3Com SuperStack 3 Switch 3870 Family network switch Implementation Guide

PDF

Tài liệu

Quảng cáo

SuperStack

3 Switch 3870 Family

Implementation Guide

3CR17450-91

3CR17451-91

http://www.3com.com/

Part No. DUA1745-0BAA01

Published April 2004

3Com Corporation

350 Campus Drive

Marlborough, MA

USA 01752-3064

Copyright © 2004, 3Com Corporation. All rights reserved. No part of this documentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without written permission from 3Com Corporation.

3Com Corporation reserves the right to revise this documentation and to make changes in content from time to time without obligation on the part of 3Com Corporation to provide notification of such revision or change.

3Com Corporation provides this documentation without warranty, term, or condition of any kind, either implied or expressed, including, but not limited to, the implied warranties, terms or conditions of merchantability, satisfactory quality, and fitness for a particular purpose. 3Com may make improvements or changes in the product(s) and/or the program(s) described in this documentation at any time.

If there is any software on removable media described in this documentation, it is furnished under a license agreement included with the product as a separate document, in the hard copy documentation, or on the removable media in a directory file named LICENSE.TXT or !LICENSE.TXT. If you are unable to locate a copy, please contact 3Com and a copy will be provided to you.

UNITED STATES GOVERNMENT LEGEND

If you are a United States government agency, then this documentation and the software described herein are provided to you subject to the following:

All technical data and computer software are commercial in nature and developed solely at private expense.

Software is delivered as “Commercial Computer Software” as defined in DFARS 252.227-7014 (June 1995) or as a “commercial item” as defined in FAR 2.101(a) and as such is provided with only such rights as are provided in 3Com’s standard commercial license for the Software. Technical data is provided with limited rights only as provided in DFAR 252.227-7015 (Nov 1995) or FAR 52.227-14 (June 1987), whichever is applicable.

You agree not to remove or deface any portion of any legend provided on any licensed program or documentation contained in, or delivered to you in conjunction with, this User Guide.

Unless otherwise indicated, 3Com registered trademarks are registered in the United States and may or may not be registered in other countries.

3Com, SuperStack and the 3Com logo are registered trademarks of 3Com Corporation.

Intel and Pentium are registered trademarks of Intel Corporation. Microsoft, MS-DOS, Windows, and Windows

NT are registered trademarks of Microsoft Corporation. Novell and NetWare are registered trademarks of

Novell, Inc. UNIX is a registered trademark in the United States and other countries, licensed exclusively through X/Open Company, Ltd. Solaris is a registered trademark of Sun Microsystems.

IEEE and 802 are registered trademarks of the Institute of Electrical and Electronics Engineers, Inc.

All other company and product names may be trademarks of the respective companies with which they are associated.

ENVIRONMENTAL STATEMENT

It is the policy of 3Com Corporation to be environmentally-friendly in all operations. To uphold our policy, we are committed to:

Establishing environmental performance standards that comply with national legislation and regulations.

Conserving energy, materials and natural resources in all operations.

Reducing the waste generated by all operations. Ensuring that all waste conforms to recognized environmental standards. Maximizing the recyclable and reusable content of all products.

Ensuring that all products can be recycled, reused and disposed of safely.

Ensuring that all products are labelled according to recognized environmental standards.

Improving our environmental record on a continual basis.

End of Life Statement

3Com processes allow for the recovery, reclamation and safe disposal of all end-of-life electronic components.

Regulated Materials Statement

3Com products do not contain any hazardous or ozone-depleting material.

Environmental Statement about the Documentation

The documentation for this product is printed on paper that comes from sustainable, managed forests; it is fully biodegradable and recyclable, and is completely chlorine-free. The varnish is environmentally-friendly, and the inks are vegetable-based with a low heavy-metal content.

ONTENTS

BOUT

HIS

UIDE

Conventions 10

BOUT

HIS

UIDE

This guide describes the features of the 3Com ® SuperStack ® 3 Switch

3870 (24 Port or 48 Port, Managed 10/100/1000). It outlines how to use these features to optimize the performance of your network.

The terms Switch and Switch 3870 are used when referring to information that applies to both Switches.

Refer to the Management Quick Reference Guide that accompanies your

Switch for details of the specific features your Switch supports.

This guide is intended for the system or network administrator who is responsible for configuring, using, and managing the Switches. It assumes a working knowledge of local area network (LAN) operations and familiarity with communication protocols that are used to interconnect LANs.

For detailed descriptions of the Web interface operations and the

Command Line Interface (CLI) commands that you require to manage the

Switch please refer to the Management Interface Reference Guide supplied in HTML format on the CD-ROM that accompanies your Switch or on the 3Com Web site.

If release notes are shipped with your product and the information there differs from the information in this guide, follow the instructions in the release notes.

Most user guides and release notes are available in Adobe Acrobat

Reader Portable Document Format (PDF) or HTML on the 3Com

World Wide Web site:

http://www.3com.com/

BOUT

HIS

UIDE

Conventions

Table 1 and Table 2 list conventions that are used throughout this guide.

Table 1 Notice Icons

Icon Notice Type

Caution

Description

Information note Information that describes important features or instructions

Information that alerts you to potential loss of data or potential damage to an application, system, or device

Warning Information that alerts you to potential personal injury

Table 2 Text Conventions

Convention Description

Screen displays This typeface represents information as it appears on the screen.

Syntax

The word “syntax” means that you must evaluate the syntax provided and then supply the appropriate values for the placeholders that appear in angle brackets. Example:

To change your password, use the following syntax:

Commands

system password <password>

In this example, you must supply a password for <password>.

The word “command” means that you must enter the command exactly as shown and then press Return or Enter.

Commands appear in bold. Example:

To display port information, enter the following command:

The words “enter” and “type”

bridge port detail

When you see the word “enter” in this guide, you must type something, and then press Return or Enter. Do not press

Return or Enter when an instruction simply says “type.”

Keyboard key names If you must press two or more keys simultaneously, the key names are linked with a plus sign (+). Example:

Words in italics

Press Ctrl+Alt+Del

Italics are used to:

■

Emphasize a point.

■

Denote a new term at the place where it is defined in the text.

Identify menu names, menu commands, and software button names. Examples:

From the Help menu, select Contents.

Click OK.

Related Documentation

Documentation

In addition to this guide, each Switch documentation set includes the following:

■

SuperStack 3 Switch 3870 Family Getting Started Guide

This guide contains:

■ all the information you need to install and set up the Switch in its default state

■

■ information on how to access the management software to begin managing your Switch.

SuperStack 3 Switch 3870 Family Management Interface Reference

Guide

This guide provides detailed information about the Web interface and

Command Line Interface that enable you to manage your Switch. It is supplied in HTML format on the CD-ROM that accompanies your

Switch.

SuperStack 3 Switch 3870 Family Management Quick Reference

Guide

This guide contains:

■

■ a list of the features supported by your Switch.

a summary of the Web interface and Command Line Interface commands for the Switch.

Release Notes

These notes provide information about the current software release, including new features, modifications, and known problems.

There are other publications you may find useful, such as:

■

Documentation accompanying 3Com Network Supervisor. This is supplied on the CD-ROM that accompanies the Switch.

BOUT

HIS

UIDE

Documentation

Comments

Your suggestions are very important to us. They will help make our documentation more useful to you. Please e-mail comments about this document to 3Com at:

[email protected]

Please include the following information when contacting us:

■

Document title

Document part number (on the title page)

Page number (if appropriate)

Example:

■

SuperStack 3 Switch 3870 Family Implementation Guide

Part number: DUA1745-0BAA01

Page 25

Please note that we can only respond to comments and questions about

3Com product documentation at this e-mail address. Questions related to technical support or sales should be directed in the first instance to your network supplier.

WITCH

EATURES

VERVIEW

What is

Management

Software?

This chapter contains introductory information about the Switch management software and supported features. It covers the following topics:

■

What is Management Software?

Switch Features Explained

For detailed descriptions of the Web interface operations and the

Command Line Interface (CLI) commands that you require to manage the

Switch please refer to the Management Interface Reference Guide supplied in HTML format on the CD-ROM that accompanies your Switch.

Your Switch can operate in its default state. However, to make full use of the features offered by the Switch, and to change and monitor the way it works, you have to access the management software that resides on the

Switch. This is known as managing the Switch.

Managing the Switch can help you to improve its efficiency and therefore the overall performance of your network.

There are several different methods of accessing the management software to manage the Switch. These methods are explained in

Chapter 3 of the Getting Started Guide that accompanies your Switch.

HAPTER

1: S

WITCH

EATURES

VERVIEW

Switch Features

Explained

The management software provides you with the capability to change the default state of some of the Switch features. This section provides a brief overview of these features — their applications are explained in more detail later in this guide.

For a list of the features supported by your Switch, please refer to the

Management Quick Reference Guide that accompanies your Switch.

Aggregated Links

Aggregated links are connections that allow devices to communicate using up to two links in parallel. Aggregated links provide two benefits:

■

They can potentially increase the bandwidth of a connection.

■

They can provide redundancy — if one link is broken, the other link will still pass traffic.

For more information about aggregated links, see Chapter 2 “Optimizing

Bandwidth” .

Auto-negotiation

Auto-negotiation allows ports to auto-negotiate port speed, duplex-mode (only at 10 Mbps and 100 Mbps) and flow control. When auto-negotiation is enabled (default), a port “advertises” its maximum capabilities — these capabilities are by default the parameters that provide the highest performance supported by the port.

SFP ports do not support auto-negotiation of port speed.

Ports operating at 1000 Mbps only support full duplex mode.

For details of the auto-negotiation features supported by your Switch, please refer to the Management Quick Reference Guide that accompanies your Switch.

Duplex

Full duplex mode allows packets to be transmitted and received simultaneously and, in effect, doubles the potential throughput of a link.

Flow Control

All Switch ports support flow control, which is a mechanism that minimizes packet loss during periods of congestion on the network.

Switch Features Explained

Flow control is supported on ports operating in half duplex mode, and is implemented using the IEEE Std 802.3-2002 (incorporating 802.3x) on ports operating in full duplex mode.

For more information about auto-negotiation and port capabilities, see

Chapter 2 “Optimizing Bandwidth” .

Configuration Save and Restore

The Configuration Save and Restore feature allows the configuration of your Switch to be saved as a file on a remote server, or to be restored onto the Switch from a remote file. The configuration information is stored in an readable ASCII text file.

All configuration information that can be set using the Switch’s

Command Line Interface is saved and restored.

You must have read/write management access level to be able to save and restore the Switch configuration.

Important Considerations

■

3Com recommends the Switch unit is reset to its factory default settings before you restore a configuration onto it. You can reset the

Switch using the

system control initialize

CLI command or the

System > Control > Initialize Web interface operation.

■

The configuration can only be restored onto a device which has the same physical connections and configuration, as when the configuration was initially saved. The restore operation will be unsuccessful if the physical configuration of the device is different.

■

The configuration of the Switch must only be restored or saved by a single user at a time.

When using the Configuration Save and Restore feature, 3Com recommends that aggregated links are configured as either:

■

Manual aggregations with Link Aggregation Configuration

Protocol (LACP) disabled on the ports that are to be manually placed in the aggregated link.

■

LACP automatic aggregations — that is, LACP enabled on all ports and the aggregated links created automatically. The aggregated link should be enabled and Spanning Tree Protocol enabled.

HAPTER

1: S

WITCH

EATURES

VERVIEW

Parameters such as VLANs and Fast Start may be set up as required.

Other combinations of port settings, however, are not recommended as Configuration Restore will only perform a “best effort” restore of the configuration. For example, LACP automatic aggregations with manually defined ports are restored as manual aggregations with manual ports. LACP automatic aggregations with automatic ports where the aggregated link is disabled and Spanning Tree Protocol is disabled are restored as manual aggregations with the aggregated link disabled.

For further information about LACP, see Chapter 2 “Optimizing

Bandwidth” .

■

When restoring a configuration onto a unit over an aggregated link, communication with that unit may be lost because the restore operation disables the aggregated link ports. Communication over the aggregated links is re-established when the restore operation has been completed.

For detailed descriptions of the Configuration Save and Restore Web interface operations and Command Line Interface (CLI) commands, please refer to the Management Interface Reference Guide supplied in HTML format on the CD-ROM that accompanies your Switch.

Multicast Filtering

Multicast filtering allows the Switch to forward multicast traffic to only the endstations that are part of a predefined multicast group, rather than broadcasting the traffic to the whole network.

The multicast filtering system supported by your Switch uses IGMP

(Internet Group Management Protocol) snooping to detect the endstations in each multicast group to which multicast traffic should be forwarded.

For more information about multicast filtering, see

Chapter 3 “Using

Multicast Filtering” .

Rapid Spanning Tree

Protocol

Rapid Spanning Tree Protocol (RSTP) is a bridge-based systems that makes your network more resilient to link failure and also provides protection from network loops — one of the major causes of broadcast storms.

Switch Features Explained

RSTP allows you to implement alternative paths for network traffic in the event of path failure and uses a loop-detection process to:

■

Discover the efficiency of each path.

■

Enable the most efficient path.

Disable the less efficient paths.

Enable one of the less efficient paths if the most efficient path fails.

RSTP is an enhanced version of STP (Spanning Tree Protocol) and is fully compatible with STP systems. RSTP can restore a network connection quicker than the legacy STP feature. RSTP can detect if it is connected to a legacy device that only supports IEEE 802.1D STP and will automatically downgrade to STP on that particular port.

RSTP conforms to the IEEE Std 802.1w-2001.

For more information about RSTP, see

Chapter 5 “Using Resilience

Features” .

Switch Database

The Switch Database is an integral part of the Switch and is used by the

Switch to determine if a packet should be forwarded, and which port should transmit the packet if it is to be forwarded.

For more information about the Switch Database, see

Chapter 6 “Using the Switch Database”

Traffic Prioritization

The traffic prioritization capabilities of your Switch provides Class of

Service (CoS) prioritization to your network. You can prioritize traffic on your network to ensure that high priority data is transmitted with minimum delay.

For more information about traffic prioritization, see

Chapter 7 “Using

Traffic Management” .

Rate Limiting

Rate limiting is the restriction of the bandwidth to or from a section of your network. Limiting the rate of network traffic reduces the stress on your network and, when used with traffic prioritization, ensures that important traffic is not held up when the network is busy.

For more information about rate limiting, see

Chapter 7 “Using Traffic

Management” .

HAPTER

1: S

WITCH

EATURES

VERVIEW

RMON

Remote Monitoring (RMON) is an industry standard feature for traffic monitoring and collecting network statistics. The Switch software continually collects statistics about the LAN segments connected to the

Switch. If you have a management workstation with an RMON management application, the Switch can transfer these statistics to your workstation on request or when a pre-defined threshold is exceeded.

For more information about RMON and Event Notification, see

Chapter 8

“Status Monitoring and Statistics” .

Broadcast Storm

Control

Broadcast Storm Control is a system that monitors the level of broadcast traffic on that port.

If the broadcast traffic level rises to a pre-defined number of frames per second (threshold), the broadcast traffic on the port is blocked until the broadcast traffic level drops below the threshold. This system prevents the overwhelming broadcast traffic that can result from network equipment which is faulty or configured incorrectly.

VLANs

A Virtual LAN (VLAN) is a flexible group of devices that can be located anywhere in a network, but which communicate as if they are on the same physical segment. With VLANs, you can segment your network without being restricted by physical connections — a limitation of traditional network design. As an example, with VLANs you can segment your network according to:

■

Departmental groups

■

Hierarchical groups

Usage groups

For more information about VLANs, see Chapter 9 “Setting Up Virtual

LANs” .

Automatic IP

Configuration

Your Switch can have its IP information automatically configured using a

DHCP server. Alternatively, you can manually configure the IP information.

For more information about how the automatic IP configuration feature works, see

Chapter 10 “Using Automatic IP Configuration” .

Switch Features Explained

Port Security

Your Switch supports the following port security modes, which you can set for an individual port or a range of ports:

■

No Security

Port security is disabled and all network traffic is forwarded through the port without any restrictions.

■

Learning Off

All currently learnt addresses on the port are made permanent. Any packets containing a source address not learnt on the port will be dropped.

■

Automatic Learning

You can limit the number of addresses that can be learned on individual ports.

Network Login

Connections are only allowed on a port once the client has been authenticated by a RADIUS server.

The maximum number of permanent addresses on the Switch is 1000.

For more information about how the automatic IP configuration feature works, see

Chapter 10 “Using Automatic IP Configuration” .

HAPTER

1: S

WITCH

EATURES

VERVIEW

PTIMIZING

ANDWIDTH

There are many ways you can optimize the bandwidth on your network and improve network performance. If you utilize certain Switch features you can provide the following benefits to your network and end users:

■

Increased bandwidth

Quicker connections

Faster transfer of data

Minimized data errors

Reduced network downtime

For detailed descriptions of the Web interface operations and the

Command Line Interface (CLI) commands that you require to manage the

Switch please refer to the Management Interface Reference Guide supplied in HTML format on the CD-ROM that accompanies your Switch.

Port Features

The default state for all the features detailed below provides the best configuration for most users. In normal operation, you do not need to

alter the Switch from its default state. However, under certain conditions you may wish to alter the default state of these ports, for example, if you are connecting to old equipment that does not comply with the IEEE

802.3x standard.

Duplex

Full duplex allows packets to be transmitted and received simultaneously and, in effect, doubles the potential throughput of a link. Half duplex only allows packets to be transmitted or received at any one time.

HAPTER

2: O

PTIMIZING

ANDWIDTH

To communicate effectively, both devices at either end of a link must use the same duplex mode. If the devices at either end of a link support auto-negotiation, this is done automatically. If the devices at either end of a link do not support auto-negotiation, both ends must be manually set to full duplex or half duplex accordingly.

Ports operating at 1000 Mbps support full duplex mode only.

Flow Control

All Switch ports support flow control, which is a mechanism that prevents packet loss during periods of congestion on the network. Packet loss is caused by one or more devices sending traffic to an already overloaded port on the Switch. Flow control prevents packet loss by inhibiting the transmitting port from generating more packets until the period of congestion ends.

Flow control is implemented using the IEEE Std 802.3-2002

(incorporating 802.3x) for ports operating in full duplex mode, and

Intelligent Flow Management (IFM) for ports operating in half duplex mode.

Auto-negotiation

Auto-negotiation allows ports to automatically determine the best port speed, duplex-mode (only at 10 Mbps and 100 Mbps) and flow control.

When auto-negotiation is enabled (default), a port “advertises” its maximum capabilities — these capabilities are by default the parameters that provide the highest performance supported by the port.

You can modify the capabilities that a port “advertises” on a per port basis, dependant on the type of port.

You can disable auto-negotiation for the whole Switch, or per port. You can also modify the capabilities that a port “advertises” on a per port basis, dependant on the type of port.

SFP ports do not support auto-negotiation of port speed.

Ports operating at 1000 Mbps support full duplex mode only.

If auto-negotiation is disabled, the auto-MDIX feature does not operate on the ports. Therefore the correct cables, that is, cross-over or straight-through need to be used. For more information, see the Getting

Started Guide that accompanies your Switch.

Aggregated Links

Ports at both ends of the link should be set to auto-negotiate.

Aggregated Links

Aggregated links are connections that allow devices to communicate using two member links in parallel. Aggregated links provide the following benefits:

■

They can potentially increase the bandwidth of a connection. The capacity of the multiple links is combined into one logical link.

They can provide redundancy — if one link is broken, the other link will still pass traffic.

A maximum of 32 aggregated links can be created on a unit.

Your Switch supports aggregated links on the 10/100/1000 and SFP ports. An aggregation can be created by using two 10/100/1000 ports, two SFP ports or one SFP port and one 10/100/1000 port.

Figure 1 shows two Switches connected using an aggregated link

containing two member links. If both ports on both Switch units are configured as 1000BASE-TX and they are operating in full duplex, the potential maximum bandwidth of the connection is 2 Gbps.

Figure 1 Switch units connected using an aggregated link

Switch

Aggregated Link

Switch

How 802.3ad Link

Aggregation

Operates

Your Switch supports IEEE Std 802.3-2002 (incorporating 802.3ad) aggregated links which use the Link Aggregation Control Protocol

(LACP). LACP provides automatic, point-to-point redundancy between two devices (switch-to-switch or switch-to-server) that have full duplex connections operating at the same speed.

By default, LACP is disabled on all Switch ports.

HAPTER

2: O

PTIMIZING

ANDWIDTH

If a member link in an aggregated link fails, the traffic using that link is dynamically reassigned to the remaining member links in the aggregated

link. Figure 2

shows the simplest case: two member links, that is the physical links, form an aggregated link. In this example, if link 1 fails, the data flow between X and B is remapped to physical link 2. The re-mapping occurs as soon as the Switch detects that a member link has failed — almost instantaneously. As a result, aggregated link configurations are extremely resilient and fault-tolerant.

Figure 2 Dynamic Reassignment of Traffic Flows

Switch

Physical Link 1

X B

Physical Link 2

Aggregated Link

The key benefits of 802.3ad link aggregation are:

■

Automatic configuration — Network management does not need to be used to manually aggregate links.

Rapid configuration and reconfiguration — Approximately one to three seconds.

Compatibility — Non-802.3ad devices can interoperate with 802.3ad enabled devices. However, you will need to manually configure the aggregated links as LACP will not be able to automatically detect and form an aggregation with a non-802.3ad device.

The operation of 802.3ad can be configured and managed via network management.

Aggregated Links

Implementing

802.3ad Aggregated

Links

LACP can be enabled or disabled on a per port basis. You can implement

802.3ad aggregated links in two ways:

■

Manual Aggregations — You can manually add and remove ports to and from an aggregated link via Web commands. However, if a port has LACP enabled, and if a more appropriate or correct automatic membership is detected by LACP, it will override the manual configuration.

LACP Automatic Aggregations — If LACP detects the two active ports sharing the same partner device, and if no matching pre-configured aggregated links exist, LACP will automatically assign both ports to form an aggregated link with the partner device.

If you have an existing single port connection between two devices, this automatic behavior allows quick and easy addition of extra bandwidth by simply adding an extra physical link between the units.

The Spanning Tree costs for a port running LACP is the cost assigned for an aggregated link running at that speed. As required by the IEEE Std

802.3-2002 (incorporating 802.3ad), no changes in cost are made according to the number of member links in the aggregated link.

Aggregated Links and

Your Switch

When any port is assigned to an aggregated link (either manually or via

LACP) it will adopt the configuration settings of the aggregated link.

When a port leaves an aggregated link its original configuration settings are restored.

■

You Switch a single aggregated link comprising both 10/100/1000 ports, both SFP ports or one SFP port and one 10/100/1000 port.

A LinkUp / LinkDown trap will only be sent for individual links. The

Traps will not be sent for an aggregation.

When setting up an aggregated link, note that:

■

The ports at both ends of a member link must be configured as members of an aggregated link, if you are manually configuring aggregated links.

■

A member link port can only belong to one aggregated link.

The member link ports can be mixed media, that is fiber and/or twisted pair ports within the same aggregated link.

The member link ports must have the same configuration.

HAPTER

2: O

PTIMIZING

ANDWIDTH

When using an aggregated link, note that:

■

To gather statistics about an aggregated link, you must add together the statistics for each port in the aggregated link.

If you wish to disable a single member link of an aggregated link, you must first physically remove the connection to ensure that you do not lose any traffic, before you disable both ends of the member link separately. If you do this, the traffic destined for that link is distributed to the other links in the aggregated link.

If you do not remove the connection and only disable one end of the member link port, traffic is still forwarded to that port by the aggregated link port at the other end. This means that a significant amount of traffic may be lost.

Before removing an entire aggregated link, you must disable all the aggregated link ports or disconnect all the links, except one — if you do not, a loop may be created.

When manually creating an aggregated link between two devices, the ports in the aggregated link must not be physically connected together until the aggregated link has been correctly configured at both ends of the link. Failure to configure the aggregated link at both ends before physically connecting the ports can result in a number of serious network issues such as lost packets and network loops.

Traffic Distribution and Link Failure on Aggregated Links

To maximize throughput, all traffic is distributed across the individual links that make up an aggregated link. Therefore, when a packet is made available for transmission down an aggregated link, a hardware-based traffic distribution mechanism determines which particular port in the link should be used. The traffic is distributed among the member links as efficiently as possible.

To avoid the potential problem of out-of-sequence packets (or “packet re-ordering”), the Switch ensures that all the conversations between a given pair of endstations will pass through the same port in the aggregated link. Single-to-multiple endstation conversations, on the other hand, may still take place over different ports.

Aggregated Links

If the link state on any of the ports in an aggregated link becomes inactive due to link failure, then the Switch will automatically redirect the aggregated link traffic to the remaining ports. Aggregated links therefore provide built-in resilience for your network.

The Switch also has a mechanism to prevent the possible occurrence of packet re-ordering when a link recovers too soon after a failure.

Aggregated Link —

Manual

Configuration

Example

The example shown in

Figure 3 illustrates a 2 Gbps aggregated link

between two Switch units, (that is, each port is operating at 1000 Mbps, full duplex).

Figure 3 A 2 Gbps aggregated link between two Switch units

Core Switch

Switch

2 Gbps Aggregated Link

To manually set up this configuration:

1 Prepare ports 5 and 7 on the core Switch for aggregated links. To do this:

a Check that the ports have an identical configuration using your preferred management interface.

b Add the ports 5 and 7 on the specified unit to the aggregated link.

2 Prepare ports 23 and 24 on the 24 Port Switch (or ports 47 and 48 if you are configuring a 48 Port Switch) for aggregated links. To do this:

a Check that the ports have an identical configuration using your preferred management interface.

b Add ports 23 and 24 on the 24 Port Switch (or ports 47 and 48 if you are configuring a 48 Port Switch) to the aggregated link.

HAPTER

2: O

PTIMIZING

ANDWIDTH

3 Connect port 5 on the core Switch to port 23 on the 24 Port Switch or port 47 if you are configuring a 48 Port Switch.

4 Connect port 7 on the core Switch to port 24 on the 24 Port Switch or port 48 if you are configuring a 48 Port Switch.

SING

ULTICAST

ILTERING

What is an IP

Multicast?

Multicast filtering improves the performance of networks that carry multicast traffic.

This chapter explains multicasts, multicast filtering, and how multicast filtering can be implemented on your Switch. It covers the following topics:

■

What is an IP Multicast?

Multicast Filtering

IGMP Multicast Filtering

For detailed descriptions of the Web interface operations and the

Command Line Interface (CLI) commands that you require to manage the

Switch please refer to the Management Interface Reference Guide supplied in HTML format on the CD-ROM that accompanies your Switch.

A multicast is a packet that is intended for “one-to-many” and “many- to-many” communication. Users explicitly request to participate in the communication by joining an endstation to a specific multicast group. If the network is set up correctly, a multicast can only be sent to an endstation or a subset of endstations in a LAN, or VLAN, that belong to the relevant multicast group.

Multicast group members can be distributed across multiple subnetworks; thus, multicast transmissions can occur within a campus

LAN or over a WAN. In addition, networks that support IP multicast send only one copy of the desired information across the network until the delivery path that reaches group members diverges. It is only at these points that multicast packets are replicated and forwarded, which makes efficient use of network bandwidth.

HAPTER

3: U

SING

ULTICAST

ILTERING

A multicast packet is identified by the presence of a multicast group address in the destination address field of the packet’s IP header.

Benefits of Multicast

The benefits of using IP multicast are that it:

■

Enables the simultaneous delivery of information to many receivers in the most efficient, logical way.

■

Reduces the load on the source (for example, a server) because it does not have to produce multiple copies of the same data.

Makes efficient use of network bandwidth and scales well as the number of participants or collaborators expands.

Works with other IP protocols and services, such as Quality of Service

(QoS).

There are situations where a multicast approach is more logical and efficient than a unicast approach. Application examples include distance learning, transmitting stock quotes to brokers, and collaborative computing.

A typical use of multicasts is in video-conferencing, where high volumes of traffic need to be sent to several endstations simultaneously, but where broadcasting that traffic to all endstations would seriously reduce network performance.

Multicast Filtering

Multicast filtering is the process that ensures that endstations only receive multicast traffic if they register to join specific multicast groups. With multicast filtering, network devices only forward multicast traffic to the ports that are connected to registered endstations.

Figure 4 shows how a network behaves without multicast filtering and

with multicast filtering.

Figure 4 The effect of multicast filtering

Multicast Filtering

Multicast Filtering and Your Switch

Your Switch provides automatic multicast filtering support using IGMP

(Internet Group Management Protocol) Snooping. It also supports IGMP query mode.

Snooping Mode

Snooping Mode allows your Switch to forward multicast packets only to the appropriate ports. The Switch “snoops” on exchanges between endstations and an IGMP device, typically a router, to find out the ports that wish to join a multicast group and then sets its filters accordingly

The Switch 3870 is compatible with any device that conforms to the

IGMP v2 protocol. The Switch does not support IGMP v3. If you have an

IGMP v3 network, you should disable IGMP snooping for the Switch using the

snoopMode command on the Web Interface.

HAPTER

3: U

SING

ULTICAST

ILTERING

IGMP Multicast

Filtering

IGMP is the system that all IP-supporting network devices use to register endstations with multicast groups. It can be used on all LANs and VLANs that contain a multicast capable IP router and on other network devices that support IP.

IGMP multicast filtering works as follows:

1 The IP router (or querier) periodically sends query packets to all the endstations in the LANs or VLANs that are connected to it. If your network has more than one IP router, then the one with the lowest IP address becomes the querier.

2 When an IP endstation receives a query packet, it sends a report packet back that identifies the multicast group that the endstation would like to join.

3 When the report packet arrives at a port on a Switch with IGMP multicast

learning enabled, the Switch learns that the port is to forward traffic for the multicast group and then forwards the packet to the router.

4 When the router receives the report packet, it registers that the LAN or

VLAN requires traffic for the multicast groups.

5 When the router forwards traffic for the multicast group to the LAN or

VLAN, the Switch units only forward the traffic to ports that received a report packet.

Enabling IGMP Multicast Learning

You can enable or disable multicast learning using the snoopMode command on the Web interface. For more information about enabling

IGMP multicast learning, please refer to the Management Interface

Reference Guide supplied on your Switch CD-ROM.

If IGMP multicast learning is not enabled then IP multicast traffic is always forwarded, that is, it floods the network.

For information about configuring IGMP functionality on an endstation, refer to the user documentation supplied with your endstation or the endstation’s Network Interface Card (NIC).

How IGMP Supports IP Multicast

How IGMP

Supports IP

Multicast

IGMP provides a way for routers and switches to learn where group members exist on a network, and thus provides a critical function in the IP multicast packet delivery process.

Electing the Querier

On each subnetwork or broadcast domain (VLAN), the communication between routers, switches, and group members begins with one

IGMP-capable device being elected as the querier - that is, the device that asks all hosts to respond with a report of the IP multicast groups that they wish to join or to which they already belong. The querier is always the device with the lowest IP address in the subnetwork. It can be a router or a Layer 2 switch. The network traffic flows most efficiently if the querier is the closest device to the sources of IP multicast traffic.

Query Messages

The querier normally sends messages called IGMP Host Membership

Query Messages, or queries, every 125 seconds. All the hosts hear the query because it is addressed to 224.0.0.1, the all systems on this subnetwork Class D address. A query is not forwarded beyond the subnetwork from which it originates.

Host Messages

Hosts use IGMP to build their own types of IP multicast messages, as described in this section.

Response to Queries

Hosts respond to queries with IGMP Host Membership Report messages, or simply IGMP reports. These reports do not travel beyond their origin subnetworks, and hosts send them at random intervals to prevent the querier from being overwhelmed.

A host sends a separate report for each group that it wants to join or to which it currently belongs. Hosts do not send reports if they are not group members.

If a router does not receive at least one host report for a particular group after two queries, the router assumes that members no longer exist and it prunes the interface for that source-group spanning tree.

HAPTER

3: U

SING

ULTICAST

ILTERING

Join Message

Rather than wait for a query, a host can also send an IGMP report on its own initiative to inform the querier that it wants to begin receiving a transmission for a specific group (perhaps by clicking a Go or Start button on the client interface). This is called a join message. The benefit is faster transmission linkages, especially if the host is the first group member on the subnetwork.

Leave-Group Messages

Leave-group messages are a type of host message defined in IGMP version 2. If a host wants to leave an IP multicast group, it issues a leave-group message addressed to 224.0.0.2, the all routers in this subnetwork Class D address. Upon receiving such a message, the querier determines whether that host is the last group member on the subnetwork by issuing a group-specific query.

Leave-group messages lower leave latency - that is, the time between when the last group member on a given subnetwork sends a report and when a router stops forwarding traffic for that group onto the subnetwork. This process conserves bandwidth. The alternative is for the router to wait for at least two queries to go unanswered before pruning that subnetwork from the delivery tree.

Role of IGMP in IP

Multicast Filtering

To further refine the IP multicast delivery process and maximize bandwidth efficiency, a Layer 3 module filters IP multicast packets on appropriate ports using a process called IGMP snooping. Both bridged interfaces and routed interfaces record which ports receive host IGMP reports and then set their filters accordingly so that IP multicast traffic for particular groups is not forwarded on ports or VLANs that do not require it.

TACK

ANAGEMENT

This chapter describes how to use the stack management capabilities of your Switch. The Switch 3870 can create mixed stacks of up to eight units high which can be managed as a single system when connected together.

The stack system is based on a centralized stacking topology whereby one master unit represents the whole stack.

Some combinations of stacked 24 and 48 port units restrict the number of modules supported by the stack.

Table 3

shows which stack configurations restrict the number of supported modules:

Table 3 Maximum Stack Configurations

Type of Unit

48 Port

24 Port

Total Units in the Stack Maximum Modules

This chapter covers the following topics:

■

Master Election

Topology Discovery

Auto Unit ID Assignment

Image Checking

System Initialization

Operating in Special Stacking Mode

Recovering from a Master Unit Failure

HAPTER

4: S

TACK

ANAGEMENT

Master Election

When the stack is powered up and completes the bootup process, the master unit is determined through the Master Election process.

The master unit election is based on the following rules:

■

If a unit has previously been elected as the master unit and it has been running for more than 20 seconds the it enters ‘non-preemptive mode’. This means that the unit will remain the master unit and the other units in the stack will be backup master units.

If no units are in non-preemptive mode or if multiple units are in non-preemptive mode, the unit with the lowest MAC address is elected as the master unit. This could occur if multiple, individual master units are connected to form a stack.

Backup Master Units

All non-master units in the stack are considered backup master units and can perform the functions of a master unit if the elected master unit is no longer available.

If the master unit fails, is power cycled or a stack topology change is detected, then the system will perform the following tasks:

■

Re-elect a new master unit.

Synchronize all units in the stack with the latest configuration information that is stored on the master unit.

Topology Discovery

Once the master unit has been elected, it performs a Topology Discovery in order to build up a database containing information about each of the other units in the stack.

The information collected from each unit is as follows:

■

Unit Configuration (model and description)

Software Version

Hardware Version

CPU Version

Device MAC Address

Device Serial Number

Auto Unit ID

Assignment

Image Checking

Auto Unit ID Assignment

■

EPLD version (if any)

If a module is fitted, the information collected also includes:

■

Module Type and Status

Module Software Version

Module Hardware Version

Module CPU Version

Module Serial Number

Module EPLD Version

Once the Topology Discovery is complete, the master unit does the following:

■

Assigns a Unit ID — This is assigned to each unit in the stacking system and is used for system configuration and simple management.

Only the master unit can assign an ID to each unit in the stack. If a unit already has a Unit ID stored in its FLASH memory, then the master unit will re-assign this same Unit ID to the unit. If the unit does not already have a Unit ID, then the master unit will assign it the next available Unit ID.

■

Generates a Unit ID Table — This is generated by the master unit to map MAC addresses and Unit IDs. The master unit maintains and updates the Unit ID table when the Unit ID assignment is completed and saves it to its FLASH memory. The table is updated if a new unit is added to the stack.

After the Unit IDs have been assigned, the master unit performs a consistency check to ensure that all the units and expansion modules in the stack are running the same version of firmware. Units and expansion modules run different firmware, however, the unit firmware and expansion module firmware are combined into a single downloadable image. This is achieved using the information gathered during Topology

Discovery.

If the ‘next boot firmware’ version of any unit in the stack (that is, the image to run after the next reboot) is not the same as the master unit’s, the stack will operate in Special Stacking Mode as follows:

HAPTER

4: S

TACK

ANAGEMENT

■

The master unit starts normal operation mode in standalone mode.

The master unit can see all units in the stack and maintain stack topology.

None of the other units can function (all ports will be disabled).

All user-initiated commands to configure the non-functioning units are dropped. The master unit, however, will be able to communicate the following information to the non-functioning units:

■

Image downloads

Stack topology information

System configuration information already stored on the master

System

Initialization

If the master unit determines during image checking that all units and expansion modules are running the same version of firmware, the system will be initialized for Normal Stacking Mode. If not, then the system will be initialized for Special Stacking Mode.

System Initialization for Normal Stacking

Mode

The master unit initializes the stack using the last saved system configuration that is stored in its local FLASH memory. To conserve FLASH space, the configuration is stored as a plain text file containing only those settings which differ from the system default settings.

The master unit looks for changes to the configuration (for example, port settings, VLAN settings and parameter changes) and saves these changes to its FLASH memory. Two ‘rotating’ files are used in FLASH memory so that only the two most recent sets of changes are available. Changes are saved to one file and the next time are saved to the next file. If the configuration changes again, the first file is overwritten.

If the configuration file contains information (such as the MAC address and Unit ID) for units that appear in the Unit ID table, then the system will apply the configuration to those units. The system will apply default settings to any units which do not have configuration information in the file.

If a system file is corrupted, the master unit will initialize the stack and set it to the Factory Default Configuration.

Operating in Special Stacking Mode

System Initialization for Special Stacking

Mode

In this mode, only the master unit is initialized with system configuration information. The other units are not initialized and are forced to remain in non-operational mode, where all ports are disabled by default.

Operating in

Special Stacking

Mode

With the stack running in Special Stacking mode, your use of management commands is limited. 3Com recommends that you monitor and upgrade the stack in one of the following ways:

CLI/Telnet/Web

Interface

In Special Stacking mode, the master unit displays warning messages whenever you log into the system through CLI, Telnet or Web, that inform you that an image download is required.

You can use a CLI, Web or SNMP command to download the run-time image from the remote server to the master unit. The master unit stores the image as its ‘Next boot image’ and downloads the image to those slave units that are running a different image version.

3Com Network

Supervisor (3NS)

During its Network Discovery process, 3NS runs a report that detects stack misconfigurations. If you notice inconsistent firmware versions on the report then you will need to upgrade the device via the 3NS agent upgrade. The image is downloaded to the master which automatically downloads this version of the software to all the other units.

When the image download has completed, the whole stack is automatically rebooted and each image in the new stack boots up with the new image.

Recovering from a

Master Unit Failure

During normal operation, the master unit sends ‘heartbeat’ messages to each unit in the stack to indicate that it is still running. If the master unit fails, the other units in the stack will detect this and the stack will go through another master election process, where the unit with the lowest

MAC address becomes the new master unit. During the election process and the associated follow-on operations (topology discovery, unit ID assignment, image checking, system initialization), traffic on the network will be disrupted for up to two minutes while the stack recovers.

HAPTER

4: S

TACK

ANAGEMENT

SING

ESILIENCE

EATURES

Setting up resilience on your network helps protect critical links against failure, protects against network loops, and reduces network downtime to a minimum.

The Switch provides resilient links using the Rapid Spanning Tree Protocol

(RSTP). The protocol configures itself automatically based on the surrounding network and is compatible with switches that use either the

Spanning Tree Protocol (STP) or RSTP.

For detailed descriptions of the Web interface operations and the

Command Line Interface (CLI) commands that you require to manage the

Switch please refer to the Management Interface Reference Guide supplied in HTML format on the CD-ROM that accompanies your Switch.

HAPTER

5: U

SING

ESILIENCE

EATURES

Rapid Spanning

Tree Protocol

The Rapid Spanning Tree Protocol makes your network more resilient to link failure and also provides a protection from loops — one of the major causes of broadcast storms. RSTP is enabled by default on your Switch.

To be fully effective, RSTP or STP must be enabled on all Switches in your network.

RSTP provides the same functionality as STP. For details on how the two systems differ, see

“How RSTP Differs to STP” on page 47 .

The following sections explain more about STP and the protocol features supported by your Switch. They cover the following topics:

■

What is STP?

How STP Works

■

Using STP on a Network with Multiple VLANs

The protocol is a part of the IEEE Std 802.1w-2001, bridge specification.

To explain RSTP more effectively, your Switch will be referred to as a bridge.

Rapid Spanning Tree

Protocol (RSTP)

The Rapid Spanning Tree (RSTP) is an enhanced Spanning Tree feature.

RSTP implements the Spanning Tree Algorithm and Protocol, as defined in the IEEE Std 802.1w-2001.

Some of the benefits of RSTP are:

■

Faster determination of the Active Spanning Tree topology throughout a bridged network.

Support for bridges with more than 256 ports.

Support for the Fast-Forwarding configuration of edge ports provided by the 'Fast Start' feature. Fast Start allows a port that is connected to an endstation to begin forwarding traffic after only 4 seconds. During this 4 seconds RSTP (or STP) will detect any misconfiguration that may cause a temporary loop and react accordingly.

Easy deployment throughout a legacy network, through backward compatibility:

■ it will default to sending 802.1D style BPDU's on a port if it receives packets of this format.

What is STP?

What is STP?

■

■ it is possible for some ports on a Switch to operate in RSTP

(802.1w) mode, and other ports, for example those connected to a legacy Switch, to operate in STP (802.1D) mode. you have an option to force your Switch to use the legacy 802.1D version of Spanning Tree, if required.

STP (802.1D) is a bridge-based system that allows you to implement parallel paths for network traffic and uses a loop-detection process to:

■

Find and disable the less efficient paths (that is, the paths that have a lower bandwidth).

Enable one of the less efficient paths if the most efficient path fails.

RSTP provides the same functionality as STP. For details on how the two systems differ, see

“How RSTP Differs to STP” on page 47 .

As an example,

Figure 5 shows a network containing three LAN segments

separated by three bridges. With this configuration, each segment can communicate with the others using two paths. Without STP enabled, this configuration creates loops that cause the network to overload.

Figure 5 A network configuration that creates loops

Figure 6 shows the result of enabling STP on the bridges in the

configuration. STP detects the duplicate paths and prevents, or blocks, one of them from forwarding traffic, so this configuration will work satisfactorily. STP has determined that traffic from LAN segment 2 to LAN segment 1 can only flow through Bridges C and A, because, for example, this path has a greater bandwidth and is therefore more efficient.

HAPTER

5: U

SING

ESILIENCE

EATURES

Figure 6 Traffic flowing through Bridges C and A

If a link failure is detected, as shown in Figure 7

, the STP process reconfigures the network so that traffic from LAN segment 2 flows through Bridge B.

Figure 7 Traffic flowing through Bridge B

STP determines which is the most efficient path between each bridged segment and a specifically assigned reference point on the network. Once the most efficient path has been determined, all other paths are blocked.

Therefore, in

Figure 5 ,

Figure 6 , and Figure 7 , STP initially determined that

the path through Bridge C was the most efficient, and so blocked the path through Bridge B. After the failure of Bridge C, STP re-evaluated the situation and opened the path through Bridge B.

How STP Works

How STP Works

When enabled, STP determines the most appropriate path for traffic through a network. It does this as outlined in the sections below.

STP Requirements

Before it can configure the network, the STP system requires:

■

Communication between all the bridges. This communication is carried out using Bridge Protocol Data Units (BPDUs), which are transmitted in packets with a known multicast address.

Each bridge to have a Bridge Identifier. This specifies which bridge acts as the central reference point, or Root Bridge, for the STP system — the lower the Bridge Identifier, the more likely the bridge is to become the Root Bridge. The Bridge Identifier is calculated using the MAC address of the bridge and a priority defined for the bridge. The default priority of your Switch is 32768.

■

Each port to have a cost. This specifies the efficiency of each link, usually determined by the bandwidth of the link — the higher the

cost, the less efficient the link. Table 4 shows the default port costs for

a Switch.

Table 4 Default port costs

Port Speed

10 Mbps

100 Mbps

1000 Mbps

Link Type

Half Duplex

Full Duplex

Aggregated Link

Half Duplex

Full Duplex

Aggregated Link

Full Duplex

Aggregated Link

Path Cost 802.1D,

1998 Edition

Path Cost

802.1w-2001

100

2,000,000

1,999,999

1,000,000

200,000

199,999

100,000

20,000

10,000

STP Calculation

The first stage in the STP process is the calculation stage. During this stage, each bridge on the network transmits BPDUs that allow the system to work out:

■

The identity of the bridge that is to be the Root Bridge. The Root

Bridge is the central reference point from which the network is configured.

The Root Path Costs for each bridge — that is, the cost of the paths from each bridge to the Root Bridge.

HAPTER

5: U

SING

ESILIENCE

EATURES

■

The identity of the port on each bridge that is to be the Root Port.

The Root Port is the one that is connected to the Root Bridge using the most efficient path, that is, the one that has the lowest Root

Path Cost. Note that the Root Bridge does not have a Root Port.

The identity of the bridge that is to be the Designated Bridge of each LAN segment. The Designated Bridge is the one that has the lowest Root Path Cost from that segment. Note that if several bridges have the same Root Path Cost, the one with the lowest

Bridge Identifier becomes the Designated Bridge.

All traffic destined to pass in the direction of the Root Bridge flows through the Designated Bridge. The port on this bridge that connects to the segment is called the Designated Bridge Port.

STP Configuration

After all the bridges on the network have agreed on the identity of the

Root Bridge, and have established the other relevant parameters, each bridge is configured to forward traffic only between its Root Port and the

Designated Bridge Ports for the respective network segments. All other ports are blocked, which means that they are prevented from receiving or forwarding traffic.

STP Reconfiguration

Once the network topology is stable, all the bridges listen for Hello BPDUs transmitted from the Root Bridge at regular intervals. If a bridge does not receive a Hello BPDU after a certain interval (the Max Age time), the bridge assumes that the Root Bridge, or a link between itself and the

Root Bridge, has gone down. The bridge then reconfigures the network to cater for the change. If you have configured an SNMP trap destination, when the topology of your network changes, the first bridge to detect the change sends out an SNMP trap.

CAUTION: Network loops can occur if aggregated links are manually configured incorrectly, that is, the physical connections do not match the assignment of ports to an aggregated link. RSTP and STP may not detect these loops. So that RSTP and STP can detect all network loops you must ensure that all aggregated links are configured correctly.

How STP Works

How RSTP Differs to

STP

RSTP works in a similar way to STP, but it includes additional information in the BPDUs. This information allows each bridge to confirm that it has taken action to prevent loops from forming when it wants to enable a link to a neighbouring bridge. This allows adjacent bridges connected via point-to-point links to enable a link without having to wait to ensure all other bridges in the network have had time to react to the change.

So the main benefit of RSTP is that the configuration decision is made locally rather than network-wide which is why RSTP can carry out automatic configuration and restore a link faster than STP.

STP Example

Figure 8 shows a LAN that has STP enabled. The LAN has three segments,

and each segment is connected using two possible links.

Figure 8 Port costs in a network

■

Bridge A has the lowest Bridge Identifier in the network, and has therefore been selected as the Root Bridge.

HAPTER

5: U

SING

ESILIENCE

EATURES

■

Because Bridge A is the Root Bridge, it is also the Designated Bridge for LAN segment 1. Port 1 on Bridge A is therefore selected as the

Designated Bridge Port for LAN Segment 1.

Port 1 of Bridges B, C, X and Y have been defined as Root Ports because they are the nearest to the Root Bridge and therefore have the most efficient path.

Bridges B and X offer the same Root Path Cost for LAN segment 2, however, Bridge B has been selected as the Designated Bridge for the segment because it has a lower Bridge Identifier. Port 2 on Bridge B is therefore selected as the Designated Bridge Port for LAN Segment 2.

Bridge C has been selected as the Designated Bridge for LAN segment

3, because it offers the lowest Root Path Cost for LAN Segment 3:

■ the route through Bridges C and B costs 200 (C to B=100, B to

A=100)

■ the route through Bridges Y and B costs 300 (Y to B=200, B to

A=100).

Port 2 on Bridge C is therefore selected as the Designated Bridge Port for LAN Segment 3.

STP Configurations

Figure 9 shows three possible STP configurations using SuperStack 3

Switch units.

■

Configuration 1 — Redundancy for Backbone Link

■

In this configuration, the Switches both have STP enabled and are connected by two links. STP discovers a duplicate path and blocks one of the links. If the enabled link breaks, the disabled link becomes re-enabled, therefore maintaining connectivity.

Configuration 2 — Redundancy through Meshed Backbone

■

In this configuration, four Switch units are connected in a way that creates multiple paths between each one. STP discovers the duplicate paths and blocks two of the links. If an enabled link breaks, one of the disabled links becomes re-enabled, therefore maintaining connectivity.

Configuration 3 — Redundancy for Cabling Error

In this configuration, a Switch has STP enabled and is accidentally connected to a hub using two links. STP discovers a duplicate path and blocks one of the links, therefore avoiding a loop.

Figure 9 STP configurations

Switch

Block

Switch

Block

Switch

How STP Works

Switch

Block

10Mbps Hub

HAPTER

5: U

SING

ESILIENCE

EATURES

Using STP on a

Network with

Multiple VLANs

The IEEE Std 802.1D, 1998 Edition does not take into account VLANs when it calculates STP information — the calculations are only performed on the basis of physical connections. For this reason, some network configurations can result in VLANs being subdivided into a number of isolated sections by the STP system. Therefore, you must ensure that any

VLAN configuration on your network takes into account the expected STP topology and alternative topologies that may result from link failures.

For example, Figure 10 shows a network containing VLANs 1 and 2. They

are connected using the 802.1Q-tagged link between Switch B and

Switch C. By default, this link has a path cost of 100 and is automatically blocked because the other Switch-to-Switch connections have a path cost of 36 (18+18). This means that both VLANs are now subdivided — VLAN

1 on Switch units A and B cannot communicate with VLAN 1 on Switch

C, and VLAN 2 on Switch units A and C cannot communicate with VLAN

2 on Switch B.

Figure 10 Configuration that separates VLANs

Switch A

100BASE-TX full duplex link carrying VLAN 1 only

(path cost 18)

100BASE-TX full duplex link carrying VLAN 2 only

(path cost 18)

Switch B Switch C

Block

802.1Q-tagged,

10BASE-T half duplex link carrying VLANs 1 and 2

(path cost 100)

To avoid any VLAN subdivision, it is recommended that all inter-Switch connections are made members of all available 802.1Q VLANs to ensure connectivity at all times. For example, the connections between Switches

A and B, and between Switches A and C should be 802.1Q tagged and carrying VLANs 1 and 2 to ensure connectivity.

For more information about VLAN Tagging, see Chapter 9 “Setting Up

Virtual LANs” .

SING THE

WITCH

ATABASE

What is the Switch

Database?

The Switch Database is used by the Switch to determine where a packet should be forwarded to, and which port should transmit the packet if it is to be forwarded.

The database contains a list of entries — each entry contains three items:

■

MAC (Ethernet) address information of the endstation that sends packets to the Switch.

Port identifier, that is the port attached to the endstation that is sending the packet.

VLAN ID of the VLAN to which the endstation belongs.

For details of the number of addresses supported by your Switch database, please refer to Chapter 1 of the Getting Started Guide that accompanies your Switch.

For detailed descriptions of the Web interface operations and the

Command Line Interface (CLI) commands that you require to manage the

Switch please refer to the Management Interface Reference Guide supplied in HTML format on the CD-ROM that accompanies your Switch.

How Switch

Database Entries

Get Added

Entries are added to the Switch Database in one of two ways:

■

The Switch can learn entries. The Switch updates its database with the source MAC address of the endstation that sent the packet, the VLAN

ID, and the port identifier on which the packet is received.

You can enter and update entries using the management interface via the Bridge > Address Database Web interface operation, or an SNMP

Network Manager.

HAPTER

6: U

SING THE

WITCH

ATABASE

Switch Database

Entry States

Databases entries can have three states:

■

Learned — The Switch has placed the entry into the Switch Database when a packet was received from an endstation. Note that:

■

Learned entries are removed (aged out) from the Switch Database if the Switch does not receive further packets from that endstation within a certain period of time (the aging time). This prevents the

Switch Database from becoming full with obsolete entries by ensuring that when an endstation is removed from the network, its entry is also removed from the database.

Learned entries are removed from the Switch Database if the

Switch is reset or powered-down.

Non-aging learned — If the aging time is set to 0 seconds, all learned entries in the Switch Database become non-aging learned entries. This means that they are not aged out, but they are still removed from the database if the Switch is reset or powered-down.

Permanent — The entry has been placed into the Switch Database using the management interface. Permanent entries are not removed from the Switch Database unless they are removed using the Switch management interface via the bridge > addressDatabase > remove

Web operation or the Switch is initialized.

SING

RAFFIC

ANAGEMENT

Using the traffic management capabilities of your Switch allows your network traffic to be controlled and prioritized to ensure that high priority data is transmitted with minimum delay.

The Switch 3870 have two features that allow you to manage the traffic on your network:

■

Traffic Prioritization — Ensures that important data is forwarded promptly by the Switch without delay. See

“What is Traffic

Prioritization?”

below.

Rate Limiting — Keeps your core network traffic down by setting a

maximum traffic rate on a port by port basis. See “Limiting the Rate of a Port”

page 59 .

HAPTER

7: U

SING

RAFFIC

ANAGEMENT

What is Traffic

Prioritization?

Traffic prioritization allows high priority data, such as time-sensitive and system-critical data to be transferred smoothly and with minimal delay over a network.

Traffic prioritization is most useful for critical applications that require a high level of service from the network. These could include:

■

Converged network applications — Used by organizations with a converged network, that is, a network that uses the same infrastructure for voice and video data and traditional data.

Organizations that require high quality voice and video data transmission at all times can ensure this by maximizing bandwidth and providing low latency.

Resource planning applications — Used by organizations that require predictable and reliable access to enterprise resource planning applications such as SAP.

■

Financial applications — Used by Accounts departments that need immediate access to large files and spreadsheets.

CAD/CAM design applications — Used by design departments that need priority connections to server farms and other devices for transferring large files.

Traffic Prioritization and your Switch

The traffic should be marked as it enters the network; the marking can be achieved in two ways:

■

The original device can apply DSCP (DiffServ code point) or 802.1p markings to the packet before transmission.

■

The edge port on the Switch connecting the originating device can mark or re-mark the packets using 802.1p, before sending the packets to the network.The Switch does not support DSCP marking or remarking.

The transmitting endstation sets the priority of each packet. When the packet is received, the Switch places the packet into the appropriate queue, depending on its priority level, for onward transmission across the network. The Switch determines which queue to service next according to the queuing mechanism selected, see

“Traffic Queues” on page 58 .

Traffic Prioritization and your Switch

How traffic is processed to provide Class of Service

A received packet at the ingress port is checked for its DSCP and IEEE

802.1D attributes to determine the level of service that the packet should receive.

802.1D packets are categorized into the 8 traffic classes defined by IEEE

802.1D; the higher the class the higher the priority given the packet on transmission.

DSCP packets are categorized into the six service levels as shown in

Figure 12 and mapped to the appropriate queue.

The priority defined in the service level directs the packet to the appropriate egress queue. When a packet comes in with both 802.1D and DSCP priority markings, the higher of the priorities will be used.

Configuring traffic prioritization for CoS Switch

QoS can be configured on your Switch using the 3Com Network

Supervisor or via the Command Line Interface (CLI).

The 3Com Network Supervisor application supplied on the CD-ROM accompanying your Switch is the main tool for configuring QoS, and

3Com recommends that you use this application to configure QoS.

You can also configure QoS via the command line interface (CLI), for a detailed description of the commands that you require refer to the

Management Interface Reference Guide supplied in HTML format on the

CD-ROM that accompanies your Switch.

Configure Class of Service using 3Com Network Supervisor in the following way:

1 Apply Traffic classification First identify the types of traffic requiring special treatment. These types are defined in the QoS feature through the creation of classifiers. The Switch supports two types of packet attributes on which to classify incoming traffic, Differentiated Services Code Point

(DSCP) and IEEE 802.1D.

2 Identify Service Levels You must then identify the level of service each classifier should receive. Note that DSCP service levels will be set somewhere else in the network and not in the Switch itself. Note also that 802.1D service levels are fixed and cannot be altered.

3 Create Profiles The next step is to create a profile, which associates classifiers with service levels.

HAPTER

7: U

SING

RAFFIC

ANAGEMENT

4 Apply CoS profile After a CoS profile has been created, it can be assigned to the Port(s). When the profile is assigned to the port(s), the

QoS configuration defined in the profile will immediately become active.

How Traffic

Prioritization Works

Traffic prioritization ensures that high priority data is forwarded through the Switch without being delayed by lower priority data. Traffic prioritization uses the two traffic queues that are present in the hardware of the Switch to ensure that high priority traffic is forwarded on a different queue from lower priority traffic. High priority traffic is given preference over low priority traffic to ensure that the most critical traffic gets the highest level of service.

The Switch employs three methods of classifying traffic for prioritization.

Traffic classification is the means of identifying which application generated the traffic, so that a service level can be applied to it.

The three supported methods for classifying traffic are:

■

802.1D (classification is done at layer 2 of the OSI model).

DiffServ code point (classification is done at layer 3 of the OSI model).

IP Port (classification is done at layer 4 of the OSI model).

These methods can be used together. If a packet is prioritized differently by the two methods then it will be tagged with the higher priority.

802.1D traffic classification

At layer 2, a traffic service class is defined in 802.1Q frame, which is able to carry VLAN identification and user priority information. The information is carried in a header field immediately following the destination MAC address, and Source MAC address.

802.1D Priority Levels

The traffic prioritization feature supported by the Switch at layer 2 is compatible with the relevant sections of the IEEE 802.1D/D17 standard

(incorporating IEEE 802.1p). Once a packet has been classified, the level of service relevant to that type of packet is applied to it.

The 802.1D standard specifies eight distinct levels of priority (0 to 7), each of which relates to a particular type of traffic. The priority levels and their traffic types are shown in

Figure 11 in order of increasing priority.

How Traffic Prioritization Works

You cannot alter the mapping of priority levels 0 - 7 to the traffic queues.

These priority levels are fixed to the traffic queues as shown in

Figure 11

Figure 11 IEEE 802.1D traffic types

Ingress Port

Traffic

Classification

802.1D

Switch

802.1D

Service Levels

Background 1

Spare

Best Effort 0

Business Critical 3

Multimedia 4

Video

Voice

Network Control 7

Traffic Queues

Queue 1 Low Priority )

Queue 2

Queue 0

Queue 3

Queue 4

Queue 5

Queue 6

Queue 7 (High Priority)

Egress Port

Figure 11 illustrates IEEE 802.1D traffic types as well as associated priority

levels and how they are mapped to the two supported traffic queues.

DiffServ traffic classification

DiffServ is an alternative method of classifying traffic so that different levels of service can be applied to it on a network. DiffServ is a layer 3 function; and the service to be applied is contained within the DSCP field, which is in the IP header of a packet.

HAPTER

7: U

SING

RAFFIC

ANAGEMENT

Figure 12 DSCP Service Level Mapping

Ingress Port

Classification

Switch

802.1D

Service Levels

Background 1

Spare 2

DSCP

(1-64)

Best Effort 0

Business Critical 3

Multimedia

Video

Voice 6

Network Control 7

Traffic Queues

Queue 1 Low Priority )

Queue 2

Queue 0

Queue 3

Queue 4

Queue 5

Queue 6

Queue 7 (High Priority)

Egress Port

Figure 12 illustrates how DiffServ code point (DSCP) service levels are

mapped to the two Traffic Queues.

IP Port traffic classification

The Switch supports classification of traffic from legacy devices by classifying traffic by its IP port number.

When an IP packet is transmitted it is always tagged with an IP port number. This number represents the type of application that created the packet and can be used to prioritize traffic originating from different applications.

The transmitting endstation tags a packet with a port number. When the packet is received, the Switch places the packet in the queue that corresponds to the IP port number of the packet. If there is no priority set against the IP port number then the packet will be sent out with the default priority.

Traffic Queues

It is the multiple traffic queues within the Switch hardware that allow packet prioritization to occur. Higher priority traffic can pass through the

Switch without being delayed by lower priority traffic. As each packet arrives in the Switch, it passes through any ingress processing (which includes classification, marking/remarking or dropping), and is then sorted into the appropriate queue. The Switch then forwards packets from each queue. Note that each egress port has its own set of queues, so that if one port is congested it does not interfere with the queue operation of other ports.

Limiting the Rate of a Port

The Switch uses the following queuing mechanisms:

■

Weighted Round Robin (WRR) — This method services all the traffic queues, giving priority to the higher priority queues. Under most circumstances, this method gives high priority precedence over low-priority, but in the event that high-priority traffic exceeds the link capacity, lower priority traffic is not blocked. This is the default method.

Strict Priority Queuing (SPQ) — This method guarantees that traffic on a higher priority queue will always be serviced ahead of traffic waiting on a lower priority queue. This can have the disadvantage that lower priority queues may become starved of bandwidth when the higher priority queues are heavily utilized.

Traffic queues cannot be enabled on a per-port basis on the Switch 3870.

Limiting the Rate of a Port

Limiting the rate at which a port can receive or send traffic can be used to ease congestion on bottlenecks in your network and provide simple prioritization when the network is busy.

Rate limiting is commonly used in the following situations:

■

To prevent a high bandwidth client or group of clients from dominating the traffic on your network.

■

To balance the traffic at a bottleneck, such as an external-facing router, so that different departments or parts of your network get similar access across the bottleneck.

The advantage of rate limiting is that it is a simple solution: it is easy to set up and maintain. It can be used to effectively keep the traffic on your network to a manageable level.

Traffic Prioritization and Rate Limiting

Traffic prioritization and rate limiting can be used together to effectively manage the traffic on your network:

■

Rate limiting will ensure that the traffic on a connection never exceeds the rate you specify.

■

Traffic prioritization will ensure that any packets dropped at times of network congestion are of the lowest priority.

HAPTER

7: U

SING

RAFFIC

ANAGEMENT

Traffic prioritization and rate limiting are best used together if the egress rate rather than the ingress rate is limited on a port; the traffic rate leaving the Switch is limited rather than the traffic arriving at the Switch.

This ensures that the traffic is prioritized before rate limiting is applied and the lowest priority packets are dropped first.

Rate limiting on ingress, as the packets arrive at the port, is not as effective. The Switch cannot determine the order in which packets will arrive and will not filter by priority.

TATUS

ONITORING AND

TATISTICS

RMON

What is RMON?

This chapter contains details of the Remote Monitoring (

RMON ) feature

that assists you with status monitoring and statistics.

For detailed descriptions of the Web interface operations and the

Command Line Interface (CLI) commands that you require to manage the

Switch please refer to the Management Interface Reference Guide supplied in HTML format on the CD-ROM that accompanies your Switch.

Using the RMON capabilities of a Switch allows you to improve your network efficiency and reduce the load on your network.

This section explains more about RMON. It covers the following topics:

■

What is RMON?

■

Benefits of RMON

RMON and the Switch

RMON is a system defined by the IETF (Internet Engineering Task Force) that allows you to monitor the traffic of LANs or VLANs.

RMON is an integrated part of the Switch software agent and continually collects statistics about a LAN segment or VLAN, and transfers the information to a management workstation on request or when a pre-defined threshold is crossed. The workstation does not have to be on the same network as the Switch and can manage the Switch by in-band or out-of-band connections.

HAPTER

8: S

TATUS

ONITORING AND

TATISTICS

The RMON Groups

The IETF define groups of Ethernet RMON statistics. This section describes the four groups supported by the Switch, and details how you can use them.

Statistics

The Statistics group provides traffic and error statistics showing packets, bytes, broadcasts, multicasts and errors on a LAN segment or VLAN.

Information from the Statistics group is used to detect changes in traffic and error patterns in critical areas of your network.

History

The History group provides historical views of network performance by taking periodic samples of the counters supplied by the Statistics group.

The group is useful for analyzing the traffic patterns and trends on a LAN segment or VLAN, and for establishing the normal operating parameters of your network.

Alarms

The Alarms group provides a mechanism for setting thresholds and sampling intervals to generate events on any RMON variable.

Alarms are used to inform you of network performance problems and they can trigger automated responses through the Events group.

Events

The Events group provides you with the ability to create entries in an event log and send SNMP traps to the management workstation. Events are the action that can result from an RMON alarm. In addition to the standard five traps required by SNMP (link up, link down, warm start, cold start, and authentication failure), RMON adds two more: rising threshold and falling threshold.

Effective use of the Events group saves you time; rather than having to watch real-time graphs for important occurrences, you can depend on the Event group for notification. Through the SNMP traps, events can trigger other actions, therefore providing a way to automatically respond to certain occurrences.

Benefits of RMON

Benefits of RMON

Using the RMON features of your Switch has three main advantages:

■

It improves your efficiency

Using RMON allows you to remain at one workstation and collect information from widely dispersed LAN segments or VLANs. This means that the time taken to reach a problem site, set up equipment, and begin collecting information is largely eliminated.

It allows you to manage your network in a more proactive manner

If configured correctly, RMON can deliver information before problems occur. This means that you can take action before they affect users. In addition, probes record the behavior of your network, so that you can analyze the causes of problems.

It reduces the load on the network and the management workstation

Traditional network management involves a management workstation polling network devices at regular intervals to gather statistics and identify problems or trends. As network sizes and traffic levels grow, this approach places a strain on the management workstation and also generates large amounts of traffic.

RMON, however, autonomously looks at the network on behalf of the management workstation without affecting the characteristics and performance of the network. RMON reports by exception, which means that it only informs the management workstation when the network has entered an abnormal state.

RMON and the

Switch

The RMON support provided by your Switch 3870 is detailed in

Table 5 .

Table 5 RMON support supplied by the Switch

RMON group Support supplied by the Switch

Statistics

History

A new or initialized Switch has one Statistics session per port.

A new or initialized Switch has two History sessions per port.

These sessions provide the data for the Web interface history displays:

■

10 min intervals, 6 historical samples stored

1 hour intervals, 6 historical samples stored

HAPTER

8: S

TATUS

ONITORING AND

TATISTICS

Table 5 RMON support supplied by the Switch

RMON group Support supplied by the Switch

Alarms

A new or initialized Switch has two Alarm sessions per port

Events

For more information about the alarms setup on the Switch, see

“Alarm Events” on page 64 .

A new or initialized Switch has one Event session per port.

When using the RMON features of the Switch, note the following:

■

The greater the number of RMON sessions, the greater the burden on the management resources of the Switch. If you have many RMON sessions, the forwarding performance of the Switch is not affected but you may experience slow response times from the Web interface.

Alarm Events

You can define alarms for the Switch. The events that you can define for each alarm and their resulting actions are listed in

Table 6

Table 6 Alarm Events

Event

No action

Notify only

Notify and filter port

Action

Send Trap.

Send Trap. Block broadcast and multicast traffic on the port. Recovers with the unfilter

port event.

Send Trap. Turn port off.

Notify and disable port

Notify and enable port

Disable port

Send Trap. Turn port on.

Turn port off.

Enable port

Turn port on.

Notify and switch resilient port

Send Trap. If port is the main port of a resilient link pair then move to standby.

Notify and unfilter port

Send Trap. Stop blocking broadcast and multicast traffic on the port.

System started

ETTING

P

IRTUAL

LAN

S

What are VLANs?

Setting up Virtual LANs (VLANs) on your Switch increases the efficiency of your network by dividing the LAN into logical, rather than physical, segments which are easier to manage.

This chapter explains more about the concept of VLANs and explains how they can be implemented on your Switch. It covers the following topics:

■

What are VLANs?

Benefits of VLANs

VLANs and Your Switch

■

VLAN Configuration Examples

For detailed descriptions of the Web interface operations and the

Command Line Interface (CLI) commands that you require to manage the

Switch please refer to the Management Interface Reference Guide supplied in HTML format on the CD-ROM that accompanies your Switch.

A VLAN is a flexible group of devices that can be located anywhere in a network, but which communicate as if they are on the same physical segment. With VLANs, you can segment your network without being restricted by physical connections — a limitation of traditional network design. As an example, with VLANs you can segment your network according to:

■

Departmental groups — For example, you can have one VLAN for the Marketing department, another for the Finance department, and another for the Development department.

■

Hierarchical groups — For example, you can have one VLAN for directors, another for managers, and another for general staff.

Usage groups — For example, you can have one VLAN for users of e-mail, and another for users of multimedia.

HAPTER

9: S

ETTING

IRTUAL

LAN

Figure 13 A network setup showing three VLANs

Switch A

1 2

Backbone connecting multiple switches

3 4 5 6 7 8

Switch B

1 2 3 4 5 6 7 8

Development Department

VLAN 3

Marketing Department

VLAN 1

Finance Department

VLAN 2

Benefits of VLANs

The main benefit of VLANs is that they provide a network segmentation system that is far more flexible than any traditional network. Using VLANs also provides you with three other benefits:

■

VLANs ease the movement of devices on networks

■

With traditional networks, network administrators spend much of their time dealing with moves and changes. If users move to a different subnetwork, the addresses of each endstation must be updated manually.

With a VLAN setup, if an endstation in VLAN Marketing for example is moved to a port in another part of the network, and retains its original subnet membership, you only need to specify that the new port is in

VLAN Marketing. You do not need to carry out any re-cabling.

VLANs provide extra security

Devices within each VLAN can only communicate with other devices in the same VLAN. If a device in VLAN Marketing needs to communicate with devices in VLAN Finance, the traffic must pass through a routing device or Layer 3 Switch.

VLANs and Your Switch

■

VLANs help to control traffic

With traditional networks, congestion can be caused by broadcast traffic that is directed to all network devices whether they require it or not. VLANs increase the efficiency of your network because each

VLAN can be set up to contain only those devices that need to communicate with each other.

VLANs and Your

Switch

Your Switch provides support for VLANs using the IEEE Std 802.1Q-1998.

This standard allows traffic from multiple VLANs to be carried across one physical link.

The IEEE Std 802.1Q-1998 allows each port on your Switch to be placed in:

■

Any one VLAN defined on the Switch.

Several VLANs at the same time using 802.1Q tagging.

The standard requires that you define the following information about each VLAN on your Switch before the Switch can use it to forward traffic:

■

VLAN Name — This is a descriptive name for the VLAN (for example,

Marketing or Management).

802.1Q VLAN ID — This is used to identify the VLAN if you use

802.1Q tagging across your network.

The Default VLAN

A new or initialized Switch contains a single VLAN, the Default VLAN.

This VLAN has the following definition:

■

VLAN Name — Default VLAN

802.1Q VLAN ID — 1 (if tagging required)

All the ports are initially placed in this VLAN, and it is the only VLAN that allows you to access the management software of the Switch over the network.

HAPTER

9: S

ETTING

IRTUAL

LAN

Communication

Between VLANs

If the devices placed in a VLAN need to communicate to devices in a different VLAN, a router or Layer 3 switching device with connections to both VLANs needs to be installed. Communication between VLANs can only take place if they are all connected to a routing or Layer 3 switching device.

Figure 14 Two VLANs connected via a router

VLAN Sales

VLAN Marketing

Switch

Router or Layer 3 Switch

Data from ports in

VLAN Sales are sent to the router or

Layer 3 Switch and redirected to ports in

VLAN Marketing.

Creating New VLANs

If you want to move a port from the Default VLAN to another VLAN, you must first define information about the new VLAN on your Switch.

VLANs: Tagged and

Untagged

Membership

Your Switch supports 802.1Q VLAN tagging, a system that allows traffic for multiple VLANs to be carried on a single physical (backbone) link.

When setting up VLANs you need to understand when to use untagged and tagged membership of VLANs. Quite simply, if a port is in a single

VLAN it can be an untagged member, but if the port needs to be a member of multiple VLANs, tagged membership must be defined.

Typically endstations (for example, clients) will be untagged members of one VLAN, while inter-Switch connections will be tagged members of all

VLANs.

VLAN Configuration Examples

The IEEE Std 802.1Q-1998 defines how VLANs operate within an open packet-switched network. An 802.1Q compliant packet carries additional information that allows a Switch to determine to which VLAN the port belongs. If a frame is carrying the additional information, it is known as

tagged.

To carry multiple VLANs across a single physical (backbone) link, each packet must be tagged with a VLAN identifier so that the Switches can identify which packets belong in which VLANs. To communicate between

VLANs a router must be used.

VLAN

Configuration

Examples

This section contains examples of VLAN configurations. It describes how to set up your Switch to support simple untagged and tagged connections.

Using Untagged

Connections

The simplest VLAN operates in a small network using a single switch. In this network there is no requirement to pass traffic for multiple VLANs across a link. All traffic is handled by the single Switch and therefore untagged connections can be used.

The example shown in

Figure 15 illustrates a single Switch connected to

endstations and servers using untagged connections. Ports 1, 2 and 3 of the Switch belong to VLAN 1, ports 16, 17 and 18 belong to VLAN 2.

VLANs 1 and 2 are completely separate and cannot communicate with each other. This provides additional security for your network.

HAPTER

9: S

ETTING

IRTUAL

LAN

Figure 15 VLAN configuration example: Using untagged connections

Endstations in VLAN 1

Endstations in VLAN 2

Switch

Server in VLAN 1

Server in VLAN 2

To set up the configuration shown in Figure 15 :

1 Configure the VLANs

Define VLAN 2 on the Switch. VLAN 1 is the default VLAN and already exists.

2 Add ports to the VLANs

Add ports 10, 11 and 12 of the Switch as untagged members to VLAN 2.

You can use the Switch Web Interface to change VLAN configuration.

VLAN configuration can be found at Bridge > VLAN.

Using 802.1Q Tagged

Connections

In a network where the VLANs are distributed amongst more than one

Switch, you must use 802.1Q tagged connections so that all VLAN traffic can be passed along the links between the Switches. 802.1Q tagging can only be used if the devices at both ends of a link support IEEE 802.1Q.

The example shown in Figure 16

illustrates two Switch units. Each Switch has endstations and a server in VLAN 1 and VLAN 2. All endstations in

VLAN 1 need to be able to connect to the server in VLAN1 which is attached to Switch 1 and all endstations in VLAN 2 need to connect to the server in VLAN2 which is attached to Switch 2.

VLAN Configuration Examples

Figure 16 VLAN configuration example: 802.1Q tagged connections

Endstation in

VLAN 1(untagged)

Endstation in

VLAN 2 (untagged)

Endstation in

VLAN 1(untagged)

Endstation in

VLAN 2 (untagged)

Server in VLAN 2

(untagged)

Switch 1 Switch 2

Port 12

VLANs 1 and 2

(802.1Q tagged)

Port 11

VLANs 1 and 2

(802.1Q tagged)

Server in VLAN1

(untagged)

To set up the configuration shown in Figure 16 :

1 Configure the VLANs on Switch 1

Define VLAN 2. VLAN 1 is the default VLAN and already exists.

2 Add endstation ports on Switch 1 to the VLANs

Place the endstation ports in the appropriate VLANs as untagged members.

3 Add port 12 on Switch 1 to the VLANs

Add port 12 on Switch 1 as a tagged member of both VLANs 1 and 2 so that all VLAN traffic is passed over the link to Switch 2.

4 Configure the VLANs on Switch 2

Define VLAN 2. VLAN 1 is the default VLAN and already exists.

5 Add endstation ports on Switch 2 to the VLANs

Place the endstation ports in the appropriate VLANs as untagged members.

6 Add port 11 on Switch 2 to the VLANs

Add port 11 on Switch 2 as a tagged member of both VLANs 1 and 2 so that all VLAN traffic is passed over the link to Switch 1.

HAPTER

9: S

ETTING

IRTUAL

LAN

7 Check the VLAN membership for both Switches

The relevant ports should be listed in the VLAN members summary.

8 Connect the Switches

Connect port 12 on Switch 1 to port 11 on Switch 2.

The VLANs are now configured and operational and the endstations in both VLANs can communicate with their relevant servers.

SING

UTOMATIC

ONFIGURATION

This chapter explains more about IP addresses and how the automatic configuration option works. It covers the following topics:

■

How Your Switch Obtains IP Information

How Automatic IP Configuration Works

■

Important Considerations

For detailed information on setting up your Switch for management, see the Getting Started Guide that accompanies your Switch.

For detailed descriptions of the Web interface operations and the

Command Line Interface (CLI) commands that you require to manage the

Switch please refer to the Management Interface Reference Guide supplied in HTML format on the CD-ROM that accompanies your Switch.

For background information on IP addressing, see

Appendix C “IP

Addressing”

HAPTER

10: U

SING

UTOMATIC

IP C

ONFIGURATION

How Your Switch

Obtains IP

Information

Your Switch has two ways to obtain its IP address information:

■

Automatic IP Configuration (default) — The Switch attempts to configure itself by communicating with a DHCP server on the network.

Manual IP Configuration — You can manually input the IP information (IP address, subnet mask, and default gateway).

If you select an option for no IP configuration the Switch will not be accessible from a remote management workstation on the LAN. In addition, the Switch will not be able to respond to SNMP requests.

How Automatic IP

Configuration

Works

When your Switch is powered up for the first time the IP configuration setting is set to auto — this is the default setting.

If your Switch has been powered up before, whichever of the three options for IP configuration ( manual, auto, none) was last configured is activated when the Switch powers up again.

You can switch to manual IP configuration at any time using a serial port connection to set up the IP information. For more information see the

Getting Started Guide that accompanies your Switch.

Automatic Process

To detect its IP information using the automatic configuration process, the Switch continually attempt to contact a DHCP server on the network requesting IP information from the server.

If a DHCP server is on the network and working correctly it responds to the clients request with an IP address (allocated from a pool of available addresses) and other parameters such as a subnet mask, default gateway, lease time, and any other options configured in the DHCP server.

The way a DHCP server responds is dependant on the DHCP server settings. Therefore the way your DHCP server responds may be different to the process outlined.

Important Considerations

Important

Considerations

This section contains some important points to note when using the automatic IP configuration feature.

The dynamic nature of automatically configured IP information means that a Switch may change its IP address whilst in use.

Server Support

Your Switch has been tested to interoperate with DHCP servers that use the following operating systems:

■

Microsoft Windows 2000 Server

■

Microsoft Windows NT4 Server

Sun Solaris v2.5.1

If you want DHCP to be the method for automatic configuration, make sure that your DHCP servers are operating normally before you power on your Switch.

Event Log Entries and Traps

An event log will be generated and an SNMP trap will be sent if the IP address configuration is changed manually.

HAPTER

10: U

SING

UTOMATIC

IP C

ONFIGURATION

AKING

OUR

ETWORK

ECURE

This chapter outlines the Port Security and Switch Management Login features, explains the key benefits of using these features, and gives examples of how and why you would use them in your network.

For detailed descriptions of the Web interface operations and the

Command Line Interface (CLI) commands that you require to manage the

Switch please refer to the Management Interface Reference Guide supplied in HTML format on the CD-ROM that accompanies your Switch.

Securing Access to the Web Interface

The Switch 3870 supports HTTPS, allowing secure access to the Web interface of the Switch.

If you adminster your switch remotely or over an insecure network, the

Switch can encrypt all HTTP traffic to and from the Web interface using the Secure Sockets Layer (SSL) of HTTP. If your network traffic is intercepted, no passwords or configuration information will be visible in the data.

To use HTTPS you need the following:

■

A browser that supports SSL

■

A digital certificate installed on the Switch

The Switch generates its own certificate the first time it is powered on.

This is the default certificate for the Switch. As it has not been validated by a Certifying Authority your browser may warn you that certificate has not been certified.

Once you have obtained a digital certificate and installed it, you will be able to securely browse your Switch by using browsing

https://xxx.xxx.xxx.xxx/

where xxx.xxx.xxx.xxx is the IP address of your Switch.

HAPTER

11: M

AKING

OUR

ETWORK

ECURE

Once you have set up your Switch to support HTTPS, you can optionally stop unencrypted administration by redirecting HTTP accesses (port 80) to port 443 (the port used by HTTPS). The Switch can be configured to redirect all attempts to administer the Web interface.

Getting a Digital

Certificate

Before accessing your Switch using HTTPS, you need an digital certificate which is used to identify your Switch. The Switch uses certificates that adhere to the following X.509 standard.

If you have the software to generate an X.509 certificate, you can self-certify your Switch. Administrators will be warned that the certificate has not been certified by a Certificate Authority (CA) but security will not be otherwise affected.

If you cannot generate an X.509 certificate yourself, you can buy one from one of the Certifying Authorities or your ISP. Each Switch will require its own X.509 certificate.

Securing Access to the Command Line

Interface

The Switch 3870 supports Secure Shell (SSH), allowing secure access to the Command Line Interface of the Switch.

If you use SSH to administer your Switch and the network traffic is intercepted, no passwords or configuration information will be visible in the data. To securely adminster the Switch using the Command Line

Interface you need a Telnet/SSH client. You do not need a digital certificate as your Switch can generate its own.

To administer your Switch using SSH, start your Telnet/SSH client and enter the IP address of your Switch.

If your Telnet/SSH application supports both encrypted and unencrypted modes, make sure that you have SSH encryption set.

At time of writing, the Telnet client supplied with Windows does not support SSH.

Access Control Lists

Access Control Lists

Access Control Lists are a set of instructions that can be applied to filter traffic on VLANs. They can be used to limit access to certain segments of the network and therefore, are useful for network security.

Access Control Lists can be used to:

■

Prevent unnecessary network traffic.

Restrict access to proprietary information within the network.

Access Control Lists are based on a series of rules. Rules are applied to

VLANs and determine the path or access limitations for packets received on a VLAN. When a packet is received on a VLAN, it is compared to an access list for this VLAN. If a match is found; meaning the packet falls under the rule, it will be blocked or forwarded to the appropriate VLAN depending on the action.

Rules are established based on IP addressing. A packet matches an access list rule when it’s destination IP address falls with the values of the rule.

When a match is found, the path the packet takes is determined by the rule and is either forwarded (permitted) or dropped (denied).

There are a maximum of 100 access lists that can be applied under the current operating system. Access list rules can be applied and traffic is forwarded at wire speed using layer 3 destination IP addresses and

VLANs.

How Access Control

List Rules Work

When a packet is received it is compared against the VLAN access list. The access list rules are applied to a range of IP addresses and are defined by the destination IP address and a mask. If a match is found in the access list the appropriate action is taken. By default, if no access list has been defined for a VLAN, all IP traffic will be permitted. Denial is based on a pre-defined rule.

For example:

Packet destination IP address: 10.101.67.45

Rule destination address: 10.101.67.0

Rule destination mask: 255.255.255.0

Rule action: deny

HAPTER

11: M

AKING

OUR

ETWORK

ECURE

Port Security

As a result of the above rule, the packet matches the parameters of the rule and will be blocked.

A destination mask of 0.0.0.0 will match all packets.

The Switch 3870 supports the following port security modes, which you can set for an individual port or a range of ports:

■

No Security

■

Port security is disabled and all network traffic is forwarded through the port without any restrictions.

Learning Off

■

All currently learnt addresses on the port are made permanent. Any packets containing a source address not learnt on the port will be dropped.

Automatic Learning

■

MAC addresses are learned continually by the port until the number of authorized addresses specified is reached. When this number is exceeded, the port automatically stops learning addresses and the port enters Learning Off mode. Access to the port is then restricted to the devices that have already been learned on the port.

Network Login

When the user has been successfully authorized, all network traffic is forwarded through the port without any restrictions. For further information see

“What is Network Login?” on page 81 .

Network Login (Secure)

When the user has been successfully authorized, only network traffic that is received from the authorized client device is forwarded through the port. The source MAC address in received packets is used to determine this; all traffic from other network devices is filtered.

What is Network Login?

What is Network

Login?

Network Login controls user access at the network edge by blocking or unblocking access on a per-port basis.

When a client device attempts to connect to a Switch port, the user is challenged to provide their identity and authentication credentials in the form of a user name and password. The user information is then sent to a remote RADIUS server in the network for authentication. This information must be successfully authenticated and authorized before the client device is granted access to the network.

For further information about RADIUS, see

“What is RADIUS?” on page 85 .

The client device must be directly connected to the Switch port (no intervening switch or hub) as the Switch uses the link status to determine if an authorized client device is connected. Network Login will not operate correctly if there is a “bridge” device between the client device and the Switch port, or if there are multiple client devices attached via a hub to the Switch port.

In addition to providing protection against unauthorized network access,

Network Login also allows the user of a port to be identified. This user identification information can be used for service accounting or billing, or to help network administrators resolve problems.

Network Login is a feature that is particularly relevant in publicly accessible networks, such as education campuses or conference facilities, which often have limited control over physical access to areas with live network connections.

Network Login is based on the IEEE Std 802.1X-2001, which defines a mechanism for user authentication for port-based network access control.

How

Network Login

Works

When Network Login is enabled the Switch acts as a relay agent between the client device that is requesting access to the network and the RADIUS server. The authentication information that is exchanged between the client device and the RADIUS server is received and transmitted by the

Switch, as shown in

Figure 17 . The Switch does not interpret or store this

information.

HAPTER

11: M

AKING

OUR

ETWORK

ECURE

Figure 17 Network Login Operation

Network Access Client

(Client Device)

Authentication

Information

Network Access Server

(Switch 3870)

Authentication

Information

RADIUS Server

When the client device and RADIUS server have exchanged authentication information, the Switch receives either an authentication succeeded or failed message from the server, and then configures the port to forward or filter traffic as appropriate. If access is granted, the

Spanning Tree Protocol places the port into the forwarding state and the client device can obtain an IP address.

If possible, when a port is configured for Network Login, it should also be configured to be a Spanning Tree Protocol (STP) edge port. This minimizes the delay before STP places the port into the forwarding state.

For further information about RADIUS, see

“What is RADIUS?” on page 85 .

Important

Considerations

This section contains some important considerations when using Network

■

Before you enable Network Login you must ensure that:

■

RADIUS has been configured on the Switch.

■

The RADIUS server in your network is operational.

If the RADIUS server fails or is unavailable, client devices will be unable to access the network.

What is Switch

Management

Login?

What is Switch Management Login?

■

Network Login is not supported on ports configured to operate as members of an aggregated link.

Network Login is not supported on ports configured to operate as members of a resilient link.

Some client devices that are connected to the Switch port may not support the authentication service, for example printers. You should configure the Switch port to operate in Automatic Learning mode, so that network traffic that does not match the MAC address for the client device is filtered.

You should enable Network Login on all relevant Switch ports. Failure to enable authentication on a single port could compromise the security of the entire network.

If you intend to manage the Switch using the Web interface or the

Command Line Interface, you need to log in with a valid user name and password.

For further information on managing the Switch, see the “Setting Up For

Management” chapter in the Getting Started Guide.

The user name and password information can be stored in either:

■

a RADIUS server (recommended)

If you enable RADIUS as the authentication mode of Switch

Management Login, the user name and password information is stored in a database on a RADIUS server in your network. Subsequent log in attempts to the Switch are remotely authenticated by the

RADIUS server.

■

the local Switch database (default)

If you enable Local as the authentication mode of Switch

Management Login, the user name and password information is stored in the local database on the Switch. Subsequent login attempts to the Switch are authenticated by the local database.

HAPTER

11: M

AKING

OUR

ETWORK

ECURE

Benefits of RADIUS

Authentication

Day-to-day network maintenance can become a substantial overhead.

For example, regularly changing the administrative password on a manageable network device is a commonplace security measure. If the local Switch database is enabled, the network administrator must have local access to each Switch to securely change user name and password information. This can be time consuming, tedious and often results in bad configurations and lapses in security.

RADIUS authentication provides centralized, secure access and removes the need to physically visit each network device. Changes to user names and passwords require only a single action on the RADIUS database and are reflected immediately.

The Switch 3870 is fully compliant with the industry standard RADIUS

protocol. For further information about RADIUS, see “What is RADIUS?”

page 85 .

How

RADIUS

Authentication

Works

When RADIUS authentication of Switch Management Login is enabled, the Switch obtains the user’s name and password and securely sends the information to the RADIUS server. The information is authenticated by the server and a valid user is allowed to login to the Switch. An invalid user will receive a reject response and is not allowed to login to the Switch.

This process is shown in

Figure 18 .

Figure 18 RADIUS Authentication Operation

1. User name and password submitted

Switch

Management

Device

4. User logs in or denied access

2. Username and password encrypted

3. Accept or reject response

RADIUS Server

What is RADIUS?

Important

Considerations

This section contains some important considerations when using RADIUS authentication of Switch Management Login on the Switch 3870.

■

Before you enable RADIUS authentication you must ensure that:

■

The Switch is configured with a static IP address.

RADIUS has been configured on the Switch.

■

The RADIUS server in your network is operational.

If the Switch is unable to contact the RADIUS server, the Command

Line Interface automatically reverts to using the local Switch database for user authentication. This allows a user with “admin” access to login to the Switch via the console port and continue to manage it.

The Web interface and Telnet do not revert to the local database, and the user will not be able to log in to the Switch via the Web interface or Telnet.

The user names and passwords stored in the local Switch database may not be the same as those stored on the RADIUS server. When a user account is created on a RADIUS server, an equivalent account is not automatically created in the local Switch database, and vice versa.

What is RADIUS?

Remote Authentication Dial-In User Service (RADIUS) is an industry standard protocol for carrying authentication, authorization and configuration information between a network device and a shared authentication server. Transactions between each network device and the server are authenticated by the use of a shared secret. Additional security is provided by encryption of passwords to prevent interception by a network snooper.

RADIUS is defined in the RFCs 2865 and 2866, “Remote Authentication

Dial-in User Service (RADIUS)” and “RADIUS Accounting”.

Network Login, a method of port-based access control, and Switch

Management Login, used to control administrative access, both utilize the RADIUS protocol.

HAPTER

11: M

AKING

OUR

ETWORK

ECURE

ONFIGURATION

ULES

Configuration Rules for Gigabit

Ethernet

Gigabit Ethernet is designed to run over several media:

■

Single-mode fiber optic cable, with connections up to 5 km

(3.1 miles). Support for distances over 5 km is supported depending on the module specification.

■

Multimode fiber optic cable, with connections up to 550 m (1804 ft).

Category 5 cabling, with connections up to 100 m (328 ft).

The different types of Gigabit Ethernet media and their specifications are detailed in

Table 7 .

Table 7 Gigabit Ethernet cabling

Gigabit Ethernet

Transceivers

1000BASE-LX

1000BASE-SX

1000BASE-T

Fiber Type

62.5

µm MM

µm SM

62.5

µm MM

62.5

µm MM

N/A

160

120

400

500

N/A

Modal

Bandwidth

(MHz/km)

500

400

500

N/A

Lengths Supported

Specified by IEEE

(meters)

2–550

2–5000

2–220

2–275

2–500

2–550

100

MM = Multimode SM = Single-mode

PPENDIX

A: C

ONFIGURATION

ULES

Configuration Rules for Fast Ethernet

The topology rules for 100 Mbps Fast Ethernet are slightly different to those for 10 Mbps Ethernet.

Figure 19

illustrates the key topology rules and provides examples of how they allow for large-scale Fast Ethernet networks.

Figure 19 Fast Ethernet configuration rules

The key topology rules are:

■

Maximum UTP cable length is 100 m (328 ft) over Category 5 cable.

A 412 m (1352 ft) fiber link is allowed for connecting switch-to-switch, or endstation-to-switch, using half-duplex

100BASE-FX.

Configuration Rules for Fast Ethernet

■

A total network span of 325 m (1066 ft) is allowed in single-repeater topologies (one hub stack per wiring closet with a fiber link to the collapsed backbone). For example, a 225 m (738 ft) fiber link from a repeater to a router or switch, plus a 100 m (328 ft) UTP link from a repeater out to the endstations.

Configuration Rules with Full Duplex

The Switch provides full duplex support for all its ports, including

Expansion Module ports. Full duplex allows packets to be transmitted and received simultaneously and, in effect, doubles the potential throughput of a link.

With full duplex, the Ethernet topology rules are the same, but the Fast

Ethernet rules are:

■

Maximum UTP cable length is 100 m (328 ft) over Category 5 cable.

■

A 2 km (6562 ft) fiber link is allowed for connecting switch-to-switch, or endstation-to-switch.

PPENDIX

A: C

ONFIGURATION

ULES

ETWORK

ONFIGURATION

XAMPLES

This chapter contains the following sections:

■

Simple Network Configuration Examples

■

Desktop Switch Example

Advanced Network Configuration Examples

■

Improving the Resilience of Your Network

PPENDIX

B: N

ETWORK

ONFIGURATION

XAMPLES

Simple Network

Configuration

Examples

The following illustrations show some simple examples of how the Switch

3870 can be used in your network.

Desktop Switch

Example

The example in

Figure 20

shows how a Switch 3870 and a Switch 4200 can be used for a group of users that require dedicated 10 Mbps,

100 Mbps, or 1000 Mbps connections to the desktop.

Figure 20 Using the Switch 3870 and Switch 4200 in a desktop environment

Switch 3870

Endstations on

10 Mbps/100 Mbps connections

Secure Network

1000 Mbps

Switch 4200

Servers on a

1000 Mbps connection

Advanced Network Configuration Examples

Advanced Network

Configuration

Examples

This section shows some network examples that illustrate how you can set up your network for optimum performance using some of the features supported by your Switch.

Improving the

Resilience of Your

Network

Figure 21 shows how you can set up your network to improve its

resilience using Spanning Tree Protocol (STP) and aggregated links also

Aggregated links increase bandwidth available and also provide extra resilience.

Figure 21 Network set up to provide resilience

Stack of four Switch 3870 units

1000 Mbps with aggregated links set up

100 Mbps

Core Switch

1000 Mbps

Servers on

1000 Mbps connections with resilient links set up

PPENDIX

B: N

ETWORK

ONFIGURATION

XAMPLES

IP A

DDRESSING

This chapter provides some background detail on the IP information that needs to be assigned to your Switch to enable you to manage it across a network. The topics covered are:

■

IP Addresses

Subnets and Subnet Masks

Default Gateways

IP addressing is a vast topic and there are white papers on the World

Wide Web and publications available if you wish to learn more about IP addressing.

IP Addresses

This IP address section is divided into two parts:

■

Simple Overview

— Gives a brief overview of what an IP address is.

Advanced Overview — Gives a more in depth explanation of IP

addresses and the way they are structured.

Simple Overview

To operate correctly, each device on your network must have a unique IP address. IP addresses have the format n.n.n.n where n is a decimal number between 0 and 255. An example IP address is ‘192.168.100.8’.

The IP address can be split into two parts:

■

The first part, called the network part, (‘192.168’ in the example) identifies the network on which the device resides.

The second part, called the host part, (‘100.8’ in the example) identifies the device within the network.

PPENDIX

C: IP A

DDRESSING

If your network is internal to your organization only, you may use any arbitrary IP address. 3Com suggests you use addresses in the series

192.168.100.X (where X is a number between 1 and 254) with a subnet mask 255.255.255.0.

These suggested IP addresses are part of a group of IP addresses that have been set aside specially for use “in house” only.

CAUTION: If your network has a connection to the external IP network, you must apply for a registered IP address. This registration system ensures that every IP address used is unique; if you do not have a registered IP address, you may be using an identical address to someone else and your network will not operate correctly.

Obtaining a Registered IP Address

InterNIC Registration Services is the organization responsible for supplying registered IP addresses. The following contact information is correct at time of publication:

World Wide Web site:

http://www.internic.net

Advanced Overview

IP addresses are 32-bit addresses that consist of a network part (the address of the network where the host is located) and a host part (the address of the host on that network).

Figure 22 IP Address: Network Part and Host Part

IP Address

network host

32 bits

The boundary between network and host parts depends on the class of IP network.

IP addresses differ from Ethernet MAC addresses, which are unique hardware-configured 48-bit addresses. A central agency, such as the

InterNIC Registration Services mentioned above, assigns the network part of the IP address, and you assign the host part. All devices that are connected to the same network share the same network part (also called the prefix).

IP Addresses

Dotted Decimal Notation

The actual IP address is a 32-bit number that is stored in binary format.

These 32 bits are segmented into 4 groups of 8 bits — each group is referred to as a field or an octet. Decimal notation converts the value of each field into a decimal number, and the fields are separated by dots.

Figure 23 Dotted Decimal Notation for IP Addresses

10011110.01100101.00001010.00100000

158.101.10.32

= Binary notation

= Decimal notation

The decimal value of an octet whose bits are all 1s is 255.

Network Portion

The location of the boundary between the network part and the host part depends on the class that the central agency assigns to your network. The three primary classes of IP addresses are as follows:

■

Class A address — Uses 8 bits for the network part and 24 bits for the host part. Although only a few Class A networks can be created, each can contain a very large number of hosts.

Class B address — Uses 16 bits for the network part and 16 bits for the host part.

Class C address — Uses 24 bits for the network part and 8 bits for the host part. Each Class C network can contain only 254 hosts, but many such networks can be created.

The high-order bits of the network part of the address designate the IP network class. See

Table 8 .

Table 8 How Address Class Corresponds to the Address Number

Address Class

High-order Bits

0nnnnnnn

10nnnnnn

11nnnnnn

Address Number

(Decimal)

0-127

128-191

192-254

PPENDIX

C: IP A

DDRESSING

Subnets and Subnet

Masks

You can divide your IP network into sub-networks also known as subnets.

Support for subnets is important because the number of bits assigned to the device part of an IP address limits the number of devices that may be addressed on any given network. For example, a Class C address is restricted to 254 devices.

The IP address can also contain a subnetwork part at the beginning of the host part of the IP address. Thus, you can divide a single Class A, B, or C network internally, allowing the network to appear as a single network to other external networks. The subnetwork part of the IP address is visible only to hosts and gateways on the subnetwork.

When an IP address contains a subnetwork part, a subnet mask identifies the bits that constitute the subnetwork address and the bits that constitute the host address. A subnet mask is a 32-bit number in the IP address format. The 1 bits in the subnet mask indicate the network and subnetwork part of the address. The 0 bits in the subnet mask indicate

the host part of the IP address, as shown in Figure 24

Figure 24 Subnet Masking

IP address

Network

Take the IP address

Subnet and Host

Apply the subnet mask

Subnet mask

1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0

Result = subnet/host boundary

Host

Figure 25 shows an example of an IP address that includes network,

subnetwork, and host parts. Suppose the IP address is 158.101.230.52 with a subnet mask of 255.255.255.0. Since this is a Class B address, this address is divided as follows:

■

158.101 is the network part

230 is the subnetwork part

52 is the host part

Subnets and Subnet Masks

As shown in this example, the 32 bits of an IP address and subnet mask are usually written using an integer shorthand. This notation translates four consecutive 8-bit groups (octets) into four integers that range from 0 through 255. The subnet mask in the example is written as

255.255.255.0.

Traditionally, subnet masks were applied to octets in their entirety.

However, one octet in the subnet mask can be further subdivided so that part of the octet indicates an extension of the network number, and the

rest of the same octet indicates the host number, as shown in Figure 25 .

Figure 25 Extending the Network Prefix

IP address

Network

Take the IP address

Subnet and Host

Apply the subnet mask

Subnet mask

1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 0 0 0 0

Result = subnet/host boundary

Host

Using the Class B IP address from

Figure 24 (158.101.230.52), the subnet

mask is 255.255.255.240.

The number that includes both the Class B natural network mask

(255.255) and the subnet mask (255.240) is sometimes called the

extended network prefix.

Continuing with the previous example, the subnetwork part of the mask uses 12 bits, and the host part uses the remaining 4 bits. Because the octets are actually binary numbers, the number of subnetworks that are possible with this mask is 4,096 (2 12 ), and the number of hosts that are possible in each subnetwork is 16 (2 4 ).

Subnet Mask Numbering

An alternate method to represent the subnet mask numbers is based on the number of bits that signify the network portion of the mask. Many

Internet Service Providers (ISPs) now use this notation to denote the subnet mask. See

Table 9 .

100

PPENDIX

C: IP A

DDRESSING

Table 9 Subnet Mask Notation

Standard Mask Notation

100.100.100.100 (255.0.0.0)

Network Prefix Notation

100.100.100.100/8

100.100.100.100 (255.255.0.0) 100.100.100.100/16

100.100.100.100 (255.255.255.0) 100.100.100.100/24

The subnet mask 255.255.255.255 is reserved as the default broadcast address.

Default Gateways

A gateway is a device on your network which is used to forward IP packets to a remote destination. An alternative name for a gateway is a

Router. “Remote” refers to a destination device that is not directly attached to the same network segment as the source device.

The source device cannot send IP packets directly to the destination device because it is in a different network segment. Instead you configure it to send the packets to a gateway which is attached to multiple segments.

When it receives the IP packets, the gateway determines the next network hop on the path to the remote destination, and sends the packets to that hop. This could either be the remote destination or another gateway closer towards the destination.

This hop-by-hop process continues until the IP packets reach the remote destination.

If manually configuring IP information for the Switch, enter the IP address of the default gateway on the local subnet in which the Switch is located.

If no default gateway exists on your network, enter the IP address

0.0.0.0

or leave the field blank.

LOSSARY

3Com Network

Supervisor

The 3Com network management application used to manage 3Com’s networking solutions.

10BASE-T

The IEEE specification for 10 Mbps Ethernet over Category 3, 4 or 5 twisted pair cable.

100BASE-FX

The IEEE specification for 100 Mbps Fast Ethernet over fiber-optic cable.

100BASE-TX

The IEEE specification for 100 Mbps Fast Ethernet over Category 5 twisted-pair cable.

1000BASE-T

The IEEE specification for 1000 Mbps Gigabit Ethernet over four-pair

Category 5 twisted-pair cable.

1000BASE-SX

The IEEE specification for 1000 Mbps Gigabit Ethernet over fiber-optic cable.

aging

The automatic removal of dynamic entries from the Switch Database which have timed-out and are no longer valid.

Aggregated Links

Aggregated links allow a user to increase the bandwidth and resilience between switches by using a group of ports to carry traffic between the switches.

auto-negotiation

A feature on twisted pair ports that allows them to advertise their capabilities for speed, duplex and flow control. When connected to a port that also supports auto-negotiation, the link can automatically configure itself to the optimum setup.

backbone

The part of a network used as a primary path for transporting traffic between network segments.

bandwidth

The information capacity, measured in bits per second, that a channel can transmit. The bandwidth of Ethernet is 10 Mbps, the bandwidth of

102

LOSSARY

Fast Ethernet is 100 Mbps, and the bandwidth of Gigabit Ethernet is

1000 Mbps.

baud

The signalling rate of a line, that is, the number of transitions (voltage or frequency changes) made per second. Also known as line speed.

bridge

A device that interconnects two LANs of a different type to form a single logical network that comprises of two network segments.

Bridges learn which endstations are on which network segment by examining the source addresses of packets. They then use this information to forward packets based on their destination address. This process is known as filtering.

broadcast

A packet sent to all devices on a network.

broadcast storm

Multiple simultaneous broadcasts that typically absorb all the available network bandwidth and can cause a network to fail. Broadcast storms can be due to faulty network devices.

See Certificate Authority.

cache

Stores copies of frequently accessed objects locally to users and serves them to users when requested.

Certificate Authority

An organization that issues Digital Certificates.

collision

A term used to describe two colliding packets in an Ethernet network.

Collisions are a part of normal Ethernet operation, but a sudden prolonged increase in the number of collisions can indicate a problem with a device, particularly if it is not accompanied by a general increase in traffic.

CSMA/CD

Carrier-sense Multiple Access with Collision Detection. The protocol defined in Ethernet and IEEE 802.3 standards in which devices transmit only after finding a data channel clear for a period of time. When two devices transmit simultaneously, a collision occurs and the colliding devices delay their retransmissions for a random length of time.

DHCP

Dynamic Host Control Protocol. A protocol that lets you centrally manage and automate the assignment of Internet Protocol (IP) addresses in an organization's network.

103

Digital Certificate

Digital Certificates are blocks of data that are used to identify users and systems and encrypt their data. Digital Certificates used by SSL adhere to the X.509 standard.

DNS

Domain Name System. This system maps a numerical Internet Protocol

(IP) address to a more meaningful and easy-to-remember name. When you need to access another device on your network, you enter the name of the device, instead of its IP address.

endstation

A computer, printer or server that is connected to a network.

Ethernet

A LAN specification developed jointly by Xerox, Intel and Digital

Equipment Corporation. Ethernet networks use CSMA/CD to transmit packets at a rate of 10 Mbps over a variety of cables.

Ethernet address

See MAC address.

Fast Ethernet

An Ethernet system that is designed to operate at 100Mbps.

forwarding

The process of sending a packet toward its destination using a networking device.

Forwarding Database

See Switch Database.

filtering

The process of screening a packet for certain characteristics, such as source address, destination address, or protocol. Filtering is used to determine whether traffic is to be forwarded, and can also prevent unauthorized access to a network or network devices.

flow control

A mechanism that prevents packet loss during periods of congestion on the network. Packet loss is caused when devices send traffic to an already overloaded port on a Switch. Flow control prevents packet loss by inhibiting devices from generating more traffic until the period of congestion ends.

FTP

File Transfer Protocol. A protocol based on TCP/IP for reliable file transfer.

full duplex

A system that allows packets to be transmitted and received at the same time and, in effect, doubles the potential throughput of a link.

gateway

See

router

Gigabit Ethernet

IEEE standard 802.3z for 1000 Mbps Ethernet; it is compatible with existing 10/100 Mbps Ethernet standards.

104

LOSSARY

half duplex

A system that allows packets to transmitted and received, but not at the same time. Contrast with full duplex.

hub

A device that regenerates LAN traffic so that the transmission distance of that signal can be extended. Hubs are similar to repeaters, in that they connect LANs of the same type; however they connect more LANs than a repeater and are generally more sophisticated.

HTTP

Hypertext Transfer Protocol. This is a set of rules for exchanging files

(text, graphic images, sound, video, and other multimedia files) on the

World Wide Web.

HTTPS

Hypertext Transfer Protocol over SSL. The term is used to describe HTTP transfers that are encrypted using the SSL protocol.

IEEE

Institute of Electrical and Electronics Engineers. This American organization was founded in 1963 and sets standards for computers and communications.

IEEE Std 802.1D, 1998

Edition

A standard that defines the behavior of bridges in an Ethernet network.

IEEE Std 802.1p

A standard that defines traffic prioritization. 802.1p is now incorporated into the relevant sections of the IEEE Std 802.1D, 1998

Edition.

IEEE Std 802.1Q-1998

A standard that defines VLAN tagging.

IEEE Std 802.3ad

A standard that defines link aggregation. 802.3ad is now incorporated into the relevant sections of the IEEE Std 802.3-2002.

IEEE Std 802.3x

A standard that defines a system of flow control for ports that operate in full duplex. 802.3x is now incorporated into the relevant sections of the IEEE Std 802.3-2002.

IEEE Std 802.1w-2001

A standard that defines Rapid Spanning Tree Protocol (RSTP) behavior.

IEEE Std 802.1X-2001

A standard that defines port-based network access control behavior.

IETF

Internet Engineering Task Force. An organization responsible for providing engineering solutions for TCP/IP networks. In the network management area, this group is responsible for the development of the

SNMP protocol.

105

IGMP snooping

A mechanism performed by an intermediate device, such as a Layer 2

Switch, that optimizes the flow of multicast traffic. The device listens for IGMP messages and build mapping tables and associated forwarding filters, in addition to reducing the IGMP protocol traffic.

Internet Group

Management

Protocol

Internet Group Management Protocol (IGMP) is a protocol that runs between hosts and their immediate neighboring multicast routers. The protocol allows a host to inform its local router that it wishes to receive transmissions addressed to a specific multicast group. Based on group membership information learned from the IGMP, a router is able to determine which if any multicast traffic needs to be forwarded to each of its subnetworks.

Intranet

An Intranet is an organization wide network using Internet protocols such as web services, TCP/IP, HTTP and HTML. An Intranet is normally used for internal communication and information, and is not accessible to computers on the wider Internet.

Internet Protocol. IP is a layer 3 network protocol that is the standard for sending data through a network. IP is part of the TCP/IP set of protocols that describe the routing of packets to addressed devices.

IPX

Internetwork Packet Exchange. IPX is a layer 3 and 4 network protocol designed for networks that use Novell

Netware

IP address

Internet Protocol address. A unique identifier for a device attached to a network using TCP/IP. The address is written as four octets separated with periods (full-stops), and is made up of a network section, an optional subnet section and a host section.

Jitter

An expression often used to describe the end-to-end delay variations during the course of a transmission. See also latency.

LAN

Local Area Network. A network of endstations (such as PCs, printers, servers) and network devices (hubs and switches) that cover a relatively small geographic area (usually not larger than a floor or building). LANs are characterized by high transmission speeds over short distances (up to 1000 m).

LLC

Logical Link Control. A sublayer of the IEEE data link layer that is located above the MAC sublayer. The LLC sublayer is responsible for

MAC sublayer addressing, flow control, error control, and framing.

106

LOSSARY

latency

The delay between the time a device receives a packet and the time the packet is forwarded out of the destination port.

line speed

See baud.

loop

An event that occurs when two network devices are connected by more than one path, thereby causing packets to repeatedly cycle around the network and not reach their destination.

MAC

Media Access Control. A protocol specified by the IEEE for determining which devices have access to a network at any one time.

MAC address

Media Access Control address; also called hardware or physical address.

A layer 2 address associated with a particular network device. Most devices that connect to a LAN have a MAC address assigned to them as they are used to identify other devices in a network. MAC addresses are 6 bytes long.

main port

The port in a resilient link that carries data traffic in normal operating conditions.

MDI

Medium Dependent Interface. An Ethernet port connection where the transmitter of one device is connected to the receiver of another device.

MDI-X

Medium Dependent Interface Cross-over. An Ethernet port connection where the internal transmit and receive lines are crossed.

MIB

Management Information Base. A collection of information about the management characteristics and parameters of a networking device.

MIBs are used by the Simple Network Management Protocol (SNMP) to gather information about the devices on a network. The Switch contains its own internal MIB.

multicast

A packet sent to a specific group of endstations on a network.

multicast filtering

A system that allows a network device to only forward multicast traffic to an endstation if it has registered that it would like to receive that traffic.

NIC

Network Interface Card. A circuit board installed in an endstation that allows it to be connected to a network.

POST

Power On Self Test. An internal test that a Switch carries out when it is powered-up.

107 protocol

A set of rules for communication between devices on a network. The rules dictate format, timing, sequencing and error control.

RADIUS

Remote Authentication Dial-In User Service. An industry standard protocol for carrying authentication, authorization and configuration information between a network device and a shared authentication server.

Rapid Spanning Tree

Protocol

An enhanced version of the Spanning Tree Protocol that allows faster determination of Spanning Tree topology throughout the bridged network.

repeater

A simple device that regenerates LAN traffic so that the transmission distance of that signal can be extended. Repeaters are used to connect two LANs of the same network type.

resilient link

A pair of ports that can be configured so that one takes over data transmission should the other fail. See also main port and standby port.

RMON

IETF Remote Monitoring MIB. A MIB that allows you to remotely monitor LANs by addressing up to nine different groups of information.

router

A router is a device on your network which is used to forward IP packets to a remote destination. An alternative name for a router is a gateway.

RSTP

See Rapid Spanning Tree Protocol.

SAP

Service Access Point. A well-defined location that identifies the user of services of a protocol entity.

Secure Shell

See SSH.

Secure Sockets Layer

See SSL.

segment

A section of a LAN that is connected to the rest of the network using a switch or bridge.

server

A computer in a network that is shared by multiple endstations. Servers provide endstations with access to shared network services such as computer files and printer queues.

SMTP

Simple Mail Transfer Protocol. An IETF standard protocol used for transferring mail across a network reliably and efficiently (as defined in

RFC 821).

108

LOSSARY

SNMP

Simple Network Management Protocol. The current IETF standard protocol for managing devices on an TCP/IP network.

Spanning Tree

Protocol (STP)

A bridge-based system for providing fault tolerance on networks. STP works by allowing you to implement parallel paths for network traffic, and ensure that redundant paths are disabled when the main paths are operational and enabled if the main paths fail.

SSH

Secure Shell. A protocol which allows secure access to the Command

Line Interface of the switch.

SSL

Secure Sockets Layer. A protocol used for encrypting network traffic. It is commonly used to encrypt HTTP traffic between and browser and a

Web server.

standby port

The port in a resilient link that takes over data transmission if the main port in the link fails.

STP

See Spanning Tree Protocol (STP).

subnet mask

A subnet mask is used to divide the device part of the IP address into two further parts. The first part identifies the subnet number. The second part identifies the device on that subnet.

switch

A device that interconnects several LANs to form a single logical LAN that comprises of several LAN segments. Switches are similar to bridges, in that they connect LANs of a different type; however they connect more LANs than a bridge and are generally more sophisticated.

Switch Database

A database that is stored by a switch to determine if a packet should be forwarded, and which port should forward the packet if it is to be forwarded. Also known as Forwarding Database.

TCP/IP

Transmission Control Protocol/Internet Protocol. This is the name for two of the most well-known protocols developed for the interconnection of networks. Originally a UNIX standard, TCP/IP is now supported on almost all platforms, and is the protocol of the Internet.

TCP relates to the content of the data travelling through a network — ensuring that the information sent arrives in one piece when it reaches its destination. IP relates to the address of the endstation to which data is being sent, as well as the address of the destination network.

109

Telnet

A TCP/IP application protocol that provides a virtual terminal service, letting a user log into another computer system and access a device as if the user were connected directly to the device.

TFTP

Trivial File Transfer Protocol. Allows you to transfer files (such as software upgrades) from a remote device using the local management capabilities of the Switch.

traffic prioritization

A system which allows data that has been assigned a high priority to be forwarded through a switch without being obstructed by other data.

unicast

A packet sent to a single endstation on a network.

VLAN

Virtual LAN. A group of location- and topology-independent devices that communicate as if they are on the same physical LAN.

VLAN tagging

A system that allows traffic for multiple VLANs to be carried on a single link.

WAN

Wide Area Network. A communications network that covers a wide area. A WAN can cover a large geographic area, and may contain several LANs within it.

X.509

A standard for Digital Certificates as used by SSL.