Websense X-Series Switch Configuration, v7.8.4

X-Series™ Switch Configuration
Web se n s e ® X-Series Appliance
v7.8.4
Websense X-Series Appliance
August, 2014
R22081478x
Copyright © 2011-2014 Websense, Inc. All rights reserved.
This document contains proprietary and confidential information of Websense, Inc. The contents of this document may not be disclosed to third
parties, copied, or duplicated in any form, in whole or in part, without prior written permission of Websense, Inc.
Every effort has been made to ensure the accuracy of this manual. However, Websense Inc., makes no warranties with respect to this documentation
and disclaims any implied warranties of merchantability and fitness for a particular purpose. Websense Inc. shall not be liable for any error or for
incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information
in this documentation is subject to change without notice.
Trademarks
Websense, the Websense Logo are registered trademarks of Websense, Inc. in the United States and other countries. Websense has numerous other
unregistered trademarks in the United States and internationally. All other trademarks are the property of their respective owners.
Microsoft, Windows, Internet Explorer, and Active Directory are either registered trademarks or trademarks of Microsoft Corporation in the United
States and/or other countries.
Mozilla and Firefox are registered trademarks of the Mozilla Foundation.
All other trademarks are property of their respective owners.
Websense® X-Series™
Switch Configuration
In this guide:

Switch basics, page 2

Assigning switch I/O modules an IP address, page 4

Configuring VLAN with high availability, page 8

Configuring No VLAN, page 10

X10G switch configuration tool, page 12

Installing a new switch, page 14
© 2014 Websense, Inc.
Switch basics
X-Series appliances come with two Dell PowerConnect M6220 switches. When used
with the X10G™, each switch supports two 10G SFP+ ports.
Special support is provided for two common network deployments:


VLAN with high availability (A1/A2 : Active/Standby). See Configuring VLAN
with high availability, page 8.
No VLAN. See Configuring No VLAN, page 10.
The switch ports used and their specific configuration are determined by the network
type.
A Microsoft Windows hosted switch configuration tool is provided to simplify the
switch configuration process.
Important
Link aggregation is not supported.
X-Series Appliance Switch Configuration for v7.8.4  2
Default switch configuration
Switches A1 and A2 arrive with the following default configuration:
Switch A1
P1 Te1/2/1
Enabled
10 gigabit
1518 maximum frame size (configurable)
Full duplex
Auto negotiation disabled
Flow control disabled
P1 Te1/2/2
Disabled
10 gigabit
1518 maximum frame size (configurable)
Full duplex
Auto negotiation disabled
Flow control disabled
Other ports are not supported.
Switch A2
P2 Te1/2/1
Enabled
10 gigabit
1518 maximum frame size (configurable)
Full duplex
Auto negotiation disabled
Flow control disabled
P2 Te1/2/2
Disabled
10 gigabit
1518 maximum frame size (configurable)
Full duplex
Auto negotiation disabled
Flow control disabled
Other ports are not supported.
Accessing a switch
To access switch A1 or A2:
1. Log on to the CMC, go to I/O Module Overview, and click the Launch IOM
GUI button for switch A1 or switch A2.
If the button isn’t available, it’s because an IP address has not been configured.
See Assigning switch I/O modules an IP address, page 4.
X-Series Appliance Switch Configuration for v7.8.4  3
2.
A logon window displays. Log on. The Dell default credentials are: Username
‘root’, password ‘calvin’. Change these to comply with your organization’s
security policies.
The switch home screen shows the status of all ports on the switch. A green port is
up (enabled), a blue port is down (disabled).
3. Click on a port to go to its configuration page.
Proceed with your desired configuration changes.
For additional Websense guides for the X10G Chassis and Security Blades, please
visit the X10G support page.
Assigning switch I/O modules an IP address
Switches A1 and A2 are accessed through the Chassis Management Controller
(CMC). Before they can be accessed, each must be assigned an IP address. To assign
an IP address:
X-Series Appliance Switch Configuration for v7.8.4  4
1. Log on to the CMC and go to Chassis Overview > I/O Module Overview >
A1 Gigabit Ethernet (or A2).
2. Click the Setup tab.
3. For each of A1 and A2, uncheck DHCP Enabled, and enter an IP address, subnet
mask, and gateway. The IP addresses must be unique.
4. Establish a User Name and Password that meets your organization’s security
standards. The factory default credentials are:
User Name = root Password = calvin
X-Series Appliance Switch Configuration for v7.8.4  5
5. Click Apply. It takes a minute or 2 for the settings to be applied.
IMPORTANT: The GUI may initially indicate that the settings reverted to the
previous values. Wait 2 or 3 minutes for the configuration action to complete and
then refresh the page.
To access a switch, go to Chassis Overview > I/O Module Overview and click the
Launch IOM GUI button corresponding to the switch you want to access.
Enabling and disabling ports
Enabling and disabling ports should not be necessary if you plan to use the provided
switch configuration tool to configure the switches.
To enable or disable a port:
1. Log on to the CMC, go to I/O Module Overview, and click the Launch IOM
GUI button for switch A1 or A2.
If the button isn’t available, it’s because an IP address has not been configured.
See the preceding section.
2.
A logon window displays. Log on.
X-Series Appliance Switch Configuration for v7.8.4  6
The home screen shows the status of all ports on the switch. A green port is up
(enabled), a blue port is down (disabled).
3. To enable or disable a port, click on the green or blue area of the port. This opens
the Port Configuration: Detail page.
a. Confirm that the Port selection is correct. Change to another port if desired.
b. Add a description if desired.
c. Select Enable or Disable from the Admin Status drop down. This determines
if the port is enabled or disabled.
d. Examine and adjust other settings as needed and click Apply.
IMPORTANT: The UI may initially indicate that the settings reverted to the
previous values. Wait 2 or 3 minutes for the configuration action to complete
and then refresh the page.
X-Series Appliance Switch Configuration for v7.8.4  7
Configuring VLAN with high availability
Note
High availability (HA) between switches A1 and A2
(RSTP : Active/Standby) is only available when VLAN is
configured.
Configuring for VLAN with HA requires:

An external upstream switch with a 10G trunk port configured

VLAN Enabled: Cabling the switches, page 8

Configuring A1 and A2 with the X10G switch configuration tool, page 12

Configuring VLAN support on a blade, page 9
VLAN Enabled: Cabling the switches
Chassis switch cabling
The primary port is A1 Te1/2/2 (the lower 10G port (P1)). This port handles all traffic.
The secondary port, for high availability (optional), is A2 Te1/2/2.
With 10G ports use SFP+ cables.
X-Series Appliance Switch Configuration for v7.8.4  8
When VLAN is enabled, after running the X10G switch configuration tool, P1 and P2
are trunked together.
Important
In the X10G switch configuration tool, when prompted for
the external port, select the option for Te1/2/2.
When cabling is complete, configure the switch with the X10G switch configuration
tool, page 12.
Upstream switch configuration
Cable appropriately to the upstream switch.
Connecting 10G ports should be in trunk mode.
Enable spanning tree on the ports. The mode can be STP, RSTP, or MSTP.
Designate at least one root bridge with a priority number less than 32768. This is the
default priority for all switches on the X10G.
Configuring VLAN support on a blade
After configuring the switch to recognize VLAN traffic and direct it appropriately,
configure VLAN support on each blade.
Important
Once you have assigned a VLAN to any appliance
interface, returning the appliance to a VLAN-unaware (no
VLAN) state requires reimaging the blade.
You can, however, reassign the VLAN ID with the ‘set
interface vlan’ command, described below.
With new installations, you are offered the option to assign a default VLAN to
interface P1 as part of the firstboot script.
For upgrades, or to add VLAN support after installation, use the appliance CLI as
follows:
1. Connect to the blade that you want to configure, and log on as admin.
2. Enter the config command, then enter the admin password when prompted.
3. Use the set interface vlan command to assign a VLAN ID to the first interface.
For example:
set interface vlan --interface p1 --vid 400
X-Series Appliance Switch Configuration for v7.8.4  9
4. Use the set interface vlan command to assign a VLAN ID to the second interface.
For example:
set interface vlan --interface p2 --vid 1025
5. When you are finished, use the show interface command to review the updated
configuration.
Configuring No VLAN
Configuring for No VLAN support requires:

An external upstream switch with 10G ports in access mode

No VLAN: Cabling the switches, page 10

Configuring A1 and A2 with the X10G switch configuration tool, page 12

Optional – Configuring link aggregation, page 11
No VLAN: Cabling the switches

The primary port can be A1 Te1/2/1 or A1 Te1/2/2. Both ports are P1.
If configuring for link aggregation (optional), cable both ports.
P1 is used for all traffic unless a secondary (P2) port is configured.

Optionally, A2 Te1/2/1 or Te1/2/2 can be used for egress traffic. Both ports are P2.
If configuring for link aggregation (optional), cable both ports.
With 10G ports use SFP+ cables.
When cabling is complete, configure the switch with the X10G switch configuration
tool, page 12.
X-Series Appliance Switch Configuration for v7.8.4  10
Configuring link aggregation
In link aggregation, both ports are active and share the load. If one port fails, the
remaining port assumes all of the load.
Requirement: The upstream connections must be on the same switch or to switches
in the same stack.
To configure link aggregation on the A1 or A2 switch:
1. Ensure that both Te1/2/1 and Te1/2/2 are enabled.
2. Perform these commands in console mode:
interface Te1/2/1
duplex full
channel-group 1 mode active
switchport access vlan 1
exit
!
interface Te1/2/2
duplex full
channel-group 1 mode active
switchport access vlan 1
exit
!
interface port-channel 1
switchport access vlan 1
exit
3. On the upstream switch:
a. Enable the 10 gigabit ports.
b. Configure link aggregation. See your switch documentation.
c. Configure each according to your VLAN allocation:
switchport access vlan <n>
Some older switches require that the VLAN info be configured on both the
physical ports and the link-aggregation port.
Some newer switches require VLAN configuration on link-aggregation port
only.
X-Series Appliance Switch Configuration for v7.8.4  11
Refer to your switch documentation.
Important
“switchport access vlan 1” is the default configuration in
Dell M6220 switches. It does not appear in the startup or
running configuration scripts.
X10G switch configuration tool
The switch configuration tool allows you to rapidly and accurately configure the
X10G switches to support either:

VLAN with high availability

No VLAN (VLAN unaware); no support for high availability
Before you begin, download the switch configuration tool to a Windows machine in
your network. The Windows machine must be able to connect to the appliance CMC
via a web browser. To download the switch tool:
1. Open a browser and navigate to www.mywebsense.com.
2. Log in when prompted, then select the Downloads tab.
3. Select Websense X10G Base Configuration from the Product drop-down list,
then select 7.8.4 from the Version list.
4. Click the download link for the Switch Configuration Tool.
5. When the download is complete, extract the archive to a temporary directory.
Using the tool requires the:

CMC IP address

CMC root password

Enable password for switches A1 and A2
To configure the switch:
1. Use the CMC manager to verify that SSH connections are enabled on the Chassis
Overview > Network > Services page under SSH Configuration.
2. Navigate to the Windows folder containing the switch configuration tool, and
double-click switch-tool.exe to launch the tool.
3. When prompted, enter the CMC IP address.
4. Enter root as the CMC user name, followed by the root password.
X-Series Appliance Switch Configuration for v7.8.4  12
5. Enter the Enable password for switch A1, followed by the Enable password for
switch A2.
The switch tool displays the current running configuration for switch A1,
followed by the configuration for switch A2. For example:
6. Select the X10G external port that is connected to your third-party upstream
switch. Use option 6 (Te1/2/2) for VLAN enabled. Use 5 or 6 for no VLAN.
7. When prompted to select a deployment option, enter option 1 to enable VLAN
support and switch high availability, or option 2 to leave the switch in No VLAN
(not VLAN-aware) mode.
X-Series Appliance Switch Configuration for v7.8.4  13
8. If you selected option 1:
a. You are prompted to configure VLAN settings for one or more blades.
To start, enter the blade number or numbers in a comma-separated list (1,2,3),
range format (1-3), or a combination (1,2, 5-8).
•
•
All of the selected blades will receive traffic for the same VLAN or
VLANs.
After configuring the first blade or set of blades, you will be given the
option to configure additional sets of VLAN settings for your remaining
blades.
b. Enter the VLAN ID or IDs to configure the traffic that will be directed to the
selected blades. VLAN IDs can be entered in a comma-separated list (100102), range format (100,101), or a combination.
Each blade supports a maximum of 3 VLANs.
c. If you have additional blades to configure, enter yes, and repeat steps a and b.
When you are finished, enter no to continue with the next step.
d. Specify whether to perform a full factory reset before reconfiguring each
switch, then review the configuration settings displayed. There is no need to
perform a factory reset unless you know there is a problem with the switch
configuration.
9. If the new settings look correct, enter 1 to start the switch reconfiguration process.
Progress information is displayed as first switch A1, then switch A2, is
configured.
The switch reconfiguration process should take only a few minutes.
10. When the switch reconfiguration is complete, press any key to exit the switch
configuration tool.
If you have configured for VLAN support, ensure that your upstream switch is
configured to send VLAN traffic to the X10G, and then configure individual blades to
recognize VLAN traffic. See Configuring VLAN support on a blade, page 9, for
instructions.
Installing a new switch
If you must replace a switch:
1. Contact Websense Technical Support for assistance.
2. When replacing the switch make certain that it is fully seated in the chassis,
and that the switch lever is latched.
3. During the replacement procedure, ask the Technical Support specialist to
demonstrate that the new switch is functioning properly, per your switch
configuration requirements.
X-Series Appliance Switch Configuration for v7.8.4  14