HP | 1920-24G-PoE+ | User's Manual | HP 1920-24G-PoE+ User's Manual

HP 1920 Gigabit Ethernet Switch Series
User Guide
Part number: 5998-5627
Software version: Release 1102
Document version: 5W100-20140620
Legal and notice information
© Copyright 2014 Hewlett-Packard Development Company, L.P.
No part of this documentation may be reproduced or transmitted in any form or by any means without
prior written consent of Hewlett-Packard Development Company, L.P.
The information contained herein is subject to change without notice.
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS
MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained
herein or for incidental or consequential damages in connection with the furnishing, performance, or
use of this material.
The only warranties for HP products and services are set forth in the express warranty statements
accompanying such products and services. Nothing herein should be construed as constituting an
additional warranty. HP shall not be liable for technical or editorial errors or omissions contained
herein.
Contents
Overview ······································································································································································ 1
Configuring the switch in the Web interface ············································································································· 2
Restrictions and guidelines ··············································································································································· 2
Operating system requirements ······························································································································ 2
Web browser requirements ····································································································································· 2
Others ········································································································································································ 5
Overview············································································································································································ 6
Logging in to the Web interface······································································································································ 6
Logging out of the Web interface ··································································································································· 7
Web interface ··································································································································································· 7
Web user level ·································································································································································· 8
Web-based NM functions ················································································································································ 8
Common items on the Web pages ······························································································································ 16
Configuring the switch at the CLI ······························································································································ 20
Getting started with the CLI ··········································································································································· 20
Setting up the configuration environment ··········································································································· 20
Setting terminal parameters·································································································································· 21
Logging in to the CLI ············································································································································· 24
CLI commands ································································································································································ 24
initialize ·································································································································································· 25
ipsetup ···································································································································································· 25
ipsetup ipv6 ··························································································································································· 26
password ································································································································································ 26
ping ········································································································································································· 27
ping ipv6 ································································································································································ 27
quit ·········································································································································································· 28
reboot ····································································································································································· 29
summary ································································································································································· 29
upgrade ·································································································································································· 30
upgrade ipv6 ························································································································································· 31
Configuration example for upgrading the system software image at the CLI ························································· 32
Configuration wizard················································································································································· 34
Basic service setup ················································································································································ 34
Entering the configuration wizard homepage···································································································· 34
Configuring system parameters ··························································································································· 34
Configuring management IP address ·················································································································· 36
Finishing configuration wizard ···························································································································· 37
Configuring stack ······················································································································································· 39
Overview········································································································································································· 39
Configuration task list ···················································································································································· 39
Configuring global parameters of a stack ·················································································································· 40
Configuring stack ports ················································································································································· 41
Displaying topology summary of a stack ···················································································································· 42
Displaying device summary of a stack ························································································································ 42
Logging in to a member device from the master ········································································································ 42
Stack configuration example ········································································································································ 43
Configuration guidelines ··············································································································································· 46
i
Displaying system and device information··············································································································· 47
Displaying system information ······································································································································ 47
Displaying basic system information ··················································································································· 47
Displaying the system resource state ··················································································································· 48
Displaying recent system logs ······························································································································ 48
Setting the refresh period ····································································································································· 48
Displaying device information ······································································································································ 48
Configuring basic device settings ····························································································································· 50
Configuring system name ·············································································································································· 50
Configuring idle timeout period ··································································································································· 50
Maintaining devices··················································································································································· 52
Software upgrade ·························································································································································· 52
Device reboot ································································································································································· 53
Electronic label ······························································································································································· 54
Diagnostic information ·················································································································································· 54
Configuring system time ············································································································································ 56
Overview········································································································································································· 56
Displaying the current system time ······························································································································· 56
Manually configuring the system time·························································································································· 56
Configuring system time by using NTP ························································································································ 57
System time configuration example ····························································································································· 58
Network requirements ··········································································································································· 58
Configuring the system time ································································································································· 59
Verifying the configuration ··································································································································· 59
Configuration guidelines ··············································································································································· 59
Configuring syslog ····················································································································································· 61
Displaying syslogs ·························································································································································· 61
Setting the log host························································································································································· 62
Setting buffer capacity and refresh interval ················································································································ 63
Managing the configuration······································································································································ 64
Backing up the configuration ········································································································································ 64
Restoring the configuration ··········································································································································· 64
Saving the configuration ··············································································································································· 65
Resetting the configuration ············································································································································ 66
Managing files ··························································································································································· 67
Displaying files ······························································································································································· 67
Downloading a file ························································································································································ 67
Uploading a file ····························································································································································· 68
Removing a file······························································································································································· 68
Specifying the main boot file ········································································································································ 68
Managing ports·························································································································································· 69
Setting operation parameters for a port ······················································································································ 69
Displaying port operation parameters ························································································································· 73
Displaying a specified operation parameter for all ports ················································································· 73
Displaying all the operation parameters for a port ··························································································· 74
Port management configuration example ···················································································································· 75
Network requirements ··········································································································································· 75
Configuring the switch ·········································································································································· 75
Configuring port mirroring ········································································································································ 79
Terminology ···································································································································································· 79
ii
Mirroring source ···················································································································································· 79
Mirroring destination ············································································································································ 79
Mirroring direction ················································································································································ 79
Mirroring group ····················································································································································· 79
Local port mirroring ······················································································································································· 79
Configuration restrictions and guidelines ···················································································································· 80
Recommended configuration procedures ···················································································································· 80
Configuring a mirroring group ····································································································································· 80
Configuring ports for the mirroring group ··················································································································· 81
Local port mirroring configuration example ················································································································ 83
Network requirements ··········································································································································· 83
Configuration procedure ······································································································································ 83
Managing users ························································································································································· 86
Adding a local user ······················································································································································· 86
Setting the super password ··········································································································································· 87
Switching to the management level ····························································································································· 88
Configuring a loopback test ······································································································································ 89
Configuration guidelines ··············································································································································· 89
Configuration procedure ··············································································································································· 89
Configuring VCT ························································································································································ 91
Overview········································································································································································· 91
Testing cable status ························································································································································ 91
Configuring the flow interval ····································································································································· 92
Viewing port traffic statistics ········································································································································· 92
Configuring RMON ··················································································································································· 93
Overview········································································································································································· 93
Working mechanism ············································································································································· 93
RMON groups ······················································································································································· 93
RMON configuration task list ······································································································································· 95
Configuring a statistics entry ································································································································ 97
Configuring a history entry··································································································································· 98
Configuring an event entry ··································································································································· 99
Configuring an alarm entry ································································································································ 100
Displaying RMON statistics································································································································ 101
Displaying RMON history sampling information ····························································································· 103
Displaying RMON event logs ···························································································································· 104
RMON configuration example ··································································································································· 105
Configuring energy saving ····································································································································· 109
Configuring energy saving on a port ························································································································ 109
Configuring SNMP·················································································································································· 111
Overview······································································································································································· 111
SNMP mechanism ··············································································································································· 111
SNMP protocol versions ····································································································································· 112
Recommended configuration procedure···················································································································· 112
Enabling SNMP agent ········································································································································ 113
Configuring an SNMP view ········································································································································ 115
Creating an SNMP view····································································································································· 115
Adding rules to an SNMP view ························································································································· 116
Configuring an SNMP community ····························································································································· 117
Configuring an SNMP group······································································································································ 118
iii
Configuring an SNMP user ········································································································································· 120
Configuring SNMP trap function ································································································································ 121
Displaying SNMP packet statistics ····························································································································· 123
SNMPv1/v2c configuration example ························································································································ 124
SNMPv3 configuration example ································································································································ 127
Displaying interface statistics ································································································································· 132
Configuring VLANs ················································································································································· 133
Overview······································································································································································· 133
VLAN fundamentals············································································································································· 133
VLAN types ·························································································································································· 134
Port-based VLAN ················································································································································· 135
Recommended VLAN configuration procedures ······································································································· 137
Recommended configuration procedure for assigning an access port to a VLAN ······································ 137
Recommended configuration procedure for assigning a trunk port to a VLAN ··········································· 137
Recommended configuration procedure for assigning a hybrid port to a VLAN········································· 138
Creating VLANs ··························································································································································· 139
Configuring the link type of a port ····························································································································· 140
Setting the PVID for a port··········································································································································· 141
Selecting VLANs ··························································································································································· 142
Modifying a VLAN ······················································································································································· 143
Modifying ports ···························································································································································· 144
VLAN configuration example······································································································································ 145
Network requirements ········································································································································· 145
Configuring Switch A ·········································································································································· 145
Configuring Switch B ·········································································································································· 149
Configuration guidelines ············································································································································· 149
Configuring VLAN interfaces ································································································································· 150
Overview······································································································································································· 150
Creating a VLAN interface·········································································································································· 150
Modifying a VLAN interface ······································································································································· 152
Configuration guidelines ············································································································································· 155
Configuring a voice VLAN ····································································································································· 156
Overview······································································································································································· 156
OUI addresses ····················································································································································· 156
Voice VLAN assignment modes ························································································································· 156
Security mode and normal mode of voice VLANs ··························································································· 158
Recommended voice VLAN configuration procedure ······························································································ 159
Configuring voice VLAN globally ······························································································································ 160
Configuring voice VLAN on ports ······························································································································ 161
Adding OUI addresses to the OUI list ······················································································································· 162
Voice VLAN configuration examples ························································································································· 163
Configuring voice VLAN on a port in automatic voice VLAN assignment mode ········································· 163
Configuring a voice VLAN on a port in manual voice VLAN assignment mode ········································· 167
Configuration guidelines ············································································································································· 172
Configuring the MAC address table ····················································································································· 173
Overview······································································································································································· 173
How a MAC address entry is created ·············································································································· 173
Types of MAC address entries ··························································································································· 174
Displaying and configuring MAC address entries ··································································································· 174
Setting the aging time of MAC address entries ········································································································ 175
MAC address table configuration example ·············································································································· 175
Network requirements ········································································································································· 175
iv
Creating a static MAC address entry················································································································ 176
Configuring MSTP ··················································································································································· 177
Overview······································································································································································· 177
Introduction to STP ······················································································································································· 177
STP protocol packets ··········································································································································· 177
Basic concepts in STP·········································································································································· 178
Calculation process of the STP algorithm ········································································································· 179
Introduction to RSTP ····················································································································································· 184
Introduction to MSTP ···················································································································································· 185
MSTP features ······················································································································································ 185
MSTP basic concepts ·········································································································································· 185
How MSTP works ················································································································································ 189
MSTP implementation on devices ······················································································································ 189
Protocols and standards ····································································································································· 190
Configuration guidelines ············································································································································· 190
Recommended MSTP configuration procedure ········································································································· 190
Configuring an MST region ········································································································································ 191
Configuring MSTP globally ········································································································································· 192
Configuring MSTP on a port ······································································································································· 195
Displaying MSTP information of a port ····················································································································· 197
MSTP configuration example ······································································································································ 199
Network requirements ········································································································································· 199
Configuration procedure ···································································································································· 200
Configuring link aggregation and LACP ··············································································································· 205
Overview······································································································································································· 205
Basic concepts ····················································································································································· 205
Link aggregation modes ····································································································································· 206
Configuration procedures ··········································································································································· 208
Configuring a static aggregation group ··········································································································· 208
Configuring a dynamic aggregation group ····································································································· 208
Creating a link aggregation group ··················································································································· 208
Displaying aggregate interface information····································································································· 209
Setting LACP priority ··········································································································································· 211
Displaying LACP-enabled port information······································································································· 211
Link aggregation and LACP configuration example································································································· 213
Configuration guidelines ···································································································································· 215
Configuring LLDP ····················································································································································· 217
Overview······································································································································································· 217
Basic concepts ····················································································································································· 217
LLDP operating modes ········································································································································· 221
Working mechanism ··········································································································································· 221
Protocols and standards ·············································································································································· 222
Recommended LLDP configuration procedure ··········································································································· 222
Enabling LLDP on ports ················································································································································ 223
Setting LLDP parameters on ports ······························································································································· 224
Setting LLDP parameters for a single port ········································································································· 224
Setting LLDP parameters for ports in batch ······································································································· 227
Configuring LLDP globally ··········································································································································· 227
Displaying LLDP information for a port ······················································································································ 229
Displaying global LLDP information ··························································································································· 234
Displaying LLDP information received from LLDP neighbors ···················································································· 236
LLDP configuration example ········································································································································ 236
Network requirements ········································································································································· 236
v
Configuring Switch A ·········································································································································· 236
Configuring Switch B ·········································································································································· 239
Verifying the configuration ································································································································· 239
LLDP configuration guidelines ····································································································································· 241
Configuring ARP ······················································································································································ 242
Overview······································································································································································· 242
ARP message format ··········································································································································· 242
ARP operating mechanism ································································································································· 242
ARP table ······························································································································································ 243
Gratuitous ARP ····················································································································································· 244
Configuring ARP entries ·············································································································································· 244
Displaying ARP entries ········································································································································ 244
Creating a static ARP entry ································································································································ 245
Removing ARP entries ·················································································································································· 245
Configuring gratuitous ARP ········································································································································· 246
Static ARP configuration example ····················································································································· 246
Configuring ARP attack protection························································································································· 250
Overview······································································································································································· 250
User validity check ·············································································································································· 250
ARP packet validity check ·································································································································· 250
Configuring ARP detection ·········································································································································· 250
Configuring IGMP snooping ·································································································································· 252
Overview······································································································································································· 252
Basic IGMP snooping concepts ························································································································· 252
How IGMP snooping works ······························································································································· 254
Protocols and standards ····································································································································· 255
Recommended configuration procedure···················································································································· 255
Enabling IGMP snooping globally ····························································································································· 256
Configuring IGMP snooping in a VLAN ···················································································································· 257
Configuring IGMP snooping port functions··············································································································· 258
Displaying IGMP snooping multicast forwarding entries························································································· 259
IGMP snooping configuration example ····················································································································· 260
Network requirements ········································································································································· 260
Configuration procedure ···································································································································· 261
Verifying the configuration ································································································································· 264
Configuring MLD snooping ···································································································································· 266
Overview······································································································································································· 266
Basic MLD snooping concepts ··························································································································· 266
How MLD snooping works ································································································································· 268
Protocols and standards ····································································································································· 269
Recommended configuration procedure···················································································································· 269
Enabling MLD snooping globally ······················································································································ 270
Configuring MLD snooping in a VLAN ············································································································· 270
Configuring MLD snooping port functions ········································································································ 272
Displaying MLD snooping multicast forwarding entries ·················································································· 273
MLD snooping configuration example ······················································································································· 274
Network requirements ········································································································································· 274
Configuration procedure ···································································································································· 274
Verifying the configuration ································································································································· 277
Configuring IPv4 and IPv6 routing ························································································································ 278
Overview······································································································································································· 278
Routing table ························································································································································ 278
vi
Static route ··························································································································································· 278
Default route ························································································································································· 279
Displaying the IPv4 active route table ······················································································································· 279
Creating an IPv4 static route······································································································································· 280
Displaying the IPv6 active route table ······················································································································· 281
Creating an IPv6 static route······································································································································· 281
IPv4 static route configuration example ····················································································································· 283
Network requirements ········································································································································· 283
Configuration considerations ····························································································································· 283
Configuration procedure ···································································································································· 283
Verifying the configuration ································································································································· 286
IPv6 static route configuration example ····················································································································· 287
Network requirements ········································································································································· 287
Configuration considerations ····························································································································· 287
Configuration procedure ···································································································································· 287
Verifying the configuration ································································································································· 290
Configuration guidelines ············································································································································· 291
DHCP overview ······················································································································································· 292
DHCP address allocation ············································································································································ 292
Allocation mechanisms ······································································································································· 292
IP address allocation process ····························································································································· 293
IP address lease extension·································································································································· 293
DHCP message format················································································································································· 294
DHCP options ······························································································································································· 295
Common DHCP options ······································································································································ 295
Option 82 ···························································································································································· 295
Protocols and standards ·············································································································································· 296
Configuring DHCP relay agent ······························································································································ 297
Overview······································································································································································· 297
Recommended configuration procedure···················································································································· 298
Enabling DHCP and configuring advanced parameters for the DHCP relay agent ············································· 299
Creating a DHCP server group ·································································································································· 300
Enabling the DHCP relay agent on an interface ······································································································ 301
Configuring and displaying clients' IP-to-MAC bindings ························································································· 302
DHCP relay agent configuration example················································································································· 303
Configuring DHCP snooping·································································································································· 306
Overview······································································································································································· 306
Application of trusted ports ································································································································ 306
DHCP snooping support for Option 82 ············································································································ 308
Recommended configuration procedure···················································································································· 308
Enabling DHCP snooping ··········································································································································· 309
Configuring DHCP snooping functions on an interface ··························································································· 309
Displaying clients' IP-to-MAC bindings ······················································································································ 310
DHCP snooping configuration example ···················································································································· 311
Managing services ·················································································································································· 314
Overview······································································································································································· 314
Managing services ······················································································································································· 315
Using diagnostic tools············································································································································· 317
Ping ················································································································································································ 317
Traceroute ····································································································································································· 317
Ping operation ······························································································································································ 318
Traceroute operation ··········································································································································· 319
vii
Configuring 802.1X ··············································································································································· 321
802.1X overview ························································································································································· 321
802.1X architecture ············································································································································ 321
Access control methods ······································································································································ 321
Controlled/uncontrolled port and port authorization status ··········································································· 322
Packet formats ······················································································································································ 322
EAP over RADIUS ················································································································································ 323
Initiating 802.1X authentication ························································································································ 324
802.1X authentication procedures ···················································································································· 325
802.1X timers ······················································································································································ 328
Using 802.1X authentication with other features ···························································································· 329
Configuration prerequisites ········································································································································· 331
Recommended configuration procedure···················································································································· 332
Configuring 802.1X globally ····································································································································· 332
Configuring 802.1X on a port ··································································································································· 333
Configuring an 802.1X guest VLAN ················································································································· 335
Configuring an Auth-Fail VLAN ························································································································· 336
802.1X configuration examples ································································································································· 336
MAC-based 802.1X configuration example ···································································································· 336
802.X with ACL assignment configuration example ······················································································· 343
Configuring AAA ···················································································································································· 352
Overview······································································································································································· 352
AAA application·················································································································································· 352
Domain-based user management ······················································································································ 353
Configuration prerequisites ········································································································································· 353
Recommended configuration procedure ··········································································································· 353
Configuring an ISP domain ································································································································ 354
Configuring authentication methods for the ISP domain ················································································· 355
Configuring authorization methods for the ISP domain ·················································································· 356
Configuring accounting methods for the ISP domain ······················································································ 357
AAA configuration example ······································································································································· 359
Configuring RADIUS ··············································································································································· 363
Overview······································································································································································· 363
Client/server model ············································································································································ 363
Security and authentication mechanisms ·········································································································· 364
Basic RADIUS message exchange process ······································································································ 364
RADIUS packet format ········································································································································ 365
Extended RADIUS attributes ······························································································································· 367
Protocols and standards ····································································································································· 368
Configuring a RADIUS scheme ··································································································································· 368
Configuring common parameters ······················································································································ 369
Adding RADIUS servers ······································································································································ 373
RADIUS configuration example ·································································································································· 374
Configuration guidelines ············································································································································· 378
Configuring users ···················································································································································· 380
Configuring a local user ·············································································································································· 380
Configuring a user group ············································································································································ 382
Managing certificates ············································································································································· 384
Overview······································································································································································· 384
PKI terms ······························································································································································· 384
PKI architecture ···················································································································································· 384
How PKI works····················································································································································· 385
viii
PKI applications ··················································································································································· 386
Recommended configuration procedures ·················································································································· 386
Recommended configuration procedure for manual request·········································································· 386
Recommended configuration procedure for automatic request······································································ 388
Creating a PKI entity ···················································································································································· 388
Creating a PKI domain ················································································································································ 390
Generating an RSA key pair······································································································································· 393
Destroying the RSA key pair ······································································································································· 394
Retrieving and displaying a certificate ······················································································································ 394
Requesting a local certificate ······································································································································ 396
Retrieving and displaying a CRL ································································································································ 398
PKI configuration example ·········································································································································· 399
Configuration guidelines ············································································································································· 403
Configuring MAC authentication ··························································································································· 404
Overview······································································································································································· 404
User account policies ·········································································································································· 404
Authentication methods······································································································································· 404
MAC authentication timers ································································································································· 405
Using MAC authentication with other features ········································································································· 405
VLAN assignment ················································································································································ 405
ACL assignment ··················································································································································· 405
Auth-Fail VLAN ···················································································································································· 405
Configuration prerequisites ········································································································································· 406
Recommended configuration procedure···················································································································· 406
Configuring MAC authentication globally ················································································································ 406
Configuring MAC authentication on a port ····································································································· 408
MAC authentication configuration examples ············································································································ 408
Local MAC authentication configuration example··························································································· 408
ACL assignment configuration example············································································································ 411
Configuring port security ········································································································································ 421
Overview······································································································································································· 421
Port security features ··········································································································································· 421
Port security modes ············································································································································· 421
Configuration guidelines ············································································································································· 423
Recommended configuration procedure···················································································································· 423
Configuring global settings for port security ············································································································· 424
Configuring basic port security control ······················································································································ 425
Configuring secure MAC addresses ·························································································································· 427
Configuring advanced port security control ·············································································································· 428
Configuring permitted OUIs ········································································································································ 429
Port security configuration examples ························································································································· 430
Basic port security mode configuration example ····························································································· 430
Advanced port security mode configuration example ···················································································· 433
Configuring port isolation······································································································································· 440
Configuring the isolation group·································································································································· 440
Port isolation configuration example·························································································································· 441
Configuring authorized IP ······································································································································ 443
Configuration procedure ············································································································································· 443
Authorized IP configuration example························································································································· 444
Network requirements ········································································································································· 444
Configuration procedure ···································································································································· 444
ix
Configuring loopback detection ···························································································································· 447
Recommended configuration procedure···················································································································· 447
Configuring loopback detection globally ·················································································································· 447
Configuring loopback detection on a port ················································································································ 448
Configuring ACLs ···················································································································································· 450
Overview······································································································································································· 450
ACL categories ···················································································································································· 450
Match order ························································································································································· 450
Implementing time-based ACL rules··················································································································· 452
IPv4 fragments filtering with ACLs ····················································································································· 452
Configuration guidelines ············································································································································· 452
Recommend ACL configuration procedures ·············································································································· 452
Recommended IPv4 ACL configuration procedure ·························································································· 452
Recommended IPv6 ACL configuration procedure ·························································································· 453
Configuring a time range ··································································································································· 453
Adding an IPv4 ACL ··········································································································································· 454
Configuring a rule for a basic IPv4 ACL ··········································································································· 455
Configuring a rule for an advanced IPv4 ACL································································································· 456
Configuring a rule for an Ethernet frame header ACL ···················································································· 459
Adding an IPv6 ACL ··········································································································································· 461
Configuring a rule for a basic IPv6 ACL ··········································································································· 462
Configuring a rule for an advanced IPv6 ACL································································································· 463
Configuring QoS ····················································································································································· 466
Overview······································································································································································· 466
Networks without QoS guarantee ····················································································································· 466
QoS requirements of new applications············································································································· 466
Congestion: causes, impacts, and countermeasures ······················································································· 467
End-to-end QoS···················································································································································· 468
Traffic classification ············································································································································· 468
Packet precedences ············································································································································· 469
Queue scheduling ··············································································································································· 471
Rate limit ······························································································································································· 473
Priority mapping ·················································································································································· 474
Introduction to priority mapping tables ············································································································· 475
Configuration guidelines ············································································································································· 476
Recommended QoS configuration procedures ········································································································· 476
Adding a class ····························································································································································· 478
Configuring classification rules··································································································································· 479
Adding a traffic behavior ············································································································································ 480
Configuring traffic mirroring and traffic redirecting for a traffic behavior ···························································· 481
Configuring other actions for a traffic behavior ······································································································· 481
Adding a policy ··························································································································································· 483
Configuring classifier-behavior associations for the policy ····················································································· 484
Applying a policy to a port········································································································································· 484
Configuring queue scheduling on a port ··················································································································· 485
Configuring rate limit on a port ·································································································································· 486
Configuring priority mapping tables ·························································································································· 487
Configuring priority trust mode on a port ················································································································· 488
ACL and QoS configuration example ··················································································································· 489
Network requirements ················································································································································· 489
Configuring Switch ······················································································································································ 489
x
Configuring PoE ······················································································································································ 497
Overview······································································································································································· 497
Configuring PoE ··························································································································································· 498
Configuring PoE ports ········································································································································· 498
Configuring non-standard PD detection ············································································································ 499
Displaying information about PSE and PoE ports ···························································································· 500
PoE configuration example ········································································································································· 501
Support and other resources ·································································································································· 503
Contacting HP ······························································································································································ 503
Subscription service ············································································································································ 503
Related information ······················································································································································ 503
Documents ···························································································································································· 503
Websites······························································································································································· 503
Conventions ·································································································································································· 504
Index ········································································································································································ 506
xi
Overview
The HP 1920 Switch Series can be configured through the command line interface (CLI), Web interface,
and SNMP/MIB. These configuration methods are suitable for different application scenarios.
•
The Web interface supports all 1920 Switch Series configurations.
•
The CLI provides configuration commands to facilitate your operation. To perform other
configurations not supported by the CLI, use the Web interface.
1
Configuring the switch in the Web interface
Restrictions and guidelines
To ensure a successful login, verify that your operating system and Web browser meet the requirements,
and follow the guidelines in this section.
Operating system requirements
•
•
The device supports the following operating systems:
{
Windows XP
{
Windows 2000
{
Windows Server 2003 Enterprise Edition
{
Windows Server 2003 Standard Edition
{
Windows Vista
{
Windows 7
{
Linux
{
MAC OS
If you are using a Windows operating system, turn off the Windows firewall. The Windows firewall
limits the number of TCP connections. When the limit is reached, you cannot log in to the Web
interface.
Web browser requirements
•
HP recommends that you use the following Web browsers:
{
Internet Explorer 6 SP2 or higher
{
Mozilla Firefox 3 or higher
{
Google Chrome 2.0.174.0 or higher
•
If you are using a Microsoft Internet Explorer browser, you must enable the security settings (see
"Enabling securing settings in a Microsoft Internet Explorer browser"), including Run ActiveX
controls and plug-ins, Script ActiveX controls marked safe for scripting, and Active scripting.
•
If you are using a Mozilla Firefox browser, you must enable JavaScript (see "Enabling JavaScript in a
Firefox browserEnabling JavaScript in a Firefox browser").
Enabling securing settings in a Microsoft Internet Explorer browser
1.
Launch the Internet Explorer, and select Tools > Internet Options from the main menu.
2.
Select the Security tab, and select the content zone where the target Website resides, as shown
in Figure 1.
2
Figure 1 Internet Explorer settings (1)
3.
Click Custom Level.
4.
In the Security Settings dialog box, enable Run ActiveX controls and plug-ins, Script ActiveX
controls marked safe for scripting, and Active scripting.
3
Figure 2 Internet Explorer settings (2)
5.
Click OK to save your settings.
Enabling JavaScript in a Firefox browser
1.
Launch the Firefox browser, and select Tools > Options.
2.
In the Options dialog box, click the Content icon, and select Enable JavaScript.
4
Figure 3 Firefox browser settings
3.
Click OK to save your settings.
Others
•
The Web interface does not support the Back, Next, and Refresh buttons provided by the browser.
Using these buttons might result in abnormal display of Web pages.
•
To ensure correct display of Web page contents after software upgrade or downgrade, clear data
cached by the browser before you log in.
•
If you click the verification code displayed on the Web login page, you can get a new verification
code.
•
Up to five users can concurrently log in to the device through the Web interface.
•
A list can contain a maximum of 20000 entries if displayed in pages.
•
The PC where you configure the device is not necessarily a Web-based network management
terminal. A Web-based network management terminal is a PC used to log in to the Web interface
and is required to be reachable to the device.
•
After logging in to the Web interface, you can select Device > Users from the navigation tree, create
a new user, and select Wizard or Network > VLAN interface to configure the IP address of the
VLAN interface acting as the management interface. For more information, see the corresponding
configuration guides of these modules.
5
Overview
The device provides web-based configuration interfaces for visual device management and
maintenance.
Figure 4 Web-based network management operating environment
Logging in to the Web interface
You can use the following default settings to log in to the web interface through HTTP:
•
Username—admin
•
Password—None
•
IP address of VLAN-interface 1 on the device—IP address of the device, depending on the status of
the network where the device resides.
{
{
If the device is not connected to the network, or no DHCP server exists in the subnet where the
device resides, you can get the IP address of the device on the label on the device. IP address
is 169.254.xxx.xxx. If the MAC address is 08004E000102, the IP address would be
169.254.1.2.
If a DHCP server exists in the subnet where the device resides, the device will dynamically
obtain its IP address through the DHCP server.
You can log in to the device through the console port, and execute the summary command to view the
information about its IP address.
<Sysname> summary
Select menu option:
Summary
IP Method:
DHCP
IP address:
169.254.1.2
Subnet mask:
255.255.0.0
Default gateway:
0.0.0.0
<Omitted>
Assuming that the IP address of the device is 169.254.1.2, to log in to the Web interface of the device
from a PC:
1.
Connect the Ethernet interface of the device to a PC by using a crossover Ethernet cable. By default,
all interfaces belong to VLAN 1.
2.
Configure an IP address for the PC and make sure that the PC and device can reach each other.
For example, assign the PC an IP address (for example, 169.254.1.27) within 169.254.0.0/16
(except for the IP address of the device).
3.
Open the browser, and input the login information.
a. Type the IP address http:// 169.254.1.2 in the address bar and press Enter.
The login page of the web interface (see Figure 5) appears.
6
b. Enter the username admin and the verification code, leave the password blank, and click
Login.
Figure 5 Login page of the Web interface
Logging out of the Web interface
CAUTION:
• You cannot log out by directly closing the browser.
• For security purposes, log out of the Web interface after you finish your operations.
1.
Save the current configuration.
Because the system does not save the current configuration automatically, HP recommends that
you perform this step to avoid loss of configuration.
2.
Click Logout in the upper-right corner of the Web interface.
Web interface
The Web interface includes three parts: navigation tree, title area, and body area, as shown in Figure 6.
Figure 6 Web-based configuration interface
(1) Navigation tree
(2) Body area
7
(3) Title area
•
Navigation tree—Organizes the Web-based NM functions as a navigation tree, where you can
select and configure functions as needed. The result is displayed in the body area.
•
Body area—Allows you to configure and display features.
•
Title area—On the left, displays the path of the current configuration interface in the navigation
area; on the right, provides the Save button to quickly save the current configuration, the Help button
to display the Web-related help information, and the Logout button to log out of the Web interface.
Web user level
Web user levels, from low to high, are visitor, monitor, configure, and management. A user with a
higher level has all the operating rights of a user with a lower level.
•
Visitor—Users of this level can only use the network diagnostic tools ping and Trace Route. They
can neither access the device data nor configure the device.
•
Monitor—Users of this level can only access the device data but cannot configure the device.
•
Configure—Users of this level can access device data and configure the device, but they cannot
upgrade the host software, add/delete/modify users, or backup/restore configuration files.
•
Management—Users of this level can perform any operations to the device.
Web-based NM functions
User level in Table 1 indicates that users of this level or users of a higher level can perform the
corresponding operations.
Table 1 Web-based NM function description
Function menu
Wizard
Description
User level
Perform quick configuration of the device.
Management
Display global settings and port settings of a stack.
Configure
Configure global parameters and stack ports.
Management
Topology
Summary
Display the topology summary of a stack.
Configure
Device
Summary
Display the control panels of stack members.
Configure
System
Information
Display the basic system information, system
resource state, and recent system operation logs.
Monitor
Device
Information
Display the port information about the device.
Monitor
IP Setup
Setup
Stack
Summary
Devi
ce
System Name
Display and configure the system name.
Configure
Basic
Web Idle
Timeout
Display and configure the idle timeout period for
logged-in users.
Configure
Device
Maintenanc
e
Software
Upgrade
Upload upgrade file from local host, and upgrade
the system software.
Management
Reboot
Reboot the device.
Management
8
Function menu
System Time
Description
User level
Electronic
Label
Display the electronic label of the device.
Monitor
Diagnostic
Information
Generate diagnostic information file and view or
save the file to local host.
Management
System Time
Display and configure the system date and time.
Configure
Net Time
Display the synchronization status of the system
clock and configure the network time.
Monitor
Display and refresh system logs.
Monitor
Clear system logs.
Configure
Loghost
Display and configure the loghost.
Configure
Log Setup
Display and configure the buffer capacity and
interval for refreshing system logs.
Configure
Backup
Back up the configuration file to be used at the next
startup from the device to the host of the current
user.
Management
Restore
Upload the configuration file to be used at the next
startup from the host of the current user to the
device.
Management
Save
Save the current configuration to the configuration
file to be used at the next startup.
Configure
Initialize
Restore the factory default settings.
Configure
File
Management
Manage files on the device, such as displaying the
file list, downloading a file, uploading a file, and
removing a file.
Management
Summary
Display port information by features.
Monitor
Detail
Display feature information by ports.
Monitor
Setup
Create, modify, delete, and enable/disable a port,
and clear port statistics.
Configure
Summary
Display the configuration information about a port
mirroring group.
Monitor
Add
Create a port mirroring group.
Configure
Remove
Remove a port mirroring group.
Configure
Modify Port
Configure ports for a mirroring group.
Configure
Summary
Display the brief information about FTP and Telnet
users.
Monitor
Super
Password
Configure a password for a lower-level user to
switch from the current access level to the
management level.
Management
Create
Create an FTP or Telnet user.
Management
Modify
Modify FTP or Telnet user information.
Management
Remove
Remove an FTP or a Telnet user.
Management
Loglist
Syslog
Configurati
on
File
Manageme
nt
Port
Manageme
nt
Port
Mirroring
Users
9
Function menu
Description
User level
Switch To
Management
Switch the current user level to the management
level.
Visitor
Loopback
Loopback
Perform loopback tests on Ethernet interfaces.
Configure
VCT
VCT
Check the status of the cables connected to Ethernet
ports.
Configure
Flow
Interval
Port Traffic
Statistics
Display the average rate at which the interface
receives and sends packets within a specified time
interval.
Monitor
Statistics
Display, create, modify, and clear RMON
statistics.
Configure
History
Display, create, modify, and clear RMON history
sampling information.
Configure
Alarm
Display, create, modify, and clear alarm entries.
Configure
Event
Display, create, modify, and clear event entries.
Configure
Log
Display log information about RMON events.
Configure
Energy Saving
Display and configure the energy saving settings of
an interface.
Configure
Display and refresh SNMP configuration and
statistics information.
Monitor
Configure SNMP.
Configure
Display SNMP community information.
Monitor
Create, modify, and delete an SNMP community.
Configure
Display SNMP group information.
Monitor
Create, modify, and delete an SNMP group.
Configure
Display SNMP user information.
Monitor
Create, modify, and delete an SNMP user.
Configure
Display the status of the SNMP trap function and
information about target hosts.
Monitor
Enable or disable the SNMP trap function; create,
modify, and delete a target host.
Configure
Display SNMP view information.
Monitor
Create, modify, and delete an SNMP view.
Configure
Display and clear the statistics information about
an interface.
Configure
RMON
Energy
Saving
Setup
Community
Group
SNMP
User
Trap
View
Interface
Statistics
Interface
Statistics
10
Function menu
VLAN
VLAN
Interface
Net
work
Voice VLAN
MAC
Description
User level
Select VLAN
Select a VLAN range.
Monitor
Create
Create VLANs.
Configure
Port Detail
Display the VLAN-related details of a port.
Monitor
Detail
Display the member port information about a
VLAN.
Monitor
Modify VLAN
Modify the description and member ports of a
VLAN.
Configure
Modify Port
Change the VLAN to which a port belongs.
Configure
Remove
Remove VLANs.
Configure
Summary
Display information about VLAN interfaces by
address type.
Monitor
Create
Create VLAN interfaces and configure IP addresses
for them.
Configure
Modify
Modify the IP addresses and status of VLAN
interfaces.
Configure
Remove
Remove VLAN interfaces.
Configure
Summary
Display voice VLAN information globally or on a
port.
Monitor
Setup
Configure the global voice VLAN.
Configure
Port Setup
Configure a voice VLAN on a port.
Configure
OUI Summary
Display the addresses of the OUIs that can be
identified by voice VLAN.
Monitor
OUI Add
Add the address of an OUI that can be identified
by voice VLAN.
Configure
OUI Remove
Remove the address of an OUI that can be
identified by voice VLAN.
Configure
Display MAC address information.
Monitor
Create and remove MAC addresses.
Configure
Display and configure MAC address aging time.
Configure
Display information about MST regions.
Monitor
Modify MST regions.
Configure
Global
Set global MSTP parameters.
Configure
Port Summary
Display the MSTP information about ports.
Monitor
Port Setup
Set MSTP parameters on ports.
Configure
Summary
Display information about link aggregation
groups.
Monitor
Create
Create link aggregation groups.
Configure
Modify
Modify link aggregation groups.
Configure
Remove
Remove link aggregation groups.
Configure
MAC
Setup
Region
MSTP
Link
Aggregatio
n
11
Function menu
LACP
LLDP
Description
User level
Summary
Display information about LACP-enabled ports and
their partner ports.
Monitor
Setup
Set LACP priorities.
Configure
Port Setup
Display the LLDP configuration information, local
information, neighbor information, statistics
information, and status information about a port.
Monitor
Modify LLDP configuration on a port.
Configure
Display global LLDP configuration information.
Monitor
Configure global LLDP parameters.
Configure
Global
Summary
Display global LLDP local information and statistics.
Monitor
Neighbor
Summary
Display global LLDP neighbor information.
Monitor
Display ARP table information.
Monitor
Add, modify, and remove ARP entries.
Configure
Display the configuration information about
gratuitous ARP.
Monitor
Configure gratuitous ARP.
Configure
Display ARP detection configuration information.
Monitor
Configure ARP detection.
Configure
Display global IGMP snooping configuration
information or the IGMP snooping configuration
information in a VLAN, and the IGMP snooping
multicast entry information.
Monitor
Configure IGMP snooping globally or in a VLAN.
Configure
Display the IGMP snooping configuration
information on a port.
Monitor
Configure IGMP snooping on a port.
Configure
Display global MLD snooping configuration
information or the MLD snooping configuration
information in a VLAN, and the MLD snooping
multicast entry information.
Monitor
Configure MLD snooping globally or in a VLAN.
Configure
Display the MLD snooping configuration
information on a port.
Monitor
Configure MLD snooping on a port.
Configure
Summary
Display the IPv4 active route table.
Monitor
Create
Create an IPv4 static route.
Configure
Remove
Delete the selected IPv4 static routes.
Configure
Global Setup
ARP Table
ARP
Manageme
nt
ARP
Anti-Attack
Gratuitous ARP
ARP Detection
Basic
IGMP
Snooping
Advanced
Basic
MLD
Snooping
Advanced
IPv4 Routing
12
Function menu
IPv6 Routing
Description
User level
Summary
Display the IPv6 active route table.
Monitor
Create
Create an IPv6 static route.
Configure
Remove
Delete the selected IPv6 static routes.
Configure
Monitor
DHCP Relay
Display information about the DHCP status,
advanced configuration information about the
DHCP relay agent, DHCP server group
configuration, DHCP relay agent interface
configuration, and the DHCP client information.
Enable/disable DHCP, configure advanced DHCP
relay agent settings, configure a DHCP server
group, and enable/disable the DHCP relay agent
on an interface.
Configure
Display the status, trusted and untrusted ports and
DHCP client information about DHCP snooping.
Monitor
Enable/disable DHCP snooping, and configure
DHCP snooping trusted and untrusted ports.
Configure
Display the states of services: enabled or disabled.
Configure
Service
Enable/disable services, and set related
parameters.
Management
IPv4 Ping
Ping an IPv4 address.
Visitor
IPv6 Ping
Ping an IPv6 address.
Visitor
IPv4
Traceroute
Perform IPv4 trace route operations.
Visitor
IPv6
Traceroute
Perform IPv6 trace route operations.
Visitor
Display MAC authentication configuration
information.
Monitor
Configure MAC authentication.
Configure
Display 802.1X configuration information globally
or on a port.
Monitor
Configure 802.1X globally or on a port.
Configure
Display port security configuration information.
Monitor
Configure port security.
Configure
Display ISP domain configuration information.
Monitor
Add and remove ISP domains.
Management
Display the authentication configuration
information about an ISP domain.
Monitor
Specify authentication methods for an ISP domain.
Management
Display the authorization method configuration
information about an ISP domain.
Monitor
Specify authorization methods for an ISP domain.
Management
DHCP
DHCP
Snooping
Service
Diagnostic
Tools
Auth
entic
ation
MAC
Authenticati
on
MAC
Authentication
802.1X
802.1X
Port Security
Port Security
Domain Setup
AAA
Authentication
Authorization
13
Function menu
Description
User level
Display the accounting method configuration
information about an ISP domain.
Monitor
Specify accounting methods for an ISP domain.
Management
RADIUS Server
Display and configure RADIUS server information.
Management
RADIUS Setup
Display and configure RADIUS parameters.
Management
Local User
Display configuration information about local
users.
Monitor
Create, modify, and remove a local user.
Management
Display configuration information about user
groups.
Monitor
Create, modify, and remove a user group.
Management
Display information about PKI entities.
Monitor
Add, modify, and delete a PKI entity.
Configure
Display information about PKI domains.
Monitor
Add, modify, and delete a PKI domain.
Configure
Display the certificate information about PKI
domains and the contents of a certificate.
Monitor
Generate a key pair, destroy a key pair, retrieve a
certificate, request a certificate, and delete a
certificate.
Configure
Display the contents of the CRL.
Monitor
Receive the CRL of a domain.
Configure
Summary
Display port isolation group information.
Monitor
Port Setup
Configure the ports in an isolation group.
Configure
Summary
Display the configurations of authorized IP, the
associated IPv4 ACL list, and the associated IPv6
ACL list.
Management
Setup
Configure authorized IP.
Management
Loopback
Detection
Display and configure system loopback detection
parameters and port loopback detection
parameters.
Configure
Summary
Display time range configuration information.
Monitor
Create
Create a time range.
Configure
Remove
Delete a time range.
Configure
Summary
Display IPv4 ACL configuration information.
Monitor
Create
Create an IPv4 ACL.
Configure
Basic Setup
Configure a rule for a basic IPv4 ACL.
Configure
Advanced
Setup
Configure a rule for an advanced IPv4 ACL.
Configure
Accounting
RADIUS
Users
User Group
Entity
Domain
Certificate
Manageme
nt
Certificate
CRL
Port Isolate
Group
Secu
rity
Authorized
IP
Loopback
Detection
Time Range
QoS
ACL IPv4
14
Function menu
Description
User level
Link Setup
Create a rule for a link layer ACL.
Configure
Remove
Delete an IPv4 ACL or its rules.
Configure
Summary
Display IPv6 ACL configuration information.
Monitor
Create
Create an IPv6 ACL.
Configure
Basic Setup
Configure a rule for a basic IPv6 ACL.
Configure
Advanced
Setup
Configure a rule for an advanced IPv6 ACL.
Configure
Remove
Delete an IPv6 ACL or its rules.
Configure
Summary
Display the queue information about a port.
Monitor
Setup
Configure a queue on a port.
Configure
Summary
Display line rate configuration information.
Monitor
Setup
Configure the line rate.
Configure
Summary
Display classifier configuration information.
Monitor
Create
Create a class.
Configure
Setup
Configure the classification rules for a class.
Configure
Remove
Delete a class or its classification rules.
Configure
Summary
Display traffic behavior configuration information.
Monitor
Create
Create a traffic behavior.
Configure
Setup
Configure actions for a traffic behavior.
Configure
Port Setup
Configure traffic mirroring and traffic redirecting
for a traffic behavior
Configure
Remove
Delete a traffic behavior.
Configure
Summary
Display QoS policy configuration information.
Monitor
Create
Create a QoS policy.
Configure
Setup
Configure the classifier-behavior associations for a
QoS policy.
Configure
Remove
Delete a QoS policy or its classifier-behavior
associations.
Configure
Summary
Display the QoS policy applied to a port.
Monitor
Setup
Apply a QoS policy to a port.
Configure
Remove
Remove the QoS policy from the port.
Configure
Priority
Mapping
Priority
Mapping
Display priority mapping table information.
Monitor
Modify the priority mapping entries.
Configure
Port Priority
Port Priority
Display port priority and trust mode information.
Monitor
Modify port priority and trust mode.
Configure
ACL IPv6
Queue
Line Rate
Classifier
Behavior
QoS Policy
Port Policy
15
Function menu
PoE
PoE
Description
User level
Summary
Display PSE information and PoE interface
information.
Monitor
PSE Setup
Configure a PoE interface.
Configure
Port Setup
Configure a port.
Configure
Common items on the Web pages
Buttons and icons
Table 2 Commonly used buttons and icons
Button and icon
Function
Applies the configuration on the current page.
Cancels the configuration on the current page.
Refreshes the current page.
Clears all entries in a list or all statistics.
Adds an item.
,
Removes the selected items.
Selects all the entries in a list.
Clears selection of all entries in a list.
Buffers but does not apply the configuration of the current step, and enters
the next configuration step.
Buffers but does not apply the configuration of the current step, and returns
to the previous configuration step.
Applies the configurations of all configuration steps.
Enters the modification page of an item so that you can modify the
configurations of the item.
Deletes the item corresponding to this icon.
Page display function
The Web interface can display contents by pages, as shown in Figure 7. You can set the number of
entries displayed per page, and view the contents on the first, previous, next, and last pages, or go to any
page that you want to check.
16
Figure 7 Content display by pages
Search function
The Web interface provides you with the basic and advanced searching functions to display only the
entries that match specific searching criteria.
•
Basic search—As shown in Figure 7, type the keyword in the text box above the list, select a search
item from the list and click Search to display the entries that match the criteria. Figure 8 shows an
example of searching for entries with LLDP disabled.
Figure 8 Basic search function example
•
Advanced search—As shown in Figure 9, you can click the Advanced Search link to open the
advanced search area. Specify the search criteria, and click Apply to display the entries that match
the criteria.
17
Figure 9 Advanced search
Take the LLDP table shown in Figure 7 as an example.
To search for the LLDP entries with LLDP Work Mode TxRx, and LLDP Status Disabled:
1.
Click the Advanced Search link, specify the search criteria on the advanced search page as shown
in Figure 10, and click Apply. The LLDP entries with LLDP Work Mode being TxRx are displayed.
Figure 10 Advanced search function example (1)
2.
Click the Advanced Search link, specify the search criteria on the advanced search page as shown
in Figure 11, and click Apply. The LLDP entries with LLDP Work Mode being TxRx and LLDP Status
being Disabled are displayed as shown in Figure 12.
Figure 11 Advanced search function example (2)
18
Figure 12 Advanced search function example (3)
Sort function
On some list pages, the Web interface provides the sorting function to display the entries in a certain
order.
The Web interface provides you with the sorting functions to display entries in certain orders.
On a list page, you can click the blue heading item of each column to sort the entries based on the
heading item you selected. After your clicking, the heading item is displayed with an arrow beside it as
shown in Figure 13. The upward arrow indicates the ascending order, and the downward arrow
indicates the descending order.
Figure 13 Sort display
19
Configuring the switch at the CLI
The HP 1920 Switch Series can be configured through the CLI, Web interface, and SNMP/MIB, among
which the Web interface supports all 1920 Switch Series configurations. These configuration methods
are suitable for different application scenarios. As a supplementary to the Web interface, the CLI
provides some configuration commands to facilitate your operation, which are described in this chapter.
To perform other configurations not supported by the CLI, use the Web interface.
You will enter user view directly after you log in to the device. Commands in the document are all
performed in user view.
Getting started with the CLI
As a supplementary to the Web interface, the CLI provides some configuration commands to facilitate
your operation. For example, if you forget the IP address of VLAN-interface 1 and cannot log in to the
device through the Web interface, you can connect the console port of the device to a PC, and
reconfigure the IP address of VLAN-interface 1 at the CLI.
This section describes using the CLI to manage the device.
Setting up the configuration environment
To set up the configuration environment, connect a terminal (a PC in this example) to the console port on
the switch with a console cable.
A console cable is an 8-core shielded cable, with a crimped RJ-45 connector at one end for connecting
to the console port of the switch, and a DB-9 female connector at the other end for connecting to the
serial port on the console terminal.
Figure 14 Console cable
A side
Pos.9
Main label
8
A
B side
B
1
Pos.1
Use a console cable to connect a terminal device to the switch, as follows:
1.
Plug the DB-9 female connector to the serial port of the console terminal or PC.
2.
Connect the RJ-45 connector to the console port of the switch.
CAUTION:
Identify the mark on the console port to make sure that you are connecting to the correct port.
20
NOTE:
• The serial port on a PC does not support hot swapping. When you connect a PC to a powered-on switch,
connect the DB-9 connector of the console cable to the PC before connecting the RJ-45 connector to the
switch.
• When you disconnect a PC from a powered-on switch, disconnect the DB-9 connector of the console
cable from the PC after disconnecting the RJ-45 connector from the switch.
Setting terminal parameters
To configure and manage the switch, you must run a terminal emulator program on the console terminal.
The following are the required terminal settings:
•
Bits per second—38,400
•
Data bits—8
•
Parity—None
•
Stop bits—1
•
Flow control—None
•
Emulation—VT100
To set terminal parameters, for example, on a Windows XP HyperTerminal:
1.
Select Start > All Programs > Accessories > Communications > HyperTerminal.
The Connection Description dialog box appears.
2.
Enter the name of the new connection in the Name field and click OK.
Figure 15 Connection description
3.
Select the serial port to be used from the Connect using list, and click OK.
21
Figure 16 Setting the serial port used by the HyperTerminal connection
4.
Set Bits per second to 38400, Data bits to 8, Parity to None, Stop bits to 1, and Flow control to
None, and click OK.
Figure 17 Setting the serial port parameters
5.
Select File > Properties in the HyperTerminal window.
22
Figure 18 HyperTerminal window
6.
Click the Settings tab, set the emulation to VT100, and click OK in the Switch Properties dialog
box.
Figure 19 Setting terminal emulation in Switch Properties dialog box
23
Logging in to the CLI
The login process requires a username and password. The default username for first time configuration
is admin, no password is required. Usernames and passwords are case sensitive.
To log in to the CLI:
1.
Press Enter. The Username prompt displays:
Login authentication
Username:
2.
Enter your username at the Username prompt.
Username:admin
3.
Press Enter. The Password prompt appears.
Password:
The login information is verified, and the following CLI menu appears:
<HP 1920 Switch>
If the password is invalid, the following message appears and process restarts.
% Login failed!
CLI commands
This section contains the following commands:
Task
Command
Display a list of CLI commands on the device.
?
Reboot the device and run the default configuration.
initialize
Configure VLAN-interface 1 to obtain an IPv4 address through
DHCP or manual configuration.
ipsetup { dhcp | ip-address ip-address { mask
| mask-length } [ default-gateway
ip-address ] }
Configure VLAN-interface 1 to obtain an IPv6 address through
the autoconfiguration function or manual configuration.
ipsetup ipv6 { auto | address { ipv6-address
prefix-length | ipv6-address/prefix-length }
[ default-gateway ipv6-address ] }
Modify the login password.
password
Log out of the system.
quit
Download the Boot ROM image or system software image file
from the TFTP server and specify it as the startup configuration
file.
upgrade [ ipv6 ] server-address
source-filename { bootrom | runtime }
Reboot the device and run the main configuration file.
reboot
View the summary information about the device.
summary
Ping a specified destination.
ping [ ipv6 ] host
Tear down the current connection and quit the system.
quit
24
initialize
Syntax
initialize
Parameters
None
Description
Use initialize to delete the configuration file to be used at the next startup and reboot the device with the
default configuration being used during reboot.
Use the command with caution because this command deletes the configuration file to be used at the
next startup and restores the factory default settings.
Examples
# Delete the configuration file to be used at the next startup and reboot the device with the default
configuration being used during reboot.
<Sysname> initialize
The startup configuration file will be deleted and the system will be rebooted.Continue?
[Y/N]:y
Please wait...
ipsetup
Syntax
ipsetup { dhcp | ip-address ip-address { mask | mask-length } [ default-gateway ip-address ] }
Parameters
dhcp: Specifies the interface to obtain an IPv4 address through DHCP.
ip-address ip-address: Specifies an IPv4 address for VLAN-interface 1 in dotted decimal notation.
mask: Subnet mask in dotted decimal notation.
mask-length: Subnet mask length, the number of consecutive ones in the mask, in the range of 0 to 32.
default-gateway ip-address: Specifies the IPv4 address of the default gateway. With this argument and
keyword combination configured, the command not only assigns an IPv4 address to the interface, but
also specifies a default route for the device.
Description
Use ipsetup dhcp to specify VLAN-interface 1 to obtain an IPv4 address through DHCP.
Use ipsetup ip address ip-address { mask | mask-length } to assign an IPv4 address to VLAN-interface 1.
By default, the device automatically obtains its IPv4 address through DHCP; if fails, it uses the assigned
IP address.
If there is no VLAN-interface 1, either command creates VLAN-interface 1 first, and then specifies its IPv4
address.
Examples
# Create VLAN-interface 1 and specify the interface to obtain an IPv4 address through DHCP.
<Sysname> ipsetup dhcp
25
# Create VLAN-interface 1 and assign 192.168.1.2 to the interface, and specify 192.168.1.1 as the default
gateway.
<Sysname> ipsetup ip-address 192.168.1.2 24 default-gateway 192.168.1.1
ipsetup ipv6
Syntax
ipsetup ipv6 { auto | address { ipv6-address prefix-length | ipv6-address/prefix-length }
[ default-gateway ipv6-address ] }
Parameters
auto: Enables the stateless address autoconfiguration function. With this function enabled,
VLAN-interface 1 can automatically generate a global unicast address and link local address.
address: Enables manual configuration of a global unicast IPv6 address for VLAN-interface 1.
ipv6-address: Specifies an IPv6 address.
prefix-length: Prefix length in the range of 1 to 128.
default-gateway ipv6-address: Specifies the IPv6 address of the default gateway. With this argument
and keyword combination configured, the command not only assigns an IPv6 address to the interface,
but also specifies a default route for the device.
Description
Use ipsetup ipv6 auto to enable the stateless address autoconfiguration function so a global unicast
address and link local address can be automatically generated.
Use ipsetup ipv6 address { ipv6-address prefix-length | ipv6-address/prefix-length } [ default-gateway
ipv6-address ] to manually assign an IPv6 address to VLAN-interface 1.
Examples
# Create VLAN-interface 1 and enable VLAN-interface 1 to automatically generate a global unicast IPv6
address and link local address.
<Sysname> ipsetup ipv6 auto
# Create VLAN-interface 1 and assign 2001::2 to the interface, with the prefix length 64, and specify
2001::1 as the default gateway.
<Sysname> ipsetup ipv6 address 2001::2 64 default-gateway 2001::1
password
Syntax
password
Parameters
None
Description
Use password to modify the login password of a user.
Examples
# Modify the login password of user admin.
<Sysname> password
26
Change password for user: admin
Old password: ***
Enter new password: **
Retype password: **
The password has been successfully changed.
ping
Syntax
ping host
Parameters
host: Destination IPv4 address (in dotted decimal notation) or host name (a string of 1 to 255 characters).
Description
Use ping to ping a specified destination.
To terminate a ping operation, press Ctrl+C.
Examples
# Ping IP address 1.1.2.2.
<Sysname> ping 1.1.2.2
PING 1.1.2.2: 56
data bytes, press CTRL_C to break
Reply from 1.1.2.2: bytes=56 Sequence=1 ttl=254 time=205 ms
Reply from 1.1.2.2: bytes=56 Sequence=2 ttl=254 time=1 ms
Reply from 1.1.2.2: bytes=56 Sequence=3 ttl=254 time=1 ms
Reply from 1.1.2.2: bytes=56 Sequence=4 ttl=254 time=1 ms
Reply from 1.1.2.2: bytes=56 Sequence=5 ttl=254 time=1 ms
--- 1.1.2.2 ping statistics --5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 1/41/205 ms
The output shows that IP address 1.1.2.2 is reachable and the echo replies are all returned from the
destination. The minimum, average, and maximum roundtrip intervals are 1 millisecond, 41 milliseconds,
and 205 milliseconds respectively.
ping ipv6
Syntax
ping ipv6 host
Parameters
host: Destination IPv6 address or host name (a string of 1 to 255 characters).
Description
Use ping ipv6 to ping a specified destination.
To terminate a ping operation, press Ctrl+C.
27
Examples
# Ping IPv6 address 2001::4.
<Sysname> ping ipv6 2001::4
PING 2001::4 : 56
data bytes, press CTRL_C to break
Reply from 2001::4
bytes=56 Sequence=1 hop limit=64
time = 15 ms
Reply from 2001::4
bytes=56 Sequence=2 hop limit=64
time = 2 ms
Reply from 2001::4
bytes=56 Sequence=3 hop limit=64
time = 11 ms
Reply from 2001::4
bytes=56 Sequence=4 hop limit=64
time = 2 ms
Reply from 2001::4
bytes=56 Sequence=5 hop limit=64
time = 12 ms
--- 2001::4 ping statistics --5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 2/8/15 ms
The output shows that IPv6 address 2001::4 is reachable and the echo replies are all returned from the
destination. The minimum, average, and maximum roundtrip intervals are 2 millisecond, 8 milliseconds,
and 15 milliseconds respectively.
quit
Syntax
quit
Parameters
None
Description
Use quit to log out of the system.
Examples
# Log out of the system.
<Sysname> quit
******************************************************************************
* Copyright (c) 2010-2014 Hewlett-Packard Development Company, L.P.
*
* Without the owner's prior written consent,
*
* no decompiling or reverse-engineering shall be allowed.
*
******************************************************************************
User interface aux0 is available.
28
reboot
Syntax
reboot
Parameters
None
Description
Use reboot to reboot the device and run the main configuration file.
Use the command with caution because reboot results in service interruption.
If the main configuration file is corrupted or does not exist, the device cannot be rebooted with the reboot
command. In this case, you can specify a new main configuration file to reboot the device, or you can
power off the device, and then power it on, and the system will automatically use the backup
configuration file at the next startup.
If you reboot the device when file operations are being performed, the system does not execute the
command to ensure security.
Examples
# If the configuration does not change, reboot the device.
<Sysname> reboot
Start to check configuration with next startup configuration file, please
wait.........DONE!
This command will reboot the device. Continue? [Y/N]:y
Now rebooting, please wait...
# If the configuration changes, reboot the device.
<Sysname> reboot
Start to check configuration with next startup configuration file, please
wait.........DONE!
This command will reboot the device. Current configuration will be lost in next startup
if you continue. Continue? [Y/N]:y
Now rebooting, please wait...
summary
Syntax
summary
Parameters
None
Description
Use summary to view the summary of the device, including the IP address of VLAN-interface 1, and
software version information.
Examples
# Display summary information about the device.
<sysname>summary
29
Select menu option:
Summary
IP Method:
Manual
IP address:
192.168.0.233
Subnet mask:
255.255.255.0
Default gateway:
IPv6 Method:
IPv6 link-local address:
IPv6 subnet mask length:
IPv6 global address:
IPv6 subnet mask length:
IPv6 default gateway:
Current boot app is: flash:/hp1920-24G.bin
Next main boot app is: flash:/hp1920-24G.bin
Next backup boot app is: flash:/test.bin
HP Comware Platform Software
Comware Software, Version 5.20.99, ESS 1101
Copyright (c) 2010-2014 Hewlett-Packard Development Company, L.P.
HP 1920-24G Switch uptime is 0 week, 0 day, 1 hour, 25 minutes
HP 1920-24G Switch
128M
bytes DRAM
32M
bytes Flash Memory
Config Register points to Flash
Hardware Version is VER.A
Bootrom Version is 109
[SubSlot 0] 24GE+4SFP Hardware Version is VER.A
upgrade
Syntax
upgrade server-address source-filename { bootrom | runtime }
Parameters
server-address: IPv4 address or host name (a string of 1 to 20 characters) of a TFTP server.
source-filename: Software package name on the TFTP server.
bootrom: Specifies the Boot ROM image in the software package file as the startup configuration file.
runtime: Specifies the system software image file in the software package file as the startup configuration
file.
Description
Use upgrade server-address source-filename bootrom to upgrade the Boot ROM image. If the Boot ROM
image in the downloaded software package file is not applicable, the original Boot ROM image is still
used as the startup configuration file.
30
Use upgrade server-address source-filename runtime to upgrade the system software image file. If the
system software image file in the downloaded software package file is not applicable, the original
system software image file is still used as the startup configuration file.
To validate the downloaded software package file, reboot the device.
NOTE:
The HP 1920 Switch Series does not provide an independent Boot ROM image; instead, it integrates the
Boot ROM image with the system software image file together in a software package file with the
extension name of .bin.
Examples
# Download software package file main.bin from the TFTP server and use the Boot ROM image in the
package as the startup configuration file.
<Sysname> upgrade 192.168.20.41 main.bin bootrom
# Download software package file main.bin from the TFTP server and use the system software image file
in the package as the startup configuration file.
<Sysname> upgrade 192.168.20.41 main.bin runtime
upgrade ipv6
Syntax
upgrade ipv6 server-address source-filename { bootrom | runtime }
Parameters
server-address: IPv6 address of a TFTP server.
source-filename: Software package name on the TFTP server.
bootrom: Specifies the Boot ROM image in the software package file as the startup configuration file.
runtime: Specifies the system software image file in the software package file as the startup configuration
file.
Description
Use upgrade ipv6 server-address source-filename bootrom to upgrade the Boot ROM image. If the Boot
ROM image in the downloaded software package file is not applicable, the original Boot ROM image
is still used as the startup configuration file.
Use upgrade ipv6 server-address source-filename runtime to upgrade the system software image file. If
the system software image file in the downloaded software package file is not applicable, the original
system software image file is still used as the startup configuration file.
To validate the downloaded software package file, reboot the device.
NOTE:
The HP 1920 Switch Series does not provide an independent Boot ROM image; instead, it integrates the
Boot ROM image with the system software image file together in a software package file with the
extension name of .bin.
31
Examples
# Download software package file main.bin from the TFTP server and use the Boot ROM image in the
package as the startup configuration file.
<Sysname> upgrade ipv6 2001::2 main.bin bootrom
# Download software package file main.bin from the TFTP server and use the system software image file
in the package as the startup configuration file.
<Sysname> upgrade ipv6 2001::2 main.bin runtime
Configuration example for upgrading the system
software image at the CLI
Network requirements
As shown in Figure 20, a 1920 switch is connected to the PC through the console cable, and connected
to the gateway through Ethernet 1/0/1. The IP address of the gateway is 192.168.1.1/24, and that of the
TFTP server where the system software image (suppose its name is Switch1920.bin) is located is
192.168.10.1/24. The gateway and the switch can reach each other.
The administrator upgrades the Boot ROM image and the system software image file of the 1920 switch
through the PC and sets the IP address of the switch to 192.168.1.2/24.
Figure 20 Network diagram
Console cable
IP network
Console port
PC
GE1/0/1
Switch
Gateway
TFTP server
Configuration procedure
1.
Run the TFTP server program on the TFTP server, and specify the path of the file to be loaded.
(Omitted)
2.
Configure the switch:
# Configure the IP address of VLAN-interface 1 of the switch as 192.168.1.2/24, and specify the
default gateway as 192.168.1.1.
<Switch> ipsetup ip-address 192.168.1.2 24 default-gateway 192.168.1.1
# Download the software package file Switch1920.bin on the TFTP server to the switch, and
upgrade the system software image in the package.
<Switch> upgrade 192.168.10.1 Switch1920.bin runtime
File will be transferred in binary mode
Downloading file from remote TFTP server, please wait.../
TFTP: 10262144 bytes received in 71 second(s)
File downloaded successfully.
# Download the software package file Switch1920.bin on the TFTP server to the switch, and
upgrade the Boot ROM image.
<Switch> upgrade 192.168.10.1 Switch1920.bin bootrom
The file flash:/Switch1920.bin exists. Overwrite it? [Y/N]:y
Verifying server file...
32
Deleting the old file, please wait...
File will be transferred in binary mode
Downloading file from remote TFTP server, please wait.../
TFTP: 10262144 bytes received in 61 second(s)
File downloaded successfully.
BootRom file updating finished!
# Reboot the switch.
<Switch> reboot
After getting the new image file, reboot the switch to validate the upgraded image.
33
Configuration wizard
The configuration wizard guides you through configuring the basic service parameters, including the
system name, system location, contact information, and management IP address.
Basic service setup
Entering the configuration wizard homepage
Select Wizard from the navigation tree.
Figure 21 Configuration wizard homepage
Configuring system parameters
1.
On the wizard homepage, click Next.
34
Figure 22 System parameter configuration page
2.
Configure the parameters as described in Table 3.
Table 3 Configuration items
Item
Description
Specify the system name.
Sysname
The system name appears at the top of the navigation tree.
You can also set the system name in the System Name page you enter by selecting
Device > Basic. For more information, see "Configuring basic device settings."
Specify the physical location of the system.
Syslocation
You can also set the physical location in the setup page you enter by selecting
Device > SNMP. For more information, see "Configuring SNMP."
Set the contact information for users to get in touch with the device vendor for help.
Syscontact
You can also set the contact information in the setup page you enter by selecting
Device > SNMP. For more information, see "Configuring SNMP."
35
Configuring management IP address
CAUTION:
Modifying the management IP address used for the current login terminates the connection to the device.
Use the new management IP address to re-log in to the system.
1.
On the system parameter configuration page, click Next.
Figure 23 Management IP address configuration page
2.
Configure the parameters as described in Table 4.
Table 4 Configuration items
Item
Description
Select a VLAN interface.
Select VLAN
Interface
Available VLAN interfaces are those configured in the page that you enter by selecting
Network > VLAN Interface and selecting the Create tab.
The IP address of a VLAN interface can be used as the management IP address to access
the device. Configure a VLAN interface and its IP address in the page that you enter by
selecting Network > VLAN Interface. For more information, see "Configuring VLAN
interfaces."
36
Item
Description
Enable or disable the VLAN interface.
When errors occurred in the VLAN interface, disable the interface and then enable the
port to bring the port to operate correctly.
Admin status
By default, the VLAN interface is down if no Ethernet ports in the VLAN is up. The VLAN
is in the up state if one or more ports in the VLAN are up.
IMPORTANT:
Disabling or enabling the VLAN interface does not affect the status of the Ethernet ports in
the VLAN. That is, the port status does not change with the VLAN interface status.
DHCP
Configure how the VLAN interface obtains an IPv4 address:
BOOTP
• DHCP—Select the option for the VLAN interface to get an IP address
through DHCP.
• BOOTP—Select the option for the VLAN interface to get an IP address
Configure IPv4
address
Manual
through BOOTP.
• Manual—Select this option to manually specify an IPv4 address and
the mask length for the VLAN interface.
IPv4 address
MaskLen
Auto
Specify an IPv4 address and the mask length for the VLAN interface.
Dotted decimal notation is also allowed for the mask length field.
These two fields are configurable if Manual is selected.
Configure how the VLAN interface obtains an IPv6 link-local address.
• Auto—Select this option for the device to automatically generate a
Configure IPv6
link-local address
Manual
link-local address based on the link-local address prefix (FE80::/64)
and the link layer address of the interface.
• Manual—Select this option to manually assign an IPv6 link-local
address to the interface.
IPv6 address
Specify an IPv6 link-local address for the VLAN interface.
This field is configurable if you select Manual. The address prefix must be
FE80::/64.
Finishing configuration wizard
After finishing the management IP address configuration, click Next.
The page displays your configurations. Review the configurations and if you want to modify the settings
click Back to go back to the page. Click Finish to confirm your settings and the system performs the
configurations.
37
Figure 24 Configuration complete
38
Configuring stack
Overview
The stack management feature allows you to configure and monitor a group of connected devices by
logging in to one device in the stack, as shown in Figure 25.
Figure 25 Stacking devices
To set up a stack for a group of connected devices, you must log in to one device to create the stack. This
device is the master device for the stack. You configure and monitor all member devices on the master
device. The ports that connect the stack member devices are called stack ports.
Configuration task list
Perform the tasks in Table 5 to configure a stack.
Table 5 Stack configuration task list
Task
Remarks
Configuring the master device of a stack:
Required.
Configuring global parameters of a stack
Configure a private IP address pool for a stack and establish the
stack, and meantime the device becomes the master device of the
stack.
By default, no IP address pool is configured for a stack and no stack
is established.
Required.
Configuring stack ports
Configure the ports of the master device that connect to member
devices as stack ports.
By default, a port is not a stack port.
39
Task
Remarks
Configuring member devices of a stack:
Required.
Configuring stack ports
Configure a port of a member device that connects to the master
device or another member device as a stack port.
By default, a port is not a stack port.
Displaying topology summary of a stack
Optional.
Display information about stack members.
Optional.
Display the control panels of stack members.
IMPORTANT:
Displaying device summary of a stack
Before viewing the control panel of a member device, you must make
sure the username, password, and access right you used to log on to
the master device are the same with those configured on the member
device; otherwise, the control panel of the member device cannot be
displayed.
Optional.
Log in to the Web network management interface of a member
device from the master device.
Logging in to a member device from the
master
IMPORTANT:
Before logging in to a member device, you must make sure the
username, password, and access right you used to log on to the
master device are the same with those configured on the member
device. Otherwise, you cannot log in to the member device. You can
configure them by selecting Device and then clicking Users from the
navigation tree.
Configuring global parameters of a stack
Select Stack from the navigation tree to enter the page shown in Figure 26. You can configure global
parameters of a stack in the Global Settings area.
40
Figure 26 Setting up
Table 6 Configuration items
Item
Description
Configure a private IP address pool for the stack.
Private Net IP
Mask
The master device of a stack must be configured with a private IP address pool to
make sure it can automatically allocate an available IP address to a member device
when the device joints the stack.
IMPORTANT:
When you configure a private IP address pool for a stack, the number of IP addresses
in the address pool needs to be equal to or greater than the number of devices to be
added to the stack. Otherwise, some devices might not be able to join the stack
automatically for lack of private IP addresses.
Enable the device to establish a stack.
Build Stack
After you enable the device to establish a stack, the device becomes the master
device of the stack and automatically adds the devices connected to its stack ports to
the stack.
IMPORTANT:
You can delete a stack only on the master device of the stack. The Global Settings area
on a member device is grayed out.
Configuring stack ports
Select Stack from the navigation tree to enter the page shown in Figure 26. You can configure stack ports
in the Port Settings area.
•
Select the box before a port name, and click Enable to configure the port as a stack port.
•
Select the box before a port name, and click Disable to configure the port as a non-stack port.
41
Displaying topology summary of a stack
Select Stack from the navigation tree and click the Topology Summary tab to enter the page shown
in Figure 27.
Figure 27 Topology Summary tab
Table 7 Field description
Fields
Description
Member ID of the device in the stack:
Device ID
• Value 0 indicates that the device is the master device of the stack.
• A value other than 0 indicates that the device is a member device and the value
is the member ID of the member device in the stack.
Device Role
Role of the device in the stack: master or slave.
Displaying device summary of a stack
Select Stack from the navigation tree and click the Device Summary tab to enter the page shown in Figure
28. On this page, you can view interfaces on the panel of each stack member by clicking the tab of the
corresponding member device.
Figure 28 Device summary (the master device)
Logging in to a member device from the master
Select Stack from the navigation tree, click the Device Summary tab, and click the tab of a member
device to enter the page shown in Figure 29.
Click the Configuring the Device hyperlink, you can log in to the Web interface of the member device to
manage and maintain the member device directly.
42
Figure 29 Device summary (a member device)
Stack configuration example
Network requirements
As shown in Figure 30, Switch A, Switch B, Switch C, and Switch D are connected to one another.
Create a stack, where Switch A is the master device, and Switch B, Switch C, and Switch D are member
devices. An administrator can log in to Switch B, Switch C, and Switch D through Switch A to perform
remote configurations.
Figure 30 Network diagram
Configuration procedure
1.
Configure global parameters for the stack on Switch A:
a. Select Stack from the navigation tree of Switch A, and then perform the subsequent steps on the
Setup tab, as shown in Figure 31.
b. Type 192.168.1.1 in the field of Private Net IP.
c. Type 255.255.255.0 in the field of Mask.
d. Select Enable from the Build Stack list.
e. Click Apply.
43
Figure 31 Configuring global parameters for the stack on Switch A
Switch A becomes the master device.
2.
Configure a stack port on Switch A:
a. In the Port Settings area on the Setup tab, select GigabitEthernet1/0/1.
b. Click Enable.
Figure 32 Configuring a stack port on Switch A
3.
On Switch B, configure GigabitEthernet 1/0/2 (connected to Switch A), GigabitEthernet 1/0/1
(connected to Switch C), and GigabitEthernet 1/0/3 (connected to Switch D) as stack ports:
a. Select Stack from the navigation tree of Switch B.
b. In the Port Settings area on the Setup tab, select GigabitEthernet1/0/1, GigabitEthernet1/0/2,
and GigabitEthernet1/0/3.
c. Click Enable.
44
Figure 33 Configuring stack ports on Switch B
Switch B becomes a member device.
4.
On Switch C, configure GigabitEthernet 1/0/1 (the port connected to Switch B) as a stack port:
a. Select Stack from the navigation tree of Switch C.
b. In the Port Settings area on the Setup tab, select GigabitEthernet1/0/1.
c. Click Enable.
Figure 34 Configuring a stack port on Switch C
Switch C becomes a member device.
5.
On Switch D, configure GigabitEthernet 1/0/1 (the port connected to Switch B) as a stack port:
a. Select Stack from the navigation tree of Switch D.
b. In the Port Settings area on the Setup tab, select GigabitEthernet1/0/1.
c. Click Enable.
Switch D becomes a member device.
45
Verifying the configuration
To verify the stack topology on Switch A:
1.
Select Stack from the navigation tree of Switch A.
2.
Click the Topology Summary tab.
Figure 35 Verifying the configuration
Configuration guidelines
When you configure a stack, follow these guidelines:
•
If a device is already configured as the master device of a stack, you cannot modify the private IP
address pool on the device.
•
If a device is already configured as a member device of a stack, the Global Settings area on the
member device is not available.
46
Displaying system and device information
Displaying system information
Select Summary from the navigation tree to enter the System Information page to view the basic system
information, system resource state, and recent system logs.
Figure 36 System information
Displaying basic system information
Table 8 Field description
Item
Description
Product Information
Description for the device.
Device Location
Device location, which you can configure on the page you enter by
selecting Device > SNMP > Setup.
Contact Information
Contact information, which you can configure on the page you enter
by selecting Device > SNMP > Setup.
SerialNum
Serial number of the device.
Software Version
Software version of the device.
Hardware Version
Hardware version of the device.
Bootrom Version
Boot ROM version of the device.
Running Time
System up time.
47
Displaying the system resource state
The System Resource State area displays the most recent CPU usage, memory usage, and temperature.
Displaying recent system logs
Table 9 Field description
Field
Description
Time
Time when the system logs were generated.
Level
Severity of the system logs.
Description
Description for the system logs.
The System Information page displays up to five the most recent system logs.
To display more system logs, click More to enter the Log List page. You can also enter this page by
selecting Device > Syslog. For more information, see "Configuring syslog."
Setting the refresh period
To set the interval for refreshing system information, select one of the following options from the Refresh
Period list:
•
If you select a certain period, the system refreshes system information at the specified interval.
•
If you select Manual, the system refreshes system information only when you click the Refresh button.
Displaying device information
Select Summary from the navigation tree, and click the Device Information tab to enter the page that
displays information about the device ports. Hover the cursor over a port and the port details appear,
including the port name, type, speed, utilization, and status, as shown in Figure 37. The aggregation
group number is also displayed if the port is added to an aggregation group. For the description about
the port number and its color, see Figure 37.
48
Figure 37 Device information
To set the interval for refreshing device information, select one of the following options from the Refresh
Period list:
•
If you select a certain period, the system refreshes device information at the specified interval.
•
If you select Manual, the system refreshes device information only when you click the Refresh button.
49
Configuring basic device settings
The device basic information feature provides the following functions:
•
Set the system name of the device. The configured system name is displayed on the top of the
navigation bar.
•
Set the idle timeout period for logged-in users. The system logs an idle user off the Web for security
purpose after the configured period.
Configuring system name
1.
Select Device > Basic from the navigation tree.
The system name configuration page appears.
Figure 38 Configuring the system name
2.
Enter the system name.
3.
Click Apply.
Configuring idle timeout period
1.
Select Device > Basic from the navigation tree.
2.
Click the Web Idle Timeout tab.
The page for configuring idle timeout period appears.
Figure 39 Configuring the idle timeout period
50
3.
Set the idle timeout period for logged-in users.
4.
Click Apply.
51
Maintaining devices
Software upgrade
CAUTION:
Software upgrade takes some time. Avoid performing any operation on the Web interface during the
upgrading procedure. Otherwise, the upgrade operation may be interrupted.
A boot file, also known as the system software or device software, is an application file used to boot the
device. Software upgrade allows you to obtain a target application file from the local host and set the file
as the boot file to be used at the next reboot. In addition, you can select whether to reboot the device to
bring the upgrade software into effect.
1.
Select Device > Device Maintenance from the navigation tree to enter the Software Upgrade tab.
Figure 40 Software upgrade configuration page
2.
Configure software upgrade parameters as described in Table 10.
3.
Click Apply.
Table 10 Configuration items
Item
Description
File
Specify the path and filename of the local application file, which must be suffixed
with the .app or .bin extension.
Specify the type of the boot file for the next boot:
File Type
• Main—Boots the device.
• Backup—Boots the device when the main boot file is unavailable.
52
Item
Description
If a file with the same
name already exists,
overwrite it without any
prompt
Specify whether to overwrite the file with the same name.
If you do not select the option, when a file with the same name exists, a dialog box
appears, telling you that the file already exists and you cannot continue the
upgrade.
Reboot after the upgrade
finished
Specify whether to reboot the device to make the upgraded software take effect
after the application file is uploaded.
Device reboot
CAUTION:
• Before rebooting the device, save the configuration. Otherwise, all unsaved configuration will be lost
after device reboot.
• When the device reboots, re-log in to the device.
1.
Select Device > Device Maintenance from the navigation tree.
2.
Click the Reboot tab.
Figure 41 Device reboot page
3.
Enable or disable the "Check whether the current configuration is saved in the next startup
configuration file" option.
4.
Click Reboot. A confirmation dialog box appears.
5.
Click OK.
{
{
If you select Check whether the current configuration is saved in the next startup configuration
file, the system will check the configuration before rebooting the device. If the check succeeds,
the system reboots the device. If the check fails, a dialog box appears, telling you that the
current configuration and the saved configuration are inconsistent, and the device is not
rebooted. In this case, save the current configuration manually before you can reboot the
device.
If you do not select the box, the system reboots the device directly.
53
Electronic label
Electronic label allows you to view information about the device electronic label, which is also known as
the permanent configuration data or archive information. The information is written into the storage
medium of a device or a card during the debugging and testing processes, and includes card name,
product bar code, MAC address, debugging and testing dates, and manufacture name.
1.
Select Device > Device Maintenance from the navigation tree.
2.
Click the Electronic Label tab to view the electronic label information.
Figure 42 Electronic label
Diagnostic information
Each functional module has its own running information. Generally, you view the output for each module
one by one. To receive as much information as possible in one operation during daily maintenance or
when system failure occurs, the diagnostic information module allows you to save the running statistics of
multiple functional modules to a file named default.diag, and then you can locate problems faster by
checking this file.
1.
Select Device > Device Maintenance from the navigation tree.
2.
Click the Diagnostic Information tab.
Figure 43 Diagnostic information
3.
Click Create Diagnostic Information File.
The system begins to generate a diagnostic information file.
4.
Click Click to Download.
The File Download dialog box appears.
5.
Select to open this file or save this file to the local host.
54
Figure 44 The diagnostic information file is created
The generation of the diagnostic file takes a period of time. During this process, do not perform any
operation on the Web page.
After the diagnostic file is generated successfully, you can view this file on the page you enter by
selecting Device > File Management, or downloading this file to the local host. For more information, see
"Managing files."
55
Configuring system time
Overview
You must configure a correct system time so that the device can operate correctly with other devices. The
system time module allows you to display and set the device system time on the Web interface.
You can set the system time through manual configuration or network time protocol (NTP) automatic
synchronization.
Defined in RFC 1305, the NTP synchronizes timekeeping among distributed time servers and clients. NTP
can keep consistent timekeeping among all clock-dependent devices within the network, and ensure a
high clock precision so that the devices can provide diverse applications based on consistent time.
Displaying the current system time
To view the current system date and time, select Device > System Time from the navigation tree to enter
the System Time page.
Figure 45 System time configuration page
Manually configuring the system time
1.
Select Device > System Time from the navigation tree.
The page for configuration the system time appears.
2.
Click the System Time Configuration text to open a calendar.
56
Figure 46 Calendar page
3.
Enter the system date and time in the Time field, or select the date and time in the calendar. To set
the time on the calendar page, select one of the following methods:
{
{
4.
Click Today. The date setting in the calendar is synchronized to the current local date
configuration, and the time setting does not change.
Select the year, month, date, and time, and then click OK.
Click Apply on the system time configuration page to save your configuration.
Configuring system time by using NTP
1.
Select Device > System Time from the navigation tree.
2.
Click the Network Time Protocol tab.
The page for configuring the system time through NTP appears.
Figure 47 NTP configuration page
3.
Configure the system time as described in Table 11.
4.
Click Apply.
57
Table 11 Configuration items
Item
Description
Clock status
Display the synchronization status of the system clock.
Source Interface
Set the source interface for an NTP message.
This configuration makes the source IP address in the NTP messages the
primary IP address of this interface. If the specified source interface is
down, the source IP address is the primary IP address of the egress
interface.
TIP:
If you do not want the IP address of an interface on the local device to
become the destination address of response messages, specify the
source interface for NTP messages.
Key 1
Set NTP authentication key.
Key 2
Enable the NTP authentication feature for a system running NTP in a
network that requires high security. This feature improves the network
security by means of client-server key authentication, and prohibits a
client from synchronizing with a device that has failed authentication.
You can set two authentication keys, each of which has a key ID and a
key string.
• ID—ID of a key.
• Key string—Character string of the MD5 authentication key.
External
Reference
Source
NTP Server
1/Reference
Key ID.
NTP Server
2/Reference
Key ID.
Specify the IP address of an NTP server, and configure the
authentication key ID used for the association with the NTP server. The
device synchronizes its time to the NTP server only if the key provided
by the server is the same as the specified key.
You can configure two NTP servers. The clients choose the optimal
reference source.
IMPORTANT:
The IP address of an NTP server is a unicast address, and cannot be a
broadcast or a multicast address, or the IP address of the local clock
source.
System time configuration example
Network requirements
As shown in Figure 48:
•
The local clock of Device A is set as the reference clock.
•
Switch B operates in client mode, and uses Device A as the NTP server.
Configure NTP authentication on Device A and Switch B so that Switch B is to be synchronized to Device
A.
58
Figure 48 Network diagram
Configuring the system time
1.
Configure the local clock as the reference clock, with the stratum of 2. Enable NTP authentication,
set the key ID to 24, and specify the created authentication key aNiceKey as a trusted key. (Details
not shown.)
2.
On Switch B, configure Device A as the NTP server:
a. Select Device > System Time from the navigation tree.
b. Click the Network Time Protocol tab.
c. Enter 24 in the ID field, enter aNiceKey in the Key String field for key 1, enter 1.0.1.11 in the
NTP Server 1 field, and enter 24 in the Reference Key ID field.
d. Click Apply.
Figure 49 Configuring Device A as the NTP server of Switch B
Verifying the configuration
After the configuration, verify that Device A and Switch B have the same system time.
Configuration guidelines
When you configure the system time, follow these guidelines:
•
A device can act as a server to synchronize the clock of other devices only after its clock has been
synchronized. If the clock of a server has a stratum level higher than or equal to the level of a client's
clock, the client will not synchronize its clock to the server's.
59
•
The synchronization process takes some time. The clock status might be displayed as
unsynchronized after your configuration. In this case, refresh the page to view the clock status and
system time later on.
•
If the system time of the NTP server is ahead of the system time of the device, and the time gap
exceeds the Web idle time specified on the device, all online Web users are logged out because of
timeout after the synchronization finishes.
60
Configuring syslog
System logs record network and device information, including running status and configuration changes.
With system logs, administrators can take corresponding actions against network problems and security
problems.
The system sends system logs to the following destinations:
•
Console
•
Monitor terminal, a terminal that has logged in to the device through the AUX or VTY user interface
•
Log buffer
•
Log host
•
Web interface
•
Log file
Displaying syslogs
1.
Select Device > Syslog from the navigation tree.
The page for displaying syslogs appears. You can click Reset to clear all system logs saved in the
log buffer on the Web interface. You can click Refresh to manually refresh the page, or you can
set the refresh interval on the Log Setup page to enable the system to automatically refresh the
page periodically. For more information, see "Setting buffer capacity and refresh interval."
Figure 50 Displaying syslogs
2.
View system logs.
61
Table 12 Field description
Field
Description
Time/Date
Displays the time/date when the system log was generated.
Source
Displays the module that generated the system log.
Displays the severity level of the system log. The information is classified into eight
levels by severity:
Level
•
•
•
•
•
•
•
•
Emergency—The system is unusable.
Alert—Action must be taken immediately.
Critical—Critical condition.
Error—Error condition.
Warning—Warning condition.
Notification—Normal but significant condition.
Information—Informational message.
Debug—Debug-level message.
Digest
Displays the brief description of the system log.
Description
Displays the content of the system log.
Setting the log host
1.
Select Device > Syslog from the navigation tree.
2.
Click the Loghost tab.
The log host configuration page appears.
Figure 51 Setting the log host
3.
Configure the log host as described in Table 13.
62
4.
Click Apply.
Table 13 Configuration items
Item
Description
IPv4/Domain
Specify the IPv4 address or domain name
of the log host.
Loghost IP/Domain
IPv6
Loghost IP
Set the IPv6 address of the log host.
IMPORTANT:
You can specify up to four log hosts.
Setting buffer capacity and refresh interval
1.
Select Device > Syslog from the navigation tree.
2.
Click the Log Setup tab.
The syslog configuration page appears.
Figure 52 Syslog configuration page
3.
Configure buffer capacity and refresh interval as described in Table 14.
4.
Click Apply.
Table 14 Configuration items
Item
Description
Buffer Capacity
Set the number of logs that can be stored in the log buffer.
Set the log refresh interval.
You can select manual refresh or automatic refresh:
Refresh Interval
• Manual—Click Refresh to view the latest log information.
• Automatic—Select to refresh the Web interface every 1 minute, 5 minutes, or 10
minutes.
63
Managing the configuration
You can back up, restore, save, or reset the device configuration.
Backing up the configuration
Configuration backup allows you to do the following:
•
Open and view the configuration files for the next startup, including the .cfg file and .xml file.
•
Back up the configuration files for the next startup to your local host.
IMPORTANT:
HP recommends backing up both the .cfg and .xml files. If you back up only the .cfg file, some
configuration information might not be restored when, for example, the configuration is mistakenly
removed.
To back up the configuration:
1.
Select Device > Configuration from the navigation tree.
The Backup page appears.
Figure 53 Backing up the configuration
2.
Click the upper Backup button.
The file download dialog box appears.
3.
Choose to view the .cfg file or to save the file to your local host.
4.
Click the lower Backup button.
The file download dialog box appears.
5.
Choose to view the .xml file or to save the file to the local host.
Restoring the configuration
Configuration restoration allows you to do the following:
•
Upload a .cfg file from your local host to the device.
•
Upload an .xml file from your local host to the device, and delete the .xml configuration file that
was used for the next startup.
The restored configuration takes effect at the next device startup.
64
To restore the configuration:
1.
Select Device > Configuration from the navigation tree.
2.
Click the Restore tab.
Figure 54 Restoring the configuration
3.
Click the upper Browse button.
The file upload dialog box appears.
4.
Select the .cfg file to be uploaded, and click OK.
5.
Click the lower Browse button.
The file upload dialog box appears.
6.
Select the .xml file to be uploaded, and click OK.
Saving the configuration
You save the running configuration to both the .cfg configuration file and .xml configuration file that will
be used at the next startup.
Saving the configuration takes some time.
Only one administrator can save the configuration at a moment. If you save the configuration while the
system is saving the configuration as required by another administrator, the system prompts you to try
again later.
You can save the configuration in either of the following modes:
•
Fast mode.
To save the configuration in fast mode, click the Save button at the upper right of the auxiliary
area.
65
Figure 55 Saving the configuration
•
Common mode.
To save the configuration in common mode:
a. Select Device > Configuration from the navigation tree.
b. Click the Save tab.
c. Click Save Current Settings.
Resetting the configuration
Resetting the configuration restores the device's factory defaults, deletes the current configuration files,
and reboots the device.
To reset the configuration:
1.
Select Device > Configuration from the navigation tree.
2.
Click the Initialize tab.
3.
Click Restore Factory-Default Settings.
Figure 56 Resetting the configuration
66
Managing files
The device requires a series of files for correct operation, including boot files and configuration files.
These files are saved on the storage media. You can display files on the storage media, download,
upload, or remove a file, or specify the main boot file.
Displaying files
1.
Select Device > File Management from the navigation tree.
Figure 57 File management page
2.
Select a medium from the Please select disk list.
Two categories of information are displayed:
{
{
Medium information, including the used space, the free space, and the capacity of the medium.
File information, including all files on the medium, the file sizes, and the boot file types (Main or
Backup). The boot file type is only displayed for an application file (.bin or .app file) that will be
used as the main or backup boot file.
Downloading a file
1.
Select Device > File Management from the navigation tree to enter the file management page
(see Figure 57).
2.
From the Please select disk list, select the medium where the file to be downloaded resides.
3.
Select the file from the list.
Only one file can be downloaded at a time.
67
4.
Click Download File.
The File Download dialog box appears.
5.
Open the file or save the file to a path.
Uploading a file
IMPORTANT:
Uploading a file takes some time. HP recommends not performing any operation on the Web interface
during the upload.
1.
Select Device > File Management from the navigation tree to enter the file management page
(see Figure 57).
2.
In the Upload File area, select the medium for saving the file from the Please select disk list.
3.
Click Browse to navigate to the file to be uploaded.
4.
Click Apply.
Removing a file
1.
Select Device > File Management from the navigation tree to enter the file management page
(see Figure 57).
2.
Do one of the following:
{
Click the
icon of a file to remove the file.
{
Select a file from the file list and click Remove File.
To remove multiple files, repeat step 2, or select the files from the file list and click Remove File.
Specifying the main boot file
1.
Select Device > File Manage from the navigation tree to enter the file management page
(see Figure 57).
2.
From the Please select disk list, select the medium that holds the application file to be used as the
main boot file.
3.
Select the application file (.bin or .app file) from the file list.
4.
Click Set as Main Boot File.
68
Managing ports
You can use the port management feature to set and view the operation parameters of a Layer 2 Ethernet
port and an aggregate interface.
•
For a Layer 2 Ethernet port, these operation parameters include its state, speed, duplex mode, link
type, PVID, description, MDI mode, flow control settings, MAC learning limit, and storm
suppression ratios.
•
For an aggregate interface, these operation parameters include its state, link type, PVID, description,
and MAC learning limit.
Setting operation parameters for a port
1.
Select Device > Port Management from the navigation tree.
2.
Click the Setup tab.
69
Figure 58 The Setup tab
3.
Set the operation parameters for the port as described in Table 15.
4.
Click Apply.
Table 15 Configuration items
Item
Description
Enable or disable the port.
Port State
Sometimes, after you modify the operation parameters of a port, you must disable and
then enable the port to have the modifications take effect.
70
Item
Description
Set the transmission speed of the port:
Speed
•
•
•
•
•
•
•
•
•
•
•
10—10 Mbps.
100—100 Mbps.
1000—1000 Mbps.
Auto—Autonegotiation.
Auto 10—Autonegotiated to 10 Mbps.
Auto 100—Autonegotiated to 100 Mbps.
Auto 1000—Autonegotiated to 1000 Mbps.
Auto 10 100—Autonegotiated to 10 or 100 Mbps.
Auto 10 1000—Autonegotiated to 10 or 1000 Mbps.
Auto 100 1000—Autonegotiated to 100 or 1000 Mbps.
Auto 10 100 1000—Autonegotiated to 10, 100, or 1000 Mbps.
Set the duplex mode of the port:
Duplex
Link Type
PVID
Description
• Auto—Autonegotiation.
• Full—Full duplex.
• Half—Half duplex.
Set the link type of the current port, which can be access, hybrid, or trunk. For more
information, see "Configuring VLANs."
To change the link type of a port from trunk to hybrid, or vice versa, you must first set its link
type to access.
Set the port VLAN ID (PVID) of the interface. For more information about setting the PVID,
see "Configuring VLANs."
To make sure a link correctly transmits packets, the trunk or hybrid ports at the two ends of
the link must have the same PVID.
Set the description of the port.
Set the MDI mode of the port.
You can use two types of Ethernet cables to connect Ethernet devices: crossover cable and
straight-through cable. To accommodate these two types of cables, an Ethernet port can
operate in one of the following three MDI modes: across, normal, and auto.
An Ethernet port is composed of eight pins. By default, each pin has its particular role. For
example, pin 1 and pin 2 are used for transmitting signals, and pin 3 and pin 6 are used
for receiving signals. You can change the pin roles by setting the MDI mode.
• For an Ethernet port in across mode, pin 1 and pin 2 are used for transmitting signals,
and pin 3 and pin 6 are used for receiving signals. The pin roles are not changed.
MDI
• For an Ethernet port in auto mode, the pin roles are decided through autonegotiation.
• For an Ethernet port in normal mode, the pin roles are changed. Pin 1 and pin 2 are
used for receiving signals, and pin 3 and pin 6 are used for transmitting signals.
To enable normal communication, you must connect the local transmit pins to the remote
receive pins. Configure the MDI mode depending on the cable types.
When you configure the MID mode, follow these guidelines:
• Typically, use the auto mode. The other two modes are used only when the device
cannot determine the cable type.
• When straight-through cables are used, the local MDI mode must be different from the
remote MDI mode.
• When crossover cables are used, the local MDI mode must be the same as the remote
MDI mode, or the MDI mode of at least one end must be set to auto.
71
Item
Description
Enable or disable flow control on the port.
Flow Control
With flow control enabled at both sides, when traffic congestion occurs on the ingress
port, the ingress port sends a Pause frame notifying the egress port to temporarily suspend
the sending of packets. The egress port is expected to stop sending any new packet when
it receives the Pause frame. In this way, flow control helps to avoid dropping of packets.
Flow control works only after it is enabled on both the ingress and egress ports.
Enable or disable auto power-down on a port that is down.
By default, auto power-down is disabled on an Ethernet port that is down.
With auto power-down enabled on an Ethernet port that stays in the down state for a
certain period, the following events occur:
Power Save
• The device automatically stops supplying power to the port.
• The port enters the power save mode.
When the Ethernet port comes up, the following events occur:
• The device automatically restores power supply to the port.
• The port resumes its normal state.
Set the MAC learning limit on the port:
Max MAC Count
• User Defined—Select this option to set the limit manually.
• No Limited—Select this option to set no limit.
Enable or disable Energy Efficient Ethernet (EEE) on a link-up port.
EEE
With EEE enabled, when a link-up Ethernet port does not receive any packet for a certain
period, it automatically enters low power mode. When a packet arrives later, the device
restores power supply to the port and the port resumes its normal state.
Set broadcast suppression on the port:
• ratio—Sets the maximum percentage of broadcast traffic to the total bandwidth of an
Ethernet port. When you select this option, you must enter a percentage in the box
below.
Broadcast
Suppression
• pps—Sets the maximum number of broadcast packets that can be forwarded on an
Ethernet port per second. When you select this option, you must enter a number in the
box below.
• kbps—Sets the maximum number of kilobits of broadcast traffic that can be forwarded
on an Ethernet port per second. When you select this option, you must enter a number
in the box below.
Set multicast suppression on the port:
• ratio—Sets the maximum percentage of multicast traffic to the total bandwidth of an
Ethernet port. When you select this option, you must enter a percentage in the box
below.
Multicast
Suppression
• pps—Sets the maximum number of multicast packets that can be forwarded on an
Ethernet port per second. When you select this option, you must enter a number in the
box below.
• kbps—Sets the maximum number of kilobits of multicast traffic that can be forwarded
on an Ethernet port per second. When you select this option, you must enter a number
in the box below.
72
Item
Description
Set unicast suppression on the port:
• ratio—Sets the maximum percentage of unicast traffic to the total bandwidth of an
Ethernet port. When you select this option, you must enter a percentage in the box
below.
Unicast
Suppression
• pps—Sets the maximum number of unicast packets that can be forwarded on an
Ethernet port per second. When you select this option, you must enter a number in the
box below.
• kbps—Sets the maximum number of kilobits of unicast traffic that can be forwarded on
an Ethernet port per second. When you select this option, you must enter a number in
the box below.
Selected Ports
Interface or interfaces that you have selected from the chassis front panel and the
aggregate interface list below, for which you have set operation parameters.
You can set only the state and MAC learning limit for an aggregate interface.
If you set operation parameters that a port does not support, you are notified of invalid settings and might
fail to set the supported operation parameters for the port or other ports.
Displaying port operation parameters
Displaying a specified operation parameter for all ports
1.
Select Device > Port Management from the navigation tree.
The Summary page appears by default.
2.
Select the option for a parameter you want to view.
The parameter information for all the ports is displayed in the lower part of the page.
73
Figure 59 The Summary tab
Displaying all the operation parameters for a port
1.
Select Device > Port Management from the navigation tree
2.
Click the Detail tab.
3.
Select a port whose operation parameters you want to view in the chassis front panel.
The operation parameter settings of the selected port are displayed on the lower part of the page.
Whether the parameter takes effect is displayed in the square brackets.
Figure 60 The Detail tab
74
Port management configuration example
Network requirements
As shown in Figure 61:
•
Server A, Server B, and Server C are connected to GigabitEthernet 1/0/1, GigabitEthernet 1/0/2,
and GigabitEthernet 1/0/3 of the switch, respectively. The rates of the network adapters of these
servers are all 1000 Mbps.
•
The switch connects to the external network through GigabitEthernet 1/0/4 whose speed is 1000
Mbps.
To avoid congestion at the egress port GigabitEthernet 1/0/4, configure the autonegotiation speed
range on GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 as 100 Mbps.
Figure 61 Network diagram
Configuring the switch
1.
As shown in Figure 62, set the speed of GigabitEthernet 1/0/4 to 1000 Mbps:
75
Figure 62 Configuring the speed of GigabitEthernet 1/0/4
2.
Batch configure the autonegotiation speed range on GigabitEthernet 1/0/1, GigabitEthernet
1/0/2, and GigabitEthernet 1/0/3 as 100 Mbps:
a. On the Setup tab, select Auto 100 from the Speed list.
b. Select 1, 2, and 3 on the chassis front panel.
1, 2, and 3 represent ports GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and
GigabitEthernet 1/0/3.
c. Click Apply.
76
Figure 63 Batch configuring the port speed
3.
Display the speed settings of ports:
a. Click the Summary tab.
b. Click the Speed button to display the speed information of all ports on the lower part of the
page, as shown in Figure 64.
77
Figure 64 Displaying the speed settings of ports
78
Configuring port mirroring
Port mirroring refers to the process of copying the packets passing through a port/VLAN/CPU to the
monitor port connecting to a monitoring device for packet analysis.
Terminology
Mirroring source
The mirroring source can be one or more monitored ports, called source ports. The device where the
ports reside is called a "source device." Packets (called "mirrored packets") passing through them are
copied to a port connecting to a monitoring device for packet analysis.
Mirroring destination
The mirroring destination is the destination port (also known as the monitor port) of mirrored packets and
connects to the data monitoring device. The device where the monitor port resides is called the
"destination device." The monitor port forwards the mirrored packets to its connecting monitoring device.
A monitor port might receive multiple duplicates of a packet in some cases because it can monitor
multiple mirroring sources. For example, assume that Port 1 is monitoring bidirectional traffic on Port 2
and Port 3 on the same device. If a packet travels from Port 2 to Port 3, two duplicates of the packet will
be received on Port 1.
Mirroring direction
The mirroring direction indicates that the inbound, outbound, or bidirectional traffic can be copied on a
mirroring source:
•
Inbound—Copies packets received on a mirroring source.
•
Outbound—Copies packets sent out of a mirroring source.
•
Bidirectional—Copies packets both received and sent on a mirroring source.
Mirroring group
Port mirroring is implemented through mirroring groups, which include local and remote mirroring groups.
Only local mirroring groups are supported.
Local port mirroring
In local port mirroring, the mirroring source and the mirroring destination are on the same device. A
mirroring group that contains the mirroring source and the mirroring destination on the device is called
a "local mirroring group."
79
Figure 65 Local port mirroring implementation
As shown in Figure 65, the source port GigabitEthernet 1/0/1 and monitor port GigabitEthernet 1/0/2
reside on the same device. Packets of GigabitEthernet 1/0/1 are copied to GigabitEthernet 1/0/2,
which then forwards the packets to the data monitoring device for analysis.
Configuration restrictions and guidelines
When you configure port mirroring, follow these restrictions and guidelines:
•
A local mirroring group can contain multiple source ports, but only one monitor port.
•
Do not enable the spanning tree feature on the monitor port.
•
Use a monitor port only for port mirroring to make sure the data monitoring device receives and
analyzes only the mirrored traffic rather than a mix of mirrored traffic and other forwarded traffic.
Recommended configuration procedures
Step
1.
2.
3.
Remarks
Configure a local mirroring
group.
Configure source ports for
the mirroring group.
Configure the monitor port
for the mirroring group.
Required.
For more information, see "Configuring a mirroring group."
Select the mirroring group type local in the Type list.
Required.
For more information, see "Configuring ports for the mirroring group."
Select the port type Mirror Port.
Required.
For more information, see "Configuring ports for the mirroring group."
Select the port type Monitor Port.
Configuring a mirroring group
1.
From the navigation tree, select Device > Port Mirroring.
80
2.
Click Add to enter the page for adding a mirroring group.
Figure 66 Adding a mirroring group
3.
Configure the mirroring group as described in Table 16.
4.
Click Apply.
Table 16 Configuration items
Item
Description
Mirroring Group ID
ID of the mirroring group to be added.
Type
Specify the type of the mirroring group to be added as Local, which indicates
adding a local mirroring group.
Configuring ports for the mirroring group
1.
From the navigation tree, select Device > Port Mirroring.
2.
Click Modify Port to enter the page for configuring ports for a mirroring group.
81
Figure 67 Modifying ports
3.
Configure ports for the mirroring group as described in Table 17.
4.
Click Apply.
A progress dialog box appears.
5.
After the success notification appears, click Close.
Table 17 Configuration items
Item
Mirroring
Group ID
Description
ID of the mirroring group to be configured.
The available groups were added previously.
Select a Local mirroring group ID to configure ports for the local mirroring group.
Configure ports for a local mirroring group:
Port Type
• Monitor Port—Configures the monitor ports for the local mirroring group.
• Mirror Port—Configures mirroring ports for the local mirroring group.
Set the direction of the traffic monitored by the monitor port of the mirroring group:
Stream
Orientation
Select port(s)
• both—Mirrors both received and sent packets on mirroring ports.
• inbound—Mirrors only packets received by mirroring port.
• outbound—Mirrors only packets sent by mirroring ports.
Click the ports to be configured on the chassis front panel. If aggregate interfaces are
configured on the device, the page displays a list of aggregate interfaces below the chassis
front panel. You can select aggregate interfaces from this list and configure them as
mirroring ports of a port mirroring group.
82
Local port mirroring configuration example
Network requirements
As shown in Figure 68, configure local port mirroring on Switch A so the server can monitor the packets
received and sent by the Marketing department and Technical department.
Figure 68 Network diagram
Configuration procedure
Adding a local mirroring group
1.
From the navigation tree, select Device > Port Mirroring.
2.
Click Add to enter the page for adding mirroring groups as shown in Figure 69.
Figure 69 Adding a local mirroring group
83
3.
Enter 1 for Mirroring Group ID, and select Local from the Type list.
4.
Click Apply.
Configuring GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2 as the source ports
1.
Click Modify Port.
2.
Select 1 – Local from the Mirroring Group ID list.
3.
Select Mirror Port from the Port Type list.
4.
Select both from the Stream Orientation list.
5.
Select 1 (GigabitEthernet 1/0/1) and 2 (GigabitEthernet 1/0/2) on the chassis front panel.
Figure 70 Configuring the source ports
6.
Click Apply.
A configuration progress dialog box appears.
7.
After the success notification appears, click Close.
Configuring GigabitEthernet 1/0/3 as the monitor port
1.
Click Modify Port.
2.
Select 1 – Local from the Mirroring Group ID list.
3.
Select Monitor Port from the Port Type list.
4.
Select 3 (GigabitEthernet 1/0/3) on the chassis front panel.
84
Figure 71 Configuring the monitor port
5.
Click Apply.
A configuration progress dialog box appears.
6.
After the success notification appears, click Close.
85
Managing users
The user management function allows you to do the following:
•
Adding a local user, and specifying the password, access level, and service types for the user.
•
Setting the super password for non-management level users to switch to the management level.
•
Switching to the management level from a lower level.
Adding a local user
1.
Select Device > Users from the navigation tree.
2.
Click the Create tab.
Figure 72 Adding a local user
3.
Configure a local user as described in Table 18.
4.
Click Apply.
Table 18 Configuration items
Item
Description
Username
Enter a username for the user.
86
Item
Description
Select an access level for the user.
Users of different levels can perform different operations. User levels, in order from low
to high, are as follows:
• Visitor—A visitor level user can perform only ping and traceroute operations. They
cannot access the data on the device or configure the device.
Access Level
• Monitor—A monitor level user can perform ping and traceroute operations and
access the data on the device, but they cannot configure the device.
• Configure—A configure level user can perform ping and traceroute operations,
access data on the device, and configure the device, but they cannot upgrade the
software, add/delete/modify users, or back up or restore the configuration file.
• Management—A management level user can perform any operations on the device.
Password
Set the password for the user.
Confirm Password
Enter the same password again.
Select the password encryption type:
Password
Encryption
• Reversible—Uses a reversible encryption algorithm. The ciphertext password can be
decrypted to get the plaintext password.
• Irreversible—Uses an irreversible encryption algorithm. The ciphertext password
cannot be decrypted to get the plaintext password.
Service Type
Select the service types for the user to use, including Web, FTP, and Telnet. You must
select at least one service type.
Setting the super password
A management level user can set the password for non-management level users to switch to the
management level. If the password is not set, non-management level users cannot switch to the
management level from a lower level.
To set the super password:
1.
Select Device > Users from the navigation tree.
2.
Click the Super Password tab.
Figure 73 Setting the super password
3.
Configure a super password as described in Table 19.
87
4.
Click Apply.
Table 19 Configuration items
Item
Description
Select the operation type:
Create/Remove
• Create—Configure or change the super password.
• Remove—Remove the current super password.
Password
Set the password for non-management level users to switch to the management level.
Confirm Password
Enter the same password again.
Select the password encryption type:
Password
Encryption
• Reversible—Uses a reversible encryption algorithm. The ciphertext password can be
decrypted to get the plaintext password.
• Irreversible—Uses an irreversible encryption algorithm. The ciphertext password
cannot be decrypted to get the plaintext password.
Switching to the management level
A non-management level user can switch to the management level after providing the correct super
password.
The level switching operation does not change the access level setting for the user. When the user logs
in to the Web interface again, the access level of the user is still the level set for the user.
To switch to the management level:
1.
Select Device > Users from the navigation tree.
2.
Click the Switch To Management tab.
3.
Enter the correct super password.
4.
Click Login.
Figure 74 Switching to the management level
88
Configuring a loopback test
You can check whether an Ethernet port operates correctly by performing Ethernet port loopback test.
During the test time, the port cannot forward data packets correctly.
Ethernet port loopback test has the following types:
•
Internal loopback test—Establishes self loop in the switching chip and checks whether there is a
chip failure related to the functions of the port.
•
External loopback test—Uses a loopback plug on the port. Packets forwarded by the port will be
received by itself through the loopback plug. The external loopback test can be used to check
whether there is a hardware failure on the port.
Configuration guidelines
When you configure a loopback test, follow these restrictions and guidelines:
•
When a port is physically down, you cannot perform an external loopback test on the port.
•
After a port is shut down manually, you can perform neither internal nor external test on the port.
•
When a port is under loopback test, you cannot apply Rate, Duplex, Cable Type, and Port Status
configuration to the port.
•
An Ethernet port operates in full duplex mode when a loopback test is performed. It restores its
original duplex mode after the loopback test is finished.
Configuration procedure
1.
From the navigation tree, select Device > Loopback.
Figure 75 Loopback test page
2.
Select External or Internal for loopback test type.
3.
Select an Ethernet interface from the chassis front panel.
89
4.
Click Test.
After the test is complete, the system displays the loopback test result.
Figure 76 Loopback test result
90
Configuring VCT
Overview
You can use the Virtual Cable Test (VCT) function to check the status of the cable connected to an Ethernet
port on the device. The result is returned in less than 5 seconds. The test covers whether short circuit or
open circuit occurs on the cable and the length of the faulty cable.
The fiber port does not support this feature.
Testing cable status
1.
Select Device > VCT from the navigation tree to enter the page for testing cable status.
2.
Select the port you want to test on the chassis front panel.
3.
Click Test.
The test result is returned within 5 seconds and displayed in the Result field.
Figure 77 Testing the status of the cable connected to an Ethernet port
The result displays the cable status and length. The cable status can be normal, abnormal,
abnormal (open), abnormal (short), or failure.
{
{
{
When a cable is normal, the cable length displayed is the total length of the cable.
When a cable is abnormal, the cable length displayed is the length between the current port
and the location where fault occurs.
The cable length detected can have an error of up to 5 meters.
91
Configuring the flow interval
With the flow interval module, you can view the number of packets and bytes sent and received by a port,
and the bandwidth use of the port over the specified interval.
Viewing port traffic statistics
1.
Select Device > Flow interval from the navigation tree.
By default, the Port Traffic Statistics tab is displayed.
2.
View the number of packets and bytes sent and received by each port, and the bandwidth use of
each port over the last interval.
Figure 78 Port traffic statistics
When the bandwidth utilization is lower than 1%, 1% is displayed.
92
Configuring RMON
Overview
Remote Network Monitoring (RMON) is an enhancement to SNMP. It enables proactive remote
monitoring and management of network devices and subnets. An RMON monitor periodically or
continuously collects traffic statistics for the network attached to a port on the managed device. The
managed device can automatically send a notification when a statistic crosses an alarm threshold, so the
NMS does not need to constantly poll MIB variables and compare the results.
RMON uses SNMP notifications to notify NMSs of various alarm conditions such as broadcast traffic
threshold exceeded. In contrast, SNMP reports function and interface operating status changes such as
link up, link down, and module failure.
HP devices provide an embedded RMON agent as the RMON monitor. An NMS can perform basic
SNMP operations to access the RMON MIB.
Working mechanism
RMON monitors typically take one of the following forms:
•
Dedicated RMON probes—NMSs can obtain management information from RMON probes
directly and control network resources. NMSs can obtain all RMON MIB information by using this
method.
•
RMON agents embedded in network devices—NMSs exchange data with RMON agents by using
basic SNMP operations to gather network management information. Because this method is
resource intensive, most RMON agent implementations provide only four groups of MIB information:
alarm, event, history, and statistics.
You can configure your device to collect and report traffic statistics, error statistics, and performance
statistics.
RMON groups
Among the RFC 2819 defined RMON groups, HP implements the statistics group, history group, event
group, and alarm group supported by the public MIB. HP also implements a private alarm group, which
enhances the standard alarm group.
Ethernet statistics group
The statistics group defines that the system collects various traffic statistics on an interface (only Ethernet
interfaces are supported), and saves the statistics in the Ethernet statistics table (ethernetStatsTable) for
future retrieval. The interface traffic statistics include network collisions, CRC alignment errors,
undersize/oversize packets, broadcasts, multicasts, bytes received, and packets received.
After you create a statistics entry for an interface, the statistics group starts to collect traffic statistics on the
interface. The statistics in the Ethernet statistics table are cumulative sums.
93
History group
The history group defines that the system periodically collects traffic statistics on interfaces and saves the
statistics in the history record table (ethernetHistoryTable). The statistics include bandwidth utilization,
number of error packets, and total number of packets.
The history statistics table record traffic statistics collected for each sampling interval. The sampling
interval is user-configurable.
Event group
The event group defines event indexes and controls the generation and notifications of the events
triggered by the alarms defined in the alarm group and the private alarm group. The events can be
handled in one of the following ways:
•
Log—Logs event information (including event time and description) in the event log table so the
management device can get the logs through SNMP.
•
Trap—Sends an SNMP notification when the event occurs.
•
Log-Trap—Logs event information in the event log table and sends an SNMP notification when the
event occurs.
•
None—No action.
Alarm group
The RMON alarm group monitors alarm variables, such as the count of incoming packets (etherStatsPkts)
on an interface. After you define an alarm entry, the system gets the value of the monitored alarm
variable at the specified interval. If the value of the monitored variable is greater than or equal to the
rising threshold, a rising event is triggered. If the value of the monitored variable is smaller than or equal
to the falling threshold, a falling event is triggered. The event is then handled as defined in the event
group.
If an alarm entry crosses a threshold multiple times in succession, the RMON agent generates an alarm
event only for the first crossing. For example, if the value of a sampled alarm variable crosses the rising
threshold multiple times before it crosses the falling threshold, only the first crossing triggers a rising alarm
event, as shown in Figure 79.
Figure 79 Rising and falling alarm events
94
RMON configuration task list
Configuring the RMON statistics function
The RMON statistics function can be implemented by either the Ethernet statistics group or the history
group, but the objects of the statistics are different, as follows:
•
A statistics object of the Ethernet statistics group is a variable defined in the Ethernet statistics table,
and the recorded content is a cumulative sum of the variable from the time the statistics entry is
created to the current time. Perform the tasks in Table 20 to configure RMON Ethernet statistics
function.
•
A statistics object of the history group is the variable defined in the history record table, and the
recorded content is a cumulative sum of the variable in each period. Perform the tasks in Table 21
to configure RMON history statistics function.
Table 20 RMON statistics group configuration task list
Task
Remarks
Required.
You can create up to 100 statistics entries in a statistics table.
Configuring a statistics entry
After you create a statistics entry on an interface, the system collects
various traffic statistics on the interface, including network collisions, CRC
alignment errors, undersize/oversize packets, broadcasts, multicasts,
bytes received, and packets received. The statistics are cleared at a
reboot.
IMPORTANT:
You can create only one statistics entry on one interface.
Table 21 RMON history group configuration task list
Task
Remarks
Required.
You can create up to 100 history entries in a history table.
Configuring a history entry
After an entry is created, the system periodically samples the number of
packets received/sent on the current interface. It saves the statistics as an
instance under the leaf node of the etherHistoryEntry table.
IMPORTANT:
When you create an entry, if the value of the specified sampling interval is
identical to that of the existing history entry, the system considers their
configurations are the same and the creation fails.
Configuring the RMON alarm function
To send traps to the NMS when an alarm is triggered, configure the SNMP agent as described in
"Configuring SNMP" before configuring the RMON alarm function.
Perform the tasks in Table 22 to configure RMON alarm function.
95
Table 22 RMON alarm configuration task list
Task
Remarks
Required.
You can create up to 100 statistics entries in a statistics table.
Configuring a statistics
entry
As the alarm variables that can be configured through the Web interface are MIB
variables that defined in the history group or the statistics group, configure the
RMON Ethernet statistics function or the RMON history statistics function on the
monitored Ethernet interface.
After you create a statistics entry on an interface, the system collects various traffic
statistics on the interface, including network collisions, CRC alignment errors,
undersize/oversize packets, broadcasts, multicasts, bytes received, and packets
received. The statistics are cleared at a reboot.
IMPORTANT:
You can create only one statistics entry for one interface.
Required.
You can create up to 60 event entries for an event table.
Configuring an event
entry
An event entry defines event indexes and the actions the system takes, including
log the event, send a trap to the NMS, take no action, and log the event and send
a trap to the NMS.
IMPORTANT:
You cannot create an entry if the values of the specified alarm variable, sampling
interval, sampling type, rising threshold and falling threshold are identical to those
of an existing entry in the system.
Required.
You can create up to 60 alarm entries for an alarm table.
Configuring an alarm
entry
With an alarm entry created, the specified alarm event is triggered when an
abnormity occurs. The alarm event defines how to deal with the abnormity.
IMPORTANT:
You cannot create an entry if the values of the specified event description, owners,
and actions are identical to those of an existing entry in the system.
Displaying RMON running status
After you configure the RMON statistics function or the alarm function, you can view RMON running
status and verify the configuration by performing tasks in Table 23.
Table 23 Displaying RMON running status
Task
Remarks
Displaying RMON statistics
Display the interface statistics during the period from the time the
statistics entry is created to the time the page is displayed. The statistics
are cleared after the device reboots.
Displaying RMON history sampling
information
After you create a history control entry on an interface, the system
calculates the information of the interface periodically and saves the
information to the etherHistoryEntry table. You can perform this task to
display the entries in this table. When you configure the history group,
the system specifies the number of history sampling records that can be
displayed and the history sampling interval.
96
Task
Remarks
Displaying RMON event logs
If you configure the system to log an event after the event is triggered
when you configure the event group, the event is recorded in the RMON
log. Perform this task to display the details of the log table.
Configuring a statistics entry
1.
Select Device > RMON from the navigation tree.
The Statistics tab page appears.
Figure 80 Statistics entry
2.
Click Add.
Figure 81 Adding a statistics entry
3.
Configure a statistic entry as described in Table 24.
4.
Click Apply.
Table 24 Configuration items
Item
Interface Name
Owner
Description
Select the name of the interface on which the statistics entry is created.
Only one statistics entry can be created on one interface.
Set the owner of the statistics entry.
97
Configuring a history entry
1.
Select Device > RMON from the navigation tree.
2.
Click the History tab.
Figure 82 History entry
3.
Click Add.
Figure 83 Adding a history entry
4.
Configure a history entry as described in Table 25.
5.
Click Apply.
Table 25 Configuration items
Item
Description
Interface Name
Select the name of the interface on which the history entry is created.
Set the capacity of the history record list corresponding to this history entry (the
maximum number of records that can be saved in the history record list).
Buckets Granted
If the current number of the entries in the table has reached the maximum
number, the system deletes the earliest entry to save the latest one. The statistics
include total number of received packets on the current interface, total number
of broadcast packets, and total number of multicast packets in a sampling
period.
Interval
Set the sampling period.
Owner
Set the owner of the entry.
98
Configuring an event entry
1.
Select Device > RMON from the navigation tree.
2.
Click the Event tab.
Figure 84 Event entry
3.
Click Add.
Figure 85 Adding an event entry
4.
Configure an event entry as described in Table 26.
5.
Click Apply.
Table 26 Configuration items
Item
Description
Description
Set the description for the event.
Owner
Set the entry owner.
Set the actions that the system takes when the event is triggered:
Event Type
• Log—The system logs the event.
• Trap—The system sends a trap in the community name of null.
If you select both Log and Trap, the system logs the event and sends a trap. If
neither is selected, the system takes no action.
99
Configuring an alarm entry
1.
Select Device > RMON from the navigation tree.
2.
Click the Alarm tab.
Figure 86 Alarm entry
3.
Click Add.
Figure 87 Adding an alarm entry
4.
Configure an alarm entry as described in Table 27.
5.
Click Apply.
Table 27 Configuration items
Item
Description
Alarm variable:
Static Item
Set the traffic statistics that are collected and monitored. For
more information, see Table 28.
Interface Name
Set the name of the interface whose traffic statistics are
collected and monitored.
Sample Item:
100
Item
Description
Interval
Set the sampling interval.
Set the sampling type:
• Absolute—Absolute sampling to obtain the value of the
Sample Type
variable when the sampling time is reached.
• Delta—Delta sampling to obtain the variation value of the
variable during the sampling interval when the sampling
time is reached.
Set the owner of the alarm entry.
Owner:
Alarm:
Select whether to create a default event.
Create Default Event
Rising Threshold
The description of the default event is default event, the action
is log-and-trap, and the owner is default owner.
If there is no event, you can create the default event. And when
the value of the alarm variable is higher than the alarm rising
threshold or lower than the alarm falling threshold, the system
adopts the default action log-and-trap.
Set the alarm rising threshold.
Set the action that the system takes when the value of the alarm
variable is higher than the alarm rising threshold.
Rising Event
If you select the Create Default Event box, this option is not
configurable.
Falling Threshold
Set the alarm falling threshold.
Set the action that the system takes when the value of the alarm
variable is lower than the alarm falling threshold.
Falling Event
If you select the Create Default Event box, this option is not
configurable.
Displaying RMON statistics
1.
Select Device > RMON from the navigation tree.
The page in Figure 80 appears.
2.
Click the
icon for the statistics entry of an interface.
101
Figure 88 RMON statistics
Table 28 Field description
Field
Description
Number of Received Bytes
Total number of octets received by the interface,
corresponding to the MIB node etherStatsOctets.
Number of Received Packets
Total number of packets received by the interface,
corresponding to the MIB node etherStatsPkts.
Number of Received Broadcasting Packets
Total number of broadcast packets received by the
interface, corresponding to the MIB node
etherStatsBroadcastPkts.
Number of Received Multicast Packets
Total number of multicast packets received by the
interface, corresponding to the MIB node
etherStatsMulticastPkts.
Number of Received Packets With CRC Check
Failed
Total number of packets with CRC errors received on the
interface, corresponding to the MIB node
etherStatsCRCAlignErrors.
Number of Received Packets Smaller Than 64
Bytes
Total number of undersize packets (shorter than 64
octets) received by the interface, corresponding to the
MIB node etherStatsUndersizePkts.
Number of Received Packets Larger Than
1518 Bytes
Total number of oversize packets (longer than 1518
octets) received by the interface, corresponding to the
MIB node etherStatsOversizePkts.
Number of Received Packets Smaller Than 64
Bytes And FCS Check Failed
Total number of undersize packets (shorter than 64
octets) with CRC errors received by the interface,
corresponding to the MIB node etherStatsFragments.
Number of Received Packets Larger Than
1518 Bytes And FCS Check Failed
Number of oversize packets (longer than 1518 octets)
with CRC errors received by the interface,
corresponding to the MIB node etherStatsJabbers.
102
Field
Description
Number of Network Conflicts
Total number of collisions received on the interface,
corresponding to the MIB node etherStatsCollisions.
Number of Packet Discarding Events
Total number of drop events received on the interface,
corresponding to the MIB node etherStatsDropEvents.
Number of Received 64 Bytes Packets
Total number of received packets with 64 octets on the
interface, corresponding to the MIB node
etherStatsPkts64Octets.
Number of Received 65 to 127 Bytes Packets
Total number of received packets with 65 to 127 octets
on the interface, corresponding to the MIB node
etherStatsPkts65to127Octets.
Number of Received 128 to 255 Bytes
Packets
Total number of received packets with 128 to 255 octets
on the interface, corresponding to the MIB node
etherStatsPkts128to255Octets.
Number of Received 256 to 511 Bytes
Packets
Total number of received packets with 256 to 511 octets
on the interface, corresponding to the MIB node
etherStatsPkts256to511Octets.
Number of Received 512 to 1023 Bytes
Packets
Total number of received packets with 512 to 1023
octets on the interface, corresponding to the MIB node
etherStatsPkts512to1023Octets.
Number of Received 1024 to 1518 Bytes
Packets
Total number of received packets with 1024 to 1518
octets on the interface, corresponding to the MIB node
etherStatsPkts1024to1518Octets.
Displaying RMON history sampling information
1.
Select Device > RMON from the navigation tree.
2.
Click the History tab.
3.
Click the
icon for a history entry.
Figure 89 RMON history sampling information
103
Table 29 Field description
Field
Description
Number of the entry in the system buffer.
NO
Statistics are numbered chronologically when they are saved to the system
buffer.
Time
Time at which the information is saved.
DropEvents
Dropped packets during the sampling period, corresponding to the MIB
node etherHistoryDropEvents.
Octets
Number of octets received during the sampling period, corresponding to the
MIB node etherHistoryOctets.
Pkts
Number of packets received during the sampling period, corresponding to
the MIB node etherHistoryPkts.
BroadcastPkts
Number of broadcasts received during the sampling period, corresponding
to the MIB node etherHistoryBroadcastPkts.
MulticastPkts
Number of multicasts received during the sampling period, corresponding to
the MIB node etherHistoryMulticastPkts.
CRCAlignErrors
Number of packets received with CRC alignment errors during the sampling
period, corresponding to the MIB node etherHistoryCRCAlignErrors.
UndersizePkts
Number of undersize packets received during the sampling period,
corresponding to the MIB node etherHistoryUndersizePkts.
OversizePkts
Number of oversize packets received during the sampling period,
corresponding to the MIB node etherHistoryOversizePkts.
Fragments
Number of fragments received during the sampling period, corresponding to
the MIB node etherHistoryFragments.
Jabbers
Number of jabbers received during the sampling period, corresponding to
the MIB node etherHistoryJabbers.
Support for the field depends on the device model.
Collisions
Number of collision packets received during the sampling period,
corresponding to the MIB node etherHistoryCollisions.
Utilization
Bandwidth utilization during the sampling period, corresponding to the MIB
node etherHistoryUtilization.
Displaying RMON event logs
1.
Select Device > RMON from the navigation tree.
2.
Click the Log tab.
104
Figure 90 Log tab
In this example, event 1 has generated one log, which is triggered because the alarm value
(11779194) exceeds the rising threshold (10000000). The sampling type is absolute.
RMON configuration example
Network requirements
As shown in Figure 91, create an entry in the RMON Ethernet statistics table to gather statistics on
GigabitEthernet 1/0/1 with the sampling interval being 10 seconds. Perform corresponding
configurations so that the system logs the event when the number of bytes received on the interface more
than 1000 or less than 100.
Figure 91 Network diagram
Configuration procedure
1.
Configure RMON to gather statistics for GigabitEthernet 1/0/1:
a. Select Device > RMON from the navigation tree.
The Statistics tab page appears.
b. Click Add.
The page in Figure 92 appears.
c. Select GigabitEthernet1/0/1 from the Interface Name list, type user1 in the Owner field, and
click Apply.
105
Figure 92 Adding a statistics entry
2.
Display RMON statistics for GigabitEthernet 1/0/1:
a. Click the icon
corresponding to GigabitEthernet 1/0/1.
b. Display this information as shown in Figure 93.
Figure 93 Displaying RMON statistics
3.
Create an event to start logging after the event is triggered:
a. Click the Event tab.
b. Click Add.
The page in Figure 94 appears.
c. Type user1-rmon in the Owner field, select the box before Log, and click Apply.
d. The page displays the event entry, and you can see that the entry index of the new event is 1,
as shown in Figure 95.
106
Figure 94 Configuring an event group
Figure 95 Displaying the index of an event entry
4.
Configure an alarm group to sample received bytes on GigabitEthernet 1/0/1. When the
received bytes exceed the rising or falling threshold, logging is enabled:
a. Click the Alarm tab.
b. Click Add.
The page in Figure 96 appears.
c. Select Number of Received Bytes from the Static Item list, select GigabitEthernet1/0/1 from the
Interface Name list, enter 10 in the Interval field, select Delta from the Simple Type list, enter
user1 in the Owner field, enter 1000 in the Rising Threshold field, select 1 from the Rising Event
list, enter 100 in the Falling Threshold field, select 1 from the Falling Event list, and click Apply.
107
Figure 96 Configuring an alarm group
Verifying the configuration
After the above configuration, when the alarm event is triggered, you can display log information for
event 1 on the Web interface.
1.
Select Device > RMON from the navigation tree.
2.
Click the Log tab.
The log page appears. The log in this example indicates that event 1 generated one log, which
was triggered because the alarm value (22050) exceeded the rising threshold (1000). The
sampling type is absolute.
Figure 97 Log information for event 1
108
Configuring energy saving
Energy saving enables a port to operate at the lowest transmission speed, disable PoE, or go down
during a specific time range on certain days of a week. The port resumes when the effective time period
ends.
Configuring energy saving on a port
1.
Select Device > Energy Saving from the navigation tree to enter the energy saving configuration
page.
2.
Click a port.
Figure 98 Energy saving configuration page
3.
Configure an energy saving policy for the port as described in Table 30.
4.
Click Apply.
Table 30 Configuration items
Item
Description
Time Range
Set the time period when the port is in the state of energy saving.
IMPORTANT:
• Up to five energy saving policies with different time ranges can be configured on a
Sun through Sat
port.
• Specify the start time and end time in units of 5 minutes, such as 08:05 to 10:15.
Otherwise, the start time is postponed and the end time is brought forward so that
they meet the requirements. For example, if you set the time range to 08:08 to
10:12, the effective time range is 08:10 to 10:10.
PoE Disabled
Disable PoE on the port.
109
Item
Description
Set the port to transmit data at the lowest speed.
Lowest Speed
If you configure the lowest speed limit on a port that does not support 10 Mbps, the
configuration cannot take effect.
Shut down the port.
Shutdown
An energy saving policy can have all the three energy saving schemes configured, of
which the shutdown scheme takes the highest priority.
110
Configuring SNMP
This chapter provides an overview of the Simple Network Management Protocol (SNMP) and guides you
through the configuration procedure.
Overview
SNMP is an Internet standard protocol widely used for a management station to access and operate the
devices on a network, regardless of their vendors, physical characteristics and interconnect technologies.
SNMP enables network administrators to read and set the variables on managed devices for state
monitoring, troubleshooting, statistics collection, and other management purposes.
SNMP mechanism
The SNMP framework comprises the following elements:
•
SNMP manager—Works on an NMS to monitor and manage the SNMP-capable devices in the
network.
•
SNMP agent—Works on a managed device to receive and handle requests from the NMS, and
send traps to the NMS when some events, such as interface state change, occur.
•
Management Information Base (MIB)—Specifies the variables (for example, interface status and
CPU usage) maintained by the SNMP agent for the SNMP manager to read and set.
Figure 99 Relationship between an NMS, agent and MIB
A MIB stores variables called "nodes" or "objects" in a tree hierarchy and identifies each node with a
unique OID. An OID is a string of numbers that describes the path from the root node to a leaf node. For
example, the object B in Figure 100 is uniquely identified by the OID {1.2.1.1}.
Figure 100 MIB tree
SNMP provides the following basic operations:
•
Get—The NMS retrieves SNMP object nodes in an agent MIB.
111
•
Set—The NMS modifies the value of an object node in an agent MIB.
•
Notifications—Includes traps and informs. SNMP agent sends traps or informs to report events to
the NMS. The difference between these two types of notification is that informs require
acknowledgement but traps do not. The device supports only traps.
SNMP protocol versions
HP supports SNMPv1, SNMPv2c, and SNMPv3. An NMS and an SNMP agent must use the same
SNMP version to communicate with each other.
•
SNMPv1—Uses community names for authentication. To access an SNMP agent, an NMS must use
the same community name as set on the SNMP agent. If the community name used by the NMS is
different from the community name set on the agent, the NMS cannot establish an SNMP session to
access the agent or receive traps and notifications from the agent.
•
SNMPv2c—Uses community names for authentication. SNMPv2c is compatible with SNMPv1, but
supports more operation modes, data types, and error codes.
•
SNMPv3—Uses a user-based security model (USM) to secure SNMP communication. You can
configure authentication and privacy mechanisms to authenticate and encrypt SNMP packets for
integrity, authenticity, and confidentiality.
Recommended configuration procedure
SNMPv3 differs from SNMPv1 and SNMPv2c in many ways. Their configuration procedures are
described in separate sections.
Table 31 SNMPv1 or SNMPv2c configuration task list
Task
Remarks
Required.
The SNMP agent function is disabled by default.
1.
Enabling SNMP agent
IMPORTANT:
If SNMP agent is disabled, all SNMP agent-related configurations are
removed.
Optional.
2.
Configuring an SNMP view
After creating SNMP views, you can specify an SNMP view for an
SNMP community to limit the MIB objects that can be accessed by the
SNMP community.
3.
Configuring an SNMP community
Required.
Optional.
4.
Configuring SNMP trap function
Allows you to configure that the agent can send SNMP traps to the
NMS, and configure information about the target host (usually the
NMS) of the SNMP traps.
The SNMP agent sends traps to inform the NMS of important events,
such as a reboot.
By default, an agent is allowed to send SNMP traps to the NMS.
5.
Displaying SNMP packet statistics
Optional.
112
Table 32 SNMPv3 configuration task list
Task
Remarks
Required.
The SNMP agent function is disabled by default.
1.
Enabling SNMP agent
IMPORTANT:
If SNMP agent is disabled, all SNMP agent-related configurations are
removed.
Optional.
2.
Configuring an SNMP view
After creating SNMP views, you can specify an SNMP view for an SNMP
group to limit the MIB objects that can be accessed by the SNMP group.
Required.
3.
Configuring an SNMP group
After creating an SNMP group, you can add SNMP users to the group
when creating the users. Therefore, you can realize centralized
management of users in the group through the management of the group.
Required.
Before creating an SNMP user, you need to create the SNMP group to
which the user belongs.
4.
Configuring an SNMP user
IMPORTANT:
After you change the local engine ID, the existing SNMPv3 users become
invalid, and you must re-create the SNMPv3 users. For more information
about engine ID, see "Enabling SNMP agent."
Optional.
5.
Configuring SNMP trap
function
Allows you to configure that the agent can send SNMP traps to the NMS,
and configure information about the target host (usually the NMS) of the
SNMP traps.
The SNMP agent sends traps to inform the NMS of important events, such
as a reboot.
By default, an agent is allowed to send SNMP traps to the NMS.
6.
Displaying SNMP packet
statistics
Optional.
Enabling SNMP agent
1.
Select Device > SNMP from the navigation tree.
The SNMP configuration page appears.
113
Figure 101 Setup tab
2.
Configure SNMP settings on the upper part of the page as described in Table 33.
3.
Click Apply.
Table 33 Configuration items
Item
Description
SNMP
Specify to enable or disable SNMP agent.
Configure the local engine ID.
Local Engine ID
Maximum Packet Size
Contact
The validity of a user after it is created depends on the engine ID of the
SNMP agent. If the engine ID when the user is created is not identical to the
current engine ID, the user is invalid.
Configure the maximum size of an SNMP packet that the agent can receive
or send.
Set a character string to describe contact information for system
maintenance.
If the device is faulty, the maintainer can contact the manufacture factory
according to the contact information of the device.
114
Item
Description
Location
Set a character string to describe the physical location of the device.
SNMP Version
Set the SNMP version run by the system.
Configuring an SNMP view
Creating an SNMP view
1.
Select Device > SNMP from the navigation tree.
2.
Click the View tab.
The View tab appears.
Figure 102 View tab
3.
Click Add.
The Add View window appears.
Figure 103 Creating an SNMP view (1)
4.
Type the view name.
5.
Click Apply.
The page in Figure 104 appears.
6.
Configure the parameters as described in Table 34.
7.
Click Add to add the rule into the list box at the lower part of the page.
115
8.
Repeat steps 6 and 7 to add more rules for the SNMP view.
9.
Click Apply.
To cancel the view, click Cancel.
Figure 104 Creating an SNMP view (2)
Table 34 Configuration items
Item
Description
View Name
Set the SNMP view name.
Rule
Select to exclude or include the objects in the view range determined by the MIB
subtree OID and subtree mask.
Set the MIB subtree OID (such as 1.4.5.3.1) or name (such as system).
MIB Subtree OID
Subtree Mask
MIB subtree OID identifies the position of a node in the MIB tree, and it can
uniquely identify a MIB subtree.
Set the subtree mask, a hexadecimal string. Its length must be an even number in
the range of 2 to 32.
If no subtree mask is specified, the default subtree mask (all Fs) will be used for
mask-OID matching.
Adding rules to an SNMP view
1.
Select Device > SNMP from the navigation tree.
2.
Click the View tab.
The page in Figure 102 appears.
3.
Click the
icon of the target view.
The Add rule for the view ViewDefault window appears.
116
Figure 105 Adding rules to an SNMP view
4.
Configure the parameters as described in Table 34.
5.
Click Apply.
NOTE:
You can also click the
icon corresponding to the specified view on the page as shown in Figure 102,
and then you can enter the page to modify the view.
Configuring an SNMP community
1.
Select Device > SNMP from the navigation tree.
2.
Click the Community tab.
The Community tab appears.
Figure 106 Configuring an SNMP community
3.
Click Add.
The Add SNMP Community page appears.
117
Figure 107 Creating an SNMP Community
4.
Configure the SNMP community as described in Table 35.
5.
Click Apply.
Table 35 Configuration items
Item
Description
Community Name
Set the SNMP community name.
Configure SNMP NMS access right:
• Read only—The NMS can perform read-only operations to the MIB objects
Access Right
when it uses this community name to access the agent.
• Read and write—The NMS can perform both read and write operations to
the MIB objects when it uses this community name to access the agent.
View
Specify the view associated with the community to limit the MIB objects that
can be accessed by the NMS.
ACL
Associate the community with a basic ACL to allow or prohibit the access to
the agent from the NMS with the specified source IP address.
Configuring an SNMP group
1.
Select Device > SNMP from the navigation tree.
2.
Click the Group tab.
The Group tab appears.
Figure 108 SNMP group
118
3.
Click Add.
The Add SNMP Group page appears.
Figure 109 Creating an SNMP group
4.
Configure SNMP group as described in Table 36.
5.
Click Apply.
Table 36 Configuration items
Item
Description
Group Name
Set the SNMP group name.
Select the security level for the SNMP group:
Security Level
• NoAuth/NoPriv—No authentication no privacy.
• Auth/NoPriv—Authentication without privacy.
• Auth/Priv—Authentication and privacy.
IMPORTANT:
For an existing SNMP group, its security level cannot be modified.
Read View
Select the read view of the SNMP group.
Select the write view of the SNMP group.
Write View
Notify View
ACL
If no write view is configured, the NMS cannot perform the write operations to all
MIB objects on the device.
Select the notify view (the view that can send trap messages) of the SNMP group.
If no notify view is configured, the agent does not send traps to the NMS.
Associate a basic ACL with the group to restrict the source IP address of SNMP
packets. To restrict the intercommunication between the NMS and the agent, you
can allow or prohibit SNMP packets with a specific source IP address.
119
Configuring an SNMP user
1.
Select Device > SNMP from the navigation tree.
2.
Click the User tab.
The User tab appears.
Figure 110 SNMP user
3.
Click Add.
The Add SNMP User page appears.
Figure 111 Creating an SNMP user
4.
Configure the SNMP user as described in Table 37.
5.
Click Apply.
120
Table 37 Configuration items
Item
Description
User Name
Set the SNMP user name.
Select the security level for the SNMP group. The available security
levels are:
Security Level
• NoAuth/NoPriv—No authentication no privacy.
• Auth/NoPriv—Authentication without privacy.
• Auth/Priv—Authentication and privacy.
Select an SNMP group to which the user belongs:
• When the security level is NoAuth/NoPriv, you can select an
SNMP group with no authentication no privacy.
Group Name
• When the security level is Auth/NoPriv, you can select an SNMP
group with no authentication no privacy or authentication without
privacy.
• When the security level is Auth/Priv, you can select an SNMP
group of any security level.
Authentication Mode
Select an authentication mode (including MD5 and SHA) when the
security level is Auth/NoPriv or Auth/Priv.
Authentication Password
Set the authentication password when the security level is
Auth/NoPriv or Auth/Priv.
Confirm Authentication
Password
The confirm authentication password must be the same with the
authentication password.
Privacy Mode
Select a privacy mode (including DES56, AES128, and 3DES) when
the security level is Auth/Priv.
Privacy Password
Set the privacy password when the security level is Auth/Priv.
Confirm Privacy Password
The confirm privacy password must be the same with the privacy
password.
ACL
Associate a basic ACL with the user to restrict the source IP address of
SNMP packets. To allow or prohibit the specified NMS to access the
agent by using this user name, you can allow or prohibit SNMP
packets with a specific source IP address.
Configuring SNMP trap function
1.
Select Device > SNMP from the navigation tree.
2.
Click the Trap tab.
The Trap tab appears.
121
Figure 112 Traps configuration
3.
Select Enable SNMP Trap.
4.
Click Apply to enable the SNMP trap function.
5.
Click Add.
The page for adding a target host of SNMP traps appears.
Figure 113 Adding a target host of SNMP traps
6.
Configure the settings for the target host as described in Table 38.
7.
Click Apply.
Table 38 Configuration items
Item
Description
Set the destination IP address.
Destination IP Address
Select the IP address type: IPv4 or IPv6, and then type the corresponding IP
address in the field according to the IP address type.
122
Item
Description
Security Name
Set the security name, which can be an SNMPv1 community name, an
SNMPv2c community name, or an SNMPv3 user name.
Set UDP port number.
IMPORTANT:
UDP Port
Security Model
Security Level
The default port number is 162, which is the SNMP-specified port used for
receiving traps on the NMS. Generally (such as using IMC or MIB Browser as the
NMS), you can use the default port number. To change this parameter to another
value, you need to make sure the configuration is the same with that on the NMS.
Select the security model, for which you must set the SNMP version. For the
NMS to receive notifications, make sure the SNMP version is the same with that
on the NMS.
Set the authentication and privacy mode for SNMP traps when the security
model is selected as v3. The available security levels are: no authentication no
privacy, authentication but no privacy, and authentication and privacy.
When the security model is selected as v1 or v2c, the security level is no
authentication no privacy, and cannot be modified.
Displaying SNMP packet statistics
Select Device > SNMP from the navigation tree.
The page for displaying SNMP packet statistics appears.
Figure 114 SNMP packet statistics
123
SNMPv1/v2c configuration example
Network requirements
As shown in Figure 115, the NMS at 1.1.1.2/24 uses SNMPv1 or SNMPv2c to manage the switch (agent)
at 1.1.1.1/24, and the switch automatically sends traps to report events to the NMS.
Figure 115 Network diagram
Configuring the agent
1.
Enable SNMP:
a. Select Device > SNMP from the navigation tree.
The SNMP configuration page appears.
b. Select the Enable option, and select the v1 and v2c options.
c. Click Apply.
Figure 116 Configuring the SNMP agent
2.
Configure a read-only community:
a. Click the Community tab.
b. Click Add.
The Add SNMP Community page appears.
c. Enter public in the Community Name field, and select Read only from the Access Right list.
d. Click Apply.
124
Figure 117 Configuring an SNMP read-only community
3.
Configure a read and write community:
a. Click Add on the Community tab page.
The Add SNMP Community page appears.
b. Enter private in the Community Name field, and select Read and write from the Access Right
list.
c. Click Apply.
Figure 118 Configuring an SNMP read and write community
4.
Enable SNMP traps:
a. Click the Trap tab.
The Trap tab page appears.
b. Select Enable SNMP Trap.
c. Click Apply.
125
Figure 119 Enabling SNMP traps
5.
Configure a target host SNMP traps:
a. Click Add on the Trap tab page.
The page for adding a target host of SNMP traps appears.
b. Select the IPv4/Domain option and type 1.1.1.2 in the following field, type public in the
Security Name field, and select v1 from the Security Model list.
c. Click Apply.
Figure 120 Adding a trap target host
Configuring the NMS
The configuration on the NMS must be consistent with that on the agent. Otherwise, you cannot perform
corresponding operations.
To configure the NMS:
1.
Configure the SNMP version for the NMS as v1 or v2c.
2.
Create a read-only community and name it public.
3.
Create a read and write community and name it private.
126
For information about how to configure the NMS, see the NMS manual.
Verifying the configuration
After the above configuration, an SNMP connection is established between the NMS and the agent. The
NMS can get and configure the values of some parameters on the agent through MIB nodes.
Disable or enable an idle interface on the agent, and you can see the interface state change traps on the
NMS.
SNMPv3 configuration example
Network requirements
As shown in Figure 121, the NMS (1.1.1.2/24) uses SNMPv3 to monitor and manage the interface status
of the AP (the agent) at 1.1.1.1/24, and the AP automatically sends traps to report events to the NMS.
The NMS and the agent perform authentication when they set up an SNMP session. The authentication
algorithm is MD5 and the authentication key is authkey. The NMS and the AP also encrypt the SNMP
packets between them by using the DES56 algorithm and the privacy key prikey.
Figure 121 Network diagram
Configuring the agent
1.
Enable SNMP agent:
a. Select Device > SNMP from the navigation tree.
The SNMP configuration page appears.
b. Select the Enable option, and select the v3 option.
c. Click Apply.
Figure 122 Configuring the SNMP agent
127
2.
Configure an SNMP view:
a. Click the View tab.
b. Click Add.
The page for creating an SNMP view appears.
c. Type view1 in the View Name field.
d. Click Apply.
Figure 123 Creating an SNMP view (1)
e. On the page that appears, select the Included option, type the MIB subtree OID interfaces, and
click Add.
f. Click Apply.
A configuration progress dialog box appears.
g. Click Close after the configuration process is complete.
Figure 124 Creating an SNMP view (2)
3.
Configure an SNMP group:
a. Click the Group tab.
b. Click Add.
The page in Figure 125 appears.
c. Type group1 in the Group Name field, select view1 from the Read View list, select view1 from
the Write View list.
d. Click Apply.
128
Figure 125 Creating an SNMP group
4.
Configure an SNMP user:
a. Click the User tab.
b. Click Add.
The page in Figure 126 appears.
c. Type user1 in the User Name field, select Auth/Priv from the Security Level list, select group1
from the Group Name list, select MD5 from the Authentication Mode list, type authkey in the
Authentication Password and Confirm Authentication Password fields, select DES56 from the
Privacy Mode list, and type prikey in the Privacy Password and Confirm Privacy Password
fields.
d. Click Apply.
129
Figure 126 Creating an SNMP user
5.
Enable SNMP traps:
a. Click the Trap tab.
The Trap tab page appears.
b. Select Enable SNMP Trap.
c. Click Apply.
Figure 127 Enabling SNMP traps
6.
Configure a target host SNMP traps:
a. Click Add on the Trap tab page.
The page for adding a target host of SNMP traps appears.
130
b. Select the IPv4/Domain option and type 1.1.1.2 in the following field, type user1 in the
Security Name field, select v3 from the Security Model list, and select Auth/Priv from the
Security Level list.
c. Click Apply.
Figure 128 Adding a trap target host
Configuring the NMS
The configuration on NMS must be consistent with that on the agent. Otherwise, you cannot perform
corresponding operations.
To configure the NMS:
1.
Specify the SNMP version for the NMS as v3.
2.
Create an SNMP user user1.
3.
Enable both authentication and privacy functions
4.
Use MD5 for authentication and DES56 for encryption.
5.
Set the authentication key to authkey and the privacy key to prikey.
For information about configuring the NMS, see the NMS manual.
Verifying the configuration
After the above configuration, the NMS can establish an SNMP connection with the agent and query
and reconfigure values of objects in the agent MIB.
Disable or enable an idle interface on the agent, and you can see the interface state change traps on the
NMS.
131
Displaying interface statistics
The interface statistics module displays statistics about the packets received and sent through interfaces.
To display interface statistics, select Device > Interface Statistics from the navigation tree.
Figure 129 Interface statistics display page
Table 39 describes the fields on the page.
Table 39 Field description
Field
Description
InOctets
Total octets of all packets received on the interface.
InUcastPkts
Number of received unicast packets.
InNUcastPkts
Number of received non-unicast packets.
InDiscards
Number of valid packets discarded in the inbound direction.
InErrors
Number of received invalid packets.
InUnknownProtos
Number of received unknown protocol packets.
OutOctets
Total octets of all packets sent through the interface.
OutUcastPkts
Number of unicast packets sent through the interface.
OutNUcastPkts
Number of non-unicast packets sent through the interface.
OutDiscards
Number of valid packets discarded in the outbound direction.
OutErrors
Number of invalid packets sent through the interface.
Last statistics clearing time
Last time when the statistics were cleared.
132
Configuring VLANs
Overview
Ethernet is a network technology based on the CSMA/CD mechanism. As the medium is shared,
collisions and excessive broadcasts are common on an Ethernet. To address the issue, virtual LAN (VLAN)
was introduced to break a LAN down into separate VLANs. VLANs are isolated from each other at Layer
2. A VLAN is a bridging domain, and all broadcast traffic is contained within it, as shown in Figure 130.
Figure 130 A VLAN diagram
A VLAN is logically divided on an organizational basis rather than on a physical basis. For example, all
workstations and servers used by a particular workgroup can be assigned to the same VLAN, regardless
of their physical locations.
VLAN technology delivers the following benefits:
•
Confining broadcast traffic within individual VLANs. This reduces bandwidth waste and improves
network performance.
•
Improving LAN security. By assigning user groups to different VLANs, you can isolate them at Layer
2. To enable communication between VLANs, routers or Layer 3 switches are required.
•
Flexible virtual workgroup creation. As users from the same workgroup can be assigned to the same
VLAN regardless of their physical locations, network construction and maintenance is much easier
and more flexible.
VLAN fundamentals
To enable a network device to identify frames of different VLANs, a VLAN tag field is inserted into the
data link layer encapsulation. The format of VLAN-tagged frames is defined in IEEE 802.1Q-1999.
In the header of a traditional Ethernet data frame, the field after the destination MAC address and the
source MAC address is the Type field indicating the upper layer protocol type, as shown in Figure 131.
133
Figure 131 Traditional Ethernet frame format
IEEE 802.1Q inserts a four-byte VLAN tag after the DA&SA field, as shown in Figure 132.
Figure 132 Position and format of VLAN tag
A VLAN tag comprises the following fields:
•
Tag protocol identifier (TPID)—The 16-bit TPID field indicates whether the frame is VLAN-tagged
and is 0x8100 by default.
•
Priority—The 3-bit priority field indicates the 802.1p priority of the frame.
•
Canonical format indicator (CFI)—The 1-bit CFI field specifies whether the MAC addresses are
encapsulated in the standard format when packets are transmitted across different media. A value
of 0 indicates that MAC addresses are encapsulated in the standard format. The value of 1
indicates that MAC addresses are encapsulated in a non-standard format. The value of the field is
0 by default.
•
VLAN ID—The 12-bit VLAN ID field identifies the VLAN the frame belongs to. The VLAN ID range
is 0 to 4095. As 0 and 4095 are reserved, a VLAN ID actually ranges from 1 to 4094.
A network device handles an incoming frame depending on whether the frame is VLAN tagged and the
value of the VLAN tag, if any.
The Ethernet II encapsulation format is used in this section. In addition to the Ethernet II encapsulation
format, Ethernet also supports other encapsulation formats, including 802.2 LLC, 802.2 SNAP, and
802.3 raw. The VLAN tag fields are added to frames encapsulated in these formats for VLAN
identification.
When a frame carrying multiple VLAN tags passes through, the device processes the frame according to
its outer VLAN tag, and transmits the inner tags as payload.
VLAN types
You can implement VLANs based on the following criteria:
•
Port
•
MAC address
•
Protocol
•
IP subnet
•
Policy
•
Other criteria
The Web interface is available only for port-based VLANs, and this chapter introduces only port-based
VLANs.
134
Port-based VLAN
Port-based VLANs group VLAN members by port. A port forwards traffic for a VLAN only after it is
assigned to the VLAN.
Port link type
You can configure the link type of a port as access, trunk, or hybrid. The link types use the following
VLAN tag handling methods:
•
Access port—An access port belongs to only one VLAN and sends traffic untagged. It is usually
used to connect a terminal device unable to identify VLAN tagged-packets or when it is
unnecessary to separate different VLAN members. As shown in Figure 133, Device A is connected
to common PCs that cannot recognize VLAN tagged-packets, and you must configure Device A's
ports that connect to the PCs as access ports.
•
Trunk port—A trunk port can carry multiple VLANs to receive and send traffic for them. Except
traffic from the port VLAN ID (PVID), traffic sent through a trunk port will be VLAN tagged. Usually,
ports that connect network devices are configured as trunk ports. As shown in Figure 133, Device
A and Device B need to transmit packets of VLAN 2 and VLAN 3, and you must configure the ports
interconnecting Device A and Device B as trunk ports and assign them to VLAN 2 and VLAN 3.
•
Hybrid port—A hybrid port allows traffic of some VLANs to pass through untagged and traffic of
some other VLANs to pass through tagged. Usually, hybrid ports are configured to connect devices
whose support for VLAN-tagged packets are uncertain. As shown in Figure 133, Device C connects
to a small-sized LAN in which some PCs belong to VLAN 2 and other PCs belong to VLAN 3, and
Device B is uncertain about whether Device C supports VLAN-tagged packets. Configure on Device
B the port connecting to Device C as a hybrid port to allow packets of VLAN 2 and VLAN 3 to pass
through untagged.
Figure 133 Port link types
VLAN 2
VLAN 2
VLAN 3
Device B
Device A
Device C
Access links are required
Trunk links are reuqired
Hybrid links are required
135
VLAN 3
PVID
By default, VLAN 1 is the PVID for all ports. You can change the PVID for a port, as required.
Use the following guidelines when you configure the PVID on a port:
•
An access port can join only one VLAN. The VLAN to which the access port belongs is the PVID of
the port.
•
A trunk or hybrid port can join multiple VLANs, and you can configure a PVID for the port.
•
You can use a nonexistent VLAN as the PVID for a hybrid or trunk port, but not for an access port.
After you delete the VLAN that an access port resides in, the PVID of the port changes to VLAN 1.
However, deleting the VLAN specified as the PVID of a trunk or hybrid port does not affect the PVID
setting on the port.
•
HP recommends that you set the same PVID for local and remote ports.
•
Make sure a port permits its PVID. Otherwise, when the port receives frames tagged with the PVID
or untagged frames, the port drops these frames.
Frame handling methods
The following table shows how ports of different link types handle frames:
Actions
Access
In the inbound
direction for an
untagged frame
Tags the frame with the
PVID tag.
Trunk
Hybrid
Checks whether the PVID is permitted on the port:
• If yes, tags the frame with the PVID tag.
• If not, drops the frame.
• Receives the frame if
In the inbound
direction for a
tagged frame
its VLAN ID is the
same as the PVID.
• Drops the frame if its
VLAN ID is different
from the PVID.
• Receives the frame if its VLAN is permitted on the port.
• Drops the frame if its VLAN is not permitted on the port.
• Removes the tag and sends
In the outbound
direction
Removes the VLAN tag
and sends the frame.
the frame if the frame carries
the PVID tag and the port
belongs to the PVID.
• Sends the frame without
removing the tag if its VLAN is
carried on the port, but is
different from the PVID.
136
Sends the frame if its VLAN
is permitted on the port. The
frame is sent with the VLAN
tag removed or intact
depending on your
configuration with the port
hybrid vlan command. This
is true of the PVID.
Recommended VLAN configuration procedures
Recommended configuration procedure for assigning an
access port to a VLAN
Step
1.
Remarks
Required.
Creating VLANs.
Create one or multiple VLANs.
Optional.
2.
Configuring the link type of a port.
Configure the link type of the port as access.
By default, the link type of a port is access.
3.
Setting the PVID for a port.
4.
Configuring the access ports as untagged
members of a VLAN:
Configure the PVID of the
access port.
Required.
a. Selecting VLANs
Specify the range of VLANs available for
selection during related operations.
Configure a subset of all existing VLANs.
This step is required before you perform
operations on the Detail, Modify VLAN,
and Modify Port tabs.
N/A
By default, an access port
is an untagged member of
VLAN 1.
b. Modifying a VLAN
Configure the access ports as untagged
members of the specified VLAN.
5.
An access port has only
one untagged VLAN and
the untagged VLAN is its
PVID. The three operations
produce the same result,
and the latest operation
takes effect.
Configure the untagged
VLAN of the port.
Modifying ports.
Recommended configuration procedure for assigning a trunk
port to a VLAN
Step
1.
Remarks
Required.
Creating VLANs.
Create one or multiple VLANs.
Optional.
Configure the link type of the port as trunk.
2.
Configuring the link type of a port.
To configure a hybrid port as a trunk port, first configure it
as an access port.
By default, the link type of a port is access.
137
Step
Remarks
3.
Setting the PVID for a port.
4.
Configure the trunk port as an untagged
member of the specified VLANs:
Configure the PVID of the
trunk port.
a. Selecting VLANs
Specify the range of VLANs available for
selection during related operations.
Configure a subset of all existing VLANs.
This step is required before you perform
operations on the Detail, Modify VLAN,
and Modify Port tabs.
A trunk port has only one
untagged VLAN and the
untagged VLAN is its PVID.
The three operations produce
the same result, and the latest
operation takes effect.
N/A
By default, the untagged
VLAN of a trunk port is VLAN
1.
b. Modifying a VLAN
Configure the trunk port as an untagged
member of the specified VLANs.
5.
Modifying ports.
6.
Configure the trunk port as a tagged
member of the specified VLANs:
Configure the untagged
VLAN of the trunk port.
a. Selecting VLANs
Specify the range of VLANs available for
selection during related operations.
Configure a subset of all existing VLANs.
This step is required before you perform
operations on the Detail, Modify VLAN,
and Modify Port tabs.
When you change the
untagged VLAN (PVID) of a
trunk port, the former untagged
VLAN automatically becomes a
tagged VLAN of the trunk port.
Required.
A trunk port can have multiple
tagged VLANs. You can
repeat these steps to configure
multiple tagged VLANs for the
trunk port.
N/A
b. Modifying a VLAN
Configure the trunk port as a tagged
member of the specified VLANs.
7.
Required.
Configure the tagged
VLAN of the trunk port.
Modifying ports.
Recommended configuration procedure for assigning a hybrid
port to a VLAN
Step
1.
Remarks
Required.
Creating VLANs.
Create one or multiple VLANs.
Optional.
Configure the link type of the port as hybrid.
2.
To configure a trunk port as a hybrid port, first
configure it as an access port.
Configuring the link type of a port.
If you configure multiple untagged VLANs for a trunk
port at the same time, the trunk port automatically
becomes a hybrid port.
By default, the link type of a port is access.
138
Step
Remarks
Optional.
3.
Setting the PVID for a port.
Configure the PVID of the hybrid port.
By default, the PVID of a hybrid port is VLAN 1.
4.
Configure the hybrid port as an untagged
member of the specified VLANs:
a. Selecting VLANs
Specify the range of VLANs available for
selection during related operations. Configure
a subset of all existing VLANs. This step is
required before you perform operations on the
Detail, Modify VLAN, and Modify Port tabs.
Required.
N/A
b. Modifying a VLAN
Configure the hybrid port as an untagged
member of the specified VLAN.
Configure the
untagged VLAN of the
hybrid port.
5.
Modifying ports.
6.
Configure the hybrid port as a tagged member of
the specified VLAN:
a. Selecting VLANs
Specify the range of VLANs available for
selection during related operations. Configure
a subset of all existing VLANs. This step is
required before you perform operations on the
Detail, Modify VLAN, and Modify Port tabs.
N/A
Configure the tagged
VLAN of the hybrid
port.
Modifying ports.
Creating VLANs
1.
From the navigation tree, select Network > VLAN.
2.
Click Create to enter the page for creating VLANs.
3.
Enter the VLAN IDs, a VLAN ID range, or both.
4.
Click Create.
139
By default, the untagged
VLAN of a hybrid port is
VLAN 1.
Required.
b. Modifying a VLAN
Configure the hybrid port as a tagged
member of the specified VLAN.
7.
A hybrid port can have
multiple untagged VLANs.
Repeat these steps to
configure multiple
untagged VLANs for a
hybrid port.
A hybrid port can have
multiple tagged VLANs.
You can repeat these steps
to configure multiple
tagged VLANs for the
hybrid port.
Figure 134 Creating VLANs
Table 40 Configuration items
Item
Description
VLAN IDs
IDs of the VLANs to be created.
• ID—Select the ID of the VLAN whose description string is to be modified.
Modify the description
of the selected VLAN
Click the ID of the VLAN to be modified in the list in the middle of the page.
• Description—Set the description string of the selected VLAN.
By default, the description string of a VLAN is its VLAN ID, such as VLAN 0001.
Configuring the link type of a port
You can also configure the link type of a port on the Setup tab of Device > Port Management. For more
information, see "Managing ports."
To configure the link type of a port:
1.
From the navigation tree, select Network > VLAN.
2.
Click Modify Port.
3.
Select the port that you want to configure on the chassis front panel.
4.
Select the Link Type option.
5.
Set the link type to access, hybrid, or trunk.
6.
Click Apply.
A progress dialog box appears.
7.
Click Close on the progress dialog box when the dialog box prompts that the configuration
succeeds.
140
Figure 135 Modifying ports
Setting the PVID for a port
You can also configure the PVID of a port on the Setup tab of Device > Port Management. For more
information, see "Managing ports."
To set the PVID for a port:
1.
From the navigation tree, select Network > VLAN.
2.
Click Modify Port.
3.
Select the port that you want to configure on the chassis front panel.
4.
Select the PVID option.
The option allows you to modify the PVID of the port.
5.
Set a PVID for the port. By selecting the Delete box, you can restore the PVID of the port to the
default, which is VLAN 1.
The PVID of an access port must be an existing VLAN.
6.
Click Apply.
A progress dialog box appears.
7.
Click Close on the progress dialog box when the dialog box prompts that the configuration
succeeds.
141
Figure 136 Modifying the PVID for a port
Selecting VLANs
1.
From the navigation tree, select Network > VLAN.
The Select VLAN tab is displayed by default for you to select VLANs.
Figure 137 Selecting VLANs
2.
Select the Display all VLANs option to display all VLANs, or select the Display a subnet of all
configured VLANs option to enter the VLAN IDs to be displayed.
3.
Click Select.
142
Modifying a VLAN
1.
From the navigation tree, select Network > VLAN.
2.
Click Modify VLAN to enter the page for modifying a VLAN.
Figure 138 Modifying a VLAN
3.
Modify the member ports of a VLAN as described in Table 41.
4.
Click Apply.
A progress dialog box appears.
5.
Click Close on the progress dialog box when the dialog box prompts that the configuration
succeeds.
Table 41 Configuration items
Item
Please select a VLAN
to modify
Modify Description
Description
Select the VLAN to be modified.
The VLANs available for selection are existing VLANs selected on the page for
selecting VLANs.
Modify the description string of the selected VLAN.
By default, the description string of a VLAN is its VLAN ID, such as VLAN 0001.
Set the member type of the port to be modified in the VLAN:
• Untagged—Configures the port to send the traffic of the VLAN after removing the
Select membership
type
VLAN tag.
• Tagged—Configures the port to send the traffic of the VLAN without removing the
VLAN tag.
• Not a Member—Removes the port from the VLAN.
143
Item
Description
Select ports to be
modified and
assigned to this VLAN
Select the ports to be modified in the selected VLAN.
When you configure an access port as a tagged member of a VLAN, the link type of the
port is automatically changed into hybrid.
Modifying ports
1.
From the navigation tree, select Network > VLAN.
2.
Click Modify Port to enter the page for modifying ports.
Figure 139 Modifying ports
3.
Modify the VLANs of a port as described in Table 42.
4.
Click Apply.
A progress dialog box appears.
5.
Click Close on the progress dialog box when the dialog box prompts that the configuration
succeeds.
Table 42 Configuration items
Item
Description
Select Ports
Select the ports to be modified.
144
Item
Description
Set the member types of the selected ports to be modified in the specified VLANs:
Select
membership
type
• Untagged—Configures the ports to send the traffic of the VLANs after removing the VLAN
tags.
• Tagged—Configures the ports to send the traffic of the VLANs without removing the VLAN
tags.
• Not a Member—Removes the ports from the VLANs.
Set the IDs of the VLANs to or from which the selected ports are to be assigned or removed.
When you set the VLAN IDs, follow these guidelines:
VLAN IDs
• You cannot configure an access port as an untagged member of a nonexistent VLAN.
• When you configure an access port as a tagged member of a VLAN, or configure a trunk
port as an untagged member of multiple VLANs in bulk, the link type of the port is
automatically changed into hybrid.
• You can configure a hybrid port as a tagged or untagged member of a VLAN only if the
VLAN is an existing, static VLAN.
VLAN configuration example
Network requirements
As shown in Figure 140, trunk port GigabitEthernet 1/0/1 of Switch A is connected to trunk port
GigabitEthernet 1/0/1 of Switch B.
Configure the PVID of GigabitEthernet 1/0/1 as VLAN 100, and configure GigabitEthernet 1/0/1 to
permit packets from VLAN 2, VLAN 6 through VLAN 50, and VLAN 100 to pass through.
Figure 140 Network diagram
Configuring Switch A
1.
Configure GigabitEthernet 1/0/1 as a trunk port and configure VLAN 100 as the PVID:
a. From the navigation tree, select Device > Port Management.
b. Click Setup to enter the page for setting ports.
c. Select Trunk in the Link Type list, select the PVID box, and then enter PVID 100.
d. Select GigabitEthernet 1/0/1 on the chassis front device panel.
e. Click Apply.
145
Figure 141 Configuring GigabitEthernet 1/0/1 as a trunk port and its PVID as 100
2.
Create VLAN 2, VLAN 6 through VLAN 50, and VLAN 100:
a. From the navigation tree, select Network > VLAN.
b. Click Create to enter the page for creating VLANs.
c. Enter VLAN IDs 2, 6-50, 100.
d. Click Apply.
146
Figure 142 Creating VLAN 2, VLAN 6 through VLAN 50, and VLAN 100
3.
Assign GigabitEthernet 1/0/1 to VLAN 100 as an untagged member:
a. Click Select VLAN to enter the page for selecting VLANs.
b. Select the option before Display a subnet of all configured VLANs, and enter 1-100 in the field.
c. Click Select.
Figure 143 Setting a VLAN range
d. Click Modify VLAN to enter the page for modifying the ports in a VLAN.
e. Select 100 – VLAN 0100 in the Please select a VLAN to modify: list, select the Untagged option,
and select GigabitEthernet 1/0/1 on the chassis front device panel.
f. Click Apply.
147
A configuration progress dialog box appears.
g. After the configuration process is complete, click Close.
Figure 144 Assigning GigabitEthernet 1/0/1 to VLAN 100 as an untagged member
4.
Assign GigabitEthernet 1/0/1 to VLAN 2, and VLAN 6 through VLAN 50 as a tagged member:
a. Click Modify Port to enter the page for modifying the VLANs to which a port belongs.
b. Select GigabitEthernet 1/0/1 on the chassis front device panel, select the Tagged option, and
enter VLAN IDs 2, 6-50.
c. Click Apply.
A configuration progress dialog box appears.
d. After the configuration process is complete, click Close in the dialog box.
148
Figure 145 Assigning GigabitEthernet 1/0/1 to VLAN 2 and to VLANs 6 through 50 as a
tagged member
Configuring Switch B
Configure Switch B in the same way Switch A is configured. (Details not shown.)
Configuration guidelines
When you configure VLANs, follow these guidelines:
•
As the default VLAN, VLAN 1 can be neither created nor removed manually.
•
You cannot manually create or remove VLANs reserved for special purposes.
•
Dynamic VLANs cannot be removed on the page for removing VLANs.
•
You cannot remove a VLAN that has referenced a QoS policy.
149
Configuring VLAN interfaces
Before creating a VLAN interface, you must create the corresponding VLAN in Network > VLAN. For
more information, see "Configuring VLANs."
Overview
For hosts of different VLANs to communicate, you must use a router or Layer 3 switch to perform layer 3
forwarding. To achieve this, you can use VLAN interfaces.
VLAN interfaces are virtual interfaces used for Layer 3 communication between different VLANs. They do
not exist as physical entities on devices. For each VLAN, you can create one VLAN interface. You can
assign the VLAN interface an IP address, and specify it as the gateway of the VLAN to forward the traffic
destined for an IP network segment different from that of the VLAN.
Creating a VLAN interface
When you create a VLAN interface, you can select to assign an IPv4 address and an IPv6 link-local
address to the VLAN interface in this step or in a separate step. If you do not select to configure an IP
address, you can create the VLAN interface, and configure an IP address for the VLAN interface by
modifying it.
To create a VLAN interface:
1.
From the navigation tree, select Network > VLAN Interface.
2.
Click Create to enter the page for creating a VLAN interface.
150
Figure 146 Creating a VLAN interface
3.
Configure the VLAN interface as described in Table 43.
4.
Click Apply.
Table 43 Configuration items
Item
Description
Input a VLAN ID:
Enter the ID of the VLAN interface to be created. Before creating a VLAN interface,
make sure the corresponding VLAN exists.
Configure
Primary
IPv4
Address
DHCP
Configure the way in which the VLAN interface gets an IPv4 address.
BOOTP
Allow the VLAN interface to get an IP address automatically by
selecting the DHCP or BOOTP option. Otherwise, select the Manual
option to manually assign the VLAN interface an IP address.
Manual
After a VLAN interface fails to get an IP address through DHCP
multiple times, the device stops IP address application and configures
the default IP address for the interface.
IPv4
Address
Configure an IPv4 address for the VLAN interface.
Mask
Length
This field is available after you select the Manual option.
Set the subnet mask length (or enter a mask in dotted decimal
notation format).
This field is available after you select the Manual option.
151
These items
are available
after you
select the
Configure
Primary IPv4
Address box.
Item
Description
Auto
Configure the way in which the VLAN interface gets an IPv6 link-local
address.
Select the Auto or Manual option:
Configure
IPv6 Link
Local
Address
Manual
• Auto—The device automatically assigns a link-local address to the
VLAN interface based on the link-local address prefix (FE80::/64)
and the link-layer address of the VLAN interface.
• Manual—Requires manual assignment.
IPv6
Address
Configure an IPv6 link-local address for the VLAN interface.
This field is available after you select the Manual option. The prefix of
the IPv6 link-local address you enter must be FE80::/64.
These items
are available
after you
select the
Configure
IPv6 Link
Local
Address box.
Modifying a VLAN interface
By modifying a VLAN interface, you can assign an IPv4 address, an IPv6 link-local address, and an IPv6
site-local address, or global unicast address to the VLAN interface, and shut down or bring up the VLAN
interface.
After you modify the IPv4 address and status or the IPv6 address and status, or add an IPv6 unicast
address for a selected VLAN interface on the page for modifying VLAN interfaces, you must click the
correct Apply button to submit the modification.
After you change the IP address of the VLAN interface you are using to log in to the device, you will be
disconnected from the device. You can use the changed IP address to re-log in.
To modify a VLAN interface:
1.
From the navigation tree, select Network > VLAN Interface.
2.
Click Modify to enter the page for modifying a VLAN interface.
152
Figure 147 Modifying a VLAN interface
3.
Modify a VLAN interface as described in Table 44.
4.
Click Apply.
Table 44 Configuration items
Item
Description
Select the VLAN interface to be configured.
Select VLAN Interface
The VLAN interfaces available for selection in the list are those created on the page
for creating VLAN interfaces.
153
Item
Description
DHCP
Configure the way in which the VLAN interface gets an IPv4 address.
BOOTP
Allow the VLAN interface to get an IP address automatically by selecting the DHCP or
BOOTP option, or manually assign the VLAN interface an IP address by selecting the
Manual option. In the latter case, you must set the mask length or enter a mask in
dotted decimal notation format.
Manual
Select Up or Down from the Admin Status list to bring up or shut down the selected
VLAN interface.
Modify
IPv4
Address
When the VLAN interface fails, shut down and then bring up the VLAN interface,
which might restore the VLAN interface.
Admin
Status
By default, a VLAN interface is down if all Ethernet ports in the VLAN are down.
Otherwise, the VLAN interface is up.
When you set the admin status, follow these guidelines:
• The current VLAN interface state in the Modify IPv4 Address and Modify IPv6
Address frames changes as the VLAN interface state is modified in the Admin
Status list.
• The state of each port in the VLAN is independent of the VLAN interface state.
Auto
Configure the way in which the VLAN interface gets an IPv6 link-local address.
Select the Auto or Manual option:
• Auto—The device automatically assigns a link-local address to the VLAN interface
Manual
according to the link-local address prefix (FE80::/64) and the link-layer address of
the VLAN interface.
• Manual—Configures an IPv6 link-local address for the VLAN interface manually.
Select Up or Down from the Admin Status list to bring up or shut down the selected
VLAN interface.
When the VLAN interface fails, shut down and then enable the VLAN interface, which
might restore the VLAN interface.
Modify
IPv6
Address
Admin
Status
By default, a VLAN interface is down if all Ethernet ports in the VLAN are down.
Otherwise, the VLAN interface is up.
When you set the admin status, follow these guidelines:
• The current VLAN interface state in the Modify IPv4 Address and Modify IPv6
Address frames changes as the VLAN interface state is modified in the Admin
Status list.
• The state of each port in the VLAN is independent of the VLAN interface state.
Assign an IPv6 site-local address or global unicast address to the VLAN interface.
Add IPv6
Unicast
Address
Enter an IPv6 address in the field and select a prefix length in the list next to it.
The prefix of the IPv6 address you entered cannot be FE80::/10, the prefix of the
link-local address.
The prefix of the IPv6 site-local address you enter must be FEC0::/10.
EUI-64
Select the box to generate IPv6 site-local addresses or global unicast addresses in the
64-bit Extended Unique Identifier (EUI-64) format.
If the EUI-64 box is not specified, manually configured IPv6 site-local addresses or
global unicast addresses are used.
154
Configuration guidelines
When you configure VLAN interfaces, follow these guidelines:
•
A link-local address is automatically generated for an IPv6 VLAN interface after an IPv6 site-local
address or global unicast address is configured for the VLAN interface. This generated link-local
address is the same as the one generated in the Auto mode. If a manually assigned link-local
address is available, the manually assigned one takes effect. After the manually assigned link-local
address is removed, the automatically generated one takes effect.
•
For an IPv6 VLAN interface whose IPv6 link-local address is generated automatically after you
assign an IPv6 site-local address or global unicast address, removing the IPv6 site-local address or
global unicast address also removes the generated IPv6 link-local address.
•
For IPv6 link-local address configuration, manual assignment takes precedence over automatic
generation. If you first adopt the manual assignment and then the automatic generation, the
automatically generated link-local address will not take effect and the link-local address of the
interface is still the manually assigned one. However, if you remove the manually assigned one, the
one automatically generated takes effect.
155
Configuring a voice VLAN
Overview
The voice technology is developing quickly, and more and more voice devices are in use. In broadband
communities, data traffic and voice traffic are usually transmitted in the network at the same time. Usually,
voice traffic needs higher priority than data traffic to reduce the transmission delay and packet loss ratio.
A voice VLAN is configured for voice traffic. After assigning the ports that connect to voice devices to a
voice VLAN, the system automatically modifies quality of service (QoS) parameters for voice traffic, to
improve the transmission priority of voice traffic and ensure voice quality.
NOTE:
Common voice devices include IP phones and integrated access devices (IADs). Only IP phones are used
in the voice VLAN configuration examples in this document.
OUI addresses
A device determines whether an incoming packet is a voice packet by checking its source MAC address.
If the source MAC address of a received packet matches an organizationally unique identifier (OUI) in
the voice device OUI list (referred to as the OUI list in this document) maintained by the switch, the packet
is regarded as a voice packet.
You can add OUI addresses to the OUI list maintained by the device or use the default OUI list shown
in Table 45 for voice traffic identification.
Table 45 The default OUI list
Number
OUI Address
Vendor
1
0003-6b00-0000
Cisco phone
2
00e0-7500-0000
Polycom phone
An OUI address is usually the first 24 bits of a MAC address (in binary format). It is a globally unique
identifier assigned to a vendor by the IEEE. In this document, however, OUI addresses are used by the
system to determine whether received packets are voice packets and they are the results of the AND
operation of a MAC address and a mask. For more information, see "Adding OUI addresses to the OUI
list."
You can remove default OUI addresses and if needed, add them to the OUI list after their removal.
Voice VLAN assignment modes
A port connected to a voice device, an IP phone for example, can be assigned to a voice VLAN in one
of the following modes:
•
Automatic mode—The system matches the source MAC addresses in the protocol packets (tagged
packets) sent by the IP phone upon its power-on against the OUI list. If a match is found, the system
156
automatically assigns the receiving port to a voice VLAN, issues ACL rules and configures the
packet precedence. You can configure an aging timer for the voice VLAN. The system will remove
the port from the voice VLAN when the aging timer expires if no voice packet is received on the port
during the aging timer. The system automatically assigns ports to, or removes ports from, a voice
VLAN. Automatic mode is suitable for scenarios where PCs and IP phones connected in series
access the network through the device and ports on the device simultaneously transmit both voice
traffic and data traffic, as shown in Figure 148. When the voice VLAN works normally, if the system
reboots, the system reassigns ports in automatic voice VLAN assignment mode to the voice VLAN
after the reboot, ensuring that existing voice connections can work normally. In this case, voice
traffic streams do not trigger port assignment to the voice VLAN.
Figure 148 PCs and IP phones connected in series access the network
•
Manual mode—You must assign the port to a voice VLAN manually. Then, the system matches the
source MAC addresses in the packets against the OUI addresses. If a match is found, the system
issues ACL rules and configures the packet precedence. In this mode, you must manually assign
ports to, or remove ports from, a voice VLAN. Manual mode is suitable for scenarios where only IP
phones access the network through the device, and ports on the device transmit only voice traffic,
as shown in Figure 149. In this mode, ports assigned to a voice VLAN transmit voice traffic
exclusively, which prevents the impact of data traffic on the transmission of voice traffic.
Figure 149 Only IP phones access the network
Both modes forward tagged packets according to their tags.
Table 46 and Table 47 list the configurations required for ports of different link types to support tagged
or untagged voice traffic sent from IP phones when different voice VLAN assignment modes are
configured.
•
IP phones send tagged voice traffic
157
Table 46 Required configurations on ports of different link types for them to support tagged voice
traffic
Port link type
Voice VLAN assignment mode
supported for tagged voice
traffic
Configuration requirements
Access
Manual
Configure the PVID of the port as the voice VLAN.
Trunk
Hybrid
•
In automatic mode, the PVID of the port cannot be
the voice VLAN.
Automatic and manual
In manual mode, configure the port to permit
packets of the voice VLAN to pass through.
In automatic mode, the PVID of the port cannot be
the voice VLAN.
Automatic and manual
In manual mode, configure the port to permit
packets of the voice VLAN to pass through tagged.
IP phones send untagged voice traffic
When IP phones send untagged voice traffic, you can only configure the voice traffic receiving
ports on the device to operate in manual voice VLAN assignment mode.
Table 47 Required configurations on ports of different link types for them to support tagged voice
traffic
Port link type
Voice VLAN assignment mode
supported for untagged voice
traffic
Configuration requirements
Access
Manual
Configure the PVID of the port as the voice
VLAN.
Trunk
Manual
Configure the PVID of the port as the voice
VLAN and assign the port to the voice VLAN.
Hybrid
Manual
Configure the PVID of the port as the voice
VLAN and configure the port to permit packets
of the voice VLAN to pass through untagged.
NOTE:
• If an IP phone sends tagged voice traffic and its access port is configured with 802.1X authentication
and guest VLAN, you must assign different VLAN IDs for the voice VLAN, the PVID of the access port,
and the 802.1X guest VLAN for the functions to operate normally.
• If an IP phone sends untagged voice traffic, to deliver the voice VLAN function, you must configure the
PVID of the access port as the voice VLAN. As a result, 802.1X authentication does not take effect.
Security mode and normal mode of voice VLANs
Depending on their inbound packet filtering mechanisms, voice VLAN-enabled ports operate in one of
the following modes:
•
Normal mode—In this mode, both voice packets and non-voice packets are allowed to pass
through a voice VLAN-enabled inbound port. When receiving a voice packet, the port forwards it
without checking its source MAC address against the OUI addresses configured for the device. If
158
the PVID of the port is the voice VLAN and the port operates in manual VLAN assignment mode, the
port forwards all received untagged packets in the voice VLAN. In normal mode, the voice VLANs
are vulnerable to traffic attacks. Vicious users can forge a large amount of untagged packets and
send them to voice VLAN-enabled ports to consume the voice VLAN bandwidth, affecting normal
voice communication.
•
Security mode—In this mode, only voice packets whose source MAC addresses comply with the
recognizable OUI addresses can pass through the voice VLAN-enabled inbound port, but all other
packets are dropped.
In a safe network, you can configure the voice VLANs to operate in normal mode, reducing the
consumption of system resources due to source MAC addresses checking.
HP recommends not transmitting both voice packets and non-voice packets in a voice VLAN. If you have
to, first make sure that the voice VLAN security mode is disabled.
Table 48 How a voice VLAN-enable port processes packets in security/normal mode
Voice VLAN operating mode
Packet type
Packet processing mode
Untagged packets
If the source MAC address of a
packet matches an OUI address
configured for the device, it is
forwarded in the voice VLAN;
otherwise, it is dropped.
Packets carrying the voice VLAN tag
Security mode
Packets carrying other tags
Untagged packets
Packets carrying the voice VLAN tag
Normal mode
Packets carrying other tags
If the packet is a voice packet does
not carry the voice VLAN tag or
PVID tag, the packet is dropped.
Otherwise, the packet is
forwarded or dropped depending
on whether the port allows packets
of these VLANs to pass through.
The port does not check the source
MAC addresses of inbound
packets. All types of packets can
be transmitted in the voice VLAN.
Forwarded or dropped depending
on whether the port allows packets
of these VLANs to pass through
Recommended voice VLAN configuration
procedure
Before configuring the voice VLAN, you must create the VLAN and configure the link type of each port
to be assigned to the VLAN. Because VLAN 1 is the system-default VLAN, you do not need to create it;
however, you cannot configure it as the voice VLAN. For information about port link types, see
"Managing ports."
159
Recommended configuration procedure for a port in automatic voice VLAN assignment mode
Step
Remarks
(Optional.)
Configuring voice VLAN globally
1.
Configure the voice VLAN to operate in security mode and configure
the aging timer
(Required.)
Configuring voice VLAN on ports
2.
Configure the voice VLAN assignment mode of a port as automatic
and enable the voice VLAN function on the port.
By default, the voice VLAN assignment mode of a port is automatic,
and the voice VLAN function is disabled on a port.
(Optional.)
Adding OUI addresses to the
OUI list
3.
The system supports up to 8 OUI addresses.
By default, the system is configured with two OUI addresses, as shown
in Table 45.
Recommended configuration procedure for a port in manual voice VLAN assignment mode
Step
1.
Remarks
Configuring voice
VLAN globally
(Optional.)
Configure the voice VLAN to operate in security mode and configure the aging
timer.
(Required.)
2.
3.
Configuring voice
VLAN on ports
Adding OUI
addresses to the OUI
list
Configure the voice VLAN assignment mode of a port as manual and enable
voice VLAN on the port.
By default, the voice VLAN assignment mode of a port is automatic, and voice
VLAN is disabled on a port.
(Optional.)
You can configure up to 8 OUI addresses.
By default, the system is configured with the two OUI addresses shown in Table
45.
Configuring voice VLAN globally
1.
Select Network > Voice VLAN from the navigation tree.
2.
Click the Setup tab.
Figure 150 Configuring voice VLAN
160
3.
Configure the global voice VLAN settings as described in Table 49.
4.
Click Apply.
Table 49 Configuration items
Item
Description
Voice VLAN security
Select Enable or Disable in the list to enable or disable the voice VLAN security
mode.
By default, the voice VLANs operate in security mode.
Set the voice VLAN aging timer.
Voice VLAN aging time
The voice VLAN aging timer setting only applies to a port in automatic voice
VLAN assignment mode. The voice VLAN aging timer starts as soon as the port
is assigned to the voice VLAN. If no voice packet has been received before the
timer expires, the port is removed from the voice VLAN.
Configuring voice VLAN on ports
1.
Select Network > Voice VLAN from the navigation tree.
2.
Click the Port Setup tab.
Figure 151 Configuring voice VLAN on ports
3.
Configure the voice VLAN function for ports as described in Table 50.
4.
Click Apply.
Table 50 Configuration items
Item
Description
Voice VLAN port mode
• Auto—Automatic voice VLAN assignment mode
• Manual—Manual voice VLAN assignment mode
Set the voice VLAN assignment mode of a port to:
161
Item
Description
Voice VLAN port state
Select Enable or Disable in the list to enable or disable the voice VLAN function
on the port.
Voice VLAN ID
Set the voice VLAN ID of a port when the voice VLAN port state is set to Enable.
Select the port on the chassis front panel.
You can select multiple ports to configure them in bulk. The numbers of the
selected ports will be displayed in the Ports selected for voice VLAN field.
Select Ports
NOTE:
To set the voice VLAN assignment mode of a port to automatic, you must make
sure that the link type of the port is trunk or hybrid, and that the port does not
belong to the voice VLAN.
Adding OUI addresses to the OUI list
1.
Select Network > Voice VLAN from the navigation tree.
2.
Click the OUI Add tab.
Figure 152 Adding OUI addresses to the OUI list
3.
Add an OUI address to the list as described in Table 51.
4.
Click Apply.
Table 51 Configuration items
Item
Description
OUI Address
Set the source MAC address of voice traffic.
Mask
Set the mask length of the source MAC address.
Description
Set the description of the OUI address entry.
162
Voice VLAN configuration examples
Configuring voice VLAN on a port in automatic voice VLAN
assignment mode
Network requirements
As shown in Figure 153:
•
Configure VLAN 2 as the voice VLAN allowing only voice traffic to pass through.
•
The IP phone connected to hybrid port GigabitEthernet 1/0/1 sends untagged voice traffic.
•
GigabitEthernet 1/0/1 operates in automatic VLAN assignment mode. Set the voice VLAN aging
timer to 30 minutes.
•
Configure GigabitEthernet 1/0/1 to allow voice packets whose source MAC addresses match the
OUI addresses specified by OUI address 0011-2200-0000 and mask ffff-ff00-0000. The
description of the OUI address entry is test.
Figure 153 Network diagram
Configuring Switch A
1.
Create VLAN 2:
a. Select Network > VLAN from the navigation tree.
b. Click the Create tab.
c. Enter VLAN ID 2.
d. Click Create.
163
Figure 154 Creating VLAN 2
2.
Configure GigabitEthernet 1/0/1 as a hybrid port:
a. Select Device > Port Management from the navigation tree.
b. Click the Setup tab.
c. Select Hybrid from the Link Type list.
d. Select GigabitEthernet 1/0/1 from the chassis front panel.
e. Click Apply.
164
Figure 155 Configuring GigabitEthernet 1/0/1 as a hybrid port
3.
Configure the voice VLAN function globally:
a. Select Network > Voice VLAN from the navigation tree.
b. Click the Setup tab.
c. Select Enable in the Voice VLAN security list.
d. Set the voice VLAN aging timer to 30 minutes.
e. Click Apply.
Figure 156 Configuring the voice VLAN function globally
4.
Configure voice VLAN on GigabitEthernet 1/0/1:
165
a. Click the Port Setup tab.
b. Select Auto in the Voice VLAN port mode list.
c. Select Enable in the Voice VLAN port state list.
d. Enter voice VLAN ID 2.
e. Select GigabitEthernet 1/0/1 on the chassis front panel.
f. Click Apply.
Figure 157 Configuring voice VLAN on GigabitEthernet 1/0/1
5.
Add OUI addresses to the OUI list:
a. Click the OUI Add tab.
b. Enter OUI address 0011-2200-0000.
c. Select FFFF-FF00-0000 in the Mask list.
d. Enter description string test.
e. Click Apply.
Figure 158 Adding OUI addresses to the OUI list
166
Verifying the configuration
1.
When the preceding configurations are completed, the OUI Summary tab is displayed by default,
as shown in Figure 159. You can view the information about the newly-added OUI address.
Figure 159 Displaying the current OUI list of the device
2.
Click the Summary tab, where you can view the current voice VLAN information.
Figure 160 Displaying voice VLAN information
Configuring a voice VLAN on a port in manual voice VLAN
assignment mode
Network requirements
As shown in Figure 161:
•
Configure VLAN 2 as a voice VLAN that carries only voice traffic.
•
The IP phone connected to hybrid port GigabitEthernet 1/0/1 sends untagged voice traffic.
•
GigabitEthernet 1/0/1 operates in manual voice VLAN assignment mode and allows voice
packets whose source MAC addresses match the OUI addresses specified by OUI address
167
0011-2200-0000 and mask ffff-ff00-0000 to pass through. The description of the OUI address entry
is test.
Figure 161 Network diagram
Configuring Switch A
1.
Create VLAN 2:
a. Select Network > VLAN from the navigation tree.
b. Click the Create tab.
c. Enter VLAN ID 2.
d. Click Create.
Figure 162 Creating VLAN 2
2.
Configure GigabitEthernet 1/0/1 as a hybrid port and configure its PVID as VLAN 2:
a. Select Device > Port Management from the navigation tree.
b. Click the Setup tab.
c. Select Hybrid from the Link Type list.
168
d. Select the PVID box and enter 2 in the field.
e. Select GigabitEthernet 1/0/1 from the chassis front panel.
f. Click Apply.
Figure 163 Configuring GigabitEthernet 1/0/1 as a hybrid port
3.
Assign GigabitEthernet 1/0/1 to VLAN 2 as an untagged member:
a. Select Network > VLAN from the navigation tree.
b. Click the Modify Port tab.
c. Select GigabitEthernet 1/0/1 from the chassis front panel.
d. Select the Untagged option.
e. Enter VLAN ID 2.
f. Click Apply.
A configuration progress dialog box appears.
g. After the configuration process is complete, click Close.
169
Figure 164 Assigning GigabitEthernet 1/0/1 to VLAN 2 as an untagged member
4.
Configure voice VLAN on GigabitEthernet 1/0/1:
a. Select Network > Voice VLAN from the navigation tree.
b. Click the Port Setup tab.
c. Select Manual in the Voice VLAN port mode list.
d. Select Enable in the Voice VLAN port state list.
e. Enter 2 in the VLAN IDs field.
f. Select GigabitEthernet 1/0/1 on the chassis front panel.
g. Click Apply.
170
Figure 165 Configuring voice VLAN on GigabitEthernet 1/0/1
5.
Add OUI addresses to the OUI list:
a. Click the OUI Add tab.
b. Enter OUI address 0011-2200-0000.
c. Select FFFF-FF00-0000 as the mask.
d. Enter description string test.
e. Click Apply.
Figure 166 Adding OUI addresses to the OUI list
Verifying the configuration
1.
When the preceding configurations are complete, the OUI Summary tab is displayed by default,
as shown in Figure 167. You can view the information about the newly-added OUI address.
171
Figure 167 Displaying the current OUI list of the device
2.
Click the Summary tab, where you can view the current voice VLAN information.
Figure 168 Displaying the current voice VLAN information
Configuration guidelines
When you configure the voice VLAN function, follow these guidelines:
•
To remove a VLAN functioning as a voice VLAN, disable its voice VLAN function first.
•
Only one VLAN is supported and only an existing static VLAN can be configured as the voice
VLAN.
•
Do not enable the voice VLAN function on a link aggregation group member port.
•
After you assign a port operating in manual voice VLAN assignment mode to the voice VLAN, the
voice VLAN takes effect.
172
Configuring the MAC address table
MAC address configurations related to interfaces apply to Layer 2 Ethernet interfaces and Layer 2
aggregate interfaces only.
This document covers only the configuration of unicast MAC address entries, including static, dynamic,
and blackhole entries.
Overview
To reduce single-destination packet flooding in a switched LAN, an Ethernet device uses a MAC address
table to forward frames. This table describes from which port a MAC address (or host) can be reached.
Upon receiving a frame, the device uses the destination MAC address of the frame to look for a match
in the MAC address table. If a match is found, the device forwards the frame out of the outgoing interface
in the matching entry. If no match is found, the device floods the frame out of all but the incoming port.
How a MAC address entry is created
The device automatically learns entries in the MAC address table, or you can add them manually.
MAC address learning
The device can automatically populate its MAC address table by learning the source MAC addresses of
incoming frames on each port.
When a frame arrives at a port (for example, Port A), the device performs the following tasks:
1.
Verifies the source MAC address (for example, MAC-SOURCE) of the frame.
2.
Looks up the source MAC address in the MAC address table.
3.
{
If an entry is found, the device updates the entry.
{
If no entry is found, the device adds an entry for MAC-SOURCE and Port A.
When the device receives a frame destined for MAC-SOURCE after learning this source MAC
address, the device finds the MAC-SOURCE entry in the MAC address table and forwards the
frame out of Port A.
The device performs this learning process each time it receives a frame from an unknown source MAC
address until the MAC address table is fully populated.
Manually configuring MAC address entries
With dynamic MAC address learning, a device does not distinguish between illegitimate and legitimate
frames. For example, when a hacker sends frames with a forged source MAC address to a port different
from the one with which the real MAC address is associated, the device creates an entry for the forged
MAC address, and forwards frames destined for the legal user to the hacker instead.
To improve port security, you can manually add MAC address entries to the MAC address table of the
device to bind specific user devices to the port.
173
Types of MAC address entries
A MAC address table can contain the following types of entries:
•
Static entries—Manually added and never age out.
•
Dynamic entries—Manually added or dynamically learned, and might age out.
•
Blackhole entries—Manually configured and never age out. They are configured for filtering out
frames with specific source or destination MAC addresses. For example, to block all frames
destined for a specific user for security concerns, you can configure the MAC address of this user
as a blackhole MAC address entry.
A static or blackhole MAC address entry can overwrite a dynamic MAC address entry, but not vice
versa.
Displaying and configuring MAC address entries
1.
Select Network > MAC from the navigation tree.
The MAC tab automatically appears, which shows all the MAC address entries on the device.
Figure 169 The MAC tab
2.
Click Add in the bottom to enter the page for creating MAC address entries.
Figure 170 Creating a MAC address entry
3.
Configure a MAC address entry as described in Table 52.
4.
Click Apply.
Table 52 Configuration items
Item
Description
MAC
Set the MAC address to be added.
174
Item
Description
Set the type of the MAC address entry:
• Static—Static MAC address entries that never age out.
• Dynamic—Dynamic MAC address entries that will age out.
• Blackhole—Blackhole MAC address entries that never age out.
Type
The MAC tab (see Figure 169) displays the following types of MAC address entries:
•
•
•
•
Config static—Static MAC address entries manually configured by the users.
Blackhole—Blackhole MAC address entries.
Learned—Dynamic MAC address entries learned by the device.
Other—Other types of MAC address entries.
VLAN ID
Set the ID of the VLAN to which the MAC address belongs.
Port
Set the port to which the MAC address belongs. This port must belong to the specified
VLAN.
Setting the aging time of MAC address entries
1.
Select Network > MAC from the navigation tree.
2.
Click the Setup tab to enter the page for setting the MAC address entry aging time.
Figure 171 Setting the aging time for MAC address entries
3.
Configure the aging time for MAC address entries as described in Table 53.
4.
Click Apply.
Table 53 Configuration items
Item
Description
No-aging
Specify that the MAC address entry never ages out.
Aging time
Set the aging time for the MAC address entry.
MAC address table configuration example
Network requirements
Use the Web-based NMS to configure the MAC address table of the device. Add a static MAC address
00e0-fc35-dc71 under GigabitEthernet 1/0/1 in VLAN 1.
175
Creating a static MAC address entry
1.
Select Network > MAC from the navigation tree.
By default, the MAC tab is displayed.
2.
Click Add.
3.
Configure a MAC address entry:
a. Type MAC address 00e0-fc35-dc71.
b. Select static from the Type list.
c. Select 1 from the VLAN list.
d. Select GigabitEthernet1/0/1 from the Port list.
4.
Click Apply.
Figure 172 Creating a static MAC address entry
176
Configuring MSTP
Overview
Spanning tree protocols eliminate loops in a physical link-redundant network by selectively blocking
redundant links and putting them in a standby state.
The recent versions of STP include the Rapid Spanning Tree Protocol (RSTP) and the Multiple Spanning
Tree Protocol (MSTP).
Introduction to STP
STP was developed based on the 802.1d standard of IEEE to eliminate loops at the data link layer in a
LAN. Networks often have redundant links as backups in case of failures, but loops are a very serious
problem. Devices running STP detect loops in the network by exchanging information with one another,
and eliminate loops by selectively blocking certain ports to prune the loop structure into a loop-free tree
structure. This avoids proliferation and infinite cycling of packets that would occur in a loop network.
In the narrow sense, STP refers to IEEE 802.1d STP. In the broad sense, STP refers to the IEEE 802.1d STP
and various enhanced spanning tree protocols derived from that protocol.
STP protocol packets
STP uses bridge protocol data units (BPDUs), also known as configuration messages, as its protocol
packets. This chapter uses BPDUs to represent all types of spanning tree protocol packets.
STP-enabled network devices exchange BPDUs to establish a spanning tree. BPDUs contain sufficient
information for the network devices to complete spanning tree calculation.
STP uses the following types of BPDUs:
•
Configuration BPDUs—Used for calculating a spanning tree and maintaining the spanning tree
topology.
•
Topology change notification (TCN) BPDUs—Used for notifying the concerned devices of network
topology changes.
Configuration BPDUs contain sufficient information for the network devices to complete spanning tree
calculation. Important fields in a configuration BPDU include the following:
•
Root bridge ID—Consisting of the priority and MAC address of the root bridge.
•
Root path cost—Cost of the path to the root bridge denoted by the root identifier from the
transmitting bridge.
•
Designated bridge ID—Consisting of the priority and MAC address of the designated bridge.
•
Designated port ID—Consisting of the priority and global port number of the designated port.
•
Message age—Age of the configuration BPDU while it propagates in the network.
•
Max age—Maximum age of the configuration BPDU stored on a device.
•
Hello time—Configuration BPDU transmission interval.
177
Forward delay—Delay that STP bridges use to transit port state.
•
The descriptions and examples in this chapter only use the following fields in the configuration BPDUs:
•
Root bridge ID (represented by device priority)
•
Root path cost
•
Designated bridge ID (represented by device priority)
•
Designated port ID (represented by port name)
Basic concepts in STP
Root bridge
A tree network must have a root bridge. The entire network contains only one root bridge, and all the
other bridges in the network are called "leaf nodes". The root bridge is not permanent, but can change
with changes of the network topology.
Upon initialization of a network, each device generates and periodically sends configuration BPDUs,
with itself as the root bridge. After network convergence, only the root bridge generates and periodically
sends configuration BPDUs. The other devices only forward the BPDUs.
Root port
On a non-root bridge, the port nearest to the root bridge is the root port. The root port communicates with
the root bridge. Each non-root bridge has only one root port. The root bridge has no root port.
Designated bridge and designated port
Classification
Designated bridge
Designated port
For a device
Device directly connected with the local
device and responsible for forwarding
BPDUs to the local device.
Port through which the designated bridge
forwards BPDUs to the local device.
For a LAN
Device responsible for forwarding BPDUs to
this LAN segment.
Port through which the designated bridge
forwards BPDUs to this LAN segment.
As shown in Figure 173, Device B and Device C are connected to the LAN. AP1 and AP2, BP1 and BP2,
and CP1 and CP2 are ports on Device A, Device B, and Device C, respectively.
•
If Device A forwards BPDUs to Device B through AP1, the designated bridge for Device B is Device
A, and the designated port of Device B is port AP1 on Device A.
•
If Device B forwards BPDUs to the LAN, the designated bridge for the LAN is Device B, and the
designated port for the LAN is the port BP2 on Device B.
178
Figure 173 Designated bridges and designated ports
Path cost
Path cost is a reference value used for link selection in STP. STP calculates path costs to select the most
robust links and block redundant links that are less robust, to prune the network into a loop-free tree.
All the ports on the root bridge are designated ports.
Calculation process of the STP algorithm
The spanning tree calculation process described in the following sections is a simplified process for
example only.
Calculation process
The STP algorithm uses the following calculation process:
1.
Network initialization.
Upon initialization of a device, each port generates a BPDU with the port as the designated port,
the device as the root bridge, 0 as the root path cost, and the device ID as the designated bridge
ID.
2.
Root bridge selection.
Initially, each STP-enabled device on the network assumes itself to be the root bridge, with its own
device ID as the root bridge ID. By exchanging configuration BPDUs, the devices compare their
root bridge IDs to elect the device with the smallest root bridge ID as the root bridge.
3.
Root port and designated ports selection on the non-root bridges.
Step
Description
1
A non-root-bridge device regards the port on which it received the optimum
configuration BPDU as the root port. Table 54 describes how the optimum configuration
BPDU is selected.
179
Step
Description
Based on the configuration BPDU and the path cost of the root port, the device
calculates a designated port configuration BPDU for each of the other ports.
2
• The root bridge ID is replaced with that of the configuration BPDU of the root port.
• The root path cost is replaced with that of the configuration BPDU of the root port plus
the path cost of the root port.
• The designated bridge ID is replaced with the ID of this device.
• The designated port ID is replaced with the ID of this port.
The device compares the calculated configuration BPDU with the configuration BPDU
on the port whose port role will be determined, and acts depending on the result of the
comparison:
• If the calculated configuration BPDU is superior, the device considers this port as the
3
designated port, replaces the configuration BPDU on the port with the calculated
configuration BPDU, and periodically sends the calculated configuration BPDU.
• If the configuration BPDU on the port is superior, the device blocks this port without
updating its configuration BPDU. The blocked port can receive BPDUs, but it cannot
send BPDUs or forward any data.
When the network topology is stable, only the root port and designated ports forward user traffic.
Other ports are all in the blocked state to receive BPDUs but not to forward BPDUs or user traffic.
Table 54 Selecting the optimum configuration BPDU
Step
Actions
Upon receiving a configuration BPDU on a port, the device compares the priority of
the received configuration BPDU with that of the configuration BPDU generated by
the port. It takes one of the following actions:
1
• If the former priority is lower, the device discards the received configuration BPDU
and keeps the configuration BPDU the port generated.
• If the former priority is higher, the device replaces the content of the configuration
BPDU generated by the port with the content of the received configuration BPDU.
2
The device compares the configuration BPDUs of all the ports, and chooses the
optimum configuration BPDU.
The following are the principles of configuration BPDU comparison:
a. The configuration BPDU with the lowest root bridge ID has the highest priority.
b. If all the configuration BPDUs have the same root bridge ID, their root path costs are compared.
For example, the root path cost in a configuration BPDU plus the path cost of a receiving port
is S. The configuration BPDU with the smallest S value has the highest priority.
c. If all configuration BPDUs have the same root bridge ID and S value, their designated bridge
IDs, designated port IDs, and the IDs of the receiving ports are compared in sequence. The
configuration BPDU that contains a smaller designated bridge ID, designated port ID, or
receiving port ID is selected.
A tree-shape topology forms when the root bridge, root ports, and designated ports are selected.
Example of STP calculation
Figure 174 provides an example showing how the STP algorithm works.
180
Figure 174 STP network
As shown in Figure 174, the priority values of Device A, Device B, and Device C are 0, 1, and 2, and the
path costs of links among the three devices are 5, 10, and 4, respectively.
1.
Device state initialization.
In Table 55, each configuration BPDU contains the following fields: root bridge ID, root path cost,
designated bridge ID, and designated port ID.
Table 55 Initial state of each device
Device
Device A
Device B
Device C
2.
Port name
BPDU of port
AP1
{0, 0, 0, AP1}
AP2
{0, 0, 0, AP2}
BP1
{1, 0, 1, BP1}
BP2
{1, 0, 1, BP2}
CP1
{2, 0, 2, CP1}
CP2
{2, 0, 2, CP2}
Configuration BPDUs comparison on each device.
In Table 56, each configuration BPDU contains the following fields: root bridge ID, root path cost,
designated bridge ID, and designated port ID.
181
Table 56 Comparison process and result on each device
Device
Configuration BPDU on
ports after comparison
Comparison process
• Port AP1 receives the configuration BPDU of Device B {1, 0,
1, BP1}. Device A finds that the configuration BPDU of the
local port {0, 0, 0, AP1} is superior to the received
configuration BPDU, and it discards the received
configuration BPDU.
• Port AP2 receives the configuration BPDU of Device C {2, 0,
Device A
2, CP1}. Device A finds that the BPDU of the local port {0, 0,
0, AP2} is superior to the received configuration BPDU, and
it discards the received configuration BPDU.
• AP1: {0, 0, 0, AP1}
• AP2: {0, 0, 0, AP2}
• Device A finds that both the root bridge and designated
bridge in the configuration BPDUs of all its ports are itself, so
it assumes itself to be the root bridge. It does not make any
change to the configuration BPDU of each port, and it starts
sending out configuration BPDUs periodically.
• Port BP1 receives the configuration BPDU of Device A {0, 0,
0, AP1}. Device B finds that the received configuration BPDU
is superior to the configuration BPDU of the local port {1, 0,
1, BP1}, and it updates the configuration BPDU of BP1.
• Port BP2 receives the configuration BPDU of Device C {2, 0,
2, CP2}. Device B finds that the configuration BPDU of the
local port {1, 0, 1, BP2} is superior to the received
configuration BPDU, and it discards the received
configuration BPDU.
• BP1: {0, 0, 0, AP1}
• BP2: {1, 0, 1, BP2}
• Device B compares the configuration BPDUs of all its ports,
Device B
and determines that the configuration BPDU of BP1 is the
optimum configuration BPDU. Then, it uses BP1 as the root
port, the configuration BPDUs of which will not be changed.
• Based on the configuration BPDU of BP1 and the path cost
of the root port (5), Device B calculates a designated port
configuration BPDU for BP2 {0, 5, 1, BP2}.
• Device B compares the calculated configuration BPDU {0, 5,
1, BP2} with the configuration BPDU of BP2. If the calculated
BPDU is superior, BP2 will act as the designated port, and
the configuration BPDU on this port will be replaced with the
calculated configuration BPDU, which will be sent out
periodically.
• Root port BP1: {0, 0,
0, AP1}
• Designated port BP2:
{0, 5, 1, BP2}
• Port CP1 receives the configuration BPDU of Device A {0, 0,
0, AP2}. Device C finds that the received configuration
BPDU is superior to the configuration BPDU of the local port
{2, 0, 2, CP1}, and it updates the configuration BPDU of
CP1.
Device C
• Port CP2 receives the configuration BPDU of port BP2 of
Device B {1, 0, 1, BP2} before the configuration BPDU is
updated. Device C finds that the received configuration
BPDU is superior to the configuration BPDU of the local port
{2, 0, 2, CP2}, and it updates the configuration BPDU of
CP2.
182
• CP1: {0, 0, 0, AP2}
• CP2: {1, 0, 1, BP2}
Device
Configuration BPDU on
ports after comparison
Comparison process
After comparison:
• The configuration BPDU of CP1 is elected as the optimum
configuration BPDU, so CP1 is identified as the root port, the
configuration BPDUs of which will not be changed.
• Device C compares the calculated designated port
configuration BPDU {0, 10, 2, CP2} with the configuration
BPDU of CP2, and CP2 becomes the designated port, and
the configuration BPDU of this port will be replaced with the
calculated configuration BPDU.
• Root port CP1: {0, 0,
0, AP2}
• Designated port CP2:
{0, 10, 2, CP2}
• Then, port CP2 receives the updated configuration BPDU of
Device B {0, 5, 1, BP2}. Because the received configuration
BPDU is superior to its own configuration BPDU, Device C
launches a BPDU update process.
• At the same time, port CP1 receives periodic configuration
• CP1: {0, 0, 0, AP2}
• CP2: {0, 5, 1, BP2}
BPDUs from Device A. Device C does not launch an update
process after comparison.
After comparison:
• Because the root path cost of CP2 (9) (root path cost of the
BPDU (5) plus path cost corresponding to CP2 (4)) is smaller
than the root path cost of CP1 (10) (root path cost of the
BPDU (0) + path cost corresponding to CP2 (10)), the BPDU
of CP2 is elected as the optimum BPDU, and CP2 is elected
as the root port, the messages of which will not be changed.
• After comparison between the configuration BPDU of CP1
and the calculated designated port configuration BPDU,
port CP1 is blocked, with the configuration BPDU of the port
unchanged, and the port will not receive data from Device A
until a spanning tree calculation process is triggered by a
new event, for example, the link from Device B to Device C
going down.
• Blocked port CP2: {0,
0, 0, AP2}
• Root port CP2: {0, 5,
1, BP2}
After the comparison processes described in Table 56, a spanning tree with Device A as the root bridge
is established, and the topology is as shown in Figure 175.
Figure 175 The final calculated spanning tree
183
The configuration BPDU forwarding mechanism of STP
The configuration BPDUs of STP are forwarded according to these guidelines:
•
Upon network initiation, every device regards itself as the root bridge, generates configuration
BPDUs with itself as the root, and sends the configuration BPDUs at a regular hello interval.
•
If the root port received a configuration BPDU and the received configuration BPDU is superior to
the configuration BPDU of the port, the device increases the message age carried in the
configuration BPDU following a certain rule, and it starts a timer to time the configuration BPDU
while sending this configuration BPDU through the designated port.
•
If the configuration BPDU received on a designated port has a lower priority than the configuration
BPDU of the local port, the port immediately sends its own configuration BPDU in response.
•
If a path becomes faulty, the root port on this path no longer receives new configuration BPDUs and
the old configuration BPDUs will be discarded because of timeout. The device generates
configuration BPDUs with itself as the root and sends the BPDUs and TCN BPDUs. This triggers a
new spanning tree calculation process to establish a new path to restore the network connectivity.
However, the newly calculated configuration BPDU cannot be propagated throughout the network
immediately, so the old root ports and designated ports that have not detected the topology change
continue forwarding data along the old path. If the new root ports and designated ports begin to
forward data as soon as they are elected, a temporary loop might occur.
STP timers
STP calculation involves the following timers:
•
Forward delay—The delay time for device state transition. A path failure can cause spanning tree
recalculation to adapt the spanning tree structure to the change. However, the resulting new
configuration BPDU cannot propagate throughout the network immediately. If the newly elected
root ports and designated ports start to forward data immediately, a temporary loop is likely to
occur.
For this reason, as a mechanism for state transition in STP, the newly elected root ports or
designated ports require twice the forward delay time before they transit to the forwarding state,
which makes sure the new configuration BPDU has propagated throughout the network.
•
Hello time—The time interval at which a device sends hello packets to the neighboring devices to
make sure the paths are fault-free.
•
Max age—A parameter used to determine whether a configuration BPDU held by the device has
expired. The device discards the BPDU if the max age is exceeded.
Introduction to RSTP
Developed based on the 802.1w standard of IEEE, RSTP is an optimized version of STP. It achieves rapid
network convergence by allowing a newly elected root port or designated port to enter the forwarding
state much faster than STP.
If the old root port on the device has stopped forwarding data and the upstream designated port has
started forwarding data, a newly elected RSTP root port rapidly enters the forwarding state.
A newly elected RSTP designated port rapidly enters the forwarding state if it is an edge port (a port that
directly connects to a user terminal rather than to another network device or a shared LAN segment) or
it connects to a point-to-point link. Edge ports directly enter the forwarding state. Connecting to a
point-to-point link, a designated port enters the forwarding state immediately after the device receives a
handshake response from the directly connected device.
184
Introduction to MSTP
MSTP overcomes the following STP and RSTP limitations:
•
STP limitations—STP does not support rapid state transition of ports. A newly elected port must wait
twice the forward delay time before it transits to the forwarding state, even if it connects to a
point-to-point link or is an edge port.
•
RSTP limitations—Although RSTP enables faster network convergence than STP, RSTP fails to
provide load balancing among VLANs. As with STP, all RSTP bridges in a LAN share one spanning
tree and forward packets from all VLANs along this spanning tree.
MSTP features
Developed based on IEEE 802.1s, MSTP overcomes the limitations of STP and RSTP. In addition to
supporting rapid network convergence, it provides a better load sharing mechanism for redundant links
by allowing data flows of different VLANs to be forwarded along separate paths.
MSTP provides the following features:
•
MSTP divides a switched network into multiple regions, each of which contains multiple spanning
trees that are independent of one another.
•
MSTP supports mapping VLANs to spanning tree instances by means of a VLAN-to-instance
mapping table. MSTP can reduce communication overheads and resource usage by mapping
multiple VLANs to one instance.
•
MSTP prunes a loop network into a loop-free tree, which avoids proliferation and endless cycling of
packets in a loop network. In addition, it supports load balancing of VLAN data by providing
multiple redundant paths for data forwarding.
•
MSTP is compatible with STP and RSTP.
MSTP basic concepts
Figure 176 shows a switched network that comprises four MST regions, each MST region comprising four
MSTP devices.
185
Figure 176 Basic concepts in MSTP
MST region
A multiple spanning tree region (MST region) consists of multiple devices in a switched network and the
network segments among them. All these devices have the following characteristics:
•
A spanning tree protocol enabled.
•
Same region name.
•
Same VLAN-to-instance mapping configuration.
•
Same MSTP revision level.
•
Physically linked with one another.
Multiple MST regions can exist in a switched network. You can assign multiple devices to the same MST
region. In Figure 176, the switched network comprises four MST regions, MST region A0 through MST
region D0, and all devices in each MST region have the same MST region configuration.
MSTI
MSTP can generate multiple independent spanning trees in an MST region, and each spanning tree is
mapped to a range of VLANs. Each spanning tree is referred to as a "multiple spanning tree instance
(MSTI)".
In Figure 176, multiple MSTIs can exist in each MST region, each MSTI corresponding to the specified
VLANs.
186
VLAN-to-instance mapping table
As an attribute of an MST region, the VLAN-to-instance mapping table describes the mapping
relationships between VLANs and MSTIs.
In Figure 176, the VLAN-to-instance mapping table of region A0 is: VLAN 1 is mapped to MSTI 1, VLAN
2 to MSTI 2, and the rest to CIST. MSTP achieves load balancing by means of the VLAN-to-instance
mapping table.
CST
The common spanning tree (CST) is a single spanning tree that connects all MST regions in a switched
network. If you regard each MST region as a device, the CST is a spanning tree calculated by these
devices through STP or RSTP.
The red lines in Figure 176 represent the CST.
IST
An internal spanning tree (IST) is a spanning tree that runs in an MST region. It is also called MSTI 0, a
special MSTI to which all VLANs are mapped by default.
In Figure 176, the CIST has a section in each MST region, and this section is the IST in the respective MST
region.
CIST
The common and internal spanning tree (CIST) is a single spanning tree that connects all devices in a
switched network. It consists of the ISTs in all MST regions and the CST.
In Figure 176, the ISTs in all MST regions plus the inter-region CST constitute the CIST of the entire
network.
Regional root bridge
The root bridge of the IST or an MSTI within an MST region is the regional root bridge of the IST or the
MSTI. Based on the topology, different spanning trees in an MST region might have different regional
roots.
As shown in Figure 176, the regional root of MSTI 1 in region D0 is device B, and that of MSTI 2 is device
C.
Common root bridge
The common root bridge is the root bridge of the CIST.
In Figure 176, for example, the common root bridge is a device in region A0.
Port roles
A port can play different roles in different MSTIs. As shown in Figure 177, an MST region has device A,
device B, device C, and device D. Port 1 and port 2 of device A are connected to the common root
bridge, port 5 and port 6 of device C form a loop, and port 3 and port 4 of device D are connected
downstream to the other MST regions.
187
Figure 177 Port roles
MSTP calculation involves the following port roles:
•
Root port—Forwards data for a non-root bridge to the root bridge. The root bridge does not have
any root port.
•
Designated port—Forwards data to the downstream network segment or device.
•
Master port—Serves as a port on the shortest path from the local MST region to the common root
bridge. The master port is not always located on the regional root. It is a root port on the IST or CIST
and still a master port on the other MSTIs.
•
Alternate port—Serves as the backup port for a root port or master port. When the root port or
master port is blocked, the alternate port takes over.
•
Backup port—Serves as the backup port of a designated port. When the designated port is invalid,
the backup port becomes the new designated port. A loop occurs when two ports of the same
spanning tree device are connected, so the device blocks one of the ports. The blocked port acts as
the backup.
•
Boundary port—Connects an MST region to another MST region or to an STP/RSTP-running device.
In MSTP calculation, a boundary port's role on an MSTI is consistent with its role on the CIST. But
that is not true with master ports. A master port on MSTIs is a root port on the CIST.
Port states
In MSTP, a port can be in one of the following states:
•
Forwarding—The port learns MAC addresses and forwards user traffic.
•
Learning—The port learns MAC addresses but does not forward user traffic.
•
Discarding—The port does not learn MAC addresses or forwards user traffic.
A port can have different port states in different MSTIs. A port state is not exclusively associated with a
port role. Table 57 lists the port states supported by each port role. (A check mark [√] indicates that the
188
port state is available for the corresponding port role, and a dash [—] indicates that the port state is not
available for the corresponding port role.)
Table 57 Ports states supported by different port roles
Port role
Port state
Root port/master
port
Designated
port
Boundary
port
Alternate port
Backup port
Forwarding
√
√
√
—
—
Learning
√
√
√
—
—
Discarding
√
√
√
√
√
How MSTP works
MSTP divides an entire Layer 2 network into multiple MST regions, which are connected by a calculated
CST. Inside an MST region, multiple spanning trees, called MSTIs, are calculated. Among these MSTIs,
MSTI 0 is the CIST.
Similar to RSTP, MSTP uses configuration BPDUs to calculate spanning trees. An important difference is
that an MSTP BPDU carries the MSTP configuration of the bridge from which the BPDU is sent.
CIST calculation
The calculation of a CIST tree is also the process of configuration BPDU comparison. During this process,
the device with the highest priority is elected as the root bridge of the CIST. MSTP generates an IST within
each MST region through calculation. At the same time, MSTP regards each MST region as a single
device and generates a CST among these MST regions through calculation. The CST and ISTs constitute
the CIST of the entire network.
MSTI calculation
Within an MST region, MSTP generates different MSTIs for different VLANs based on the
VLAN-to-instance mappings. For each spanning tree, MSTP performs a separate calculation process,
which is similar to spanning tree calculation in STP/RSTP. For more information, see "Calculation process
of the STP algorithm"
In MSTP, a VLAN packet is forwarded along the following paths:
•
Within an MST region, the packet is forwarded along the corresponding MSTI.
•
Between two MST regions, the packet is forwarded along the CST.
MSTP implementation on devices
MSTP is compatible with STP and RSTP. STP and RSTP protocol packets can be recognized by devices
running MSTP and used for spanning tree calculation.
In addition to basic MSTP functions, the device provides the following functions for ease of management:
•
Root bridge hold
•
Root bridge backup
•
Root guard
•
BPDU guard
189
•
Loop guard
•
TC-BPDU (a message that notifies the device of topology changes) guard
•
Support for the hot swapping of interface boards and switchover of the active and standby main
boards.
Protocols and standards
MSTP is documented in the following protocols and standards:
•
IEEE 802.1d, Spanning Tree Protocol
•
IEEE 802.1w, Rapid Spanning Tree Protocol
•
IEEE 802.1s, Multiple Spanning Tree Protocol
Configuration guidelines
When you configure MSTP, follow these guidelines:
•
Two or more spanning tree devices belong to the same MST region only if they are configured to
have the same MST region name, MST region level, and the same VLAN-to-instance mapping
entries in the MST region, and they are connected through a physical link.
•
If two or more devices are selected as the root bridge in a spanning tree at the same time, the device
with the lowest MAC address is chosen.
•
If BPDU guard is disabled, a port set as an edge port becomes a non-edge port again if it receives
a BPDU from another port. To restore its port role as an edge port, you must restart the port.
•
If a port directly connects to a user terminal, configure it as an edge port and enable BPDU guard
for it. This enables the port to quickly transit to the forwarding state when ensuring network security.
Recommended MSTP configuration procedure
Step
Remarks
Optional.
1.
Configuring an MST
region.
Configure the MST region-related parameters and VLAN-to-instance
mappings.
By default, the MST region-related parameters adopt the default values, and
all VLANs in an MST region are mapped to MSTI 0.
Required.
2.
Configuring MSTP globally.
Enable STP globally and configure MSTP parameters.
By default, STP is enabled globally. All MSTP parameters have default
values.
Optional.
3.
Configuring MSTP on a
port.
Enable MSTP on a port and configure MSTP parameters.
By default, MSTP is enabled on a port, and all MSTP parameters adopt the
default values.
190
Step
4.
Remarks
Displaying MSTP
information of a port.
Optional.
Display MSTP information of a port in MSTI 0, the MSTI to which the port
belongs, and the path cost and priority of the port.
Configuring an MST region
1.
From the navigation tree, select Network > MSTP.
By default, the Region tab is displayed.
Figure 178 MST region
2.
Click Modify.
Figure 179 Configuring an MST region
3.
Configure the MST region information as described in Table 58, and click Apply.
191
Table 58 Configuration items
Item
Region Name
4.
Description
MST region name.
The MST region name is the bridge MAC address of the device by default.
Revision Level
Revision level of the MST region.
Manual (Instance ID and
VLAN ID)
Manually add VLAN-to-instance mappings. Click Apply to add the
VLAN-to-instance mapping entries to the list.
Modulo
The device automatically maps 4094 VLANs to the corresponding MSTIs
based on the modulo value.
Click Activate.
Configuring MSTP globally
1.
From the navigation tree, select Network > MSTP.
2.
Click the Global tab.
192
Figure 180 Configuring MSTP globally
3.
Configure the global MSTP configuration as described in Table 59, and then click Apply.
Table 59 Configuration items
Item
Enable STP Globally
Description
Selects whether to enable STP globally.
Other MSTP configurations take effect only after you enable STP globally.
Selects whether to enable BPDU guard.
BPDU Guard
BPDU guard can protect the device from malicious BPDU attacks, making the
network topology stable.
193
Item
Description
Sets the operating mode of STP:
• STP—Each port on a device sends out STP BPDUs.
• RSTP—Each port on a device sends out RSTP BPDUs, and automatically
Mode
migrates to STP-compatible mode when detecting that it is connected with a
device running STP.
• MSTP—Each port on a device sends out MSTP BPDUs, and automatically
migrates to STP-compatible mode when detecting that it is connected with a
device running STP.
Sets the maximum number of hops in an MST region to restrict the region size.
Max Hops
Path Cost Standard
The setting can take effect only when it is configured on the regional root
bridge.
Specifies the standard for path cost calculation. It can be Legacy, IEEE
802.1D-1998, or IEEE 802.1T.
Any two stations in a switched network are interconnected through a specific
path composed of a series of devices. The bridge diameter (or the network
diameter) is the number of devices on the path composed of the most devices.
Bridge Diameter
After you set the network diameter, you cannot set the timers. Instead, the
device automatically calculates the forward delay, hello time, and max age.
When you configure the bridge diameter, follow these guidelines:
• The configured network diameter is effective on CIST only, not on MSTIs.
• The bridge diameter cannot be configured together with the timers.
Configure the timers:
• Forward Delay—Set the delay for the root and designated ports to transit to
the forwarding state.
• Hello Time—Set the interval at which the device sends hello packets to the
surrounding devices to make sure the paths are fault-free.
• Max Age—Set the maximum length of time a configuration BPDU can be
Timers
held by the device.
When you configure timers, follow these guidelines:
• The settings of hello time, forward delay and max age must meet a certain
formula. Otherwise, the network topology will not be stable. HP
recommends you to set the network diameter and then have the device
automatically calculate the forward delay, hello time, and max age.
• The bridge diameter cannot be configured together with the timers.
Sets the role of the device in the MSTI or the bridge priority of the device, which
is one of the factors deciding whether the device can be elected as the root
bridge.
Instance (Instance ID,
Root Type, and Bridge
Priority)
Role of the device in the MSTI:
• Not Set—Not set (you can set the bridge priority of the device when
selecting this role)
• Primary—Configure the device as the root bridge (you cannot set the bridge
priority of the device when selecting this role)
• Secondary—Configure the device as a secondary root bridge (you cannot
set the bridge priority of the device when selecting this role).
194
Item
Description
Selects whether to enable TC-BPDU guard.
When receiving topology change (TC) BPDUs, the device flushes its forwarding
address entries. If someone forges TC-BPDUs to attack the device, the device
will receive a large number of TC-BPDUs within a short time and frequently
flushes its forwarding address entries. This affects network stability.
tc-protection
With the TC-BPDU guard function, you can prevent frequent flushing of
forwarding address entries.
HP recommends not disabling this function.
tc-protection threshold
Sets the maximum number of immediate forwarding address entry flushes the
device can perform within a certain period of time after receiving the first
TC-BPDU.
Configuring MSTP on a port
1.
From the navigation tree, select Network > MSTP.
2.
Click the Port Setup tab.
Figure 181 MSTP configuration on a port
3.
Configure MSTP for ports as described in Table 60, and then click Apply.
Table 60 Configuration items
Item
Description
STP
Selects whether to enable STP on the port.
Sets the type of protection to be enabled on the port:
Protection
• Not Set—No protection is enabled on the port.
• Edged Port, Root Protection, Loop Protection—For more information, see Table 61.
195
Item
Description
Sets the priority and path cost of the port in the current MSTI:
• Priority—The priority of a port is an important factor in determining whether the port
Instance
(Instance ID,
Port Priority,
Auto Path
Cost, and
Manual Path
Cost)
can be elected as the root port of a device. If all other conditions are the same, the
port with the highest priority will be elected as the root port. On an MSTP-enabled
device, a port can have different priorities in different MSTIs, and the same port can
play different roles in different MSTIs, so that data of different VLANs can be
propagated along different physical paths, implementing per-VLAN load balancing.
You can set port priority values based on the actual networking requirements.
• Path cost—A parameter related to the rate of a port. On an MSTP-enabled device, a
port can have different path costs in different MSTIs. Setting appropriate path costs
allows VLAN traffic flows to be forwarded along different physical links, achieving
VLAN-based load balancing. The device can automatically calculate the default
path cost. Alternatively, you can also manually configure path cost for ports.
• Point to Point
SpecifIes whether the port is connected to a point-to-point link:
{
Advanced
Auto—Configures the device to automatically detect whether or not the link type
of the port is point-to-point.
{
Force False—The link type for the port is not point-to-point link.
{
Force True—The link type for the port is point-to-point link.
If a port is configured as connecting to a point-to-point link, the setting takes effect on the
port in all MSTIs. If the physical link to which the port connects is not a point-to-point link
and you force it to be a point-to-point link by configuration, the configuration might incur
a temporary loop.
• Transmit Limit—Configures the maximum number of MSTP packets that can be sent
during each Hello interval.
The larger the transmit limit is, the more network resources will be occupied. HP
recommends that you use the default value.
• MSTP Mode—Sets whether the port migrates to the MSTP mode.
In a switched network, if a port on an MSTP (or RSTP) device connects to a device
running STP, this port will automatically migrate to the STP-compatible mode. After
the device running STP is removed, the port on the MSTP (or RSTP) device might not
be able to migrate automatically to the MSTP (or RSTP) mode, but will remain
operating in the STP-compatible mode. You can set this option to enable the port to
automatically migrate to the MSTP (or RSTP) mode.
Select port(s)
Selects one or multiple ports on which you want to configure MSTP on the chassis front
panel. If aggregate interfaces are configured on the device, the page displays a list of
aggregate interfaces below the chassis front panel. You can select aggregate interfaces
from this list.
Table 61 Protection types
Protection type
Description
Sets the port as an edge port.
Edged Port
Some ports of access layer devices are directly connected to PCs or file servers,
which cannot generate BPDUs. You can set these ports as edge ports to achieve
fast transition for these ports.
HP recommends that you enable the BPDU guard function in conjunction with the
edged port function to avoid network topology changes when the edge ports
receive configuration BPDUs.
196
Protection type
Description
Enables the root guard function.
Root Protection
Configuration errors or attacks might result in configuration BPDUs with their
priorities higher than that of a root bridge, which causes a new root bridge to be
elected and network topology change to occur. The root guard function is used to
address such a problem.
Enables the loop guard function.
Loop Protection
By keeping receiving BPDUs from the upstream device, a device can maintain the
state of the root port and other blocked ports. These BPDUs might get lost because
of network congestion or unidirectional link failures. The device will re-elect a root
port, and blocked ports might transit to the forwarding state, causing loops in the
network. The loop guard function is used to address such a problem.
Displaying MSTP information of a port
1.
From the navigation tree, select Network > MSTP.
2.
Click the Port Summary tab.
3.
Select a port on the chassis front panel.
If you have configured aggregate interfaces on the device, the page displays a list of aggregate
interfaces below the chassis front panel. You can select aggregate interfaces from this list. The
lower part of the page displays the MSTP information of the port in MSTI 0 (when STP is enabled
globally) or the STP status and statistics (when STP is not enabled globally), the MSTI to which the
port belongs, and the path cost and priority of the port in the MSTI.
Figure 182 The port summary tab
197
Table 62 Field description
Field
Description
[FORWARDING]
The port is in forwarding state, so the port learns MAC addresses and
forwards user traffic.
[LEARNING]
The port is in learning state, so the port learns MAC addresses but does not
forward user traffic.
[DISCARDING]
The port is in discarding state, so the port does not learn MAC addresses or
forward user traffic.
[DOWN]
The port is down.
Port Protocol
Whether STP is enabled on the port.
Port Role
Role of the port, which can be Alternate, Backup, Root, Designated, Master,
or Disabled.
Port Priority
Priority of the port.
Port Cost(Legacy)
Path cost of the port. The field in the bracket indicates the standard used for
port path cost calculation, which can be legacy, dot1d-1998, or dot1t.
Config indicates the configured value, and Active indicates the actual value.
Designated bridge ID and port ID of the port.
Desg. Bridge/Port
The port ID displayed is insignificant for a port that does not support port
priority.
Whether the port is an edge port:
Port Edged
• Config—The configured value.
• Active—The actual value.
Whether the port is connected to a point-to-point link:
Point-to-point
• Config—The configured value.
• Active—The actual value.
Transmit Limit
Maximum number of packets sent within each Hello time.
Protection type on the port:
Protection Type
MST BPDU Format
Port ConfigDigest-Snooping
•
•
•
•
Root—Root guard.
Loop—Loop guard.
BPDU—BPDU guard.
None—No protection.
Format of the MST BPDUs that the port can send, which can be legacy or
802.1s. Config indicates the configured value, and Active indicates the
actual value.
Whether digest snooping is enabled on the port.
Rapid transition
Whether the current port rapidly transits to the forwarding state.
Num of Vlans Mapped
Number of VLANs mapped to the current MSTI.
198
Field
Description
Major parameters for the port:
PortTimes
•
•
•
•
•
Hello—Hello timer.
MaxAge—Max Age timer.
FWDly—Forward delay timer.
MsgAge—Message Age timer.
Remain Hop—Remaining hops.
BPDU Sent
Statistics on sent BPDUs.
BPDU Received
Statistics on received BPDUs.
Protocol Status
Whether MSTP is enabled.
Protocol Std.
MSTP standard.
Version
MSTP version.
CIST Bridge-Prio.
Priority of the current device in the CIST.
MAC address
MAC address of the current device.
Max age(s)
Maximum age of a configuration BPDU.
Forward delay(s)
Port state transition delay, in seconds.
Hello time(s)
Configuration BPDU transmission interval, in seconds.
Max hops
Maximum hops of the current MST region.
MSTP configuration example
Network requirements
As shown in Figure 183, configure MSTP as follows:
•
All devices on the network are in the same MST region.
•
Packets of VLAN 10, VLAN 20, VLAN 30, and VLAN 40 are forwarded along MSTI 1, MSTI 2,
MSTI 3, and MSTI 0, respectively.
•
Switch A and Switch B operate at the distribution layer. Switch C and Switch D operate at the access
layer. VLAN 10 and VLAN 20 are terminated on the distribution layer devices, and VLAN 30 is
terminated on the access layer devices, so the root bridges of MSTI 1 and MSTI 2 are Switch A and
Switch B, respectively, and the root bridge of MSTI 3 is Switch C.
199
Figure 183 Network diagram
Switch A
Switch B
Permit: all VLAN
Permit:
VLAN 10, 40
Permit:
VLAN 20, 40
Permit:
VLAN 10, 40
Permit:
VLAN 20, 40
Permit: VLAN 30, 40
Switch C
Switch D
"Permit:" next to a link in the figure is followed by the VLANs the packets of which are permitted to pass
this link.
Configuration procedure
Configuring Switch A
1.
Configure an MST region:
a. From the navigation tree, select Network > MSTP.
By default, the Region tab is displayed.
b. Click Modify.
Figure 184 The region tab
c. Set the region name to example.
d. Set the revision level to 0.
e. Select Manual.
f. Select 1 from the Instance ID list.
g. Set the VLAN ID to 10.
h. Click Apply.
The system maps VLAN 10 to MSTI 1 and adds the VLAN-to-instance mapping entry to the
VLAN-to-instance mapping list.
i.
Repeat the preceding three steps to map VLAN 20 to MSTI 2 and VLAN 30 to MSTI 3 and add
the VLAN-to-instance mapping entries to the VLAN-to-instance mapping list.
200
j.
Click Activate.
Figure 185 Configuring an MST region
2.
Configure MSTP globally:
a. From the navigation tree, select Network > MSTP.
b. Click the Global tab.
c. Select Enable from the Enable STP Globally list.
d. Select MSTP from the Mode list.
e. Select the box before Instance.
f. Set the Instance ID field to 1.
g. Set the Root Type field to Primary.
h. Click Apply.
201
Figure 186 Configuring MSTP globally (on Switch A)
Configuring Switch B
1.
Configure an MST region on the switch in the same way the MST region is configured on Switch
A.
2.
Configure MSTP globally:
a. From the navigation tree, select Network > MSTP.
b. Click the Global tab.
c. Select Enable from the Enable STP Globally list.
d. Select MSTP from the Mode list.
e. Select the box before Instance.
f. Set the Instance ID field to 2.
g. Set the Root Type field to Primary.
h. Click Apply.
202
Configuring Switch C
1.
Configure an MST region on the switch in the same way the MST region is configured on Switch
A.
2.
Configure MSTP globally:
a. From the navigation tree, select Network > MSTP.
b. Click Global.
c. Select Enable from the Enable STP Globally list.
d. Select MSTP from the Mode list.
e. Select the box before Instance.
f. Set the Instance ID field to 3.
g. Set the Root Type field to Primary.
h. Click Apply.
Configuring Switch D
1.
Configure an MST region on the switch in the same way the MST region is configured on Switch
A.
2.
Configure MSTP globally:
a. From the navigation tree, select Network > MSTP.
b. Click Global.
c. Select Enable from the Enable STP Globally list.
d. Select MSTP from the Mode list.
e. Click Apply.
203
Figure 187 Configuring MSTP globally (on Switch D)
204
Configuring link aggregation and LACP
Overview
Ethernet link aggregation bundles multiple physical Ethernet links into one logical link, called an
aggregate link. Link aggregation has the following benefits:
•
Increased bandwidth beyond the limits of any single link. In an aggregate link, traffic is distributed
across the member ports.
•
Improved link reliability. The member ports dynamically back up one another. When a member
port fails, its traffic is automatically switched to other member ports.
Basic concepts
Aggregate interface
An aggregate interface is a logical interface.
Aggregation group
An aggregation group is a collection of Ethernet interfaces. When you create an aggregate interface,
the switch automatically creates an aggregation group of the same number as the aggregate interface.
Aggregation states of the member ports in an aggregation group
A member port in an aggregation group can be in either of the following states:
•
Selected—A Selected port can forward user traffic.
•
Unselected—An Unselected port cannot forward user traffic.
The port rate of an aggregate interface equals the total rate of its member ports in Selected state, and its
duplex mode is the same as that of the selected member ports.
For more information about the states of member ports in an aggregation group, see "Static aggregation
mode" and "Dynamic aggregation mode."
LACP
The Link Aggregation Control Protocol (LACP) is defined in IEEE 802.3ad. It uses LACPDUs to exchange
aggregation information between LACP-enabled devices.
LACP is automatically enabled on member ports in a dynamic aggregation group. An LACP-enabled
port sends LACPDUs to notify the remote system (the partner) of its system LACP priority, system MAC
address, LACP port priority, port number, and operational key. Upon receiving an LACPDU, the peer port
compares the received information with the information received on other member ports. In this way, the
two systems reach an agreement on which ports are placed in Selected state.
Operational key
When aggregating ports, link aggregation control automatically assigns each port an operational key
based on port attributes, including the port rate, duplex mode, and link state configuration.
In an aggregation group, all Selected ports are assigned the same operational key.
205
Configuration classes
Port configurations include the following classes:
•
Class-two configurations—A member port can be placed in the Selected state only if it has the
same class-two configurations as the aggregate interface.
Table 63 Class-two configurations
•
Type
Considerations
Port isolation
Whether a port has joined an isolation group, and the isolation group to which
the port belongs.
VLAN
Permitted VLAN IDs, port VLAN ID (PVID), link type (trunk, hybrid, or access), IP
subnet-based VLAN configuration, protocol-based VLAN configuration, and
VLAN tagging mode.
MAC address
learning
MAC address learning capability, MAC address learning limit, and forwarding
of frames with unknown destination MAC addresses after the upper limit of the
MAC address table is reached.
Class-one configurations—Include settings that do not affect the aggregation state of the member
port even if they are different from those on the aggregate interface. For example, MSTP, can be
configured on aggregate interfaces and member ports. However, class-one configurations do not
take effect in operational key calculation.
Any class-two configuration change might affect the aggregation state of link aggregation member ports
and running services. To make sure you are aware of the risk, the system displays a warning message
every time you attempt to change a class-two configuration setting on a member port.
Link aggregation modes
Based on the link aggregation procedure, link aggregation operates in one of the following modes:
•
Static aggregation mode
•
Dynamic aggregation mode
Static aggregation mode
LACP is disabled on the member ports in a static aggregation group. In a static aggregation group, the
system sets the aggregation state of each member port according to the following rules:
1.
Chooses a reference port from the member ports that are in up state and with the same class-two
configurations as the aggregate interface. The candidate ports are sorted in the following order:
{
Full duplex/high speed
{
Full duplex/low speed
{
Half duplex/high speed
{
Half duplex/low speed
If two ports have the same duplex mode/speed pair, the one with the lower port number is chosen.
2.
Places the ports in up state with the same port attributes and class-two configurations as the
reference port in the Selected state, and place all others in the Unselected state.
3.
The number of Selected ports is limited in a static aggregation group. When the number of the
Selected ports is under the limit, all the member ports become Selected ports. When the limit is
206
exceeded, places the ports with smaller port numbers in the Selected state and those with greater
port numbers in the Unselected state.
4.
Places the member ports in the Unselected state if all the member ports are down.
5.
Places the ports that cannot aggregate with the reference port in the Unselected state, for example,
as a result of the inter-board aggregation restriction.
After a static aggregation group has reached the limit on Selected ports, any port that joins the group is
placed in the Unselected state to avoid traffic interruption on the existing Selected ports. However, the
state of link aggregation member ports might change after a reboot.
Dynamic aggregation mode
LACP is enabled on member ports in a dynamic aggregation group.
In a dynamic aggregation group, a Selected port can receive and send LACPDUs. An Unselected port
can receive and send LACPDUs only when it is up, and has the same configurations as the aggregate
interface.
In a dynamic aggregation group, the local system (the actor) negotiates with the remote system (the
partner) to determine the aggregation state of each port in the following steps:
1.
The systems compare the system IDs. (A system ID contains the system LACP priority and the system
MAC address). The lower the LACP priority, the smaller the system ID. If LACP priority values are
the same, the two systems compare their system MAC addresses. The lower the MAC address, the
smaller the system ID.
2.
The system with the smaller system ID chooses the port with the smallest port ID as the reference
port. (A port ID contains a port priority and a port number.) The port with the lower priority value
is chosen. If two ports have the same aggregation priority, the system compares their port numbers.
The port with the smaller port number becomes the reference port.
3.
If a port in up state is with the same port attributes and class-two configuration as the reference port,
and the peer port of the port is with the same port attributes and class-two configurations as the
peer port of the reference port, consider the port as a candidate selected port. Otherwise, the port
is placed in the Unselected state.
The number of Selected ports in an aggregation group is limited. When the number of Selected ports is
under the limit, all the member ports are set to Selected state. When the limit is exceeded, the system sets
the ports with smaller port IDs as the Selected ports, and place other ports in the Unselected state. At the
same time, the peer device, being aware of the changes, sets the aggregation state of local member
ports the same as their peer ports.
The system places the ports that cannot aggregate with the reference port in the Unselected state, for
example, as the result of the inter-board aggregation restriction.
When you configure static and dynamic aggregation modes, follow these guidelines:
•
In an aggregation group, a Selected port must have the same port attributes and class-two
configurations as the reference port. To keep these configurations consistent, you should configure
the port manually.
•
Any port attribute or class-two configuration change might affect the aggregation state of all
member ports and ongoing traffic. If you need to make this change, make sure you understand its
impact on the live network.
207
Configuration procedures
Configuring a static aggregation group
Step
Remarks
Creating a link aggregation group.
1.
Create a static aggregate interface and configure member
ports for the static aggregation group.
By default, no link aggregation group exists.
(Optional.) Displaying aggregate
interface information.
2.
Display detailed information of an existing aggregation
group.
Configuring a dynamic aggregation group
Step
Remarks
1.
Create a dynamic aggregate interface and configure member ports for the
dynamic aggregation group automatically created. LACP is enabled
automatically on all the member ports.
Creating a link
aggregation group.
By default, no link aggregation group exists.
2.
3.
4.
(Optional.) Displaying
aggregate interface
information.
(Optional.) Setting
LACP priority.
(Optional.) Displaying
LACP-enabled port
information.
Display detailed information of an existing aggregation group.
Set LACP priority for the local system and link aggregation member ports.
Changes of LACP priorities affect the aggregation state of the member ports.
The default port LACP priority and system LACP priority are both 32768.
Display detailed information of LACP-enabled ports and the corresponding
remote (partner) ports.
Creating a link aggregation group
1.
From the navigation tree, select Network > Link Aggregation.
2.
Click Create.
208
Figure 188 Creating a link aggregation group
3.
Configure a link aggregation group as described in Table 64.
4.
Click Apply.
Table 64 Configuration items
Item
Description
Enter Link Aggregation
Interface ID
Assign an ID to the link aggregation group to be created.
You can view the result in the Summary area at the bottom of the page.
Set the type of the link aggregation interface to be created:
Specify Interface Type
Select port(s) for the link
aggregation interface
• Static—LACP is disabled.
• Dynamic—LACP is enabled.
Select one or multiple ports to be assigned to the link aggregation group from
the chassis front panel.
You can view the result in the Summary area at the bottom of the page.
Displaying aggregate interface information
1.
From the navigation tree, select Network > Link Aggregation.
The default Summary tab appears. The list on the upper part of the page displays information
about all the aggregate interfaces.
209
2.
Choose an aggregate interface from the list.
The list on the lower part of the page displays the detailed information about the member ports of
the link aggregation group.
Figure 189 Displaying information of an aggregate interface
Table 65 Field description
Field
Aggregation interface
Description
Type and ID of the aggregate interface.
Bridge-Aggregation indicates a Layer 2 aggregate interface.
Link Type
Type of the aggregate interface: static or dynamic.
Partner ID
ID of the remote device, including its LACP priority and MAC address.
Selected Ports
Number of Selected ports in each link aggregation group (Only Selected ports
can send and receive user data).
Standby Ports
Number of Unselected ports in each link aggregation group (Unselected ports
cannot send or receive user data).
Member Port
A member port of the link aggregation group corresponding to the target
aggregate interface.
State
Aggregation state of a member port: Selected or Unselected.
Reason for being Unselected
Reason why the state of a member port is Unselected. For a Selected port, this
field displays a hyphen (-).
210
Setting LACP priority
1.
From the navigation tree, select Network > LACP.
2.
Click Setup.
3.
In the Set LACP enabled port(s) parameters area, set the port priority, and select the ports in the
chassis front panel.
4.
Click Apply in the area.
Figure 190 Setting the LACP priority
Table 66 Configuration items
Item
Description
Port Priority
Set a port LACP priority.
Select port(s) to
apply Port Priority
Choose the ports where the port LACP priority you set will apply on the chassis front panel.
You can set LACP priority on both LACP-enabled ports and LACP-disabled ports.
5.
In the Set global LACP parameters area, set the system priority.
6.
Click Apply in the area.
Displaying LACP-enabled port information
1.
From the navigation tree, select Network > LACP.
The default Summary tab appears. The upper part of the page displays a list of all LACP-enabled
ports on the device and information about them. Table 67 describes the fields.
2.
Select a port on the port list.
3.
Click View Details.
211
Detailed information about the peer port appears on the lower part of the page. Table 68
describes the fields.
Figure 191 Displaying the information of LACP-enabled ports
Table 67 Field description
Field
Description
Unit
ID of a device in a stack.
Port
Port where LACP is enabled.
LACP State
State of LACP on the port.
Port Priority
LACP priority of the port.
State
Aggregation state of the port. If a port is Selected, this field also displays the ID
of the aggregation group it belongs to.
Inactive Reason
Reason code indicating why a port is Unselected for receiving or sending user
data. For more information about the reason codes, see the bottom of the page
shown in Figure 191.
212
Field
Description
Partner Port
ID of the peer port.
States of the peer port:
•
•
•
•
•
•
•
•
Partner Port State
Oper Key
A—LACP is enabled.
B—LACP short timeout. If B does not appear, it indicates LACP long timeout.
C—The sending system considers the link is aggregatable.
D—The sending system considers the link is synchronized.
E—The sending system considers the incoming frames are collected.
F—The sending system considers the outgoing frames are distributed.
G—The sending system receives frames in the default state.
H—The sending system receives frames in the expired state.
Operational key of the local port.
Table 68 Field description
Field
Description
Unit
Number of the remote system.
Port
Name of the remote port.
Partner ID
LACP priority and MAC address of the remote system.
Partner Port Priority
LACP priority of the remote port.
Partner Oper Key
Operational key of the remote port.
Link aggregation and LACP configuration example
Network requirements
As shown in Figure 192, create a link aggregation group on Switch A and Switch B to load-share
incoming and outgoing traffic across the member ports.
GE1/0/1
GE1/0/2
GE1/0/3
GE1/0/1
GE1/0/2
GE1/0/3
Figure 192 Network diagram
Method 1: Create static link aggregation group 1
1.
From the navigation tree, select Network > Link Aggregation.
2.
Click Create.
3.
Configure static link aggregation group 1:
213
a. Enter link aggregation interface ID 1.
b. Select Static (LACP Disabled) for the aggregate interface type.
c. Select GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 on the
chassis front panel.
4.
Click Apply.
Figure 193 Creating static link aggregation group 1
Method 2: Create dynamic link aggregation group 1
1.
From the navigation tree, select Network > Link Aggregation.
2.
Click Create.
3.
Configure dynamic aggregation group 1:
a. Enter link aggregation interface ID 1.
b. Select Dynamic (LACP Enabled) for aggregate interface type.
c. Select GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 on the
chassis front panel.
4.
Click Apply.
214
Figure 194 Creating dynamic link aggregation group 1
Configuration guidelines
When you configure a link aggregation group, follow these guidelines:
•
In an aggregation group, a Selected port must have the same port attributes and class-two
configurations as the reference port. To keep these configurations consistent, you should configure
the port manually.
•
Choose a reference port from the member ports that are in up state and with the same class-two
configurations as the aggregate interface. The candidate ports are sorted in the following order:
{
Full duplex/high speed
{
Full duplex/low speed
{
Half duplex/high speed
{
half duplex/low speed
If two ports have the same duplex mode/speed pair, the one with the lower port number is chosen.
•
Port attribute configuration includes the configuration of the port rate, duplex mode, and link state.
For more information about class-two configurations, see "Configuration classes."
•
To guarantee a successful static aggregation, make sure the ports at the two ends of each link to be
aggregated are in the same aggregation state. To guarantee a successful dynamic aggregation,
make sure the peer ports of the ports aggregated at one end are also aggregated. The two ends
can automatically negotiate the aggregation state of each member port.
215
•
Do not assign the following types of ports to Layer 2 aggregate groups:
{
MAC address authentication-enabled ports.
{
port security-enabled ports.
{
packet filtering-enabled ports.
{
Ethernet frame filtering-enabled ports.
{
IP source guard-enabled ports.
{
802.1X-enabled ports.
•
Deleting a Layer 2 aggregate interface also deletes its aggregation group and causes all member
ports to leave the aggregation group.
•
When a load sharing aggregation group becomes non-load-sharing because of insufficient load
sharing resources, one of the following problems might occur:
{
{
The number of Selected ports of the actor is inconsistent with that of the partner, which might
result in incorrect traffic forwarding
The peer port of a Selected port is Unselected, which might result anomalies in upper-layer
protocol and traffic forwarding.
216
Configuring LLDP
Overview
In a heterogeneous network, a standard configuration exchange platform makes sure different types of
network devices from different vendors can discover one another and exchange configuration.
The Link Layer Discovery Protocol (LLDP) is specified in IEEE 802.1AB. The protocol operates on the data
link layer to exchange device information between directly connected devices. With LLDP, a device sends
local device information as TLV (type, length, and value) triplets in LLDP Data Units (LLDPDUs) to the
directly connected devices. Local device information includes its system capabilities, management IP
address, device ID, port ID, and so on. The device stores the device information in LLDPDUs from the LLDP
neighbors in a standard MIB. LLDP enables a network management system to quickly detect and identify
Layer 2 network topology changes.
For more information about MIBs, see "Configuring SNMP."
Basic concepts
LLDP frame formats
LLDP sends device information in LLDP frames. LLDP frames are encapsulated in Ethernet II or SNAP
frames.
•
LLDP frames encapsulated in Ethernet II
Figure 195 LLDP frame encapsulated in Ethernet II
Table 69 Fields in an Ethernet II encapsulated LLDP frame
Field
Description
Destination MAC address
MAC address to which the LLDP frame is advertised. It is fixed to
0x0180-C200-000E, a multicast MAC address.
Source MAC address
MAC address of the sending port.
Type
Ethernet type for the upper layer protocol. It is 0x88CC for LLDP.
217
•
Field
Description
Data
LLDPDU.
FCS
Frame check sequence, a 32-bit CRC value used to determine the
validity of the received Ethernet frame.
LLDP frames encapsulated in SNAP
Figure 196 LLDP frame encapsulated in SNAP
Table 70 Fields in a SNAP-encapsulated LLDP frame
Field
Description
Destination MAC address
MAC address to which the LLDP frame is advertised. It is fixed to
0x0180-C200-000E, a multicast MAC address.
Source MAC address
MAC address of the sending port. If the port does not have a MAC
address, the MAC address of the sending bridge is used.
Type
SNAP type for the upper layer protocol. It is
0xAAAA-0300-0000-88CC for LLDP.
Data
LLDPDU.
FCS
Frame check sequence, a 32-bit CRC value used to determine the
validity of the received Ethernet frame.
LLDPDUs
LLDP uses LLDPDUs to exchange information. An LLDPDU comprises multiple TLVs. Each TLV carries a type
of device information, as shown in Figure 197.
Figure 197 LLDPDU encapsulation format
An LLDPDU can carry up to 28 types of TLVs. Mandatory TLVs include Chassis ID TLV, Port ID TLV, Time
to Live TLV, and End of LLDPDU TLV. Other TLVs are optional.
TLVs
A TLV is an information element that contains the type, length, and value fields.
LLDPDU TLVs include the following categories:
218
•
Basic management TLVs
•
Organizationally (IEEE 802.1 and IEEE 802.3) specific TLVs
•
LLDP-MED (media endpoint discovery) TLVs
Basic management TLVs are essential to device management.
Organizationally specific TLVs and LLDP-MED TLVs are used for improved device management. They are
defined by standardization or other organizations and are optional to LLDPDUs.
•
Basic management TLVs
Table 71 lists the basic management TLV types. Some of them are mandatory for LLDPDUs.
Table 71 Basic management TLVs
Type
Description
Chassis ID
Specifies the bridge MAC address of the sending device.
Remarks
Specifies the ID of the sending port.
• If the LLDPDU carries LLDP-MED TLVs, the port ID TLV
Port ID
carries the MAC address of the sending port or the
bridge MAC in case the port does not have a MAC
address.
Mandatory.
• Otherwise, the port ID TLV carries the port name.
Time to Live
Specifies the life of the transmitted information on the
receiving device.
End of LLDPDU
Marks the end of the TLV sequence in the LLDPDU.
Port Description
Specifies the port description of the sending port.
System Name
Specifies the assigned name of the sending device.
System Description
Specifies the description of the sending device.
System Capabilities
Identifies the primary functions of the sending device and
the enabled primary functions.
Optional.
Specifies the following elements:
Management Address
• The management address used to reach higher level
entities to assist discovery by network management.
• The interface number and OID associated with the
address.
•
IEEE 802.1 organizationally specific TLVs
Table 72 IEEE 802.1 organizationally specific TLVs
Type
Description
Port VLAN ID
Specifies the port's VLAN identifier (PVID). An LLDPDU carries only
one TLV of this type.
Port And Protocol VLAN ID
Indicates whether the device supports protocol VLANs and, if so,
what VLAN IDs these protocols will be associated with. An LLDPDU
can carry multiple different TLVs of this type.
VLAN Name
Specifies the textual name of any VLAN to which the port belongs.
An LLDPDU can carry multiple different TLVs of this type.
219
Type
Description
Protocol Identity
Indicates protocols supported on the port. An LLDPDU can carry
multiple different TLVs of this type.
DCBX
Data center bridging exchange protocol.
NOTE:
HP devices support only receiving protocol identity TLVs.
•
IEEE 802.3 organizationally specific TLVs
Table 73 IEEE 802.3 organizationally specific TLVs
Type
Description
MAC/PHY
Configuration/Status
Contains the rate and duplex capabilities of the sending port, support for
autonegotiation, enabling status of auto negotiation, and the current rate
and duplex mode.
Contains the power supply capability of the port:
Power Via MDI
•
•
•
•
•
Port class (PSE or PD).
Power supply mode.
Whether PSE power supply is supported.
Whether PSE power supply is enabled.
Whether pair selection can be controllable.
Link Aggregation
Indicates the support of the port for link aggregation, the aggregation
capability of the port, and the aggregation status (or whether the link is in an
aggregation).
Maximum Frame Size
Indicates the supported maximum frame size. It is now the MTU of the port.
Indicates the power state control configured on the sending port, including
the following:
Power Stateful Control
• Power supply mode of the PSE/PD.
• PSE/PD priority.
• PSE/PD power.
The power stateful control TLV is defined in IEEE P802.3at D1.0. The later versions no longer
support this TLV. HP devices send this type of TLVs only after receiving them.
•
LLDP-MED TLVs
LLDP-MED TLVs provide multiple advanced applications for VoIP, such as basic configuration,
network policy configuration, and address and directory management. LLDP-MED TLVs provide a
cost-effective and easy-to-use solution for deploying voice devices in Ethernet. LLDP-MED TLVs are
shown in Table 74.
Table 74 LLDP-MED TLVs
Type
Description
LLDP-MED Capabilities
Allows a network device to advertise the LLDP-MED TLVs that it supports.
Network Policy
Allows a network device or terminal device to advertise the VLAN ID of the
specific port, the VLAN type, and the Layer 2 and Layer 3 priorities for specific
applications.
220
Type
Description
Extended
Power-via-MDI
Allows a network device or terminal device to advertise power supply
capability. This TLV is an extension of the Power Via MDI TLV.
Hardware Revision
Allows a terminal device to advertise its hardware version.
Firmware Revision
Allows a terminal device to advertise its firmware version.
Software Revision
Allows a terminal device to advertise its software version.
Serial Number
Allows a terminal device to advertise its serial number.
Manufacturer Name
Allows a terminal device to advertise its vendor name.
Model Name
Allows a terminal device to advertise its model name.
Asset ID
Allows a terminal device to advertise its asset ID. The typical case is that the
user specifies the asset ID for the endpoint to facilitate directory management
and asset tracking.
Location Identification
Allows a network device to advertise the appropriate location identifier
information for a terminal device to use in the context of location-based
applications.
For more information about LLDPDU TLVs, see the IEEE standard (LLDP) 802.1AB-2005 and the
LLDP-MED standard (ANSI/TIA-1057).
Management address
The network management system uses the management address of a device to identify and manage the
device for topology maintenance and network management. The management address is encapsulated
in the management address TLV.
LLDP operating modes
LLDP can operate in one of the following modes:
•
TxRx mode—A port in this mode can send and receive LLDP frames.
•
Tx mode—A port in this mode can only send LLDP frames.
•
Rx mode—A port in this mode can only receive LLDP frames.
•
Disable mode—A port in this mode cannot send or receive LLDP frames.
Each time the LLDP operating mode of a port changes, its LLDP protocol state machine reinitializes. A
configurable reinitialization delay prevents frequent initializations caused by frequent changes to the
operating mode. If you configure the reinitialization delay, a port must wait the specified amount of time
to initialize LLDP after the LLDP operating mode changes.
Working mechanism
Transmitting LLDP frames
An LLDP-enabled port operating in TxRx mode or Tx mode sends LLDP frames to its directly connected
devices both periodically and when the local configuration changes. To prevent LLDP frames from
overwhelming the network during times of frequent changes to local device information, an interval is
introduced between two successive LLDP frames.
This interval is shortened to 1 second in either of the following cases:
221
•
A new neighbor is discovered. A new LLDP frame is received carrying device information new to the
local device.
•
The LLDP operating mode of the port changes from Disable or Rx to TxRx or Tx.
This is the fast sending mechanism of LLDP. With this mechanism, the specified number of LLDP frames is
sent successively at the 1-second interval. The mechanism helps LLDP neighbors discover the local device
as soon as possible. Then, the normal LLDP frame transmission interval resumes.
Receiving LLDP frames
An LLDP-enabled port operating in TxRx mode or Rx mode confirms the validity of TLVs carried in every
received LLDP frame. If the TLVs are valid, the information is saved and an aging timer is set. When the
TTL value in the Time to Live TLV carried in the LLDP frame becomes zero, the information ages out
immediately.
Protocols and standards
•
IEEE 802.1AB-2005, Station and Media Access Control Connectivity Discovery
•
ANSI/TIA-1057, Link Layer Discovery Protocol for Media Endpoint Devices
Recommended LLDP configuration procedure
Step
Remarks
Optional.
1.
Enabling LLDP on ports.
By default, LLDP is enabled on ports.
Make sure LLDP is also enabled globally, because LLDP can work on a port
only when it is enabled both globally and on the port.
Optional.
LLDP settings include LLDP operating mode, packet encapsulation, CDP
compatibility, device information polling, trapping, and advertisable TLVs.
2.
3.
Setting LLDP parameters
on ports.
Configuring LLDP
globally.
By default:
•
•
•
•
•
The LLDP operating mode is TxRx.
The encapsulation format is Ethernet II.
CDP compatibility is disabled.
Device information polling and trapping are disabled.
All TLVs except the Location Identification TLV are advertised.
Required.
By default, global LLDP is disabled.
To enable LLDP to work on a port, enable LLDP both globally and on the port.
Optional.
4.
Displaying LLDP
information for a port.
You can display the local LLDP information, neighbor information, statistics,
and status information of a port, where:
• The local LLDP information refers to the TLVs to be advertised by the local
device to neighbors.
• The neighbor information refers to the TLVs received from neighbors.
222
Step
5.
6.
Remarks
Displaying global LLDP
information.
Displaying LLDP
information received
from LLDP neighbors.
Optional.
You can display the local global LLDP information and statistics.
Optional.
You can display the LLDP information received from LLDP neighbors.
Enabling LLDP on ports
1.
From the navigation tree, select Network > LLDP.
By default, the Port Setup tab is displayed. This tab displays the enabling status and operating
mode of LLDP on a port.
2.
Select one or more ports and click Enable.
To disable LLDP on a port, select the port and click Disable.
Figure 198 The port setup tab
223
Setting LLDP parameters on ports
The Web interface allows you to set LLDP parameters for a single port or for multiple ports in batch.
Setting LLDP parameters for a single port
1.
From the navigation tree, select Network > LLDP.
By default, the Port Setup tab is displayed.
2.
Click the
icon for the port.
On the page as shown in Figure 199, the LLDP settings of the port are displayed.
Figure 199 Modifying LLDP settings on a port
3.
Configure the LLDP parameters for the port as described in Table 75.
4.
Click Apply.
A progress dialog box appears.
5.
Click Close on the progress dialog box when the progress dialog box prompts that the
configuration succeeds.
Table 75 Configuration items
Item
Description
Interface Name
Displays the name of the port or ports you are configuring.
Displays the LLDP enabling status on the port you are configuring.
DLDP State
This field is not available when you batch-configure ports.
Set the LLDP operating mode on the port or ports you are
configuring:
Basic
Settings
LLDP Operating Mode
•
•
•
•
TxRx—Sends and receives LLDP frames.
Tx—Sends but does not receive LLDP frames.
Rx—Receives but not does not send LLDP frames.
Disable—Neither sends nor receives LLDP frames.
224
Item
Description
Set the encapsulation for LLDP frames:
• ETHII—Encapsulates outgoing LLDP frames in Ethernet II frames
Encapsulation Format
and processes an incoming LLDP frame only if its encapsulation
is Ethernet II.
• SNAP—Encapsulates outgoing LLDP frames in Ethernet II frames
and processes an incoming LLDP frame only if its encapsulation
is Ethernet II.
LLDP-CDP PDUs use only SNAP encapsulation.
Set the CDP compatibility of LLDP:
CDP Operating Mode
• Disable—Neither sends nor receives CDP frames.
• TxRx—Sends and receives CDP frames
To enable LLDP to be compatible with CDP on the port, you must
enable CDP compatibility on the Global Setup tab and set the CDP
operating mode on the port to TxRx.
Enable LLDP polling and set the polling interval.
If no polling interval is set, LLDP polling is disabled.
LLDP Polling Interval
With the polling mechanism, LLDP periodically detects local
configuration changes. If a configuration change is detected, an
LLDP frame is sent to inform the LLDP neighbors of the change.
Set the enable status of the LLDP trapping function on the port or
ports.
LLDP Trapping
LLDP trapping is used to report to the network management station
critical events such as new neighbor devices detected and link
failures.
To avoid excessive traps from being sent when topology is instable,
tune the minimum trap transmission interval on the Global Setup tab.
Base TLV
Settings
Port Description
Select the box to include the port description TLV in transmitted LLDP
frames.
System Capabilities
Select the box to include the system capabilities TLV in transmitted
LLDP frames.
System Description
Select the box to include the system description TLV in transmitted
LLDP frames.
System Name
Select the box to include the system name TLV in transmitted LLDP
frames.
Management Address
Select the box to include the management address TLV in
transmitted LLDP frames and, in addition, set the management
address and its format (a numeric or character string in the TLV).
If no management address is specified, the main IP address of the
lowest VLAN carried on the port is used. If no main IP address is
assigned to the VLAN, 127.0.0.1 is used.
225
Item
DOT1
TLV
Setting
Description
Port VLAN ID
Select the box to include the PVID TLV in transmitted LLDP frames.
Protocol VLAN ID
Select the box to include port and protocol VLAN ID TLVs in
transmitted LLDP frames and specify the VLAN IDs to be advertised.
If no VLAN is specified, the lowest protocol VLAN ID is transmitted.
VLAN Name
DOT3
TLV
Setting
MED TLV
Setting
Select the box to include VLAN name TLVs in transmitted LLDP
frames, and specify the VLAN IDs to be advertised.
If no VLAN is specified, the lowest VLAN carried on the port is
advertised.
Link Aggregation
Select the box to include the link aggregation TLV in transmitted
LLDP frames.
MAC/PHY
Configuration/Status
Select the box to include the MAC/PHY configuration/status TLV in
transmitted LLDP frames.
Maximum Frame Size
Select the box to include the maximum frame size TLV in transmitted
LLDP frames.
Power via MDI
Select the box to include the power via MDI TLV and power stateful
control TLV in transmitted LLDP frames.
LLDP-MED
Capabilities
Select the box to include the LLDP-MED capabilities TLV in
transmitted LLDP frames.
Inventory
Select the box to include the hardware revision TLV, firmware
revision TLV, software revision TLV, serial number TLV,
manufacturer name TLV, model name TLV and asset ID TLV in
transmitted LLDP frames.
Network Policy
Select the box to include the network policy TLV in transmitted LLDP
frames.
Extended
Power-via-MDI
Capability
Select the box to include the extended power-via-MDI TLV in
transmitted LLDP frames.
Emergency Number
Select the box to encode the emergency call number in the location
identification TLV in transmitted LLDP frames and set the emergency
call number.
Address
Network Device
Address
Select Address to encode the civic address information of the
network connectivity device in the location identification TLV in
transmitted LLDP frames. In addition, set the device type (DHCP
server, switch, or LLDP-MED endpoint), country code, and network
device address.
When you configure the network device address, select the address
information type from the list, enter the address information in the
field below, and click Add next to the field to add the information to
the address information list below. To remove an address
information entry, select the entry from the list, and click Delete. The
civic address information can include language, province/state,
country, city, street, house number, name, postal/zip code, room
number, post office box, and, if necessary, additional information.
226
Setting LLDP parameters for ports in batch
1.
From the navigation tree, select Network > LLDP.
By default, the Port Setup tab is displayed.
2.
Select one or multiple ports on the port list.
3.
Click Modify Selected to enter the page for modifying these ports in batch.
Figure 200 Modifying LLDP settings on ports in batch
4.
Set the LLDP settings for these ports as described in Table 75.
5.
Click Apply.
A progress dialog box appears.
6.
Click Close on the progress dialog box when the progress dialog box prompts that the
configuration succeeds.
Configuring LLDP globally
1.
From the navigation tree, select Network > LLDP.
2.
Click the Global Setup tab.
227
Figure 201 The global setup tab
3.
Set the global LLDP setup as described in Table 76.
4.
Click Apply.
A progress dialog box appears.
5.
Click Close on the progress dialog box when the progress dialog box prompts that the
configuration succeeds.
Table 76 Configuration items
Item
Description
LLDP Enable
Select from the list to enable or disable global LLDP.
Select from the list to enable or disable CDP compatibility of LLDP.
When you configure CDP compatibility, follow these guidelines:
• To enable LLDP to be compatible with CDP on a port, you must set the CDP
CDP Compatibility
operating mode on the port to TxRx and enable CDP compatibility on the
Global Setup tab.
• Because the maximum TTL allowed by CDP is 255 seconds, you must make
sure the product of the TTL multiplier and the LLDP frame transmission
interval is less than 255 seconds for CDP-compatible LLDP to work correctly
with Cisco IP phones.
Fast LLDPDU Count
Set the number of LLDP frames sent each time fast LLDP frame transmission is
triggered.
228
Item
Description
Set the TTL multiplier.
The TTL TLV carried in an LLDPDU determines how long the device information
carried in the LLDPDU can be saved on a recipient device. You can configure
the TTL of locally sent LLDPDUs to determine how long information about the
local device can be saved on a neighbor device by setting the TTL multiplier.
The TTL is expressed as TTL multiplier × LLDP frame transmission interval.
TTL Multiplier
When you configure the TTL multiplier, follow these guidelines:
• If the product of the TTL multiplier and the LLDP frame transmission interval
is greater than 65535, the TTL carried in transmitted LLDP frames takes
65535 seconds.
• Because the maximum TTL allowed by CDP is 255 seconds, you must make
sure the product of the TTL multiplier and the LLDP frame transmission
interval is less than 255 seconds for CDP-compatible LLDP to work correctly
with Cisco IP phones.
Set the minimum interval for sending traps.
Trap Interval
With the LLDP trapping function enabled on a port, traps are sent out of the
port to advertise the topology changes detected over the trap interval to
neighbors. By tuning this interval, you can prevent excessive traps from being
sent when topology is instable.
Set initialization delay for LLDP-enabled ports.
Reinit Delay
Each time the LLDP operating mode of a port changes, its LLDP protocol state
machine reinitializes. A configurable reinitialization delay prevents frequent
initializations caused by frequent changes to the operating mode. If you
configure the reinitialization delay, a port must wait the specified amount of
time to initialize LLDP after the LLDP operating mode changes.
Set LLDP frame transmission delay.
Tx Delay
With LLDP enabled, a port advertises LLDP frames to its neighbors both
periodically and when the local configuration changes. To avoid excessive
number of LLDP frames caused by frequent local configuration changes, an
LLDP frame transmission delay is introduced. After sending an LLDP frame, the
port must wait for the specified interval before it can send another one.
LLDP frame transmission delay must be less than the TTL to make sure the LLDP
neighbors can receive LLDP frames to update information about the device you
are configuring before it is aged out.
Set the LLDP frame transmission interval.
Tx Interval
If the product of the TTL multiplier and the LLDP frame transmission interval is
greater than 65535, the TTL carried in transmitted LLDP frames takes 65535
seconds. The likelihood exists that the LLDP frame transmission interval is greater
than TTL. You should avoid the situation, because the LLDP neighbors will fail to
receive LLDP frames to update information about the device you are configuring
before it is aged out.
Displaying LLDP information for a port
1.
From the navigation tree, select Network > LLDP.
By default, the Port Setup tab is displayed.
2.
On the port list, click a port name to display its LLDP information at the lower half of the page.
229
By default, the Local Information tab is displayed. Table 77 describes the fields.
Figure 202 The local information tab
Table 77 Field description
Field
Description
Port ID subtype:
Port ID subtype
•
•
•
•
•
•
•
Interface alias.
Port component.
MAC address.
Network address.
Interface name.
Agent circuit ID.
Locally assigned—Locally-defined port ID type other than those listed
above.
PoE port class:
Power port class
• PSE—Power sourcing equipment.
• PD—Powered device.
Power class of the PD:
Port power
classification
•
•
•
•
•
•
Unknown.
Class0.
Class1.
Class2.
Class3.
Class4.
Media policy type:
Media policy type
•
•
•
•
•
•
•
•
•
Unknown.
Voice.
Voice signaling.
Guest voice.
Guest voice signaling.
Soft phone voice.
Videoconferencing.
Streaming video.
Video signaling.
230
Field
Description
PSE power source type:
PoE PSE power source
• Primary.
• Backup.
PoE power supply priority of PSE ports:
Port PSE priority
3.
•
•
•
•
Unknown—Unknown PSE priority.
Critical—Priority level 1.
High—Priority level 2.
Low—Priority level 3.
Click the Neighbor Information tab to display the LLDP neighbor information.
Table 78 describes the fields.
Figure 203 The neighbor information tab
Table 78 Field description
Field
Description
Chassis type
•
•
•
•
•
•
•
Chassis ID type:
Chassis ID
Chassis component.
Interface alias.
Port component.
MAC address.
Network address.
Interface name.
Locally assigned—Locally-defined chassis type other than those listed
above.
Chassis ID depending on the chassis type, which can be a MAC address
of the device.
231
Field
Description
Port ID type:
Port ID type
Port ID
•
•
•
•
•
•
•
Interface alias.
Port component.
MAC address.
Network address.
Interface name.
Agent circuit ID.
Locally assigned—Locally-defined port ID type other than those listed
above.
Port ID value.
Capabilities supported on the system:
System capabilities supported
• Repeater.
• Bridge.
• Router.
Capabilities enabled on the system:
System capabilities enabled
• Repeater.
• Bridge.
• Router.
Auto-negotiation supported
Indicates whether autonegotiation is supported on the port.
Auto-negotiation enabled
Indicates whether autonegotiation is enabled on the port.
OperMau
Speed and duplex state on the port.
Link aggregation supported
Indicates whether link aggregation is supported.
Link aggregation enabled
Indicates whether link aggregation is enabled.
Aggregation port ID
Link aggregation group ID. It is 0 if the neighbor port is not assigned to
any link aggregation group.
Maximum frame Size
Maximum frame size supported on the neighbor port.
MED device class:
• Connectivity device—An intermediate device that provide network
connectivity.
• Class I—A generic endpoint device. All endpoints that require the
discovery service of LLDP belong to this category.
Device class
• Class II—A media endpoint device. The class II endpoint devices
support the media stream capabilities and the capabilities of generic
endpoint devices.
• Class III—A communication endpoint device. The class III endpoint
devices directly support end users of the IP communication system.
Providing all capabilities of generic and media endpoint devices,
Class III endpoint devices are used directly by end users.
232
Field
Description
Media policy type:
Media policy type
•
•
•
•
•
•
•
•
•
Unknown.
Voice.
Voice signaling.
Guest voice.
Guest voice signaling.
Soft phone voice.
Videoconferencing.
Streaming video.
Video signaling.
Unknown Policy
Indicates whether the media policy type is unknown.
VLAN tagged
Indicates whether packets of the media VLAN are tagged.
Media policy VlanID
ID of the media VLAN.
Media policy L2 priority
Layer 2 priority.
Media policy Dscp
DSCP value.
HardwareRev
Hardware version of the neighbor.
FirmwareRev
Firmware version of the neighbor.
SoftwareRev
Software version of the neighbor.
SerialNum
Serial number advertised by the neighbor.
Manufacturer name
Manufacturer name advertised by the neighbor.
Model name
Model name advertised by the neighbor.
Asset tracking identifier
Asset ID advertised by the neighbor. This ID is used for the purpose of
inventory management and asset tracking.
PSE power source type:
PoE PSE power source
• Primary.
• Backup.
PoE power supply priority of PSE ports:
Port PSE priority
4.
•
•
•
•
Unknown—Unknown PSE priority.
Critical—Priority level 1.
High—Priority level 2.
Low—Priority level 3.
Click the Statistics Information tab to display the LLDP statistics.
233
Figure 204 The statistic information tab
5.
Click the Status Information tab to display the LLDP status information.
Figure 205 The status information tab
Displaying global LLDP information
1.
From the navigation tree, select Network > LLDP.
2.
Click the Global Summary tab to display global local LLDP information and statistics.
Table 79 describes the fields.
234
Figure 206 The global summary tab
Table 79 Field description
Field
Description
Chassis ID
Local chassis ID depending on the chassis type defined.
Capabilities supported on the system:
System capabilities
supported
• Repeater.
• Bridge.
• Router.
Capabilities enabled on the system:
System capabilities
enabled
• Repeater.
• Bridge.
• Router.
MED device class:
• Connectivity device—An intermediate device that provide network
connectivity.
• Class I—A generic endpoint device. All endpoints that require the discovery
service of LLDP belong to this category.
Device class
• Class II—A media endpoint device. The class II endpoint devices support
the media stream capabilities and the capabilities of generic endpoint
devices.
• Class III—A communication endpoint device. The class III endpoint devices
directly support end users of the IP communication system. Providing all
capabilities of generic and media endpoint devices, Class III endpoint
devices are used directly by end users.
235
Displaying LLDP information received from LLDP
neighbors
1.
From the navigation tree, select Network > LLDP.
2.
Click the Neighbor Summary tab to display the global LLDP neighbor information, as shown
in Figure 207.
Figure 207 The neighbor summary tab
LLDP configuration example
Network requirements
As shown in Figure 208, configure LLDP on Switch A and Switch B so that the NMS can determine the
status of the link between Switch A and MED and the link between Switch A and Switch B.
Figure 208 Network diagram
Configuring Switch A
1.
(Optional.) Enable LLDP on GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2. By default, LLDP
is enabled on Ethernet ports.
2.
Set the LLDP operating mode to Rx on GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2:
a. From the navigation tree, select Network > LLDP.
By default, the Port Setup tab is displayed, as shown in Figure 209.
b. Select port GigabitEthernet1/0/1 and GigabitEthernet1/0/2.
c. Click Modify Selected.
236
The page shown in Figure 210 appears.
Figure 209 The port setup tab
d. Select Rx from the LLDP Operating Mode list.
3.
Click Apply.
A progress dialog box appears.
4.
Click Close on the progress dialog box when the progress dialog box prompts that the
configuration succeeds.
237
Figure 210 Setting LLDP on multiple ports
5.
Enable global LLDP:
a. Click the Global Setup tab, as shown in Figure 211.
b. Select Enable from the LLDP Enable list.
6.
Click Apply.
A progress dialog box appears.
7.
Click Close on the progress dialog box when the progress dialog box prompts that the
configuration succeeds.
Figure 211 The global setup tab
238
Configuring Switch B
1.
(Optional.) Enable LLDP on port GigabitEthernet 1/0/1. By default, LLDP is enabled on Ethernet
ports.
2.
Set the LLDP operating mode to Tx on GigabitEthernet 1/0/1:
a. From the navigation tree, select Network > LLDP.
By default, the Port Setup tab is displayed.
b. Click the
icon for port GigabitEthernet 1/0/1.
c. Select Tx from the LLDP Operating Mode list.
3.
Click Apply.
A progress dialog box appears.
4.
Click Close on the progress dialog box when the progress dialog box prompts that the
configuration succeeds.
Figure 212 Setting the LLDP operating mode to Tx
5.
Enable global LLDP:
a. Click the Global Setup tab.
b. Select Enable from the LLDP Enable list.
6.
Click Apply.
A progress dialog box appears.
7.
Click Close on the progress dialog box when the progress dialog box prompts that the
configuration succeeds.
Verifying the configuration
1.
Display the status information of port GigabitEthernet 1/0/1 on Switch A:
a. From the navigation tree, select Network > LLDP.
By default, the Port Setup tab is displayed.
239
b. Click the GigabitEthernet1/0/1 port name in the port list.
c. Click the Status Information tab at the lower half of the page.
The output shows that port GigabitEthernet 1/0/1 is connected to an MED neighbor device.
Figure 213 The status information tab (1)
2.
Display the status information of port GigabitEthernet 1/0/2 on Switch A:
a. Click the GigabitEthernet1/0/2 port name in the port list.
b. Click the Status Information tab at the lower half of the page.
The output shows that port GigabitEthernet 1/0/2 is connected to a non-MED neighbor device
(Switch B), as shown in Figure 214.
Figure 214 The status information tab (2)
3.
Tear down the link between Switch A and Switch B.
4.
Click Refresh to display the status information of port GigabitEthernet 1/0/2 on Switch A.
The updated status information of port GigabitEthernet 1/0/2 shows that no neighbor device is
connected to the port, as shown in Figure 215.
Figure 215 The status information tab displaying the updated port status information
240
LLDP configuration guidelines
When you configure LLDP, follow these guidelines:
•
To make LLDP take effect on a port, enable LLDP both globally and on the port.
•
To advertise LLDP-MED TLVs other than the LLDP-MED capabilities TLV, include the LLDP-MED
capabilities TLV.
•
To remove the LLDP-MED capabilities TLV, remove all other LLDP-MED TLVs.
•
To remove the MAC/PHY configuration TLV, remove the LLDP-MED capabilities set TLV first.
•
When the advertising of LLDP-MED capabilities TLV and MAC/PHY configuration/status TLV is
disabled, if the LLDP-MED capabilities set TLV is included, the MAC/PHY configuration/status TLV
is included automatically.
•
When you configure LLDP settings for ports in batch, if you do not set the TLVs, each port uses its
own TLV settings.
241
Configuring ARP
Overview
ARP resolves IP addresses into MAC addresses on Ethernet networks.
ARP message format
ARP uses two types of messages: ARP request and ARP reply. Figure 216 shows the format of the ARP
request/reply messages. Numbers in the figure refer to field lengths.
Figure 216 ARP message format
•
Hardware type—Hardware address type. The value 1 represents Ethernet.
•
Protocol type—Type of the protocol address to be mapped. The hexadecimal value 0x0800
represents IP.
•
Hardware address length and protocol address length—Length, in bytes, of a hardware address
and a protocol address. For an Ethernet address, the value of the hardware address length field is
6. For an IPv4 address, the value of the protocol address length field is 4.
•
OP—Operation code, which describes type of the ARP message. Value 1 represents an ARP request,
and value 2 represents an ARP reply.
•
Sender hardware address—Hardware address of the device sending the message.
•
Sender protocol address—Protocol address of the device sending the message.
•
Target hardware address—Hardware address of the device to which the message is being sent.
•
Target protocol address—Protocol address of the device to which the message is being sent.
ARP operating mechanism
As shown in Figure 217, Host A and Host B are on the same subnet. Host A sends a packet to Host B as
follows:
1.
Host A looks through its ARP table for an ARP entry for Host B. If one entry is found, Host A uses
the MAC address in the entry to encapsulate the IP packet into a data link layer frame. Then Host
A sends the frame to Host B.
242
2.
If Host A finds no entry for Host B, Host A buffers the packet and broadcasts an ARP request. The
payload of the ARP request contains the following information:
{
Sender IP address and sender MAC address—Host A's IP address and MAC address.
{
Target IP address—Host B's IP address.
{
Target MAC address—An all-zero MAC address.
All hosts on this subnet can receive the broadcast request, but only the requested host (Host B)
processes the request.
3.
Host B compares its own IP address with the target IP address in the ARP request. If they are the
same, Host B:
a. Adds the sender IP address and sender MAC address into its ARP table.
b. Encapsulates its MAC address into an ARP reply.
c. Unicasts the ARP reply to Host A.
4.
After receiving the ARP reply, Host A:
a. Adds the MAC address of Host B into its ARP table.
b. Encapsulates the MAC address into the packet and sends the packet to Host B.
Figure 217 ARP address resolution process
If Host A and Host B are on different subnets, Host A sends a packet to Host B, as follows:
1.
Host A broadcasts an ARP request to the gateway. The target IP address in the ARP request is the
IP address of the gateway.
2.
The gateway responds with its MAC address in an ARP reply to Host A.
3.
Host A uses the gateway's MAC address to encapsulate the packet, and then sends the packet to
the gateway.
4.
If the gateway has an ARP entry for Host B, it forwards the packet to Host B directly. If not, the
gateway broadcasts an ARP request, in which the target IP address is the IP address of Host B.
5.
After the gateway gets the MAC address of Host B, it sends the packet to Host B.
ARP table
An ARP table stores dynamic and static ARP entries.
243
Dynamic ARP entry
ARP automatically creates and updates dynamic entries. A dynamic ARP entry is removed when its aging
timer expires or the output interface goes down. In addition, a dynamic ARP entry can be overwritten by
a static ARP entry.
Static ARP entry
A static ARP entry is manually configured and maintained. It does not age out and cannot be overwritten
by any dynamic ARP entry.
Static ARP entries protect communication between devices, because attack packets cannot modify the
IP-to-MAC mapping in a static ARP entry.
Gratuitous ARP
In a gratuitous ARP packet, the sender IP address and the target IP address are the IP address of the
sending device, the sender MAC address is the MAC address of the sending device, and the target MAC
address is the broadcast address ff:ff:ff:ff:ff:ff.
A device sends a gratuitous ARP packet for either of the following purposes:
•
Determine whether its IP address is already used by another device. If the IP address is already used,
the device is informed of the conflict by an ARP reply.
•
Inform other devices of a MAC address change.
Gratuitous ARP packet learning
This feature enables a device to create or update ARP entries by using the sender IP and MAC addresses
in received gratuitous ARP packets.
When this feature is disabled, the device uses the received gratuitous ARP packets to update existing ARP
entries only.
Configuring ARP entries
Displaying ARP entries
From the navigation tree, select Network > ARP Management. The default ARP Table page appears, as
shown in Figure 218.
This page displays all ARP entries.
Figure 218 ARP Table configuration page
244
Creating a static ARP entry
1.
From the navigation tree, select Network > ARP Management.
The default ARP Table page appears, as shown in Figure 218.
2.
Click Add.
The New Static ARP Entry page appears.
Figure 219 Add a static ARP entry
3.
Configure the static ARP entry as described in Table 80.
4.
Click Apply.
Table 80 Configuration items
Item
Description
IP Address
Enter an IP address for the static ARP entry.
MAC Address
Enter a MAC address for the static ARP entry.
VLAN ID
Advanced
Options
Enter a VLAN ID and specify a port for the static ARP entry.
IMPORTANT:
Port
The VLAN ID must be the ID of the VLAN that has already been created, and the port
must belong to the VLAN. The corresponding VLAN interface must have been created.
Removing ARP entries
1.
From the navigation tree, select Network > ARP Management.
The default ARP Table page appears, as shown in Figure 218.
2.
Remove ARP entries:
{
To remove specific ARP entries, select the boxes of target ARP entries, and click Del Selected.
{
To remove all static and dynamic ARP entries, click Delete Static and Dynamic.
{
To remove all static ARP entries, click Delete Static.
{
To remove all dynamic ARP entries, click Delete Dynamic.
245
Configuring gratuitous ARP
1.
From the navigation tree, select Network > ARP Management.
2.
Click the Gratuitous ARP tab.
Figure 220 Gratuitous Configuring ARP page
3.
Configure gratuitous ARP as described in Table 81.
4.
Click Apply.
Table 81 Configuration items
Item
Description
Disable gratuitous ARP packets
learning function
Disable learning of ARP entries from gratuitous ARP packets.
Send gratuitous ARP packets when
receiving ARP requests from another
network segment
Gratuitous ARP packet learning is enabled by default.
Enable the device to send gratuitous ARP packets upon receiving ARP
requests from another network segment.
By default, the device does not send gratuitous ARP packets upon
receiving ARP requests from another network segment.
Static ARP configuration example
Network Requirements
As shown in Figure 221, hosts are connected to Switch A, and Switch A is connected to Router B through
GigabitEthernet 1/0/1 in VLAN 100.
To ensure secure communications between Switch A and Router B, configure a static ARP entry on Switch
A for Router B.
246
Figure 221 Network diagram
Configuring Switch A
1.
Create VLAN 100:
a. From the navigation tree, select Network > VLAN.
b. Click the Add tab.
c. Enter 100 in the VLAN ID field.
d. Click Create.
Figure 222 Creating VLAN 100
2.
Add GigabitEthernet 1/0/1 to VLAN 100:
a. Click the Modify Port tab.
b. In the Select Ports area, select interface GigabitEthernet 1/0/1.
247
c. Select Untagged for Select membership type.
d. Enter 100 in the VLAN IDs field.
e. Click Apply.
A configuration process dialog box appears.
f. After the configuration process is complete, click Close.
Figure 223 Adding GigabitEthernet 1/0/1 to VLAN 100
3.
Create VLAN-interface 100:
a. From the navigation tree, select Network > VLAN Interface.
b. Click the Create tab.
c. Enter 100 in the VLAN ID field.
d. Select Configure Primary IPv4 Address.
e. Select Manual.
f. Enter 192.168.1.2 in the IPv4 Address field.
g. Enter 24 or 255.255.255.0 in the Mask Length field.
h. Click Apply.
248
Figure 224 Creating VLAN-interface 100
4.
Create a static ARP entry:
a. From the navigation tree, select Network > ARP Management.
The default ARP Table page appears.
b. Click Add.
c. Enter 192.168.1.1 in the IP Address field.
d. Enter 00e0-fc01-0000 in the MAC Address field.
e. Select Advanced Options.
f. Enter 100 in the VLAN ID field.
g. Select GigabitEthernet1/0/1 from the Port list.
h. Click Apply.
Figure 225 Creating a static ARP entry
249
Configuring ARP attack protection
Overview
Although ARP is easy to implement, it provides no security mechanism and is vulnerable to network
attacks. The ARP detection feature enables access devices to block ARP packets from unauthorized clients
to prevent user spoofing and gateway spoofing attacks.
ARP detection provides user validity check and ARP packet validity check.
User validity check
This feature does not check ARP packets received from ARP trusted ports, but it checks ARP packets from
ARP untrusted ports.
Upon receiving an ARP packet from an ARP untrusted interface, this feature compares the sender IP and
MAC addresses against the DHCP snooping entries and 802.1X security entries. If a match is found from
those entries, the ARP packet is considered valid and is forwarded. If no match is found, the ARP packet
is considered invalid and is discarded.
ARP packet validity check
This feature does not check ARP packets received from ARP trusted ports. It checks ARP packets received
from ARP untrusted ports based on the following objects:
•
src-mac—Checks whether the sender MAC address in the message body is identical to the source
MAC address in the Ethernet header. If they are identical, the packet is forwarded. Otherwise, the
packet is discarded.
•
dst-mac—Checks the target MAC address of ARP replies. If the target MAC address is all-zero,
all-one, or inconsistent with the destination MAC address in the Ethernet header, the packet is
considered invalid and discarded.
•
ip—Checks the sender and target IP addresses of ARP replies, and the sender IP address of ARP
requests. All-one or multicast IP addresses are considered invalid and the corresponding packets
are discarded.
Configuring ARP detection
To check user validity, at least one among DHCP snooping entries and 802.1X security entries is
available. Otherwise, all ARP packets received from ARP untrusted ports are discarded.
1.
From the navigation tree, select Network > ARP Anti-Attack.
The default ARP Detection page appears.
250
Figure 226 ARP detection configuration page
2.
Configure ARP detection as described in Table 82.
3.
Click Apply.
Table 82 Configuration items
Item
Description
Select VLANs on which ARP detection is to be enabled.
VLAN Settings
To add VLANs to the Enabled VLANs list, select one or multiple VLANs from the Disabled
VLANs list and click the << button.
To remove VLANs from the Enabled VLANs list, select one or multiple VLANs from the list
and click the >> button.
Select trusted ports and untrusted ports.
Trusted Ports
To add ports to the Trusted Ports list, select one or multiple ports from the Untrusted Ports list
and click the << button.
To remove ports from the Trusted Ports list, select one or multiple ports from the list and click
the >> button.
Select ARP packet validity check modes:
• Discard the ARP packet whose sender MAC address is different from the source MAC
address in the Ethernet header.
• Discard the ARP packet whose target MAC address is all 0s, all 1s, or inconsistent with
ARP Packet
Validity Check
the destination MAC address in the Ethernet header.
• Discard the ARP request whose sender IP address is all 1s or a multicast address, and
discard the ARP reply whose sender and target IP addresses are all 1s or multicast
addresses.
If none is selected, the system does not check the validity of ARP packets.
If both ARP packet validity check and user validity check are enabled, the system performs
the former first, and then the latter.
251
Configuring IGMP snooping
Overview
IGMP snooping runs on a Layer 2 switch as a multicast constraining mechanism to improve multicast
forwarding efficiency. It creates Layer 2 multicast forwarding entries from IGMP packets that are
exchanged between the hosts and the router.
As shown in Figure 227, when IGMP snooping is not enabled, the Layer 2 switch floods multicast packets
to all hosts. When IGMP snooping is enabled, the Layer 2 switch forwards multicast packets of known
multicast groups to only the receivers of the multicast groups.
Figure 227 Multicast forwarding before and after IGMP snooping is enabled
Basic IGMP snooping concepts
This section lists the basic IGMP snooping concepts.
IGMP snooping related ports
As shown in Figure 228, IGMP snooping runs on Switch A and Switch B, Host A and Host C are receivers
in a multicast group.
252
Figure 228 IGMP snooping related ports
The following describes the ports involved in IGMP snooping:
•
Router port—Layer 3 multicast device-side port. Layer 3 multicast devices include designated
routers and IGMP queriers. In Figure 228, GigabitEthernet 1/0/1 of Switch A and GigabitEthernet
1/0/1 of Switch B are router ports. A switch records all its local router ports in its router port list.
Do not confuse the "router port" in IGMP snooping with the "routed interface" commonly known as
the "Layer 3 interface." The router port in IGMP snooping is the Layer 2 interface.
•
Member port—Multicast receiver-side port. In Figure 228, GigabitEthernet 1/0/2 and
GigabitEthernet 1/0/3 of Switch A and GigabitEthernet 1/0/2 of Switch B are member ports. A
switch records all its member ports in the IGMP snooping forwarding table.
Unless otherwise specified, router ports and member ports in this document include both dynamic and
static ports.
NOTE:
When IGMP snooping is enabled, all ports that receive PIM hello messages or IGMP general queries with
the source addresses other than 0.0.0.0 are considered dynamic router ports.
Aging timers for dynamic ports in IGMP snooping
Timer
Description
Message received before
the timer expires
Action after the timer
expires
Dynamic
router port
aging timer
When a port receives an
IGMP general query with the
source address other than
0.0.0.0 or PIM hello message,
the switch starts or resets an
aging timer for the port. When
the timer expires, the dynamic
router port ages out.
IGMP general query with the
source address other than
0.0.0.0 or PIM hello message.
The switch removes this
port from its router port
list.
253
Timer
Description
Dynamic
member port
aging timer
When a port dynamically
joins a multicast group, the
switch starts or resets an aging
timer for the port. When the
timer expires, the dynamic
member port ages out.
Message received before
the timer expires
Action after the timer
expires
IGMP membership report.
The switch removes this
port from the IGMP
snooping forwarding
table.
NOTE:
In IGMP snooping, only dynamic ports age out.
How IGMP snooping works
The ports in this section are dynamic ports.
IGMP messages include general query, IGMP report, and leave message. An IGMP snooping-enabled
switch performs differently depending on the message.
General query
The IGMP querier periodically sends IGMP general queries to all hosts and routers on the local subnet to
determine whether any active multicast group members exist on the subnet. The destination address of
IGMP general queries is 224.0.0.1.
After receiving an IGMP general query, the switch forwards the query through all ports in the VLAN
except the receiving port. The switch also performs one of the following actions:
•
If the receiving port is a dynamic router port in the router port list, the switch restarts the aging timer
for the port.
•
If the receiving port is not in the router port list, the switch adds the port as a dynamic router port into
the router port list and starts an aging timer for the port.
IGMP report
A host sends an IGMP report to the IGMP querier for the following purposes:
•
Responds to IGMP queries if the host is a multicast group member.
•
Applies for a multicast group membership.
After receiving an IGMP report, the switch forwards it through all the router ports in the VLAN, resolves
the address of the reported multicast group, and performs one of the following actions:
•
If no forwarding entry matches the group address, the switch creates a forwarding entry for the
group, adds the receiving port as a dynamic member port to the forwarding entry, and starts an
aging timer for the port.
•
If a forwarding entry matches the group address, but the receiving port is not in the forwarding
entry for the group, the switch adds the port as a dynamic member port to the forwarding entry, and
starts an aging timer for the port.
•
If a forwarding entry matches the group address and the receiving port is in the forwarding entry
for the group, the switch restarts the aging timer for the port.
A switch does not forward an IGMP report through a non-router port. If the switch forwards a report
message through a member port, the IGMP report suppression mechanism running on hosts causes all
attached hosts that monitor the reported multicast address to suppress their own reports. In this case, the
254
switch cannot determine whether the reported multicast group still has active members attached to that
port.
Leave message
An IGMPv1 host silently leaves a multicast group and the switch is not notified of the leaving. However,
because the host stops sending IGMP reports as soon as it leaves the multicast group, the switch removes
the port that connects to the host from the forwarding entry for the multicast group when the aging timer
for the port expires.
An IGMPv2 or IGMPv3 host sends an IGMP leave message to the multicast router when it leaves a
multicast group.
When the switch receives an IGMP leave message on a dynamic member port, the switch first examines
whether a forwarding entry matches the group address in the message, and, if a match is found, whether
the forwarding entry for the group contains the dynamic member port.
•
If no forwarding entry matches the group address, or if the forwarding entry does not contain the
port, the switch directly discards the IGMP leave message.
•
If a forwarding entry matches the group address and the forwarding entry contains the port, the
switch forwards the leave message to all router ports in the VLAN. Because the switch does not
know whether any other hosts attached to the port are still listening to that group address, the switch
does not immediately remove the port from the forwarding entry for that group. Instead, it restarts
the aging timer for the port.
After receiving the IGMP leave message, the IGMP querier resolves the multicast group address in the
message and sends an IGMP group-specific query to the multicast group through the port that received
the leave message. After receiving the IGMP group-specific query, the switch forwards it through all its
router ports in the VLAN and all member ports of the multicast group. The switch also performs one of the
following actions for the port that received the IGMP leave message:
•
If the port (assuming that it is a dynamic member port) receives an IGMP report in response to the
group-specific query before its aging timer expires, it means that some host attached to the port is
receiving or expecting to receive multicast data for the multicast group. The switch restarts the aging
timer for the port.
•
If the port receives no IGMP report in response to the group-specific query before its aging timer
expires, it means that no hosts attached to the port are still listening to that group address. The
switch removes the port from the forwarding entry for the multicast group when the aging timer
expires.
Protocols and standards
RFC 4541, Considerations for Internet Group Management Protocol (IGMP) and Multicast Listener
Discovery (MLD) Snooping Switches
Recommended configuration procedure
Step
1.
Remarks
Enabling IGMP
snooping globally
Required.
Disabled by default.
255
Step
Remarks
Required.
Enable IGMP snooping in the VLAN and configure the IGMP snooping version
and querier feature.
2.
Configuring IGMP
snooping in a VLAN
By default, IGMP snooping is disabled in a VLAN.
When you enable IGMP snooping, follow these guidelines:
• Enable IGMP snooping globally before you enable it for a VLAN.
• IGMP snooping for a VLAN takes effect only on the member ports in that
VLAN.
Optional.
3.
Configuring IGMP
snooping port
functions
Configure the maximum number of multicast groups and fast-leave processing on
a port of the specified VLAN.
When you configure IGMP snooping port functions, follow these guidelines:
• Before you enable IGMP snooping on a port, enable multicast routing or
IGMP snooping globally.
• IGMP snooping enabled on a port takes effect only after IGMP snooping is
enabled in the VLAN or IGMP is enabled on the VLAN interface.
4.
Displaying IGMP
snooping multicast
forwarding entries
Optional.
Enabling IGMP snooping globally
1.
From the navigation tree, select Network > IGMP snooping.
2.
Click Enable for IGMP snooping.
3.
Click Apply.
Figure 229 Enabling IGMP snooping globally
256
Configuring IGMP snooping in a VLAN
1.
From the navigation tree, select Network > IGMP snooping.
2.
Click the
icon for the VLAN.
Figure 230 Configuring IGMP snooping in a VLAN
3.
Configure the parameters as described in Table 83.
4.
Click Apply.
Table 83 Configuration items
Item
Description
Enable or disable IGMP snooping in the VLAN.
IGMP snooping
You can proceed with the subsequent configurations only if Enable is selected
here.
The default setting is IGMPv2.
By configuring an IGMP snooping version, you actually configure the versions of
IGMP messages that IGMP snooping can process.
• IGMPv2 snooping can process IGMPv1 and IGMPv2 messages, but it floods
Version
IGMPv3 messages in the VLAN instead of processing them.
• IGMPv3 snooping can process IGMPv1, IGMPv2, and IGMPv3 messages.
IMPORTANT:
If you change IGMPv3 snooping to IGMPv2 snooping, the system clears all IGMP
snooping forwarding entries that are dynamically added.
257
Item
Description
Enable or disable the IGMP snooping querier function.
On an IP multicast network that runs IGMP, a Layer 3 device acts as an IGMP
querier to send IGMP queries and establish and maintain multicast forwarding
entries, ensuring correct multicast traffic forwarding at the network layer.
Querier
On a network without Layer 3 multicast devices, IGMP querier cannot work
because a Layer 2 device does not support IGMP. To address this issue, you can
enable IGMP snooping querier on a Layer 2 device so that the device can
generate and maintain multicast forwarding entries at the data link layer,
providing IGMP querier functions.
Query interval
Configure the IGMP query interval.
General Query Source IP
Specify the source IP address of general queries.
Special Query Source IP
Specify the source IP address of group-specific queries.
Configuring IGMP snooping port functions
1.
From the navigation tree, select Network > IGMP snooping.
2.
Click the Advanced tab.
Figure 231 Configuring IGMP snooping port functions
3.
Configure the parameters as described in Table 84.
4.
Click Apply.
258
Table 84 Configuration items
Item
Description
Select the port on which advanced IGMP snooping features will be configured. The port
can be an GigabitEthernet port or Layer 2 aggregate interface.
After a port is selected, advanced features configured on this port are displayed at the
lower part of this page.
Port
TIP:
The advanced IGMP snooping configurations on a Layer 2 aggregate interface do not
interfere with configurations on its member ports, nor do they participate in aggregation
calculations. The configuration on a member port of the aggregate group does not take
effect until the port leaves the aggregate group.
VLAN ID
Specify the ID of the VLAN in which the port functions are to be configured.
The configurations made in a VLAN take effect on the ports only in this VLAN.
Configure the maximum number of multicast groups on a port.
With this feature, you can limit multicast traffic on the port.
Group Limit
IMPORTANT:
If the number of multicast groups on a port exceeds the limit that you are setting, the system
removes all the forwarding entries related to that port from the IGMP snooping forwarding
table. The receiver hosts attached to that port can join multicast groups again before the
number of multicast groups on the port reaches the limit.
Enable or disable fast-leave processing on the port.
Fast Leave
When a port that is enabled with the IGMP snooping fast-leave processing feature
receives an IGMP leave message, the switch immediately removes that port from the
forwarding entry for the multicast group specified in the message. When the switch
receives IGMP group-specific queries for that multicast group, it does not forward them to
that port.
You can enable IGMP snooping fast-leave processing on ports to save bandwidth and
resources.
Displaying IGMP snooping multicast forwarding
entries
1.
From the navigation tree, select Network > IGMP snooping.
2.
Click Show Entries to display information about IGMP snooping multicast forwarding entries.
Figure 232 Displaying entry information
3.
To display detailed information about an entry, click the
259
icon for the entry.
Figure 233 Displaying detailed information about the entry
Table 85 Field description
Field
Description
VLAN ID
ID of the VLAN to which the entry belongs.
Source Address
Multicast source address. If no multicast sources are specified, this field displays
0.0.0.0.
Group Address
Multicast group address.
Router Port(s)
All router ports.
Member Port(s)
All member ports.
IGMP snooping configuration example
Network requirements
As shown in Figure 234, IGMPv2 runs on Router A and IGMPv2 snooping runs on Switch A. Router A
acts as the IGMP querier.
Perform the configuration so Host A can receive the multicast data addressed to the multicast group
224.1.1.1.
260
Figure 234 Network diagram
VLAN 100
Host B
1.1.1.1/24
GE1/0/2
GE1/0/2
Source
GE1/0/1
Router A
IGMP querier
GE1/0/3
GE1/0/1
Switch A
Host A
Receiver
Configuration procedure
Configuring Router A
Enable IP multicast routing globally, enable PIM-DM on each interface, and enable IGMP on
GigabitEthernet 1/0/1. (Details not shown.)
Configuring Switch A
1.
Create VLAN 100:
a. From the navigation tree, select Network > VLAN.
b. Click the Create tab.
c. Enter 100 as the VLAN ID.
d. Click Apply.
261
Figure 235 Creating VLAN 100
2.
Assign GigabitEthernet 1/0/1 through GigabitEthernet 1/0/3 to VLAN 100:
a. Click the Modify Port tab.
b. Select GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 in the
Select Ports area.
c. Select Untagged for Select membership type.
d. Enter 100 as the VLAN ID.
e. Click Apply.
262
Figure 236 Assigning ports to the VLAN
3.
Enable IGMP snooping globally:
a. From the navigation tree, select Network > IGMP snooping.
b. Select Enable.
c. Click Apply.
Figure 237 Enabling IGMP snooping globally
4.
Enable IGMP snooping for VLAN 100:
a. Click the
icon for VLAN 100.
b. Select Enable for IGMP snooping.
c. Select 2 for Version.
d. Click Apply.
263
Figure 238 Configuring IGMP snooping in VLAN 100
Verifying the configuration
1.
From the navigation tree, select Network > IGMP snooping.
2.
Click Show Entries in the basic VLAN configuration page to display information about IGMP
snooping multicast forwarding entries.
Figure 239 Displaying IGMP snooping multicast forwarding entries
3.
Click the
this entry.
icon for the multicast entry (0.0.0.0, 224.1.1.1) to display detailed information about
Figure 240 Displaying detailed information about the entry
264
The output shows that GigabitEthernet 1/0/3 of Switch A is listening to the multicast streams destined for
multicast group 224.1.1.1.
265
Configuring MLD snooping
Overview
MLD snooping runs on a Layer 2 switch as an IPv6 multicast constraining mechanism to improve multicast
forwarding efficiency. It creates Layer 2 multicast forwarding entries from MLD messages that are
exchanged between the hosts and the router.
As shown in Figure 241, when MLD snooping is not enabled, the Layer 2 switch floods IPv6 multicast
packets to all hosts. When MLD snooping is enabled, the Layer 2 switch forwards multicast packets of
known IPv6 multicast groups to only the receivers of the multicast groups.
Figure 241 IPv6 multicast forwarding before and after MLD snooping is enabled
Basic MLD snooping concepts
This section lists the basic MLD snooping concepts.
MLD snooping related ports
As shown in Figure 242, MLD snooping runs on Switch A and Switch B. Host A and Host C are receivers
in an IPv6 multicast group.
266
Figure 242 MLD snooping related ports
The following describes the ports involved in MLD snooping:
•
Router port—Layer 3 multicast device-side port. Layer 3 multicast devices include designated
routers and MLD queriers. As shown in Figure 242, GigabitEthernet 1/0/1 of Switch A and
GigabitEthernet 1/0/1 of Switch B are router ports. A switch records all its local router ports in its
router port list.
Do not confuse the "router port" in MLD snooping with the "routed interface" commonly known as
the "Layer 3 interface." The router port in MLD snooping is a Layer 2 interface.
•
Member port—Multicast receiver-side port. As shown in Figure 242, GigabitEthernet 1/0/2 and
GigabitEthernet 1/0/3 of Switch A and GigabitEthernet 1/0/2 of Switch B are member ports. A
switch records all local member ports in its MLD snooping forwarding table.
Unless otherwise specified, router ports and member ports in this document include both dynamic and
static ports.
NOTE:
When MLD snooping is enabled, all ports that receive IPv6 PIM hello messages or MLD general queries
with source addresses other than 0::0 are considered dynamic router ports.
Aging timers for dynamic ports in MLD snooping
Timer
Description
Message received
before the timer
expires
Action after the timer
expires
Dynamic router
port aging timer
When a port receives an MLD
general query with the source
address other than 0::0 or IPv6
PIM hello message, the switch
starts or resets an aging timer.
When the timer expires, the
dynamic router port ages out.
MLD general query with
the source address other
than 0::0 or IPv6 PIM
hello message.
The switch removes this
port from its router port
list.
267
Timer
Description
Dynamic member
port aging timer
When a port dynamically joins
an IPv6 multicast group, the
switch starts or resets an aging
timer for the port. When the
timer expires, the dynamic
member port ages out.
Message received
before the timer
expires
Action after the timer
expires
MLD membership report.
The switch removes this
port from the MLD
snooping forwarding
table.
NOTE:
In MLD snooping, only dynamic ports age out.
How MLD snooping works
The ports in this section are dynamic ports.
MLD messages include general query, MLD report, and done message. An MLD snooping-enabled
switch performs differently depending on the MLD message.
General query
The MLD querier periodically sends MLD general queries to all hosts and routers on the local subnet to
check whether any active IPv6 multicast group members exist on the subnet. The destination IPv6 address
of MLD general queries is FF02::1.
After receiving an MLD general query, the switch forwards the query to all ports in the VLAN except the
receiving port. The switch also performs one of the following actions:
•
If the receiving port is a dynamic router port in the router port list, the switch restarts the aging timer
for the router port.
•
If the receiving port is not in the router port list, the switch adds the port as a dynamic router port to
the router port list and starts an aging timer for the port.
MLD report
A host sends an MLD report to the MLD querier for the following purposes:
•
Responds to queries if the host is an IPv6 multicast group member.
•
Applies for an IPv6 multicast group membership.
After receiving an MLD report, the switch forwards it through all the router ports in the VLAN and resolves
the address of the reported IPv6 multicast group. The switch also performs one of the following actions:
•
If no forwarding entry matches the IPv6 group address, the switch creates a forwarding entry for the
group, adds the receiving port as a dynamic member port to the forwarding entry, and starts an
aging timer for the port.
•
If a forwarding entry matches the IPv6 group address, but the receiving port is not in the forwarding
entry for the group, the switch adds the port as a dynamic member port to the forwarding entry, and
starts an aging timer for the port.
•
If a forwarding entry matches the IPv6 group address and the receiving port is in the forwarding
entry for the group, the switch resets an aging timer for the port.
A switch does not forward an MLD report through a non-router port. If the switch forwards a report
through a member port, the MLD report suppression mechanism causes all attached hosts that monitor
268
the reported IPv6 multicast group address to suppress their own reports. In this case, the switch cannot
determine whether the reported IPv6 multicast group still has active members attached to that port.
Done message
When a host leaves an IPv6 multicast group, the host sends an MLD done message to the multicast router.
When the switch receives an MLD done message on a member port, the switch first examines whether a
forwarding entry matches the IPv6 group address in the message, and, if a match is found, determines
whether the forwarding entry contains the dynamic member port.
•
If no forwarding entry matches the IPv6 multicast group address, or if the forwarding entry does not
contain the port, the switch directly discards the MLD done message.
•
If a forwarding entry matches the IPv6 multicast group address and contains the port, the switch
forwards the MLD done message to all router ports in the VLAN. Because the switch does not know
whether any other hosts attached to the port are still listening to that IPv6 multicast group address,
the switch does not immediately remove the port from the forwarding entry for that group. Instead,
the switch resets the aging timer for that port.
After receiving the MLD done message, the MLD querier resolves the IPv6 multicast group address in the
message and sends an MLD multicast-address-specific query to that IPv6 multicast group through the port
that received the MLD done message. After receiving the MLD multicast-address-specific query, the switch
forwards it through all its router ports in the VLAN and all member ports for that IPv6 multicast group. The
switch also performs one of the following actions for the port that received the MLD done message:
•
If the port (assuming that it is a dynamic member port) receives any MLD report in response to the
MLD multicast-address-specific query before its aging timer expires, it means that some host
attached to the port is receiving or expecting to receive IPv6 multicast data for that IPv6 multicast
group. The switch resets the aging timer for the port.
•
If the port receives no MLD report in response to the MLD multicast-address-specific query before its
aging timer expires, it means that no hosts attached to the port are still monitoring that IPv6
multicast group address. The switch removes the port from the forwarding entry for the IPv6
multicast group when the aging timer expires.
Protocols and standards
RFC 4541, Considerations for Internet Group Management Protocol (IGMP) and Multicast Listener
Discovery (MLD) Snooping Switches
Recommended configuration procedure
Step
1.
Remarks
Enabling MLD snooping
globally
Required.
Disabled by default.
269
Step
Remarks
Required.
Enable MLD snooping in the VLAN and configure the MLD snooping
version and querier.
2.
Configuring MLD snooping in
a VLAN
By default, MLD snooping is disabled in a VLAN.
When you enable MLD snooping, follow these guidelines:
• Enable MLD snooping globally before you enable it for a VLAN.
• MLD snooping for a VLAN takes effect only on the member ports in
that VLAN.
Optional.
Configure the maximum number of IPv6 multicast groups and fast-leave
processing on a port of the specified VLAN.
3.
Configuring MLD snooping
port functions
When you configure MLD snooping port functions, follow these
guidelines:
• Enable MLD snooping globally before you enable it on a port.
• MLD snooping enabled on a port takes effect only after MLD
snooping is enabled for the VLAN.
4.
Displaying MLD snooping
multicast forwarding entries
Optional.
Enabling MLD snooping globally
1.
Select Network > MLD snooping from the navigation tree.
2.
Click Enable for MLD snooping.
3.
Click Apply.
Figure 243 Enabling MLD snooping globally
Configuring MLD snooping in a VLAN
1.
Select Network > MLD snooping from the navigation tree.
270
2.
Click the
icon for the VLAN.
Figure 244 Configuring MLD snooping in a VLAN
3.
Configure the parameters as described in Table 86.
4.
Click Apply.
Table 86 Configuration items
Item
MLD snooping
Description
Enable or disable MLD snooping in the VLAN.
You can proceed with the subsequent configurations only if Enable is selected here.
The default setting is MLDv1.
By configuring an MLD snooping version, you actually configure the versions of MLD
messages that MLD snooping can process.
• MLDv1 snooping can process MLDv1 messages, but it floods MLDv2 messages in
Version
the VLAN instead of processing them.
• MLDv2 snooping can process MLDv1 and MLDv2 messages.
IMPORTANT:
If you change the MLDv2 snooping to MLDv1 snooping, the system clears all MLD
snooping forwarding entries that are dynamically added.
Enable or disable the MLD snooping querier function.
In an IPv6 multicast network that runs MLD, a Layer 3 device acts as the MLD querier
to send MLD queries and establish and maintain IPv6 multicast forwarding entries,
ensuring correct IPv6 multicast traffic forwarding at the network layer.
Querier
On an IPv6 network without Layer 3 multicast devices, MLD querier cannot work
because a Layer 2 device does not support MLD. To address this issue, you can
enable MLD snooping querier on a Layer 2 device so that the device can generate
and maintain IPv6 multicast forwarding entries at data link layer, providing MLD
querier functions.
Query interval
Configure the MLD general query interval.
General Query Source
Address
Specify the source IPv6 address of MLD general queries.
Special Query Source
Address
Specify the source IPv6 address of MLD multicast-address-specific queries.
271
Configuring MLD snooping port functions
1.
Select Network > MLD snooping from the navigation tree.
2.
Click the Advanced tab.
Figure 245 Configuring MLD snooping port functions
3.
Configure the parameters as described in Table 87.
4.
Click Apply.
Table 87 Configuration items
Item
Description
Select the port on which advanced MLD snooping features will be configured. The port
can be an GigabitEthernet port or Layer 2 aggregate interface.
After a port is selected, advanced features configured on this port are displayed at the
lower part of this page.
Port
TIP:
Advanced MLD snooping features configured on a Layer 2 aggregate interface do not
interfere with configurations on its member ports, nor do they take part in aggregation
calculations. The configuration on a member port of the aggregate group does not take
effect until the port leaves the aggregate group
VLAN ID
Specify the ID of the VLAN in which port functions are to be configured.
The configurations made in a VLAN take effect on the ports only in this VLAN.
Configure the maximum number of IPv6 multicast groups on a port.
With this feature, you can regulate IPv6 multicast traffic on the port.
Multicast Group
Limit
IMPORTANT:
When the number of IPv6 multicast groups on a port exceeds the limit that you are setting,
the system deletes all the IPv6 forwarding entries related to that port from the MLD snooping
forwarding table. The receiver hosts to that port can join the IPv6 multicast groups again
before the number of IPv6 multicast groups on this port reaches the limit.
272
Item
Description
Enable or disable fast-leave processing on the port.
Fast Leave
When a port that is enabled with the MLD snooping fast-leave processing feature receives
an MLD done message, the switch immediately deletes that port from the IPv6 forwarding
table entry for the multicast group specified in the message. When the switch receives
MLD multicast-address-specific queries for that multicast group, it does not forward them to
that port.
You can enable MLD snooping fast-leave processing on ports to save bandwidth and
resources.
Displaying MLD snooping multicast forwarding entries
1.
Select Network > MLD snooping from the navigation tree.
2.
Click Show Entries to display information about MLD snooping multicast forwarding entries.
Table 88 Displaying entry information
3.
To view detailed information about an entry, click the
icon for the entry.
Figure 246 Detailed information about an MLD snooping multicast entry
Table 89 Field description
Field
Description
VLAN ID
ID of the VLAN to which the entry belongs.
Source Address
Multicast source address. If no IPv6 multicast sources are specified, this field
displays ::.
Group Address
Multicast group address.
Router Ports
All router ports.
273
Field
Description
Member Ports
All member ports.
MLD snooping configuration example
Network requirements
As shown in Figure 247, MLDv1 runs on Router A and MLDv1 snooping runs on Switch A. Router A acts
as the MLD querier.
Perform the configuration so that Host A can receive the IPv6 multicast packets destined for the IPv6
multicast group FF1E::101.
Figure 247 Network diagram
VLAN 100
Host B
1::1/64
GE1/0/2
1::2/64
Source
GE1/0/1
2001::1/64
Router A
MLD querier
GE1/0/2
GE1/0/3
GE1/0/1
Switch A
Host A
Receiver
Configuration procedure
Configuring Router A
Enable IPv6 multicast routing, assign an IPv6 address to each interface, enable IPv6 PIM-DM on each
interface, and enable MLD on GigabitEthernet 1/0/1. (Details not shown.)
Configuring Switch A
1.
Create VLAN 100:
a. Select Network > VLAN from the navigation tree.
b. Click the Create tab.
c. Enter 100 as the VLAN ID.
d. Click Apply.
274
Figure 248 Creating VLAN 100
2.
Assign GigabitEthernet 1/0/1 through GigabitEthernet 1/0/3 to VLAN 100:
a. Click the Modify Port tab.
b. Select GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 in the
Select Ports area.
c. Select Untagged for Select membership type.
d. Enter 100 as the VLAN ID.
e. Click Apply.
275
Figure 249 Assigning ports to VLAN 100
3.
Enable MLD snooping globally:
a. Select Network > MLD snooping from the navigation tree.
b. Select Enable.
c. Click Apply.
Figure 250 Enabling MLD snooping globally
4.
Enable MLD snooping:
a. Click the
icon for VLAN 100.
b. Select Enable for MLD snooping.
c. Select 1 for Version.
276
d. Click Apply.
Figure 251 Enabling MLD snooping in VLAN 100
Verifying the configuration
1.
Select Network > MLD snooping from the navigation tree.
2.
Click Show Entries in the basic VLAN configuration page to display information about MLD
snooping multicast forwarding entries.
Figure 252 Displaying MLD snooping multicast forwarding entries
3.
Click the
entry.
icon for the multicast entry (::, FF1E::101) to display detailed information about this
Figure 253 Displaying detailed information about the entry
The output shows that GigabitEthernet 1/0/3 of Switch A is listening to multicast streams destined for
IPv6 multicast group FF1E::101.
277
Configuring IPv4 and IPv6 routing
The term "router" in this chapter refers to both routers and Layer 3 switches.
Overview
A router selects an appropriate route according to the destination address of a received packet and
forwards the packet to the next router. The last router on the path is responsible for sending the packet to
the destination host. Routing provides the path information that guides the forwarding of packets.
Routing table
A router selects optimal routes from the routing table, and sends them to the forwarding information base
(FIB) table to guide packet forwarding. Each router maintains a routing table and a FIB table.
Routes discovered by different routing protocols are available in a routing table and they can be divided
into the following categories by origin:
•
Direct routes—Routes discovered by data link protocols, also known as "interface routes."
•
Static routes—Manually configured routes. Static routes are easy to configure and require fewer
system resources. They work well in small and stable networks, but cannot adjust to network
changes, so you must manually configure the routes again whenever the network topology
changes.
•
Dynamic routes—Routes that are discovered dynamically by routing protocols.
Each entry in the FIB table specifies a physical interface that packets destined for a certain address
should go out to reach the next hop—the next router—or the directly connected destination.
A route entry includes the following items:
•
Destination IP address—Destination IP address or destination network.
•
Mask (IPv4)/prefix length (IPv6)—Specifies, together with the destination address, the address of
the destination network. A logical AND operation between the destination address and the
network mask/prefix length yields the address of the destination network.
•
Preference—Routes to the same destination might be discovered by various routing protocols or
manually configured, and routing protocols and static routes have different preferences configured.
The route with the highest preference (the smallest value) is optimal.
•
Outbound interface—Specifies the interface through which a matching IP packet is to be
forwarded.
•
Next hop—Specifies the address of the next hop router on the path.
Static route
Static routes are manually configured. If a network's topology is simple, you only need to configure static
routes for the network to work correctly.
278
Static routes cannot adapt to network topology changes. If a fault or a topological change occurs in the
network, the network administrator must modify the static routes manually.
Default route
A default route is used to forward packets that do not match any specific routing entry in the routing table.
Without a default route, packets that do not match any routing entries are discarded.
You can configure default routes in the Web interface in the following ways:
•
Configure an IPv4 static default route and specify both its destination IP address and mask as
0.0.0.0.
•
Configure an IPv6 static default route and specify both its destination IP address and prefix as ::/0.
Displaying the IPv4 active route table
Select Network > IPv4 Routing from the navigation tree to enter the page.
Figure 254 IPv4 active route table
Table 90 Field description
Field
Destination IP Address
Mask
Protocol
Preference
Description
Destination IP address and subnet mask of the IPv4 route.
Protocol that discovered the IPv4 route.
Preference value for the IPv4 route.
The smaller the number, the higher the preference.
Next Hop
Next hop IP address of the IPv4 route.
Interface
Output interface of the IPv4 route. Packets destined for the specified
network segment are sent out of the interface.
279
Creating an IPv4 static route
1.
Select Network > IPv4 Routing from the navigation tree.
2.
Click the Create tab.
The page for configuring an IPv4 static route appears.
Figure 255 Creating an IPv4 static route
3.
Create an IPv4 static route as described in Table 91.
4.
Click Apply.
Table 91 Configuration items
Item
Description
Destination IP Address
Enter the destination host or network IP address in dotted decimal notation.
Mask
Enter the mask of the destination IP address.
You can enter a mask length or a mask in dotted decimal notation.
Set a preference value for the static route. The smaller the number, the higher the
preference.
Preference
For example, specifying the same preference for multiple static routes to the same
destination enables load sharing on the routes. Specifying different preferences
enables route backup.
Next Hop
Enter the next hop IP address in dotted decimal notation.
280
Item
Description
Select the output interface.
Interface
You can select any available Layer 3 interface, for example, a virtual interface, of
the device. If you select NULL 0, the destination IP address is unreachable.
Displaying the IPv6 active route table
Select Network > IPv6 Routing from the navigation tree to enter the page.
Figure 256 IPv6 active route table
Table 92 Field description
Field
Destination IP Address
Prefix Length
Protocol
Preference
Description
Destination IP address and prefix length of the IPv6 route.
Protocol that discovered the IPv6 route.
Preference value for the IPv6 route.
The smaller the number, the higher the preference.
Next Hop
Next hop IP address of the IPv6 route.
Interface
Output interface of the IPv6 route. Packets destined for the specified network
segment are sent out of the interface.
Creating an IPv6 static route
1.
Select Network > IPv6 Routing from the navigation tree.
2.
Click the Create tab.
281
The page for configuring an IPv6 static route appears.
Figure 257 Creating an IPv6 static route
3.
Create an IPv6 static route as described in Table 93.
4.
Click Apply.
Table 93 Configuration items
Item
Description
Destination IP Address
Enter the destination host or network IP address, in the X:X::X:X format. The
128-bit destination IPv6 address is a hexadecimal address with eight parts
separated by colons (:). Each part is represented by a 4-digit hexadecimal
integer.
Prefix Length
Enter or select the prefix length of the destination IPv6 address.
Set a preference value for the static route. The smaller the number, the higher the
preference.
Preference
For example, specifying the same preference for multiple static routes to the same
destination enables load sharing on the routes. Specifying different priorities for
them enables route backup.
Next Hop
Enter the next hop address, in the same format as the destination IP address.
Select the output interface.
Interface
You can select any available Layer 3 interface, for example, a virtual interface,
of the device. If you select NULL 0, the destination IPv6 address is unreachable.
282
IPv4 static route configuration example
Network requirements
As shown in Figure 258, configure IPv4 static routes on Switch A, Switch B, and Switch C for any two
hosts to communicate with each other.
Figure 258 Network diagram
Configuration considerations
On Switch A, configure a default route with Switch B as the next hop.
On Switch B, configure one static route with Switch A as the next hop and the other with Switch C as the
next hop.
On Switch C, configure a default route with Switch B as the next hop.
Configuration procedure
1.
Configure a default route to Switch B on Switch A:
a. Select Network > IPv4 Routing from the navigation tree of Switch A.
b. Click the Create tab.
c. Enter 0.0.0.0 for Destination IP Address, 0 for Mask, and 1.1.4.2 for Next Hop.
d. Click Apply.
283
Figure 259 Configuring a default route
2.
Configure a static route to Switch A and Switch C on Switch B:
a. Select Network > IPv4 Routing from the navigation tree of Switch B.
b. Click the Create tab.
The page for configuring a static route appears.
c. Enter 1.1.2.0 for Destination IP Address, 24 for Mask, and 1.1.4.1 for Next Hop.
d. Click Apply.
284
Figure 260 Configuring a static route
e. Enter 1.1.3.0 for Destination IP Address, enter 24 for Mask, and enter 1.1.5.6 for Next Hop.
f. Click Apply.
3.
Configure a default route to Switch B on Switch C:
a. Select Network > IPv4 Routing from the navigation tree of Switch C.
b. Click the Create tab.
c. Enter 0.0.0.0 for Destination IP Address, 0 for Mask, and 1.1.5.5 for Next Hop.
d. Click Apply.
285
Figure 261 Configuring a default route
Verifying the configuration
1.
Display the routing table.
Enter the IPv4 route page of Switch A, Switch B, and Switch C to verify that the newly configured
static routes are displayed as active routes on the pages.
2.
Ping Host C from Host A (assuming both hosts run Windows XP):
C:\Documents and Settings\Administrator>ping 1.1.3.2
Pinging 1.1.3.2 with 32 bytes of data:
Reply from 1.1.3.2: bytes=32 time=1ms TTL=128
Reply from 1.1.3.2: bytes=32 time=1ms TTL=128
Reply from 1.1.3.2: bytes=32 time=1ms TTL=128
Reply from 1.1.3.2: bytes=32 time=1ms TTL=128
Ping statistics for 1.1.3.2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 1ms, Average = 1ms
286
IPv6 static route configuration example
Network requirements
As shown in Figure 262, configure IPv6 static routes on Switch A, Switch B, and Switch C for any two
hosts to communicate with each other.
Figure 262 Network diagram
Host B 2::2/64
Vlan-int400
2::1/64
Vlan-int200
4::2/64
Vlan-int300
5::2/64
Switch B
Vlan-int200
4::1/64
Vlan-int300
5::1/64
Vlan-int100
1::1/64
Host A 1::2/64
Vlan-int500
3::1/64
Switch C
Switch A
Host C 3::2/64
Configuration considerations
On Switch A, configure a default route with Switch B as the next hop.
On Switch B, configure one static route with Switch A as the next hop and the other with Switch C as the
next hop.
On Switch C, configure a default route with Switch B as the next hop.
Configuration procedure
1.
Configure a default route to Switch B on Switch A:
a. Select Network > IPv6 Routing from the navigation tree of Switch A.
b. Click the Create tab.
c. Enter :: for Destination IP Address, select 0 from the Prefix Length list, and enter 4::2 for Next
Hop.
d. Click Apply.
287
Figure 263 Configuring a default route
2.
Configure a static route to Switch A and Switch C on Switch B:
a. Select Network > IPv6 Routing from the navigation tree of Switch B.
b. Click the Create tab.
The page for configuring a static route appears.
c. Enter 1:: for Destination IP Address, select 64 from the Prefix Length list, and enter 4::1 for Next
Hop.
d. Click Apply.
288
Figure 264 Configuring a static route
e. Enter 3:: for Destination IP Address, select 64 from the Prefix Length list, and enter 5::1 for Next
Hop.
f. Click Apply.
3.
Configure a default route to Switch B on Switch C:
a. Select Network > IPv6 Routing from the navigation tree of Switch C.
b. Click the Create tab.
c. Enter :: for Destination IP Address, select 0 from the Prefix Length list, and enter 5::2 for Next
Hop.
d. Click Apply.
289
Figure 265 Configuring a default route
Verifying the configuration
1.
Display the routing table.
Enter the IPv6 route page of Switch A, Switch B, and Switch C to verify that the newly configured
static routes are displayed as active routes on the pages.
2.
Ping Host C from Switch A:
<SwitchA> ping ipv6 3::2
PING 3::2 : 56
data bytes, press CTRL_C to break
Reply from 3::2
bytes=56 Sequence=1 hop limit=254
time = 63 ms
Reply from 3::2
bytes=56 Sequence=2 hop limit=254
time = 62 ms
Reply from 3::2
bytes=56 Sequence=3 hop limit=254
time = 62 ms
Reply from 3::2
bytes=56 Sequence=4 hop limit=254
time = 63 ms
Reply from 3::2
bytes=56 Sequence=5 hop limit=254
--- 3::2 ping statistics --5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
290
time = 63 ms
round-trip min/avg/max = 62/62/63 ms
Configuration guidelines
When you configure a static route, follow these guidelines:
•
If you do not specify the preference, the default preference will be used. Reconfiguration of the
default preference applies only to newly created static routes. The Web interface does not support
configuration of the default preference.
•
If you specify the next hop address first and then configure it as the IP address of a local interface,
such as a VLAN interface, the static route does not take effect.
•
When you specify the output interface, note the following:
{
{
•
If the output interface is NULL 0 or a loopback interface, no next hop address is required.
If the output interface is a broadcast interface (such as a VLAN interface), you must specify the
output interface and the next hop at the same time.
You can delete only IPv4/IPv6 static routes on the Remove tab.
291
DHCP overview
The Dynamic Host Configuration Protocol (DHCP) provides a framework to assign configuration
information to network devices.
DHCP uses the client-server model. Figure 266 shows a typical DHCP application.
A DHCP client can obtain an IP address and other configuration parameters from a DHCP server on
another subnet through a DHCP relay agent. For more information about the DHCP relay agent, see
"Configuring DHCP relay agent." You can enable the DHCP client on an interface. For more information
about the DHCP client configuration, see "Configuring VLAN interface."
Figure 266 A typical DHCP application
DHCP address allocation
Allocation mechanisms
DHCP supports the following mechanisms for IP address allocation:
•
Static allocation—The network administrator assigns an IP address to a client (for example, a
WWW server), and DHCP conveys the assigned address to the client.
•
Automatic allocation—DHCP assigns a permanent IP address to a client.
•
Dynamic allocation—DHCP assigns an IP address to a client for a limited period of time, which is
called a lease. Most DHCP clients obtain their addresses in this way.
292
IP address allocation process
Figure 267 Dynamic IP address allocation process
1.
The client broadcasts a DHCP-DISCOVER message to locate a DHCP server.
2.
A DHCP server offers configuration parameters such as an IP address to the client in a
DHCP-OFFER message. The sending mode of the DHCP-OFFER is determined by the flag field in
the DHCP-DISCOVER message. For more information about the DHCP message format, see
"DHCP message format."
3.
If several DHCP servers send offers to the client, the client accepts the first received offer, and
broadcasts it in a DHCP-REQUEST message to request the IP address formally. (IP addresses
offered by other DHCP servers can be assigned to other clients.)
4.
All DHCP servers receive the DHCP-REQUEST message, but only the server from which the client
accepts the offered IP address returns a DHCP-ACK message to the client, confirming that the IP
address has been allocated to the client, or a DHCP-NAK unicast message, denying the IP address
allocation.
{
{
After the client receives the DHCP-ACK message, it broadcasts a gratuitous ARP packet to verify
whether the IP address assigned by the server is in use.
If the client receives no response within the specified time, the client uses this IP address.
Otherwise, the client sends a DHCP-DECLINE message to the server and requests an IP address
again.
IP address lease extension
A dynamically assigned IP address has a lease. When the lease expires, the IP address is reclaimed by
the DHCP server. To continue using the IP address, the client must extend the lease duration.
When half of the lease duration elapses, the DHCP client unicasts a DHCP-REQUEST to the DHCP server
to extend the lease. Depending on the availability of the IP address, the DHCP server returns either a
DHCP-ACK unicast confirming that the client's lease duration has been extended, or a DHCP-NAK
unicast denying the request.
If the client receives no reply, it broadcasts another DHCP-REQUEST message for lease extension when
seven eighths of the lease duration elapses. Again, depending on the availability of the IP address, the
DHCP server returns either a DHCP-ACK unicast confirming that the client's lease duration has been
extended, or a DHCP-NAK unicast denying the request.
293
DHCP message format
Figure 268 shows the DHCP message format. DHCP uses some of the fields in significantly different ways.
The numbers in parentheses indicate the size of each field in bytes.
Figure 268 DHCP message format
0
7
op (1)
23
15
htype (1)
hlen (1)
31
hops (1)
xid (4)
secs (2)
flags (2)
ciaddr (4)
yiaddr (4)
siaddr (4)
giaddr (4)
chaddr (16)
sname (64)
file (128)
options (variable)
•
op—Message type defined in option field. 1 = REQUEST, 2 = REPLY
•
htype, hlen—Hardware address type and length of the DHCP client.
•
hops—Number of relay agents a request message traveled.
•
xid—Transaction ID, a random number chosen by the client to identify an IP address allocation.
•
secs—Filled in by the client, the number of seconds elapsed since the client began address
acquisition or renewal process. This field is reserved and set to 0.
•
flags—The leftmost bit is defined as the BROADCAST (B) flag. If this flag is set to 0, the DHCP server
sent a reply back by unicast. If this flag is set to 1, the DHCP server sent a reply back by broadcast.
The remaining bits of the flags field are reserved for future use.
•
ciaddr—Client IP address if the client has an IP address that is valid and usable. Otherwise, it is set
to zero. (The client does not use this field to request a specific IP address to lease.)
•
yiaddr—"Your" (client) IP address, assigned by the server.
•
siaddr—Server IP address, from which the client obtained configuration parameters.
•
giaddr—(Gateway) IP address of the first relay agent a request message traveled.
•
chaddr—Client hardware address.
•
sname—Server host name, from which the client obtained configuration parameters.
•
file—Bootfile name and path information, defined by the server to the client.
•
options—Optional parameters field that is variable in length, which includes the message type,
lease duration, subnet mask, domain name server IP address, and WINS IP address.
294
DHCP options
DHCP defines the message format as an extension to BOOTP for compatibility. DHCP uses the Option
field to carry information for dynamic address allocation and to provide additional configuration
information to clients.
Figure 269 DHCP option format
Common DHCP options
The following are common DHCP options:
•
Option 3—Router option. It specifies the gateway address.
•
Option 6—DNS server option. It specifies the DNS server's IP address.
•
Option 33—Static route option. It specifies a list of classful static routes (the destination addresses
in these static routes are classful) that a client should add into its routing table. If both Option 33
and Option 121 exist, Option 33 is ignored.
•
Option 51—IP address lease option.
•
Option 53—DHCP message type option. It identifies the type of the DHCP message.
•
Option 55—Parameter request list option. It is used by a DHCP client to request specified
configuration parameters. The option includes values that correspond to the parameters requested
by the client.
•
Option 60—Vendor class identifier option. It is used by a DHCP client to identify its vendor, and by
a DHCP server to distinguish DHCP clients by vendor class and assign specific IP addresses to the
DHCP clients.
•
Option 66—TFTP server name option. It specifies a TFTP server to be assigned to the client.
•
Option 67—Bootfile name option. It specifies the bootfile name to be assigned to the client.
•
Option 121—Classless route option. It specifies a list of classless static routes (the destination
addresses in these static routes are classless) that the requesting client should add to its routing table.
If both Option 33 and Option 121 exist, Option 33 is ignored.
•
Option 150—TFTP server IP address option. It specifies the TFTP server IP address to be assigned to
the client.
For more information about DHCP options, see RFC 2132 and RFC 3442.
Option 82
Some options, such as Option 82, have no unified definitions in RFC 2132.
Option 82 is the relay agent option. It records the location information about the DHCP client. When a
DHCP relay agent or DHCP snooping device receives a client's request, it adds Option 82 to the request
message and sends it to the server.
295
The administrator can use Option 82 to locate the DHCP client and further implement security control
and accounting. The DHCP server can use Option 82 to provide individual configuration policies for the
clients.
Option 82 can include up to 255 sub-options and must have one sub-option at least. Option 82 supports
two sub-options: sub-option 1 (Circuit ID) and sub-option 2 (Remote ID).
Option 82 has no unified definition. Its padding formats vary with vendors.
By default, the normal padding format is used on the device. You can specify the code type for the
sub-options as ASCII or HEX. The padding contents for sub-options in the normal padding format are as
follows:
•
Sub-option 1—Padded with the VLAN ID and interface number of the interface that received the
client's request. The following figure gives its format. The value of the sub-option type is 1, and that
of the circuit ID type is 0.
Figure 270 Sub-option 1 in normal padding format
•
Sub-option 2—Padded with the MAC address of the DHCP relay agent interface or the MAC
address of the DHCP snooping device that received the client's request. The following figure gives
its format. The value of the sub-option type is 2, and that of the remote ID type is 0.
Figure 271 Sub-option 2 in normal padding format
Protocols and standards
•
RFC 2131, Dynamic Host Configuration Protocol
•
RFC 2132, DHCP Options and BOOTP Vendor Extensions
•
RFC 1542, Clarifications and Extensions for the Bootstrap Protocol
•
RFC 3046, DHCP Relay Agent Information Option
•
RFC 3442, The Classless Static Route Option for Dynamic Host Configuration Protocol (DHCP)
version 4.
296
Configuring DHCP relay agent
Overview
Since the DHCP clients request IP addresses through broadcast messages, the DHCP server and clients
must be on the same subnet. Through a DHCP relay agent, DHCP clients can get IP addresses from a
DHCP server on another subnet. This feature avoids deploying a DHCP server for each subnet to
centralize management and reduce investment. Figure 272 shows a typical application of the DHCP
relay agent.
Figure 272 DHCP relay agent application
The DHCP server and client interact with each other in the same way regardless of whether the relay
agent exists (see "DHCP overview"). For more information about DHCP packet exchange, see "IP
address allocation process."
The following only describes steps related to the DHCP relay agent:
1.
After receiving a DHCP-DISCOVER or DHCP-REQUEST broadcast message from a DHCP client,
the DHCP relay agent fills the giaddr field of the message with its IP address and forwards the
message to the designated DHCP server in unicast mode.
2.
Based on the giaddr field, the DHCP server returns an IP address and other configuration
parameters in a response.
3.
The relay agent conveys the response to the client.
297
Figure 273 DHCP relay agent operation
Recommended configuration procedure
Task
Remarks
Enabling DHCP and configuring
advanced parameters for the DHCP
relay agent
Required.
Enable DHCP globally and configure advanced DHCP parameters.
By default, global DHCP is disabled.
Required.
Creating a DHCP server group
To improve reliability, you can specify several DHCP servers as a
group on the DHCP relay agent and correlate a relay agent interface
with the server group. When the interface receives requesting
messages from clients, the relay agent forwards them to all the DHCP
servers of the group.
Required.
Enabling the DHCP relay agent on an
interface
Enable the DHCP relay agent on an interface, and correlate the
interface with a DHCP server group.
IMPORTANT:
The DHCP relay agent works on interfaces with IP addresses manually
configured only.
Optional.
Create a static IP-to-MAC binding, and view static and dynamic
bindings.
Configuring and displaying clients'
IP-to-MAC bindings
The DHCP relay agent can dynamically record clients' IP-to-MAC
bindings after clients get IP addresses. It also supports static bindings,
that is, you can manually configure IP-to-MAC bindings on the DHCP
relay agent, so that users can access external network using fixed IP
addresses.
By default, no static binding is created.
298
Enabling DHCP and configuring advanced
parameters for the DHCP relay agent
1.
From the navigation tree, select Network > DHCP to enter the default DHCP Relay page.
2.
Click Display Advanced Configuration to expand the advanced DHCP relay agent configuration
area, as shown in Figure 274.
Figure 274 DHCP relay agent configuration page
3.
Enable DHCP service and configure advanced parameters for DHCP relay agent as shown
in Table 94.
299
4.
Click Apply.
Table 94 Configuration items
Item
Description
DHCP Service
Enable or disable global DHCP.
Enable or disable unauthorized DHCP server detection.
There are unauthorized DHCP servers on networks, which reply DHCP clients with
wrong IP addresses.
Unauthorized Server
Detect
With this feature enabled, upon receiving a DHCP request, the DHCP relay agent
records the IP address of any DHCP server that assigned an IP address to the DHCP
client and the receiving interface. The administrator can use this information to check
out DHCP unauthorized servers. The device puts a record once for each DHCP
server. The administrator needs to find unauthorized DHCP servers from the log
information. After the information of recorded DHCP servers is cleared, the relay
agent re-records server information following this mechanism.
Enable or disable periodic refresh of dynamic client entries, and set the refresh
interval.
Dynamic Bindings
Refresh
A DHCP client sends a DHCP-RELEASE unicast message to the DHCP server through
the DHCP relay agent to relinquish its IP address. In this case the DHCP relay agent
simply conveys the message to the DHCP server, thus it does not remove the IP
address from dynamic client entries. To solve this problem, the periodic refresh of
dynamic client entries feature is introduced.
With this feature, the DHCP relay agent uses the IP address of a client and the MAC
address of the DHCP relay agent interface to periodically send a DHCP-REQUEST
message to the DHCP server.
• If the server returns a DHCP-ACK message or does not return any message within
Track Timer Interval
a specific interval, which means that the IP address is assignable now, the DHCP
relay agent ages out the client entry.
• If the server returns a DHCP-NAK message, which means the IP address is still in
use, the relay agent does not age it out.
If the Auto option is selected, the refresh interval is calculated by the relay agent
according to the number of client entries.
Creating a DHCP server group
1.
From the navigation tree, select Network > DHCP to enter the default DHCP Relay page shown
in Figure 274.
2.
In the Server Group area, click Add to enter the page shown in Figure 275.
Figure 275 Create a server group
300
3.
Configure the DHCP server group as shown in Table 95.
4.
Click Apply.
Table 95 Configuration items
Item
Server Group ID
Description
Enter the ID of a DHCP server group.
You can create up to 20 DHCP server groups.
Enter the IP address of a server in the DHCP server group.
IP Address
The server IP address cannot be on the same subnet as the IP address of the DHCP
relay agent. Otherwise, the client cannot obtain an IP address.
Enabling the DHCP relay agent on an interface
1.
From the navigation tree, select Network > DHCP to enter the default DHCP Relay page shown
in Figure 274.
2.
In the Interface Config field, click the
in Figure 276.
icon of a specific interface to enter the page shown
Figure 276 Configuring a DHCP relay agent interface
3.
Configure the DHCP relay agent on the interface as shown in Table 96.
4.
Click Apply.
Table 96 Configuration items
Item
Description
Interface Name
This field displays the name of a specific interface.
DHCP Relay
Enable or disable the DHCP relay agent on the interface.
Enable or disable IP address check.
Address Match Check
Server Group ID
With this function enabled, the DHCP relay agent checks whether a requesting
client's IP and MAC addresses match a binding (dynamic or static) on the DHCP
relay agent. If not, the client cannot access outside networks through the DHCP
relay agent. This prevents invalid IP address configuration.
Correlate the interface with a DHCP server group.
A DHCP server group can be correlated with multiple interfaces.
301
Configuring and displaying clients' IP-to-MAC
bindings
1.
From the navigation tree, select Network > DHCP to enter the default DHCP Relay page shown
in Figure 274.
2.
In the User Information area, click User Information to view static and dynamic bindings, as shown
in Figure 277.
Figure 277 Displaying clients' IP-to-MAC bindings
3.
Click Add to enter the page as shown in Figure 278.
Figure 278 Creating a static IP-to-MAC binding
4.
Configure the static IP-to-MAC binding as described in Table 97.
5.
Click Apply.
Table 97 Configuration items
Item
Description
IP Address
Enter the IP address of a DHCP client.
MAC Address
Enter the MAC address of the DHCP client.
Select the Layer 3 interface connected with the DHCP client.
Interface Name
IMPORTANT:
The interface of a static binding entry must be configured as a DHCP relay agent.
Otherwise, address entry conflicts might occur.
302
DHCP relay agent configuration example
Network requirements
As shown in Figure 279, VLAN-interface 1 on the DHCP relay agent (Switch A) connects to the network
where DHCP clients reside.
The IP address of VLAN-interface 1 is 10.10.1.1/24 and the IP address of VLAN-interface 2 is 10.1.1.1/24.
VLAN-interface 2 is connected to the DHCP server whose IP address is 10.1.1.1/24.
The switch forwards DHCP messages between DHCP clients and the DHCP server.
Figure 279 Network diagram
DHCP client
DHCP client
Vlan-int1
10.10.1.1/24
Vlan-int2
10.1.1.2/24
Switch A
DHCP relay agent
DHCP client
DHCP server
DHCP client
Configuring Switch A
1.
Enable DHCP:
a. From the navigation tree, select Network > DHCP to enter the default DHCP Relay page.
b. Select the Enable option next to DHCP Service, as shown in Figure 280.
c. Click Apply.
303
Figure 280 Enabling DHCP
2.
Configure a DHCP server group:
a. In the Server Group area, click Add and then perform the following operations, as shown
in Figure 281.
b. Enter 1 for Server Group ID.
c. Enter 10.1.1.1 for IP Address.
d. Click Apply.
Figure 281 Adding a DHCP server group
304
3.
Enable the DHCP relay agent on VLAN-interface 1:
a. In the Interface Config field, click the
icon of VLAN-interface 1, and then perform the
following operations, as shown in Figure 282.
b. Select the Enable option next to DHCP Relay.
c. Select 1 for Server Group ID.
d. Click Apply.
Figure 282 Enabling the DHCP relay agent on an interface and correlate it with a server group
Because the DHCP relay agent and server are on different subnets, you need to configure a static route
or dynamic routing protocol to make them reachable to each other.
305
Configuring DHCP snooping
DHCP snooping works between the DHCP client and server, or between the DHCP client and DHCP
relay agent. It guarantees that DHCP clients obtain IP addresses from authorized DHCP servers. Also, it
records IP-to-MAC bindings of DHCP clients (called DHCP snooping entries) for security purposes.
DHCP snooping does not work between the DHCP server and DHCP relay agent.
Overview
DHCP snooping defines trusted and untrusted ports to make sure clients obtain IP addresses only from
authorized DHCP servers.
•
Trusted—A trusted port can forward DHCP messages correctly to make sure the clients get IP
addresses from authorized DHCP servers.
•
Untrusted—An untrusted port discards received DHCP-ACK and DHCP-OFFER messages to prevent
unauthorized servers from assigning IP addresses.
DHCP snooping reads DHCP-ACK messages received from trusted ports and DHCP-REQUEST messages
to create DHCP snooping entries. A DHCP snooping entry includes the MAC and IP addresses of a client,
the port that connects to the DHCP client, and the VLAN. The DHCP snooping entries can be used by ARP
detection to prevent ARP attacks. For more information about ARP detection, see "Configuring ARP attack
protection".
Application of trusted ports
Configure ports facing the DHCP server as trusted ports, and configure other ports as untrusted ports.
As shown in Figure 283, configure the DHCP snooping device's port that is connected to the DHCP
server as a trusted port. The trusted port forwards response messages from the DHCP server to the client.
The untrusted port connected to the unauthorized DHCP server discards incoming DHCP response
messages.
306
Figure 283 Trusted and untrusted ports
In a cascaded network as shown in Figure 284, configure each DHCP snooping device's ports
connected to other DHCP snooping devices as trusted ports. To save system resources, you can disable
the untrusted ports that are not directly connected to DHCP clients from generating DHCP snooping
entries.
Figure 284 Trusted and untrusted ports in a cascaded network
Table 98 describes roles of the ports shown in Figure 284.
Table 98 Roles of ports
Device
Untrusted port
Trusted port disabled from
recording binding entries
Trusted port enabled to
record binding entries
Switch A
GigabitEthernet
1/0/1
GigabitEthernet 1/0/3
GigabitEthernet 1/0/2
307
Device
Untrusted port
Trusted port disabled from
recording binding entries
Trusted port enabled to
record binding entries
Switch B
GigabitEthernet
1/0/3 and
GigabitEthernet
1/0/4
GigabitEthernet 1/0/1
GigabitEthernet 1/0/2
Switch C
GigabitEthernet
1/0/1
GigabitEthernet 1/0/3 and
GigabitEthernet 1/0/4
GigabitEthernet 1/0/2
DHCP snooping support for Option 82
Option 82 records the location information about the DHCP client so the administrator can locate the
DHCP client for security and accounting purposes. For more information, see "Option 82."
DHCP snooping uses the same strategies as the DHCP relay agent to handle Option 82 for DHCP
request messages, as shown in Table 99. If a response returned by the DHCP server contains Option 82,
DHCP snooping removes Option 82 before forwarding the response to the client. If the response contains
no Option 82, DHCP snooping forwards it directly.
Table 99 Handling strategy
If a DHCP request has…
Option 82
No Option 82
Handling strategy
The DHCP snooping device…
Drop
Drops the message.
Keep
Forwards the message without changing Option 82.
Replace
Forwards the message after replacing the original
Option 82 with the Option 82 padded in normal
format.
N/A
Forwards the message after adding the Option 82
padded in normal format.
Recommended configuration procedure
Task
Enabling DHCP snooping
Remarks
Required.
By default, DHCP snooping is disabled.
Required.
Specify an interface as trusted and configure DHCP snooping to support
Option 82.
Configuring DHCP snooping
functions on an interface
By default, an interface is untrusted and DHCP snooping does not support
Option 82.
IMPORTANT:
You need to specify the ports connected to the authorized DHCP servers as
trusted to make sure DHCP clients can obtain valid IP addresses. The trusted
port and the port connected to the DHCP client must be in the same VLAN.
308
Task
Remarks
Displaying clients' IP-to-MAC
bindings
Optional.
Display clients' IP-to-MAC bindings recorded by DHCP snooping.
Enabling DHCP snooping
1.
From the navigation tree, select Network > DHCP.
2.
Click the DHCP Snooping tab to enter the page shown in Figure 285.
3.
Select the Enable option next to DHCP Snooping to enable DHCP Snooping.
Figure 285 DHCP snooping configuration page
Configuring DHCP snooping functions on an
interface
1.
From the navigation tree, select Network > DHCP.
2.
Click the DHCP Snooping tab to enter the page shown in Figure 285.
3.
icon of a specific interface in the Interface Config area to enter the page shown
Click the
in Figure 286.
309
Figure 286 DHCP snooping interface configuration page
4.
Configure DHCP snooping on the interface as described in Table 100.
5.
Click Apply.
Table 100 Configuration items
Item
Description
Interface Name
This field displays the name of a specific interface.
Interface State
Configure the interface as trusted or untrusted.
Option 82 Support
Configure DHCP snooping to support Option 82 or not.
Select the handling strategy for DHCP requests containing Option 82. The strategies
include:
Option 82 Strategy
• Drop—The message is discarded if it contains Option 82.
• Keep—The message is forwarded without its Option 82 being changed.
• Replace—The message is forwarded after its original Option 82 is replaced with
the Option 82 padded in normal format.
Displaying clients' IP-to-MAC bindings
1.
From the navigation tree, select Network > DHCP.
2.
Click the DHCP Snooping tab to enter the page shown in Figure 285.
3.
Click User Information to enter the page as shown in Figure 287.
Figure 287 DHCP snooping user information
Table 101 describes the fields of DHCP snooping entries.
Table 101 Field description
Item
Description
IP Address
Displays the IP address assigned by the DHCP server to the client.
MAC Address
Displays the MAC address of the client.
310
Item
Description
Displays the client type:
Type
• Dynamic—The IP-to-MAC binding is generated dynamically.
• Static—The IP-to-MAC binding is configured manually. Static bindings are not
supported.
Interface Name
Displays the device interface to which the client is connected.
VLAN
Displays the VLAN to which the device belongs.
Remaining Lease Time
Displays the remaining lease time of the IP address.
DHCP snooping configuration example
Network requirements
As shown in Figure 288, a DHCP snooping device (Switch B) is connected to a DHCP server through
GigabitEthernet 1/0/1, and to DHCP clients through GigabitEthernet 1/0/2 and GigabitEthernet
1/0/3.
•
Enable DHCP snooping on Switch B and configure DHCP snooping to support Option 82.
Configure the handling strategy for DHCP requests containing Option 82 as replace.
•
Enable GigabitEthernet 1/0/1 to forward DHCP server responses. Disable GigabitEthernet 1/0/2
and GigabitEthernet 1/0/3 from forwarding DHCP server responses.
•
Configure Switch B to record clients' IP-to-MAC address bindings in DHCP-REQUEST messages and
DHCP-ACK messages received from a trusted port.
Figure 288 Network diagram
Configuring Switch B
1.
Enable DHCP snooping:
a. From the navigation tree, select Network > DHCP.
b. Click the DHCP Snooping tab.
c. As shown in Figure 289, select the Enable option next to DHCP Snooping to enable DHCP
snooping.
311
Figure 289 Enabling DHCP snooping
2.
Configure DHCP snooping functions on GigabitEthernet 1/0/1:
a. Click the
icon of GigabitEthernet 1/0/1 on the interface list.
b. Select the Trust option next to Interface State as shown in Figure 290.
c. Click Apply.
Figure 290 Configuring DHCP snooping functions on GigabitEthernet 1/0/1
3.
Configure DHCP snooping functions on GigabitEthernet 1/0/2:
a. Click the
icon of GigabitEthernet 1/0/2 on the interface list.
b. Select the Untrust option for Interface State shown in Figure 291.
c. Select the Enable option next to Option 82 Support.
d. Select Replace for Option 82 Strategy.
e. Click Apply.
Figure 291 Configuring DHCP snooping functions on GigabitEthernet 1/0/2
312
4.
Configure DHCP snooping functions on GigabitEthernet 1/0/3:
a. Click the
icon of GigabitEthernet 1/0/3 on the interface list.
b. Select the Untrust option for Interface State as shown in Figure 292.
c. Select the Enable option next to Option 82 Support.
d. Select Replace for Option 82 Strategy.
e. Click Apply.
Figure 292 Configuring DHCP snooping functions on GigabitEthernet 1/0/3
313
Managing services
Overview
Service management allows you to manage the following types of services: FTP, Telnet, SSH, SFTP, HTTP
and HTTPS.
You can enable or disable the services, modify HTTP and HTTPS port numbers, and associate the FTP,
HTTP, or HTTPS service with an ACL to block illegal users.
FTP service
FTP is an application layer protocol for sharing files between server and client over a TCP/IP network.
Telnet service
Telnet is an application layer protocol that provides remote login and virtual terminal functions.
SSH service
Secure Shell (SSH) offers an approach to securely logging in to a remote device. By encryption and
strong authentication, it protects devices against attacks such as IP spoofing and plain text password
interception.
SFTP service
The secure file transfer protocol (SFTP) is a new feature in SSH2.0. SFTP uses the SSH connection to
provide secure data transfer. The device can serve as the SFTP server, allowing a remote user to log in to
the SFTP server for secure file management and transfer. The device can also serve as an SFTP client,
enabling a user to login from the device to a remote device for secure file transfer.
HTTP service
HTTP is used for transferring webpage information across the Internet. It is an application-layer protocol
in the TCP/IP protocol suite.
You can log in to the device by using the HTTP protocol with HTTP service enabled, accessing and
controlling the device with Web-based network management.
HTTPS service
The Hypertext Transfer Protocol Secure (HTTPS) refers to the HTTP protocol that supports the Security
Socket Layer (SSL) protocol.
The SSL protocol of HTTPS enhances the security of the device in the following ways:
•
Uses the SSL protocol to ensure the legal clients to access the device securely and prohibit the illegal
clients.
•
Encrypts the data exchanged between the HTTPS client and the device to ensure the data security
and integrity.
•
Defines certificate attribute-based access control policy for the device to control user access.
314
Managing services
1.
Select Network > Service from the navigation tree to enter the service management configuration
page, as shown in Figure 293.
Figure 293 Service management
2.
Enable or disable services on the page. Table 102 describes the detailed configuration items.
3.
Click Apply.
Table 102 Configuration items
Description
Item
Enable FTP
service
FTP
ACL
Enable or disable the FTP service.
The FTP service is disabled by default.
Associate the FTP service with an ACL. Only the clients that pass the ACL
filtering are permitted to use the FTP service.
You can view this configuration item by clicking the expanding button in
front of FTP.
Telnet
Enable Telnet
service
Enable or disable the Telnet service.
SSH
Enable SSH
service
Enable or disable the SSH service.
The Telnet service is disabled by default.
The SSH service is disabled by default.
Enable or disable the SFTP service.
SFTP
Enable SFTP
service
The SFTP service is disabled by default.
IMPORTANT:
When you enable the SFTP service, the SSH service must be enabled.
HTTP
Enable HTTP
service
Enable or disable the HTTP service.
The HTTP service is enabled by default.
315
Item
Description
Set the port number for HTTP service.
Port Number
You can view this configuration item by clicking the expanding button in
front of HTTP.
IMPORTANT:
When you modify a port, make sure the port is not used by any other
service.
ACL
Enable HTTPS
service
Associate the HTTP service with an ACL. Only the clients that pass the ACL
filtering are permitted to use the HTTP service.
You can view this configuration item by clicking the expanding button in
front of HTTP.
Enable or disable the HTTPS service.
The HTTPS service is disabled by default.
Select a local certificate for the HTTPS service from the Certificate
dropdown list.
Certificate
You can configure the certificates available in the dropdown list in
Authentication > Certificate Management. For more information, see
"Managing certificates."
IMPORTANT:
If no certificate is specified, the HTTPS service generates its own
certificate.
HTTPS
Set the port number for HTTPS service.
Port Number
You can view this configuration item by clicking the expanding button in
front of HTTPS.
IMPORTANT:
When you modify a port, make sure the port is not used by any other
service.
ACL
Associate the HTTPS service with an ACL. Only the clients that pass the
ACL filtering are permitted to use the HTTPS service.
You can view this configuration item by clicking the expanding button in
front of HTTPS.
316
Using diagnostic tools
This chapter describes how to use the ping and traceroute utilities.
Ping
Use the ping utility to determine if a specific address is reachable.
A ping operation involves the following steps:
1.
The source device sends ICMP echo requests to the destination device.
2.
The destination device responds by sending ICMP echo replies to the source device after receiving
the ICMP echo requests.
3.
The source device displays related statistics after receiving the replies.
You can ping only the IP address of a device in the current software version.
If the source device does not receive an ICMP echo reply within the timeout time, it displays the following
information:
•
A prompt.
•
Ping statistics.
If the source device receives ICMP echo replies within the timeout time, it displays the following
information:
•
Number of bytes for each echo reply.
•
Message sequence number.
•
Time to Live (TTL).
•
Response time.
•
Ping statistics.
Ping statistics include the following information:
•
Number of echo requests sent.
•
Number of echo replies received.
•
Percentage of echo replies not received.
•
Minimum, average, and maximum response time.
Traceroute
Traceroute retrieves the IP addresses of Layer 3 devices in the path to a specific destination. You can use
traceroute to test network connectivity and identify failed nodes.
You can traceroute the IP address or the host name of a destination device. If the target host name cannot
be resolved, a prompt appears.
A traceroute operation involves the following steps:
1.
The source device sends a packet with a Time to Live (TTL) value of 1 to the destination device.
317
2.
The first hop device responds with an ICMP TTL-expired message to the source. In this way, the
source device gets the address of the first device.
3.
The source device sends a packet with a TTL value of 2 to the destination device.
4.
The second hop responds with an ICMP TTL-expired message. In this way, the source device gets
the address of the second device.
5.
The destination device responds with an ICMP port-unreachable message because the packet from
the source has an unreachable port number. In this way, the source device gets the address of the
destination device.
In this way, the source device can get the addresses of all Layer 3 devices on the path.
Ping operation
The Web interface does not support IPv6 ping.
To perform a ping operation:
1.
From the navigation tree, select Network > Diagnostic Tools.
The ping configuration page appears.
Figure 294 Ping configuration page
2.
Enter the IP address of the destination device in the Destination IP address or host name field.
3.
Click Start.
4.
View the output in the Summary area.
318
Figure 295 Ping operation result
Traceroute operation
The Web interface does not support IPv6 traceroute.
Before performing a traceroute operation, perform the following tasks:
•
Enable sending of ICMP timeout packets by executing the ip ttl-expires enable command on
intermediate devices.
•
Enable sending of ICMP destination unreachable packets by executing the ip unreachables enable
command on the destination device.
To perform a traceroute operation:
1.
From the navigation tree, select Network > Diagnostic Tools.
2.
Click the Trace Route tab.
The traceroute configuration page appears.
Figure 296 Traceroute configuration page
319
3.
Enter the IP address or host name of the destination device in the Trace Route field.
4.
Click Start.
5.
View the output in the Summary area.
Figure 297 Traceroute operation result
320
Configuring 802.1X
802.1X overview
802.1X is a port-based network access control protocol initially proposed by the IEEE 802 LAN/WAN
committee for the security of WLANs. It has been widely used on Ethernet for access control.
802.1X controls network access by authenticating the devices connected to 802.1X-enabled LAN ports.
This chapter describes how to configure 802.1X on an HP device. You can also configure the port security
feature to perform 802.1X. Port security combines and extends 802.1X and MAC authentication. It
applies to a network (for example, a WLAN) that requires different authentication methods for different
users on a port. For more information, see "Configuring port security."
802.1X architecture
802.1X operates in the client/server model. It comprises three entities: the client (the supplicant), the
network access device (the authenticator), and the authentication server.
Figure 298 802.1X architecture
•
Client—A user terminal seeking access to the LAN. It must have 802.1X software to authenticate to
the network access device.
•
Network access device—Authenticates the client to control access to the LAN. In a typical 802.1X
environment, the network access device uses an authentication server to perform authentication.
•
Authentication server—Provides authentication services for the network access device. The
authentication server authenticates 802.1X clients by using the data sent from the network access
device, and returns the authentication results to the network access device to make access decisions.
The authentication server is typically a RADIUS server. In a small LAN, you can also use the network
access device as the authentication server.
Access control methods
HP implements port-based access control as defined in the 802.1X protocol, and extends the protocol to
support MAC-based access control.
•
Port-based access control—Once an 802.1X user passes authentication on a port, any subsequent
user can access the network through the port without authentication. When the authenticated user
logs off, all other users are logged off.
321
•
MAC-based access control—Each user is separately authenticated on a port. When a user logs off,
no other online users are affected.
Controlled/uncontrolled port and port authorization status
802.1X defines two logical ports for the network access port: controlled port and uncontrolled port. Any
packet arriving at the network access port is visible to both logical ports.
•
Controlled port—Allows incoming and outgoing traffic to pass through when it is in the authorized
state, and denies incoming and outgoing traffic when it is in the unauthorized state, as shown
in Figure 299. The controlled port is set in authorized state if the client has passed authentication,
and in unauthorized state, if the client has failed authentication.
•
Uncontrolled port—Is always open to receive and transmit EAPOL frames.
Figure 299 Authorization state of a controlled port
Authenticator system 1
Controlled port
Authenticator system 2
Uncontrolled port
Controlled port
Uncontrolled port
Port authorized
Port unauthorized
LAN
LAN
In the unauthorized state, a controlled port controls traffic in one of the following ways:
•
Performs bidirectional traffic control to deny traffic to and from the client.
•
Performs unidirectional traffic control to deny traffic from the client.
The device supports only unidirectional traffic control.
Packet formats
EAP packet format
Figure 300 shows the EAP packet format.
Figure 300 EAP packet format
0
15
7
Code
Identifier
Length
2
4
Data
N
322
•
Code—Type of the EAP packet. Options include Request (1), Response (2), Success (3), or Failure
(4).
•
Identifier—Used for matching Responses with Requests.
•
Length—Length (in bytes) of the EAP packet. The length is the sum of the Code, Identifier, Length,
and Data fields.
•
Data—Content of the EAP packet. This field appears only in a Request or Response EAP packet. The
Data field comprises the request type (or the response type) and the type data. Type 1 (Identify) and
type 4 (MD5-challenge) are two examples for the type field.
EAPOL packet format
Figure 301 shows the EAPOL packet format.
Figure 301 EAPOL packet format
•
PAE Ethernet type—Protocol type. It takes the value 0x888E for EAPOL.
•
Protocol version—The EAPOL protocol version used by the EAPOL packet sender.
•
Type—Type of the EAPOL packet. Table 103 lists the types of EAPOL packets supported by HP
implementation of 802.1X.
Table 103 Types of EAPOL packets
Value
Type
Description
0x00
EAP-Packet
The client and the network access device uses EAP-Packets to
transport authentication information.
0x01
EAPOL-Start
The client sends an EAPOL-Start message to initiate 802.1X
authentication to the network access device.
0x02
EAPOL-Logoff
The client sends an EAPOL-Logoff message to tell the network
access device that it is logging off.
•
Length—Data length in bytes, or length of the Packet body. If packet type is EAPOL-Start or
EAPOL-Logoff, this field is set to 0, and no Packet body field follows.
•
Packet body—Content of the packet. When the EAPOL packet type is EAP-Packet, the Packet body
field contains an EAP packet.
EAP over RADIUS
RADIUS adds two attributes, EAP-Message and Message-Authenticator, for supporting EAP
authentication. For the RADIUS packet format, see "Configuring RADIUS."
323
EAP-Message
RADIUS encapsulates EAP packets in the EAP-Message attribute, as shown in Figure 302. The Type field
takes 79, and the Value field can be up to 253 bytes. If an EAP packet is longer than 253 bytes, RADIUS
encapsulates it in multiple EAP-Message attributes.
Figure 302 EAP-Message attribute format
7
0
Type
15
N
Length
String
EAP packets
Message-Authenticator
RADIUS includes the Message-Authenticator attribute in all packets that have an EAP-Message attribute
to check their integrity. The packet receiver drops the packet if the calculated packet integrity checksum
is different from the Message-Authenticator attribute value. The Message-Authenticator prevents EAP
authentication packets from being tampered with during EAP authentication.
Figure 303 Message-Authenticator attribute format
Initiating 802.1X authentication
Both the 802.1X client and the access device can initiate 802.1X authentication.
802.1X client as the initiator
The client sends an EAPOL-Start packet to the access device to initiate 802.1X authentication. The
destination MAC address of the packet is the IEEE 802.1X specified multicast address
01-80-C2-00-00-03 or the broadcast MAC address. If any intermediate device between the client and
the authentication server does not support the multicast address, you must use an 802.1X client (for
example, the HP iNode 802.1X client) that can send broadcast EAPOL-Start packets.
Access device as the initiator
The access device initiates authentication, if a client cannot send EAPOL-Start packets. One example is
the 802.1X client available with Windows XP.
The access device supports the following modes:
•
Multicast trigger mode—The access device multicasts Identity EAP-Request packets periodically
(every 30 seconds by default) to initiate 802.1X authentication.
•
Unicast trigger mode—Upon receiving a frame with the source MAC address not in the MAC
address table, the access device sends an Identity EAP-Request packet out of the receiving port to
the unknown MAC address. It retransmits the packet if no response has been received within a
certain time interval.
324
802.1X authentication procedures
802.1X provides the following methods for authentication:
•
EAP relay.
•
EAP termination.
You choose either mode depending on the support of the RADIUS server for EAP packets and EAP
authentication methods.
•
EAP relay mode:
EAP relay is defined in IEEE 802.1X. In this mode, the network device uses EAPOR packets to send
authentication information to the RADIUS server, as shown in Figure 304.
Figure 304 EAP relay
In EAP relay mode, the client must use the same authentication method as the RADIUS server. On
the network access device, you only need to enable EAP relay.
Some network access devices provide the EAP server function so you can use EAP relay even if the
RADIUS server does not support any EAP authentication method or no RADIUS server is available.
•
EAP termination mode:
In EAP termination mode, the network access device terminates the EAP packets received from the
client, encapsulates the client authentication information in standard RADIUS packets, and uses
PAP or CHAP to authenticate to the RADIUS server, as shown in Figure 305.
Figure 305 EAP termination
Comparing EAP relay and EAP termination
Packet exchange method
Benefits
Limitations
• Supports various EAP
authentication methods.
EAP relay
• The configuration and
processing is simple on the
network access device.
325
The RADIUS server must support the
EAP-Message and Message-Authenticator
attributes, and the EAP authentication method
used by the client.
Packet exchange method
Benefits
Limitations
• Supports only MD5-Challenge EAP
EAP termination
Works with any RADIUS
server that supports PAP or
CHAP authentication.
authentication and the "username +
password" EAP authentication initiated by
an HP iNode 802.1X client.
• The processing is complex on the network
access device.
EAP relay
Figure 306 shows the basic 802.1X authentication procedure in EAP relay mode, assuming that
EAP-MD5 is used.
Figure 306 802.1X authentication procedure in EAP relay mode
1.
When a user launches the 802.1X client software and enters a registered username and password,
the 802.1X client software sends an EAPOL-Start packet to the network access device.
2.
The network access device responds with an Identity EAP-Request packet to ask for the client
username.
3.
In response to the Identity EAP-Request packet, the client sends the username in an Identity
EAP-Response packet to the network access device.
4.
The network access device relays the Identity EAP-Response packet in a RADIUS Access-Request
packet to the authentication server.
326
5.
The authentication server uses the identity information in the RADIUS Access-Request to search its
user database. If a matching entry is found, the server uses a randomly generated challenge
(EAP-Request/MD5 challenge) to encrypt the password in the entry, and sends the challenge in a
RADIUS Access-Challenge packet to the network access device.
6.
The network access device relays the EAP-Request/MD5 Challenge packet in a RADIUS
Access-Request packet to the client.
7.
The client uses the received challenge to encrypt the password, and sends the encrypted password
in an EAP-Response/MD5 Challenge packet to the network access device.
8.
The network access device relays the EAP-Response/MD5 Challenge packet in a RADIUS
Access-Request packet to the authentication server.
9.
The authentication server compares the received encrypted password with the one it generated at
step 5. If the two are identical, the authentication server considers the client valid and sends a
RADIUS Access-Accept packet to the network access device.
10. Upon receiving the RADIUS Access-Accept packet, the network access device sends an
EAP-Success packet to the client, and sets the controlled port in the authorized state so the client
can access the network.
11. After the client comes online, the network access device periodically sends handshake requests to
check whether the client is still online. By default, if two consecutive handshake attempts fail, the
device logs off the client.
12. Upon receiving a handshake request, the client returns a response. If the client fails to return a
response after a certain number of consecutive handshake attempts (two by default), the network
access device logs off the client. This handshake mechanism enables timely release of the network
resources used by 802.1X users that have abnormally gone offline.
13. The client can also send an EAPOL-Logoff packet to ask the network access device for a logoff.
14. In response to the EAPOL-Logoff packet, the network access device changes the status of the
controlled port from authorized to unauthorized and sends an EAP-Failure packet to the client.
EAP termination
Figure 307 shows the basic 802.1X authentication procedure in EAP termination mode, assuming that
CHAP authentication is used.
327
Figure 307 802.1X authentication procedure in EAP termination mode
In EAP termination mode, the network access device rather than the authentication server generates an
MD5 challenge for password encryption (see Step 4). The network access device then sends the MD5
challenge together with the username and encrypted password in a standard RADIUS packet to the
RADIUS server.
802.1X timers
This section describes the timers used on an 802.1X device to guarantee that the client, the device, and
the RADIUS server can interact with each other correctly.
•
Username request timeout timer—Starts when the device sends an EAP-Request/Identity packet to
a client in response to an authentication request. If the device receives no response before this timer
expires, it retransmits the request. The timer also sets the interval at which the network device sends
multicast EAP-Request/Identity packets to detect clients that cannot actively request authentication.
•
Client timeout timer—Starts when the access device sends an EAP-Request/MD5 Challenge packet
to a client. If no response is received when this timer expires, the access device retransmits the
request to the client.
•
Server timeout timer—Starts when the access device sends a RADIUS Access-Request packet to the
authentication server. If no response is received when this timer expires, the access device
retransmits the request to the server.
328
•
Handshake timer—Sets the interval at which the access device sends client handshake requests to
check the online status of a client that has passed authentication. If the device receives no response
after sending the maximum number of handshake requests, it considers that the client has logged
off. For information about how to enable the online user handshake function, see "Configuring
802.1X on a port."
•
Quiet timer—Starts when the access device sends a RADIUS Access-Request packet to the
authentication server. If no response is received when this timer expires, the access device
retransmits the request to the server.
•
Periodic online user re-authentication timer—Sets the interval at which the network device
periodically re-authenticates online 802.1X users. For information about how to enable periodic
online user re-authentication on a port, see "Configuring 802.1X on a port."
Using 802.1X authentication with other features
VLAN assignment
You can configure the authentication server to assign a VLAN for an 802.1X user that has passed
authentication. The way that the network access device handles VLANs on an 802.1X-enabled port
differs by 802.1X access control mode.
Access control
Port-based
VLAN manipulation
Assigns the VLAN to the port as the port VLAN (PVID). The authenticated 802.1X
user and all subsequent 802.1X users can access the VLAN without authentication.
When the user logs off, the previous PVID restores, and all other online users are
logged off.
• If the port is a hybrid port with MAC-based VLAN enabled, the device maps the
MAC address of each user to the VLAN assigned by the authentication server.
The PVID of the port does not change. When a user logs off, the MAC-to-VLAN
mapping for the user is removed.
MAC-based
• If the port is an access, trunk, or MAC-based VLAN disabled hybrid port, the
device assigns the first authenticated user's VLAN to the port as the PVID. If a
different VLAN is assigned to a subsequent user, the user cannot pass the
authentication. To avoid the authentication failure of subsequent users, be sure to
assign the same VLAN to all 802.1X users on these ports.
With 802.1X authentication, a hybrid port is always assigned to a VLAN as an untagged member. After
the assignment, do not reconfigure the port as a tagged member in the VLAN.
On a periodic online user re-authentication enabled port, if a user has been online before you enable the
MAC-based VLAN function, the access device does not create a MAC-to-VLAN mapping for the user
unless the user passes re-authentication and the VLAN for the user has changed.
Guest VLAN
You can configure a guest VLAN on a port to accommodate users that have not performed 802.1X
authentication, so they can access a limited set of network resources, such as a software server, to
download anti-virus software and system patches. Once a user in the guest VLAN passes 802.1X
authentication, it is removed from the guest VLAN and can access authorized network resources. The
way that the network access device handles VLANs on the port differs by 802.1X access control mode.
•
On a port that performs port-based access control:
329
Authentication status
VLAN manipulation
No 802.1X user has
performed authentication
within 90 seconds after
802.1X is enabled.
The device assigns the 802.1X guest VLAN to the port as the PVID. All
802.1X users on this port can access only resources in the guest VLAN.
A user in the 802.1X guest
VLAN fails 802.1X
authentication.
If no 802.1X guest VLAN is configured, the access device does not
perform any VLAN operation.
If an 802.1X Auth-Fail VLAN (see "Auth-Fail VLAN") is available, the
device assigns the Auth-Fail VLAN to the port as the PVID. All users on this
port can access only resources in the Auth-Fail VLAN.
If no Auth-Fail VLAN is configured, the PVID on the port is still the 802.1X
guest VLAN. All users on the port are in the guest VLAN.
• The device assigns the VLAN specified for the user to the port as the
A user in the 802.1X guest
VLAN passes 802.1X
authentication.
•
PVID, and removes the port from the 802.1X guest VLAN. After the
user logs off, the user configured PVID restores.
• If the authentication server assigns no VLAN, the user configured PVID
applies. The user and all subsequent 802.1X users are assigned to the
user-configured PVID. After the user logs off, the PVID remains
unchanged.
On a port that performs MAC-based access control:
Authentication status
VLAN manipulation
A user has not passed
802.1X authentication yet.
The device creates a mapping between the MAC address of the user and
the 802.1X guest VLAN. The user can access resources in the guest
VLAN.
A user in the 802.1X guest
VLAN fails 802.1X
authentication.
A user in the 802.1X guest
VLAN passes 802.1X
authentication.
If an 802.1X Auth-Fail VLAN is available, the device remaps the MAC
address of the user to the Auth-Fail VLAN. The user can access only
resources in the Auth-Fail VLAN.
If no 802.1X Auth-Fail VLAN is configured, the user is still in the guest
VLAN.
The device remaps the MAC address of the user to the authorized VLAN.
If the authentication server assigns no authorized VLAN, the device
remaps the MAC address of the user to the initial PVID on the port.
To use the 802.1X guest VLAN function on a port that performs MAC-based access control, make sure the
port is a hybrid port, and enable MAC-based VLAN on the port.
The network device assigns a hybrid port to an 802.1X guest VLAN as an untagged member.
Auth-Fail VLAN
You can configure an Auth-Fail VLAN to accommodate users that have failed 802.1X authentication
because of the failure to comply with the organization security strategy, such as using a wrong password.
Users in the Auth-Fail VLAN can access a limited set of network resources, such as a software server, to
download anti-virus software and system patches.
The Auth-Fail VLAN does not accommodate 802.1X users that have failed authentication for
authentication timeouts or network connection problems. The way that the network access device
handles VLANs on the port differs by 802.1X access control mode.
•
On a port that performs port-based access control:
330
Authentication status
VLAN manipulation
A user fails 802.1X
authentication.
The device assigns the Auth-Fail VLAN to the port as the PVID. All 802.1X
users on this port can access only resources in the Auth-Fail VLAN.
A user in the Auth-Fail VLAN
fails 802.1X
re-authentication.
The Auth-Fail VLAN is still the PVID on the port, and all 802.1X users on
this port are in this VLAN.
• The device assigns the VLAN specified for the user to the port as the
A user passes 802.1X
authentication.
•
PVID, and removes the port from the Auth-Fail VLAN. After the user
logs off, the user-configured PVID restores.
• If the authentication server assigns no VLAN, the initial PVID applies.
The user and all subsequent 802.1X users are assigned to the
user-configured PVID. After the user logs off, the PVID remains
unchanged.
On a port that performs MAC-based access control:
Authentication status
VLAN manipulation
A user fails 802.1X
authentication.
The device remaps the MAC address of the user to the Auth-Fail VLAN.
The user can access only resources in the Auth-Fail VLAN.
A user in the Auth-Fail VLAN
fails 802.1X
re-authentication.
The user is still in the Auth-Fail VLAN.
A user in the Auth-Fail VLAN
passes 802.1X
authentication.
The device remaps the MAC address of the user to the server-assigned
VLAN.
If the authentication server assigns no VLAN, remaps the MAC address of
the user to the initial PVID on the port.
To perform the 802.1X Auth-Fail VLAN function on a port that performs MAC-based access control, you
must ensure that the port is a hybrid port, and enable MAC-based VLAN on the port.
The network device assigns a hybrid port to an 802.1X Auth-Fail VLAN as an untagged member.
ACL assignment
You can specify an ACL for an 802.1X user to control its access to network resources. After the user
passes 802.1X authentication, the authentication server, either the local access device or a RADIUS
server, assigns the ACL to the port to filter the traffic from this user. In either case, you must configure the
ACL on the access device. You can change ACL rules while the user is online.
Configuration prerequisites
When you configure 802.1X, follow these restrictions and guidelines:
•
Configure an ISP domain and AAA scheme (local or RADIUS authentication) for 802.1X users. For
more information, see "Configuring AAA" and "Configuring RADIUS."
•
If RADIUS authentication is used, create user accounts on the RADIUS server.
•
If local authentication is used, create local user accounts on the access device and specify the LAN
access service for the user accounts. For more information, see "Configuring users."
331
Recommended configuration procedure
Step
Remarks
Required.
1.
Configuring 802.1X globally
This function enables 802.1X authentication globally. It also
configures the authentication method and advanced parameters.By
default, 802.1X authentication is disabled globally.
Required.
2.
Configuring 802.1X on a port
This function enables 802.1X authentication on the specified port and
configures 802.1X parameters for the port.By default, 802.1X
authentication is disabled on a port.
Configuring 802.1X globally
1.
From the navigation tree, select Authentication > 802.1X.
The 802.1X page appears.
Figure 308 Configuring 802.1X
2.
In the 802.1X Configuration area, select Enable 802.1X.
3.
Select an authentication method from the Authentication Method list.
Authentication Method list
{
{
{
CHAP—Sets the access device to perform EAP termination and use CHAP to communicate with
the RADIUS server.
PAP—Sets the access device to perform EAP termination and use PAP to communicate with the
RADIUS server.
EAP—Sets the access device to relay EAP packets, and supports any of the EAP authentication
methods to communicate with the RADIUS server.
When you configure EAP relay or EAP termination, consider the following factors:
332
4.
{
The support of the RADIUS server for EAP packets.
{
The authentication methods supported by the 802.1X client and the RADIUS server.
Click Advanced to expand the advanced 802.1X configuration area.
Figure 309 Configuring advanced 802.1X parameters
5.
Configure advanced 802.1X settings as described in Table 104, and then click Apply.
Table 104 Configuration items
Item
Description
Quiet
Sets whether to enable the quiet timer.
Quiet Period
Sets the value of the quiet timer.
Sets the maximum number of authentication request attempts.
Retry Times
The network access device retransmits an authentication request if it does not
receive a response to the request it has sent to the client within a period of time (set
by the TX Period or the Supplicant Timeout Time value). The network access
device stops retransmitting the request, if it has made the maximum number of
request transmission attempts but still received no response.
TX-Period
Sets the username request timeout timer.
Handshake Period
Sets the handshake timer.
Re-Authentication
Period
Sets the periodic online user re-authentication timer.
Supplicant Timeout
Time
Sets the client timeout timer.
Server Timeout Time
Sets the server timeout timer.
NOTE:
You can set the client timeout timer to a high value in a low-performance network, and adjust the
server timeout timer to adapt to the performance of different authentication servers. In most cases, the
default settings are sufficient.
Configuring 802.1X on a port
1.
From the navigation tree, select Authentication > 802.1X.
2.
In the Ports With 802.1X Enabled area, click Add.
3.
Configure 802.1X features on a port as shown in Figure 310, and then click Apply.
333
Figure 310 Configuring 802.1X on a port
Table 105 describes the configuration items.
Table 105 Configuration items
Item
Port
Port Control
Description
Selects a port where you want to enable 802.1X. Only ports not enabled
with 802.1X authentication are available.
802.1X configuration takes effect on a port only after 802.1X is enabled
both globally and on the port.
Selects an access control method for the port, MAC Based or Port Based.
Selects a port authorization state for 802.1X:
• Auto—Places the port initially in the unauthorized state to allow only
Port Authorization
EAPOL packets to pass, and after a user passes authentication, sets the
port in the authorized state to allow access to the network. You can use
this option in most scenarios.
• Force-Authorized—Places the port in the authorized state, enabling users
on the port to access the network without authentication.
• Force-Unauthorized—Places the port in the unauthorized state, denying
any access requests from users on the port.
Max Number of Users
Sets the maximum number of concurrent 802.1X users on the port.
Specifies whether to enable the online user handshake function.
Enable Handshake
This function enables the network access device to send handshake
messages to online users at the interval set by the Handshake Period setting.
If no response is received from an online user after the maximum number of
handshake attempts (set by the Retry Times setting) has been made, the
network access device sets the user in the offline state. For information about
the timers, see "Configuring 802.1X globally."
NOTE:
If the network has 802.1X clients that cannot exchange handshake packets with
the network access device, disable the online user handshake function to
prevent their connections from being inappropriately torn down.
334
Item
Description
Specifies whether to enable periodic online user re-authentication on the
port.
Periodic online user re-authentication tracks the connection status of online
users and updates the authorization attributes assigned by the server, such as
the ACL, and VLAN. The re-authentication interval is specified by the
Re-Authentication Period setting in Table 104.
NOTE:
• The periodic online user re-authentication timer can also be set by the
Enable Re-Authentication
authentication server in the session-timeout attribute. The server-assigned
timer overrides the timer setting on the access device, and it enables
periodic online user re-authentication, even if the function is not
configured on the access device. Support for the server assignment of
re-authentication timer and the re-authentication timer configuration on
the server vary with servers.
• The VLAN assignment status must be consistent before and after
re-authentication. If the authentication server has assigned a VLAN before
re-authentication, it must also assign a VLAN at re-authentication. If the
authentication server has assigned no VLAN before re-authentication, it
must not assign one at re-authentication. Violation of either rule can cause
the user to be logged off. The VLANs assigned to an online user before
and after re-authentication can be the same or different.
Guest VLAN
Specifies an existing VLAN as the guest VLAN.
For more information, see "Configuring an 802.1X guest VLAN."
Specifies whether to enable MAC-based VLAN.
Enable MAC VLAN
Required when MAC Based is selected for Port Control.
NOTE:
Only hybrid ports support the feature.
Auth-Fail VLAN
Specifies an existing VLAN as the Auth-Fail VLAN to accommodate users that
have failed 802.1X authentication.
For more information, see "Configuring an Auth-Fail VLAN."
Configuring an 802.1X guest VLAN
Configuration prerequisites
•
Create the VLAN to be specified as the 802.1X guest VLAN.
•
If the 802.1X-enabled port performs MAC-based access control, configure the port as a hybrid port,
enable MAC-based VLAN on the port, and assign the port to the 802.1X guest VLAN as an
untagged member.
Configuration guidelines
•
The 802.1X guest VLANs on different ports can be different.
•
Assign different IDs to the port VLAN and the 802.1X guest VLAN on a port, so the port can
correctly process incoming VLAN tagged traffic.
•
With 802.1X authentication, a hybrid port is always assigned to a VLAN as an untagged member.
After the assignment, do not reconfigure the port as a tagged member in the VLAN.
•
Use Table 106 when you configure multiple security features on a port.
335
Table 106 Relationships of the 802.1X guest VLAN and other security features
Feature
Relationship description
MAC authentication guest VLAN on a port that
performs MAC-based access control
Only the 802.1X guest VLAN take effect. A user that
fails MAC authentication will not be assigned to the
MAC authentication guest VLAN.
802.1X Auth-Fail VLAN on a port that performs
MAC-based access control
The 802.1X Auth-Fail VLAN has a higher priority.
Port intrusion protection on a port that performs
MAC-based access control
The 802.1X guest VLAN function has higher priority
than the block MAC action, but it has lower priority
than the shutdown port action of the port intrusion
protection feature.
Configuring an Auth-Fail VLAN
Configuration prerequisites
•
Create the VLAN to be specified as the 802.1X Auth-Fail VLAN.
•
If the 802.1X-enabled port performs MAC-based access control, configure the port as a hybrid port,
enable MAC-based VLAN on the port, and assign the port to the Auth-Fail VLAN as an untagged
member.
Configuration guidelines
•
The 802.1X Auth-Fail VLANs on different ports can be different.
•
Assign different IDs to the port VLAN and the 802.1X Auth-Fail VLAN on a port, so the port can
correctly process VLAN tagged incoming traffic.
•
Use Table 107 when configuring multiple security features on a port.
Table 107 Relationships of the 802.1X Auth-Fail VLAN with other features
Feature
Relationship description
MAC authentication guest VLAN on a port that
performs MAC-based access control
The 802.1X Auth-Fail VLAN has a high priority.
Port intrusion protection on a port that performs
MAC-based access control
The 802.1X Auth-Fail VLAN function has higher priority
than the block MAC action, but it has lower priority
than the shutdown port action of the port intrusion
protection feature.
802.1X configuration examples
MAC-based 802.1X configuration example
Network requirements
As shown in Figure 311, the access device performs 802.1X authentication for users that connect to port
GigabitEthernet 1/0/1. Implement MAC-based access control on the port, so the logoff of one user does
not affect other online 802.1X users. Enable periodic re-authentication of online users on the port, so that
the server can periodically update the authorization information of the users.
336
Use RADIUS servers to perform authentication, authorization, and accounting for the 802.1X users. If
RADIUS accounting fails, the access device logs the user off. The RADIUS servers run CAMS or IMC.
Configure the host at 10.1.1.1 as the primary authentication and secondary accounting servers, and the
host at 10.1.1.2 as the secondary authentication and primary accounting servers. Assign all users to the
ISP domain test.
Configure the shared key as name for packets between the access device and the authentication server,
and the shared key as money for packets between the access device and the accounting server.
Exclude the ISP domain name from the username sent to the RADIUS servers.
Specify the device to try up to 5 times at an interval of 5 seconds in transmitting a packet to the RADIUS
server until it receives a response from the server, and to send real time accounting packets to the
accounting server every 15 minutes.
Figure 311 Network diagram
Configuring IP addresses
# Assign an IP address to each interface as shown in Figure 311. Make sure the supplicant, switch, and
servers can reach each other. (Details not shown.)
Configuring the RADIUS servers
For more information about the RADIUS configuration, see "Configuring RADIUS."
Configuring 802.1X for the switch
1.
Configure global 802.1X:
a. From the navigation tree, select Authentication > 802.1X.
b. Select Enable 802.1X, select the authentication method as CHAP, and click Apply.
Figure 312 Configuring 802.1X globally
337
2.
Configure 802.1X for GigabitEthernet 1/0/1:
a. In the Ports With 802.1X Enabled area, click Add.
b. Select GigabitEthernet1/0/1 from the Port list, select Enable Re-Authentication, and click
Apply.
Figure 313 Configuring 802.1X for GigabitEthernet 1/0/1
Configuring the RADIUS scheme for the switch
1.
Configure authentication and accounting attributes for the RADIUS scheme:
a. From the navigation tree, select Authentication > RADIUS, and click Add.
b. Enter the scheme name system.
c. Select the server type Extended, and select Without domain name from the Username Format
list.
d. Click Advanced.
e. Enter name in the Authentication Key and Confirm Authentication Key fields.
f. Enter money in the Accounting Key and Confirm Accounting Key fields.
g. Enter 5 as the server timeout timer.
h. Enter 5 as the maximum number of request transmission attempts.
i.
Enter 15 as the realtime accounting interval.
338
Figure 314 Configuring the RADIUS scheme
2.
Configure the primary authentication server in the RADIUS scheme:
a. In the RADIUS Server Configuration area, click Add.
b. Select the server type Primary Authentication.
c. Enter the IP address 10.1.1.1, and enter the port number 1812.
339
d. Click Apply.
The RADIUS Server Configuration area displays the primary authentication server you have
configured.
3.
Configure the backup authentication server in the RADIUS scheme:
a. In the RADIUS Server Configuration area, click Add.
b. Select the server type Backup Authentication.
c. Enter the IP address 10.1.1.2, and enter the port number 1812.
d. Click Apply.
The RADIUS Server Configuration area displays the backup authentication server you have
configured.
4.
Configure the primary accounting server in the RADIUS scheme:
a. In the RADIUS Server Configuration area, click Add.
b. Select the server type Primary Accounting.
c. Enter the IP address 10.1.1.2, and enter the port number 1813.
d. Click Apply.
The RADIUS Server Configuration area displays the accounting server you have configured.
5.
Configure the secondary accounting server in the RADIUS scheme:
a. In the RADIUS Server Configuration area, click Add.
b. Select the server type Backup Accounting.
c. Enter the IP address 10.1.1.1, and enter the port number 1813.
d. Click Apply.
The RADIUS Server Configuration area displays the backup accounting server you have
configured.
6.
On the RADIUS configuration page, click Apply.
Configuring AAA for the scheme
1.
Create an ISP domain:
a. From the navigation tree, select Authentication > AAA.
The Domain Setup page appears.
b. Select test from the Domain Name list, and select Enable from the Default Domain list.
c. Click Apply.
340
Figure 315 Creating an ISP domain
2.
Configure AAA authentication method for the ISP domain:
a. Click the Authentication tab.
b. Select test from the Select an ISP domain list.
c. Select Default AuthN, select authentication method RADIUS from the Default AuthN list, and
select the authentication scheme system from the Name list, as shown in Figure 316.
Figure 316 Configuring AAA authentication method for the ISP domain
d. Click Apply.
A configuration progress dialog box appears, as shown in Figure 317.
341
Figure 317 Configuration progress dialog box
e. After the configuration process is complete, click Close.
3.
Configure AAA authorization method for the ISP domain:
a. Click the Authorization tab.
b. Select test from the Select an ISP domain list.
c. Select Default AuthZ, select the authorization method RADIUS from the Default AuthZ list, and
select the authorization scheme system from the Name list, as shown in Figure 318.
Figure 318 Configuring the AAA authorization method for the ISP domain
d. Click Apply.
A configuration progress dialog box appears.
e. After the configuration process is complete, click Close.
4.
Configure AAA accounting method for the ISP domain:
a. Click the Accounting tab.
b. Select test from the Select an ISP domain list.
c. Select Default Accounting, select the accounting method RADIUS as the default accounting
method, and select the accounting scheme system from the Name list, as shown in Figure 319.
342
Figure 319 Configuring the AAA accounting method for the ISP domain
d. Click Apply.
e. After the configuration process is complete, click Close.
802.X with ACL assignment configuration example
Network requirements
As shown in Figure 320, perform 802.1X authentication on port GigabitEthernet 1/0/1. Use the RADIUS
server at 10.1.1.1 as the authentication and authorization server and the RADIUS server at 10.1.1.2 as the
accounting server. Assign an ACL to GigabitEthernet 1/0/1 to deny the access of 802.1X users to the
FTP server at 10.0.0.1/24.
Figure 320 Network diagram
Configuring IP addresses
# Assign an IP address to each interface as shown in Figure 320. (Details not shown.)
Configuring a RADIUS scheme
1.
Create a RADIUS scheme:
a. From the navigation tree, select Authentication > RADIUS, and then click Add.
b. Enter the scheme name system.
c. Select the server type Extended.
343
d. Select Without domain name from the Username Format list.
e. Click Apply.
2.
Configure the primary authentication server in the RADIUS scheme:
a. In the RADIUS Server Configuration area, click Add.
b. Select the server type Primary Authentication.
c. Enter the IP address 10.1.1.1, and enter the port number 1812.
d. Enter expert in the Key and Confirm Key fields.
e. Click Apply.
Figure 321 Configuring the RADIUS authentication server
3.
Configure the primary accounting server in the RADIUS scheme:
a. In the RADIUS Server Configura