manualshive.com logo in svg

Belden Hirschmann Rail Switch Power Lite, Руководство пользователя

Поделиться
Скачать
Belden Hirschmann Rail Switch Power Lite Скачать руководство пользователя страница 57

Spanning Tree

UM RedundConfig RSPL

Release 2.0 02/2013

3.6 Guards

57

3.6 Guards

The device allows you to activate various protection functions (guards) on the 
device ports.
The following protection functions help protect your network from incorrect 
configurations, loops and attacks with STP-BPDUs:

BPDU Guard – for manually defined terminal device ports (edge ports)
You activate this protection function globally in the device.

Terminal device ports do not normally receive any STP-BPDUs. If an 
attacker still attempts to feed in STP-BPDUs at this port, the device 
deactivates the device port.

Содержание Hirschmann Rail Switch Power Lite

Страница 1: ...UM RedundConfig RSPL Release 2 0 02 2013 Technical Support https hirschmann support belden eu com User Manual Redundancy Configuration Rail Switch Power Lite RSPL ...

Страница 2: ...ance features described here are binding only if they have been expressly agreed when the contract was made This document was produced by Hirschmann Automation and Control GmbH according to the best of the company s knowledge Hirschmann reserves the right to change the contents of this document without prior notice Hirschmann can give no guarantee in respect of the correctness or accuracy of the i...

Страница 3: ...5 Example Configuration 18 3 Spanning Tree 29 3 1 Basics 31 3 1 1 The tasks of the STP 31 3 1 2 Bridge parameters 32 3 1 3 Bridge Identifier 32 3 1 4 Root Path Cost 33 3 1 5 Port Identifier 34 3 1 6 Max Age and Diameter 35 3 2 Rules for Creating the Tree Structure 37 3 2 1 Bridge information 37 3 2 2 Setting up the tree structure 38 3 3 Examples 40 3 3 1 Example of determining the root path 40 3 3...

Страница 4: ...ree Priority Vector 49 3 4 4 Fast reconfiguration 49 3 4 5 STP compatibility mode 50 3 5 Configuring the device 51 3 6 Guards 57 3 6 1 Activating the BPDU Guard 61 3 6 2 Activating Root Guard TCN Guard Loop Guard 64 A Readers Comments 66 B Index 69 C Further Support 71 ...

Страница 5: ... display and the other information that you need to install the device The Basic Configuration user manual contains the information you need to start operating the device It takes you step by step from the first startup operation through to the basic settings for operation in your environment The Redundancy Configuration user manual document contains the information you require to select the suita...

Страница 6: ...provides you with additional options for smooth configuration and monitoring Simultaneous configuration of multiple devices Graphical user interface with network layout Auto topology discovery Event log Event handling Client server structure Browser interface ActiveX control for SCADA integration SNMP OPC gateway ...

Страница 7: ...Work step Subheading Link Cross reference with link Note A note emphasizes an important fact or draws your attention to a dependency Courier ASCII representation in user interface Execution in the Graphical User Interface Execution in the Command Line Interface WLAN access point Router with firewall Switch with firewall Router Switch ...

Страница 8: ...Key 8 UM RedundConfig RSPL Release 2 0 02 2013 Bridge Hub A random computer Configuration Computer Server PLC Programmable logic controller I O Robot ...

Страница 9: ...t the communication is maintained when a connection fails you install additional physical connections between the network nodes Redundancy protocols ensure that the additional connections remain switched off while the original connection is still working If the connection fails the redundancy protocol generates a new path from the sender to the receiver via the alternative connection To introduce ...

Страница 10: ...ology For networks with star or tree topologies redundancy procedures are only possible in connection with physical loop creation The result is a meshed topology Figure 2 Meshed topology Tree topology with physical loops For operating in this network topology the device provides you with the following redundancy protocols Rapid Spanning Tree RSTP ...

Страница 11: ...rks with a line topology you can use redundancy procedures by connecting the ends of the line This creates a ring topology Figure 3 Ring topology Line topology with connected ends For operating in this network topology the device provides you with the following redundancy protocols Media Redundancy Protocol MRP Rapid Spanning Tree RSTP ...

Страница 12: ...ery port If the flow control and the redundancy function are active at the same time the redundancy may not work as intended Redundancy protocol Network topology Comments MRP Ring The switching time can be selected and is practically independent of the number of devices An MRP Ring consits of up to 50 devices that support the MRP protocol according to IEC 62439 If you only use Hirschmann devices u...

Страница 13: ... standardized solution for ring redundancy in the industrial environment MRP is compatible with redundant ring coupling supports VLANs and is distinguished by very short reconfiguration times An MRP Ring consists of up to 50 devices that support the MRP protocol according to IEC 62439 If you only use Hirschmann devices up to 100 devices are possible in the MRP Ring ...

Страница 14: ...the help of the RM Ring Manager function the two ends of a backbone in a line structure can be closed to a redundant ring The ring manager keeps the redundant line open as long as the line structure is intact If a segment becomes inoperable the ring manager immediately closes the redundant line and line structure is intact again Figure 4 Line structure Figure 5 Redundant ring structure RM Ring Man...

Страница 15: ...e You define the maximum time for the reconfiguration of the line in the ring manager Possible values for the maximum delay time 500 ms 200 ms Note You only configure the reconfiguration time with a value less than 500 ms if all the devices in the ring support the shorter delay time Otherwise the devices that only support longer delay times might not be reachable due to overloading Loops can occur...

Страница 16: ... mode speeds up the link failure recognition when the ring participants inform the ring manager of interruptions in the ring via link down notifications Hirschmann devices support link down notifications Therefore you generally activate the advanced mode in the ring manager If you are using devices that do not support link down notifications the ring manager reconfigures the line in the selected m...

Страница 17: ...There is exactly 1 ring manager in the ring If you are using VLANs configure every ring port with the following settings Deactivate ingress filtering see the Switching VLAN Port dialog Define the port VLAN ID PVID see the Switching VLAN Port dialog PVID 1 if the device transmits the MRP data packets untagged VLAN ID 0 in Redundancy MRP dialog PVID any if the device transmits the MRP data packets i...

Страница 18: ...rts Figure 6 Example of MRP Ring RM Ring Manager main line redundant line The following example configuration describes the configuration of the ring manager device 1 You configure the 2 other devices 2 to 3 in the same way but without activating the ring manager function This example does not use a VLAN You have entered 200 ms as the ring recovery time and all the devices support the advanced mod...

Страница 19: ...onegotiation automatic configuration with 100 Mbit s full duplex FDX or 1000 Mbit s full duplex FDX Port type Bit rate Autonegotiation automatic configuration Port setting Duplex TX 100 Mbit s off on 100 Mbit s full duplex FDX TX 1 Gbit s on on Optical 100 Mbit s off on 100 Mbit s full duplex FDX Optical 1 Gbit s on on Table 2 Port settings for ring ports ...

Страница 20: ...cy function are active at the same time there is a risk that the redundancy function will not operate as intended Default setting flow control deactivated globally and activated on all ports Switch Spanning Tree off on all devices in the network Open the Redundancy Spanning Tree Global dialog Switch off the function In the state on delivery Spanning Tree is switched on on the device Figure 7 Switc...

Страница 21: ... sequence of 16 number blocks 8 bit values When configuring with the graphical user interface the device uses the default value 255 255 255 255 255 255 255 255 255 255 255 255 255 255 255 255 Open the Redundancy MRP dialog Define the desired ring ports Figure 8 Defining the ring ports mrp domain add default domain Creates a new MRP domain with the default domain ID mrp domain modify port primary 1...

Страница 22: ...fig RSPL Release 2 0 02 2013 Activate the ring manager For the other devices in the ring leave the setting as Off Figure 9 Activating the ring manager mrp domain modify mode manager Defines the device as the ring manager Do not activate the ring manager on any other device ...

Страница 23: ...MRP UM RedundConfig RSPL Release 2 0 02 2013 2 5 Example Configuration 23 Select the checkbox in the Advanced Mode field Figure 10 Activating the advanced mode mrp domain modify advanced mode enabled Activates the advanced mode ...

Страница 24: ...s not provide the ring stability necessary to meet the requirements of your network you select 500 ms In the Ring Recovery field select the value 200ms Figure 11 Defining the time for the ring recovery mrp domain modify recovery delay 200ms Defines 200ms as the max delay time for the reconfiguration of the ring Leave the value in the VLAN field as 0 ...

Страница 25: ...edundConfig RSPL Release 2 0 02 2013 2 5 Example Configuration 25 Switch the operation of the MRP Ring on Figure 12 Switching on the MRP function Click on Set to save the changes mrp domain modify operation enable Activates the MRP Ring ...

Страница 26: ...vices at the ends of the line via their ring ports Check the messages from the device show mrp Displays the parameters for checking The Operation field shows the operating state of the ring port Possible values forwarding Port is switched on connection exists blocked Port is blocked connection exists disabled Port is disabled not connected No connection exists Figure 13 Messages in the Operation f...

Страница 27: ...ion Configuration error Ring port link error Error in the cabling of the ring ports The following messages are possible if the device is operating as a ring manager Configuration error Packet of other ring manager received Another device exists in the ring that is operating as the ring manager Activate the Ring Manager function if there is exactly one device in the ring Configuration error Connect...

Страница 28: ...D If the MRP Ring is not assigned to a VLAN link in this example leave the VLAN ID as 0 In the Switching VLAN Static dialog define the VLAN membership as U untagged for the ring ports in VLAN 1 If the MRP Ring is assigned to a VLAN enter a VLAN ID 0 In the Switching VLAN Static dialog define the VLAN membership as T tagged for the ring ports in the selected VLAN mrp domain modify vlan 0 4042 Assig...

Страница 29: ...n of redundant connections Redundancy enables the systematic reactivation of individual connections as needed RSTP is a further development of the Spanning Tree Protocol STP and is compatible with it If a connection or a bridge becomes inoperable the STP required a maximum of 30 seconds to reconfigure This is no longer acceptable in time sensitive applications RSTP achieves average reconfiguration...

Страница 30: ...lowed in a branch Note The RSTP standard dictates that all the devices within a network work with the Rapid Spanning Tree Algorithm If STP and RSTP are used at the same time the advantages of faster reconfiguration with RSTP are lost in the network segments that are operated in combination A device that only supports RSTP works together with MSTP devices by not assigning an MST region to itself bu...

Страница 31: ...omes inoperable STP reactivates the previously deactivated path again This allows redundant links to increase the availabiliy of communication STP determines a bridge that represents the STP tree structure s base This bridge is called root bridge Features of the STP algorithm automatic reconfiguration of the tree structure in the case of a bridge becoming inoperable or the interruption of a data p...

Страница 32: ... 8 bytes The 2 highest value bytes are the priority The default setting for the priority number is 32 768 but the Management Administrator can change this when configuring the network The 6 lowest value bytes of the bridge identifier are the bridge s MAC address The MAC address allows each bridge to have unique bridge identifiers The bridge with the smallest number for the bridge identifier has th...

Страница 33: ...undant paths The root path cost is the sum of all individual costs of those paths that a data packet has to traverse from a connected bridge s port to the root bridge Figure 17 Path costs Data rate Recommended value Recommended range Possible range 100 Kbit s 200 000 000a 20 000 000 200 000 000 1 200 000 000 1 Mbit s 20 000 000a 2 000 000 200 000 000 1 200 000 000 10 Mbit s 2 000 000a 200 000 20 0...

Страница 34: ...art is the port priority which is specified by the Administrator default value 128 It also applies here that the port with the smallest number for the port identifier has the highest priority Figure 18 Port Identifier a Bridges that conform with IEEE 802 1D 1998 and only support 16 bit values for the path costs should use the value 65 535 FFFFH for path costs when they are used in conjunction with...

Страница 35: ...ons between the devices in the network that are furthest removed from each other is known as the network diameter Figure 19 Definition of diameter The network diameter that can be achieved in the network is MaxAge 1 In the state on delivery MaxAge 20 and the maximum diameter that can be achieved 19 If you set the maximum value of 40 for MaxAge the maximum diameter that can be achieved 39 1 Diamete...

Страница 36: ... STP BPDU the bridge compares the MessageAge counter with the MaxAge value defined in the device If MessageAge MaxAge the bridge forwards the STP BPDU to the next bridge If MessageAge MaxAge the bridge discards the STP BPDU Figure 20 Transmission of an STP BPDU depending on MaxAge Message Age 0 MaxAge 5 Root Bridge Message Age 1 Message Age 2 Message Age 3 Message Age 4 Message Age 5 Message Age 5...

Страница 37: ... 2 1 Bridge information To determine the tree structure the bridges need more detailed information about the other bridges located in the network To obtain this information each bridge sends a BPDU Bridge Protocol Data Unit to the other bridges The contents of a BPDU include bridge identifier root path costs and port identifier see IEEE 802 1D ...

Страница 38: ...e bridge identifiers of the bridge closer to the root The bridge blocks the port that leads to the bridge with the numerically higher ID a numerically higher ID is the logically worse one If 2 bridges have the same priority the bridge with the numerically larger MAC address has the numerically higher ID which is logically the worse one If multiple paths with the same root path costs lead from one ...

Страница 39: ...mine root path no yes Equal priority in bridge identification Equal port priority yes Path with lowest path costs root path Path with highest port priority root path Path with highest priority in bridge identification root path no no Path with lowest port number of designated bridge root path Root path determined Use the bridge with lowest MAC address designated bridge yes ...

Страница 40: ...ge in this case bridge 1 In the example all the sub paths have the same path costs The protocol blocks the path between bridge 2 and bridge 3 as a connection from bridge 3 via bridge 2 to the root bridge would result in higher path costs The path from bridge 6 to the root bridge is interesting The path via bridge 5 and bridge 3 creates the same root path costs as the path via bridge 4 and bridge 2...

Страница 41: ... determining the root path 1 P BID 16384 2 P BID 32768 3 P BID 32768 6 P BID 32768 Port 3 7 P BID 32768 P BID 32768 Port 1 MAC 00 01 02 03 04 06 5 P BID 32768 4 Root path Interrupted path P BID Priority of the bridge identifikation BID BID without MAC Address MAC 00 01 02 03 04 05 Root Bridge ...

Страница 42: ...rotocol blocks the path between bridge 2 and bridge 3 as a connection from bridge 3 via bridge 2 to the root bridge would mean higher path costs The path from bridge 6 to the root bridge is interesting The path via bridge 5 and bridge 3 creates the same root path costs as the path via bridge 4 and bridge 2 The bridges select the path via bridge 4 because the value 28 672 for the priority in the br...

Страница 43: ...ples 43 Figure 23 Example of manipulating the root path 1 P BID 16384 2 P BID 32768 3 P BID 32768 5 P BID 28672 6 P BID 32768 7 P BID 32768 4 P BID 32768 Root Bridge Root path Interrupted path P BID Priority of the bridge identifikation BID BID without MAC Address ...

Страница 44: ...dges add up If the Management Administrator configures bridge 2 as the root bridge the burden of the control packets on the subnetworks is distributed much more evenly The result is the configuration shown here see fig 24 The path costs for most of the bridges to the root bridge have decreased Figure 24 Example of manipulating the tree structure 5 P BID 32768 7 P BID 32768 P BID 32768 3 P BID 3276...

Страница 45: ...ith equally low path costs the bridge ID of the bridge that leads to the root designated bridge decides which of its ports is given the role of the root port by the bridge further removed from the root If a bridge has multiple ports with equally low path costs to the same bridge the bridge uses the port ID of the bridge leading to the root designated bridge to decide which port it selects locally ...

Страница 46: ...pid Spanning Tree Bridge Protocol Data Units Alternate port This is a blocked port that takes over the task of the bridge port if the connection to the root bridge is lost The alternate port provides a backup connection to the root bridge Backup port This is a blocked port that serves as a backup in case the connection to the designated port of this network segment without any RSTP bridges is lost...

Страница 47: ...tocol 47 Figure 25 Port role assignment Port 1 Port 2 2 BID 20480 3 BID 24576 5 BID 32768 1 BID 16384 7 BID 40960 BID 28672 4 P BID Priority of the bridge identifikation BID BID without MAC Address Root path Interrupted path Root port Designated port Alternate port Backup port Edge port ...

Страница 48: ...arding Address learning is active FDB sending and receipt of all frame types not only STP BPDUs STP port state Administrative bridge port state MAC operational RSTP Port state Active topology port role DISABLED Disabled FALSE Discardinga a The dot1d MIB displays Disabled Excluded disabled DISABLED Enabled FALSE Discardinga Excluded disabled BLOCKING Enabled TRUE Discardingb b The dot1d MIB display...

Страница 49: ...their own ports 3 4 4 Fast reconfiguration Why can RSTP react faster than STP to an interruption of the root path Introduction of edge ports During a reconfiguration RSTP switches an edge port into the transmission mode after three seconds default setting and then waits for the Hello Time to elapse to be sure that no bridge sending BPDUs is connected When the user ensures that a terminal device is...

Страница 50: ...reinstatements etc Note The downside of this fast reconfiguration is the possibility that data packages could be duplicated and or arrive at the recipient in the wrong order during the reconfiguration phase of the RSTP topology If this is unacceptable for your application use the slower Spanning Tree Protocol or select one of the other faster redundancy procedures described in this manual 3 4 5 ST...

Страница 51: ...al a device in the backbone takes on this role Set up the network to meet your requirements initially without redundant lines You deactivate the flow control on the participating ports If the flow control and the redundancy function are active at the same time there is a risk that the redundancy function will not operate as intended Default setting flow control deactivated globally and activated o...

Страница 52: ...ing Tree Global dialog Activate the function Figure 26 Switching the function on Click on Set to save the changes enable Switch to the privileged EXEC mode configure Switch to the Configuration mode spanning tree operation Switches Spanning Tree on show spanning tree global Displays the parameters for checking ...

Страница 53: ...es over the role of the root bridge In the Priority field you enter a numerically lower value The root bridge receives the numerically lowest bridge priority of all the devices in the network Figure 27 Defining the bridge priority Click on Set to save the changes spanning tree mst priority 0 0 61440 in 4096er Schritten Defines the bridge priority of the device ...

Страница 54: ...After saving the dialog shows the following information The Bridge is Root checkbox is selected The Root Port field shows the value 0 0 The Root Path Cost field shows the value 0 Figure 28 Device is operating as root bridge show spanning tree global Displays the parameters for checking ...

Страница 55: ...e If possible do not change the value in the Hello Time field If applicable change the values in the Forward Delay and Max Age fields The root bridge transmits the changed values to the other devices Figure 29 Changing Forward Delay and Max Age Click on Set to save the changes spanning tree forward time 4 30 Defines the delay time for the status change in seconds spanning tree max age 6 40 Specifi...

Страница 56: ...in the other devices Bridge ID bridge priority and MAC address of the corresponding device and the root bridge Number of the device port that leads to the root bridge Path cost from the root port of the device to the root bridge Figure 30 Check values show spanning tree global Displays the parameters for checking ...

Страница 57: ...tion functions help protect your network from incorrect configurations loops and attacks with STP BPDUs BPDU Guard for manually defined terminal device ports edge ports You activate this protection function globally in the device Terminal device ports do not normally receive any STP BPDUs If an attacker still attempts to feed in STP BPDUs at this port the device deactivates the device port ...

Страница 58: ...t If a designated port receives an STP BPDU with better path information to the root bridge the device discards the STP BPDU and sets the transmission state of the port to discarding instead of root If there are no STP BPDUs with better path information to the root bridge after 2 x Hello Time the device resets the state of the port to a value according to the port role ...

Страница 59: ...tivate this protection function separately for every device port If the protection function is activated the device ignores Topology Change flags in received STP BPDUs This does not change the content of the address table FDB of the device port However additional information in the BPDU that changes the topology is processed by the device Hacker ...

Страница 60: ...ction function separately for every device port This protection function prevents the transmission status of a port from unintentionally being changed to forwarding if the port does not receive any more STP BPDUs If this situation occurs the device designates the loop status of the port as inconsistent but does not forward any data packets ...

Страница 61: ...panning Tree Global dialog Select the BPDU Guard checkbox Figure 31 Activating the BPDU Guard Click on Set to save the changes enable Switch to the privileged EXEC mode configure Switch to the Configuration mode spanning tree bpdu guard Activates the BPDU Guard show spanning tree global Displays the parameters for checking ...

Страница 62: ...al device ports select the checkbox in the Admin Edge Port column Figure 32 Port dialog CIST tab Click on Set to save the changes interface x y Switches to the interface mode spanning tree edge port Designates the port as a terminal device port edge port show spanning tree port x y Displays the parameters for checking exit Leaves the interface mode ...

Страница 63: ... To reset the status of the device port to the value forwarding you proceed as follows If the device port is still receiving BPDUs Remove the manual definition as an edge port or Deactivate the BPDU Guard Activate the device port again In the Redundancy Spanning Tree Port dialog CIST tab the device shows the value enable in the BPDU Guard Effect column Figure 33 Port dialog Guards tab show spannin...

Страница 64: ...lumn For ports that receive STP BPDUs with a Topology Change flag select the checkbox in the TCN Guard column For root alternate or backup ports select the checkbox in the Loop Guard column Figure 34 Activating Guards Note The Root Guard and Loop Guard functions are mutually exclusive If you switch on the Root Guard function while the Loop Guard function is switched on the device switches off the ...

Страница 65: ...ace mode spanning tree guard root Switches the Root Guard on at the designated port spanning tree guard tcn Switches on the TCN Guard on the port that receives STP BPDUs with a Topology Change flag spanning tree guard loop Switches the Loop Guard on at a root alternate or backup port exit Leaves the interface mode show spanning tree port x y Displays the parameters of the port for checking ...

Страница 66: ... ensure trouble free operation Your comments and suggestions help us to further improve the quality of our documentation Your assessment of this manual Did you discover any errors in this manual If so on what page Very good Good Satisfactory Mediocre Poor Precise description O O O O O Readability O O O O O Understandability O O O O O Examples O O O O O Structure O O O O O Completeness O O O O O Gr...

Страница 67: ...tion General comments Sender Dear User Please fill out and return this page as a fax to the number 49 0 7127 14 1600 or by post to Hirschmann Automation and Control GmbH Department 01RD NT Stuttgarter Str 45 51 72654 Neckartenzlingen Company Department Name Telephone no Street Zip code City e mail Date Signature ...

Страница 68: ...Readers Comments 68 UM RedundConfig RSPL Release 2 0 02 2013 ...

Страница 69: ...36 MRP 11 12 13 17 N Network load 29 31 P Path costs 33 38 Port Identifier 32 34 Port number 34 Port priority Spanning Tree 34 Port roles RSTP 45 Port State 48 Protection functions guards 57 R Rapid Spanning Tree 10 11 12 45 Reconfiguration 31 Reconfiguration time MRP 15 Redundancy 5 Redundant connections 29 Ring 14 Ring manager 14 RM function 14 Root Bridge 38 Root guard 58 64 Root Path Cost 32 R...

Страница 70: ...Index 70 UM RedundConfig RSPL Release 2 0 02 2013 ...

Страница 71: ...merica region at Tel 1 717 217 2270 E mail inet support us belden com in the Asia Pacific region at Tel 65 6854 9860 E mail inet ap belden com Hirschmann Competence Center The Hirschmann Competence Center is ahead of its competitors Consulting incorporates comprehensive technical advice from system evaluation through network planning to project planning Training offers you an introduction to the b...

Страница 72: ...SPL Release 2 0 02 2013 With the Hirschmann Competence Center you have decided against making any compromises Our client customized package leaves you free to choose the service components you want to use Internet http www hicomcenter com ...

Страница 73: ...Further Support UM RedundConfig RSPL Release 2 0 02 2013 73 ...

Страница 74: ......

Отзывы:

Нет отзывов

Бренды по названию

Популярные бренды

Загрузить еще бренды