

Page 201: ...rt id severity level facility facility description text no logging host ipv4 address ipv6 address hostname Logs messages to a remote server with this IP address Use the no form of this command to delete the SYSLOG server with the specified address from the list of SYSLOGs show syslog servers Displays list of SYSLOG servers console configure logging host 1 1 1 1 console show syslog servers Device C...

Page 202: ...nt host as well as an IPv4 host also known as dual stack This enables device operation in a pure IPv6 network as well as in a combined IPv4 IPv6 network Difference Between IPv4 and IPv6 Addressing The primary difference between IPv4 to IPv6 is the length of network addresses IPv6 addresses are 128 bits whereas IPv4 addresses are 32 bits Thus IPv6 addresses enable the use of many more unique addres...

Page 203: ...6 nodes over an IPv4 infrastructure The tunneling mechanism implemented is the Intra Site Automatic Tunnel Addressing Protocol ISATAP This protocol treats the IPv4 network as a virtual IPv6 local link with each IPv4 address mapped to a Link Local IPv6 address IPv4 Interface Parameters You can assign IP addresses to the interface in the following ways Manual Assignment Described below DHCP Server A...

Page 204: ...request with a sender IP address that is equal to its IP address defined on the input interface it sends a SYSLOG message informing of IP duplication containing the sender IP and MAC addresses from the received ARP message To assign an IP address to an interface and to define subnets to which traffic can be routed 1 Click System IP Addressing IPv4 Interface Parameters in the tree view to display t...

Page 205: ...IP address is defined Select an interface type Port LAG or VLAN and the specific interface number Defining IPv4 Interfaces Using CLI Commands The following table summarizes the CLI commands for setting fields displayed in the IPv4 Interfaces Parameters page Table 9 18 IPv4 Interface Parameters CLI Commands CLI Command Description ip address ip address mask prefix length no ip address ip address Se...

Page 206: ... if ip default gateway 10 5 225 33 Set the address of the default gateway console config if no ip address Remove the address if required Table 9 20 Sample CLI Script to Configure IPv4 Statically on a Port CLI Command Description console config Enter Global Configuration mode console config interface gi1 0 1 Enter Interface mode for port 1 on unit 1 console config no switchport Enable the port to w...

Page 207: ...and sends another DHCPDISCOVER packet that restarts the process IP address collisions occur when the same IP address is used in the same IP subnet by more than one device Address collisions require administrative actions on the DHCP server and or the devices that collide Up to 32 interfaces ports LAGs and or VLAN on the switch can be configured with a static or dynamic IP address The IP subnets to...

Page 208: ...ect 55xx Systems User Guide To define the switch as a DHCP client 1 Click System IP Addressing DHCP IPv4 Interface in the tree view to display the DHCP IPv4 Interface Summary page Figure 9 16 DHCP IPv4 Interface Summary ...

Page 209: ...he Interface field Defining DHCP IPv4 Interfaces Using CLI Commands The following table summarizes the CLI commands for setting fields in the DHCP IPv4 Interface pages Table 9 21 DHCP IPv4 Interface CLI Commands CLI Command Description ip address dhcp no ip address dhcp Acquires an IP address on an Ethernet interface from the Dynamic Host Configuration Protocol DHCP Use the no form of this command...

Page 210: ...nfig interface vlan 1 Enter VLAN mode for VLAN 1 console config no switchport Enable the port to work as an IP interface Layer 3 mode console config if ip address dhcp Use the DHCP protocol to acquire the IP address console config if no ip address dhcp Remove the address if required Table 9 23 Sample CLI Script to Configure IPv4 Dynamically on a Port CLI Command Description console config Enter Gl...

Page 211: ...t prefix match To add an IPv4 static route 1 Click System IP Addressing IPv4 Static Routing in the tree view to display the IPv4 Static Routing Summary page Figure 9 17 IPv4 Static Routing Summary 2 Click Add to add a destination and enter the fields Destination IP Prefix Enter the destination IPv4 prefix If all zeros are entered this represents a default route Network Mask Select the destination ...

Page 212: ...o the destination Defining IPv4 Static Routing Using CLI Commands The following table summarizes the CLI commands for configuring IPv4 static routing The following is an example of the CLI command Table 9 24 IPv4 Static Routing CLI Commands CLI Command Description ip routing no ip routing Enables IPv4 Routing Use the no format of the command to disable IPv4 Routing ip route prefix mask prefix leng...

Page 213: ...onsole config Enter Global Configuration mode console config vlan database Enter VLAN mode console config vlan vlan 100 150 Create VLANs number 100 to 150 console config vlan exit Exit VLAN mode console config interface gi1 0 1 Enter Interface mode for port 1 on unit 1 console config if switchport access vlan 100 Make port a member of VLAN 100 console config if ip address 1 1 1 1 255 255 255 0 Set...

Page 214: ...etup IPv6 Interfaces The system supports IPv6 addressable hosts To define IPv6 interfaces 1 Click System IP Addressing IPv6 Interface in the tree view to open the IPv6 Interface Summary page Figure 9 19 IPv6 Interface Summary PC 1 1 1 1 Switch PC 2 1 1 1 VLAN 100 VLAN 150 ...

Page 215: ...ranslates to 100 ICMP error messages per second 3 To add a new IPv6 interface click Add IPv6 Interface and enter the fields Interface Select an IPv6 interface to be configured Number of DAD Attempts Enter the number of consecutive neighbor solicitation messages that are sent on an interface while Duplicate Address Detection DAD is performed on Unicast IPv6 addresses on this interface New addresses...

Page 216: ...obal Anycast The IP address is a globally unique IPv6 Anycast address visible and reachable from different subnets IPv6 Address Enter the IPv6 address assigned to the interface The address must be a valid IPv6 address specified in hexadecimal using 16 bit values between colons An example of an IPv6 address is 2031 0 130F 0 0 9C0 876A 130D and the compressed version is represented as 2031 0 130F 9C...

Page 217: ...s using stateless auto configuration on an interface Addresses are configured depending on the prefixes received in Router Advertisement messages Use the no form of this command to disable address auto configuration on the interface ipv6 icmp error interval milliseconds bucketsize no ipv6 icmp error interval Configures the rate limit interval and bucket size parameters for IPv6 Internet Control Me...

Page 218: ...face Use the no form of this command to prevent the generation of unreachable messages ipv6 nd dad attempts attempt Configures the number of consecutive neighbor solicitation messages that are sent on an interface while Duplicate Address Detection DAD is performed on the unicast IPv6 addresses of the interface show ipv6 interface gigabitethernet tengigabite thernet port number vlan vlan id port ch...

Page 219: ...ments to the switch IPv6 interface When adding or deleting IP addresses the following events occur When removing an IP interface all of its default gateway IP addresses are removed Dynamic IP addresses cannot be removed An alert message is displayed after a user attempts to insert more than one IP address An alert message is displayed when attempting to insert a non Link Local type address Table 9...

Page 220: ...fault Gateway Summary The previously defined routers are displayed with the following fields IPv6 Default IPv6 Address The router s address Interface The interface on which the router is accessed Type The means by which the default gateway was configured The possible options are Static The default gateway is user defined Dynamic The default gateway is dynamically configured through router advertis...

Page 221: ...pper layer protocols a chance to provide reachability confirmation Probe The default gateway is no longer known to be reachable and Unicast Neighbor Solicitation probes are being sent to verify reachability Unreachable No reachability confirmation was received 2 To add an IPv6 default gateway click Add and enter the fields IPv6 Address Type Displays that the IP address was added to the interface t...

Page 222: ... ISATAP addressing conventions When a tunnel interface is enabled for ISATAP the tunnel source must be set for the interface in order for the interface to become active An ISATAP address is represented using the 64 bit prefix 0 5EFE w x y z where 5EFE is the ISATAP identifier and w x y z is a public or private IPv4 address Thus a Link Local address will be represented as FE80 5EFE w x y z show ipv...

Page 223: ...nterface state becomes Active If an ISATAP interface is active the ISATAP router IPv4 address is resolved via DNS by using ISATAP to IPv4 mapping If the ISATAP DNS record is not resolved the ISATAP host name to address mapping is searched in the host name cache When an ISATAP router IPv4 address is not resolved via the DNS process the status of the ISATAP IP interface remains Active The system doe...

Page 224: ...ge Figure 9 21 IPv6 ISATAP Tunnel 2 Enter the fields ISATAP Status Enable disable the status of ISATAP on the device IPv4 Address Type Enter the source of the IPv4 address used by the tunnel The options are Auto Use the dynamic address None Disable the ISATAP tunnel Manual Use the manual address assigned IPv4 Address Enter the local source IPv4 address of a tunnel interface ...

Page 225: ...s The following table summarizes the CLI commands for setting fields displayed in the ISATAP Tunnel pages Table 9 29 ISATAP Tunnel CLI Commands CLI Command Description interface tunnel number Enters tunnel interface configuration mode tunnel mode ipv6ip isatap no tunnel mode ipv6ip Configures an IPv6 transition mechanism global support mode Use the no form of this command to remove an IPv6 transit...

Page 226: ...is command to restore the default configuration tunnel isatap robustness number no tunnel isatap robustness Configures the number of DNS Query Router Solicitation refresh messages that the device sends Use the no form of this command to restore the default configuration show ipv6 tunnel Displays information on the ISATAP tunnel Table 9 30 ISATAP Tunnel CLI Script CLI Command Description console co...

Page 227: ...erface tunnel 1 Enter tunnel mode console config tunnel tunnel mode ipv6ip isatap Enable tunnel console config tunnel tunnel source auto The system minimum IPv4 address will be used as the source address for packets sent on the tunnel interface console config tunnel do show ipv6 tunnel Display tunnel configuration Table 9 30 ISATAP Tunnel CLI Script CLI Command Description ...

Page 228: ... includes a database for maintaining reachability information about active neighbors The device supports a total of up to 64 neighbors obtained statically or dynamically When removing an IPv6 interface all neighbors entered statically or learned dynamically are removed To add an IPv6 neighbor 1 Click System IP Addressing IPv6 Neighbors in the tree view to display the IPv6 Neighbors Summary page Fi...

Page 229: ...her than probe the neighbor immediately however there is a delay sending probes for a short while in order to give upper layer protocols a chance to provide reachability confirmation Probe The neighbor is no longer known to be reachable and Unicast Neighbor Solicitation probes are being sent to verify reachability 2 To clear the Neighbors table select one of the following options None Does not cle...

Page 230: ...v6 Neighbors CLI Commands CLI Command Description ipv6 neighbor ipv6_addr gigabitethernet tengigabitethernet port number vlan vlan id port channel LAG number mac_addr no ipv6 neighbor ipv6_addr gigabitethernet tengigabitethernet port number vlan vlan id port channel LAG number Configures a static entry in the IPv6 neighbor discovery cache Use the no form of this command to remove a static IPv6 ent...

Page 231: ... following is an example of the CLI commands console config console config ipv6 neighbor 3000 a31b vlan 1 001b 3f9c 84ea console show ipv6 neighbors dynamic Interface IPv6 Address HW Address State Router VLAN 1 3000 a31b 0001b 3f9c 84ea Reachable Yes ...

Page 232: ...namic entry also has an associated invalidation timer value extracted from Router Advertisements This timer is used to delete entries that are no longer advertised To view IPv6 destinations and how they are reached Click System IP Addressing IPv6 Routes Table in the tree view to display the IPv6 Routes Table page Figure 9 23 IPv6 Routes Table The following is displayed for each IP address IPv6 Add...

Page 233: ...ife Time The timeout interval of the route if no activity takes place Infinite means the address is never deleted Route Type Specifies whether the destination is directly attached and the means by which the entry was learned The possible options are Local A directly connected route entry Static Manually configured route supported only for default gateway learned through the Neighbor Discover ND pr...

Page 234: ...is the metric S 0 via fe80 77 0 VLAN 1 Lifetime Infinite ND 0 via fe80 200 cff fe4a dfa8 0 VLAN 1 Lifetime 1784 sec L 2001 64 is directly connected g2 Lifetime Infinite L 2002 1 1 1 64 is directly connected VLAN 1 Lifetime 2147467 sec L 3001 64 is directly connected VLAN 1 Lifetime Infinite L 4004 64 is directly connected VLAN 1 Lifetime Infinite L 6001 64 is directly connected g2 Lifetime Infinit...

Page 235: ...NS servers maintain domain name databases and their corresponding IP addresses To add a DNS server and specify the active DNS server 1 Click System IP Addressing Domain Name System in the tree view to display the Domain Name System Summary page Figure 9 24 Domain Name System Summary The list of previously defined DNS servers is displayed 2 To enable mapping of host names into IP addresses through ...

Page 236: ...which the IPv6 interface is configured ISATAP The IPv6 interface is configured on an ISATAP tunnel DNS Server Enter the IP address of the DNS server being added DNS Server Currently Active Displays the DNS server that is currently active Set DNS Server Active Check to activate the selected DNS server Configuring DNS Servers Using the CLI Commands The following table summarizes the CLI commands for...

Page 237: ...ear host dhcp name Deletes entries from the host name to address mapping received from DHCP show hosts Displays the default domain name the list of name server hosts the static and the cached list of host names and addresses console config ip domain lookup console config ip name server 176 16 1 18 Table 9 33 DNS CLI Commands Continued CLI Command Description ...

Page 238: ...define the default domain name 1 Click System IP Addressing Default Domain Name to display the Default Domain Name page Figure 9 25 Default Domain Name If there is a currently defined default domain name it is displayed 2 Enter the Default Domain Name 1 160 Characters Its Type is displayed and has one of the following options Dynamic The IP address was created dynamically Static The IP address is ...

Page 239: ...ault domain name The following is an example of the CLI commands Table 9 34 Default Domain Name CLI Commands CLI Command Description ip domain name name no ip domain name Defines a default domain name that the software uses to complete unqualified host names The no form of the command disables the use of the Domain Name System DNS console config ip domain name dell com ...

Page 240: ...n IP addresses to static host names 1 Click System IP Addressing Host Name Mapping in the tree view to display the Host Name Mapping Summary page Figure 9 26 Host Name Mapping Summary The currently defined host names are displayed 2 Click Add to add a new host name Up to four IP addresses can be added 3 For each IP address enter the fields Supported IP Format Select whether the IPv4 or IPv6 format...

Page 241: ...s Enter the host name to be associated with the IP address entered below IP Address Enter the IP address of the domain Four addresses can be entered 4 Click Remove to delete a host name All addresses for this host name are deleted at the same time Mapping IP Addresses to Domain Host Names Using the CLI Commands The following table summarizes the CLI commands for mapping domain host names to IP add...

Page 242: ...ARP converts IP addresses into physical MAC addresses ARP enables a host to communicate with other hosts when their IP addresses are known To add an IP MAC address mapping 1 Click System IP Addressing ARP in the tree view to display the ARP Summary page Figure 9 27 ARP Summary console config ip host accounting abc com 176 10 23 1 ...

Page 243: ...leared Dynamic Only learned ARP entries are cleared Static Only static ARP entries are cleared 3 To add a mapping click Add and enter the fields Interface Select an interface to be associated with the addresses IP Address Enter the station IP address which is associated with the MAC address filled in below MAC Address Enter the station MAC address which is associated in the ARP table with the IP a...

Page 244: ... arp timeout seconds Configures how long an entry remains in the ARP cache This command can be used in Global Configuration mode for all interfaces or in Interface Configuration mode for a specific interface clear arp cache Deletes all dynamic entries from the ARP cache show arp Displays entries in the ARP Table show arp configuration Displays the global and interface configuration of the ARP prot...

Page 245: ...e switch can relay specific UDP Broadcast packets received from its IPv4 interfaces to specific destination IP addresses To configure the relaying of UDP packets received from a specific IPv4 interface with a destination UDP port 1 Click System IP Addressing UDP Relay in the tree view to display the UDP Relay Summary page Figure 9 28 UDP Relay Summary ...

Page 246: ...t Services are not selected check the text box and enter a UDP port Destination IP Address Enter the IP address that receives the UDP packet relays If this field is 0 0 0 0 UDP packets are discarded If this field is 255 255 255 255 UDP packets are flooded to all IP interfaces Configuring UDP Relay Using the CLI Commands The following table summarizes the CLI commands for setting fields displayed i...

Page 247: ...x Systems User Guide 247 The following is an example of the CLI commands console config ip helper address all 172 16 9 9 49 53 console config do show ip helper address Interface Helper Address UDP Ports All 172 16 9 9 49 53 ...

Page 248: ...Connect 55xx Systems User Guide Diagnostics This section describes how to perform cable tests on copper and fiber optic cables It contains the following sections Integrated Cable Test Optical Transceiver Diagnostics ...

Page 249: ...exception of Approximated Cable Length test This test can only be performed when the port is up and operating at 1 Gbps To perform a cable test and view the results 1 Click System Diagnostics Integrated Cable Test Summary in the tree view to display the Integrated Cable Test Summary page Figure 9 29 Integrated Cable Test Summary 2 Select a unit in the stack in the Unit ID field Results from previo...

Page 250: ...rt where the cable error occurred Last Update Displays the last time the port was tested Approximate Cable Length Displays the approximate cable length Performing Integrated Cable Tests Using CLI Commands The following table contains the CLI commands for performing integrated cable tests Table 9 38 Integrated Cable Test CLI Commands CLI Command Description test cable diagnostics tdr interface giga...

Page 251: ...that do not support the digital diagnostic monitoring standard SFF 8472 The following is the list of the compatible SFPs SFP X3366 1000Base SX Finisar FTLF8519P2BNL U3650 1000Base LX Finisar FTRJ1319P1BTL SFP N743D SR Finisar FTLX8571D3BCL T307D LR Finisar FTLX1471D3BCL C043H LRM Avago AFBR 707SDZ D1 N198M LRM Finisar FTLX1371D3BCL console enable console test cable diagnostics tdr gi1 0 3 Cable is...

Page 252: ... unit Port The port number on which the cable was tested Temperature The temperature C at which the cable is operating Voltage The voltage at which the cable is operating Current The current at which the cable is operating Output Power The rate at which output power is transmitted Input Power The rate at which input power is transmitted Transmitter Fault A fault occurred during transmission Loss o...

Page 253: ... command Table 9 39 Fiber Optic Cable Test CLI Commands CLI Command Description show fiber ports optical transceiver interface gigabitethernet tengigabitethe rnet port number detailed Displays the optical transceiver diagnostics console show fiber ports optical transceiver detailed Port Temp C Voltage Current aM Output mWat Input mWa POWER mWa LOS gi1 0 1 48 5 15 50 1 789 1 789 No No gi1 0 2 43 5 ...

Page 254: ...n Active Users Local User Database Line Passwords Enable Password TACACS Password Management RADIUS Access Profiles Access to management functions may be limited to users identified by Ingress interface Port LAG or VLAN Source IP address Source IP subnet Management access may be separately defined for the following types of management access methods Telnet CLI over Telnet sessions Secure Telnet We...

Page 255: ...ic sources If you enable management access through a VLAN all ports and IP interfaces on that VLAN will be acceptable If specific IP address es are specified only traffic from the specified IP addresses on the appropriate ports will be accepted Access Profiles Rules Each management access profile is composed of at least one rule which acts as a filter and defines the device management method inter...

Page 256: ... Figure 9 31 Access Profiles Summary The currently defined access profiles are displayed 2 To activate an access profile select it in the Active Access Profile field If you select Console Only active management of the device can only be performed using the console connection This profile cannot be removed 3 To add a new profile click Add and enter the fields Access Profile Name 1 32 Characters Ent...

Page 257: ...P users Interface Check the fields and select the interface type to which the rule applies Enable Source IP Address Check this parameter to restrict access based on the source IP address When this field is not selected the source IP address cannot be entered into a configured rule Supported IP Format Select whether the IPv4 or IPv6 format is supported for the source IP addresses Source IP Address ...

Page 258: ...the rules are described in Defining Access Profile Rules Using CLI Commands on page 260 The following is an example of the CLI commands Table 9 40 Access Profile CLI Commands CLI Command Description management access list name no management access list name Defines an access list for management Use the no form of this command to delete an access list console config management access list mlist con...

Page 259: ...ment access profiles 1 Click System Management Security Profile Rules in the tree view to display the Profile Rules Summary page Figure 9 32 Profile Rules Summary 2 Select an access profile name Its rules are displayed in the order that they will be implemented 3 To add a rule to the selected management access profile click Add 4 Select a management access profile 5 Complete the fields that are de...

Page 260: ... Sets port permitting conditions for the management access list and the selected management method deny gigabitethernet tengigabitethe rnet port number vlan vlan id port channel LAG number service service Sets port denying conditions for the management access list and the selected management method deny ip source ipv4 address ipv6 address prefix length mask mask prefix length gigabitethernet tengi...

Page 261: ...l permit gi1 0 1 console config macl permit gi1 0 2 console config macl deny gi1 0 3 console config macl deny gi1 0 4 console config macl exit console config management access class mlist console config exit console show management access list mlist permit gi1 0 1 permit gi1 0 2 deny gi1 0 3 deny gi1 0 4 Note all other access implicitly denied console show management access class Management access...

Page 262: ...a the RADIUS server If an error occurs during the authentication the next selected method is used If an authentication method fails or the user has an insufficient privilege level the user is denied access to the switch The switch then stops does not continue and does not attempt to use the next authentication method If a privilege level is redefined the user must also be re defined User authentic...

Page 263: ...ed authentication profiles are displayed 2 Click Add to add a new authentication profile and enter the fields Profile Name 1 12 Characters Enter the name of the new authentication profile Profile names cannot include blank spaces Authentication Method Optional Methods Select a user authentication methods that can be assigned to this authentication profile The possible options are Line The line pas...

Page 264: ...ccurs Select a method by highlighting it in the Optional Methods list and clicking on the right arrow to move it to the Selected Methods list Configuring an Authentication Profile Using CLI Commands The following table summarizes the CLI commands for setting fields displayed in the Authentication Profiles pages The following is an example of the CLI commands Table 9 42 Authentication Profile CLI C...

Page 265: ...e 1 while Telnet users can be authenticated by Authentication Profile 2 To assign an authentication profile to a management access method 1 Click System Management Security Select Authentication in the tree view to display the Select Authentication page Figure 9 34 Select Authentication 2 For the Console Telnet and Secure Telnet SSH types of users select either the default authentication profile o...

Page 266: ...thentication enable default list name method method2 no aaa authentication enable default list name Indicates the authentication method list when accessing a higher privilege level from a remote Telnet Console or SSH enable authentication default list name no enable authentication Specifies the authentication method for accessing a higher privilege level from a remote Telnet or console Use the no ...

Page 267: ...defined The following is an example of the CLI commands that creates an authentication method list for http server access RADIUS and local console config line console console config line enable authentication default console config line login authentication default console config line exit console config ip http authentication aaa login authentication radius local console config exit ...

Page 268: ...anagement Security Active Users in the tree view to display the Active Users page Figure 9 35 Active Users The following fields are displayed for all active users Name Active users logged into the device Protocol The management method by which the user is connected to the device Location The user s IP address ...

Page 269: ...r viewing active users connected to the device The following example shows an example of the CLI command Table 9 44 Active Users CLI Commands CLI Command Description show users Displays information about active users console show users Username Protocol Location Bob Serial John SSH 172 16 0 1 Robert HTTP 172 16 0 8 Betty Telnet 172 16 1 7 ...

Page 270: ...urity Local User Database in the tree view to display the Local User Database Summary page Figure 9 36 Local User Database Summary All users are displayed even if they have been suspended If a user has been suspended it can be restored here by selecting the Reactivate Suspended User field 2 To add a user click Add and enter the fields User Name 1 20 characters Enter the username of the user ...

Page 271: ...ed out due to too many failed authentication attempts since the user last logged in successfully status Locked Reactivate Suspended User Check to reactivate the specified user s access rights Access rights can be suspended after unsuccessfully attempting to login Configuring Local Users Using CLI Commands The following table summarizes the CLI commands for configuring local users Table 9 45 Local ...

Page 272: ...lick System Management Security Line Passwords in the tree view to display the Line Password page Figure 9 37 Line Password 2 Enter the fields for each type of user separately Password 0 159 Characters Enter the line password for accessing the device Confirm Password Confirm the line password console config username bob password lee privilege 15 console set username bob active ...

Page 273: ...ocked Line Check to reactivate the line password for a Console Telnet Secure Telnet session Access rights can be suspended after a number of unsuccessful attempts to log in Assigning Line Passwords Using CLI Commands The following table summarizes the CLI commands for setting fields displayed in the Line Password page The following is an example of the CLI commands Table 9 46 Line Password CLI Com...

Page 274: ...ble Password page Figure 9 38 Enable Password 2 Enter the fields Select Enable Access Level Select the access level to associate with the enable password The lowest user access level is 1 and 15 is the highest user access level Users with access level 15 are Privileged Users and only they can access and use the OpenManage Switch Administrator Password 0 159 characters Enter the enable password Con...

Page 275: ...d page The following is an example of the CLI commands TACACS The device can act as a Terminal Access Controller Access Control System TACACS client TACACS provides centralized validation of users accessing the device while still retaining consistency with RADIUS and other authentication processes TACACS provides the following services Authentication Provides authentication during login and via us...

Page 276: ...CACS Summary The list of currently defined TACACS servers is displayed The parameters for each server is displayed along with its connection status 2 Enter the default parameters for TACACS servers These values are used unless values are added in the TACACS Add or Edit pages Source IP Address The device IP address used for the TACACS session between the device and the TACACS server The default is ...

Page 277: ...ields on the page The fields below are those that were not described on the TACACS Summary page Host IP Address Enter the TACACS server IP address Priority 0 65535 Enter the order in which the TACACS servers are used if several are defined Source IP Address Enter either specific device IP address for the TACACS server Authentication Port 0 65535 Enter the port number through which the TACACS sessi...

Page 278: ...cacs server host ip address hostname Configures a TACACS host Use the no form of this command to delete the specified TACACS host tacacs server key key string no tacacs server key Specifies the authentication and encryption key for all TACACS communications between the device and the TACACS server Use the no form of this command to disable the key tacacs server timeout timeout no tacacs server tim...

Page 279: ...ing Prevention of frequent password reuse Lockout of users after failed login attempts Number of repeated characters allowed Number of different character classes required in the password Numeric alphabetic and special characters are all character classes console config tacacs server source ip 172 16 8 1 console show tacacs Device Configuration IP Address Status Port Single TimeOut Source IP Prior...

Page 280: ...expiration the device displays a password expiration warning message After the password has expired users can log in a few additional times During the remaining logins an additional warning message displays informing the user that the password must be changed If the password is not changed users are locked out of the system and can only log in using the console Password warnings are logged in the ...

Page 281: ... required fields and enter their values Enable Strong Passwords Check to enable this feature Number of Classes Select a number of character classes The character classes are upper case characters lower case characters digits and punctuation The number of character classes selected indicates how many different types of characters must be in the password Repeated Characters Select the number of perm...

Page 282: ...ust be changed before the password can be reused Select the number of times Password History Hold Time 1 365 When checked the password history will be deleted after the number of days entered Enter the number of days Password Management Using CLI Commands The following table summarizes the CLI commands for setting fields displayed in the Password Management page Table 9 49 Password Management CLI ...

Page 283: ...eused password history hold time days no password history hold time Configures the duration that a password is relevant for tracking passwords history Use the no form of this command to return to the default configuration password lockout number no password lockout Defines the number of times a faulty password is entered before the user is locked out of the device Use the no form of this command t...

Page 284: ... Shell Access Web Access Console Access console config passwords strength minimum character classes 3 Enable that passwords must contain at least three character classes password min length 8 Enable that passwords must contain at least eight characters console config username admin privilege 15 password FGH123 Create a user named admin with privilege level 15 and password that fits the strength ru...

Page 285: ...smitted requests sent to RADIUS server before a failure occurs Default Timeout for Reply 1 30 The default amount of the time in seconds that the device waits for an answer from the RADIUS server before timing out Default Dead time 0 2000 The default amount of time in minutes that a RADIUS server is bypassed for service requests Default Key String 0 128 Characters The Default Key string used for au...

Page 286: ...ou do not want this server to be used for accounting purposes Usage Type Enter the RADIUS server usage The possible options are Login Used for login authentication and or accounting 802 1x Used for 802 1x authentication and or accounting All Used for all types of authentication and or accounting 4 Enter the following fields if you do not want to use the default values entered in the RADIUS Summary...

Page 287: ...deadtime key key string source ipv4 address ipv6 address priority priority usage login 802 1x all no radius server host ipv4 address ipv6 address hostname Specifies a RADIUS server host Use the no form of the command to delete the specified RADIUS server host radius server timeout timeout no radius server timeout Sets the interval for which a device waits for a server host to reply Use the no form...

Page 288: ...ist of RADIUS server hosts Use the no form of this command to restore the default configuration radius server deadtime deadtime no radius server deadtime Configures unavailable servers to be skipped Use the no form of this command to restore the default configuration radius server key key string no radius server key Sets the authentication and encryption key for all RADIUS communications between t...

Page 289: ...ervers IP address Port Port Time Ret Dead Source IP Prio Usage Auth Acct Out rans Time 1 1 1 11 1812 1813 Global Global Global Global 10 all 1 1 1 21 1812 1813 Global Global Global Global 19 all 1 1 1 31 1812 1813 Global Global Global Global 18 all 1 1 1 41 1812 1813 Global Global Global Global 17 all 1 1 1 51 1812 1813 Global Global Global Global 16 all Global values TimeOut 3 Retransmit 3 Deadti...

Page 290: ...server uses a defined pool of IP addresses user defined from which it allocates IP addresses to DHCP clients The DHCP server can allocate IP addresses in the following modes Static Allocation The hardware address of a host is manually mapped to an IP address Permanent Allocation An IP address sent to the client through a standard request reply mechanism is owned by that client permanently unless c...

Page 291: ...dress in the address pool before assigning that IP address to a requesting client If the ping is unanswered the DHCP server assumes that the address is not in use and assigns the address to the client To configure the device as a DHCP server 1 Click System DHCP Server DHCP Server Properties in the tree view to display the DHCP Server Properties page Figure 9 42 DHCP Server Properties ...

Page 292: ...efining DHCP Server Using CLI Commands The following table summarizes the CLI commands for defining the switch as a DHCP server Table 9 52 DHCP Server CLI Commands CLI Command Description ip dhcp server no ip dhcp server Enables the DHCP server feature on the device Use the no form of this command to disable the DHCP server feature ip dhcp ping enable no ip dhcp ping enable Enables the DHCP server...

Page 293: ...nds no ip dhcp ping timeout Specifies the time interval during which a DHCP server waits for a ping reply from an address pool Use the no form of this command to restore default values console config ip dhcp ping enable console config ip dhcp ping count 5 Table 9 52 DHCP Server CLI Commands Continued CLI Command Description ...

Page 294: ...lease duration To create a pool of IP addresses and define their lease durations 1 Click System DHCP Server Network Pool in the tree view to display the Network Pool Summary page Figure 9 43 Network Pool Summary The previously defined network pools are displayed 2 Click Add to define a new network pool and enter the fields Pool Name Enter the pool name Subnet IP Address Enter the subnet in which t...

Page 295: ...lert Days The duration of the lease in number of days The range is 0 to 49710 days Hours The number of hours in the lease A days value must be supplied before an hours value can be added Minutes The number of minutes in the lease A days value and an hours value must be added before a minutes value can be added Infinite The duration of the lease is unlimited Default Router Enter the default router ...

Page 296: ...lt SNTP Server Enter the IP address of the time server for the DHCP client Next Server Enter the IP address of the next server in the boot process of a DHCP client If the next server in the boot process is not configured the DHCP server uses inbound interface helper addresses as boot servers Next Server Name Enter the name of the next server in the boot process Image File Name Enter the name of th...

Page 297: ...fault router list dns server ip address ip address2 ip address8 no dns server Configures the DNS IP servers available to a DHCP client Use the no form of this command to remove the DNS server list domain name domain no domain name Specifies the domain name for a DHCP client Use the no form of this command to remove the domain name netbios name server ip address ip address2 ip address8 no netbios n...

Page 298: ...erver next server name name no next server name Configures the next server name in the boot process of a DHCP client Use the no form of this command to remove the boot server name bootfile filename no bootfile Specifies the default boot image file name for a DHCP client Use the no form of this command to delete the boot image file name show ip dhcp pool network name Displays the DHCP network pool ...

Page 299: ...can be excluded To define an excluded address range 1 Click System DHCP Server Excluded Addresses in the tree view to display the Excluded Addresses Summary page Figure 9 44 Excluded Addresses Summary The previously defined excluded IP addresses are displayed 2 To add a range of IP addresses to be excluded click Add and enter the fields Start IP Address First IP address in the range of excluded IP...

Page 300: ...Description ip dhcp excluded address low address high address no ip dhcp excluded address low address high address Configures a DHCP address pool on a DHCP Server and enter DHCP Pool Configuration mode Use the no form of this command to remove the address pool show ip dhcp excluded addresses Displays the excluded addresses console config ip dhcp excluded address 172 16 1 100 172 16 1 199 console s...

Page 301: ...atic Hosts Summary page Figure 9 45 Static Hosts Summary The static hosts are displayed 2 To add a static host click Add and enter the fields Host Name Enter the host pool name which can be a string of symbols and an integer IP Address Enter the IP address that was statically assigned to the host Network Mask Enter the pool s network mask Prefix Length Enter the number of bits that comprise the ad...

Page 302: ...ent NetBIOS Node Type Select how to resolve the NetBIOS name Valid node types are Empty Default value Broadcast IP Broadcast messages are used to register and resolve NetBIOS names to IP addresses Peer to Peer Point to point communications with a NetBIOS name server are used to register and resolve computer names to IP addresses Mixed A combination of b node and p node communications is used to re...

Page 303: ...hat are common to the Network Pool pages but are used in the context DHCP Pool Host context Table 9 55 Defining Static Hosts Using CLI Commands CLI Command Description ip dhcp pool host no ip dhcp pool host Configures a DHCP static address on a DHCP Server and enters the DHCP Pool Host Configuration mode Use the no form of this command to remove the address pool ip host name address address2 addre...

Page 304: ...ion console config dhcp ip host accounting website com 176 10 23 1 console show hosts System Name Default domain Domain name is not configured Name address lookup is enable Name servers Preference order 1 1 1 1 1 1 1 2 1 1 1 3 1 1 1 4 1 1 1 5 Configured host name to address mapping Host IP Address accounting website com 176 10 23 1 ...

Page 305: ...ge Figure 9 46 Address Binding The following fields for the address bindings are displayed IP Address The IP addresses of the client Client Identifier MAC Address A unique identification of the client specified as a MAC Address or in dotted hexadecimal notation e g 01b6 0819 6811 72 Lease Expiration The lease expiration date and time of the host s IP address Type The manner in which the IP address...

Page 306: ...e client permanently unless changes in the network environment connections take place for any reason Dynamic The IP address obtained dynamically from the switch is owned by the client for a specified period of time The IP address is revoked at the end of this period at which time the client must request another IP address ...

Page 307: ... list of variables that are used to manage the switch These variables are stored in the Management Information Base MIB from which they may be presented The SNMP agent defines the MIB specification format as well as the format used to access the information over the network Access rights to the SNMP agents are controlled by access strings SNMPv1 and v2 are enabled by default SNMP v3 In addition to...

Page 308: ...l USM SNMPv3 can only be enabled if the Local Engine ID is enabled SNMP Access Rights Access rights in SNMP are managed in the following ways SNMPv1 and SNMPv2 Communities The community name is a password sent by the SNMP management station to the device for authentication purposes A community string is transmitted along with the SNMPv1 v2 frames but neither the frames nor the community string are...

Page 309: ...lowing are the switch model Object IDs OIDs SNMP Global Settings The Engine ID is used by SNMPv3 entities to uniquely identify themselves An SNMP agent is considered an authoritative SNMP engine This means that the agent responds to incoming messages Get GetNext GetBulk Set and sends Trap messages to a manager The agent s local information is encapsulated in fields in the message Each SNMP agent m...

Page 310: ...Parameters The global parameters are displayed 2 Enter the fields Local Engine ID 10 64 Hex Characters Check and enter the local device engine ID The field value is a hexadecimal string Each byte in hexadecimal character strings is two hexadecimal digits Each byte can be separated by a period or a colon The Engine ID must be defined before SNMPv3 is enabled For stacked devices verify that the Engi...

Page 311: ...rs Using CLI Commands The following table summarizes the CLI commands for setting fields in the Global Parameters page Table 9 56 SNMP Global Parameters Commands CLI Command Description snmp server engine ID local engine id string default no snmp server engine ID local Specifies the local device engine ID The field values is a hexadecimal string Each byte in hexadecimal character strings is two he...

Page 312: ...d from the view being defined snmp server trap authentication no snmp server trap authentication Enables the router to send Simple Network Management Protocol traps when authentication fails Use the no form of this command to disable SNMP failed authentication traps show snmp Checks the status of SNMP communications console config snmp server enable traps console config snmp server trap authentica...

Page 313: ...2 Select a view name Its subtrees are displayed 3 To remove a subtree from an SNMP view click Remove The subtrees of the default views Default DefaultSuper cannot be changed 4 To add a new view click Add and enter a new View Name 1 30 Characters 5 To complete the definition of the view click Edit and select a View Name to modify Enter the fields New Object ID Subtree Check to specify the device fe...

Page 314: ...ges The following is an example of CLI commands Table 9 57 SNMP View CLI Commands CLI Command Description snmp server view view name oid tree included excluded no snmp server view view name oid tree Creates or updates a SNMP server view entry Use the no form of this command to remove an SNMP server view entry show snmp views viewname Displays the configuration of a view or all views console config...

Page 315: ...n the User Security Model pages Groups can be defined in any version of SNMP but only SNMPv3 groups can be assigned authentication methods To add an SNMP group and assign it access control privileges 1 Click System SNMP Access Control in the tree view to display the Access Control Summary page Figure 9 49 Access Control Summary Previously defined groups are displayed 2 To add a new group click Add...

Page 316: ...own list Write The management access is read write and changes can be made to the assigned SNMP view If desired select a view from the drop down list Notify Sends traps for the assigned SNMP view If desired select a view from the drop down list Defining SNMP Access Control Using CLI Commands The following table summarizes the CLI commands for defining fields displayed in the Access Control pages T...

Page 317: ... attributes of its group and can then access the views permitted to this group A user can only be a member of a single group Before you create an SNMPv3 user create an SNMPv3 group in the Access Control pages When the configuration file is saved SNMP communities users are not saved This means that if you configure another device with this configuration file you must define the SNMP communities use...

Page 318: ...nd their groups are displayed 2 To add a user click Add and enter the fields User Name 1 30 Characters Enter a new user name Engine ID Specifies the local or remote SNMP entity to which the user is connected Changing or removing the local SNMP Engine ID deletes the SNMPv3 User Database Select either Local or Remote If Remote is selected enter the remote engine ID Group Name Select from a list of u...

Page 319: ...D5 16 SHA 20 Hex Characters If the MD5 Key or SHA Key authentication method was selected enter the HMAC MD5 96 or HMAC SHA 96 keys The authentication and privacy keys are entered to define the authentication key If only authentication is required 16 bytes are defined for MD5 If both privacy and authentication are required 32 bytes are defined for MD5 Each byte in hexadecimal character strings is t...

Page 320: ...IB objects using a view Views are defined in the Views Setting pages Advanced Table Access rights to a community are assigned to a group that consists of users A group can have Read Write and Notify access to views Groups are defined in the Access Control pages Table 9 59 SNMP Users CLI Commands CLI Command Description snmp server user username groupname v1 v2c remote host v3 encrypted auth md5 sh...

Page 321: ...displayed 2 To add a new community click Add 3 Define the SNMP management station by entering its IP address information Supported IP Format Select whether the IPv4 or IPv6 format is being used IPv6 Address Type When the community supports IPv6 this specifies the type of static address supported The possible options are Link Local A Link Local address that is non routable and used for communicatio...

Page 322: ...cess mode and views directly with the community enter the fields Basic Check to enable SNMP Basic mode for a selected community Access Mode If Basic is selected specify the access rights of the community The possible options are Read Only Management access is restricted to read only and changes cannot be made to the community Read Write Management access is read write and changes can be made to th...

Page 323: ...tification of management trap targets Trap filtering Table 9 60 SNMP Community CLI Commands CLI Command Description snmp server community community view view name ro rw su ipv4 address ipv6 address mask mask value prefix length prefix value type router oob Sets up the community access string to permit access to the SNMP protocol Use the no form of this command to remove the specified community str...

Page 324: ...ts pages To add a notification filter 1 Click System SNMP Notification Filters in the tree view to display the Notification Filter Summary page Figure 9 52 Notification Filter Summary 2 The OIDs of the selected filter are displayed 3 If required the notification filter type can be changed by selecting one of the following options Excluded OID traps or informs will not be sent Included OID traps or...

Page 325: ... Specify the device feature OID Filter Type Select whether the defined OID branch will be Included or Excluded in the selected SNMP view Configuring Notification Filters Using CLI Commands The following table summarizes CLI commands for defining fields displayed in the Notification Filter pages Table 9 61 SNMP Notification Filter CLI Commands CLI Command Description snmp server filter filter name ...

Page 326: ... nodes to which trap messages are sent by the switch A trap receiver entry contains the IP address of the node and the SNMP credentials corresponding to the version that will be included in the trap message When an event arises that requires a trap message to be sent it is sent to every node listed in the trap receiver list Some messages are of an informational nature and are called informs instea...

Page 327: ...d notification recipients are displayed 2 To add a new notification recipient click Add and enter the fields Supported IP Format Select whether the IPv4 or IPv6 format is supported IPv6 Address Type When the recipient supports IPv6 this specifies the type of static address supported The possible options are Link Local A Link Local address that is non routable and used for communication on the same...

Page 328: ...manager Notification Version The message trap SNMP version v1 or v2 If SNMPv3 is used to send and receive traps enter the fields User Name The user to whom SNMP notifications are sent Security Level The means by which the packet is authenticated The possible options are No Authentication The packet is neither authenticated nor encrypted Authentication The packet is authenticated Privacy The packet...

Page 329: ...priv community string udp port port filter filtername timeout seconds retries retries no snmp server host ipv4 address ipv6 address hostname traps informs version 1 2c 3 Creates or updates a notification recipient receiving notifications in SNMP version 1 2 or 3 Use the no form of this command to remove the specified host show snmp Shows the current SNMP configuration console config snmp server ho...

Page 330: ... at startup or after reboot The Startup Configuration file is created from the Running Configuration file or can be created from another file Running Configuration File Files with extension text These files contain all Startup Configuration file commands as well as all commands entered during the current session After the device is powered down or rebooted all commands stored in the Running Config...

Page 331: ...e This can be done in one of the following ways Manually System files can be downloaded using the File Download page and uploaded using the File Upload page Automatically Auto Update Configuration System files can be downloaded automatically as follows Auto Configuration If the Auto Configure feature is enabled in the Auto Update of Configuration Image File page the Startup Configuration file in v...

Page 332: ...n to placing configuration and image files on the USB key the USB key might also contain a setup file which is a file with a setup extension Setup File Contents A setup file contains one or more lines Each line contains some or all of the following fields MAC Address This indicates to which device the line applies In this way a single setup file can be used for multiple devices New IP Address The ...

Page 333: ...0 255 255 255 0 switch X text pc5500 4018 ros This means that the line applies to the device with MAC address 0080 c200 0010 a new IP address of 192 168 0 10 is to be assigned to the device with mask 255 255 255 0 The switch x text is the Startup Configuration file and pc5500 4018 ros is the new image file 0080 c200 0010 192 168 0 10 255 255 255 0 switch X text pc5500 4018 ros in use This line wil...

Page 334: ...k Configuration File Name Image File Name Flag Example 192 168 0 10 255 255 255 0 switch text pc5500 4018 ros This means that the line applies to any device no MAC address is supplied a new IP address of 192 168 0 10 is to be assigned to the device with mask 255 255 255 0 The switch x text is the Startup Configuration file and pc5500 4018 ros is the new image file Format D Contains the following 3...

Page 335: ...and or the Startup Configuration file is empty See Performing Auto Update from a USB Drive on page 336 The Auto Update from a TFTP server is triggered if the following conditions are fulfilled The conditions for a USB Auto Update are not fulfilled An IP address of a TFTP server is received from a DHCP server A file name is received from DHCP server The Auto Configuration from a TFTP server is trig...

Page 336: ...interface There is a VLAN without an IP address Preparations for Using Auto Update Configuration from a USB Drive Before Auto Update Configuration from a USB drive can be performed the following steps must be performed 1 Enable Auto Update Configuration in the Auto Update of Configuration Image File page 2 Optional Create a line in the setup file for this device containing the required options and...

Page 337: ...ic device was found the setup file is searched for valid lines with formats C or D The first line found is applied 3 Apply the correct line When the correct line in the setup file is found it is applied as follows If the line contains an IP address and IP mask the IP address is configured on the default VLAN If the line contains an image file and its version differs from the current image file ver...

Page 338: ... Auto Configuration One File Read Method on page 338 This method is used if a configuration file is found on the TFTP server Multi file Read described in Auto Configuration Multi File Read Method on page 339 This method is used if a configuration file name is not found on the DHCP server or the configuration file is not found on the TFTP server Auto Configuration One File Read Method This method r...

Page 339: ...file The following steps are performed by the switch The switch gets the hostname as described below If the hostname was provided by the DHCP server this hostname is used If the hostname has not been provided by a DHCP server and if the user has configured the sysName variable its value is used as a hostname If neither of the above occurred the switch uses the fp net cfg Filename List on the TFTP ...

Page 340: ...ain directory Place a software image file in it Create an indirect file that contains a path and the name of the software version for example indirect contax txt that contains contax contax version ros Copy this file to the TFTP server s main directory DHCP Server Configure the DHCP server with option 20 or 66 This is the IP address of the TFTP server Configure the DHCP server with option 125 Ente...

Page 341: ...he startup configuration needs to include a DHCP IP interface The device is defined as a DHCP client as described in DHCP IPv4 Interface on page 207 After reboot this command is not saved in the Startup configuration Preparations described above must be completed on the DHCP server and TFTP servers 1 Click System File Management Auto Update of Configuration Image File in the tree view to display t...

Page 342: ...t empty Auto Copy Running Configuration to Startup Configuration After Download boot host auto save Enable disable the Running Configuration file to be automatically copied to the Startup Configuration file after downloading the Running Configuration file Auto Update Configuration Using CLI Commands The following table summarizes the CLI commands for setting fields displayed in the Auto Update of ...

Page 343: ...e to the default boot host auto save no boot host auto save Enables automatic saving of Running configuration in Startup configuration after download Use the no form of this command restore default behavior show boot Shows the status of the IP DHCP Auto Config process console show boot Auto Config Config Download via DHCP enabled Next Boot Config Download via DHCP force Auto Update Image Download ...

Page 344: ...HCP_CL W DHCPIPCANDIDATE The device is waiting for IP address verification on interface Vlan 1 IP 10 5 225 47 mask 255 255 255 224 DHCP server 10 5 224 25 01 Oct 2006 15 20 03 BOOTP_DHCP_CL I DHCPCONFIGURED The device has been configured on interface Vlan 1 IP 10 5 225 47 mask 255 255 255 224 DHCP server 10 5 224 25 01 Oct 2006 15 20 03 COPY I FILECPY Files Copy source URL tftp 10 5 224 4 33 txt d...

Page 345: ...ed IPv6 Address Type When the server supports IPv6 this specifies the type of static address supported The possible options are Link Local A Link Local address that is non routable and used for communication on the same network only Global A globally unique IPv6 address visible and reachable from different subnets Link Local Interface When the server supports an IPv6 Link Local address this specif...

Page 346: ...tive image after reset and then to reset the device following the download During the Image file download a dialog box opens that displays the download progress and browsing is disabled Boot Code Downloads the Boot file 6 If the Configuration Download option was selected enter the following Server IP Address Enter the IP address of the server Source File Name 1 64 Characters Enter the source file ...

Page 347: ... fields for the TFTP server IP address Supported IP Format Select whether IPv4 or IPv6 format is supported IPv6 Address Type When the server supports IPv6 this specifies the type of static address supported The possible options are Link Local A Link Local address that is non routable and used for communication on the same network only Global A globally unique IPv6 address visible and reachable fro...

Page 348: ...he server from which the firmware file is downloaded Source File Name 1 64 characters The file to be downloaded Destination File Type The destination file type to which the file is downloaded The possible options are Software Image Downloads the Image file The image file overwrites the non active image It is recommended to designate that the non active image becomes the active image after reset an...

Page 349: ...ading Files Using CLI Commands The following table summarizes the CLI commands for setting fields displayed in the File Download page The following is an example of the CLI command NOTE Each exclamation mark indicates that ten packets were successfully transferred File Upload Software and configuration files can be uploaded to an external device To upload from a USB port or when management compute...

Page 350: ...ile Upload 2 Configuration Upload is selected automatically 3 Select to upload a configuration file when the management computer is using HTTP or from a USB port in Download Protocol 4 Enter the fields Transfer File Name The configuration file to which the configuration is uploaded The possible options are Running Configuration Uploads the Running Configuration file Startup Configuration Uploads t...

Page 351: ...t fields for the TFTP server IP address Supported IP Format Select whether IPv4 or IPv6 format is supported IPv6 Address Type When the server supports IPv6 this specifies the type of static address supported The possible options are Link Local A Link Local address that is non routable and used for communication on the same network only Global A globally unique IPv6 address visible and reachable fr...

Page 352: ...acters The file name to which the file is uploaded 6 If Configuration Upload was selected enter TFTP Server IP Address The TFTP server IP address to which the configuration file is uploaded Destination File Name 1 64 Characters The configuration file name path to which the file is uploaded Transfer File Name The configuration file that is uploaded The possible options are Running Configuration Upl...

Page 353: ...Upload page The following is an example of the CLI commands Table 9 65 File Upload CLI Commands CLI Command Description copy source url destination url Copies any file from a source to a destination console copy image tftp 10 6 6 64 uploaded ros Copy 4234656 bytes copied in 00 00 33 hh mm ss 01 Jan 2000 07 30 42 COPY W TRAP The copy operation was completed successfully ...

Page 354: ...mage The switch boots from the active image You can switch the inactive image to the active image and then reboot the switch The active image file for each unit in the stack can be individually selected To select the image file to be used after reset 1 Click System File Management Active Images in the tree view to display the Active Images page Figure 9 59 Active Images The following fields are di...

Page 355: ... the Active Images The following is an example of the CLI commands Copy Files Firmware and configuration files can be copied between units in the stack Use the Copy Files page to perform the following Copy the firmware on the Master unit to another unit in the stack Copy the master Running Configuration file to the master sTartup Configuration file or copy the configuration to a user defined confi...

Page 356: ...for example when trying to create a VLAN that is already defined on the system Restore configuration factory defaults To copy files 1 Click System File Management Copy Files in the tree view to display the Copy Files page Figure 9 60 Copy Files 2 To copy the firmware from the Master unit to the Backup Master unit or to all other units select Copy Master Firmware and select the options Source Selec...

Page 357: ...tion file or New File Name 1 64 characters To copy the source file to a user named file enter the name of a file If this option is selected check where the file is stored Flash or USB 4 Select Restore Configuration Factory Defaults to replace the current configuration settings by the factory configuration default settings 5 Click Activate to initiate the selected process Copying Files Using CLI Co...

Page 358: ...006 16 10 51 FILE I DELETE File Delete file URL flash startup config console copy running config startup config Overwrite file startup config Yes press any key for no 01 Oct 2006 16 11 47 COPY I FILECPY Files Copy source URL running config destination URL flash startup config 01 Oct 2006 16 12 01 COPY N TRAP The copy operation was completed successfully Copy succeeded ...

Page 359: ...tions and file permissions The files system permits managing up to two user defined backup configuration files To view information about files 1 Click System File Management File System in the tree view to display the File System page Figure 9 61 File System 2 Select the File Location The possible options are Flash Files in flash memory are displayed USB Files on the USB device are displayed ...

Page 360: ...able when selecting USB 4 To rename a file click its Rename button Change the File Name Managing Files Using CLI Commands The following table summarizes the CLI command for viewing system files The following is an example of the CLI commands Table 9 68 File Management CLI Command CLI Command Description dir flash usb Display list of files on a flash file system rename url new url Renames a file de...

Page 361: ... without regard to the stack topology or the number of units in the stack can be managed as a single switch For more information about stacking see Stacking Overview on page 43 The stacking pages described in this section enable the following actions Switching from the Master unit to the Backup Master unit Changing unit IDs Viewing hardware and software versions on each unit Resetting either a uni...

Page 362: ...gement Stack Unit ID in the tree view to display the Stack Unit ID page Figure 9 62 Stack Unit ID 2 Enter the fields Switch Stack Control from Unit 1 to Unit 2 Check this field to make unit 2 the Master unit Unit ID After Reset Select Auto if you want the system to assign the unit ID after reset Select a number to assign the unit an ID manually ...

Page 363: ...llowing is an example of the CLI commands Table 9 69 Stack Unit ID CLI Commands CLI Command Description stack master unit no stack master Makes the unit specified be the Master unit Use the no version to restore the default Master unit switch current unit number renumber new unit number Changes the unit ID of a specific unit console config stack master unit 2 console config switch 3 renumber 6 ...

Page 364: ... Versions in the tree view to display the Versions page Figure 9 63 Versions The following fields are displayed Unit ID The unit number for which the device versions are displayed Software Version The current software version running on the device Boot Version The current Boot version running on the device Hardware Version The current device hardware version ...

Page 365: ...the stack 1 If changes were made to the Running Configuration file save them to the Startup Configuration file before resetting the device This prevents the current device configuration from being lost For more information about saving Configuration files see Copy Files on page 355 Table 9 70 Versions CLI Commands CLI Command Description show version unit id Displays system version information for...

Page 366: ...nit ID field select either the unit ID to be reset or Stack to reset all the units in the stack Resetting the Device Using the CLI The following table summarizes the CLI commands for performing a reset of the device via the CLI Table 9 71 Reset CLI Command CLI Command Description reload slot unit Reloads the operating system of a single unit or of all the units ...

Page 367: ...deed all the units in a stack To light up the Location LED 1 Click System Stack Management Unit Identification in the tree view to display the Unit Identification page Figure 9 65 Unit Identification console reload You haven t saved your changes Are you sure you want to continue Y N N Y This command will reset the whole system and disconnect your current session Do you want to continue Y N N ...

Page 368: ...l The Location and Power LED light up for this period of time Setting the Location LED Using the CLI The following table summarizes the CLI commands for setting the Location LED The following is an example of the CLI command Table 9 72 Location LED CLI Commands CLI Command Description system light unit unit number duration seconds system light stop Lights the location LED on a spe cific unit Use t...

Page 369: ...dded in a switch or router or in a stand alone probe and a central data collector known as the sFlow receiver The sFlow agent uses sampling technology to capture traffic and statistics from the device it is monitoring sFlow datagrams are used to forward the sampled traffic and statistics to an sFlow receiver for analysis sFlow V5 defines How traffic is monitored The sFlow MIB that controls the sFl...

Page 370: ...receiver also known as a collector for sFlow statistics Use the sFlow Receivers Settings page for this 2 Enable flow and or counter sampling direct the samples to a receiving interface and configure the average sampling rate Use the sFlow Interface Settings pages for this 3 View and clear the sFlow statistics counters Use the sFlow Statistics page for this ...

Page 371: ...ree view to display the sFlow Receivers Settings Summary page Figure 9 66 sFlow Receivers Settings Summary The sflow parameters are displayed 2 To add a receiver sflow analyzer click Add and select one of the pre defined sampling definition indices in Index 3 Enter the receiver s address fields Supported IP Format Select whether IPv4 or IPv6 format is supported ...

Page 372: ...TAP tunnel IP Address Enter the receiver s IP address 4 Enter the fields Syslog Port Number Port to which SYSLOG message are sent Maximum Header Size Bytes Maximum number of bytes that can be sent to the receiver in a single sample datagram frame Adding an sFlow Receiver Using the CLI Commands The following table summarizes the CLI commands for adding an sFlow receiver Table 9 73 sflow Receiver CL...

Page 373: ...ivers Index IP Address Port Max Datagram Size 1 0 0 0 0 6343 1400 2 172 16 1 2 6343 1400 3 0 0 0 0 6343 1400 4 0 0 0 0 6343 1400 5 0 0 0 0 6343 1400 6 0 0 0 0 6343 1400 7 0 0 0 0 6343 1400 8 0 0 0 0 6343 1400 Interfaces Interface Flow Counters Max Header Collector Index Sampling Sampling Interval Size Sampling Counters gi1 0 1 1 2048 60 sec 128 1 1 gi1 0 2 1 4096 Disabled 128 0 2 ...

Page 374: ...the port from which to collect the sFlow information 1 Click System sFlow sFlow Interface Settings in the tree view to display the sFlow Interface Settings Summary page Figure 9 67 sFlow Interface Settings Summary The sflow interface settings are displayed 2 To associate an sFlow receiver with a port click Add and enter the fields Interface Select the unit port from which information is collected ...

Page 375: ...one of the indices that was defined in the sFlow Receivers Settings pages Configuring sFlow Interfaces Using the CLI Commands The following table summarizes the CLI commands for configuring sFlow interfaces The following is an example of the CLI commands Table 9 74 sflow Interface CLI Commands CLI Command Description sflow flow sampling rate receiver index max header size bytes no sflow flow sampl...

Page 376: ...tree view to display the sFlow Statistics page Figure 9 68 sFlow Statistics The following sflow statistics per interface are displayed Interface Port for which sample was collected Packets Sampled Number of packets sampled Datagrams Sent to Receiver Number of sFlow sampling packets sent 2 Click Clear Statistics to clear the counters ...

Page 377: ...d CLI Command Description show sflow statistics port id Displays sFlow statistics for ports that are enabled for Flow sampling or Counters sampling clear sflow statistics port id Clears sFlow statistics for ports that are enabled for Flow sampling or Counters sampling console show sflow statistics Total sFlow datagrams sent to collectors 100 Interface Packets Sampled Datagrams Sent to Collector gi...

Page 378: ... 10 Ports This section describes how to configure port functionality It contains the following topics Overview Jumbo Frames Green Ethernet Configuration Protected Ports Port Profile Port Configuration LAG Configuration Storm Control Port Mirroring ...

Page 379: ...nnecting a Network Interface Card NIC that does not support auto negotiation or is not set to auto negotiation both the device switching port and the NIC must be manually set to the same speed and duplex mode If the station on the other side of the link attempts to auto negotiate with a device 100BaseT port that is configured to full duplex the auto negotiation results in the station attempting to...

Page 380: ... control on the device works in Receive Only mode meaning that the interfaces with enabled flow control receive PAUSE frames but do not send them When flow control is enabled the system buffers are allocated per port so that if the buffers of one port are consumed other ports will still have their free buffers Back Pressure The device supports back pressure for ports configured to Half Duplex mode...

Page 381: ...Dell PowerConnect 55xx Systems User Guide 381 Port tagging No tagging Flow Control On Back Pressure Off Table 10 1 Port Default Settings Continued Function Default Setting ...

Page 382: ...e of up to 1 632 bytes To enable jumbo frames 1 Click Switching Ports Jumbo Frames in the tree view to display the Jumbo Frames page Figure 10 1 Jumbo Frames The current jumbo frames setting is displayed 2 Enable disable jumbo frames in the New Setting after reset field NOTE You must save the configuration and reboot the device in order to make jumbo frames operational ...

Page 383: ...zes the CLI commands for configuring Jumbo frames The following is an example of the CLI commands Table 10 2 Jumbo Frames CLI Commands CLI Command Description port jumbo frame no port jumbo frame Enables jumbo frames on the device Use the no form of this command to disable jumbo frames console config port jumbo frame ...

Page 384: ...abled by default and is transparent to users This feature is defined per port regardless of their LAG membership Short Reach Mode Power usage is adjusted to the actual cable length In this mode the VCT Virtual Cable Tester length test is performed to measure cable length If the cable is shorter than a predetermined length the switch reduces the power used to send frames over the cable thus saving ...

Page 385: ...reen Ethernet Configuration Summary page Figure 10 2 Green Ethernet Configuration Summary 2 The amount of energy saved from the last switch reboot is displayed in the Cumulative Energy Saved field This value is updated each time there is an event that affects power saving Click Reset to reset its value 3 Enter the fields Energy Efficient Ethernet Globally enable disable the Energy Efficient Ethern...

Page 386: ...in the stack The following is displayed for each port on the unit Port Port number Oper Displays the operational status of Green Ethernet Resolved Tx Timer μsec Integer that indicates the current Tw_sys_tx is supported by the local system Local Tx Timer μsec Indicates the time in micro seconds that the transmitting link partner waits before it starts transmitting data after leaving Low Power Idle ...

Page 387: ...hort reach force Forces short reach mode on an interface Use the no form of this command to return to the default green ethernet short reach threshold cable length no green ethernet short reach threshold Set the maximum cable length for applying short reach mode Use the no form of this command to return to the default green ethernet power meter reset Resets the power save meter eee enable no eee e...

Page 388: ...a community It can send traffic to other protected ports in the same community and to uplink ports Uplink Port An uplink port is an unprotected port that can send traffic to any port Isolated Port A protected port that does not belong to a community Port Protection is independent of all other features and configuration settings Two protected ports in a common VLAN cannot communicate with each othe...

Page 389: ...ee view to display the Protected Ports Summary page Figure 10 3 Protected Ports Summary A summary of all the ports and their statuses is displayed 2 Click Edit 3 Select the unit and interface 4 Enter values for the following fields State Select Protected Unprotected to enable disable port protection Community Select the community to which to add the port or define the port as Isolated ...

Page 390: ...t Multicast and Broadcast traffic on a port at Layer 2 from other protected ports on the same switch Use the no form of this command to disable protection on the port switchport community community no switchport community Associates a protected port with a community Use the no form of this command to return to default show interfaces protected ports gigabitethernet tengiga bitethernet port number ...

Page 391: ...ndle configurations as a port profile and then apply it to one or more interfaces at a time Up to 20 user defined macros can be supported These can only be defined through CLI commands Built In Pre defined macros that cannot be changed or deleted The device includes the following built in macros Global Desktop Phone Switch Router Wireless Configuration Before a built in profile can be applied to a...

Page 392: ...Run Global Profile Apply the global profile before applying a built in interface profile 3 To assign a profile to an interface click Edit 4 Select a unit interface and a Assigned Profile The Profile Description is displayed 5 Each profile requires entering various elements of VLAN information Enter the fields according to the profile VLAN Port Mode Displays the port mode applied to ports in the pr...

Page 393: ...n Violation Action to be applied to packets arriving on a locked port The possible options are Discard Discard the packets from any unlearned source Forward Forward the packets from an unknown source without learning the MAC address Shutdown Discard the packet from any unlearned source and shut down the port Ports remain shutdown until they are reactivated or the device is reset Spanning Tree fiel...

Page 394: ...y placed in the Forwarding state when the port is up BPDU Guard Displays whether BPDU Guard is enabled on the port Miscellaneous fields Policy Name Displays the name of a policy if one is defined on the port Auto Negotiation Displays whether auto negotiation is enabled on the port Auto Negotiation enables a port to advertise its transmission rate duplex mode and Flow Control abilities to other dev...

Page 395: ...e macro name Displays the parameters for all configured macros or for one macro on the switch Switch config interface gi1 0 2 Switch config if macro trace dup Applying command duplex full Applying command speed auto Switch config interface gi1 0 2 Switch config if macro apply duplex DUPLEX full SPEED auto Switch config if exit Switch config interface gi1 0 3 Switch config if macro apply dup Switch...

Page 396: ...nd Description console config console config interface range gi1 0 1 24 Enter Interface mode for ports 1 24 on unit 1 console config if range macro name access_port Enter macro commands one per line End with the character Create a macro called access_port disable spanning tree Enter the commands in the macro disables spanning tree on the interfaces console config do show parser macro name access_p...

Page 397: ...he tree view to display the Port Configuration Summary page Figure 10 5 Port Configuration Summary All ports on the selected unit and their configuration settings are displayed 2 To modify the port settings click Edit and select a port 3 Enter the following fields Description 1 64 Characters Enter a user identification attached to the port Port Type Displays the type of port Admin Status Enable di...

Page 398: ... options You can designate Administrative Speed only when port auto negotiation is disabled Current Port Speed Displays the actual synchronized port speed bps Admin Duplex Select the port duplex mode this is only possible if Auto Negotiation is not enabled The options are Full The interface supports transmission between the device and the client in both directions simultaneously Half The interface...

Page 399: ... 10000 mbps speed port and full duplex mode setting Current Advertisement Displays the port advertises its speed to its neighbor port to start the negotiation process The possible field values are those specified in the Admin Advertisement field Neighbor Advertisement Displays the neighboring port s advertisement settings The field values are identical to the Admin Advertisement field values Back ...

Page 400: ...ches MDI Use for end stations Current MDI MDIX Displays the current device MDIX settings LAG Displays whether the port is part of a LAG Configuring Ports Using CLI Commands The following table summarizes the CLI commands for configuring ports as displayed in the Port Configuration pages Table 10 8 Port Configuration CLI Commands CLI Command Description eee enable no eee enable Enables the EEE mode...

Page 401: ... operation for the speed and duplex parameters of a given interface Use the no form of this command to disable auto negotiation back pressure no back pressure Enables Back Pressure on a given interface Use the no form of this command to disable back pressure flowcontrol auto on off no flowcontrol Configures the flow control on a given interface Use the no form of this command to disable flow contr...

Page 402: ...rface gi2 0 1 console config if description RD SW 3 console config if shutdown console config if no shutdown console config if speed 100 console config if duplex full console config if negotiation console config if back pressure console config if flowcontrol on console config if mdix auto console config if end console show interfaces configuration gi2 0 1 Flow Admin Back Mdix Port Type Duplex Spee...

Page 403: ...about Link Aggregated Groups LAGs and assigning ports to LAGs see Link Aggregation on page 500 To configure LAGs 1 Click Switching Ports LAG Configuration in the tree view to display the LAG Configuration Summary page Figure 10 6 LAG Configuration Summary The LAG parameters are displayed 2 To configure a LAG click Edit 3 Select the LAG and enter the fields LAG Mode Select the LAG mode The possible...

Page 404: ... at 10 Mbps 100M The LAG is currently operating at 100 Mbps 1000M The LAG is currently operating at 1000 Mbps 10000 Full The LAG is currently operating at 1000 Mbps Current Speed Displays the speed at which the LAG is currently operating Admin Auto Negotiation Enable disable auto negotiation which is a protocol between two link partners that enables a LAG to advertise its transmission rate duplex ...

Page 405: ...possible options are Enable Enables flow control on the LAG default Disable Disables flow control on the LAG Auto Negotiation Enables the auto negotiation of flow control on the LAG Current Flow Control Displays the current Flow Control setting Configuring LAGs Using CLI Commands The following table summarizes the CLI commands for configuring LAGs as displayed in the LAG Configuration pages Table ...

Page 406: ...nd to disable auto negotiation flowcontrol auto on off no flowcontrol Configures the flow control on a given LAG Use the no form of this command to disable flow control show interfaces configuration port channel LAG number Displays the configuration for the LAGs show interface advertise Displays the LAG s negotiation advertisement settings show interfaces status port channel LAG number Displays th...

Page 407: ...el 1 console config if no negotiation console config if speed 100 console config if flowcontrol on console config if exit console config interface port channel 2 console config if shutdown console config if exit console config if end console show interfaces port channel Channel Ports ch1 Inactive gi 1 0 11 13 ch2 Active gi 1 0 14 ...

Page 408: ...tential for a storm Storm protection provides the ability to limit the number of frames entering the switch and to define the types of frames that are counted towards this limit When a threshold limit is configured on the device the port discards traffic when that threshold is reached The port remains blocked until the traffic rate drops below this threshold It then resumes normal forwarding To co...

Page 409: ...ch unknown packets are forwarded Configuring Storm Control Using CLI Commands The following table summarizes the CLI commands for configuring Storm Control as displayed on the Storm Control pages Table 10 10 Storm Control CLI Commands CLI Command Description storm control include multicast unknown unicast no storm control include multicast Counts Multicast packets in the Broadcast storm control Us...

Page 410: ...trol configuration console config interface gi1 0 1 console config if storm control broadcast enable console config if storm control include multicast unknown unicast console show ports storm control gi1 0 1 Port State Rate Kbits Sec Included gi1 0 1 Disabled 8500 Broadcast Table 10 10 Storm Control CLI Commands Continued CLI Command Description ...

Page 411: ... traffic is silently discarded This may mean that the traffic actually seen by any device attached to the target port is an arbitrarily selected subset of the actual traffic going through the source ports Port mirroring is only relevant to physical ports Therefore if you want a LAG to function as the source of a port mirroring session the member ports must be individually specified as sources Up t...

Page 412: ...zer they should be transmitted as they are received on the ingress port However in the device the packet is transmitted out of the port analyzer as always tagged or always untagged user configurable regardless of the input encapsulation Source Port Restrictions The following restrictions apply to ports specified as source ports Source ports cannot be a member of a LAG Source ports cannot be config...

Page 413: ...ummary The previously defined source ports for the selected Destination Port are displayed along with the fields defined in the Add page and their status Status Indicates if the port is currently being monitored Active or not being monitored notReady because of some problem 2 To add a port to be mirrored click Add and enter the fields Source Port The port number from which port traffic is copied T...

Page 414: ...n port monitor src interface id rx tx no port monitor src interface id Starts a port monitoring session This must be performed in Interface Configuration mode which is the destination interface Use the no form of this command to stop a port monitoring session show ports monitor Displays the port monitoring status console config interface gi1 0 1 console config if port monitor gi1 0 8 console show ...

Page 415: ...Dell PowerConnect 55xx Systems User Guide 415 ...

Page 416: ... Dell PowerConnect 55xx Systems User Guide 11 Address Tables This section describes how MAC addresses are handled on the device It contains the following topics Overview Static Addresses Dynamic Addresses ...

Page 417: ...esses are dynamically learned when packets arrive at the device Addresses are associated with ports by learning the source address of the frame Frames addressed to a destination MAC address that is not associated with any port are flooded to all ports of the relevant VLAN In order to prevent the bridging table from overflowing dynamic MAC addresses from which no traffic is seen for a certain perio...

Page 418: ...ables Static Address Table in the tree view to display the Static Address Table Summary page Figure 11 1 Static Address Table A list of the currently defined static addresses is displayed 2 To add a static address click Add 3 Enter the following fields Interface Select a port or LAG for the entry MAC Address Enter the interface MAC address VLAN ID Check and select the VLAN ID for the port or VLAN ...

Page 419: ...s Using CLI Commands The following table summarizes the CLI commands for configuring static address parameters as displayed in the Static Address Table pages Table 11 1 Static Address CLI Commands CLI Command Description mac address table static mac address vlan vlan id interface gigabitethernet tengigabitethern et port number port channel LAG number permanent delete on reset delete on timeout sec...

Page 420: ...the CLI commands console config if bridge address 00 60 70 4C 73 FF permanent gi1 0 8 console show mac address table static Aging time is 300 sec VLAN MAC Address Port Type 1 00 60 70 4C 73 FF gi1 0 8 static 1 00 60 70 8C 73 FF gi1 0 8 static 200 00 10 0D 48 37 FF gi1 0 9 static ...

Page 421: ...m overflowing and to make room for new addresses an address is deleted from the table if no traffic is received from a dynamic MAC address for a certain period This period of time is called the aging interval To configure dynamic addresses 1 Click Switch Address Tables Dynamic MAC Address in the tree view to display the Dynamic Address page Figure 11 2 Dynamic Address Table The current address tab...

Page 422: ...s Table pages Table 11 2 Dynamic Address CLI Commands CLI Command Description mac address table aging time seconds no mac address table aging time Sets the aging time of the address table Use the no form of this command to restore the default clear mac address table dynamic interface gigabitethernet tengigabitether net port number port channel LAG number permanent delete on reset delete on timeout...

Page 423: ...following is an example of the CLI commands console config mac address table aging time 600 console show mac address table dynamic Aging time is 300 sec VLAN MAC Address Port Type 1 00 60 70 4C 73 FF gi1 0 8 dynamic 1 00 60 70 8C 73 FF gi1 0 8 dynamic ...

Page 424: ...ell PowerConnect 55xx Systems User Guide 12 GARP This section describes how to configure Generic Attribute Registration Protocol GARP on the device It contains the following topics GARP Overview GARP Timers ...

Page 425: ...lues such as VLAN Identifiers with each other In doing so these attributes are propagated to devices in the bridged LAN and these devices form a reachability tree that is a subset of an active topology GARP defines the architecture rules of operation state machines and variables for the registration and deregistration of attribute values When configuring GARP ensure the following The leave time mu...

Page 426: ...in milliseconds during which Protocol Data Units PDU are transmitted GARP Leave Timer 10 2147483640 Enter the time interval in milliseconds which the device waits before leaving its GARP state Leave time is activated by a Leave All Time message sent received and cancelled by the Join message received Leave time must be greater than or equal to three times the join time GARP Leave All Timer 10 2147...

Page 427: ...l ues show gvrp configuration gigabitethernet tengigabitether net port number vlan vlan id port channel LAG number Displays GVRP configuration infor mation including timer values whether GVRP and dynamic VLAN creation are enabled and which ports are running GVRP console config interface gi1 0 1 console config if garp timer leave 900 console config if end console show gvrp configuration gi1 0 11 GV...

Page 428: ...User Guide 13 Spanning Tree This chapter describes the Spanning Tree Protocol It contains the following topics Spanning Tree Protocol Overview Global Settings STP Port Settings STP LAG Settings Rapid Spanning Tree Multiple Spanning Tree ...

Page 429: ...ence might be possible RSTP is enabled by default Although Classic STP is guaranteed to prevent Layer 2 forwarding loops in a general network topology there might be an unacceptable delay before convergence This means that before convergence each bridge or switch in the network must decide if it should actively forward traffic or not on each of its ports For more information on configuring Rapid S...

Page 430: ...om VLAN A that is causing a loop while traffic can remain active in another domain where no loop was seen such as on VLAN B MSTP provides full connectivity for packets allocated to any VLAN and transmits packets assigned to various VLANs through different multiple spanning tree MST regions MST regions act as a single bridge For more information on configuring Multiple STP see Multiple Spanning Tre...

Page 431: ...tings page Figure 13 1 Global Settings The currently defined settings are displayed 2 Enter the fields Spanning Tree State Enable Spanning Tree on the device STP Operation Mode Select the STP mode enabled on the device The possible options are Classic STP Enables Classic STP on the device Rapid STP Enables Rapid STP on the device This is the default value Multiple STP Enables Multiple STP on the d...

Page 432: ...sts assigned to an interface vary according to the selected method Bridge Settings Priority 0 61440 in steps of 4096 Enter the bridge priority value When switches or bridges are running STP each is assigned a priority After exchanging BPDUs the device with the lowest priority value becomes the Root Bridge The default value is 32768 The port priority value is provided in increments of 4096 For exam...

Page 433: ...mount of time that has elapsed since the bridge was initialized or reset and the last topographic change occurred Defining STP Global Parameters Using CLI Commands The following table summarizes the CLI commands for defining STP global parameters as displayed in the Global Settings pages Table 13 1 STP Global Parameter CLI Commands CLI Command Description spanning tree no spanning tree Enables spa...

Page 434: ...ing tree max age seconds Configures the spanning tree bridge maximum age Use the no form of this command to restore the default configuration spanning tree forward time seconds no spanning tree forward time Configures the spanning tree bridge forward time which is the amount of time a port remains in the listening and learning states before entering the forwarding state Use the no form of this com...

Page 435: ...f the CLI commands console config spanning tree console config spanning tree mode rstp console config spanning tree priority 12288 console config spanning tree hello time 5 console config spanning tree max age 12 console config spanning tree forward time 25 console config exit ...

Page 436: ...ry The ports and their STP settings are displayed 2 To modify STP settings on a port click Edit 3 Select the port and enter the fields STP Enable disable STP on the port Fast Link Check to enable Fast Link mode for the port If this is enabled the Port State is automatically placed in the Forwarding state when the port is up Fast Link mode optimizes the time it takes for the STP protocol to converg...

Page 437: ...ort is currently in the learning mode The port cannot forward traffic however it can learn new MAC addresses Forwarding The port is currently in the forwarding mode The port can forward traffic and learn new MAC addresses Role Displays the port role assigned by the STP algorithm that provides STP paths The possible options are Root This port provides the lowest cost path to forward packets to root...

Page 438: ...ignated Cost Displays the cost of the port participating in the STP topology Ports with a lower cost are less likely to be blocked if STP detects loops Forward Transitions Displays the number of times the port has changed from the Forwarding state to Blocking LAG Displays the LAG to which the port is attached Defining STP Port Settings Using CLI Commands The following table summarizes the CLI comm...

Page 439: ...fast Enables Fast Link mode Use the no form of this command to disable the PortFast mode spanning tree bpduguard enable disable no spanning tree bpduguard Shuts down an interface when it receives a bridge protocol data unit BPDU Use the no form of this command to restore the default configuration spanning tree guard root Enables root guard on all spanning tree instances on the interface show spann...

Page 440: ...ority 96 console config if spanning tree portfast console config if exit console config exit console show spanning tree gi1 0 15 instance 12 Port gi1 0 15 enabled State discarding Role alternate Port ID 128 15 Port cost 19 Type P2p configured Auto Internal Port Fast No configured No Designated bridge Priority 32768 Address 00 00 b0 07 07 49 Designated port ID 128 11 Designated path cost 0 Guard ro...

Page 441: ...G from the Select a LAG drop down menu 4 Enter the fields STP Enable disable STP on the LAG Fast Link Check to enable Fast Link mode for the LAG If Fast Link mode is enabled for a LAG the LAG State is automatically placed in Forwarding when the LAG is up Fast Link mode optimizes the time it takes for the STP protocol to converge STP convergence can take from 30 60 seconds in large networks BPDU Gu...

Page 442: ...nnot forward traffic but it can learn new MAC addresses Forwarding The LAG is currently in the forwarding mode and it can forward traffic and learn new MAC addresses Broken The LAG is currently malfunctioning and cannot be used for forwarding traffic Role Displays the LAG role assigned by the STP algorithm that provides STP paths The possible options are Root This LAG provides the lowest cost path...

Page 443: ...d the MAC address of the designated bridge Designated Port ID Displays the ID of the selected interface Designated Cost Displays the cost of the port participating in the STP topology Ports with a lower cost are less likely to be blocked if STP detects loops Forward Transitions Displays the number of times the LAG State has changed from the Forwarding state to a Blocking state Defining STP LAG Set...

Page 444: ...Spanning Tree Protocol RSTP detects and uses network topologies that enable a faster convergence of the spanning tree without creating forwarding loops To configure RSTP 1 Click Switching Spanning Tree Rapid Spanning Tree in the tree view to display the Rapid Spanning Tree Summary page Figure 13 4 Rapid Spanning Tree Summary 2 To modify RSTP settings on an interface click Edit and enter the fields...

Page 445: ...isplays if Fast Link is enabled or disabled for the port or LAG If Fast Link is enabled for an interface the interface is automatically placed in the forwarding state The possible options are Enable Fast Link is enabled Disable Fast Link is disabled Auto Fast Link mode is enabled a few seconds after the interface becomes active Point to Point Admin Status Select if a point to point links is establ...

Page 446: ...MSTP If it still exists as an STP link the device continues to communicate with it by using STP Otherwise if it has been migrated to RSTP or MSTP the device communicates with it using RSTP or MSTP respectively Defining Rapid STP Parameters Using CLI Commands The following table summarizes the CLI commands for defining Rapid STP parameters as displayed in the Rapid Spanning Tree pages Table 13 3 Ra...

Page 447: ...nds show spanning tree gigabitethernet tengigabiteth ernet port number port channel LAG number Displays spanning tree configuration console config interface gi1 0 5 console config if spanning tree link type shared Table 13 3 Rapid STP Parameters CLI Command Continued CLI Command Description ...

Page 448: ...stems User Guide Multiple Spanning Tree This section describes Multiple Spanning Tree Protocol MSTP It contains the following topics MSTP Overview MSTP Properties VLAN to MSTP Instance MSTP Instance Settings MSTP Interface Settings ...

Page 449: ...in the Forwarding State in another STP instance In addition packets assigned to various VLANs are transmitted along different paths within Multiple Spanning Trees Regions MST Regions Regions are one or more Multiple Spanning Tree bridges by which frames can be transmitted MSTP Properties To set an MSTP region 1 Click Switching Spanning Tree MSTP Settings in the tree view to display the MSTP Proper...

Page 450: ...ng table summarizes the CLI commands for configuring MST properties in the MSTP Properties pages Table 13 4 MSTP Properties CLI Commands CLI Command Description spanning tree mst configuration Enters MST Configuration mode spanning tree mst max hops hop count no spanning tree mst max hops Configures the number of hops in an MST region before the BDPU is discarded and the port information is aged o...

Page 451: ...fig mst name region1 console config mst revision 1 console config interface gi1 0 1 console config if spanning tree mst 1 port priority 144 console config spanning tree mst max hops 10 console config spanning tree mst configuration console config mst instance 2 add vlan 21 30 console config mst name region1 console config mst revision 1 console config mst show pending Pending MST configuration Nam...

Page 452: ... 6 VLAN to MSTP Instance Summary The MSTP instances and their associated VLANs are displayed 2 To associate a VLAN with an MSTP instance click Edit 3 Select the MSTP instance the VLAN and whether to add or remove the VLAN from the MSTP instance association 4 Enter the fields Select MST Instance ID Select an MST instance VLANs Enter the VLANs being mapped to this instance Action Select the mapping ...

Page 453: ...mple of the CLI commands Table 13 5 Mapping VLAN to MSTP Instances Using CLI Commands CLI Command Description spanning tree mst configuration Enters MST Configuration mode instance instance id vlan vlan range no instance instance id vlan vlan range Maps VLANs to an MST instance Use the no form of this command to restore default mapping show spanning tree detail Displays the spanning tree configura...

Page 454: ... Settings page Figure 13 7 MSTP Instance Settings The MSTP instances and their associated VLANs are displayed 2 Select an Instance ID 3 Enter the Bridge Priority 0 61440 of this bridge for the selected MSTP instance 4 The following fields are displayed Included VLANs Displays VLANs included in this instance Designated Root Bridge ID Priority and MAC address of the Root Bridge for the MST instance ...

Page 455: ...elds in the MSTP Instance pages The following is an example of the CLI commands Table 13 6 Configuring MSTP Instances CLI Commands CLI Command Description spanning tree mst configuration Enters MST Configuration mode spanning tree mst instance id priority priority no spanning tree mst instance id priority Configures the device priority for the specified spanning tree instance Use the no form of th...

Page 456: ...instance is displayed 2 To set MSTP settings for an interface click Edit 3 Select an instance and enter the fields Interface ID Assign either ports or LAGs to the selected MSTP instance Port State Displays whether the port is enabled or disabled in the specific instance Type Displays whether MSTP treats the port as a point to point port or a port connected to a hub and whether the port is internal...

Page 457: ...ted in a loop by a point to point link Backup ports also occur when a LAN has two or more connections connected to a shared segment Disabled This port is not participating in the Spanning Tree Interface Priority Enter the interface priority for specified instance Path Cost 1 200 000 000 Enter the port contribution to the Spanning Tree instance If a loop occurs the spanning tree considers path cost...

Page 458: ...no spanning tree mst instance id cost Sets the path cost of the port for MST calculations in Interface Configuration mode Use the no form of this command to restore the default configuration spanning tree mst instance id port priority priority Configures the device priority for the specified spanning tree instance in Interface Configuration mode Use the no form of this command to restore the defau...

Page 459: ... 459 14 VLANs This chapter describes how VLANs are configured on the device It contains the following topics Virtual LAN Overview VLAN Membership Port Settings LAGs Settings Protocol Groups Protocol Port GVRP Parameters Private VLAN Voice VLAN ...

Page 460: ...an be thought of as a Broadcast domain that exists within a defined set of switches A VLAN consists of a number of end systems either hosts or network equipment such as bridges and routers connected by a single bridging domain The bridging domain is supported on various pieces of network equipment for example LAN switches that operate bridging protocols between them with a separate bridge group fo...

Page 461: ...MAC address 4 The egress rules define whether the frame is to be sent as tagged or untagged Special case VLANs VLAN 1 and VLAN 4095 are special case VLANs VLAN1 Defined as the default VLAN and may only be used as a Ports Default VLAN ID PVID This means that if the VLAN whose VID is the current port s PVID is deleted from the port or from the system that port s PVID is set to 1 VLAN 1 cannot be del...

Page 462: ...e VID is set as the current PVID of the port is deleted from the system or deleted from the port the port s PVID will be set to 1 meaning that the port will be made a member of VLAN 1 the default VLAN Ingress filtering is always enabled for ports in Access mode Setting an Access port s PVID to 4095 effectively shuts it down as no frames will be transferred in either direction Access mode ports are...

Page 463: ...ed for switch to switch links where traffic is usually tagged General Ports Ports set to General mode may be members of multiple VLANs Each of these VLANs may be configured to be tagged or untagged This setting applies to transmitted frames Incoming untagged frames are classified into the VLAN whose VID is the currently configured PVID Ingress filtering may be disabled on General ports Ingress fil...

Page 464: ...ame type can be set on a port to accept all frames tagged and untagged tagged only or untagged only This setting takes precedence over all other settings so that if the acceptable frame type is tagged only incoming untagged frames are silently discarded even if the port has a valid PVID ...

Page 465: ... view the ports in a VLAN and assign various parameters 1 Click Switching VLAN VLAN Membership in the tree view to display the VLAN Membership Summary page Figure 14 2 VLAN Membership Summary The ports in the selected unit VLAN are displayed along with their statuses Each port LAG is labeled with one of the following codes regarding its membership in the VLAN ...

Page 466: ...AN ID and select a VLAN ID to view VLAN Name Check VLAN Name and select a VLAN ID to view VLAN Name 0 32 Characters Enter a new VLAN name Status The VLAN type Possible values are Dynamic The VLAN was dynamically created through GVRP Static The VLAN is user defined Authentication Not Required Enable disable authentication on the VLAN 3 To define a new VLAN click ADD and enter the fields The fields ...

Page 467: ...Adds a name to a VLAN dot1x auth not req no dot1x auth not req Enables unauthorized devices access to the VLAN Use the no form of this command to disable access to the VLAN console config vlan database console config vlan vlan 1972 console config vlan end console config interface vlan 1972 console config if name Marketing console config vlan dot1x auth not req console config if end Table 14 1 VLAN...

Page 468: ... VLAN ID 1 is the default VLAN and cannot be deleted from the system To configure ports on a VLAN 1 Click Switching VLAN Port Settings in the tree view to display the Port Settings Summary page Figure 14 3 Port Settings Summary All interfaces on the selected unit and their settings are displayed 2 To modify the port settings click Edit and enter the fields Interface Enter the unit port number to b...

Page 469: ...rt Private VLAN Host The port is an isolated port Current Reserved VLAN Displays the VLAN currently designated by the system as the reserved VLAN Reserve VLAN for Internal Use 1 4094 Check to enter a reserved VLAN and enter its ID If none is required check None PVID 1 4095 Enter a VLAN ID to be added to untagged packets The possible values are 1 4095 VLAN 4095 is defined according to standard and ...

Page 470: ...or untagged traffic to trunk ports Multicast VLAN ID 1 4094 Enter VLAN used for Multicast TV VLAN traffic on access ports Customer VLAN ID 1 4094 Enter VLAN used for customer ports Assigning Ports to VLAN Groups Using CLI Commands The following table summarizes the CLI commands for assigning ports to VLAN groups Table 14 2 Port to VLAN Group Assignments CLI Commands CLI Command Description switchp...

Page 471: ... interface is in trunk mode Use the no form of this command to restore the default configuration switchport general allowed vlan add remove vlan list tagged untagged no switchport general allowed vlan Sets the general characteristics when the interface is in general mode Use the no form of this command to reset a general characteristic to the default switchport general pvid vlan id no switchport g...

Page 472: ...unk general private vlan promiscuous host customer no switchport mode Configure the VLAN membership mode of a port Use the no form of this command to restore the default configuration Table 14 2 Port to VLAN Group Assignments CLI Commands Continued CLI Command Description ...

Page 473: ...onfig interface gi1 0 8 console config if switchport mode access console config if switchport access vlan 23 console config if end console config interface gi1 0 9 console config if switchport mode trunk console config if switchport mode trunk allowed vlan add 23 25 console config if end console config interface gi1 0 11 console config if switchport mode general console config if switchport genera...

Page 474: ... a VLAN 1 Click Switching VLAN LAG Settings in the tree view to display the VLAN LAG Settings page Figure 14 4 VLAN LAG Settings All LAGs and their settings are displayed 2 To modify the LAG settings click Edit and enter the fields LAG Select the LAG to be modified Switchport Mode Select whether the LAG is in Layer 2 or Layer 3 If the LAG is in Layer 2 enter the parameters described below otherwis...

Page 475: ...omiscuous port Private VLAN Host The port is an isolated port Current Reserved VLAN Displays the VLAN currently designated as the reserved VLAN Reserve VLAN for Internal Use 1 4094 Enter the VLAN that is designated as the reserved VLAN after the device is reset or select None PVID 1 4095 Assigns a VLAN ID to untagged packets The possible VLAN IDs are 1 4095 VLAN 4095 is defined as per standard and...

Page 476: ... Enable disable Ingress filtering by the LAG Ingress filtering discards packets that are destined to VLANs of which the specific LAG is not a member Native VLAN ID 1 4094 Enter VLAN used for untagged traffic to trunk ports or select None Multicast VLAN ID 1 4094 Enter VLAN used for Multicast TV VLAN traffic on access ports or select None Customer VLAN ID 1 4094 Enter VLAN used for customer ports o...

Page 477: ... are only available on General ports Classification rules are set on a per port basis and may be sensitive to the frame s encapsulation The default encapsulation assumed is Ethernet On each port a user can define associations between groups of data link layer protocols and ports For each group port combination the user may set the VLAN to which frames incoming on that port will be classified if th...

Page 478: ...lation as per RFC 1042 The following standards are relevant IEEE802 1V defines VLAN assignment by protocol type IETF RFC 10 2 defines a standard for the transmission of IP datagrams over IEEE 802 Networks Defining Protocol Groups Define protocol groups in two steps 1 Define a protocol group by assigning one or more protocols to the group and giving it a protocol group ID any integer using the Prot...

Page 479: ...14 5 Protocol Group Summary The currently defined protocol groups are displayed 2 To add a new protocol group click Add and enter the fields Frame Type Select a frame type to be accepted in the protocol group Protocol Value Select a protocol name or Ethernet Based Protocol Value 0600 FFFF Enter the Ethernet protocol group type Protocol Group ID Assign a protocol group ID number ...

Page 480: ...mands Table 14 3 VLAN Protocol Groups CLI Commands CLI Command Description map protocol protocol encapsulation protocols group group no map protocol protocol encapsulation Maps a protocol to a protocol group Protocol groups are used for protocol based VLAN assignment Use the no form of this command to delete a protocol from a group console config vlan database console config vlan map protocol ip p...

Page 481: ...with it To add an interface to a protocol group 1 Click Switching VLAN Protocol Port in the tree view to display the Protocol Port Summary page Figure 14 6 Protocol Port Summary A list of previously defined protocol groups is displayed 2 To assign an interface to a protocol group click Add and enter the fields Interface Port or LAG number to be added to a protocol group Group ID Select a protocol ...

Page 482: ...owing table summarizes the CLI command for defining protocol ports The following is a sample of the CLI commands Table 14 4 Protocol Port CLI Commands CLI Command Description switchport general map protocols group group vlan vlan id no switchport general map protocols group group Sets a protocol based classification rule Use the no form of this command to delete a classification console config if ...

Page 483: ...ion of the GVRP protocol it is advised to set the maximum number of GVRP VLANs equal to a value which significantly exceeds The number of all static VLANs both currently configured and expected to be configured The number of all dynamic VLANs participating in GVRP both currently configured initial number of dynamic GVRP VLANs is 128 and expected to be configured To set GVRP parameters 1 Click Swit...

Page 484: ...ommands for configuring GVRP as displayed in the GVRP Global Parameters page Table 14 5 GVRP Global Parameters CLI Commands CLI Command Description gvrp enable no gvrp enable In Global Configuration mode this command enables GVRP globally In Interface Configuration mode it enables GVRP on the interface Use the no form of this command to disable GVRP on the device gvrp vlan creation forbid no gvrp ...

Page 485: ...unning GVRP show gvrp error statistics gigabitethernet tengigabitet hernet port number port channel LAG number Displays GVRP error statistics show gvrp statistics gigabitethernet tengigabitet hernet port number port channel LAG number Displays GVRP statistics clear gvrp statistics gigabitethernet tengigabitet hernet port number port channel LAG number Clears all the GVRP statistics information Tab...

Page 486: ...Maximum VLANs 4094 Port s GVRP Status Registration Dynamic VLAN Timers milliseconds Creation Join Leave Leave All gi1 0 1 Disabled Normal Enabled 200 600 10000 gi1 0 2 Disabled Normal Enabled 200 600 10000 gi1 0 3 Disabled Normal Enabled 200 600 10000 gi1 0 4 Disabled Normal Enabled 200 600 10000 gi1 0 5 Disabled Normal Enabled 200 600 10000 gi1 0 6 Disabled Normal Enabled 200 600 10000 gi1 0 7 Di...

Page 487: ...orts can be members of a Private VLAN PVLAN in the following membership types Promiscuous ports that can communicate with all ports of the same PVLAN including the isolated ports of the same PVLAN Isolated ports that have complete Layer 2 isolation from the other ports within the same PVLAN but not from the promiscuous ports Isolated ports can communicate with promiscuous ports The PVLAN entity is...

Page 488: ...y by Associated Primary VLAN ID check that field enter a VLAN ID and click Query The associated VLANs are displayed 3 To define a private VLAN click Assign and enter the fields Private VLAN ID Select a VLAN to be assigned Private VLAN Type Select one of the possible options Primary Traffic from promiscuous ports flow through this type of VLAN This is for the internet or shared servers Isolated Tra...

Page 489: ...Promiscuous Port is promiscuous C Conditional operational state depends on Port VLAN Mode Port receives the Port VLAN type set in the VLAN Port Settings page See Port Modes on page 462 for a description of the various port modes Configuring Private VLAN Using CLI Commands The following table summarizes the CLI commands for configuring private VLANs Table 14 6 Private VLAN CLI Commands CLI Command ...

Page 490: ...id no switchport private vlan host association Configures the VLANs of the private vlan host port Use the no form of this command to reset to default show vlan private vlan tag vlan id Displays private VLAN information console show vlan private vlan Primary Secondary Type Ports 20 Primary gi1 0 1 2 20 201 Isolated gi1 0 1 8 20 202 Isolated gi1 0 1 2 gi1 09 18 20 203 Isolated gi1 0 1 2 gi1 0 19 21 ...

Page 491: ...Use only tagged packets for all communications Initially use untagged packets while retrieving the initial IP address through DHCP Then the phone uses the Voice VLAN and starts sending tagged VoIP packets Non VoIP traffic is dropped from the Voice VLAN when the device is in Auto Voice VLAN secured mode The Voice VLAN feature also provides QoS actions to VoIP ensuring that the quality of voice does...

Page 492: ... Enter the fields Voice VLAN State Select Enable to use the Voice VLAN feature on the device Voice VLAN ID Select the VLAN that is to be the voice VLAN Class of Service Select to add a CoS level to untagged packets received on the voice VLAN The possible values are 0 to 7 where 7 is the highest priority 0 is used as a best effort and is invoked automatically when no other value has been set Remark...

Page 493: ...n enable Enables automatic voice VLAN configuration for a port Use the no form of this command to disable automatic voice VLAN configuration voice vlan id vlan id no voice vlan id Enables the voice VLAN and configures the voice VLAN ID in Global Configuration mode Use the no form of this command to disable voice VLAN voice vlan cos cos queue remark no voice vlan cos Sets the voice VLAN Class of Se...

Page 494: ...UI table 1440 minutes MAC Address Prefix Description 00 E0 BB 3COM 00 03 6B Cisco 00 E0 75 Veritel 00 D0 1E Pingtel 00 01 E3 Siemens 00 60 B9 NEC Philips 00 0F E2 Huawei 3COM 00 09 6E Avaya Voice VLAN VLAN ID 8 CoS 6 Remark Yes Interface Enabled Secure Activated gi1 0 1 Yes Yes Yes gi1 0 2 Yes Yes Yes gi1 0 3 Yes Yes Yes gi1 0 4 Yes Yes Yes ...

Page 495: ...lay the Port Setting Summary page Figure 14 10 Voice VLAN Port Setting A list of the ports and their voice VLAN settings is displayed 2 To modify the voice VLAN settings for an interface click Edit and enter the fields Interface Enter the specific port or LAG to which the Voice VLAN settings are applied Voice VLAN Mode Select the Voice VLAN mode The possible options are ...

Page 496: ...oice VLAN the user cannot add it to the Voice VLAN in Auto mode only in Static mode Voice VLAN Security Enable disable security on the interface Security ensures that packets arriving with an unrecognized OUI are dropped for example data packets Defining Voice VLAN Port Settings Using CLI Commands The following table summarizes the CLI command for defining Voice VLAN port settings Table 14 8 Voice...

Page 497: ...UIs can be stored on the switch Nine specific OUIs of popular VoIP phones manufacturers are stored by default Traffic from each type of IP phone contains the OUI for the phone manufacturer When frames are received in which the source MAC address s first three octets match one of the OUIs in the OUI list the port on which they are received is automatically assigned to the Voice VLAN console config ...

Page 498: ... 1 Click Switching VLAN Voice VLAN OUI in the tree view to display the OUI Summary Figure 14 11 OUI Summary The previously defined OUIs are displayed 2 To add a new OUI click Add and enter the fields Telephony OUI Enter a new OUI Description Enter an OUI description up to 32 characters ...

Page 499: ... following is an example of the CLI commands Table 14 9 Voice VLAN OUIs CLI Commands CLI Command Description voice vlan oui table add mac address prefix remove mac address prefix text no voice vlan oui table Configures the voice OUI table Use the no form of this command to restore the default configuration console config voice vlan oui table add 00 E0 BB console config ...

Page 500: ...00 Dell PowerConnect 55xx Systems User Guide 15 Link Aggregation This section describes link aggregation of ports It contains the following topics Link Aggregation Overview LACP Parameters LAG Membership ...

Page 501: ...s are also LACP ports the devices establishes a LAG between them When you aggregate ports the ports and LAG must fulfill the following conditions All ports within a LAG must be the same media type A VLAN is not configured on the port The port is not assigned to another LAG Auto negotiation mode is not configured on the port The port is in full duplex mode All ports in the LAG have the same ingress...

Page 502: ...hash function statistically load balances the aggregated link members The device considers an Aggregated Link to be a single logical port Aggregate ports can be linked into link aggregation port groups Each group comprises ports with the same speed set to full duplex operations Ports in a LAG can contain different media types if the ports are operating at the same speed Aggregated links can be man...

Page 503: ...dynamic LAG To set LACP parameters 1 Click Switching Link Aggregation LACP Parameters in the tree view to display the LACP Parameters page Figure 15 1 LACP Parameters The LACP parameters for all ports are displayed 2 Enter the global LACP System Priority 1 65535 value that determines which candidate ports will become members of the LAG The page displays the LACP settings of the ports on the select...

Page 504: ...e following table summarizes the CLI commands for configuring LACP parameters as displayed in the LACP Parameters page Table 15 1 LACP Parameters CLI Commands CLI Command Description lacp system priority value Configures the system priority lacp port priority value Configures the priority value for physical ports lacp timeout long short Assigns an administrative LACP timeout show lacp gigabitether...

Page 505: ...commands console config lacp system priority 120 console config interface gi1 0 11 console config if lacp port priority 247 console config if lacp timeout long console config if end console show lacp gi1 0 11 statistics Port gi1 0 11 LACP Statistics LACP PDUs sent 2 LACP PDUs received 2 ...

Page 506: ...error message is generated If the first port joining the LAG cannot be configured with the LAG settings the port is added to the LAG using the port default settings and an error message is generated Since this is the only port in the LAG the entire LAG operates with the port s settings instead of the LAG s defined settings To assign ports to LAGs 1 Click Switching Link Aggregation LAG Membership i...

Page 507: ...number to aggregate or remove the port to that LAG number Adding Ports to LAGs Using CLI Commands The following table summarizes the CLI commands for assigning ports to LAGs as displayed in the LAG Membership pages The following is an example of the CLI commands Table 15 2 LAG Membership CLI Commands CLI Command Description channel group LAG number mode on auto no channel group Associates a port w...

Page 508: ...s chapter describes Multicast support on the device It contains the following topics Multicast Support Overview Global Parameters Bridge Multicast Groups Bridge Multicast Forward All IGMP Snooping Unregistered Multicast Multicast TV VLAN Multicast TV VLAN Mapping ...

Page 509: ... the Multicast Filtering Database The default setting of this is to flood all such traffic traffic in unregistered Multicast groups The device supports Forwarding L2 Multicast Packets Forwards Layer 2 Multicast packets Layer 2 Multicast filtering is enabled by default and is not user configurable Filtering L2 Multicast Packets Forwards Layer 2 packets to interfaces If Multicast filtering is disabl...

Page 510: ...lyzes the incoming packets and determines Which ports want to join which Multicast groups Which ports have Multicast routers generating IGMP queries What routing protocols are forwarding packets and Multicast traffic Ports requesting to join a specific Multicast group issue an IGMP report specifying that the Multicast group is accepting members This results in the creation of an entry in the Multi...

Page 511: ...ng Multicast Support Global Parameters in the tree view to display the Global Parameters page Figure 16 1 Global Parameters 2 Enter the fields Bridge Multicast Filtering Enable disable Multicast filtering Disabled is the default value IGMP Snooping Status Enable disable IGMP Snooping on the device Disabled is the default value ...

Page 512: ...e CLI commands Table 16 1 Multicast Filtering and Snooping CLI Commands CLI Command Description bridge multicast filtering no bridge multicast filtering Enables filtering of Multicast addresses Use the no form of this command to disable multicast address filtering ip igmp snooping no ip igmp snooping Enables Internet Group Membership Protocol IGMP snooping Use the no form of this command to disabl...

Page 513: ... a Multicast service group and the manner in which the port or LAG joined it To add and configure a Multicast group 1 Click Switching Multicast Support Bridge Multicast Group in the tree view to display the Bridge Multicast Group Summary page Figure 16 2 Bridge Multicast Group Summary The ports and LAGs in the selected Multicast Group are displayed ...

Page 514: ...Multicast Enter a Multicast group MAC address Ports Select the ports to be added to a Multicast service Toggle a port to S to join the port to the selected Multicast group as a static port Toggle a port to F to indicate that it is Forbidden to this service Leave the field empty if it is not involved in the VLAN LAGs Select the LAGs to be added to a Multicast service Toggle a LAG to S to join the p...

Page 515: ...multicast forbidden address mac multicast address ip multicast address add remove gigabitethernet tengigabitethe rnet interface list port channel LAG number list no bridge multicast forbidden address mac multicast address Forbids adding a specific Multicast address to specific ports Use the no form of this command to return to default Use the no form of this command to restore the default configur...

Page 516: ...s 1 0100 5e02 0203 gi1 0 8 19 0100 5e02 0208 gi1 0 8 console show bridge multicast address table format ip VLAN IP Address Type Ports 1 224 239 130 2 2 3 static gi1 0 11 gi1 0 12 Forbidden ports for multicast addresses VLAN IP Address Ports 1 224 239 130 2 2 3 gi1 0 8 ...

Page 517: ...ort or VLAN To attach interfaces to a Multicast service 1 Click Switching Multicast Support Bridge Multicast Forward All in the tree view to display the Bridge Multicast Forward All page Figure 16 3 Bridge Multicast Forward All 2 Select a unit VLAN and click on the ports and LAGs to be attached to the Multicast service Toggle a port to S to join the port to the selected Multicast group as a static...

Page 518: ...le of the CLI commands Table 16 4 Managing LAGs and Ports Attached to Multicast Routers CLI Commands CLI Command Description show bridge multicast filtering vlan id Displays the Multicast filtering configuration bridge multicast forward all add remove gigabitethernet tengigabitethe rnet interface list port channel LAG number list Enables forwarding of all Multicast packets on a port Use the no for...

Page 519: ...ge Multicast filtering must also be enabled By default a Layer 2 switch forwards Multicast frames to all ports of the relevant VLAN essentially treating the frame as if it were a Broadcast When IGMP Snooping is enabled per VLAN the switch forwards Multicast frames to ports that have registered as Multicast clients in the VLAN NOTE The switch supports IGMP Snooping only on static VLANs It does not ...

Page 520: ...an one IGMP Querier is present in the domain The speed of IGMP Querier activity should be aligned with the IGMP snooping enabled switches Queries should be sent at a rate that is aligned to the snooping table aging time If queries are sent at a rate lower than the aging time the subscriber cannot receive the Multicast packets To enable IGMP Snooping on a VLAN 1 Click Switching Multicast Support IG...

Page 521: ...he elected querier Query Interval 30 18000 Enter the interval between general queries sent by the querier Operational Query Interval The time interval in seconds between general queries sent by the elected querier Query Max Response Interval 5 20 Enter the amount of time in which a host should respond to a query Operational Query Max Response Interval Displays the actual delay Last Member Query Co...

Page 522: ...g IGMP snooping on a VLAN Table 16 5 IGMP Snooping CLI Commands CLI Command Description ip igmp snooping vlan vlan id no ip igmp snooping vlan vlan id Enables IGMP snooping on a specific VLAN Use the no form of this command to disable IGMP snooping on a VLAN interface ip igmp snooping vlan vlan id mrouter learn pim dvmrp no ip igmp snooping vlan vlan id mrouter learn pim dvmrp Enables automatic le...

Page 523: ...rocessing ip igmp snooping vlan vlan id querier no ip igmp snooping vlan vlan id querier Enables the IGMP querier on a specific VLAN Use the no form of this command to disable the IGMP querier on a VLAN interface ip igmp snooping querier address source ip address no ip igmp snooping querier address Defines the source IP address that the IGMP Snooping querier would use Use the no form of this comma...

Page 524: ...GMP Snooping is globaly disabled IGMP Snooping admin Enabled IGMP Snooping oper mode Disabled Routers IGMP version 3 IGMP snooping querier admin disabled IGMP snooping querier oper disabled IGMP snooping querier address admin IGMP snooping querier address oper 10 5 234 232 IGMP snooping robustness admin 2 oper 2 IGMP snooping query interval admin 125 sec oper 125 sec IGMP snooping query maximum re...

Page 525: ...a registered Multicast group only to ports that are registered to that Multicast group Traffic from unregistered Multicast groups which are the groups that are not known to the device can either be filtered or forwarded After a port has been set to Forwarding Filtering its configuration is valid for any VLAN of which it is a member or will be a member of To set the action for unregistered Multicas...

Page 526: ...unregistered Multicast frames on the selected VLAN interface Configuring Unregistered Multicast Using CLI Commands The following table summarizes the CLI commands for configuring Unregistered Multicast on the device The following is an example of the CLI commands Table 16 6 Unregistered Multicast CLI Commands CLI Command Description bridge multicast unregistered Configures the forwarding state of ...

Page 527: ... performed per port One or more IP Multicast address groups can be associated with a Multicast VLAN The source port must belong to the Multicast VLAN Source and receiver ports do not have to be members of the same VLAN An end port is defined as a receiver port for the Multicast VLAN Receiving ports can belong to a single user VLAN and additionally to one Multicast VLAN The receiver port can be an ...

Page 528: ...Multicast TV VLAN Membership The receiver and transceiver ports in the selected TV VLAN are displayed Displaying Multicast TV VLAN Membership Using CLI Commands The following table summarizes the CLI command for displaying Multicast TV VLAN membership Table 16 7 Multicast TV VLAN Membership CLI Commands CLI Command Description show vlan multicast tv vlan vlan id Displays information on the source ...

Page 529: ...VLAN Mapping in the tree view to display the Multicast TV VLAN Mapping Summary page Figure 16 7 Multicast TV VLAN Mapping Summary The Multicast Group IP addresses for the selected TV VLAN are displayed 2 To add the Multicast Group IP address for a VLAN click Add and enter the fields VLAN ID Enter a VLAN ID console show vlan multicast tv vlan 1 Source Ports gi1 0 8 gi1 0 9 Receiver Ports gi2 0 1 18...

Page 530: ...I Commands CLI Command Description ip igmp snooping vlan vlan id multicast tv ip multicast address count number no ip igmp snooping vlan vlan id multicast tv ip multicast address count number Defines the Multicast IP addresses that are associated with a Multicast TV VLAN Use the no form of this command to remove all associations show ip igmp snooping multicast tv vlan vlan id Displays the IP addre...

Page 531: ...s User Guide 531 17 LLDP The section describes the Link Layer Discovery Protocol LLDP It contains the following topics LLDP Overview LLDP Properties LLDP Port Settings MED Network Policy LLDP MED Port Settings Neighbors Information ...

Page 532: ...LV field LLDP devices must support chassis and port ID advertisements as well as system name system ID system description and system capability advertisements LLDP Media Endpoint Discovery LLDP MED increases network flexibility by enabling various IP systems to co exist on a single network and provides the following features Detailed network topology information including information on which devi...

Page 533: ...the LLDP Properties page Figure 17 1 LLDP Properties The current LLDP properties are displayed 2 Enter the fields Enable LLDP Enable disable LLDP on the device Updates Interval 5 32768 Enter the rate at which LLDP advertisement updates are sent Hold Multiplier 2 10 Enter the hold time to be sent in the LLDP update packets as a multiple of the timer value ...

Page 534: ...um time in seconds that an LLDP port waits before reinitializing LLDP transmission Transmit Delay 1 8192 Enter the amount of time that passes between successive LLDP frame transmissions due to changes in the LLDP local systems MIB To use the default values for any field select Use Default ...

Page 535: ...and to restore the default configuration lldp hold multiplier number no lldp hold multiplier Specifies the time that the receiving device should hold a Link Layer Discovery Protocol LLDP packet before discarding it Use the no form of this command to restore the default configuration lldp reinit seconds no lldp reinit Specifies the minimum time an LLDP port will wait before reinitializing Use the n...

Page 536: ...xx Systems User Guide The following is an example of the CLI commands console config interface gi1 0 1 console config if lldp run console config lldp timer 30 console config lldp hold multiplier 3 console config lldp reinit 4 ...

Page 537: ...evices that support the LLDP To configure LLDP per port 1 Click System LLDP LLDP Port Settings in the tree view to display the LLDP Port Settings Summary page Figure 17 2 LLDP Port Settings Summary LLDP settings for all ports are displayed 2 To modify the LLDP settings for a port click Edit and select the port to be configured 3 Select the transmission type on which LLDP is to be configured in the...

Page 538: ...witch This value equals the sysDescr object System Capabilities Primary functions of the switch and whether or not these functions are enabled in the switch The capabilities are indicated by two octets Bits 0 through 7 indicate Other Repeater Bridge WLAN AP Router Telephone DOCSIS cable device and station respectively Bits 8 through 15 are reserved 802 3 MAC PHY Duplex and bit rate capability and ...

Page 539: ... Enables transmitting LLDP on an interface Use the no form of this command to stop transmitting LLDP on an interface lldp receive no lldp receive Enables receiving LLDP on an interface Use the no form of this command to stop receiving LLDP on an interface lldp optional tlv tlv1 tlv2 tlv5 Specifies which optional TLVs from the basic set should be transmitted console config interface gi1 0 1 console...

Page 540: ... a policy can be created for VoIP phones that instructs them to Send voice traffic on VLAN 10 Tag voice traffic with DSCP 63 Transmit data traffic to the switch from the PC connected to the switch through the VoIP phone without modification to traffic sent by the PC typically Untagged For network policies to be implemented they must be created and then associated with ports Before policies are def...

Page 541: ...rk Policy Summary Previously defined network policies are displayed 2 To add a network policy click Add and enter the fields Network Policy Number Select an available network policy number Application Select the application type of traffic for which the network policy is defined VLAN ID Enter the VLAN ID to which the traffic should be sent VLAN Type Select whether the traffic is Tagged or Untagged...

Page 542: ...ing commands are used to configure MED network policies The following is an example of the CLI commands Table 17 3 LLDP MED Network Policies CLI Commands CLI Command Description lldp med network policy number application vlan id vlan type tagged untagged up priority dscp value no lldp med network policy number Defines an LLDP MED network policy Use the no form of this command to remove an LLDP MED...

Page 543: ... ports on that unit are displayed along with the following fields LLDP MED Status Specifies if LLDP MED is enabled on the selected port Network Policy Specifies whether a network policy is assigned to the port Location Specifies whether the location is advertised PoE Specifies whether PoE is enabled on the port 3 To modify network policies on a port click Edit 4 Select the port to be configured an...

Page 544: ...rd Ave E Location ECS ELIN 10 25 Bytes in Hex Displays the device s ECS ELIN location 5 To view MED details for a port click Details and select a port The following fields are displayed for the port Auto Negotiation Status Enabled specifies that auto negotiation is enabled on the port Disabled indicates that it is not Advertised Capabilities The list of port capabilities advertised for the port MA...

Page 545: ...lication type Application Type The application type Flags The VLAN tagging status for the application type Tagged or Untagged VLAN ID The VLAN number for the application type User Priority The user priority for the application type DSCP The DSCP value assigned to the network policy Location Type Displays the port s LLDP location type Coordinates Device s location map coordinates Civic Address Devi...

Page 546: ...es an LLDP MED network policy on an interface Use the no form of this command to remove all the LLDP MED network policies from the interface lldp med location coordinate data civic address data ecs elin data no lldp med location coordinate civic address ecs elin configure the LLDP MED for an interface Use the no form of this command to delete location information for an interface show lldp med con...

Page 547: ...fig lldp med location civic address 6162636465 console show lldp med configuration Fast Start Repeat Count 4 Network policy 1 Application type voiceSignaling VLAN ID 1 untagged Layer 2 priority 0 DSCP 0 Port Capabilities Network Location PoE Notif Inventory Policy ications gi1 0 1 Yes Yes Yes No Enabled No gi1 0 2 Yes Yes No No Enabled No ...

Page 548: ...mum interval that can pass without receiving an LLDP PDU from a neighbor The timeout value is computed from the neighbor s Time to Live TLV To view neighbors information 1 Click System LLDP Neighbors Information in the tree view to display the Neighbors Information page Figure 17 5 Neighbors Information The following fields are displayed for each port on the device that has a discovered neighbor P...

Page 549: ...ng fields are displayed for the neighbors of the selected port Power Type Port s power type Power Source Port s power source Power Priority Port s power priority Power Value Port s power value in Watts Hardware revision Hardware revision Firmware revision Firmware revision Software revision Software revision Serial number Device serial number Manufacturer name Device manufacturer name Model name D...

Page 550: ...CLI commands console show lldp neighbors Port Device ID Port ID System Capabili TTL Name ties gi2 0 17 00 75 73 71 72 55 1 e21 0 91 gi2 0 33 00 12 cf 7c 63 a0 1 e1 0 92 gi2 0 33 00 11 22 11 22 33 1 g39 0 107 gi2 0 33 00 aa aa aa aa aa 1 e37 0 106 gi2 0 41 a4 ba db 57 7c 8d g13 O 97 ...

Page 551: ...1 18 Dynamic ARP Inspection This section describes dynamic ARP inspection It contains the following topics Dynamic ARP Inspection Overview Global Settings Dynamic ARP Inspection List Dynamic ARP Inspection Entries VLAN Settings Trusted Interfaces ...

Page 552: ...ooping database If the IP address is found the packet is valid and is forwarded Packets with invalid ARP Inspection bindings are logged and dropped Ports are classified as follows Trusted Packets are not inspected Untrusted Packets are inspected as described above The following additional validation checks may be configured by the user Source MAC Compares the packet s source MAC address in the Eth...

Page 553: ...lobal Settings page Figure 18 1 Global Settings 2 Enter the fields Enable ARP Inspection Enable disable ARP inspection ARP Inspection Validate Enable disable the following checking source MAC address destination MAC address and IP addresses against the respective addresses in the ARP body Minimal Syslog Interval 0 86400 Enter the minimum time interval between successive ARP SYSLOG messages ...

Page 554: ...arp inspection Enables ARP inspection Use the no form of this command to disable ARP inspection ip arp inspection validate no ip arp inspection validate Performs specific checks for dynamic ARP inspection Use the no form of this command to restore the default configuration ip arp inspection logging interval seconds infinite no ip arp inspection logging interval Sets the minimum time interval betwe...

Page 555: ... ARP Inspection List in the tree view to display the Dynamic ARP Inspection List Summary page Figure 18 2 Dynamic ARP Inspection List Summary The dynamic ARP lists are displayed 2 To create a new list and enter the first address pair in it click Add and enter the fields List Name Create and enter a list name IP Address Enter the IP address that will be mapped to the MAC address entered below MAC A...

Page 556: ...pages The following is an example of some of the CLI commands Table 18 2 Dynamic ARP Inspection List CLI Commands CLI Command Description ip arp inspection list create name no ip arp inspection list create name Creates a static ARP binding list and enters the ARP list configuration mode Use the no form of this command to delete the list console config ip arp inspection list create servers console ...

Page 557: ...s in the tree view to display the Dynamic ARP Inspection Entries Summary page Figure 18 3 Dynamic ARP Inspection Entries Summary The dynamic ARP entries for the selected list are displayed 2 To add a new address pair to a list click Add and select the list 3 Enter the fields IP Address Enter the IP address that will be mapped to the MAC address entered below MAC Address Enter the MAC address that ...

Page 558: ...s mac address mac address no ip ip address mac address mac address Creates a static ARP binding Use the no form of this command to delete a static ARP binding show ip arp inspection list Displays the static ARP binding list console config ip arp inspection list create servers console config arp list ip 172 16 1 1 mac address 0060 704c 7321 console config arp list ip 172 16 1 2 mac address 0060 704...

Page 559: ...mic ARP Inspection Entries VLAN Settings in the tree view to display the VLAN Settings Summary page Figure 18 4 VLAN Settings Summary The VLANs and their associated lists of IP MAC address pairs are displayed 2 To designate a VLAN to be associated with an ARP inspection list click Add VLAN and enter the VLAN ID 3 Click Assign and select the List Name to be associated with the VLAN ...

Page 560: ...igning IP MAC Address Pairs to VLANs CLI Commands CLI Command Description ip arp inspection vlan vlan id Enables ARP inspection on a VLAN based on the DHCP Snooping database Use the no form of this command to disable ARP inspection on a VLAN ip arp inspection list assign vlan id name no ip arp inspection list assign vlan Assigns a static ARP binding list to a VLAN Use the no form of this command t...

Page 561: ...n the network or the network firewall To configure an interface to be trusted 1 Click Switching Dynamic ARP Inspection Trusted Interface in the tree view to display the Trusted Interface Summary page Figure 18 5 Trusted Interface Summary The ports on the selected unit and their trusted status are displayed 2 To modify the status of an interface click Edit 3 Select the interface and enable disable ...

Page 562: ...ters CLI Commands CLI Command Description ip arp inspection trust no ip arp inspection trust Configures an interface trust state that determines if incoming ARP packets are inspected Use the no form of this command to restore the default configuration show ip arp inspection gigabitethernet tengigabit ethernet port number port channel LAG number Displays the ARP inspection configuration for all int...

Page 563: ...Dell PowerConnect 55xx Systems User Guide 563 19 DHCP Snooping This section describes DHCP Snooping and DHCP Relay features It contains the following topics DHCP Snooping DHCP Relay ...

Page 564: ...ks DHCP snooping filters untrusted messages and stores these messages in a database Interfaces are untrusted if the packet is received from an interface outside the network or from an interface beyond the network firewall Trusted interfaces receive packets only from within the network or the network firewall The DHCP Snooping Binding database contains the untrusted interfaces MAC address IP addres...

Page 565: ...re is information in the database If the information exists and does not match the interface on which the message was received the packet is filtered Otherwise the packet is forwarded to trusted interfaces only and the entry is removed from database Forward to trusted interfaces only DHCPRELEASE Same as DHCPDECLINE Same as DHCPDECLINE DHCPINFORM Forward to trusted interfaces only Forward to truste...

Page 566: ...uses TCAM resources The switch writes changes to the binding database only when the switch system clock is synchronized with SNTP The switch does not update the Binding database when a station moves to another interface Global Parameters Use the Global Parameters page to Enable disable DHCP snooping globally Determine whether to forward or filter DHCP packets received from untrusted interfaces who...

Page 567: ...ward enable or filter disable DHCP packets received from untrusted interfaces with option 82 information Verify MAC Address Enable disable MAC addresses verification This determines whether to forward enable or filter disable DHCP packets received from untrusted interfaces whose source MAC address and the DHCP client MAC address do not match Save Binding Database to File Enable disable saving the ...

Page 568: ...rn to the default setting ip dhcp snooping verify no ip dhcp snooping verify Configures the switch to verify on an untrusted port that the source MAC address in a DHCP packet matches the client hardware address Use the no form of this command to configure the switch to not verify the MAC addresses ip dhcp snooping database no ip dhcp snooping database Configures the DHCP snooping binding file Use ...

Page 569: ...nsole config ip dhcp snooping verify console config ip dhcp snooping database console config ip dhcp snooping database frequency 1200 console show ip dhcp snooping DHCP snooping is enabled DHCP snooping database enabled Option 82 on untrusted port is allowed Verification of hwaddr field is enabled DHCP snooping file update frequency is configured to 1200 seconds Interface Trusted gi2 0 1 yes gi2 0...

Page 570: ...ed for that VLAN are removed from the Binding database To enable disable DHCP snooping on a VLAN 1 Click Switching DHCP Snooping VLAN Settings in the tree view to display the VLAN Settings page Figure 19 2 VLAN Settings The list of existing VLANs are displayed in the VLAN ID list 2 Click Add to move the VLANs for which you want to enable DHCP snooping from the VLAN ID list to the Enabled VLANs lis...

Page 571: ...nfiguring DHCP snooping on VLANs The following is an example of some of the CLI commands Table 19 3 DHCP Snooping on VLANs CLI Commands CLI Command Description ip dhcp snooping vlan vlan id no ip dhcp snooping vlan id Enables DHCP snooping on a VLAN Use the no form of this command to disable DHCP snooping on a VLAN console config ip dhcp snooping vlan 1 ...

Page 572: ...face in the tree view to display the Trusted Interface Summary page Figure 19 3 Trusted Interfaces Summary A list of the interfaces is displayed 2 To change the trust status of an interface click Edit and enter the fields Interface Select a unit and port or LAG Trust Status Enable disable DHCP Snooping Trust mode on the selected port or LAG ...

Page 573: ...ed These entries are added to the Snooping Binding database and Snooping Binding file if it exists but they are not added to the configuration files A manually added entry can be either dynamic or a static When configuring a dynamic entry an expiration date must be assigned The refresh time in seconds of the binding table is added in the Global Parameters pages Table 19 4 DHCP Snooping Trusted Int...

Page 574: ... Binding Database A list of the database entries is displayed 2 To query the database enter query criteria and click Query Database entries matching the query are displayed 3 To add a entry click Add and enter the fields Type Select the entry type The possible options are Static IP address was statically configured Dynamic IP address was dynamically configured MAC Address Enter the MAC address to ...

Page 575: ...cription ip dhcp snooping database no ip dhcp snooping database Enables the DHCP Snooping binding database file Use the no form of this command to delete the DHCP Snooping binding database file ip dhcp snooping database update freq seconds no ip dhcp snooping database update freq Enables the DHCP Snooping binding database file Use the no form of this command to delete the DHCP Snooping binding dat...

Page 576: ...base and configuration information for all interfaces or some interfaces on a switch console config ip dhcp snooping database console config ip dhcp snooping update freq 3600 console show ip dhcp snooping binding Update frequency 3600 Total number of binding 2 MAC Address IP Address Lease sec Type VLAN Interface 0060 704C 73FF 10 1 8 1 7983 snooping 3 gi1 0 21 0060 704C 7BC1 10 1 8 2 92332 snoopin...

Page 577: ...ts This functionality is intended to be used when the client ingress VLAN is different than the VLAN on which DHCP servers are connected The switch can relay DHCP messages received from its IPv4 interfaces to one or more configured DHCP servers The switch puts the IPv4 address into the message giaddr before relaying it to the servers It uses the switch s IPv4 address of the interface where the mes...

Page 578: ...g and DHCP relay can insert option 82 into traversing packets DHCP snooping with option 82 insertion provides transparent Layer 2 relay agent functionality when the DHCP server is on the same VLAN as the clients Limitations The following limitations exist for DHCP Relay It is not supported on IPv6 It is not relayed to servers on the client s VLAN Packets that have option 82 information added by ot...

Page 579: ...ect 55xx Systems User Guide 579 Option 82 To enable Option82 insertion 1 Click Switching DHCP Relay Option 82 in the tree view to display the Option 82 page Figure 19 5 Option 82 2 Enable disable Option 82 insertion ...

Page 580: ...s 1 Click Switching DHCP Relay Global Settings in the tree view to display the Global Settings Summary page Figure 19 6 Global Settings Summary The currently define DHCP servers are displayed 2 Enable disable DHCP relay Table 19 6 CLI Option 82 Commands CLI Command Description ip dhcp information option no ip dhcp information option Enables DHCP option 82 data insertion Use the no form of this com...

Page 581: ...lay features on the device Use the no form of this command to disable the DHCP relay agent ip dhcp relay address ip address no ip dhcp relay address ip address Defines the DHCP servers available for the DHCP relay Use the no form of this command to remove servers from the list show ip dhcp relay Displays the server addresses on the DHCP relay console config if ip dhcp relay enable console config i...

Page 582: ...ly in the Global Settings page To enable DHCP relay on a port LAG or VLAN 1 Click Switching DHCP Relay Interface Settings in the tree view to display the Interface Settings Summary page Figure 19 7 Interface Settings Summary The currently define DHCP interfaces are displayed 2 To enable DHCP relay on an interface click Add 3 Select the interface ...

Page 583: ...lay features on the interface in Interface Configuration mode Use the no form of this command to disable the DHCP relay agent feature on the interface ip dhcp relay address ip address no ip dhcp relay address Defines a DHCP servers available for DHCP relay Use the no form of this command to remove servers from the list console config interface vlan 2 console config if ip dhcp relay enable console ...

Page 584: ... 55xx Systems User Guide 20 iSCSI Optimization This section describes iSCSI optimization It contains the following topics Optimizing iSCSI Overview Global Parameters iSCSI Targets iSCSI Sessions Configuring iSCSI Using CLI ...

Page 585: ...ys while providing hosts such as database and web servers with the illusion of locally attached disks The targets listen on a well known TCP port or any other TCP port that has been explicitly specified for incoming connections The login process is started when the initiator establishes a TCP connection to the desired target through the TCP port that was explicitly specified The group of iSCSI TCP...

Page 586: ...s redirect messages upon the initiator request and as a result the initiator opens a connection to a different target the new target must be configured as part of the general configuration Only iSCSI flows to targets that use the iSCSI well known port or other explicit user defined configuration are assigned QoS The aging configuration works for each connection The mechanism checks connection acti...

Page 587: ...onnection replaces the oldest one within this specific iSCSI session A short flow interruption caused by STP topology change or administrative port down action might cause the TCP connection to reinitiate without closing the iSCSI session If the actual iSCSI session used only one TCP connection the reinitiated one will be added to the monitoring table for an aging time period After that it is remo...

Page 588: ...or DSCP to Queue pages To enable iSCSI and set its QoS parameters 1 Click System iSCSI Optimization Global Parameters in the tree view to display the Global Parameters page Figure 20 1 Global Parameters 2 Enter the fields iSCSI Status Enable disable iSCSI optimization iSCSI COS Status Enable disable the Class of Service profile to apply to iSCSI flows Classification Select whether the priority of ...

Page 589: ...I Global Parameters Using CLI Commands The following table summarizes the CLI commands for defining fields displayed in the iSCSI Global Parameters pages Table 20 1 iSCSI Global Parameters CLI Commands CLI Command Description iscsi enable no iscsi enable Enables iSCSI awareness Use the no form of the command to disable iSCSI awareness iscsi cos vpt vpt dscp dscp remark no iscsi cos Sets the qualit...

Page 590: ...sole config iscsi aging time 10 console show iscsi Target iqn 1993 11 com disk vendor diskarrays sn 45678 Session 1 Initiator iqn 1992 04 com os vendor plan9 cdrom 12 storage sys1 xyz Time started 23 Jul 2002 10 04 50 Time for aging out 10 min ISID 11 Initiator Initiator Target Target IP Address TCP Port IP Address IP port 172 16 1 3 49154 172 16 1 20 30001 ...

Page 591: ...isplay the iSCSI Targets Summary page Figure 20 2 iSCSI Targets Summary The currently defined targets are displayed 2 To add a new target click Add 3 Enter the fields TCP Port TCP port used by the target for iSCSI communications IP Address IP address of the target The IP address 0 0 0 0 is any IP address Target Name 0 223 characters Name of the target ...

Page 592: ...nds CLI Command Description iscsi target port tcp port 1 tcp port 2 tcp port 8 address ip address name target name no iscsi target port tcp port 1 tcp port 2 tcp port 8 address ip address Configures iSCSI port s target address and name Use the no form of this command to delete an iSCSI target show iscsi sessions Show the current iSCSI targets and sessions console config iscsi target port 30001 add...

Page 593: ...e view to display the iSCSI Sessions page Figure 20 3 iSCSI Sessions 2 Select a target and click Details The following is displayed Target Name The name of the target Initiator Name The name of the initiator ISID The iSCSI session ID Session Life Time The amount of time that has passed since the first frame of the session Aging Time The time left until the session ages out and is removed ...

Page 594: ...1 Initiator iqn 1995 05 com os vendor plan9 cdrom 10 ISID 222 Target iqn 103 1 com storage vendor sn 43338 storage tape sys1 xyz Initiator iqn 1992 04 com os vendor plan9 cdrom 12 ISID 44 Initiator iqn 1995 05 com os vendor plan9 cdrom 10 ISID 65 console show iscsi sessions detailed Target iqn 1993 11 com disk vendor diskarrays sn 45678 Session 1 Initiator iqn 1992 04 com os vendor plan9 cdrom 12 ...

Page 595: ... iSCSI feature using CLI Table 20 4 Sample CLI Script to Configure iSCSI CLI Command Description iscsi enable Enable iSCSI iscsi cos vpt 2 remark Set iSCSI flow to use VPT 2 Layer 2 CoS This VPT value replaces the original VPT in the packet show iscsi sessions Verify that iSCSI is enabled and that the iSCSI flows are displayed ...

Page 596: ...96 21 Statistics RMON This section describes many of the statistics available on the device The only exception is the QoS statistics described in Quality of Service on page 640 It contains the following topics Table Views RMON Components Charts ...

Page 597: ...er Guide 597 Table Views This section displays statistics in table form It contains the following topics Denied ACEs Counters Utilization Summary Counter Summary Interface Statistics Etherlike Statistics GVRP Statistics EAP Statistics ...

Page 598: ...tics RMON Table Views Denied ACEs Counters in the tree view to display the Denied ACEs Counters page Figure 21 1 Denied ACEs Counters The global number of dropped packets is displayed along with the number of dropped packets on each interface 2 To clear the counters select either a stack unit and port or LAG All ports LAGs in the unit are displayed 3 Mark the counters to be cleared and click Clear...

Page 599: ...ounters statistics The following is an example of the CLI commands Table 21 1 Denied ACE Counters CLI Commands CLI Command Description show interfaces access lists counters gigabitethernet tengigabite thernet port number port channel LAG number Displays Access List counters console show interfaces access lists counters Interface Denied ACE hits gi1 0 1 55 gi1 0 2 33 gi1 0 3 32 ...

Page 600: ...re 21 2 Utilization Summary 2 Select a unit and port LAG The following fields are displayed Port LAG The port LAG number Interface Status The status of the interface Up Down or Not Present when no port is attached to the LAG Interface Utilization Network interface utilization percentage based on the duplex mode of the interface The range of this reading is from 0 to 200 The maximum reading of 200 ...

Page 601: ...ace Non Unicast Packets Received Percentage of non Unicast packets received on the interface Error Packets Received Percentage of packets with errors received on the interface 3 Select one of the Refresh Rate options to specify how frequently the statistics should be refreshed The CPU utilization chart is displayed ...

Page 602: ...ics RMON Table Views Counter Summary in the tree view to display the Counter Summary page Figure 21 3 Counter Summary Counters for the selected units or LAG are displayed 2 Select a port LAG The following fields are displayed Port LAG The interface number Interface Status Status of the interface Up or Down Received Unicast Packets Number of received Unicast packets on the interface ...

Page 603: ... Non Unicast Packets Number of received non Unicast packets on the interface Transmitted Non Unicast Packets Number of transmitted non Unicast packets from the interface Received Errors Number of received packets with errors on the interface 3 Select one of the Refresh Rate options to specify how frequently the counters should be refreshed ...

Page 604: ...able Views Interface Statistics in the tree view to display the Interface Statistics page Figure 21 4 Interface Statistics 2 Select a port LAG 3 Select one of the Refresh Rate options to specify how frequently the counters should be refreshed The following fields are displayed Receive Statistics Total Bytes Octets Amount of octets received on the selected interface ...

Page 605: ...ce Packets with Errors Number of errors packets received on the selected interface Transmit Statistics Total Bytes Octets Number of octets transmitted from the selected interface Unicast Packets Number of Unicast packets transmitted from the selected interface Multicast Packets Number of Multicast packets transmitted from the selected interface Broadcast Packets Number of Broadcast packets transmi...

Page 606: ...re 21 5 Etherlike Statistics 2 Select a port LAG The following fields are displayed Frame Check Sequence FCS Errors Number of frames received that are an integral number of octets in length but do not pass the FCS check Single Collision Frames Number of frames that are involved in a single collision and are subsequently transmitted successfully Late Collisions Number of collisions detected after t...

Page 607: ...ed with a PAUSE operation code Transmitted Pause Frames Number of MAC Control frames transmitted on this interface with a PAUSE operation code 3 Select one of the Refresh Rate options to clears the statistics for the selected interface Viewing Interface Statistics Using the CLI Commands The following table contains the CLI commands for viewing utilization counters and interface statistics Table 21...

Page 608: ... OutMcastPkts OutBcastPkts OutOctets gi2 0 1 0 0 0 0 gi2 0 2 0 0 0 0 gi2 0 3 0 0 0 0 gi2 0 4 0 0 0 0 console show interfaces counters gi1 0 1 Port InUcastPkts InMcastPkts InBcastPkts InOctets gi1 0 1 0 0 0 0 Port OutUcastPkts OutMcastPkts OutBcastPkts OutOctets gi1 0 1 0 0 0 0 Alignment Errors 0 FCS Errors 0 Single Collision Frames 0 Multiple Collision Frames 0 SQE Test Errors 0 Deferred Transmiss...

Page 609: ...display the GVRP Statistics page Figure 21 6 GVRP Statistics 2 Select a port LAG The number of received and transmitted packets in the following counters is displayed GVRP Statistics Table Join Empty The number of GVRP Join Empty packets Empty The number of GVRP empty packets Leave Empty The number of GVRP Leave Empty packets Join In The number of GVRP Join In packets ...

Page 610: ...Invalid Attribute Length errors Invalid Event The number of GVRP Invalid Events errors 3 Select one of the Refresh Rate options to specify how frequently the statistics should be refreshed Viewing GVRP Statistics Using the CLI Commands The following table contains the CLI commands for viewing GVRP statistics Table 21 3 GVRP Statistics CLI Commands CLI Command Description show gvrp statistics gigab...

Page 611: ...P Statistics Legend rJE Join Empty Received rJIn Join In Received rEmp Empty Received rLIn Leave In Received rLE Leave Empty Received rLA Leave All Received sJE Join Empty Sent sJIn Join In Sent sEmp Empty Sent sLIn Leave In Sent sLE Leave Empty Sent sLA Leave All Sent Port rJE rJIn rEmp rLIn rLE rLA sJE sJIn sEmp sLIn sLE sLA ...

Page 612: ...P statistics 1 Click Statistics RMON Table Views EAP Statistics in the tree view to display the EAP Statistics page Figure 21 7 EAP Statistics 2 Select a port LAG The following fields are displayed Frames Received The number of valid EAPOL frames received on the port Frames Transmitted The number of EAPOL frames transmitted via the port ...

Page 613: ...Frames Receive The number of unrecognized EAPOL frames received on this port Length Error Frames Receive The number of EAPOL frames with an invalid Packet Body Length received on this port Last Frame Version The protocol version number attached to the most recently received EAPOL frame Last Frame Source The source MAC address attached to the most recently received EAPOL frame 3 Select one of the R...

Page 614: ...ole show dot1x statistics gi1 0 1 EapolFramesRx 11 EapolFramesTx 12 EapolStartFramesRx 1 EapolLogoffFramesRx 1 EapolRespIdFramesRx 3 EapolRespFramesRx 6 EapolReqIdFramesTx 3 EapolReqFramesTx 6 InvalidEapolFramesRx 0 EapLengthErrorFramesRx 0 LastEapolFrameVersion 1 LastEapolFrameSource 0008 3b79 8787 ...

Page 615: ...N Components This section describes Remote Monitoring RMON which enables network managers to display network information from a remote location It contains the following topics Statistics History Control History Table Events Control Events Log Alarms ...

Page 616: ...he Statistics page Figure 21 8 Statistics 2 Select a port LAG The following fields are displayed Received Bytes Octets Number of bytes received on the selected interface Received Packets Number of packets received on the selected interface Broadcast Packets Received Number of good Broadcast packets received on the interface since the device was last refreshed This number does not include Multicast...

Page 617: ...her a bad Frame Check Sequence FCS with an integral number of octets FCS Error or a bad FCS with a non integral number of octets Alignment Error Jabbers Number of packets received longer than 1518 octets excluding framing bits but including FCS octets and having either a bad Frame Check Sequence FCS with an integral number of octets FCS Error or a bad FCS with a non integral number of octets Align...

Page 618: ...d enabling RMON statistics The following is an example of the CLI commands Table 21 5 Configuring RMON Statistics Using CLI Command CLI Command Description show rmon statistics gigabitethernet tengigabiteth ernet interface port channel LAG number Displays RMON Ethernet statistics console show rmon statistics gi1 0 1 Port te1 0 1 Dropped 0 Octets 0 Packets 0 Broadcast 0 Multicast 0 CRC Align Errors...

Page 619: ... Control in the tree view to display the History Control Summary page Figure 21 9 History Control Summary Previously defined samples are displayed 2 To add a new entry click Add The New History Entry number which uniquely identifies the sample is displayed 3 Enter the fields for the entry Source Interface Sampled Ethernet interface Owner 0 20 characters RMON station or user that configured the ent...

Page 620: ...I commands Table 21 6 RMON History Control CLI Commands CLI Command Description rmon collection stats index owner ownername bucket bucket number interval seconds no rmon collection stats index Enables and configures RMON on an interface Use the no form of this command to remove a specified RMON history group of statistics show rmon collection history gigabitethernet tengigabitet hernet interface p...

Page 621: ... during a single sample To display RMON statistics for a specified sample 1 Click Statistics RMON RMON History Table in the tree view to display the History Table page Figure 21 10 History Table 2 Select a History Entry No The following fields are displayed Owner RMON station or user that requested the RMON information Sample No Number of the specific sample the information in the table reflects ...

Page 622: ...h of between 64 1632 octets who had a bad Check Sequence FCS with an integral number of octets or a bad FCS with a non integral number Undersize Packets Number of packets having less than 64 octets received during the sampling session Oversize Packets Number of packets having more than 1632 octets received during the sampling session Fragments Number of packets having less than 64 octets and havin...

Page 623: ...nd Table 21 7 RMON History Table CLI Commands CLI Command Description show rmon history index throughput errors other period seconds Displays RMON Ethernet statistics history console show rmon history 1 throughput Sample Set 1 Interface 1 0 1 Requested samples 50 Owner CLI Interval 1800 Granted samples 50 Maximum table size 500 Time Jan 18 2005 21 57 00 Octets 303595962 Packets 357568 Broadcast 32...

Page 624: ...g then the events are logged in the Events Log page To define an RMON event 1 Click Statistics RMON RMON Events Control in the tree view to display the Events Control Summary page Figure 21 11 Events Control Summary The currently defined events are displayed Along with the fields described in the Events Control Add page the following field is displayed for the events Time The time that the event o...

Page 625: ...d Trap When an alarm occurs a trap is generated Log and Trap When an alarm occurs a log entry is recorded and a trap is generated Owner Enter the event owner Defining RMON Events Using the CLI Commands The following table contains the CLI commands for defining RMON events Table 21 8 RMON Event Definition CLI Commands CLI Command Description rmon event index none log trap log trap community text de...

Page 626: ...ple of the CLI commands console config rmon event 1 log console config exit console show rmon events Index Description Type Community Owner Last Time Sent 1 Errors Log Default Community CLI Jan 18 2002 23 58 17 2 High Broadcast Log Trap Router Manager Jan 18 2002 23 59 48 ...

Page 627: ...the event is performed when the event is bound to an alarm see the Alarms page and the conditions of the alarm have occurred To display the events log Click Statistics RMON RMON Events Log in the tree view to display the Events Control page Figure 21 12 Events Control The following fields are displayed Event The event identifier Log No The log number Log Time Time when the log entry was entered ...

Page 628: ...or any other SNMP object counter maintained by the agent Both the rising and falling thresholds must be configured in the alarm After a rising threshold is crossed another rising event is not generated until the companion falling threshold is crossed After a falling alarm is issued the next Table 21 9 Device Event Viewing CLI Commands CLI Command Description show rmon log event Displays the RMON l...

Page 629: ...m occurs To add an RMON alarm 1 Click Statistics RMON RMON Alarms in the tree view to display the Alarms Summary page Figure 21 13 Alarms Summary The currently defined alarms are displayed 2 To add a new alarm click Add and enter the fields Alarm Entry Displays a new alarm entry Interface Select the interface for which RMON statistics are displayed Counter Name Select the selected MIB variable ...

Page 630: ...the previously defined events Falling Threshold 0 2147483647 Enter the falling counter value that triggers the falling event alarm Falling Event Select one of the previously defined events Startup Alarm Select the trigger that activates the alarm The possible options are Rising Alarm A rising counter value triggers the alarm Falling Alarm A falling counter value triggers the alarm Rising and Falli...

Page 631: ...ce Alarm CLI Commands CLI Command Description rmon alarm index MIB_Object_ID interval rthreshold fthreshold revent fevent type type startup direction owner name no rmon alarm index Configures RMON alarm conditions Use the no form of this command to remove an alarm show rmon alarm table Displays summary of the alarm table show rmon alarm number Displays the RMON alarm configuration ...

Page 632: ...wing is an example of the CLI commands console config rmon alarm 1000 1 3 6 1 2 1 2 2 1 10 1 360000 1000000 1000000 10 20 console show rmon alarm table Index 123 OID 1 3 6 1 2 1 2 2 1 10 1 1 3 6 1 2 1 2 2 1 10 1 1 3 6 1 2 1 2 2 1 10 9 Owner CLI Manager CLI ...

Page 633: ... as charts It contains the following topics Ports LAGs CPU Utilization Ports To display port statistics in chart format 1 Click Statistics RMON Charts Ports in the tree view to display the Ports page Figure 21 14 Ports 2 Select the unit ID of a unit in the stack for which you want to display statistics ...

Page 634: ...tistics Select the frame error statistics to display RMON Statistics Select the RMON statistics to display GVRP Statistics Select the GVRP statistics type to display Refresh Rate Select the amount of time that passes before the statistics are refreshed 4 To draw a chart for the selected statistics click Draw The chart for the selected statistic is displayed on the page ...

Page 635: ... the same statistics in chart form LAGs To display LAG statistics in chart format 1 Click Statistics RMON Charts LAGs in the tree view to display the LAGs page Figure 21 15 LAGs 2 Check the type of statistics to be displayed Interface Statistics Select the interface statistics to display Etherlike Statistics Select the frame error statistics to display RMON Statistics Select the RMON statistics to...

Page 636: ...s for viewing LAG statistics Table 21 11 LAG Statistic CLI Commands CLI Command Description show interfaces counters gigabitethernet tengigabitet hernet interface port channel LAG number Displays traffic seen by the physical interface show rmon statistics gigabitethernet tengigabitet hernet interface port channel LAG number Displays RMON Ethernet statistics show gvrp statistics gigabitethernet ten...

Page 637: ...sole show rmon statistics gi1 0 1 Port gi1 0 1 Dropped 0 Octets 0 Packets 0 Broadcast 0 Multicast 0 CRC Align Errors 0 Collisions 0 Undersize Pkts 0 Oversize Pkts 0 Fragments 0 Jabbers 0 64 Octets 0 65 to 127 Octets 1 128 to 255 Octets 1 256 to 511 Octets 1 512 to 1023 Octets 0 1024 to max Octets 0 ...

Page 638: ...ach unit in the stack Each unit in the stack is assigned a color on the graph To display CPU utilization in chart format 1 Click Statistics RMON Charts CPU Utilization in the tree view to display the CPU Utilization page Figure 21 16 CPU Utilization 2 Select the Refresh Rate to specify how frequently the statistics should be refreshed 3 The CPU utilization chart is displayed ...

Page 639: ...the CLI commands for viewing CPU utilization The following is an example of the CLI commands Table 21 12 CPU Utilization CLI Commands CLI Command Description show cpu utilization Displays CPU utilization console show cpu utilization CPU utilization service is on CPU utilization five seconds 5 one minute 3 five minutes 3 ...

Page 640: ...ms User Guide 640 22 Quality of Service This section provides information for configuring Quality of Service QoS It contains the following topics QoS Features and Components General QoS Basic Mode QoS Advanced Mode QoS Statistics ...

Page 641: ... are sent to a particular queue for handling as a function of the traffic class to which they belong Other Traffic Class Handling Attribute Applies QoS mechanisms to various classes including bandwidth management QoS Modes A single QoS mode is selected and applies to all interfaces in the system The modes are Basic Mode Class of Service CoS Traffic is divided into classes that determine how it is ...

Page 642: ...de all traffic is mapped to a single best effort queue so that no type of traffic is prioritized over another Only a single mode can be active at a time When the system is configured to work in QoS Advanced mode settings for QoS Basic mode are not active and vice versa When the QoS mode is changed the following occurs When changing from Advanced mode to any other mode policy profile definitions an...

Page 643: ...operties Queue Mapping to Queue Bandwidth TCP Congestion Avoidance QoS Mode To enable disable the QoS mode 1 Click Quality of Service General QoS Mode in the tree view to display the QoS Mode page Figure 22 1 QoS Mode 2 Select the QoS Mode The possible options are Basic QoS is enabled in Basic mode on the switch ...

Page 644: ...ing CLI Commands The following table summarizes the CLI commands for setting the QoS mode The following is an example of the CLI commands Table 22 1 QoS Mode CLI Commands CLI Command Description qos basic advanced no qos Enables QoS on the device Use the no form of this command to disable QoS on the device show qos Displays the QoS mode console config qos basic ...

Page 645: ...rties in the tree view to display the QoS Properties Summary page Figure 22 2 QoS Properties Summary The default CoS values for all interfaces on the selected unit are displayed 2 To modify the CoS value for an interface click Edit and enter the fields Interface Select a port or LAG if required Set Default CoS Enter the default CoS tag value for untagged packets ...

Page 646: ...ransmitted thus providing the highest level of priority of traffic to the lowest numbered queue Weighted Round Robin WRR In WRR mode the number of packets sent from the queue is proportional to the weight of the queue the higher the weight the more frames are sent For example if all eight queues are WRR and the default weights are used queue 1 receives 1 15 of the bandwidth assuming all queues are...

Page 647: ...owing is true if some queues are assigned strict priority and others are assigned WRR If one queue is assigned strict priority all higher queues are also assigned strict priority Conversely if a queue is assigned a WRR weight all lower queues must also have a WRR weight assigned to them In the above case traffic for the strict priority queues is always sent before traffic from the WRR queues Traff...

Page 648: ... Enter the parameters for the queues Strict Priority Check to indicate that traffic scheduling for the selected queue and all higher queues is based strictly on the queue priority WRR Check to indicate that traffic scheduling for the selected queue is based on WRR The time period is divided between the WRR queues that are not empty meaning they have descriptors to egress This happens only if stric...

Page 649: ...on provides information for mapping DSCP and CoS values to service queues and contains the following topics CoS to Queue DSCP to Queue Table 22 3 Queue Setting CLI Commands CLI Command Description priority queue out num of queues number of queues no priority queue out num of queues Configures the number of expedite queues Use the no form of this command to restore the default configuration wrr que...

Page 650: ...kets the CoS priority is the default CoS priority assigned to ingress ports By changing CoS to Queue mapping Queue schedule method and bandwidth allocation it is possible to achieve the desired quality of services in a network The CoS to Queue mapping is applicable only if one of the following exists The switch is in QoS Basic mode and CoS is the trusted mode The switch is in QoS Advanced mode and...

Page 651: ...eneral CoS to Queue in the tree view to display the CoS to Queue page Figure 22 4 CoS to Queue The CoS queue mappings are displayed 2 Enter the fields Class of Service The CoS priority tag values where zero is the lowest priority and 7 is the highest priority Queue The queue to which the CoS priority is mapped ...

Page 652: ...apping the Queue schedule method and bandwidth allocation it is possible to achieve improved quality of service in a network The DSCP to Queue mapping is applicable to IP packets when The switch is in Basic mode and DSCP is the trusted mode The switch is in Advanced mode and the packets belongs to flows that are DSCP trusted Non IP packets are always classified to the best effort queue Table 22 4 ...

Page 653: ...he DSCP to Queue page Figure 22 5 DSCP to Queue The DSCP values in the incoming packet and its associated queues are displayed 2 Enter the fields DSCP In The values of the DSCP field in the incoming packet Queue The queue to which packets with the specific DSCP value is assigned The values are 1 8 where 1 is the lowest value and 8 is the highest ...

Page 654: ... above this limit is discarded Egress Shaping Rates is defined by the following Committed Information Rate CIR sets the average maximum amount of data allowed to be sent on the egress interface measured in bits per second Committed Burst Shape CBS sets the maximum burst of data that is allowed to be sent even though it is above the CIR This is defined in number of bytes of data Table 22 5 DSCP to ...

Page 655: ...22 6 Bandwidth Summary The ingress and egress rates are displayed for all ports on the selected unit 2 To set interface parameters click Edit 3 Select an interface and enter the fields Enable Ingress Rate Limit Enable disable ingress traffic limit for the interface If this field is selected enter the Ingress Rate Limit Ingress Rate Limit Enter the ingress traffic limit for the interface ...

Page 656: ...n number of bytes of data Configuring Bandwidth Using CLI Commands The following table summarizes the CLI commands for configuring fields in the Bandwidth pages The following is an example of the CLI commands Table 22 6 Bandwidth CLI Commands CLI Command Description traffic shape committed rate committed burst no traffic shape Sets shaper on egress port Use no form in order to disable the shaper r...

Page 657: ...e count To configure TCP congestion avoidance 1 Click Quality of Service General TCP Congestion Avoidance in the tree view to display the TCP Congestion Avoidance page NOTE TCP Congestion Avoidance increases network reliability but it also increases network traffic Continue only if you are sure it will improve overall network performance For this change to be effective you must save the configurat...

Page 658: ...age The following is an example of the CLI commands Table 22 7 TCP Congestion Avoidance CLI Commands CLI Command Description qos wrr queue wrtd no qos wrr queue wrtd Enables Weighted Random Tail Drop WRTD Use the no form of this command to disable WRTD console config qos wrr queue wrtd This setting will take effect only after copying running configuration to startup configuration and resetting the...

Page 659: ... done in the ingress of the trusted domain Workflow to Configure Basic Mode To configure Basic QoS mode perform the following 1 Select Basic mode for the system in the QoS Mode page 2 Select the trust behavior in the Global Settings page 3 If there is any port that as an exception should not trust the incoming CoS mark disable the QoS state on that port in the Interface Settings pages If a port is...

Page 660: ...tive when the QoS mode is Basic Packets entering a QoS domain are classified at the edge of the QoS domain For more information on setting Trust mode on an interface see Interface Settings on page 664 To define Trust configuration 1 Click Quality of Service QoS Basic Mode Global Settings in the tree view to display the Global Settings page Figure 22 8 Global Settings ...

Page 661: ... values set in the DSCP to Queue page When this field is enabled the switch uses the new DSCP values to select the egress queue Assigning Global Settings Using CLI Commands The following table summarizes the CLI commands for configuring fields in the Global Settings page The following is an example of the CLI commands Table 22 8 Global Settings CLI Commands CLI Command Description qos trust cos ds...

Page 662: ...ty of traffic used in the first domain As an example assume that there are three levels of service Silver Gold and Platinum The DSCP incoming values used to mark these levels are 10 20 and 30 respectively If this traffic is forwarded to another service provider that has the same three levels of service but uses DSCP values 16 24 and 48 the values set in the DSCP Rewrite page are used to change the...

Page 663: ...werConnect 55xx Systems User Guide 663 To map DSCP In values to DSCP Out values 1 Click Quality of Service QoS Basic Mode DSCP Rewrite in the tree view to display the DSCP Rewrite page Figure 22 9 DSCP Rewrite ...

Page 664: ...as follows QoS Trust State Disabled on an Interface All inbound traffic on the port is mapped to the best effort queue and no classification prioritization takes place QoS Trust State Enabled on an Interface Port prioritized traffic on ingress is based on the system wide configured trusted mode which is either CoS Trusted mode or DSCP Trusted mode Table 22 9 DSCP Rewrite CLI Commands CLI Command D...

Page 665: ...Mode Interface Settings in the tree view to display the Interface Settings Summary page Figure 22 10 Interface Settings Summary Trust mode is displayed for each interface on the selected unit 2 To change the QoS trust state for an interface click Edit and select an interface on a unit 3 Enable disable the QoS Trust State ...

Page 666: ...e the no form of this command to disable the trust state on each port show qos interface buffers queueing policers shapers rate limit interface id Displays QoS information on the interface console config interface gi1 0 15 console config if qos trust Table 22 11 Sample CLI Script to Configure QoS Basic Mode CLI Command Description console configure console config qos basic Enable QoS in Basic mode...

Page 667: ...Guide 667 console config interface gi1 0 1 Enter Interface mode on port gi1 0 1 console config if service acl input mac1 Bind MAC1 to port gi1 0 1 Table 22 11 Sample CLI Script to Configure QoS Basic Mode Continued CLI Command Description ...

Page 668: ...ame quality of service action A policy can contain one or more flows each with a user defined QoS action The QoS of a class map flow may be enforced by the associated policer There are two type of policers as described in Defining Class Mapping Using CLI Commands on page 674 Per flow QoS actions are applied to flows by binding the policy maps to the desired ports A policy map and its class maps ca...

Page 669: ...ps on page 682 Set DSCP CoS Policy Class Maps on page 682 Set Queue DSCP Mapping on page 670 Binding Combination of rules and actions that are bound to one or more interfaces Workflow to Configure Advanced QoS Mode To configure Advanced QoS mode perform the following 1 Select Advanced mode for the system in the QoS Mode page 2 If external DSCP values are different from those used on incoming packe...

Page 670: ... specify the action to take when the amount of traffic in the flow s exceeds the QoS specified limits The portion of the traffic that causes the flow to exceed its QoS limit is referred to as out of profile packets If the exceed action is Remark DSCP as opposed to Drop the switch rewrites the original DSCP value of the out of profile IP packets to a new value based on the values entered in the DSC...

Page 671: ...QoS Advanced Mode DSCP Mapping to display the DSCP Mapping page Figure 22 11 DSCP Mapping 2 If the Exceed Action is Out of Profile in the Policy Class Maps page or Remark DSCP in the Aggregate Policy page the DSCP In values are rewritten with the DSCP Out values Set the DSCP Out values as required ...

Page 672: ...ed class map is the action performed by the system Packets that match the same class map belong to the same flow There are two possible types of matching match all Traffic matches class map if it matches IP IPV6 and MAC ACLs match any Traffic matches class map if it matches at least one of the ACLs If a more complex set of rules is needed several class maps can be grouped into a super group called...

Page 673: ... Mapping Summary The previously defined class maps are displayed 2 To add a class map click Add A new class map is added by selecting one or two ACLs and assigning them a class map name If a class map has two ACLs specify that a frame must match both ACLs or that it must match either one or both of the ACLs selected 3 Enter the parameters Class Map Name Enter the name of a new class map ...

Page 674: ...s map MAC ACL Select the MAC based ACL for the class map Preferred ACL Select whether packets are first matched to an IP based ACL or a MAC based ACL Defining Class Mapping Using CLI Commands The following table summarizes the CLI commands for setting the fields in the Class Mapping pages Table 22 13 Class Mapping CLI Commands CLI Command Description class class map name access group acl name no c...

Page 675: ...acl name Defines the match criteria for classifying traffic Use the no form of this command to delete the match criteria show class map class map name Displays information about the class map console config qos advanced console config class map class1 match all console config cmap match access group enterprise console config cmap do show class map class1 Class Map matchAll class1 Match access grou...

Page 676: ... An aggregate policer applies QoS to one or more class maps and to one or more flows An aggregation policer can support class maps from various policies An aggregate policer applies QoS to all its flow s in aggregation regardless of policies and ports An aggregate policer is created in the Aggregate Policer pages An aggregate policer is defined if the policer is to be shared with more than one cla...

Page 677: ...ng aggregate policers are displayed 2 To add an aggregate policer click Add and enter the fields Aggregate Policer Name Enter the name of the Aggregate Policer Committed Information Rate CIR Enter the maximum bandwidth allowed in bits per second See the description of this field in Bandwidth on page 654 Committed Burst Size CBS Enter the maximum burst size even if it goes beyond the CIR in bytes S...

Page 678: ...I Commands The following table summarizes the CLI commands for setting the fields in the Aggregate Policer pages The following is an example of the CLI commands Table 22 14 Aggregate Policer CLI Commands CLI Command Description qos aggregate policer aggregate policer name committed rate kbps excess burst byte exceed action drop policed dscp transmit no qos aggregate policer aggregate policer name ...

Page 679: ...rs Policy Table A policy can consist of one of the following One or more class maps of ACLs that define the traffic flows in the policy One or more aggregate policers that apply the QoS to the traffic flows in the policy Table 22 15 Aggregate Policer CLI Commands CLI Command Description qos aggregate policer aggregate policer name committed rate kbps excess burst byte exceed action drop policed ds...

Page 680: ...dded in the Policy Table pages To create a QoS policy 1 Click Quality of Service QoS Advanced Mode Policy Table to display the Policy Table Summary page Figure 22 14 Policy Table Summary The previously defined policies are displayed 2 To create a policy click Add 3 Enter the name of the new policy in the Policy Name field 4 Add class maps to the new policy in the Policy Class Maps page ...

Page 681: ...elds in the Policy Table page The following is an example of the CLI commands Table 22 16 Policy Table CLI Commands CLI Command Description policy map policy map name no policy map policy map name Creates a policy map and enters the Policy map Configuration mode Use the no form of this command to delete a policy map console config policy map policy1 ...

Page 682: ...affic flow To add a class map to a policy 1 Click Quality of Service QoS Advanced Mode Policy Class Maps to display the Policy Class Maps Summary page Figure 22 15 Policy Class Maps Summary 2 Select a policy in the Policy Name field The class maps in that policy are displayed 3 To add a class map click Add 4 Enter the parameters Policy Name Select the policy to which the class map is being added ...

Page 683: ...selected enter a New Value which determines the egress queue of the matching packets DSCP If DSCP is selected the new DSCP value and the DSCP to Queue mapping determines the egress queue of the matching packets Queue If Queue is selected the new value is the egress queue number for all matching packets CoS If CoS is selected the CoS priority value and the CoS to Queue mapping determines the egress...

Page 684: ... Policy Class Maps CLI Commands CLI Command Description class class map name access group acl name no class class map name Defines a traffic classification and enters the Policy map Class Configuration mode Use the no form of this command to detach a class map from the policy map trust cos dscp no trust Configures the trust state which selects the value that QoS uses as the source of the internal ...

Page 685: ...e no form of this command to remove an existing aggregate policer show policy map policy map name Displays all policy maps or a specific policy map console config policy map policy1 console config pmap class class1 access group enterprise console config pmap trust cos dscp console config pmap set dscp 56 console config pmap class class1 console config pmap c police 124000 9600 exceed action drop c...

Page 686: ...ingle policy can be bound to more than one interface When a policy is bound to an interface it filters and applies QoS to ingress traffic that belongs to the flows defined in the policy The policy does not apply to traffic egress to the same port To edit a policy it must first be removed unbound from all those ports to which it is bound To define policy binding 1 Click Quality of Service QoS Advan...

Page 687: ...Using CLI Commands The following table summarizes the CLI commands for setting the fields in the Policy Binding pages The following is an example of the CLI commands Table 22 18 Policy Binding CLI Commands CLI Command Description service policy input policy map name no service policy input Applies a policy map to the input of a particular interface Use the no form of this command to detach a polic...

Page 688: ...Dell PowerConnect 55xx Systems User Guide QoS Statistics This section describes how to view and manage QoS statistics It contains the following topics Policer Statistics Aggregated Policer Queues Statistics ...

Page 689: ...file and out of profile packets received from an interface that meet the conditions defined in the class map of a policy To view policer statistics 1 Click Quality of Service QoS Statistics Policer Statistics to display the Policer Statistics Summary page Figure 22 17 Policer Statistics Summary The following statistics for the previously defined counters are displayed Interface Statistics are disp...

Page 690: ...Policer Statistics Using CLI Commands The following table summarizes the CLI commands for setting the fields in the Policer Statistics pages The following is an example of the CLI commands Table 22 19 Policer Statistics CLI Commands CLI Command Description qos statistics policer policy map name class map name no qos statistics policer policy map name class map name Enables counting in profile and ...

Page 691: ...ummary page Figure 22 18 Aggregate Policer Summary The following statistics for the previously defined counters are displayed Aggregate Policer Name Policer on which statistics are based In Profile Bytes Number of in profile packets that were received Out of Profile Bytes Number of out of profile packets that were received 2 To add a new counter that applies to another aggregate policer click Add ...

Page 692: ... dropped packets based on interface queue and drop precedence Lowest drop precedence has the lowest probability of being dropped Table 22 20 Aggregate Policer Statistics CLI Commands CLI Command Description qos statistics aggregate policer aggregate policer name no qos statistics aggregate policer aggregate policer name Enables counting in profile and out of profile bytes vis a vis an aggregate po...

Page 693: ...to display the Queues Statistics Summary Figure 22 19 Queues Statistics Summary The statistics for previously defined counters are displayed Counter Set Number of counter Port Number of port Queue Number of queue Total Packets Number of packets forwarded or tail dropped Tail Drop Packets Percentage of packets that were tail dropped ...

Page 694: ...rwarded or tail dropped Defining QoS Statistics Using CLI Commands The following table summarizes the CLI commands for setting the fields in the QoS Statistics pages The following is an example of the CLI commands Table 22 21 QoS Statistics CLI Commands CLI Command Description qos statistics queues set number queue all dp all gigabitethernet tengigabitethe rnet port number all no qos statistics qu...

Page 695: ...P subnets ACL Access Control List Allow network managers to define classification actions and rules for specific ingress ports Aggregated VLAN Groups several VLANs into a single aggregated VLAN Aggregating VLANs enables routers to respond to ARP requests for nodes located on different sub VLANs belonging to the same Super VLAN Routers respond with their MAC address ARP Address Resolution Protocol ...

Page 696: ...itch module Backup Configuration Files Contains a backup copy of the switch module configuration The Backup file changes when the Running Configuration file or the Startup Configuration file is copied to the Backup file Bandwidth Bandwidth specifies the amount of data that can be transmitted in a fixed amount of time For digital switch modules bandwidth is defined in Bits per Second bps or Bytes p...

Page 697: ...specific however they are protocol independent Bridges operate at Layer 1 and Layer 2 levels Broadcast Domain device sets that receive Broadcast frames originating from any device within a designated set Routers bind Broadcast domains because routers do not forward Broadcast frames Broadcasting A method of transmitting packets to all ports on a network Broadcast Storm An excessive amount of Broadc...

Page 698: ... the CLI Communities Specifies a group of users which retains the same system access rights CPU Central Processing Unit The part of a computer that processes information CPUs are composed of a control unit and an ALU D DHCP Client A device using DHCP to obtain configuration parameters such as a network address DHCP Snooping DHCP Snooping expands network security by providing firewall security betw...

Page 699: ...figured on the RADIUS server E Egress Ports Ports from which network traffic is transmitted End System An end user device on a network Ethernet Ethernet is standardized as per IEEE 802 3 Ethernet is the most common implemented LAN standard Supports data transfer rates of Mpbs where 10 100 or 1000 Mbps is supported EWS Embedded Web Server Provides device management via a standard web browser Embedd...

Page 700: ...ains from sending packets Fragment Ethernet packets smaller than 576 bits Frame Packets containing the header and trailer information required by the physical medium G GARP General Attributes Registration Protocol Registers client stations into a Multicast domain Gigabit Ethernet Gigabit Ethernet transmits at 1000 Mbps and is compatible with existing 10 100 Mbps Ethernet standards GVRP GARP VLAN R...

Page 701: ...panning Tree Protocol IEEE 802 1d supports MAC bridging to avoid network loops IEEE 802 1p Prioritizes network traffic at the data link MAC sublayer IEEE 802 1Q Defines the operation of VLAN Bridges that permit the definition operation and administration of VLANs within Bridged LAN infrastructures IGMP Snooping IGMP Snooping examines IGMP frame contents when they are forwarded by the device from w...

Page 702: ...ra Site Automatic Tunnel Addressing Protocol ISATAP is an automatic overlay tunneling mechanism that uses the underlying IPv4 network as a non Broadcast multicast access link layer for IPv6 ISATAP is designed for transporting IPv6 packets within a site where a native IPv6 infrastructure is not yet available L LAG Link Aggregated Group Aggregates ports or VLANs into a single virtual port or VLAN Fo...

Page 703: ...e incoming packets evenly to all servers or redirect the packets to the next available server M MAC Address Media Access Control Address The MAC Address is a hardware specific address that identifies each network node MAC Address Learning MAC Address Learning characterizes a learning bridge in which the packet s source MAC address is recorded Packets destined for that address are forwarded only to...

Page 704: ...t Interface with Crossover MDIX A cable used for hubs and switches MIB Management Information Base MIBs contain information describing specific aspects of network components Multicast Transmits copies of a single packet to multiple ports N NA Neighbor Advertisement ND Neighbor Discovery NS Neighbor Solicitation NMS Network Management System An interface that provides a method of managing a system ...

Page 705: ...cket Internet Groper Verifies if a specific IP address is available A packet is sent to another IP address and waits for a reply Port Physical ports provide connecting components that allow microprocessors to communicate with peripheral equipment Port Mirroring Monitors and mirrors network traffic by forwarding copies of incoming and outgoing packets from one port to a monitoring port For more inf...

Page 706: ...s and tracking connection time RMON Remote Monitoring Provides network information to be collected from a single workstation Router A device that connects to separate networks Routers forward packets between two or more networks Routers operate at a Layer 3 level RSTP Rapid Spanning Tree Protocol Detects and uses network topologies that allow a faster convergence of the spanning tree without creat...

Page 707: ...rk switch clock time synchronization up to the millisecond SoC System on a Chip An ASIC that contains an entire system For example a telecom SoC application can contain a microprocessor digital signal processor RAM and ROM Spanning Tree Protocol Prevents loops in network traffic The Spanning Tree Protocol STP provides tree topography for any arrangement of bridges STP provides one path between end...

Page 708: ... two hosts to communicate and exchange data streams TCP guarantees packet delivery and guarantees packets are transmitted and received in the order their sent Telnet Terminal Emulation Protocol Enables system users to log in and use resources on remote networks TFTP Trivial File Transfer Protocol Uses User Data Protocol UDP without security features to transfer files Trap A message sent by the SNM...

Page 709: ...ther than defining a hardware solution VoIP Voice over IP W WAN Wide Area Networks Networks that cover a large geographical area Wildcard Mask Specifies which IP address bits are used and which bits are ignored A wild switch module mask of 255 255 255 255 indicates that no bit is important A wildcard of 0 0 0 0 indicates that all the bits are important ...

Page 710: ...CLI 67 ACE IPv4 105 ACL binding 118 ACL IPv4 104 ACL IPv6 113 ACLs 30 98 Active users 268 Address pool 294 Address Resolution Protocol 242 695 Address Tables 416 Administrator Buttons 87 Advanced QoS 24 Advanced Switch Configuration 63 Aggregate Policer 676 691 Aggregated VLAN 695 Alarms 628 Anycast 171 176 Apply Save 87 ARP 242 244 695 ARP inspection 30 ARP dynamic inspection 551 ARP dynamic insp...

Page 711: ...oups 513 Bridge Protocol Data Unit 697 Broadcast 172 176 Broadcast Storm Control 19 Buttons 36 C Cables testing 249 CBC 308 Cipher Block Chaining 308 Class Mapping 672 Class of Service 698 Classic lock 93 Classic STP 429 CLI 26 64 67 254 CLI macro 30 Clock Source 174 Command Line Interface 26 Command Mode Overview 64 Configuration file 348 Configuration file download 346 Configuration using the Se...

Page 712: ...92 DHCP server properties 291 DHCP server retreiving an IP address 68 DHCP Snooping 30 564 DHCP global parameters 566 DHCP trusted interfaces 572 DHCP VLAN settings 570 DiffServe Code Point 698 DNS 27 235 Domain 698 Domain Name System 27 235 Dot1x 28 Dot1x Authentication 127 Download boot image 81 Download system image 79 Download TFTP 347 Download USB HTTP 345 Downloading software 76 330 DSCP 698...

Page 713: ...s 155 Fast Forward Table 699 Fast link 22 436 441 FFT 699 FIFO 699 File information 359 Filtering 470 476 509 Filtering L2 Multicast Packets 509 Firmware download 346 First In First Out 700 Flapping 700 Flow Control 380 700 Flow Control Support IEEE 802 3X 16 Flow Monitoring sflow 25 Forwarding L2 Multicast Packets 509 Fragment 700 Frame 700 Frame Flow 461 Front Panel 35 Full 802 1Q VLAN Tagging C...

Page 714: ...e mapping 240 HTTP 254 262 279 701 HTTP password configuring 73 HTTPS 254 257 262 279 HyperText Transport Protocol 701 I IC 701 ICMP 701 Icons 87 Identifying a switch via LED 32 IEEE 701 IEEE 802 1d 701 IEEE 802 1p 701 IEEE 802 1Q 20 701 IEEE 802 1s Multiple Spanning Tree 22 IEEE 802 1w Rapid Spanning Tree 22 IGMP 510 IGMP Snooping 19 519 701 Image file 701 Image files active 354 Information Butto...

Page 715: ... 702 Layer 2 702 Layer 2 Features 19 Layer 2 Switching 509 Layer 3 702 LED Definitions 38 LEDs 36 40 LEDs on Front Panel 36 Light Emitting Diodes 38 Limited dynamic lock 93 Line passwords 272 Link Aggregated Group 702 Link aggregation 23 500 502 Link Aggregation and LACP 23 Link Control Protocol LCP packets 393 445 Link Layer Discovery Protocol Media Endpoint Discovery 703 Link Duplex Activity LED...

Page 716: ... Logs 188 Loops 429 M MAC Address Capacity Support 17 MAC address learning 703 MAC addresses 93 703 MAC addresses supported features 17 MAC Layer 703 MAC Multicast Support 18 Mac based ACE 101 Mac based ACL 99 Management Access Lists 255 Management Access Methods 265 Management Information Base 307 704 Management IP Address Conflict Notification 25 Management methods 257 Management security 254 Ma...

Page 717: ...ols 393 445 Network Management System 704 Network pool 296 NMS 704 NS 704 O Object ID 308 OID 308 Optical transciever diagnostics 251 Option 82 578 OUI 497 P Packets 705 Password configuration 71 Password management 29 279 Password recovery 78 Passwords 84 275 Path Cost 432 PDU 705 PING 705 PoE 15 157 Policer Statistics 689 Policers 675 Policy Binding 686 Policy Table 679 Port 705 Port Configurati...

Page 718: ...Ports 481 Protocol VLAN Edge 705 PVE 705 PVID 468 475 Q QinQ 462 QoS 23 646 706 QoS Advanced mode 666 QoS Basic mode 660 QoS Modes 643 QoS Properties 645 QoS Advanced Mode Workflow 669 QoS Aggregate Policer 676 QoS assignment to hardware queues 641 QoS Bandwidth 654 QoS Basic mode 659 QoS Basic Mode Workflow 659 QoS Class Mapping 672 QoS DSCP Mapping 670 QoS DSCP Rewrite 661 QoS DSCP to Queue 652 ...

Page 719: ...emote Log Server 199 Remote Monitoring 26 706 Reset button 36 Retrieving an IP Address 68 RMON 615 618 619 706 RMON Statistics 615 616 Router Solicitation 706 Routes Table IPv6 232 RS 706 RS 232 Console Port 35 RSTP 22 444 706 Rules 255 Running Configuration File 330 706 S Secure Shell 284 Secure Telnet SSH 254 265 Security Features 28 Security Management 71 Segmentation 707 Selecting the Master a...

Page 720: ...79 707 SSH password configuring 73 SSL 28 Stack ID LED 42 Stack management 44 361 Stack Menu 78 Stack Support 15 Stacking 44 Stacking failover topology 47 Stacking adding a unit to the stack 48 Stacking assigning unit IDs 48 Stacking automatic assignment of unit IDs 48 Starting the Application 84 Startup Configuration 330 707 Startup file 330 Startup Menu 76 Static addresses 418 419 Static hosts 3...

Page 721: ... LEDs 38 T Table Views 597 TACACS 29 264 275 TCP Congestion Avoidance 24 656 TCP IP 708 TDR technology 249 Telnet 254 257 262 265 273 279 284 708 Telnet Connection 67 Telnet password configuring 72 Terminal Access Controller Access Control System 275 Terminal Connection 68 TFTP 26 708 Time Domain Reflectometry 249 Time range 122 Time range absolute 123 Time range recurring 124 Time synchronization...

Page 722: ...Protocol 708 User Security Model 307 Using Dell OpenManage Switch Administrator 83 Using the CLI 64 USM 307 Utilization Summary 600 V Ventilation System 38 Versions hardware software 364 Virtual Local Area Networks 709 VLAN 20 459 465 466 517 709 VLAN frame flow 461 VLAN membership 465 VLAN settings DHCP 570 VLAN Support 20 VLAN to MSTP Instance 452 VLAN ARP settings 559 VLAN LAG settings 474 VLAN...

Page 723: ...723 FILE LOCATION C Users gina Desktop Checkout_new Maintenance Projects Dell Contax Dell_ContaxUG_PrintIX fm DELL CONFIDENTIAL PRELIMINARY 5 7 12 FOR PROOF ONLY X XG Ports 35 ...

Page 724: ...724 FILE LOCATION C Users gina Desktop Checkout_new Maintenance Projects Dell Contax Dell_ContaxUG_PrintIX fm DELL CONFIDENTIAL PRELIMINARY 5 7 12 FOR PROOF ONLY ...

Page 725: ...725 FILE LOCATION C Users gina Desktop Checkout_new Maintenance Projects Dell Contax Dell_ContaxUG_PrintIX fm DELL CONFIDENTIAL PRELIMINARY 5 7 12 FOR PROOF ONLY ...

Page 726: ...726 FILE LOCATION C Users gina Desktop Checkout_new Maintenance Projects Dell Contax Dell_ContaxUG_PrintIX fm DELL CONFIDENTIAL PRELIMINARY 5 7 12 FOR PROOF ONLY ...

Page 727: ...clearly Fixed RDP description A4 April 2 2012 Following corrections made Add description regarding the Egress ACL feature Enter comments regarding the PVLAN feature Fixed RDP abbreviation to Reliable Data Protocol in ACL section Add the recommendation of using HDMI cable version to 1 4 for stacking A3 Jan 31 2012 Corrected command in private VLAN CLI command A2 Sept 21 2011 Entered comment that en...

Page 728: ......

Search results

Summary of Contents for POWERCONNECT 5524

Reviews:

Related manuals for POWERCONNECT 5524

Brands by name

Popular brands

Dell POWERCONNECT 5524, User Manual

Search results

Summary of Contents for POWERCONNECT 5524

Reviews:

Related manuals for POWERCONNECT 5524

Brands by name

Popular brands