If you have ordered modules for your VIP-NET-M28A at the same time, they will be installed and verified at time of order. Otherwise you can purchase modules at any time.

Optional Accessories

•

VPX Standard, Plus, or Custom – Video Over IP Management Software with Automation

•

VPX Wallmaster plugin for VPX

•

VIP-NET Media Hub purpose built for video over ip network switches

Recommended with all Media Hub switches:

•

PureLink VIP Encoders and Decoders

•

PureLink VIP Cameras

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Modules

1G modules Slots 1 <> 3

VIP-NET-M28A-8RJ45

8x RJ45 Ports – 10/100/1000 Base-T

VIP-NET-M28A-8SFP

8x SFP Ports – 10/100/1000 Base-X

VIP-NET-M28A-4ST-MM

4x ST Ports (pairs) – 1000 Base-F(X) Multi Mode

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

VIP-NET-M28A-4ST-SM

4x ST Ports (pairs) – 1000 Base-F(X) Single Mode

1G modules Slot 4

VIP-NET-M28A-4SFP4

4x SFP Ports – 10/100/1000 Base-X

VIP-NET-M28A-4ST-MM4

4x ST Ports (pairs) – 1000 Base-F(X) Multi Mode

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

VIP-NET-M28A-4ST-SM4

4x ST Ports (pairs) – 1000 Base-F(X) Single Mode

10G modules Slot 4

VIP-NET-M28A-4SFP+4

4x SFP+ Ports – 1000/10G Base-F(X)

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Product Description

The VIP-NET-M28A is professional grade layer 3 network switch that includes 1G and 10G connectivity, dual redundant power supplies, and PTP (Precision Timing Protocol). With IEC 61850-3 and IEEE 1613 certifications, the VIP-NET-M28A is ruggedly designed for substation and rolling stock applications and is an excellent fit in mission critical applications such as mobile command and mobile broadcast/production. The VIP-NET-M28A 10G SFP modules can operate in up to 140F conditions, while the remaining modules can operate in up to 185F conditions. In addition, with ethernet redundancy protocols such as O-ring recovery under 30mS and MSTP, the VIP-NET-M28A is ideal for protecting mission critical applications against interruptions or malfunctions.

Features

•

PTP (Precision Timing Protocol)

•

GRE (Generic Routing Encapsulation) tunneling protocol

•

O-Ring (recovery time < 30ms over 250 units of connection) and MSTP(RSTP/STP compatible) for

Ethernet redundancy

•

Open-Ring to interoperate with other vendors ’ ring technology in open architecture

•

O-Chain to allow multiple redundant network rings

•

IEEE 1588v2 clock synchronization

•

IPV6 new internet protocol version

•

Modbus TCP protocol

• priority-tagged frames to be received by specific IEDs

•

IEEE 802.3az Energy-Efficient Ethernet technology

•

HTTPS/SSH protocols to enhance network security

•

SMTP client

•

IP-based bandwidth management application based QoS management

•

Device Binding security function

•

DOS/DDOS auto prevention

•

IGMP v2/v3 (IGMP snooping support) to filter multicast traffic

•

SNMP v1/v2c/v3 & RMON & 802.1Q VLAN network management

•

ACL, TACACS+ and 802.1x user authentication for security

•

10K Bytes Jumbo Frame

• multiple notifications for incidents

• management via Web-based interfaces, Telnet, Console (CLI), and Windows utility (Open-Vision)

•

LLDP Protocol

•

Redundant DC power inputs

• Compliant with IEC 61850-3 and IEEE 1613

•

Supports 3 x 10/100/1000Base-T(X) RJ-45 modules for up to 24 ports

•

Supports 3 x 100/1000Base-X SFP modules for up to 24 ports

•

Supports 1 x 10G SFP+ module for up to 4 ports

•

Operating temperature: -40 to 85 o C (-20 to 60 o C when using 10G SFP module)

•

Operating humidity: 5% to 95%, non-condensing

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Front Panel

1 2 3 4 5

Diagnostic LED center with RS232 console port

1G Slot/Bay 1 (shown with 1G RJ45 module)

1G Slot/Bay 2 (shown with 1G SFP module)

1G Slot/Bay 3 (shown with 1G ST module)

10G Slot/Bay 4 (shown with 10G SFP module)

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Rear Panel

1 2 3

Power supply bay 1

Power supply bay 2

Dual circuit AC power inlet

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Connecting to the VIP-NET-M28A to the Network

The VIP-NET-M28A can be configured from both a built in Web UI, or the API, which can be accessed over the network. The default IP address information is:

IP Address: 192.168.10.1

Subnet Mask: 255.255.255.0

Default Gateway: 192.168.10.254

Username: admin

Password: admin

Windows 8.1 and Windows 10 Computer LAN Port Setup

Opening Network Page

Option 1: Right Click on the taskbar icon that looks like a signal strength indicator. Then click on

“Open Network and Sharing Center”.

Option 2: Use the search window and type “Network and Sharing Center”. When the search function provides choices below, select Network and Sharing Center.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

The next page will be as shown below. Select the “Change Adapter Settings”.

When you are in the Change Adapter Settings page as shown below, select the LAN adapter that you will use to communicate with the VIP-NET-M28A system.

For this example, we will select the middle listing, Qualcomm Atheros LAN Adapter. Double click on the listing. The properties page will open as shown below.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Select “Internet Protocol Version 4 (TCP/IPv4)” by double click on the text.

Note: Do not deselect the checkbox or change the selections of any other properties in the menu.

When the window changes to the Properties page for the Internet Protocol Version 4, enter the same IP subnet as the VIP-NET-M28A system. (VIP-NET-M28A default address is 192.168.1.10

)

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Setting up your Mac computer to communicate on the same subnet

Opening Network Page

From the top menu bar, you can either click on the network symbol

Or click on the Apple icon in the upper left, and the select system preferences:

Then select Network:

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Select the appropriate network adapter from the list in the left pane, and then set the correct IP subnet parameters.

Network switch requirements for Video Over IP Closed Systems

The VIP-NET-M28A L3 Media Hub network switch is compatible with all Media Hub network switches from PureLink. We recommend the Media Hub line as they are video over ip purpose built and ready for use out of the box in closed systems. The Media Hub line of network switches are all either L2+ or L3 switches depending on the model, and support CAT and Fiber transport.

You may use the VIP-NET-M28A with other network switches. Please contact PureLink for design support.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Specifications

Technology

Ethernet Standards

MAC Table

Priority Queues

Processing

Switch Properties

Jumbo frame

Security Featues

Software Features

IEEE 802.3 for 10Base-T

IEEE 802.3u for 100Base-TX and 100Base-FX

IEEE 802.3ab for 1000Base-T

IEEE 802.z for 1000Base-X

IEEE 802.3ae for 10Gigabit Ethernet

IEEE 802.3x for Flow control

IEEE 802.3ad for LACP (Link Aggregation Control Protocol )

IEEE 802.1p for COS (Class of Service)

IEEE 802.1Q for VLAN Tagging

IEEE 802.1w for RSTP (Rapid Spanning Tree Protocol)

IEEE 802.1s for MSTP (Multiple Spanning Tree Protocol)

IEEE 802.1x for Authentication

IEEE 802.1AB for LLDP (Link Layer Discovery Protocol)

32K

Store-and-Forward

Switching latency: 7 us

Switching bandwidth: 128Gbps

Max. Number of Available VLANs: 4095

VLAN ID Range : 1 to 4094

IGMP multicast groups: 128 for each VLAN

Port rate limiting: User Define

Up to 10K Bytes

Device Binding security feature

Enable/disable ports, MAC based port security

Port based network access control (802.1x)

MAC-based authentication

MAC address limit

VLAN (802.1Q ) to segregate and secure network traffic

Radius centralized password management

SNMPv3 encrypted authentication and access security

Https / SSH enhance network security

Web and CLI authentication and authorization

IP source guard

IEEE 1588v2 clock synchronization

IEEE 802.1D Bridge, auto MAC address learning/aging and MAC address

(static)

Multiple Registration Protocol (MRP)

MSTP (RSTP/STP compatible)

Redundant Ring (O-Ring) with recovery time less than 30ms over 250 units

TOS/Diffserv supported

Quality of Service (802.1p) for real-time traffic

VLAN (802.1Q) with VLAN tagging

IGMP v2/v3 Snooping

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Network Redundancy

IP-based bandwidth management

Application-based QoS management

DOS/DDOS auto prevention

Port configuration, status, statistics, monitoring, security

DHCP Server/Client

DHCP Relay

Modbus TCP

SMTP Client

SNTP Server

O-Ring

O-Chain

MRP

MSTP (RSTP/STP compatible)

RS-232 Serial Console

Port

LED Indicators

RS-232 in RJ-45 connector with console cable. 115200bps, 8, N, 1

Power Indicator (PWR)

Green: Indicates that the system ready. The LED is blinking when the system is upgrading firmware

Power Indicator (PWR1

/ PWR2)

Ring Master Indicator

(R.M.)

O-Ring Indicator

(Ring)

Fault Indicator (Fault)

Reset To Default

Running Indicator

(DEF)

Supervisor Login

Indicator (RMT)

Green: Power LED x 2

Green: Indicates that the system is operating in O-Ring Master mode

Green: Indicates that the system operating in O-Ring mode

Green Blinking: Indicates that the Ring is broken.

Amber: Indicate unexpected event occurred

Green: System resets to default configuration

Green: System is accessed remotely

Smart LED Display system

Fault Contact

Relay

Power

Redundant power input modular

Power Consumption

(Typ.)

Link/Act(LK/ACT) / Speed(SPD) / Duplex(FDX) / Remote (RMT) green LED indicator x 4

Mode select Button (MODE) : Link/Act(LK/ACT) / Speed(SPD) / Duplex(FDX)

/ Remote (RMT) mode select button Port 1 ~ 28 Link/Act(LK/ACT) LED show

: Green x 28

Relay output to carry capacity of 1A at 24VDC

Dual 100~240VAC / 100~370VDC power inputs at terminal block

43.5Watts max.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Physical Characteristics

Enclosure 19 inches rack mountable

Dimensions (W x D x

Weight (g)

440 (W) x 325 (D) x 44 (H) mm (17.32x12.8x1.73 inches)

6600 g

MTBF(mean time between failures)

Time

Environmental

Storage Temperature

246,537hrs

-40 to 85°C (-40 to 185°F)

24VDC~36VDC

10G SFP+ module absent: -40 to 75°C

24VDC~36VDC

10G SFP+ module used: -20 to 50 °C

Operating Temperature

10G SFP+ module absent: -40 to 85°C

10G SFP+ module used: -20 to 60 °C

Operating Humidity

Regulatory Approvals

Power Automation

EMI

36VDC~72VDC

10G SFP+ module absent: -40 to 85°C

36VDC~72VDC

10G SFP+ module used: -20 to 60 °C

5% to 95% Non-condensing

EMS

EMC

Safety

Transport

IEC 61850-3, IEEE 1613

FCC Part 15, CISPR (EN55022) class A

IEC61000-4-2 (ESD), IEC61000-4-3 (RS), IEC61000-4-4 (EFT), IEC61000-

4-5 (Surge), IEC61000-4-6 (CS), IEC61000-4-8, IEC61000-4-11

EN50121-4 (EN50121-1)

UL 60950-1

NEMA TS1&TS2

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Connections

Power

Each VIP-NET-M28A is powered by 120/240VAC 50/60 Hz and supports two separate circuit inputs, one each for the two power supplies.

These circuits MUST be from different phases!

Diagnostic LEDs

1 2 3 4

PWR:

PWR1:

PWR 2:

R.M:

Ring:

Fault:

DEF:

LINK:

SPD:

10.

FDX:

11.

RMT:

Power

Power Bay 1

Power Bay 2

Ring Master

Ring

Fault

Reset to Default

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

LED

PWR

PW1

PW2

R.M

Ring

Fault

DEF

RMT

LNK

SPD

FDX

Green

Amber

Green

Amber

Color

Green

Status

Blinking

Slowly blinking

Fast blinking

Blinking

Description

DC power on

Upgrading firmware

DC power module 1 activated

DC power module 2 activated

Ring Master

Ring enabled

Ring structure is broken (i.e. part of the ring is disconnected)

Ring disabled

Errors (power failure or port malfunctioning)

System reset to default

Accessed remotely

Port link up

Data transmitted

Port works under full duplex.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

RJ45 LED

LINK

Green LED

ACT

Orange LED

Status

On

Flash

Description

Ethernet connected

Data transmission

RJ45 cable pin information

(TIA/EIA-568-B)

1. Orange-white Data 1 + 5. Blue-white

2. Orange Data 1 - 6. Green

3. Green-white Data 2 + 7. Brown-white

4. Blue Data 3 + 8. Brown

Data 3 -

Data 2 -

Data 4 +

Data 4 –

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Rear Panel

On the rear panel of the switch sit two panel module slots and one terminal block. The terminal blocks include two power pairs for redundant power supply.

Note :

RLY COM – Relay Com

RLY NO – Relay Normal Open

RLY NC – Relay Normal Close

1. Power panel modules

2. Terminal block

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Rack Mounting

The switch comes with two rack-mount kits to allow you to fasten the switch to a rack in any environments.

Follow the following steps to install the switch to a rack.

Step 1: Install left and right front mounting brackets to the switch using 4 M3 screws on each side provided with switch.

Step 2: With front brackets orientated in front of the rack, nest front and rear brackets together. Fasten together using remaining M4 screws into counter sunk holes.

Step 3: Fasten the front mounting bracket to the front of the rack.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Module Installation

Each VIP-NET-M28A series switch supports maximum three RJ-45 modules, giving you a total of 24 RJ-

45 ports. Follow the steps bellows for installation.

Step 1: Switch off the power of the switch.

Step 2: Insert the modules in Slot 1, 2, and 3 respectively.

Step 3: Switch on the power of the switch

Each VIP-NET-M28A series switch supports maximum three SFP modules, giving you a total of 24 SFP ports. Follow the steps bellows for installation.

Step 1: Switch off the power of the switch.

Step 2: Insert the modules in Slot 1, 2, and 3 respectively.

Step 3: Switch on the power of the switch

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Each VIP-NET-M28A series switch supports one 10G SFP+ module, giving you a total of 4 10G ports.

Follow the steps bellows for installation. PureLink provides several 10G module options. The module can be plugged into the 10-Gigabit Ethernet port of the switch and links the switch with a fiber-optic network.

Follow the steps bellows for installation.

Step 1: Switch off the power of the switch.

Step 2: Insert the modules in Slot 4.

Step 3: Switch on the power of the switch

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Power Modules

Each VIP-NET-M28A series switch supports maximum two power modules. Follow the steps bellows for installation.

Step 1: Switch off the power of the switch.

Step 2: Insert the modules in Power 1 and 2 slots respectively.

Step 3: Switch on the power of the switch

WARNING

Do the type plate. not disconnect modules or wires unless power has been switched off or the area is known to be non-hazardous. The devices may only be connected to the supply voltage shown on

ATTENTION

Be sure to disconnect the power cord before installing and/or wiring your switches.

Calculate the maximum possible current in each power wire and common wire.

Observe all electrical codes dictating the maximum current allowable for each wire size.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

3. If the current goes above the maximum ratings, the wiring could overheat, causing serious damage to your equipment.

4. Use separate paths to route wiring for power and devices. If power wiring and device wiring paths must cross, make sure the wires are perpendicular at the intersection point.

5. Do not run signal or communications wiring and power wiring through the same wire conduit. To avoid interference, wires with different signal characteristics should be routed separately.

6. You can use the type of signal transmitted through a wire to determine which wires should be kept separate. The rule of thumb is that wiring sharing similar electrical characteristics can be bundled together

You should separate input wiring from output wiring

It is advised to label the wiring to all devices in the system

Grounding

Grounding and wire routing help limit the effects of noise due to electromagnetic interference (EMI). Run the ground connection from the ground screws to the grounding surface prior to connecting devices.

Fault Relay

The relay contact of the 2-pin terminal block connector is used to detect user-configured events. The two wires attached to the fault contacts form an open circuit when a user-configured event is triggered. If a userconfigured event does not occur, the fault circuit remains closed.

Redundant Power Inputs

The VIP-NET-M28A series support dual redundant power supplies, Power Supply 1 (PWR1) and Power

Supply 2 (PWR2). The connections for PWR1, PWR2 and the RELAY are located on the terminal block.

Step 1: Insert the negative/positive DC wires into the V-/V+ terminals, respectively.

Step 2: To keep the DC wires from pulling loose, use a small flat-blade screwdriver to tighten the wireclamp screws on the front of the terminal block connector.

Step 3: Insert the plastic terminal block connector prongs into the terminal block receptor.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

O-Ring

You can connect three or more switches to form a ring topology to gain network redundancy capabilities through the following steps.

1. Connect each switch to form a daisy chain using an Ethernet cable.

2. Set one of the connected switches to be the master and make sure the port setting of each connected switch on the management page corresponds to the physical ports connected. For information about the

port setting, please refer to 0 Configurations.

3. Connect the last switch to the first switch to form a ring topology.

O-Ring

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Coupling Ring

If you already have two O-Ring topologies and would like to connect the rings, you can form them into a couping ring. All you need to do is select two switches from each ring to be connected, for example, switch

A and B from Ring 1 and switch C and D from ring 2. Decide which port on each switch to be used as the coupling port and then link them together, for example, port 1 of switch A to port 2 of switch C and port 1 of switch B to port 2 of switch D. Then, enable Coupling Ring option by checking the checkbox on the management page and select the coupling ring in correspondance to the connected port. For more

information on port setting, please refer to 0 Configurations. Once the setting is completed, one of the

connections will act as the main path while the other will act as the backup path.

Switch B

O-Ring

Switch A

Main Path

Backup Path

Switch D

O-Ring

Switch C

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Dual Homing

If you want to connect your ring topology to a RSTP network environment, you can use dual homing.

Choose two switches (Switch A & B) from the ring for connecting to the switches in the RSTP network

(Ciscos switches). The connection of one of the switches (Switch A or B) will act as the primary path, while the other will act as the backup path that is activated when the primary path connection fails.

Backup Path

Switch B

Main Path

O-Ring

RSTP

Switch A

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

O-Chain

When connecting multiple O-Rings to meet your expansion demand, you can create an O-Chain topology through the following steps.

1. Select two switches from the chain (Switch A & B) that you want to connect to the O-Ring and connect them to the switches in the ring (Switch C & D).

2. In correspondence to the port connected to the ring, configure an edge port for both of the connected

switches in the chain by checking the box in the management page (see 0 Configurations).

3. Once the setting is completed, one of the connections will act as the main path, and the other as the back up path.

Edge port

Switch C

O-Ring

Switch D

Switch A

Switch B

Edge port

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Redundancy

Redundancy for minimized system downtime is one of the most important concerns for critical mission networking devices. PureLink provides redundancy technologies including O-Ring, O-RSTP, and Open-

Ring featuring faster recovery time than existing redundancy technologies widely used in commercial applications, such as STP, RSTP, and MSTP. These redundancy technologies not only support different networking topologies, but also assure the reliability of the network.

O-Ring

O-Ring technology provides recovery time of less than 10 milliseconds and up to 250 nodes. The ring protocols identify one switch as the master of the network, and then automatically block packets from traveling through any of the network’s redundant loops. If one branch of the ring gets disconnected from the rest of the network, the protocol automatically readjusts the ring so that the part of the network that was disconnected can reestablish contact with the rest of the network. The O-Ring redundant ring technology can protect mission-critical applications from network interruptions or temporary malfunction with its fast recover technology.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Configurations

O-Ring supports three ring topologies: Ring Master , Coupling Ring , and Dual Homing . You can configure the settings in the interface below.

Label

Redundant Ring

Ring Master

1 st Ring Port

2 nd Ring Port

Coupling Ring

Coupling Port

Dual Homing

Apply

Description

Check to enable O-Ring topology.

Only one ring master is allowed in a ring. However, if more than one switches are set to enable Ring Master , the switch with the lowest MAC address will be the active ring master and the others will be backup masters.

The primary port when the switch is ring master

The backup port when the switch is ring master

Check to enable Coupling Ring .

Coupling Ring can divide a big ring into two smaller rings to avoid network topology changes affecting all switches. It is a good method for connecting two rings.

Ports for connecting multiple rings. A coupling ring needs four switches to build an active and a backup link.

Links formed by the coupling ports will run in active/backup mode.

Check to enable Dual Homing . When Dual Homing is enabled, the ring will be connected to normal switches through two RSTP links (ex: backbone Switch). The two links work in active/backup mode, and connect each ring to the normal switches in RSTP mode.

Click to apply the configurations.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Due to heavy loading, setting one switch as ring master and coupling ring at the same time is not recommended.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

O-Chain

O-Chain enhances network redundancy for any backbone networks, providing ease-of-use and maximum fault-recovery swiftness, flexibility, compatibility, and cost-effectiveness in a set of network redundancy topologies. The self-healing Ethernet technology designed for distributed and complex industrial networks enables the network to recover in less than 10ms for up to 250 switches if at any time a segment of the chain fails.

O-Chain allows multiple redundant rings of different redundancy protocols to join and function together as a large and the most robust network topologies. It can create multiple redundant networks beyond the limitations of current redundant ring technologies.

O-Chain is very easy to configure and manage. Only one edge port of the edge switch needs to be defined.

Other switches beside them just need to have O-Chain enabled.

Label

Enable

1 st Ring Port

2 nd Ring Port

Edge Port

Description

Check to enable O-Chain function

The first port connecting to the ring

The second port connecting to the ring

An O-Chain topology must begin with edge ports. The ports with a smaller switch MAC address will serve as the backup link and

RM LED will light up.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

STP/RSTP/MSTP

STP (Spanning Tree Protocol), and its advanced versions RSTP (Rapid Spanning Tree Protocol) and

MSTP (Multiple Spanning Tree Protocol), are designed to prevent network loops and provide network redundancy. Network loops occur frequently in large networks as when two or more paths run to the same destination, broadcast packets may get in to an infinite loop and hence causing congestion in the network.

STP can identify the best path to the destination, and block all other paths. The blocked links will stay connected but inactive. When the best path fails, the blocked links will be activated. Compared to STP which recovers a link in 30 to 50 seconds, RSTP can shorten the time to 5 to 6 seconds.

STP Bridge Status

This page shows the status for all STP bridge instance.

Label

MSTI

Bridge ID

Root ID

Root Port

Root Cost

Topology Flag

Topology

Change Last

Description

The bridge instance. You can also link to the STP detailed bridge status.

The bridge ID of this bridge instance.

The bridge ID of the currently selected root bridge.

The switch port currently assigned the root port role.

Root path cost. For a root bridge, this is zero. For other bridges, it is the sum of port path costs on the least cost path to the Root Bridge.

The current state of the Topology Change Flag for the bridge instance.

The time since last Topology Change occurred.

Click to refresh the page immediately.

Check this box to enable an automatic refresh of the page at regular intervals.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

STP Port Status

This page displays the STP port status for the currently selected switch.

Label

Port

CIST Role

State

Uptime

Description

The switch port number to which the following settings will be applied.

The current STP port role of the CIST port. The values include:

AlternatePort , BackupPort , RootPort , and DesignatedPort .

The current STP port state of the CIST port. The values include:

Blocking , Learning , and Forwarding .

The time since the bridge port is last initialized

Click to refresh the page immediately.

Check this box to enable an automatic refresh of the page at regular intervals.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

STP Statistics

This page displays the STP port statistics for the currently selected switch.

Label

Port

RSTP

STP

TCN

Discarded Unknown

Discarded Illegal

Description

The switch port number to which the following settings will be applied.

The number of RSTP configuration BPDUs received/transmitted on the port

The number of legacy STP configuration BPDUs received/transmitted on the port

The number of (legacy) topology change notification BPDUs received/transmitted on the port

The number of unknown spanning tree BPDUs received (and discarded) on the port.

The number of illegal spanning tree BPDUs received (and discarded) on the port.

Click to refresh the page immediately

Check to enable an automatic refresh of the page at regular intervals

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

STP Bridge Configurations

Label

Protocol Version

Bridge Priority

Forward Delay

Max Age

Maximum Hop Count

Transmit Hold Count

Description

The version of the STP protocol. Valid values include STP, RSTP and MSTP.

Controls the bridge priority. Lower numeric values have better priority. The bridge priority plus the MSTI instance number, concatenated with the 6-byte MAC address of the switch forms a

Bridge Identifier.

For MSTP operation, this is the priority of the CIST. Otherwise, this is the priority of the STP/RSTP bridge.

The delay used by STP bridges to transit root and designated ports to forwarding (used in STP compatible mode). The range of valid values is 4 to 30 seconds.

The maximum time the information transmitted by the root bridge is considered valid. The range of valid values is 6 to 40 seconds, and Max Age must be <= (FwdDelay-1)*2.

This defines the initial value of remaining hops for MSTI information generated at the boundary of an MSTI region. It defines how many bridges a root bridge can distribute its BPDU information to. The range of valid values is 4 to 30 seconds, and

MaxAge must be <= (FwdDelay-1)*2.

The number of BPDUs a bridge port can send per second. When exceeded, transmission of the next BPDU will be delayed. The range of valid values is 1 to 10 BPDUs per second.

Click to save changes.

Click to undo any changes made locally and revert to previously saved values.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

MSTP

Since the recovery time of STP and RSTP takes seconds, which are unacceptable in some industrial applications, MSTP was developed. The technology supports multiple spanning trees within a network by grouping and mapping multiple VLANs into different spanning-tree instances, known as MSTIs, to form individual MST regions. Each switch is assigned to an MST region. Hence, each MST region consists of one or more MSTP switches with the same VLANs, at least one MST instance, and the same MST region name. Therefore, switches can use different paths in the network to effectively balance loads.

Port Settings

This page allows you to examine and change the configurations of current MSTI ports. A MSTI port is a virtual port, which is instantiated separately for each active CIST (physical) port for each MSTI instance configured and applicable for the port. The MSTI instance must be selected before MSTI port configuration options are displayed.

This page contains MSTI port settings for physical and aggregated ports. The aggregation settings are stack global.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Label

Port

Path Cost

Description

The switch port number of the corresponding STP CIST (and

MSTI) port

Configures the path cost incurred by the port. Auto will set the path cost according to the physical link speed by using the 802.1Drecommended values. Specific allows you to enter a user-defined value. The path cost is used when establishing an active topology for the network. Lower path cost ports are chosen as forwarding ports in favor of higher path cost ports. The range of valid values is 1 to 200000000.

Configures the priority for ports having identical port costs. (See above).

Click to save changes.

Click to undo any changes made locally and revert to previously saved values.

Priority

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Mapping

This page allows you to examine and change the configurations of current STP MSTI bridge instance.

Label

Configuration Name

Configuration

Revision

MSTI

VLANS Mapped

Description

The name which identifies the VLAN to MSTI mapping. Bridges must share the name and revision (see below), as well as the

VLAN-to-MSTI mapping configurations in order to share spanning trees for MSTIs (intra-region). The name should not exceed 32 characters.

Revision of the MSTI configuration named above. This must be an integer between 0 and 65535.

The bridge instance. The CIST is not available for explicit mapping, as it will receive the VLANs not explicitly mapped.

The list of VLANs mapped to the MSTI. The VLANs must be separated with commas and/or space. A VLAN can only be mapped to one MSTI. An unused MSTI will be left empty (ex. without any mapped VLANs).

Click to save changes.

Click to undo any changes made locally and revert to previously saved values.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Priority

This page allows you to examine and change the configurations of current STP MSTI bridge instance priority.

Label

MSTI

Priority

Description

The bridge instance. CIST is the default instance, which is always active.

Indicates bridge priority. The lower the value, the higher the priority. The bridge priority, MSTI instance number, and the 6-byte

MAC address of the switch forms a bridge identifier.

Click to save changes

Click to undo any changes made locally and revert to previously saved values

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

CIST

With the ability to cross regional boundaries, CIST is used by MSTP to communicate with other MSTP regions and with any RSTP and STP single-instance spanning trees in the network. Any boundary port, that is, if it is connected to another region, will automatically belongs solely to CIST, even if it is assigned to an

MSTI. All VLANs that are not members of particular MSTIs are members of the CIST.

Port Settings

Label

Port

STP Enabled

Path Cost

Priority

OpenEdge (setate flag)

AdminEdge

AutoEdge

Description

The switch port number to which the following settings will be applied.

Check to enable STP for the port

Configures the priority for ports having identical port costs. (See above).

A flag indicating whether the port is connected directly to edge devices or not (no bridges attached). Transiting to the forwarding state is faster for edge ports ( operEdge set to true) than other ports.

Configures the operEdge flag to start as set or cleared.(the initial operEdge state when a port is initialized).

Check to enable the bridge to detect edges at the bridge port automatically. This allows operEdge to be derived from whether

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Restricted Role

Restricted TCN

BPDUs are received on the port or not.

When enabled, the port will not be selected as root port for CIST or any MSTI, even if it has the best spanning tree priority vector.

Such a port will be selected as an alternate port after the root port has been selected. If set, spanning trees will lose connectivity. It can be set by a network administrator to prevent bridges outside a core region of the network from influencing the active spanning tree topology because those bridges are not under the full control of the administrator. This feature is also known as Root Guard.

When enabled, the port will not propagate received topology change notifications and topology changes to other ports. If set, it will cause temporary disconnection after changes in an active spanning trees topology as a result of persistent incorrectly learned station location information. It is set by a network administrator to prevent bridges outside a core region of the network from causing address flushing in that region because those bridges are not under the full control of the administrator or is the physical link state for the attached LANs transitions frequently.

Configures whether the port connects to a point-to-point LAN rather than a shared medium. This can be configured automatically or set to true or false manually. Transiting to forwarding state is faster for point-to-point LANs than for shared media.

Click to save changes.

Click to undo any changes made locally and revert to previously saved values.

Point2Point

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Fast Recovery

Fast recovery mode can be set to connect multiple ports to one or more switches. IGPS-9084GP with fast recovery mode will provide redundant links. Fast recovery mode supports 12 priorities. Only the first priority will be the active port, and the other ports with different priorities will be backup ports.

Label

Enable port

Description

Activates fast recovery mode

Ports can be set to 12 priorities. Only the port with the highest priority will be the active port. 1st Priority is the highest.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

anagement

The switch can be controlled via a built-in web server which supports Internet Explorer (Internet Explorer

5.0 or above versions) and other Web browsers such as Chrome. Therefore, you can manage and configure the switch easily and remotely. You can also upgrade firmware via a web browser. The Web management function not only reduces network bandwidth consumption, but also enhances access speed and provides a user-friendly viewing screen.

By default, IE5.0 or later version do not allow Java applets to open sockets. You need to modify the browser setting separately in order to enable Java applets for network ports .

Preparing for Web Management

You can access the management page of the switch via the following default values:

IP Address: 192.168.10.1

Subnet Mask: 255.255.255.0

Default Gateway: 192.168.10.254

User Name: admin

Password: admin

System Login

1. Launch the Internet Explorer.

2. Type http:// and the IP address of the switch. Press Enter .

3. A login screen appears.

4. Type in the username and password. The default username and password is admin .

5. Click Enter or OK button, the management Web page appears.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

After logging in, you can see the information of the switch as below.

On the right hand side of the management interface shows links to various settings. You can click on the links to access the configuration pages of different functions.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Basic Settings

Basic Settings allow you to configure the basic functions of the switch.

System Information

This page shows the general information of the switch.

Label

System Name

System

Description

System Location

System Contact

Description

An administratively assigned name for the managed node. By convention, this is the node's fully-qualified domain name. A domain name is a text string consisting of alphabets (A-Z, a-z), digits (0-9), and minus sign (-). Space is not allowed to be part of the name. The first character must be an alpha character. And the first or last character must not be a minus sign. The allowed string length is 0 to 255.

Description of the device

The physical location of the node (e.g., telephone closet, 3rd floor). The allowed string length is 0 to 255, and only ASCII characters from 32 to 126 are allowed.

The textual identification of the contact person for this managed node, together with information on how to contact this person.

The allowed string length is 0 to 255, and only ASCII characters from 32 to 126 are allowed.

Click to save changes.

Click to undo any changes made locally and revert to previously saved values.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Admin & Password

This page allows you to configure the system password required to access the web pages or log in from

CLI.

Label

Old User Name

Old Password

New User Name

New Password

Confirm New

Password

Description

The existing User name. If this is incorrect, you cannot set the new password.

The existing password. If this is incorrect, you cannot set the new password.

The new system User name. The allowed string length is 0 to 31, and only ASCII characters from 32 to 126 are allowed.

The new system password. The allowed string length is 0 to 31, and only ASCII characters from 32 to 126 are allowed.

Re-type the new password.

Click to save changes.

Authentication

This page allows you to configure how a user is authenticated when he/she logs into the switch via one of the management interfaces.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Label

Client

Authentication

Method

Fallback

Description

The management client for which the configuration below applies.

Method can be set to one of the following values:

•

no :

Authentication is disabled and login is not possible.

local:

Use the local user database on the

switch

for authentication.

•

radius:

Use remote RADIUS server(s) for authentication.

•

tacacs+:

Use remote TACACS+ server(s) for authentication.

Check to enable fallback to local authentication.

If none of the configured authentication servers are active, the local user database is used for authentication.

This is only possible if Authentication Method is set to a value other than none or local .

Click to save changes

Click to undo any changes made locally and revert to previously saved values

IP Settings

This page allows you to configure IP information for the switch. You can configure the settings of the device operating in host or router mode.

Label

Mode

IP Interface

Description

Configure whether the IP stack should act as a host or a router.

In Host mode, IP traffic between interfaces will not be routed.

In Router mode traffic is routed between all interfaces.

You can configure the information of IPv4 and IPv6 in this section. IPv4 DHCP configurations include:

Enable : check to enable IPv4 DHCP function.

Fallback: specifies the number of seconds for trying to obtain

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

a DHCP lease.

Current Lease : For DHCP interfaces with an active lease, the column shows the current interface address, as provided by the DHCP server.

IPv4 configurations include:

Address : shows the IPv4 address of the interface in dotted decimal notation. If DHCP is enabled, this field is not used. The field may also be left blank if IPv4 operation on the interface is not desired.

Mask Length : the IPv4 network mask, in number of bits (prefix length). Valid values are between 0 and 30 bits for an IPv4 address. If DHCP is enabled, this field is not used. The field may also be left blank if IPv4 operation on the interface is not desired.

IPv6 configurations include:

Address : shows the address of the interface. A IPv6 address is in 128-bit records represented as eight fields of up to four hexadecimal digits with a colon separating each field (:). For example, fe80::21:cff:fe03:4dc7. The symbol :: is a special syntax that can be used as a shorthand way of representing multiple 16-bit groups of contiguous zeros; but it can appear only once. It can also represent a legally valid IPv4 address.

For example: 192.1.2.34. The field may be left blank if IPv6 operation on the interface is not desired.

Mask Length : the IPv6 network mask, in number of bits (prefix length). Valid values are between 1 and 128 bits for a IPv6 address. The field may be left blank if IPv6 operation on the interface is not desired.

IP Routes

Delete : Select this option to delete an existing IP route.

Network : The destination IP network or host address of this route. Valid format is dotted decimal notation or a valid IPv6 notation. A default route can use the value 0.0.0.0 or IPv6 notation.

Mask Length : The destination IP network or host mask, in number of bits (prefix length). It defines how much of a network address that must match, in order to qualify for this route. Valid values are between 0 and 32 bits respectively 128 for IPv6 routes. Only a default route will have a mask length of 0 (as it will match anything).

Gateway : The IP address of the IP gateway. Valid format is dotted decimal notation or a valid IPv6 notation. Gateway and

Network must be of the same type.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Next Hop VLAN : The VLAN ID (VID) of the specific IPv6 interface associated with the gateway. The given VID ranges from 1 to 4094 and will be effective only when the corresponding IPv6 interface is valid. If the IPv6 gateway address is link-local, it must specify the next hop VLAN for the gateway. If the IPv6 gateway address is not link-local, system ignores the next hop VLAN for the gateway.

IP Status

This page will show the IP details of the device based on the settings you made in the IP Setting section.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Daylight Saving Time

Label

Time Zone Configuration

Daylight Saving Time

Configuration

Description

Time Zone : Set the switch location time zone. The following table lists the different location time zone for your reference.

Acronym : User can set the acronym of the time zone. This is a User configurable acronym to identify the time zone. (Range:

Up to 16 alpha-numeric characters and can contain '-', '_' or

'.').

Daylight Saving Time Mode : Enable or disable daylight saving time function. This is used to set the clock forward or backward according to the configurations set below for a defined daylight saving time duration. Select 'Disable' to disable the daylight saving time configuration. Select

'Recurring' and configure the Daylight Saving Time duration to repeat the configuration every year. Select ' Non-Recurring ' and configure the daylight saving time duration for single time configuration. ( Default : Disabled ).

Start Time Settings: Set up the start time of the daylight saving time period.

End Time Settings: Set up the ending time of the daylight saving time period.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Local Time Zone

November Time Zone

Oscar Time Zone

ADT - Atlantic Daylight

AST - Atlantic Standard

EDT - Eastern Daylight

EST - Eastern Standard

CDT - Central Daylight

CST - Central Standard

MDT - Mountain Daylight

MST - Mountain Standard

PDT - Pacific Daylight

PST - Pacific Standard

ADT - Alaskan Daylight

ALA - Alaskan Standard

HAW - Hawaiian Standard

Nome, Alaska

Offset Settings: Set up the offset time.

Conversion from UTC Time at 12:00 UTC

- 1 hour 11 am

-2 hours

-3 hours

-4 hours

-5 hours

-6 hours

-7 hours

-8 hours

-9 hours

-10 hours

-11 hours

10 am

9 am

8 am

7 am

6 am

5 am

4 am

3 am

2 am

1 am

CET - Central European

FWT - French Winter

MET - Middle European

MEWT - Middle European Winter

SWT - Swedish Winter

+1 hour 1 pm

EET - Eastern European, USSR

Zone 1

BT - Baghdad, USSR Zone 2

ZP4 - USSR Zone 3

ZP5 - USSR Zone 4

+2 hours

+3 hours

+4 hours

+5 hours

2 pm

3 pm

4 pm

5 pm

ZP6 - USSR Zone 5

WAST - West Australian Standard

+6 hours

+7 hours

6 pm

7 pm

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

CCT - China Coast, USSR Zone 7

JST - Japan Standard, USSR

Zone 8

EAST - East Australian Standard

GST

Guam Standard, USSR Zone 9

IDLE - International Date Line

NZST - New Zealand Standard

NZT - New Zealand

+8 hours

+9 hours

+10 hours

+12 hours

8 pm

9 pm

10 pm

Midnight

RIP

RIP (Routing Information Protocol) is one of the protocols which may be used by routers to exchange network topology information. It is characterized as an “interior” gateway protocol, and is typically used in small to medium-sized networks. A router running RIP sends the contents of its routing table to each of its adjacent routers every 30 seconds. When a route is removed from the routing table it is flagged as unusable by the receiving routers after 180 seconds, and removed from their tables after an additional

120 seconds. You can choose to enable or disable RIP in the section.

VRRP

A VRRP (Virtual Router Redundancy Protocol) is a computer networking protocol aimed to eliminate the single point of failure by automatically assigning available IP routers to participating hosts. Using a virtual router ID (VRID) address and virtual router IP (VRIP) address to represent itself, a virtual router consists of two or more physical routers, including one master router and one or more backup routers. All routers in the virtual router group share the same VRID and VRIP. The master router provides primary routing and the backup routers monitor the status of the master router and become active if the master router fails.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Label

VRRP Global

VRRP Group

Description

Mode : user can enable or disable VRRP Function

Version : support VRRP V2 / V3

For each VRRP Group, we provide several options:

VRID : Virtual Router ID, from 1 to 254.

VLAN ID : input VLAN ID , from 1 to 4096

Primary IP :

Priority : Priority, from 1 to 254.

Input Virtual IP.

Adver Intv : Advertisement packet forwarding interval .

Preempt mode : Controls whether a (starting or restarting) higherpriority Backup router preempts a lower-priority Master router.

Values are True to allow preemption and False to prohibit preemption. Default is True.

Auth Type : user can setting NoAuth / Simple Text

AuthCode : Password, 8 characters.

AuthCode : Enter the authorization code for the VRRP group

VRRP Status : show VRRP Master / Backup Status .

Virtual MAC : show Virtual MAC Address .

HTTPS

You can configure the HTTPS mode in the following page.

Label

Mode

Description

Indicates the selected HTTPS mode. When the current connection is HTTPS, disabling HTTPS will automatically redirect web browser to an HTTP connection. The modes include:

Enabled : enable HTTPS.

Disabled : disable HTTPS.

Click to save changes

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Click to undo any changes made locally and revert to previously saved values

SSH

You can configure the SSH mode in the following page.

Label

Mode

Description

Indicates the selected SSH mode. The modes include:

Enabled : enable SSH.

Disabled : disable SSH.

Click to save changes

Click to undo any changes made locally and revert to previously saved values

e

DBU01 Option Config

DBU01 is an embedded configuration backup/restore function. It allows you to store and restore device configurations without using a PC.

Label

Backup Option

Restore Option

Description

Enable or disable backup function. If enabled, existing configurations will be stored as a backup file.

Enable or disable backup function. If enabled, the system will apply saved configurations to the device.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

LLDP

LLDP Configurations

This page allows you to examine and configure current LLDP port settings.

Label

Port

Mode

Description

The switch port number to which the following settings will be applied.

Indicates the selected LLDP mode

Rx only : the switch will not send out LLDP information, but LLDP information from its neighbors will be analyzed.

Tx only : the switch will drop LLDP information received from its neighbors, but will send out LLDP information.

Disabled : the switch will not send out LLDP information, and will drop LLDP information received from its neighbors.

Enabled : the switch will send out LLDP information, and will analyze LLDP information received from its neighbors.

LLDP Neighbor Information

This page provides a status overview for all LLDP neighbors. The following table contains information for each port on which an LLDP neighbor is detected. The columns include the following information:

Label

Local Port

Chassis ID

Remote Port ID

System Name

Port Description

System Capabilities

Description

The port that you use to transmits and receives LLDP frames.

The identification number of the neighbor sending out the LLDP frames.

The identification of the neighbor port

The name advertised by the neighbor.

The description of the port advertised by the neighbor.

Description of the neighbor's capabilities. The capabilities include:

1. Other

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Management

Address

2. Repeater

3. Bridge

4. WLAN Access Point

5. Router

6. Telephone

7. DOCSIS Cable Device

8. Station Only

9. Reserved

When a capability is enabled, a (+) will be displayed. If the capability is disabled, a (-) will be displayed.

The neighbor's address which can be used to help network management. This may contain the neighbor's IP address.

Click to refresh the page immediately

Check to enable an automatic refresh of the page at regular intervals

Port Statistics

This page provides an overview of all LLDP traffic. Two types of counters are shown. Global counters will apply settings to the whole switch stack, while local counters will apply settings to specified switches.

Global Counters

Label

Neighbor entries were last changed at

Total Neighbors

Entries Added

Total Neighbors

Entries Deleted

Total Neighbors

Entries Dropped

Total Neighbors

Description

Shows the time when the last entry was deleted or added.

Shows the number of new entries added since switch reboot

Shows the number of new entries deleted since switch reboot

Shows the number of LLDP frames dropped due to full entry table

Shows the number of entries deleted due to expired time-to-live

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Entries Aged Out

Local Counters

Label

Local Port

Tx Frames

Rx Frames

Rx Errors

Frames Discarded

TLVs Discarded

TLVs Unrecognized

Org. Discarded

Age-Outs

Description

The port that receives or transmits LLDP frames

The number of LLDP frames transmitted on the port

The number of LLDP frames received on the port

The number of received LLDP frames containing errors

If a port receives an LLDP frame, and the switch's internal table is full, the LLDP frame will be counted and discarded. This situation is known as "too many neighbors" in the LLDP standard. LLDP frames require a new entry in the table if Chassis ID or Remote

Port ID is not included in the table. Entries are removed from the table when a given port links down, an LLDP shutdown frame is received, or when the entry ages out.

Each LLDP frame can contain multiple pieces of information, known as TLVs (Type Length Value). If a TLV is malformed, it will be counted and discarded.

The number of well-formed TLVs, but with an unknown type value

The number of organizationally TLVs received

Each LLDP frame contains information about how long the LLDP information is valid (age-out time). If no new LLDP frame is received during the age-out time, the LLDP information will be removed, and the value of the age-out counter will be incremented.

Click to refresh the page immediately

Click to clear the local counters. All counters (including global counters) are cleared upon reboot.

Check to enable an automatic refresh of the page at regular intervals

UPnP

UPnP is an acronym for Universal Plug and Play. The goals of UPnP are to allow devices to connect seamlessly and to simplify the implementation of networks in the home (data sharing, communications, and entertainment) and in corporate environments for simplified installation of computer components

Label

Mode

Description

Indicates the UPnP operation mode. Possible modes are:

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

TTL

Advertising Duration

Enabled: Enable UPnP mode operation.

Disabled: Disable UPnP mode operation.

When the mode is enabled, two ACEs are added automatically to trap UPNP related packets to CPU. The ACEs are automatically removed when the mode is disabled.

The TTL value is used by UPnP to send SSDP advertisement messages. Valid values are in the range 1 to 255.

The duration, carried in SSDP packets, is used to inform a control point or control points how often it or they should receive an SSDP advertisement message from this switch. If a control point does not receive any message within the duration, it will think that the switch no longer exists. Due to the unreliable nature of UDP, in the standard it is recommended that such refreshing of advertisements to be done at less than one-half of the advertising duration. In the implementation, the switch sends SSDP messages periodically at the interval one-half of the advertising duration minus 30 seconds. Valid values are in the range 100 to 86400.

NTP

The function allows you to specify the Network Time Protocol (NTP) servers to query for the current time to maintain an accurate time on the switch, ensuring the system log record meaningful dates and times for event entries. With NTP, the switch can set its internal clock periodically according to an NTP time server.

Otherwise, the switch will only record the time from the factory default set at the last bootup. When the NTP client is enabled, the switch regularly sends a request for a time update to a configured time server. A maximum of five time servers are supported. The switch will attempt to poll each server in the configured sequence.

Label

Mode

Description

Select a NTP mode from the drop down list.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Server Sets the IP address for up to five time servers. The switch will update the time from the servers, starting from the first to the fifth in sequence if any of them fails. The polling interval is fixed at 15 minutes.

Modbus TCP

This page shows Modbus TCP support of the switch. (For more information regarding Modbus, please visit

http://www.modbus.org/

)

Label

Mode

Description

Shows the existing status of the Modbus TCP function

EtherNet/IP

EtherNet/IP is an industrial network protocol that adapts the Common Industrial Protocol to standard

Ethernet.[1] EtherNet/IP is one of the leading industrial protocols in the United States and is widely used in a range of industries including factory, hybrid and process.

Label

Mode

Description

Indicates the EtherNet/IP mode operation. Possible modes are:

Enabled: Enable EtherNet/IP mode operation.

Disabled: Disable EtherNet/IP mode operation.

Backup/Restore Configurations

You can save/view or load switch configurations. The configuration file is in XML format.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Firmware Update

This page allows you to update the firmware of the switch.

DHCP Server

The switch provides DHCP server functions. By enabling DHCP, the switch will become a DHCP server and dynamically assigns IP addresses and related IP information to network clients.

Basic Settings

This page allows you to set up DHCP settings for the switch. You can check the Enabled checkbox to activate the function. Once the box is checked, you will be able to input information in each column.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Dynamic Client List

When DHCP server functions are activated, the switch will collect DHCP client information and display in the following table.

Client List

You can assign a specific IP address within the dynamic IP range to a specific port. When a device is connected to the port and requests for dynamic IP assigning, the switch will assign the IP address that has previously been assigned to the connected device.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

DHCP Snooping / Relay Agent

DHCP Snooping

DHCP Snooping is used to block intruder on the untrusted ports of the switch device when it tries to intervene by injecting a bogus DHCP reply packet to a legitimate conversation between the DHCP client and server.

Label

Snooping Mode

Description

Indicates the DHCP snooping mode operation. Possible modes are:

Enabled: Enable DHCP snooping mode operation. When

DHCP snooping mode operation is enabled, the DHCP request messages will be forwarded to trusted ports and only allow reply packets from trusted ports.

Disabled: Disable DHCP snooping mode operation.

Port Mode Configuration Indicates the DHCP snooping port mode. Possible port modes are:

Trusted: Configures the port as trusted source of the DHCP messages.

Untrusted: Configures the port as untrusted source of the

DHCP messages.

DHCP Snooping Statistics

This page provides statistics for DHCP snooping. The statistics doesn't count the DHCP packets for system

DHCP client or DHCP relay mode is enabled.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Label

Rx and Tx Discovery

Rx AND Tx Offer

Rx AND Tx Request

Rx AND Tx Decline

Rx and Tx ACK

Rx and Tx NAK

Rx and Tx Release

Rx and Tx inform

Description

The number of discover (option 53 with value 1) packets received and transmitted.

The number of offer (option 53 with value 2) packets received and transmitted.

The number of request (option 53 with value 3) packets received and transmitted.

The number of decline (option 53 with value 4) packets received and transmitted.

The number of ACK (option 53 with value 5) packets received and transmitted.

The number of NAK (option 53 with value 6) packets received and transmitted.

The number of release (option 53 with value 7) packets received and transmitted.

The number of inform (option 53 with value 8) packets received and transmitted.

Rx and Tx Lease Query

Rx and Tx Lease

Unassigned

The number of lease query (option 53 with value 10) packets received and transmitted.

The number of lease unassigned (option 53 with value 11) packets received and transmitted.

Rx and Tx Lease Unkonw The number of lease unknown (option 53 with value 12) packets received and transmitted.

Rx and Tx Lease Active The number of lease active (option 53 with value 13) packets received and transmitted.

Rx Discarded from

Untusted

Rx Discarded checksum error

The number of discarded packet that are coming from untrusted port.

The number of discard packet that IP/UDP checksum is error.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Relay Agent

DHCP relay is used to forward and transfer DHCP messages between the clients and the server when they are not in the same subnet domain. You can configure the function in this page.

Label

Relay Mode

Description

Indicates the existing DHCP relay mode. The modes include:

Enabled : activate DHCP relay. When DHCP relay is enabled, the agent forwards and transfers DHCP messages between the clients and the server when they are not in the same subnet domain to prevent the DHCP broadcast message from flooding for security considerations.

Disabled : disable DHCP relay

Relay Server Indicates the DHCP relay server IP address. A DHCP relay agent is used to forward and transfer DHCP messages between the clients and the server when they are not in the same subnet domain.

Relay Information Mode Indicates the existing DHCP relay information mode. The format of DHCP option 82 circuit ID format is

"[vlan_id][module_id][port_no]". The first four characters represent the VLAN ID, and the fifth and sixth characters are the module ID. In stand-alone devices, the module ID always equals to 0; in stacked devices, it means switch ID. The last two characters are the port number. For example, "00030108" means the DHCP message received form VLAN ID 3, switch

ID 1, and port No. 8. The option 82 remote ID value equals to the switch MAC address.

The modes include:

Enabled : activate DHCP relay information. When DHCP relay information is enabled, the agent inserts specific information

(option 82) into a DHCP message when forwarding to a DHCP server and removes it from a DHCP message when transferring to a DHCP client. It only works when DHCP relay mode is enabled.

Disabled : disable DHCP relay information

Relay Information Policy Indicates the policies to be enforced when receiving DHCP relay information. When DHCP relay information mode is enabled, if the agent receives a DHCP message that already

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

contains relay agent information, it will enforce the policy. The

Replace option is invalid when relay information mode is disabled. The policies includes:

Replace : replace the original relay information when a DHCP message containing the information is received.

Keep : keep the original relay information when a DHCP message containing the information is received.

Drop : drop the package when a DHCP message containing the information is received.

Relay Agent Statistics

The relay statistics shows the information of relayed packet of the switch.

Label

Transmit to Sever

Transmit Error

Receive from Server

Receive Missing Agent

Option

Receive Missing Circuit

Description

The number of packets relayed from the client to the server

The number of packets with errors when being sent to clients

The number of packets received from the server

The number of packets received without agent information

The number of packets received with Circuit ID

Receive Missing Remote

Receive Bad Circuit ID

The number of packets received with the Remote ID option missing.

The number of packets whose Circuit ID do not match the known circuit ID

Receive Bad Remote ID The number of packets whose Remote ID do not match the known Remote ID

Label

Transmit to Client

Transmit Error

Receive from Client

Receive Agent Option

Replace Agent Option

Description

The number of packets relayed from the server to the client

The number of packets with errors when being sent to servers

The number of packets received from the server

The number of received packets containing relay agent information

The number of packets replaced when received messages contain relay agent information.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Keep Agent Option

Drop Agent Option

The number of packets whose relay agent information is retained

The number of packets dropped when received messages contain relay agent information.

Port Setting

Port Setting allows you to manage individual ports of the switch, including traffic, power, and trunks.

Port Control

This page shows current port configurations. Ports can also be configured here.

Label

Port

Link

Current Link Speed

Configured Link

Speed

Flow Control

Maximum Frame

Description

The switch port number to which the following settings will be applied.

The current link state is shown by different colors. Green indicates the link is up and red means the link is down.

Indicates the current link speed of the port

The drop-down list provides available link speed options for a given switch port

Auto selects the highest speed supported by the link partner

Disabled disables switch port configuration

<> configures all ports

When Auto is selected for the speed, the flow control will be negotiated to the capacity advertised by the link partner.

When a fixed-speed setting is selected, that is what is used.

Current Rx indicates whether pause frames on the port are obeyed, and Current Tx indicates whether pause frames on the port are transmitted. The Rx and Tx settings are determined by the result of the last auto-negotiation.

You can check the Configured column to use flow control. This setting is related to the setting of Configured Link Speed .

You can enter the maximum frame size allowed for the switch port

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Excessive Collision

Mode in this column, including FCS. The allowed range is 1518 bytes to

9600 bytes.

Configure port transmit collision behavior.

Discard: Discard frame after 16 collisions (default).

Restart: Restart backoff algorithm after 16 collisions.

Click to save changes

Click to undo any changes made locally and revert to previously saved values

Click to refresh the page. Any changes made locally will be undone.

Port Alias

You can assign a port alias name for each port to enable easy identification of the devices connected to the port.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Port Trunk

This page allows you to configure the aggregation hash mode and the aggregation group.

Label Description

Source MAC Address Calculates the destination port of the frame. You can check this box to enable the source MAC address, or uncheck to disable. By default, Source MAC Address is enabled.

Destination MAC

Address

IP Address

Calculates the destination port of the frame. You can check this box to enable the destination MAC address, or uncheck to disable.

By default, Destination MAC Address is disabled.

Calculates the destination port of the frame. You can check this box to enable the IP address, or uncheck to disable. By default, IP

Address is enabled.

TCP/UDP Port

Number

Calculates the destination port of the frame. You can check this box to enable the TCP/UDP port number, or uncheck to disable.

By default, TCP/UDP Port Number is enabled.

Label

Group ID

Port Members

Description

Indicates the ID of each aggregation group. Normal means no aggregation. Only one group ID is valid per port.

Lists each switch port for each group ID. Select a radio button to include a port in an aggregation, or clear the radio button to

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

remove the port from the aggregation. By default, no ports belong to any aggregation group. Only full duplex ports can join an aggregation and the ports must be in the same speed in each group.

LACP

This page allows you to enable LACP functions to

group ports together to form single virtual links, thereby increasing the bandwidth between the switch and other LACP-compatible devices

LACP trunks are similar to static port trunks, but they are more flexible because LACP is compliant with the IEEE

802.3ad standard. Hence, it is interoperable with equipment from other vendors that also comply with the standard. You can change LACP port settings in this page.

Label

Port

LACP Enabled

Key

Role

Description

Indicates the ID of each aggregation group. Normal indicates there is no aggregation. Only one group ID is valid per port.

Lists each switch port for each group ID. Check to include a port in an aggregation, or clear the box to remove the port from the aggregation. By default, no ports belong to any aggregation group.

Only full duplex ports can join an aggregation and the ports must be in the same speed in each group.

The Key value varies with the port, ranging from 1 to 65535. Auto will set the key according to the physical link speed (10Mb = 1,

100Mb = 2, 1Gb = 3). Specific allows you to enter a user-defined value. Ports with the same key value can join in the same aggregation group, while ports with different keys cannot.

Indicates LACP activity status. Active will transmit LACP packets every second, while Passive will wait for a LACP packet from a partner (speak if spoken to).

Click to save changes

Click to undo any changes made locally and revert to previously saved values

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

LACP System Status

This page provides a status overview for all LACP instances.

Label

Aggr ID

Partner System ID

Partner Key

Last Changed

Last Channged

Description

The aggregation ID is associated with the aggregation instance.

For LLAG, the ID is shown as ' isid:aggr-id ' and for GLAGs as

' aggr-id '

System ID (MAC address) of the aggregation partner

The key assigned by the partner to the aggregation ID

The time since this aggregation changed.

Indicates which ports belong to the aggregation of the switch/stack. The format is: " Switch ID:Port ".

Click to refresh the page immediately

Check to enable an automatic refresh of the page at regular intervals

LACP Status

This page provides an overview of the LACP status for all ports.

Label

Port

LACP

Key

Aggr ID

Partner System ID

Description

Switch port number

Yes means LACP is enabled and the port link is up. No means

LACP is not enabled or the port link is down. Backup means the port cannot join in the aggregation group unless other ports are removed. The LACP status is disabled.

The key assigned to the port. Only ports with the same key can be aggregated

The aggregation ID assigned to the aggregation group

The partner’s system ID (MAC address)

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Partner Port The partner’s port number associated with the port

Click to refresh the page immediately

Check to enable an automatic refresh of the page at regular intervals

LACP Statistics

This page provides an overview of the LACP statistics for all ports.

Label

Port

LACP Transmitted

LACP Received

Discarded

Description

Switch port number

The number of LACP frames sent from each port

The number of LACP frames received at each port

The number of unknown or illegal LACP frames discarded at each port.

Click to refresh the page immediately

Check to enable an automatic refresh of the page at regular intervals

Click to clear the counters for all ports

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Loop Guard

This feature prevents loop attack. When receiving loop packets, the port will be disabled automatically, preventing the loop attack from affecting other network devices.

Label Description

Enable Loop Protection Activate loop protection functions (as a whole)

Transmission Time The interval between each loop protection PDU sent on each port. The valid value is 1 to 10 seconds.

Shutdown Time The period (in seconds) for which a port will be kept disabled when a loop is detected (shutting down the port). The valid value is 0 to 604800 seconds (7 days). A value of zero will keep a port disabled permanently (until the device is restarted).

Label

Port

Enable

Action

Tx Mode

Description

Switch port number

Activate loop protection functions (as a whole)

Configures the action to take when a loop is detected. Valid values include

Shutdown Port , Shutdown Port , and Log or Log Only .

Controls whether the port is actively generating loop protection PDUs or only passively look for looped PDUs.

VLAN

VLAN Membership

You can view and change VLAN membership configurations for a selected switch stack in this page. Up to

64 VLANs are supported. This page allows for adding and deleting VLANs as well as adding and deleting port members of each VLAN.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Label

Delete

Description

Check to delete the entry. It will be deleted during the next save.

VLAN ID The VLAN ID for the entry

MAC Address The MAC address for the entry

Port Members

Add New VLAN

Checkmarks indicate which ports are members of the entry. Check or uncheck as needed to modify the entry

Click to add a new VLAN ID. An empty row is added to the table, and the

VLAN can be configured as needed. Valid values for a VLAN ID are 1 through 4095.

After clicking Save , the new VLAN will be enabled on the selected switch stack but contains no port members.

A VLAN without any port members on any stack will be deleted when you click Save.

Click Delete to undo the addition of new VLANs.

Port Configurations

This page allows you to set up VLAN ports individually.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Label

Ethertype for customer S-Ports

Port

Port type

Ingress Filtering

Frame Type

Port VLAN Mode

Description

This field specifies the Ether type used for custom S-ports. This is a global setting for all custom S-ports.

The switch port number to which the following settings will be applied.

Port can be one of the following types: Unaware , Customer ( Cport ), Service ( S-port ), Custom Service ( S-custom-port ).

If port type is Unaware , all frames are classified to the port VLAN

ID and tags are not removed.

Enable ingress filtering on a port by checking the box. This parameter affects VLAN ingress processing. If ingress filtering is enabled and the ingress port is not a member of the classified

VLAN of the frame, the frame will be discarded. By default, ingress filtering is disabled (no check mark).

Determines whether the port accepts all frames or only tagged/untagged frames. This parameter affects VLAN ingress processing. If the port only accepts tagged frames, untagged frames received on the port will be discarded. By default, the field is set to All.

The allowed values are None or Specific . This parameter affects

VLAN ingress and egress processing.

If None is selected, a VLAN tag with the classified VLAN ID is inserted in frames transmitted on the port. This mode is normally used for ports connected to VLAN-aware switches. Tx tag should be set to Untag_pvid when this mode is used.

If Specific (the default value) is selected, a port VLAN ID can be configured (see below). Untagged frames received on the port are

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Port VLAN ID

Tx Tag classified to the port VLAN ID. If VLAN awareness is disabled, all frames received on the port are classified to the port VLAN ID. If the classified VLAN ID of a frame transmitted on the port is different from the port VLAN ID, a VLAN tag with the classified

VLAN ID will be inserted in the frame.

Configures the VLAN identifier for the port. The allowed range of the values is 1 through 4095. The default value is 1.

Note: The port must be a member of the same VLAN as the port

VLAN ID.

Determines egress tagging of a port. Untag_pvid : all VLANs except the configured PVID will be tagged. Tag_all : all VLANs are tagged. Untag_all : all VLANs are untagged.

Introduction of Port Types

Below is a detailed description of each port type, including Unaware, C-port, S-port, and S-custom-port.

Unaware

The function of Unaware can be used for

802.1QinQ

(double tag).

C-port

S-port

S-customport

Ingress action

When the port receives untagged frames, an untagged frame obtains a tag (based on PVID) and is forwarded.

When the port receives tagged frames,

1. if the tagged frame contains a TPID of 0x8100, it will become a double-tag frame and will be forwarded.

2. if the TPID of tagged frame is not 0x8100 (ex.

0x88A8), it will be discarded.

When the port receives untagged frames, an untagged frame obtains a tag (based on PVID) and is forwarded.

When the port receives tagged frames,

1. if the tagged frame contains a TPID of 0x8100, it will be forwarded.

2. if the TPID of tagged frame is not 0x8100 (ex.

0x88A8), it will be discarded.

When the port receives untagged frames, an untagged frame obtains a tag (based on PVID) and is forwarded.

When the port receives tagged frames,

1. if the tagged frame contains a TPID of 0x8100, it will be forwarded.

2. if the TPID of tagged frame is not 0x88A8 (ex.

0x8100), it will be discarded.

When the port receives untagged frames, an untagged frame obtains a tag (based on PVID) and is forwarded.

When the port receives tagged frames,

Egress action

The TPID of a frame transmitted by Unaware port will be set to

0x8100.

The final status of the frame after egressing will also be affected by the Egress Rule.

The TPID of a frame transmitted by C-port will be set to 0x8100.

The TPID of a frame transmitted by S-port will be set to 0x88A8.

The TPID of a frame transmitted by Scustom-port will be set to a self-customized value, which can be set

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

1. if the tagged frame contains a TPID of 0x8100, it will be forwarded.

2. if the TPID of tagged frame is not 0x88A8 (ex.

0x8100), it will be discarded. by the user via

Ethertype for Custom

S-ports.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Examples of VLAN Settings

VLAN Access Mode:

Switch A ,

Port 7 is VLAN Access mode = Untagged 20

Port 8 is VLAN Access mode = Untagged 10

Below are the switch settings.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

VLAN 1Q Trunk Mode:

Switch B ,

Port 1 = VLAN 1Qtrunk mode = tagged 10, 20

Port 2 = VLAN 1Qtrunk mode = tagged 10, 20

Below are the switch settings.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

VLAN Hybrid Mode:

Port 1 VLAN Hybrid mode = untagged 10

Tagged 10, 20

Below are the switch settings.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

VLAN QinQ Mode:

VLAN QinQ mode is usually adopted when there are unknown VLANs, as shown in the figure below

.

VLAN “X” = Unknown VLAN

M28A Port 1 VLAN Settings:

VLAN ID Settings

When setting the management VLAN, only the same VLAN ID port can be used to control the switch.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

M28A VLAN Settings:

Private VLAN

The private VLAN membership configuration for the switch can be monitored and modified here. Private

VLANs can be added or deleted here. Port members of each private VLAN can be added or removed here.

Private VLANs are based on the source port mask, and there are no connections to VLANs. This means that VLAN IDs and private VLAN IDs can be identical.

A port must be a member of both a VLAN and a private VLAN to be able to forward packets. By default, all ports are VLAN unaware and members of VLAN 1 and private VLAN 1.

A VLAN-unaware port can only be a member of one VLAN, but it can be a member of multiple private

VLANs.

Label

Delete

Private VLAN ID

MAC Address

Port Members

Description

Check to delete the entry. It will be deleted during the next save.

Indicates the ID of this particular private VLAN.

The MAC address for the entry.

A row of check boxes for each port is displayed for each private

VLAN ID. You can check the box to include a port in a private

VLAN. To remove or exclude the port from the private VLAN, make sure the box is unchecked. By default, no ports are members, and all boxes are unchecked.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Adding a New Static

Entry

Click to add a new private

VLAN ID. An empty row is added to the table, and the private VLAN can be configured as needed. The allowed range for a private

VLAN ID is the same as the switch port number range. Any values outside this range are not accepted, and a warning message appears. Click OK to discard the incorrect entry, or click Cancel to return to the editing and make a correction.

The private VLAN is enabled when you click Save.

The private VLANs.

button can be used to undo the addition of new

Label

Port Members

Description

A check box is provided for each port of a private VLAN.

When checked, port isolation is enabled for that port.

When unchecked, port isolation is disabled for that port.

By default, port isolation is disabled for all ports.

GVRP

GVRP is a GARP application that provides IEEE 802.1Q-compliant VLAN pruning and dynamic VLAN creation on 802.1Q trunk ports. With GVRP, the switch can exchange VLAN configuration information with other GVRP switches, prune unnecessary broadcast and unknown unicast traffic, and dynamically create and manage VLANs on switches connected through 802.1Q trunk ports.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Label

GVRP

GVRP Protocol timers

Max Number of VLAN s

Description

User can enable / disable GVRP Function

Join-time is a value in the range 1-20 in the units of centi seconds, i.e. in units of one hundredth of a second. The default is 20.

Leave-time is a value in the range 60-300 in the units of centi seconds, i.e. in units of one hundredth of a second.The default is 60.

LeaveAll-time is a value in the range 1000-5000 in the units of centi seconds, i.e. in units of one hundredth of a second. The default is 1000

When GVRP is enabled a maximum number of VLANs supported by

GVRP is specified. By default this number is 20. This number can only be changed when GVRP is turned off.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

SNMP

SNMP System Configurations

Label

Mode

Version

Read Community

Write Community

Engine ID

Description

Indicates existing SNMP mode. Possible modes include:

Enabled : enable SNMP mode

Disabled : disable SNMP mode

Indicates the supported SNMP version. Possible versions include:

SNMP v1 : supports SNMP version 1.

SNMP v2c : supports SNMP version 2c.

SNMP v3 : supports SNMP version 3.

Indicates the read community string to permit access to SNMP agent.

The allowed string length is 0 to 255, and only ASCII characters from

33 to 126 are allowed.

The field only suits to SNMPv1 and SNMPv2c. SNMPv3 uses USM for authentication and privacy and the community string will be associated with SNMPv3 community table.

Indicates the write community string to permit access to SNMP agent.

The allowed string length is 0 to 255, and only ASCII characters from

33 to 126 are allowed.

The field only suits to SNMPv1 and SNMPv2c. SNMPv3 uses USM for authentication and privacy and the community string will be associated with SNMPv3 community table.

Indicates the SNMPv3 engine ID. The string must contain an even number between 10 and 64 hexadecimal digits, but all-zeros and all-

'F's are not allowed. Change of the Engine ID will clear all original local users.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

SNMP Trap

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Label

Trap Mode

Trap Version

Trap Community

Trap

Address

Trap Destination Port

Trap Inform Mode

Trap

Timeout(seconds)

Inform

Trap Inform Retry Times

Trap Probe

Engine ID

Destination

Security

Trap Security Engine ID

Trap Security Name

Description

Indicates existing SNMP trap mode. Possible modes include:

Enabled : enable SNMP trap mode

Disabled : disable SNMP trap mode

Indicates the supported SNMP trap version. Possible versions include:

SNMP v1 : supports SNMP trap version 1

SNMP v2c : supports SNMP trap version 2c

SNMP v3 : supports SNMP trap version 3

Indicates the community access string when sending SNMP trap packets. The allowed string length is 0 to 255, and only

ASCII characters from 33 to 126 are allowed.

Indicates the SNMP trap destination address

This is the SNMP Trap destination port used by the SNMP Trap option for event notification. You can optionally change the IP port on which to send the SNMP trap, this must be the actual port on which the SNMP trap host listens. The typical, wellknown port for SNMP traps is 162 (default).

Indicates the SNMP trap inform mode. Possible modes include:

Enabled : enable SNMP trap inform mode

Disabled : disable SNMP trap inform mode

Configures the SNMP trap inform timeout. The allowed range is 0 to 2147.

Configures the retry times for SNMP trap inform. The allowed range is 0 to 255.

Indicates the SNMP trap probe security engine ID mode of operation. Possible values are:

Enabled : Enable SNMP trap probe security engine ID mode of operation.

Disabled : Disable SNMP trap probe security engine ID mode of operation.

When is enabled, the ID will be probed automatically.

Otherwise, the ID specified in this field is used.

Indicates the SNMP trap security engine ID. SNMPv3 sends traps and informs use USM for authentication and privacy. A unique engine ID for these traps and informs is needed. When

"Trap Probe Security

Engine ID" is enabled, the ID will be probed automatically.

Otherwise, the ID specified in this field is used. The string must contain an even number (in hexadecimal format) with number of digits between 10 and 64, but all-zeros and all-'F's are not allowed.

Indicates the SNMP trap security name. SNMPv3 traps and informs using USM for authentication and privacy. A unique security name is needed when traps and informs are enabled

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

SNMP Community Configurations

This page allows you to configure SNMPv3 community table. The entry index key is Community .

Label

Delete

Community

Source IP

Source Mask

Description

Check to delete the entry. It will be deleted during the next save.

Indicates the community access string to permit access to SNMPv3 agent. The allowed string length is 1 to 32, and only ASCII characters from 33 to 126 are allowed.

Indicates the SNMP source address

Indicates the SNMP source address mask

SNMP User Configurations

This page allows you to configure SNMPv3 user table. The entry index keys are Engine ID and User

Name .

Label

Delete

Engine ID

User Name

Security Level

Description

Check to delete the entry. It will be deleted during the next save.

An octet string identifying the engine ID that this entry should belong to. The string must contain an even number between 10 and 64 hexadecimal digits, but all-zeros and all-'F's are not allowed. The

SNMPv3 architecture uses User-based Security Model (USM) for message security and View-based Access Control Model (VACM) for access control. For the USM entry, the usmUserEngineID and usmUserName are the entry keys. In a simple agent, usmUserEngineID is always that agent's own snmpEngineID value.

The value can also take the value of the snmpEngineID of a remote

SNMP engine with which this user can communicate. In other words, if user engine ID is the same as system engine ID, then it is local user; otherwise it's remote user.

A string identifying the user name that this entry should belong to. The allowed string length is 1 to 32, and only ASCII characters from 33 to

126 are allowed.

Indicates the security model that this entry should belong to. Possible

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Authentication

Protocol

Authentication

Password

Privacy Protocol

Privacy Password security models include:

NoAuth, NoPriv : no authentication and none privacy

Auth, NoPriv : Authentication and no privacy

Auth, Priv : Authentication and privacy

The value of security level cannot be modified if the entry already exists, which means the value must be set correctly at the time of entry creation.

Indicates the authentication protocol that this entry should belong to.

Possible authentication protocols include:

None : no authentication protocol

MD5 : an optional flag to indicate that this user is using MD5 authentication protocol

SHA : an optional flag to indicate that this user is using SHA authentication protocol

The value of security level cannot be modified if the entry already exists, which means the value must be set correctly at the time of entry creation.

A string identifying the authentication pass phrase. For MD5 authentication protocol, the allowed string length is 8 to 32. For SHA authentication protocol, the allowed string length is 8 to 40. Only

ASCII characters from 33 to 126 are allowed.

Indicates the privacy protocol that this entry should belong to.

Possible privacy protocols include:

None : no privacy protocol

DES : an optional flag to indicate that this user is using DES authentication protocol

A string identifying the privacy pass phrase. The allowed string length is 8 to 32, and only ASCII characters from 33 to 126 are allowed.

SNMP Group Configurations

This page allows you to configure SNMPv3 group table. The entry index keys are Security Model and

Security Name .

Label

Delete

Security Model

Description

Check to delete the entry. It will be deleted during the next save.

Indicates the security model that this entry should belong to. Possible security models included: v1 : Reserved for SNMPv1. v2c : Reserved for SNMPv2c.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Security Name

Group Name usm : User-based Security Model (USM).

A string identifying the security name that this entry should belong to.

The allowed string length is 1 to 32, and only ASCII characters from

33 to 126 are allowed.

A string identifying the group name that this entry should belong to.

The allowed string length is 1 to 32, and only ASCII characters from

33 to 126 are allowed.

SNMP View Configurations

This page allows you to configure SNMPv3 view table. The entry index keys are View Name and OID

Subtree .

Label

Delete

View Name

View Type

OID Subtree

Description

Check to delete the entry. It will be deleted during the next save.

A string identifying the view name that this entry should belong to. The allowed string length is 1 to 32, and only ASCII characters from 33 to

126 are allowed.

Indicates the view type that this entry should belong to. Possible view types include:

Included : an optional flag to indicate that this view subtree should be included.

Excluded : An optional flag to indicate that this view subtree should be excluded.

Generally, if an entry's view type is Excluded , it should exist another entry whose view type is Included, and its OID subtree oversteps the

Excluded entry.

The OID defining the root of the subtree to add to the named view.

The allowed OID length is 1 to 128. The allowed string content is digital number or asterisk (*).

SNMP Access Configurations

This page allows you to configure SNMPv3 access table. The entry index keys are Group Name , Security

Model , and Security Level .

Label Description

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Delete

Group Name

Security Model

Security Level

Read View Name

Write View Name

Check to delete the entry. It will be deleted during the next save.

A string identifying the group name that this entry should belong to.

The allowed string length is 1 to 32, and only ASCII characters from

33 to 126 are allowed.

Indicates the security model that this entry should belong to. Possible security models include: any : Accepted any security model (v1|v2c|usm). v1 : Reserved for SNMPv1. v2c : Reserved for SNMPv2c. usm : User-based Security Model (USM).

Indicates the security model that this entry should belong to. Possible security models include:

NoAuth, NoPriv : no authentication and no privacy

Auth, NoPriv : Authentication and no privacy

Auth, Priv : Authentication and privacy

The name of the MIB view defining the MIB objects for which this request may request the current values. The allowed string length is

1 to 32, and only ASCII characters from 33 to 126 are allowed.

The name of the MIB view defining the MIB objects for which this request may potentially SET new values. The allowed string length is

1 to 32, and only ASCII characters from 33 to 126 are allowed.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Traffic Prioritization

Storm Control

A LAN storm occurs when packets flood the LAN, creating excessive traffic and degrading network performance. Errors in the protocol-stack implementation, mistakes in network configuration, or users issuing a denial-of-service attack can cause a storm. Storm control prevents traffic on a LAN from being disrupted by a broadcast, multicast, or unicast storm on a port. In this page, you can specify the

rate at which packets are received

for unicast, multicast, and broadcast traffic. The unit of the rate can be either pps (packets per second) or kpps (kilopackets per second).

Note: frames sent to the CPU of the switch are always limited to approximately 4 kpps. For example, broadcasts in the management VLAN are limited to this rate. The management VLAN is configured on the

IP setup page.

Description

Frame types supported by the Storm Control function, including Unicast , Multicast , and Broadcast .

Enables or disables the given frame type

The rate is packet per second (pps). You can set the rate to 1K,

2K, 4K, 8K, 16K, 32K, 64K, 128K, 256K, 512K, or 1024K.

The 1 kpps is actually 1002.1 pps.

Label

Frame Type

Enabled

Rate

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Port Classification

QoS is an acronym for Quality of Service. It is a method to achieve efficient bandwidth utilization between individual applications or protocols.

Label

Port

QoS Class

DP level

Description

The port number for which the configuration below applies

Controls the default QoS class

All frames are classified to a QoS class. There is a one to one mapping between QoS class, queue, and priority. A QoS class of 0 (zero) has the lowest priority.

If the port is VLAN aware and the frame is tagged, then the frame is classified to a QoS class that is based on the PCP value in the tag as shown below. Otherwise the frame is classified to the default QoS class.

PCP value: 0 1 2 3 4 5 6 7

QoS class: 1 0 2 3 4 5 6 7

If the port is VLAN aware, the frame is tagged, and Tag Class is enabled, then the frame is classified to a QoS class that is mapped from the PCP and DEI value in the tag. Otherwise the frame is classified to the default

QoS class.

The classified QoS class can be overruled by a QCL entry.

Note: if the default QoS class has been dynamically changed, then the actual default QoS class is shown in parentheses after the configured default QoS class.

Controls the default Drop Precedence Level

All frames are classified to a DP level.

If the port is VLAN aware and the frame is tagged, then the frame is classified to a DP level that is equal to the DEI value in the tag. Otherwise the frame is classified to the default DP level.

If the port is VLAN aware, the frame is tagged, and Tag Class is enabled, then the frame is classified to a DP level that is mapped from the PCP and

DEI value in the tag. Otherwise the frame is classified to the default DP

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

PCP level.

The classified DP level can be overruled by a QCL entry.

Controls the default PCP value

All frames are classified to a PCP value.

If the port is VLAN aware and the frame is tagged, then the frame is classified to the PCP value in the tag. Otherwise the frame is classified to the default PCP value.

Controls the default DEI value

DEI

All frames are classified to a DEI value.

If the port is VLAN aware and the frame is tagged, then the frame is classified to the DEI value in the tag. Otherwise the frame is classified to the default DEI value.

Shows the classification mode for tagged frames on this port

Tag Class

Disabled : Use default QoS class and DP level for tagged frames

Enabled : Use mapped versions of PCP and DEI for tagged frames

Click on the mode to configure the mode and/or mapping

Note: this setting has no effect if the port is VLAN unaware. Tagged frames received on VLAN-unaware ports are always classified to the default QoS class and DP level.

DSCP Based Click to enable DSCP Based QoS Ingress Port Classification

Port Tag Remaking

This page provides an overview of QoS Egress Port Tag Remarking for all switch ports.

Label

Port

Mode

Description

The switch port number to which the following settings will be applied. Click on the port number to configure tag remarking

Shows the tag remarking mode for this port

Classified : use classified PCP/DEI values

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Default : use default PCP/DEI values

Mapped : use mapped versions of QoS class and DP level

Port DSCP

This page allows you to configure basic QoS Port DSCP settings for all switch ports.

Label

Port

Ingress

1. Translate

2. Classify

Egress

Description

Shows the list of ports for which you can configure DSCP Ingress and Egress settings.

In Ingress settings you can change ingress translation and classification settings for individual ports.

There are two configuration parameters available in Ingress:

1. Translate

2. Classify

Check to enable ingress translation

Classification has 4 different values.

Disable: no Ingress DSCP classification

DSCP=0: classify if incoming (or translated if enabled) DSCP is 0.

Selected: classify only selected DSCP whose classification is enabled as specified in DSCP Translation window for the specific

DSCP.

All: classify all DSCP

Port egress rewriting can be one of the following options:

Disable : no Egress rewrite

Enable : rewrite enabled without remapping

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Remap DP Unaware : DSCP from the analyzer is remapped and the frame is remarked with a remapped DSCP value. The remapped DSCP value is always taken from the ' DSCP

Translation->Egress Remap DP0 ' table.

Remap DP Aware : DSCP from the analyzer is remapped and the frame is remarked with a remapped DSCP value. Depending on the DP level of the frame, the remapped DSCP value is either taken from the ' DSCP Translation->Egress Remap DP0 ' table or from the ' DSCP Translation->Egress Remap DP1 ' table.

Port Policing

This page allows you to configure Policer settings for all switch ports.

Label

Port

Enable

Rate

Unti

Flow Control

Description

The port number for which the configuration below applies

Check to enable the policer for individual switch ports

Configures the rate of each policer. The default value is 500 . This value is restricted to 100 to 1000000 when the Unit is kbps or fps , and is restricted to 1 to 3300 when the Unit is Mbps or kfps .

Configures the unit of measurement for each policer rate as kbps ,

Mbps , fps , or kfps . The default value is kbps .

If Flow Control is enabled and the port is in Flow Control mode, then pause frames are sent instead of being discarded.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Queue Policing

This page allows you to configure Queue Policer settings for all switch ports.

Unit

Label

Port

Enable(E)

Rate

Description

The port number for which the configuration below applies.

Check to enable queue policer for individual switch ports

Configures the rate of each queue policer. The default value is 500 . This value is restricted to 100 to 1000000 when the Unit is kbps , and is restricted to 1 to 3300 when the Unit is Mbps .

This field is only shown if at least one of the queue policers is enabled.

Configures the unit of measurement for each queue policer rate as kbps or

Mbps. The default value is kbps .

This field is only shown if at least one of the queue policers is enabled.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

QoS Egress Port Scheduler and Shapers

This page allows you to configure Scheduler and Shapers for a specific port.

Strict Priority

Label

Scheduler Mode

Queue Shaper

Enable

Queue Shaper Rate

Queues Shaper Unit

Queue Shaper

Excess

Port Shaper Enable

Port Shaper Rate

Description

Controls whether the scheduler mode is Strict Priority or

Weighted on this switch port

Check to enable queue shaper for individual switch ports

Configures the rate of each queue shaper. The default value is

500 . This value is restricted to 100 to 1000000 whn the Unit is kbps ", and it is restricted to 1 to 3300 when the Unit is Mbps .

Configures the rate for each queue shaper. The default value is

500 . This value is restricted to 100 to 1000000 when the Unit is kbps , and it is restricted to 1 to 3300 when the Unit is Mbps .

Allows the queue to use excess bandwidth

Check to enable port shaper for individual switch ports

Configures the rate of each port shaper. The default value is 500

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Port Shaper Unit

Weighted

This value is restricted to 100 to 1000000 when the Unit is kbps , and it is restricted to 1 to 3300 when the Unit is Mbps .

Configures the unit of measurement for each port shaper rate as kbps or Mbps . The default value is kbps .

Label

Scheduler Mode

Description

Controls whether the scheduler mode is Strict Priority or

Weighted on this switch port

Queue Shaper

Enable

Check to enable queue shaper for individual switch ports

Queue Shaper Rate

Queues Shaper Unit

Configures the rate of each queue shaper. The default value is

500 . This value is restricted to 100 to 1000000 when the Unit is kbps , and it is restricted to 1 to 3300 when the Unit is Mbps .

Configures the rate of each queue shaper. The default value is

500 . This value is restricted to 100 to 1000000 when the Unit " is kbps , and it is restricted to 1 to 3300 when the Unit is Mbps .

Queue Shaper

Excess

Allows the queue to use excess bandwidth

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Queue Scheduler

Weight

Queue Scheduler

Percent

Port Shaper Enable

Port Shaper Rate

Port Shaper Unit

Configures the weight of each queue. The default value is 17 . This value is restricted to 1 to 100. This parameter is only shown if

Scheduler Mode is set to Weighted .

Shows the weight of the queue in percentage. This parameter is only shown if Scheduler Mode is set to Weighted .

Check to enable port shaper for individual switch ports

Configures the rate of each port shaper. The default value is 500 .

This value is restricted to 100 to 1000000 when the Unit is kbps , and it is restricted to 1 to 3300 when the Unit is Mbps .

Configures the unit of measurement for each port shaper rate as kbps or Mbps . The default value is kbps .

Port Scheduled

This page provides an overview of QoS Egress Port Schedulers for all switch ports.

Label

Port

Mode

Description

The switch port number to which the following settings will be applied.

Click on the port number to configure the schedulers

Shows the scheduling mode for this port

Shows the weight for this queue and port

Port Shaping

This page provides an overview of QoS Egress Port Shapers for all switch ports.

Description

The switch port number to which the following settings will be applied. Click on the port number to configure the shapers

Shows disabled or actual queue shaper rate - e.g. "800 Mbps"

Shows disabled or actual port shaper rate - e.g. "800 Mbps"

Label

Port

Mode

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

DSCP Based QoS

This page allows you to configure basic QoS DSCP-based QoS Ingress Classification settings for all switches.

Label

DSCP

Trust

Description

Maximum number of supported DSCP values is 64

Check to trust a specific DSCP value. Only frames with trusted

DSCP values are mapped to a specific QoS class and drop precedence level. Frames with untrusted DSCP values are treated as a non-IP frame.

QoS Class

DPL

QoS class value can be any number from 0-7.

Drop Precedence Level (0-1)

This page allows you to configure basic QoS DSCP translation settings for all switches. DSCP translation can be done in Ingress or Egress .

Label

DSCP

Ingress

Description

Maximum number of supported DSCP values is 64 and valid

DSCP value ranges from 0 to 63.

Ingress DSCP can be first translated to new DSCP before using the DSCP for QoS class and DPL map.

There are two configuration parameters for DSCP Translation -

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Egress

1. Translate: DSCP can be translated to any of (0-63) DSCP values.

2. Classify: check to enable ingress classification

Configurable engress parameters include;

Remap DP0 : controls the remapping for frames with DP level 0.

You can select the DSCP value from a selected menu to which you want to remap. DSCP value ranges form 0 to 63.

Remap DP1 : controls the remapping for frames with DP level 1.

You can select the DSCP value from a selected menu to which you want to remap. DSCP value ranges form 0 to 63.

DSCP Classification

This page allows you to configure the mapping of QoS class and Drop Precedence Level to DSCP value.

Description

Actual QoS class

Actual Drop Precedence Level

Select the classified DSCP value (0-63)

Label

QoS Class

DPL

DSCP

QoS Control List

This page allows you to edit or insert a single QoS control entry at a time. A QCE consists of several parameters. These parameters vary with the frame type you select.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Label

Port Members

Description

Check to include the port in the QCL entry. By default, all ports are included.

Key Parameters Key configurations include:

Tag : value of tag, can be Any , Untag or Tag .

VID : valid value of VLAN ID, can be any value from 1 to 4095 Any : user can enter either a specific value or a range of VIDs.

PCP : Priority Code Point, can be specific numbers (0, 1, 2, 3, 4, 5, 6,

7), a range (0-1, 2-3, 4-5, 6-7, 0-3, 4-7) or Any

Any

Ethernet

LLC

SNAP

DEI : Drop Eligible Indicator, can be any of values between 0 and 1 or

Any

SMAC : Source MAC Address, can be 24 MS bits (OUI) or Any

DMAC Type : Destination MAC type, can be unicast ( UC ), multicast

( MC ), broadcast ( BC ) or Any

Frame Type can be the following values:

Any

Ethernet

LLC

SNAP

IPv4

IPv6

Note: all frame types are explained below.

Allow all types of frames

Valid Ethernet values can range from 0x600 to 0xFFFF or Any' but excluding 0x800(IPv4) and 0x86DD(IPv6). The default value is Any .

SSAP Address: valid SSAP (Source Service Access Point) values can range from 0x00 to 0xFF or Any . The default value is Any .

DSAP Address: valid DSAP (Destination Service Access Point) values can range from 0x00 to 0xFF or Any . The default value is Any .

Control Valid Control: valid values can range from 0x00 to 0xFF or

Any . The default value is Any .

PID: valid PID (a.k.a ethernet type) values can range from 0x00 to

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

IPv4

IPv6

Action

Parameters

0xFFFF or Any. The default value is Any.

Protocol IP Protocol Number: (0-255, TCP or UDP) or Any

Source IP: specific Source IP address in value/mask format or Any . IP and mask are in the format of x.y.z.w where x, y, z, and w are decimal numbers between 0 and 255. When the mask is converted to a 32-bit binary string and read from left to right, all bits following the first zero must also be zero.

DSCP (Differentiated Code Point): can be a specific value, a range, or

Any . DSCP values are in the range 0-63 including BE, CS1-CS7, EF or AF11-AF43.

IP Fragment: Ipv4 frame fragmented options include 'yes' , 'no' , and

'any' .

Sport Source TCP/UDP Port: (0-65535) or Any , specific value or port range applicable for IP protocol UDP/TCP

Dport Destination TCP/UDP Port: (0-65535) or Any , specific value or port range applicable for IP protocol UDP/TCP

Protocol IP protocol number: (0-255, TCP or UDP) or Any

Source IP IPv6 source address: (a.b.c.d) or Any , 32 LS bits

DSCP (Differentiated Code Point): can be a specific value, a range, or

Any . DSCP values are in the range 0-63 including BE, CS1-CS7, EF or AF11-AF43.

Sport Source TCP/UDP port: (0-65535) or Any , specific value or port range applicable for IP protocol UDP/TCP

Dport Destination TCP/UDP port: (0-65535) or Any , specific value or port range applicable for IP protocol UDP/TCP

Class QoS class: (0-7) or Default

Valid Drop Precedence Level value can be (0-1) or Default .

Valid DSCP value can be (0-63, BE, CS1-CS7, EF or AF11-AF43) or

Default .

Default means that the default classified value is not modified by this

QCE.

QoS Counters

This page provides the statistics of individual queues for all switch ports.

Label

Port

Description

The switch port number to which the following settings will be

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Rx / Tx applied.

There are 8 QoS queues per port. Q0 is the lowest priority

The number of received and transmitted packets per queue

QCL Status

This page shows the QCL status by different QCL users. Each row describes the QCE that is defined. It is a conflict if a specific QCE is not applied to the hardware due to hardware limitations. The maximum number of QCEs is 256 on each switch.

Label

User

QCE#

Frame Type

Port

Action

Conflict

Description

Indicates the QCL user

Indicates the index of QCE

Indicates the type of frame to look for incoming frames. Possible frame types are:

Any : the QCE will match all frame type.

Ethernet : Only Ethernet frames (with Ether Type 0x600-0xFFFF) are allowed.

LLC : Only (LLC) frames are allowed.

SNAP : Only (SNAP) frames are allowed.

IPv4 : the QCE will match only IPV4 frames.

IPv6 : the QCE will match only IPV6 frames.

Indicates the list of ports configured with the QCE.

Indicates the classification action taken on ingress frame if parameters configured are matched with the frame's content.

There are three action fields: Class , DPL , and DSCP .

Class : Classified QoS; if a frame matches the QCE, it will be put in the queue.

DPL : Drop Precedence Level; if a frame matches the QCE, then DP level will set to a value displayed under DPL column.

DSCP : if a frame matches the QCE, then DSCP will be classified with the value displayed under DSCP column.

Displays the conflict status of QCL entries. As hardware resources are shared by multiple applications, resources required to add a QCE may not be available. In that case, it shows conflict status as Yes , otherwise it is always No . Please note that conflict can be resolved by releasing the hardware resources required to add the QCL entry by pressing Resolve

Conflict button.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Multicast

IGMP Snooping

This page provides IGMP Snooping related configurations.

Label Description

Snooping Enabled Check to enable global IGMP snooping

Unregistered

IPMCv4Flooding enabled

Check to enable unregistered IPMC traffic flooding

Router Port

Fast Leave

Specifies which ports act as router ports. A router port is a port on the

Ethernet switch that leads towards the Layer 3 multicast device or

IGMP querier.

If an aggregation member port is selected as a router port, the whole aggregation will act as a router port.

Check to enable fast leave on the port

VLAN Configurations of IGMP Snooping

Each page shows up to 99 entries from the VLAN table, with a default value of 20, selected by the Entries

Per Page input field. When first visited, the web page will show the first 20 entries from the beginning of the VLAN Table. The first displayed will be the one with the lowest VLAN ID found in the VLAN Table.

The VLAN input field allows the user to select the starting point in the VLAN Table. Clicking the button will update the displayed table starting from that or the next closest VLAN Table match.

The will use the last entry of the currently displayed entry as a basis for the next lookup. When the end is reached, the text No more entries is shown in the displayed table. Use the over.

button to start

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Label

Delete

VLAN ID

IGMP Snooping

Enable

IGMP Querier

Description

Check to delete the entry. The designated entry will be deleted during the next save.

The VLAN ID of the entry

Check to enable IGMP snooping for individual VLAN. Up to 32 VLANs can be selected.

Check to enable the IGMP Querier in the VLAN

IGMP Snooping Status

This page provides IGMP snooping status.

Label

VLAN ID

Querier Version

Host Version

Querier Status

Querier Receive

V1 Reports

Receive

V2 Reports

Receive

Description

The VLAN ID of the entry

Active Querier version

Active Host version

Shows the Querier status as ACTIVE or IDLE

The number of transmitted Querier

The number of received V1 reports

The number of received V2 reports

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

V3 Reports

Receive

The number of received V3 reports

V2 Leave Receive The number of received V2 leave packets

Click to refresh the page immediately

Port

Status

Clear all statistics counters

Check to enable an automatic refresh of the page at regular intervals

Switch port number

Indicates whether a specific port is a router port or not

Groups Information of IGMP Snooping

Entries in the IGMP Group Table are shown on this page. The IGMP Group Table is sorted first by VLAN

ID, and then by group.

Label

VLAN ID

Groups

Port Members

Description

The VLAN ID of the group

The group address of the group displayed

Ports under this group

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Security

Remote Control Security Configurations

Remote Control Security allows you to limit the remote access to the management interface. When enabled, requests of the client which is not in the allow list will be rejected.

Description

Port number of the remote client

IP address of the remote client. 0.0.0.0

means "any IP".

Check to enable management via a Web interface

Check to enable management via a Telnet interface

Check to enable management via a SNMP interface

Check to delete entries

Label

Port

IP Address

Web

Telnet

SNMP

Delete

Device Binding

This page provides device binding configurations. Device binding is a powerful way to monitor devices and network security.

Label

Mode

Description

Indicates the device binding operation for each port. Possible modes

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Alive Check

Active

Alive Check

Status

Stream Check

Active

Stream Check

Status are:

--: disable

Scan : scans IP/MAC automatically, but no binding function

Binding : enables binding. Under this mode, any IP/MAC that does not match the entry will not be allowed to access the network.

Shutdown : shuts down the port (No Link)

Check to enable alive check. When enabled, switch will ping the device continually.

Indicates alive check status. Possible statuses are:

--: disable

Got Reply : receive ping reply from device, meaning the device is still alive

Lost Reply : not receiving ping reply from device, meaning the device might have been dead.

Check to enable stream check. When enabled, the switch will detect the stream change (getting low) from the device.

Indicates stream check status. Possible statuses are:

--: disable

Normal : the stream is normal.

Low : the stream is getting low.

DDoS Prevention

Acton

Check to enable DDOS prevention. When enabled, the switch will monitor the device against DDOS attacks.

Indicates DDOS prevention status. Possible statuses are:

DDoS Prevention

Status

--: disable

Analyzing : analyzes packet throughput for initialization

Running : analysis completes and ready for next move

Attacked : DDOS attacks occur

Device IP Address Specifies IP address of the device

Device MAC

Address

Specifies MAC address of the device

Advanced Configurations

Alias IP Address

This page provides Alias IP Address configuration. Some devices might have more than one IP addresses.

You could specify the other IP address here.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Label

Alias IP Address

Description

Specifies alias IP address. Keep 0.0.0.0

if the device does not have an alias IP address.

Alive Check

You can use ping commands to check port link status. If port link fails, you can set actions from the dropdown list.

Description

Disables or enables the port

Simply sends logs to the log server

Disables the port

Disables or enables PoE power

Label

Link Change

Only log it

Shunt Down the

Port

Reboot Device

DDoS Prevention

This page provides DDOS Prevention configurations. The switch can monitor ingress packets, and perform actions when DDOS attack occurred on this port. You can configure the setting to achieve maximum protection.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Label

Mode

Sensibility

Packet Type

Socket Number

Filter

Action

Status

Description

Enables or disables DDOS prevention of the port

Indicates the level of DDOS detection. Possible levels are:

Low : low sensibility

Normal : normal sensibility

Medium : medium sensibility

High : high sensibility

Indicates the types of DDoS attack packets to be monitored. Possible types are:

RX Total : all ingress packets

RX Unicast : unicast ingress packets

RX Multicast : multicast ingress packets

RX Broadcast : broadcast ingress packets

TCP : TCP ingress packets

UDP : UDP ingress packets

If packet type is UDP (or TCP), please specify the socket number here. The socket number can be a range, from low to high. If the socket number is only one, please fill the same number in the low and high fields.

If packet type is UDP (or TCP), please choose the socket direction

( Destination / Source ).

Indicates the action to take when DDOS attacks occur. Possible actions are:

--: no action

Blocking 1 minute : blocks the forwarding for 1 minute and log the event

Blocking 10 minute : blocks the forwarding for 10 minutes and log the event

Blocking : blocks and logs the event

Shunt Down the Port : shuts down the port (No Link) and logs the event

Only Log it : simply logs the event

Reboot Device : if PoE is supported, the device can be rebooted. The event will be logged.

Indicates the DDOS prevention status. Possible statuses are:

--: disables DDOS prevention

Analyzing : analyzes packet throughput for initialization

Running : analysis completes and ready for next move

Attacked : DDOS attacks occur

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Device Description

This page allows you to configure device description settings.

Label

Device Type

Location Address

Description

Description

Indicates device types. Possible types are: -- (no specification), IP

Camera , IP Phone , Access Point , PC , PLC , and Network Video

Recorder

Indicates location information of the device. The information can be used for Google Mapping.

Device descriptions

Stream Check

This page allows you to configure stream check settings.

Label

Mode

Action

Description

Enables or disables stream monitPureLink of the port

Indicates the action to take when the stream gets low. Possible

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

actions are:

--: no action

Log it : simply logs the event

IP Source Guard

IP source guard can prevent traffic attacks if a host tries to use the IP address of its neighbor. You can enable IP source guard when DHCP snooping is enabled on an untrusted interface. With this function enabled, the switch blocks all IP traffic received on the interface except for DHCP packets allowed by DHCP snooping.

Configuration

Label

Mode

Max Dynamic

Clients

Description

Enable or disable this function.

Specify the number of clients supported.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Static Table

Label

Delete

Port

VLAN ID

IP Address

MAC Address

Description

Check to delete the entry. It will be deleted during the next save.

The logical port for the settings.

The vlan id for the settings.

Allowed Source IP address.

Allowed Source MAC address.

Dynamic Table

This page shows entries in the Dynamic IP Source Guard table. The default value is 20.

The Start from port address, VLAN, MAC address, and IP address input fields allow you to select the starting point in the table.

Description

The logical port for the settings.

The vlan id for the settings.

Allowed source IP address.

Allowed source MAC address.

Label

Port

VLAN ID

IP Address

MAC Address

ACL

Ports

This page allows you to configure the ACL parameters (ACE) of each switch port. These parameters will affect frames received on a port unless the frame matches a specific ACE.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Shutdown

Counter

Label

Port

Policy ID

Action

Rate Limiter ID

Port Copy

Logging

Description

The switch port number to which the following settings will be applied

Select to apply a policy to the port. The allowed values are 1 to 8. The default value is 1 .

Select to Permit to permit or Deny to deny forwarding. The default value is Permit .

Select a rate limiter for the port. The allowed values are Disabled or numbers from 1 to 15. The default value is Disabled .

Select which port frames are copied to. The allowed values are

Disabled or a specific port number. The default value is Disabled .

Specifies the logging operation of the port. The allowed values are:

Enabled : frames received on the port are stored in the system log

Disabled : frames received on the port are not logged

The default value is Disabled . Please note that system log memory capacity and logging rate is limited.

Specifies the shutdown operation of this port. The allowed values are:

Enabled : if a frame is received on the port, the port will be disabled.

Disabled : port shut down is disabled.

The default value is Disabled .

Counts the number of frames that match this ACE.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Rate Limiters

This page allows you to configure the rate limiter for the ACL of the switch.

Label

Rate Limiter ID

Rate

Description

The rate limiter ID for the settings contained in the same row.

The rate unit is packet per second (pps), which can be configured as

1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 1K, 2K, 4K, 8K, 16K, 32K, 64K,

128K, 256K, 512K, or 1024K.

The 1 kpps is actually 1002.1 pps.

ACL Control List

This page allows you to configure ACE (Access Control Entry).

An ACE consists of several parameters. These parameters vary with the frame type you have selected.

First select the ingress port for the ACE, and then the frame type. Different parameter options are displayed according to the frame type you have selected.

A frame matching the ACE can be configured here.

Label

Ingress Port

Description

Indicates the ingress port to which the ACE will apply.

Any : the ACE applies to any port

Port n : the ACE applies to this port number, where n is the number of the switch port.

Policy n : the ACE applies to this policy number, where n can range from 1

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Frame Type

Action

Rate Limiter

Port Copy

Logging

Shutdown

Counter to 8.

Indicates the frame type of the ACE. These frame types are mutually exclusive.

Any : any frame can match the ACE.

Ethernet Type : only Ethernet type frames can match the ACE. The IEEE

802.3 descripts the value of length/types should be greater than or equal to

1536 decimal (equal to 0600 hexadecimal).

ARP : only ARP frames can match the ACE. Notice the ARP frames will not match the ACE with Ethernet type.

IPv4 : only IPv4 frames can match the ACE. Notice the IPv4 frames will not match the ACE with Ethernet type.

Specifies the action to take when a frame matches the ACE.

Permit: takes action when the frame matches the ACE.

Deny: drops the frame matching the ACE.

Specifies the rate limiter in number of base units. The allowed range is 1 to

15. Disabled means the rate limiter operation is disabled.

Frames matching the ACE are copied to the port number specified here. The allowed range is the same as the switch port number range. Disabled means the port copy operation is disabled.

Specifies the logging operation of the ACE. The allowed values are:

Enabled : frames matching the ACE are stored in the system log.

Disabled : frames matching the ACE are not logged.

Please note that system log memory capacity and logging rate is limited.

Specifies the shutdown operation of the ACE. The allowed values are:

Enabled : if a frame matches the ACE, the ingress port will be disabled.

Disabled : port shutdown is disabled for the ACE.

Indicates the number of times the ACE matched by a frame.

Label

SMAC Filter

SMAC Value

DMAC Filter

Description

(Only displayed when the frame type is Ethernet Type or ARP.)

Specifies the source MAC filter for the ACE.

Any : no SMAC filter is specified (SMAC filter status is " don't-care ").

Specific : if you want to filter a specific source MAC address with the

ACE, choose this value. A field for entering an SMAC value appears.

When Specific is selected for the SMAC filter, you can enter a specific source MAC address. The legal format is "xx-xx-xx-xx-xx-xx". Frames matching the ACE will use this SMAC value.

Specifies the destination MAC filter for this ACE

Any : no DMAC filter is specified (DMAC filter status is " don't-care ").

MC : frame must be multicast.

BC : frame must be broadcast.

UC : frame must be unicast.

Specific : If you want to filter a specific destination MAC address with the ACE, choose this value. A field for entering a DMAC value appears.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

DMAC Value

When Specific is selected for the DMAC filter, you can enter a specific destination MAC address. The legal format is "xx-xx-xx-xx-xx-xx".

Frames matching the ACE will use this DMAC value.

Label

VLAN ID Filter

VLAN ID

Tag Priority

Description

Specifies the VLAN ID filter for the ACE

Any : no VLAN ID filter is specified (VLAN ID filter status is " don'tcare ").

Specific : if you want to filter a specific VLAN ID with the ACE, choose this value. A field for entering a VLAN ID number appears.

When Specific is selected for the VLAN ID filter, you can enter a specific VLAN ID number. The allowed range is 1 to 4095. Frames matching the ACE will use this VLAN ID value.

Specifies the tag priority for the ACE. A frame matching the ACE will use this tag priority. The allowed number range is 0 to 7. Any means that no tag priority is specified (tag priority is " don't-care ").

Label

IP Protocol Filter

Description

Specifies the IP protocol filter for the ACE

Any : no IP protocol filter is specified (" don't-care ").

Specific : if you want to filter a specific IP protocol filter with the ACE, choose this value. A field for entering an IP protocol filter appears.

ICMP: selects ICMP to filter IPv4 ICMP protocol frames. Extra fields for defining ICMP parameters will appear. For more details of these fields, please refer to the help file.

UDP : selects UDP to filter IPv4 UDP protocol frames. Extra fields for defining UDP parameters will appear. For more details of these fields, please refer to the help file.

TCP : selects TCP to filter IPv4 TCP protocol frames. Extra fields for

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

IP Protocol Value

IP TTL

IP Fragment

IP Option

SIP Filter

SIP Address

SIP Mask

DIP Filter

DIP Address

DIP Mask defining TCP parameters will appear. For more details of these fields, please refer to the help file.

Specific allows you to enter a specific value. The allowed range is 0 to 255. Frames matching the ACE will use this IP protocol value.

Specifies the time-to-live settings for the ACE

Zero : IPv4 frames with a time-to-live value greater than zero must not be able to match this entry.

Non-zero : IPv4 frames with a time-to-live field greater than zero must be able to match this entry.

Any : any value is allowed (" don't-care ").

Specifies the fragment offset settings for the ACE. This includes settings of More Fragments (MF) bit and Fragment Offset (FRAG

OFFSET) for an IPv4 frame.

No : IPv4 frames whose MF bit is set or the FRAG OFFSET field is greater than zero must not be able to match this entry.

Yes : IPv4 frames whose MF bit is set or the FRAG OFFSET field is greater than zero must be able to match this entry.

Any : any value is allowed (" don't-care ").

Specifies the options flag settings for the ACE

No : IPv4 frames whose options flag is set must not be able to match this entry.

Yes : IPv4 frames whose options flag is set must be able to match this entry.

Any : any value is allowed (" don't-care ").

Specifies the source IP filter for this ACE

Any : no source IP filter is specified (Source IP filter is " don't-care ").

Host : source IP filter is set to Host . Specify the source IP address in the SIP Address field that appears.

Network : source IP filter is set to Network . Specify the source IP address and source IP mask in the SIP Address and SIP Mask fields that appear.

When Host or Network is selected for the source IP filter, you can enter a specific SIP address in dotted decimal notation.

When Network is selected for the source IP filter, you can enter a specific SIP mask in dotted decimal notation.

Specifies the destination IP filter for the ACE

Any : no destination IP filter is specified (destination IP filter is " don'tcare ").

Host : destination IP filter is set to Host . Specify the destination IP address in the DIP Address field that appears.

Network : destination IP filter is set to Network . Specify the destination IP address and destination IP mask in the DIP Address and DIP Mask fields that appear.

When Host or Network is selected for the destination IP filter, you can enter a specific DIP address in dotted decimal notation.

When Network is selected for the destination IP filter, you can enter a specific DIP mask in dotted decimal notation.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Label

ARP/RARP

Request/Reply

Sender IP Filter

Sender IP

Address

Sender IP Mask

Target IP Filter

Target IP Address

Target IP Mask

ARP SMAC Match

RARP SMAC

Match

Description

Specifies the available ARP/RARP opcode (OP) flag for the ACE

Any : no ARP/RARP OP flag is specified (OP is " don't-care ").

ARP : frame must have ARP/RARP opcode set to ARP

RARP : frame must have ARP/RARP opcode set to RARP.

Other : frame has unknown ARP/RARP Opcode flag.

Specifies the available ARP/RARP opcode (OP) flag for the ACE

Any : no ARP/RARP OP flag is specified (OP is " don't-care ").

Request : frame must have ARP Request or RARP Request OP flag set.

Reply : frame must have ARP Reply or RARP Reply OP flag.

Specifies the sender IP filter for the ACE

Any : no sender IP filter is specified (sender IP filter is " don't-care ").

Host : sender IP filter is set to Host . Specify the sender IP address in the SIP Address field that appears.

Network : sender IP filter is set to Network . Specify the sender IP address and sender IP mask in the SIP Address and SIP Mask fields that appear.

When Host or Network is selected for the sender IP filter, you can enter a specific sender IP address in dotted decimal notation.

When Network is selected for the sender IP filter, you can enter a specific sender IP mask in dotted decimal notation.

Specifies the target IP filter for the specific ACE

Any : no target IP filter is specified (target IP filter is " don't-care ").

Host : target IP filter is set to Host . Specify the target IP address in the Target IP Address field that appears.

Network : target IP filter is set to Network . Specify the target IP address and target IP mask in the Target IP Address and Target IP

Mask fields that appear.

When Host or Network is selected for the target IP filter, you can enter a specific target IP address in dotted decimal notation.

When Network is selected for the target IP filter, you can enter a specific target IP mask in dotted decimal notation.

Specifies whether frames will meet the action according to their sender hardware address field (SHA) settings.

0 : ARP frames where SHA is not equal to the SMAC address

1 : ARP frames where SHA is equal to the SMAC address

Any : any value is allowed (" don't-care ").

Specifies whether frames will meet the action according to their target hardware address field (THA) settings.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

IP/Ethernet

Length

Ethernet

0 : RARP frames where THA is not equal to the SMAC address

1 : RARP frames where THA is equal to the SMAC address

Any : any value is allowed (" don't-care ")

Specifies whether frames will meet the action according to their

ARP/RARP hardware address length (HLN) and protocol address length (PLN) settings.

0 : ARP/RARP frames where the HLN is equal to Ethernet (0x06) and the (PLN) is equal to IPv4 (0x04) must not match this entry.

1 : ARP/RARP frames where the HLN is equal to Ethernet (0x06) and the (PLN) is equal to IPv4 (0x04) must match this entry.

Any : any value is allowed (" don't-care ").

Specifies whether frames will meet the action according to their

ARP/RARP hardware address space (HRD) settings.

0 : ARP/RARP frames where the HLD is equal to Ethernet (1) must not match this entry.

1 : ARP/RARP frames where the HLD is equal to Ethernet (1) must match this entry.

Any : any value is allowed (" don't-care ").

Specifies whether frames will meet the action according to their

ARP/RARP protocol address space (PRO) settings.

0 : ARP/RARP frames where the PRO is equal to IP (0x800) must not match this entry.

1 : ARP/RARP frames where the PRO is equal to IP (0x800) must match this entry.

Any : any value is allowed (" don't-care ").

Label

ICMP Type Filter

ICMP Type Value

ICMP Code Filter

ICMP Code Value

Description

Specifies the ICMP filter for the ACE

Any : no ICMP filter is specified (ICMP filter status is " don't-care ").

Specific : if you want to filter a specific ICMP filter with the ACE, you can enter a specific ICMP value. A field for entering an ICMP value appears.

When Specific is selected for the ICMP filter, you can enter a specific

ICMP value. The allowed range is 0 to 255. A frame matching the ACE will use this ICMP value.

Specifies the ICMP code filter for the ACE

Any : no ICMP code filter is specified (ICMP code filter status is " don'tcare ").

Specific : if you want to filter a specific ICMP code filter with the ACE, you can enter a specific ICMP code value. A field for entering an ICMP code value appears.

When Specific is selected for the ICMP code filter, you can enter a specific ICMP code value. The allowed range is 0 to 255. A frame matching the ACE will use this ICMP code value.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Label

TCP/UDP Source

Filter

TCP/UDP Source

No.

TCP/UDP Source

Range

TCP/UDP

Destination Filter

TCP/UDP

Destination

Number

TCP/UDP

Destination Range

TCP FIN

Description

Specifies the TCP/UDP source filter for the ACE

Any : no TCP/UDP source filter is specified (TCP/UDP source filter status is " don't-care ").

Specific : if you want to filter a specific TCP/UDP source filter with the

ACE, you can enter a specific TCP/UDP source value. A field for entering a TCP/UDP source value appears.

Range : if you want to filter a specific TCP/UDP source range filter with the ACE, you can enter a specific TCP/UDP source range. A field for entering a TCP/UDP source value appears.

When Specific is selected for the TCP/UDP source filter, you can enter a specific TCP/UDP source value. The allowed range is 0 to

65535. A frame matching the ACE will use this TCP/UDP source value.

When Range is selected for the TCP/UDP source filter, you can enter a specific TCP/UDP source range value. The allowed range is 0 to

65535. A frame matching the ACE will use this TCP/UDP source value.

Specifies the TCP/UDP destination filter for the ACE

Any : no TCP/UDP destination filter is specified (TCP/UDP destination filter status is " don't-care ").

Specific : if you want to filter a specific TCP/UDP destination filter with the ACE, you can enter a specific TCP/UDP destination value. A field for entering a TCP/UDP destination value appears.

Range : if you want to filter a specific range TCP/UDP destination filter with the ACE, you can enter a specific TCP/UDP destination range. A field for entering a TCP/UDP destination value appears.

When Specific is selected for the TCP/UDP destination filter, you can enter a specific TCP/UDP destination value. The allowed range is 0 to 65535. A frame matching the ACE will use this TCP/UDP destination value.

When Range is selected for the TCP/UDP destination filter, you can enter a specific TCP/UDP destination range value. The allowed range is 0 to 65535. A frame matching the ACE will use this TCP/UDP destination value.

Specifies the TCP FIN ("no more data from sender") value for the

ACE.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

TCP SYN

TCP PSH

TCP ACK

TCP URG

0 : TCP frames where the FIN field is set must not be able to match this entry.

1 : TCP frames where the FIN field is set must be able to match this entry.

Any : any value is allowed (" don't-care ").

Specifies the TCP SYN ("synchronize sequence numbers") value for the ACE

0 : TCP frames where the SYN field is set must not be able to match this entry.

1 : TCP frames where the SYN field is set must be able to match this entry.

Any : any value is allowed (" don't-care ").

Specifies the TCP PSH ("push function") value for the ACE

0 : TCP frames where the PSH field is set must not be able to match this entry.

1 : TCP frames where the PSH field is set must be able to match this entry.

Any : any value is allowed (" don't-care ").

Specifies the TCP ACK ("acknowledgment field significant") value for the ACE

0 : TCP frames where the ACK field is set must not be able to match this entry.

1 : TCP frames where the ACK field is set must be able to match this entry.

Any : any value is allowed (" don't-care ").

Specifies the TCP URG ("urgent pointer field significant") value for the

ACE

0 : TCP frames where the URG field is set must not be able to match this entry.

1 : TCP frames where the URG field is set must be able to match this entry.

Any : any value is allowed (" don't-care ").

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

AAA (Authentication, Authorization, and Accounting)

An AAA server is an application that provides authentication, authorization, and accounting services for attempted access to a network. An AAA server can reside in a dedicated computer, an Ethernet switch, an access point or a network access server. The current standard by which devices or applications communicate with an AAA server is RADIUS (Remote Authentication Dial-In User Service). RADIUS is a protocol used between the switch and the authentication server. This page allows you to configure common settings for an authentication server.

Label

Timeout

Retransmit

Dead Time

NAS-IP-Address

NAS-ID

Description

The timeout, which can be set to a number between 3 and 3600 seconds, is the maximum time to wait for a reply from a server.

If the server does not reply within this time frame, we will consider it to be dead and continue with the next enabled server (if any).

RADIUS servers are using the UDP protocol, which is unreliable by design. In order to cope with lost frames, the timeout interval is divided into 3 subintervals of equal length. If a reply is not received within the subinterval, the request is transmitted again.

This algorithm causes the RADIUS server to be queried up to 3 times before it is considered to be dead.

The number of times the switch tries to connect to a RADIUS server.

The dead time, which can be set to a number between 0 and

3600 seconds, is the period during which the switch will not send new requests to a server that has failed to respond to a previous request. This will stop the switch from continually trying to contact a server that it has already determined as dead.

Setting the dead time to a value greater than 0 (zero) will enable this feature, but only if more than one server has been configured.

Indicates the identifying IP Address of the NAS which is requesting authentication of the user, and SHOULD be unique to the NAS within the scope of the RADIUS server.

Network Access Server identifier (NAS-ID) for the interface. The

NAS-ID is sent to the RADIUS server by the controller (as a

RADIUS client) using the authentication request, which is used to classify users to different groups. You can enter up to 32 alphanumeric characters.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

When a user requests network connection, a RADIUS client which receives the request will perform an initial access negotiation with the user to obtain identity/password information. The client then passes the information to a RADIUS server as part of an authentication/authorization request.

The RADIUS server matches data from the authentication/authorization request with information in a trusted database. If a match is found and the user's credentials are correct, the RADIUS server sends an accept message to the client to grant access. If a match is not found or a problem is found with the user's credentials, the server returns a reject message to deny access. The NAD then establishes or terminates the user's connection. The NAD may then forward accounting information to the RADIUS server to document the transaction; the RADIUS server may store or forward this information as needed to support billing for the services provided.

Label

Delete

Hostname

Auth Port

Acct Port

Description

Click to delete an entry from the table.

Specifies the host name of the RADIUS server. The maximum supported length for the AAA RADIUS hostname is 40 characters.

The authentication port which specifies the UDP port used to connect the RADIUS server for authentication. The default is

1812.

The UDP port to use on the RADIUS accounting server. If the port is set to 0 (zero), the default port (1813) is used on the

RADIUS accounting server.

The shared secret between the switch and the RADIUS server.

The time to wait for the RADIUS server to respond.

The number of times the switch tries to connect to a RADIUS server.

Key

Timeout

Retransmit

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

TACACS+

These setting are common for all of the TACACS+ servers.

Label

Timeout

Deadtime

Key

Description

Timeout is the number of seconds, in the range 1 to 1000, to wait for a reply from a TACACS+ server before it is considered to be dead.

Deadtime, which can be set to a number between 0 to 1440 minutes, is the period during which the switch will not send new requests to a server that has failed to respond to a previous request. This will stop the switch from continually trying to contact a server that it has already determined as dead.

Setting the Deadtime to a value greater than 0 (zero) will enable this feature, but only if more than one server has been configured.

The secret key - up to 63 characters long - shared between the TACACS+ server and the switch.

TACACS+ Server Configuration

The table has one row for each TACACS+ server and a number of columns, which are:

Label

Delete

Hostname

Port

Timeout

Key

Description

To delete a TACACS+ server entry, check this box. The entry will be deleted during the next Save.

The IP address of the TACACS+ server.

The TCP port to use on the TACACS+ server for authentication.

This optional setting overrides the global timeout value.

Leaving it blank will use the global timeout value.

This optional setting overrides the global key. Leaving it blank will use the global key.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

RADIUS Overview

This page provides information about the status of the RADIUS server configurable on the authentication configuration page.

Label

IP Address

Status

Description

The RADIUS server number. Click to navigate to detailed statistics of the server

The IP address and UDP port number (in <IP Address>:<UDP

Port> notation) of the server

The current status of the server. This field has one of the following values:

Disabled : the server is disabled.

Not Ready : the server is enabled, but IP communication is not yet up and running.

Ready : the server is enabled, IP communications are built, and the RADIUS module is ready to accept access attempts.

Dead (X seconds left): access attempts are made to this server, but it does not reply within the configured timeout. The server has temporarily been disabled, but will be re-enabled when the deadtime expires. The number of seconds left before this occurs is displayed in parentheses. This state is only reachable when more than one server is enabled.

Label

IP Address

Status

Description

The RADIUS server number. Click to navigate to detailed statistics of the server

The IP address and UDP port number (in <IP Address>:<UDP

Port> notation) of the server

The current status of the server. This field has one of the following values:

Disabled: the server is disabled.

Not Ready : the server is enabled, but IP communication is not

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

yet up and running.

Ready : the server is enabled, IP communication is up and running, and the RADIUS module is ready to accept accounting attempts.

Dead (X seconds left) : accounting attempts are made to this server, but it does not reply within the configured timeout. The server has temporarily been disabled, but will be re-enabled when the dead-time expires. The number of seconds left before this occurs is displayed in parentheses. This state is only reachable when more than one server is enabled.

RADIUS Details

This page shows the access statistics of the authentication and accounting servers. Use the server dropdown list to switch between the backend servers to show related details.

Label Description

RADIUS authentication server packet counters. There are seven

‘receive’ and four ‘transmit’ counters.

Packet Counters

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Other Info

This section contains information about the state of the server and the latest round-trip time.

Label Description

RADIUS accounting server packet counters. There are five

‘receive’ and four ‘transmit’ counters.

Packet Counters

This section contains information about the state of the server and the latest round-trip time.

Other Info

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

NAS (802.1x)

A NAS (Network Access Server) is an access gateway between an external communications network and an internal network. For example, when the user dials into the ISP, he/she will be given access to the

Internet after being authorized by the access server. The authentication between the client and the server include IEEE 802.1X- and MAC-based.

The IEEE 802.1X standard defines a port-based access control procedure that prevents unauthorized access to a network by requiring users to first submit credentials for authentication. One or more backend servers (RADIUS ) determine whether the user is allowed access to the network.

MAC-based authentication allows for authentication of more than one user on the same port, and does not require the users to have special 802.1X software installed on their system. The switch uses the users'

MAC addresses to authenticate against the backend server. As intruders can create counterfeit MAC addresses, MAC-based authentication is less secure than 802.1X authentication.

Overview of 802.1X (Port-Based) Authentication

In an 802.1X network environment, the user is called the supplicant, the switch is the authenticator, and the

RADIUS server is the authentication server. The switch acts as the man-in-the-middle, forwarding requests and responses between the supplicant and the authentication server. Frames sent between the supplicant and the switch are special 802.1X frames, known as EAPOL (EAP Over LANs) frames which encapsulate

EAP PDUs (RFC3748). Frames sent between the switch and the RADIUS server are RADIUS packets.

RADIUS packets also encapsulate EAP PDUs together with other attributes like the switch's IP address, name, and the supplicant's port number on the switch. EAP is very flexible as it allows for different authentication methods, like MD5-Challenge, PEAP, and TLS. The important thing is that the authenticator

(the switch) does not need to know which authentication method the supplicant and the authentication server are using, or how many information exchange frames are needed for a particular method. The switch simply encapsulates the EAP part of the frame into the relevant type (EAPOL or RADIUS) and forwards it.

When authentication is complete, the RADIUS server sends a special packet containing a success or failure indication. Besides forwarding the result to the supplicant, the switch uses it to open up or block traffic on the switch port connected to the supplicant.

(because the X seconds have not expired), the same server will be contacted when the next backend authentication server request from the switch. This scenario will loop forever. Therefore, the server timeout should be smaller than the supplicant's EAPOL Start frame retransmission rate.

Overview of MAC-Based Authentication

Unlike 802.1X, MAC-based authentication is not a standard, but merely a best-practices method adopted by the industry. In MAC-based authentication, users are called clients, and the switch acts as the supplicant on behalf of clients. The initial frame (any kind of frame) sent by a client is snooped by the switch, which in turn uses the client's MAC address as both username and password in the subsequent EAP exchange with the RADIUS server. The 6-byte MAC address is converted to a string in the following form "xx-xx-xx-xx-xxxx", that is, a dash (-) is used as separator between the lower-cased hexadecimal digits. The switch only supports the MD5-Challenge authentication method, so the RADIUS server must be configured accordingly.

When authentication is complete, the RADIUS server sends a success or failure indication, which in turn causes the switch to open up or block traffic for that particular client, using static entries into the MAC Table.

Only then will frames from the client be forwarded on the switch. There are no EAPOL frames involved in this authentication, and therefore, MAC-based authentication has nothing to do with the 802.1X standard.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

The advantage of MAC-based authentication over 802.1X is that several clients can be connected to the same port (e.g. through a 3rd party switch or a hub) and still require individual authentication, and that the clients do npt need special supplicant software to authenticate. The disadvantage is that MAC addresses can be spoofed by malicious users, equipment whose MAC address is a valid RADIUS user can be used by anyone, and only the MD5-Challenge method is supported.

802.1X and MAC-Based authentication configurations consist of two sections: system- and port-wide.

Configuration

Label

Mode

Reauthentication

Enabled

Reauthentication Period

EAPOL Timeout

Description

Indicates if 802.1X and MAC-based authentication is globally enabled or disabled on the switch. If globally disabled, all ports are allowed to forward frames.

If checked, clients are reauthenticated after the interval specified by the Reauthentication Period. Reauthentication for

802.1X-enabled ports can be used to detect if a new device is plugged into a switch port.

For MAC-based ports, reauthentication is only useful if the

RADIUS server configuration has changed. It does not involve communication between the switch and the client, and therefore does not imply that a client is still present on a port (see Age

Period below).

Determines the period, in seconds, after which a connected client must be re-authenticated. This is only active if the

Reauthentication Enabled checkbox is checked. Valid range of the value is 1 to 3600 seconds.

Determines the time for retransmission of Request Identity

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Age Period

Hold Time

Port

Admin State

EAPOL frames.

Valid range of the value is 1 to 65535 seconds. This has no effect for MAC-based ports.

This setting applies to the following modes, i.e. modes using the

Port Security functionality to secure MAC addresses:

MAC-Based Auth .:

When the NAS module uses the Port Security module to secure

MAC addresses, the Port Security module needs to check for activity on the MAC address in question at regular intervals and free resources if no activity is seen within a given period of time.

This parameter controls exactly this period and can be set to a number between 10 and 1000000 seconds.

For ports in MAC-based Auth.

mode, reauthentication does not cause direct communications between the switch and the client, so this will not detect whether the client is still attached or not, and the only way to free any resources is to age the entry.

This setting applies to the following modes, i.e. modes using the

Port Security functionality to secure MAC addresses:

MAC-Based Auth .:

If a client is denied access - either because the RADIUS server denies the client access or because the RADIUS server request times out (according to the timeout specified on the

" Configuration → Security → AAA " page) - the client is put on hold in Unauthorized state. The hold timer does not count during an on-going authentication.

The switch will ignore new frames coming from the client during the hold time.

The hold time can be set to a number between 10 and 1000000 seconds.

The port number for which the configuration below applies

If NAS is globally enabled, this selection controls the port's authentication mode. The following modes are available:

Force Authorized

In this mode, the switch will send one EAPOL Success frame when the port link is up, and any client on the port will be allowed network access without authentication.

Force Unauthorized

In this mode, the switch will send one EAPOL Failure frame when the port link is up, and any client on the port will be disallowed network access.

Port-based 802.1X

In an 802.1X network environment, the user is called the supplicant, the switch is the authenticator, and the RADIUS server is the authentication server. The authenticator acts as the man-in-the-middle, forwarding requests and responses between the supplicant and the authentication server. Frames sent between the supplicant and the switch are special 802.1X frames, known as EAPOL (EAP Over LANs) frames which encapsulate EAP PDUs (RFC3748). Frames sent between the switch and the RADIUS server is RADIUS packets. RADIUS packets also encapsulate EAP PDUs together with other attributes like the switch's IP address, name, and the supplicant's port number on the switch. EAP is very flexible as it allows for different authentication methods, like MD5-

Challenge, PEAP, and TLS. The important thing is that the

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

authenticator (the switch) does not need to know which authentication method the supplicant and the authentication server are using, or how many information exchange frames are needed for a particular method. The switch simply encapsulates the EAP part of the frame into the relevant type

(EAPOL or RADIUS) and forwards it.

When authentication is complete, the RADIUS server sends a special packet containing a success or failure indication.

Besides forwarding the result to the supplicant, the switch uses it to open up or block traffic on the switch port connected to the supplicant.

Note: in an environment where two backend servers are enabled, the server timeout is configured to X seconds (using the authentication configuration page), and the first server in the list is currently down (but not considered dead), if the supplicant retransmits EAPOL Start frames at a rate faster than X seconds, it will never be authenticated because the switch will cancel on-going backend authentication server requests whenever it receives a new EAPOL Start frame from the supplicant. Since the server has not failed (because the X seconds have not expired), the same server will be contacted when the next backend authentication server request from the switch This scenario will loop forever. Therefore, the server timeout should be smaller than the supplicant's EAPOL Start frame retransmission rate. a. Single 802.1X

In port-based 802.1X authentication, once a supplicant is successfully authenticated on a port, the whole port is opened for network traffic. This allows other clients connected to the port (for instance through a hub) to piggy-back on the successfully authenticated client and get network access even though they are not authenticated individually. To overcome this security breach, use the Single 802.1X variant.

Single 802.1X is not yet an IEEE standard, but features many of the same characteristics as port-based 802.1X. In Single

802.1X, at most one supplicant can get authenticated on the port at a time. Normal EAPOL frames are used in the communications between the supplicant and the switch. If more than one supplicant are connected to a port, the one that comes first when the port's link is connected will be the first one considered. If that supplicant does not provide valid credentials within a certain amount of time, the chance will be given to another supplicant. Once a supplicant is successfully authenticated, only that supplicant will be allowed access. This is the most secure of all the supported modes. In this mode, the

Port Security module is used to secure a supplicant's MAC address once successfully authenticated. b. Multi 802.1X

Multi 802.1X is not yet an IEEE standard, but features many of

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Port State the same characteristics as port-based 802.1X. In Multi 802.1X, one or more supplicants can be authenticated on the same port at the same time. Each supplicant is authenticated individually and secured in the MAC table using the Port Security module.

In Multi 802.1X it is not possible to use the multicast BPDU MAC address as the destination MAC address for EAPOL frames sent from the switch to the supplicant, since that would cause all supplicants attached to the port to reply to requests sent from the switch. Instead, the switch uses the supplicant's MAC address, which is obtained from the first EAPOL Start or EAPOL

Response Identity frame sent by the supplicant. An exception to this is when no supplicants are attached. In this case, the switch sends EAPOL Request Identity frames using the BPDU multicast MAC address as destination - to wake up any supplicants that might be on the port.

The maximum number of supplicants that can be attached to a port can be limited using the Port Security Limit Control functionality.

MAC-based Auth.

Unlike port-based 802.1X, MAC-based authentication is not a standard, but merely a best-practices method adopted by the industry. In MAC-based authentication, users are called clients, and the switch acts as the supplicant on behalf of clients. The initial frame (any kind of frame) sent by a client is snooped by the switch, which in turn uses the client's MAC address as both username and password in the subsequent EAP exchange with the RADIUS server. The 6-byte MAC address is converted to a string in the following form "xx-xx-xx-xx-xx-xx", that is, a dash

(-) is used as separator between the lower-cased hexadecimal digits. The switch only supports the MD5-Challenge authentication method, so the RADIUS server must be configured accordingly.

When authentication is complete, the RADIUS server sends a success or failure indication, which in turn causes the switch to open up or block traffic for that particular client, using the Port

Security module. Only then will frames from the client be forwarded on the switch. There are no EAPOL frames involved in this authentication, and therefore, MAC-based authentication has nothing to do with the 802.1X standard.

The advantage of MAC-based authentication over port-based

802.1X is that several clients can be connected to the same port

(e.g. through a 3rd party switch or a hub) and still require individual authentication, and that the clients don't need special supplicant software to authenticate. The advantage of MACbased authentication over 802.1X-based authentication is that the clients do not need special supplicant software to authenticate. The disadvantage is that MAC addresses can be spoofed by malicious users - equipment whose MAC address is a valid RADIUS user can be used by anyone. Also, only the

MD5-Challenge method is supported. The maximum number of clients that can be attached to a port can be limited using the

Port Security Limit Control functionality.

The current state of the port. It can undertake one of the following values:

Globally Disabled : NAS is globally disabled.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Restart

Link Down : NAS is globally enabled, but there is no link on the port.

Authorized : the port is in Force Authorized or a singlesupplicant mode and the supplicant is authorized.

Unauthorized: the port is in Force Unauthorized or a singlesupplicant mode and the supplicant is not successfully authorized by the RADIUS server.

X Auth/Y Unauth : the port is in a multi-supplicant mode.

Currently X clients are authorized and Y are unauthorized.

Two buttons are available for each row. The buttons are only enabled when authentication is globally enabled and the port's

Admin State is in an EAPOL-based or MAC-based mode.

Clicking these buttons will not cause settings changed on the page to take effect.

Reauthenticate : schedules a reauthentication whenever the quiet-period of the port runs out (EAPOL-based authentication).

For MAC-based authentication, reauthentication will be attempted immediately.

The button only has effect on successfully authenticated clients on the port and will not cause the clients to be temporarily unauthorized.

Reinitialize : forces a reinitialization of the clients on the port and hence a reauthentication immediately. The clients will transfer to the unauthorized state while the reauthentication is in progress.

NAS Switch Status

This page shows the information on current NAS port statuses.

Label

Port

Admin State

Port State

Last Source

Description

The switch port number. Click to navigate to detailed 802.1X statistics of each port.

The port’s current administrative state. Refer to NAS Admin

State for more details regarding each value.

The current state of the port. Refer to NAS Port State for more details regarding each value.

The source MAC address carried in the most recently received

EAPOL frame for EAPOL-based authentication, and the most recently received frame from a new client for MAC-based authentication.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Last ID

The user name (supplicant identity) carried in the most recently received Response Identity EAPOL frame for EAPOL-based authentication, and the source MAC address from the most recently received frame from a new client for MAC-based authentication.

NAS Port Status

This page provides detailed IEEE 802.1X statistics for a specific switch port using port-based authentication.

For MAC-based ports, only the statistics of selected backend server statistics will be shown. Use the dropdown list to select which port details to be displayed.

Label

Admin State

Port State

Description

The port's current administrative state. Refer to NAS Admin State for more details regarding each value.

The current state of the port. Refer to NAS Port State for more details regarding each value.

These supplicant frame counters are available for the following administrative states:

• Force Authorized

• Force Unauthorized

• 802.1X

EAPOL Counters

Backend Server Counters

These backend (RADIUS) frame counters are available for the following administrative states:

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

• 802.1X

• MAC-based Auth.

Last Supplicant/Client Info

Information about the last supplicant/client that attempts to authenticate. This information is available for the following administrative states:

• 802.1X

• MAC-based Auth.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Warning

Fault Alarm

When any selected fault event happens, the Fault LED on the switch panel will light up and the electric relay will signal at the same time.

System Warning

SYSLOG Setting

The SYSLOG is a protocol that transmits event notifications across networks. For more details, please refer to RFC 3164 - The BSD SYSLOG Protocol.

Label

Server Mode

SYSLOG Server

IP Address

Description

Indicates existing server mode. When the mode operation is enabled, the syslog message will be sent to syslog server. The syslog protocol is based on UDP communications and received on UDP port 514 and the syslog server will not send acknowledgments back to the sender since UDP is a connectionless protocol and it does not provide acknowledgments. The syslog packet will always be sent even if the syslog server does not exist. Possible modes are:

Enabled : enable server mode

Disabled : disable server mode

Indicates the IPv4 host address of syslog server. If the switch provides

DNS functions, it also can be a host name.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

SMTP Setting

SMTP (Simple Mail Transfer Protocol) is a protocol for transmitting e-mails across the Internet. For more information, please refer to RFC 821 - Simple Mail Transfer Protocol.

Label

E-mail Alarm

Sender E-mail

Address

Mail Subject

Authentication

Description

Enables or disables transmission of system warnings by e-mail

SMTP server IP address

Subject of the mail

◼ Username: the authentication username

◼ Password: the authentication password

◼ Confirm Password: re-enter password

Recipient E-mail

Address

Apply

Help

The recipient's e-mail address. A mail allows for 6 recipients.

Click to activate the configurations

Shows help file

Event Selection

SYSLOG and SMTP are two warning methods supported by the system. Check the corresponding box to enable the system event warning method you want. Please note that the checkbox cannot be checked when SYSLOG or SMTP is disabled.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Label

System Cold Start

Description

Sends out alerts when the system is restarted

Power Status Sends out alerts when power is up or down

SNMP Authentication Failure Sends out alert when SNMP authentication fails

O-Ring Topology Change

Port Event

SYSLOG / SMTP event

Apply

Help

Sends out alerts when O-Ring topology changes

◼ Disable

◼ Link Up

◼ Link Down

◼ Link Up & Link Down

Click to activate the configurations

Shows help file

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Monitor and Diag

MAC Table

The MAC address table can be configured on this page. You can set timeouts for entries in the dynamic

MAC table and configure the static MAC table here.

Aging Configuration

By default, dynamic entries are removed from the MAC after 300 seconds. This removal is called aging.

You can configure aging time by entering a value in the box below in seconds; for example, Age Time

The allowed range is 10 to 1000000 seconds. seconds.

You can disable the automatic aging of dynamic entries by checking Disable Automatic Aging .

MAC Table Learning

If the learning mode for a given port is grayed out, it means another module is in control of the mode, and thus the user cannot change the configurations. An example of such a module is MAC-Based authentication under 802.1X.

You can configures the port to dynamically learn the MAC address based upon the following settings:

Label

Auto

Disable

Description

Learning is done automatically as soon as a frame with unknown

SMAC is received.

No learning is done.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Secure

Only static MAC entries are learned, all other frames are dropped.

Note: make sure the link used for managing the switch is added to the static Mac table before changing to secure learning mode, otherwise the management link will be lost and can only be restored by using another non-secure port or by connecting to the switch via the serial interface.

Static MAC Table Configurations

The static entries in the MAC table are shown in this table. The static MAC table can contain up to 64 entries. The entries are for the whole stack, not for individual switches. The MAC table is sorted first by

VLAN ID and then by MAC address.

Label

Delete

VLAN ID

MAC Address

Port Members

Adding New Static

Entry

Description

Check to delete an entry. It will be deleted during the next save.

The VLAN ID for the entry

The MAC address for the entry

Checkmarks indicate which ports are members of the entry. Check or uncheck to modify the entry.

Click to add a new entry to the static MAC table. You can specify the VLAN ID, MAC address, and port members for the new entry.

Click Save to save the changes.

MAC Table

Each page shows up to 999 entries from the MAC table, with a default value of 20, selected by the Entries

Per Page input field. When first visited, the web page will show the first 20 entries from the beginning of the MAC Table. The first displayed will be the one with the lowest VLAN ID and the lowest MAC address found in the MAC Table .

Each page shows up to 999 entries from the MAC table, with a default value of 20, selected by the Entries

The Start from MAC address and VLAN fields allow the user to select the starting point in the MAC table.

Clicking the button will update the displayed table starting from that or the closest next MAC table match. In addition, the two input fields will – upon clicking displayed entry, allows for continuous refresh with the same start address.

- assume the value of the first

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

The will use the last entry of the currently displayed VLAN/MAC address pairs as a basis for the next lookup. When it reaches the end, the text " no more entries " is shown in the displayed table. Use the

button to start over.

Label

Type

MAC address

VLAN

Port Members

Port Statistics

Description

Indicates whether the entry is a static or dynamic entry

The MAC address of the entry

The VLAN ID of the entry

The ports that are members of the entry.

Traffic Overview

This page provides an overview of general traffic statistics for all switch ports.

Label

Port

Packets

Bytes

Errors

Drops

Filtered

Description

The switch port number to which the following settings will be applied.

The number of received and transmitted packets per port

The number of received and transmitted bytes per port

The number of frames received in error and the number of incomplete transmissions per port

The number of frames discarded due to ingress or egress congestion

The number of received frames filtered by the forwarding process

Check to enable an automatic refresh of the page at regular intervals.

Updates the counter entries, starting from the current entry ID.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Flushes all counters entries

Detailed Statistics

This page provides detailed traffic statistics for a specific switch port. Use the port drop-down list to decide the details of which switch port to be displayed.

The displayed counters include the total number for receive and transmit, the size for receive and transmit, and the errors for receive and transmit.

Detailed Statistics – Total Receive & Transmit

Label

Rx and Tx

Packets

Rx and Tx Octets

Rx and Tx Unicast

Rx and Tx

Multicast

Rx and Tx

Broadcast

Rx and Tx Pause

Rx Drops

Description

The number of received and transmitted (good and bad) packets

The number of received and transmitted (good and bad) bytes, including FCS, except framing bits

The number of received and transmitted (good and bad) unicast packets

The number of received and transmitted (good and bad) multicast packets

The number of received and transmitted (good and bad) broadcast packets

The number of MAC Control frames received or transmitted on this port that have an opcode indicating a PAUSE operation

The number of frames dropped due to insufficient receive buffer or egress congestion

The number of frames received with CRC or alignment errors

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

CRC/Alignment

Rx Undersize

Rx Oversize

Rx Fragments

The number of short

The number of long 2

1 frames received with a valid CRC

frames received with a valid CRC

The number of short 1 frames received with an invalid CRC

Rx Jabber

Rx Filtered

Tx Drops

The number of long 2 frames received with an invalid CRC

The number of received frames filtered by the forwarding process

The number of frames dropped due to output buffer congestion

Tx Late / Exc.Coll. The number of frames dropped due to excessive or late collisions

1. Short frames are frames smaller than 64 bytes.

2. Long frames are frames longer than the maximum frame length configured for this port.

Port Mirror

You can configure port mirror on this page.

To solve network problems, selected traffic can be copied, or mirrored, to a mirror port where a frame analyzer can be attached to analyze the frame flow.

The traffic to be copied to the mirror port is selected as follows:

All frames received on a given port (also known as ingress or source mirror).

All frames transmitted on a given port (also known as egress or destination mirror).

Port to mirror is also known as the mirror port. Frames from ports that have either source (rx) or destination

(tx) mirror enabled are mirrored to this port. Disabled option disables mirror.

Label

Port

Mode

Description

The switch port number to which the following settings will be applied.

Drop-down list for selecting a mirror mode.

Rx only : only frames received on this port are mirrored to the mirror port. Frames transmitted are not mirrored.

Tx only : only frames transmitted from this port are mirrored to the mirror port.

Frames received are not mirrored.

Disabled : neither transmitted nor received frames are mirrored.

Enabled : both received and transmitted frames are mirrored to the mirror port.

Note: for a given port, a frame is only transmitted once. Therefore, you cannot mirror Tx frames to the mirror port. In this case, mode for the selected mirror port is limited to Disabled or Rx only .

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

System Log Information

This page provides switch system log information.

Label

Level

Time

Message

Description

The ID (>= 1) of the system log entry

The level of the system log entry. The following level types are supported:

Info : provides general information

Warning : provides warning for abnormal operation

Error : provides error message

All : enables all levels

The time of the system log entry

The MAC address of the switch

Check this box to enable an automatic refresh of the page at regular intervals.

Updates system log entries, starting from the current entry ID

Flushes all system log entries

Updates system log entries, starting from the first available entry ID

Updates system log entries, ending at the last entry currently displayed

Updates system log entries, starting from the last entry currently displayed.

Updates system log entries, ending at the last available entry ID.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Cable Diagnostics

This page allows you to perform VeriPHY cable diagnostics .

Press to run the diagnostics. This will take approximately 5 seconds. If all ports are selected, this can take approximately 15 seconds. When completed, the page refreshes automatically, and you can view the cable diagnostics results in the cable status table. Note that VeriPHY diagnostics is only accurate for cables 7 - 140 meters long.

10 and 100 Mbps ports will be disconnected while running VeriPHY diagnostics. Therefore, running

VeriPHY on a 10 or 100 Mbps management port will cause the switch to stop responding until VeriPHY is complete .

Label

Port

Cable Status

Description

The port for which VeriPHY Cable Diagnostics is requested

Port: port number

Pair: the status of the cable pair

Length: the length (in meters) of the cable pair

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

SFP Monitor

SFP modules with DDM (Digital Diagnostic Monitor) function can measure the temperature of the apparatus, helping you monitor the status of connection and detect errors immediately. You can manage and set up event alarms through DDM Web interface.

Ping

This page allows you to issue ICMP PING packets to troubleshoot IP connectivity issues .

After you press , five ICMP packets will be transmitted, and the sequence number and roundtrip time will be displayed upon reception of a reply. The page refreshes automatically until responses to all packets are received, or until a timeout occurs .

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

PING6 server ::10.10.132.20

64 bytes from ::10.10.132.20: icmp_seq=0, time=0ms

64 bytes from ::10.10.132.20: icmp_seq=1, time=0ms

64 bytes from ::10.10.132.20: icmp_seq=2, time=0ms

64 bytes from ::10.10.132.20: icmp_seq=3, time=0ms

64 bytes from ::10.10.132.20: icmp_seq=4, time=0ms

Sent 5 packets, received 5 OK, 0 bad

You can configure the following properties of the issued ICMP packets :

Label

IP Address

Ping Size

Description

The destination IP Address

The payload size of the ICMP packet. Values range from 8 to 1400 bytes.

IPv6 Ping

PING6 server ::192.168.10.1 sendto sendto sendto sendto

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

sendto

Sent 5 packets, received 0 OK, 0 bad

SFP Type

The page can show SFP Module EEPROM INFO

Label

Port

Vendor

PID

Version

Type

Description

Show SFP Port , port number

Show SFP module EEPROM Vendor info .

Show SFP module EEPROM PID info .

Show SFP module EEPROM Version info .

Show SFP module EEPROM TYPE info .

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Synchronization

MAC-based Authentication

This page allows you to configure and examine current PTP clock settings.

PTP External Clock Mode

Label Description

One_pps_mode The box allows you to select One_pps_mode configurations.

The following values are possible:

Output : enable the 1 pps clock output

Input : enable the 1 pps clock input

Disable : disable the 1 pps clock in/out-put

External Enable The box allows you to configure external clock output.

The following values are possible:

True : enable external clock output

False : disable external clock output

VCXO_Enable The box allows you to configure the external VCXO rate adjustment.

The following values are possible:

True : enable external VCXO rate adjustment

False : disable external VCXO rate adjustment

Clock

Frequency

The box allows you to set clock frequency.

The range of values is 1 - 25000000 (1 - 25MHz).

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

PTP Clock Configurations

Label

Delete

Clock Instance

Device Type

Port List

2 Step Flag

Clock Identity

One Way

Description

Check this box and click Save to delete the clock instance

Indicates the instance of a particular clock instance [0..3]

Click on the clock instance number to edit the clock details

Indicates the type of the clock instance. There are five device types.

Ord-Bound : ordinary/boundary clock

P2p Transp : peer-to-peer transparent clock

E2e Transp : end-to-end transparent clock

Master Only : master only

Slave Only : slave only

Set check mark for each port configured for this Clock Instance.

Static member defined by the system; true if two-step Sync events and Pdelay_Resp events are used

Shows a unique clock identifier

If true , one-way measurements are used. This parameter applies only to a slave. In one-way mode no delay measurements are performed, i.e. this is applicable only if frequency synchronization is needed. The master always responds to delay requests.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Protocol

VLAN Tag Enable

VID

PCP

Transport protocol used by the PTP protocol engine

Ethernet PTP over Ethernet multicast ip4multi PTP over IPv4 multicast ip4uni PTP over IPv4 unicast

Note: IPv4 unicast protocol only works in Master Only and Slave

Only clocks

For more information, please refer to Device Type .

In a unicast Slave Only clock, you also need to configure which master clocks to request Announce and Sync messages from.

For more information, please refer to Unicast Slave Configuration

Enables VLAN tagging for PTP frames

Note: Packets are only tagged if the port is configured for vlan tagging. i.e:

Port Type != Unaware and PortVLAN mode == None, and the port is member of the VLAN.

VLAN identifiers used for tagging the PTP frames

Priority code point values used for PTP frames

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Troubleshooting

Factory Defaults

You can reset the configuration of the stack switch on this page. Only the IP configuration is retained.

Label Description

Click to reset the configuration to factory defaults

Click to return to the Port State page without resetting

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

System Reboot

You can reset the stack switch on this page. After reset, the system will boot normally as if you have powered on the devices .

Label Description

Click to reboot device

Click to return to the Port State page without rebooting

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Command Line Interface Management

Besides Web-based management, IGPS-9084GP also supports CLI management. You can use console or telnet to manage the switch by CLI.

CLI Management by RS-232 Serial Console (115200, 8, none, 1, none)

Before configuring RS-232 serial console, connect the RS-232 port of the switch to your PC Com port using a RJ45 to DB9-F cable.

Follow the steps below to access the console via RS-232 serial cable.

Step 1: On Windows desktop, click on Start -> Programs -> Accessories -> Communications -> Hyper

Terminal

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Step 2: Input a name for the new connection.

Step 3: Select a COM port in the drop-down list.

Step 4 : A pop-up window that indicates COM port properties appears, including bits per second, data bits, parity, stop bits, and flow control.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Step 5 : The console login screen will appear. Use the keyboard to enter the Username and Password

(same as the password for Web browsers), then press Enter .

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

CLI Management by Telnet

You can can use TELNET to configure the switch. The default values are:

IP Address: 192.168.10.1

Subnet Mask: 255.255.255.0

Default Gateway: 192.168.10.254

User Name: admin

Password: admin

Follow the steps below to access console via Telnet.

Step 1 : Telnet to the IP address of the switch from the Run window by inputting commands (or from the

MS-DOS prompt) as below.

Step 2 : The Login screen will appear. Use the keyboard to enter the Username and Password (same as the password for Web browser), and then press Enter.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Commander Groups

System

System>

Configuration [all] [<port_list>]

Reboot

Restore Default [keep_ip]

Contact [<contact>]

Name [<name>]

Location [<location>]

Description [<description>]

Password <password>

Username [<username>]

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Timezone [<offset>]

Log [<log_id>] [all|info|warning|error] [clear]

IP

IP>

Configuration

DHCP [enable|disable]

Setup [<ip_addr>] [<ip_mask>] [<ip_router>] [<vid>]

Ping <ip_addr_string> [<ping_length>]

SNTP [<ip_addr_string>]

Port

port>

Configuration [<port_list>] [up|down]

Mode [<port_list>]

[auto|10hdx|10fdx|100hdx|100fdx|1000fdx|sfp_auto_ams]

Flow Control [<port_list>] [enable|disable]

State [<port_list>] [enable|disable]

MaxFrame [<port_list>] [<max_frame>]

Power [<port_list>] [enable|disable|actiphy|dynamic]

Excessive [<port_list>] [discard|restart]

Statistics [<port_list>] [<command>] [up|down]

VeriPHY [<port_list>]

SFP [<port_list>]

MAC

MAC>

Configuration [<port_list>]

Add <mac_addr> <port_list> [<vid>]

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Delete <mac_addr> [<vid>]

Lookup <mac_addr> [<vid>]

Agetime [<age_time>]

Learning [<port_list>] [auto|disable|secure]

Dump [<mac_max>] [<mac_addr>] [<vid>]

Statistics [<port_list>]

Flush

VLAN

VLAN>

Configuration [<port_list>]

PVID [<port_list>] [<vid>|none]

FrameType [<port_list>] [all|tagged|untagged]

IngressFilter [<port_list>] [enable|disable] tx_tag [<port_list>] [untag_pvid|untag_all|tag_all]

PortType [<port_list>] [unaware|c-port|s-port|s-custom-port]

EtypeCustomSport [<etype>]

Add <vid>|<name> [<ports_list>]

Forbidden Add <vid>|<name> [<port_list>]

Delete <vid>|<name>

Forbidden Delete <vid>|<name>

Forbidden Lookup [<vid>] [(name <name>)]

Lookup [<vid>] [(name <name>)] [combined|static|nas|all]

Name Add <name> <vid>

Name Delete <name>

Name Lookup [<name>]

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Private VLAN

PVLAN>

Configuration [<port_list>]

Add <pvlan_id> [<port_list>]

Delete <pvlan_id>

Lookup [<pvlan_id>]

Isolate [<port_list>] [enable|disable]

Security

Security >

Switch

Switch security setting

Network

Network security setting

AAA

Authentication, Authorization and Accounting setting

Security Switch

Password <password>

Auth

Authentication

Security/switch>

SSH

Secure Shell

HTTPS

Hypertext Transfer Protocol over

Secure Socket Layer

RMON

Remote Network MonitPureLink

Security Switch Authentication

Configuration

Security/switch/auth>

[enable|disable]

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Security Switch SSH

Configuration

Security/switch/ssh>

Mode [enable|disable]

Security Switch HTTPS

Configuration

Security/switch/ssh>

Mode [enable|disable]

Security Switch RMON

Statistics Add <stats_id> <data_source>

Statistics Delete <stats_id>

Statistics Lookup [<stats_id>]

History Add <history_id> <data_source> [<interval>] [<buckets>]

History Delete <history_id>

Security/switch/rmon>

History Lookup [<history_id>]

Alarm Add <alarm_id> <interval> <alarm_variable>

[absolute|delta]<rising_threshold> <rising_event_index>

<falling_threshold> <falling_event_index> [rising|falling|both]

Alarm Delete <alarm_id>

Alarm Lookup [<alarm_id>]

Security Network

Security/Network>

Psec

Port Security Status

NAS

Network Access Server (IEEE 802.1X)

ACL

Access Control List

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

DHCP

Dynamic Host Configuration Protocol

Security Network Psec

Switch [<port_list>]

Security/Network/Psec>

Port [<port_list>]

Security Network NAS

Configuration [<port_list>]

Mode [enable|disable]

State [<port_list>] [auto|authorized|unauthorized|macbased]

Reauthentication [enable|disable]

ReauthPeriod [<reauth_period>]

Security/Network/NAS>

EapolTimeout [<eapol_timeout>]

Agetime [<age_time>]

Holdtime [<hold_time>]

Authenticate [<port_list>] [now]

Statistics [<port_list>] [clear|eapol|radius]

Security Network ACL

Configuration [<port_list>]

Security/Network/ACL>

Action [<port_list>] [permit|deny]

[<rate_limiter>][<port_redirect>] [<mirror>] [<logging>]

[<shutdown>]

Policy [<port_list>] [<policy>]

Rate [<rate_limiter_list>] [<rate_unit>] [<rate>]

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Add [<ace_id>] [<ace_id_next>][(port <port_list>)] [(policy <policy>

<policy_bitmask>)][<tagged>] [<vid>] [<tag_prio>]

[<dmac_type>][(etype [<etype>] [<smac>] [<dmac>]) |

(arp [<sip>] [<dip>] [<smac>] [<arp_opcode>] [<arp_flags>]) |

(ip [<sip>] [<dip>] [<protocol>] [<ip_flags>]) |

(icmp [<sip>] [<dip>] [<icmp_type>] [<icmp_code>] [<ip_flags>])

(udp [<sip>] [<dip>] [<sport>] [<dport>] [<ip_flags>]) |

(tcp [<sip>] [<dip>] [<sport>] [<dport>] [<ip_flags>]

[<tcp_flags>])]

[permit|deny] [<rate_limiter>] [<port_redirect>] [<mirror>]

[<logging>][<shutdown>]

Delete <ace_id>

Lookup [<ace_id>]

Clear

Port State [<port_list>] [enable|disable]

Security Network DHCP

Configuration

Mode [enable|disable]

Security/Network/DHCP> Server [<ip_addr>]

Information Mode [enable|disable]

Information Policy [replace|keep|drop]

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Security/Network/AAA>

Statistics [clear]

Security Network AAA

Configuration

Timeout [<timeout>]

Deadtime [<dead_time>]

RADIUS [<server_index>] [enable|disable] [<ip_addr_string>]

[<secret>] [<server_port>]

ACCT_RADIUS [<server_index>] [enable|disable]

[<ip_addr_string>] [<secret>] [<server_port>]

Statistics [<server_index>]

STP

STP>

Configuration

Version [<stp_version>]

Non-certified release, v

Txhold [<holdcount>]lt 15:15:15, Dec 6 2007

MaxAge [<max_age>]

FwdDelay [<delay>] bpduFilter [enable|disable] bpduGuard [enable|disable] recovery [<timeout>]

CName [<config-name>] [<integer>]

Status [<msti>] [<port_list>]

Msti Priority [<msti>] [<priority>]

Msti Map [<msti>] [clear]

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Msti Add <msti> <vid>

Port Configuration [<port_list>]

Port Mode [<port_list>] [enable|disable]

Port Edge [<port_list>] [enable|disable]

Port AutoEdge [<port_list>] [enable|disable]

Port P2P [<port_list>] [enable|disable|auto]

Port RestrictedRole [<port_list>] [enable|disable]

Port RestrictedTcn [<port_list>] [enable|disable]

Port bpduGuard [<port_list>] [enable|disable]

Port Statistics [<port_list>]

Port Mcheck [<port_list>]

Msti Port Configuration [<msti>] [<port_list>]

Msti Port Cost [<msti>] [<port_list>] [<path_cost>]

Msti Port Priority [<msti>] [<port_list>] [<priority>]

Aggr

Aggr>

Configuration

Add <port_list> [<aggr_id>]

Delete <aggr_id>

Lookup [<aggr_id>]

Mode [smac|dmac|ip|port] [enable|disable]

LACP

LACP>

Configuration [<port_list>]

Mode [<port_list>] [enable|disable]

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Key [<port_list>] [<key>]

Role [<port_list>] [active|passive]

Status [<port_list>]

Statistics [<port_list>] [clear]

LLDP

LLDP>

Configuration [<port_list>]

Mode [<port_list>] [enable|disable]

Statistics [<port_list>] [clear]

Info [<port_list>]

QoS

QoS>

DSCP Map [<dscp_list>] [<class>] [<dpl>]

DSCP Translation [<dscp_list>] [<trans_dscp>]

DSCP Trust [<dscp_list>] [enable|disable]

DSCP Classification Mode [<dscp_list>] [enable|disable]

DSCP Classification Map [<class_list>] [<dpl_list>] [<dscp>]

DSCP EgressRemap [<dscp_list>] [<dpl_list>] [<dscp>]

Storm Unicast [enable|disable] [<packet_rate>]

Storm Multicast [enable|disable] [<packet_rate>]

Storm Broadcast [enable|disable] [<packet_rate>]

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

QCL Add [<qce_id>] [<qce_id_next>]

[<port_list>]

[<tag>] [<vid>] [<pcp>] [<dei>] [<smac>] [<dmac_type>]

[(etype [<etype>]) |

(LLC [<DSAP>] [<SSAP>] [<control>]) |

(SNAP [<PID>]) |

(ipv4 [<protocol>] [<sip>] [<dscp>] [<fragment>] [<sport>] [<dport>]) |

(ipv6 [<protocol>] [<sip_v6>] [<dscp>] [<sport>] [<dport>])]

[<class>] [<dp>] [<classified_dscp>]

QCL Delete <qce_id>

QCL Lookup [<qce_id>]

QCL Status [combined|static|conflicts]

QCL Refresh

Mirror

Mirror>

Configuration [<port_list>]

Port [<port>|disable]

Mode [<port_list>] [enable|disable|rx|tx]

Dot1x

Dot1x>

Configuration [<port_list>]

Mode [enable|disable]

State [<port_list>] [macbased|auto|authorized|unauthorized]

Authenticate [<port_list>] [now]

Reauthentication [enable|disable]

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Period [<reauth_period>]

Timeout [<eapol_timeout>]

Statistics [<port_list>] [clear|eapol|radius]

Clients [<port_list>] [all|<client_cnt>]

Agetime [<age_time>]

Holdtime [<hold_time>]

IGMP

IGMP>

Configuration [<port_list>]

Mode [enable|disable]

State [<vid>] [enable|disable]

Querier [<vid>] [enable|disable]

Fastleave [<port_list>] [enable|disable]

Router [<port_list>] [enable|disable]

Flooding [enable|disable]

Groups [<vid>]

Status [<vid>]

ACL

ACL>

Configuration [<port_list>]

Action [<port_list>] [permit|deny] [<rate_limiter>] [<port_copy>]

[<logging>] [<shutdown>]

Policy [<port_list>] [<policy>]

Rate [<rate_limiter_list>] [<packet_rate>]

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Add [<ace_id>] [<ace_id_next>] [switch | (port <port>) | (policy <policy>)]

[<vid>] [<tag_prio>] [<dmac_type>]

[(etype [<etype>] [<smac>] [<dmac>]) |

(arp [<sip>] [<dip>] [<smac>] [<arp_opcode>] [<arp_flags>]) |

(ip [<sip>] [<dip>] [<protocol>] [<ip_flags>]) |

(icmp [<sip>] [<dip>] [<icmp_type>] [<icmp_code>] [<ip_flags>]) |

(udp [<sip>] [<dip>] [<sport>] [<dport>] [<ip_flags>]) |

(tcp [<sip>] [<dip>] [<sport>] [<dport>] [<ip_flags>] [<tcp_flags>])]

[permit|deny] [<rate_limiter>] [<port_copy>] [<logging>] [<shutdown>]

Delete <ace_id>

Lookup [<ace_id>]

Clear

Mirror

Mirror>

Configuration [<port_list>]

Port [<port>|disable]

Mode [<port_list>] [enable|disable|rx|tx]

Config

Config>

Save <ip_server> <file_name>

Load <ip_server> <file_name> [check]

Firmware

Firmware> Load <ip_addr_string> <file_name>

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

SNMP

SNMP>

Trap Inform Retry Times [<retries>]

Trap Probe Security Engine ID [enable|disable]

Trap Security Engine ID [<engineid>]

Trap Security Name [<security_name>]

Engine ID [<engineid>]

Community Add <community> [<ip_addr>] [<ip_mask>]

Community Delete <index>

Community Lookup [<index>]

User Add <engineid> <user_name> [MD5|SHA] [<auth_password>] [DES]

[<priv_password>]

User Delete <index>

User Changekey <engineid> <user_name> <auth_password> [<priv_password>]

User Lookup [<index>]

Group Add <security_model> <security_name> <group_name>

Group Delete <index>

Group Lookup [<index>]

View Add <view_name> [included|excluded] <oid_subtree>

View Delete <index>

View Lookup [<index>]

Access Add <group_name> <security_model> <security_level>

[<read_view_name>] [<write_view_name>]

Access Delete <index>

Access Lookup [<index>]

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Firmware

Firmware> Load <ip_addr_string> <file_name>

PTP

PTP>

Configuration [<clockinst>]

PortState <clockinst> [<port_list>] [enable|disable|internal]

ClockCreate <clockinst> [<devtype>] [<twostep>] [<protocol>] [<oneway>] [<clockid>]

[<tag_enable>] [<vid>] [<prio>]

ClockDelete <clockinst> [<devtype>]

DefaultDS <clockinst> [<priority1>] [<priority2>] [<domain>]

CurrentDS <clockinst>

ParentDS <clockinst>

Timingproperties <clockinst> [<utcoffset>] [<valid>] [<leap59>] [<leap61>] [<timetrac>]

[<freqtrac>] [<ptptimescale>] [<timesource>]

PTP PortDataSet <clockinst> [<port_list>] [<announceintv>] [<announceto>]

[<syncintv>] [<delaymech>] [<minpdelayreqintv>] [<delayasymmetry>]

[<ingressLatency>]

LocalClock <clockinst> [update|show|ratio] [<clockratio>]

Filter <clockinst> [<def_delay_filt>] [<period>] [<dist>]

Servo <clockinst> [<displaystates>] [<ap_enable>] [<ai_enable>] [<ad_enable>] [<ap>]

[<ai>] [<ad>]

SlaveTableUnicast <clockinst>

UniConfig <clockinst> [<index>] [<duration>] [<ip_addr>]

ForeignMasters <clockinst> [<port_list>]

EgressLatency [show|clear]

MasterTableUnicast <clockinst>

ExtClockMode [<one_pps_mode>] [<ext_enable>] [<clockfreq>] [<vcxo_enable>]

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

OnePpsAction [<one_pps_clear>]

DebugMode <clockinst> [<debug_mode>]

Wireless mode <clockinst> [<port_list>] [enable|disable]

Wireless pre notification <clockinst> <port_list>

Wireless delay <clockinst> [<port_list>] [<base_delay>] [<incr_delay>]

Loop Protect

Loop Protect>

Configuration

Mode [enable|disable]

Transmit [<transmit-time>]

Shutdown [<shutdown-time>]

Port Configuration [<port_list>]

Port Mode [<port_list>] [enable|disable]

Port Action [<port_list>] [shutdown|shut_log|log]

Port Transmit [<port_list>] [enable|disable]

Status [<port_list>]

IPMC

IPMC>

Configuration [igmp]

Mode [igmp] [enable|disable]

Flooding [igmp] [enable|disable]

VLAN Add [igmp] <vid>

VLAN Delete [igmp] <vid>

State [igmp] [<vid>] [enable|disable]

Querier [igmp] [<vid>] [enable|disable]

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Fastleave [igmp] [<port_list>] [enable|disable]

Router [igmp] [<port_list>] [enable|disable]

Status [igmp] [<vid>]

Groups [igmp] [<vid>]

Version [igmp] [<vid>]

Fault

Fault>

Alarm PortLinkDown [<port_list>] [enable|disable]

Alarm PowerFailure [pwr1|pwr2|pwr3] [enable|disable]

Event

Event>

Configuration

Syslog SystemStart [enable|disable]

Syslog PowerStatus [enable|disable]

Syslog SnmpAuthenticationFailure [enable|disable]

Syslog RingTopologyChange [enable|disable]

Syslog Port [<port_list>] [disable|linkup|linkdown|both]

SMTP SystemStart [enable|disable]

SMTP PowerStatus [enable|disable]

SMTP SnmpAuthenticationFailure [enable|disable]

SMTP RingTopologyChange [enable|disable]

SMTP Port [<port_list>] [disable|linkup|linkdown|both]

DHCPServer

DHCPServer> Mode [enable|disable]

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Ring

Ring>

Mode [enable|disable]

Master [enable|disable]

1stRingPort [<port>]

2ndRingPort [<port>]

Couple Mode [enable|disable]

Couple Port [<port>]

Dualhoming Mode [enable|disable]

Dualhoming Port [<port>]

Chain

Chain>

Configuration

Mode [enable|disable]

1stUplinkPort [<port>]

2ndUplinkPort [<port>]

EdgePort [1st|2nd|none]

RCS

RCS>

Mode [enable|disable]

Add [<ip_addr>] [<port_list>] [web_on|web_off] [telnet_on|telnet_off]

[snmp_on|snmp_off]

Del <index>

Configuration

Setup [<ip_start>] [<ip_end>] [<ip_mask>] [<ip_router>] [<ip_dns>] [<ip_tftp>]

[<lease>] [<bootfile>]

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

FastRecovery

Mode [enable|disable]

FastRecovery>

Port [<port_list>] [<fr_priority>]

SFP

SFP> syslog [enable|disable] temp [<temperature>]

Info

DeviceBinding

Mode [enable|disable]

Port Mode [<port_list>] [disable|scan|binding|shutdown]

Port DDOS Mode [<port_list>] [enable|disable]

Port DDOS Sensibility [<port_list>] [low|normal|medium|high]

Port DDOS Packet [<port_list>]

Port DDOS Low [<port_list>] [<socket_number>]

Port DDOS High [<port_list>] [<socket_number>]

Devicebinding>

Port DDOS Filter [<port_list>] [source|destination]

Port DDOS Action [<port_list>]

Port DDOS Status [<port_list>]

Port Alive Mode [<port_list>] [enable|disable]

Port Alive Action [<port_list>]

[do_nothing|link_change|shutdown|only_log|reboot_device]

Port Alive Status [<port_list>]

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Port Stream Mode [<port_list>] [enable|disable]

Port Stream Action [<port_list>] [do_nothing|only_log]

Port Stream Status [<port_list>]

Port Addr [<port_list>] [<ip_addr>] [<mac_addr>]

Port Alias [<port_list>] [<ip_addr>]

Port DeviceType [<port_list>] [unknown|ip_cam|ip_phone|ap|pc|plc|nvr]

Port Location [<port_list>] [<device_location>]

Port Description [<port_list>] [<device_description>]

MRP

MRP>

Configuration

Mode [enable|disable]

Manager [enable|disable]

React [enable|disable]

1stRingPort [<mrp_port>]

2ndRingPort [<mrp_port>]

Parameter MRP_TOPchgT [<value>]

Parameter MRP_TOPNRmax [<value>]

Parameter MRP_TSTshortT [<value>]

Parameter MRP_TSTdefaultT [<value>]

Parameter MRP_TSTNRmax [<value>]

Parameter MRP_LNKdownT [<value>]

Parameter MRP_LNKupT [<value>]

Parameter MRP_LNKNRmax [<value>]

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Modbus

Modbus>

Status

Mode [enable|disable]

DBU01 Option

Configuration backup [enable|disable]

DBU01Option> Configuration Restore [enable|disable]

Configuration Status

EtherNet/IP

Ethernetip mode [enable|disable]

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Warranty

PureLink Three (3) Year Limited Warranty for PureStream ™ Branded Products Only

Dtrovision, LLC. (hereinafter “ PureLink ”) warrants its HDTools and PureStream ™ branded products (hereinafter “ Product ” ) purchased directly from PureLink or Dealer shall be free from defects in workmanship and materials, under normal use and service, for a period of three (3) years on parts and three (3) years on labor. Any repaired or replaced equipment related to Product shall be covered only under the remaining portion of the warranty. This warranty has no relationship to and exists independently of any warranty offered by Dealer. This warranty is a limited warranty and gives you specific legal rights. You may also have other rights which vary from state to state.

TERMS & CONDITIONS

PureLink shall repair or replace the Product if it develops a material fault during the period of warranty, on condition that i) the

Product has only been subject to normal use in a domestic or commercial environment in a manner consistent with its specification and functionality, ii) the Product has been cared for reasonably and only subjected to reasonable wear and tear, iii) the defect has not been caused by willful or negligent abuse or neglect, or any accident or improper installation procedure, iv) the serial number of the Product has not been altered or removed.

This warranty only applies to the original purchaser, and shall be the exclusive remedy to the original purchaser. PureLink shall not be liable for any damages whatsoever caused by Product or the failure of Product to perform, including incidental or consequential damages. PureLink shall not be liable for any claim made by a third party or made by the purchaser for a third party.

Except as expressly set forth in this warranty, PureLink makes no other warranties, expressed or implied, including any implied warranties of merchantability and fitness for a particular purpose. PureLink expressly disclaims all warranties not satisfied in this limited warranty. Any implied warranties that may be imposed by law are limited to the terms of this limited warranty. This warranty statement supersedes all previous warranties.

WARRANTY RETURNS/REPAIRS/EXCHANGES

No merchandise may be returned without prior authorization from PureLink, and a Return Materials Authorization (RMA) number.

Failure to comply with these conditions will result in rejection of the returned merchandise.

Any warranty service on Products must be arranged through Dealer. Authorized returns must be shipped freight prepaid and fully insured to PureLink, Ramsey, NJ USA, with the RMA number clearly marked on the outside of all shipping boxes and containers.

PureLink reserves the right at its sole discretion to refuse any shipments arriving freight collect or without an RMA number. Any authorized returned merchandise must be accompanied by a note describing the reason for return, along with contact information including name, phone number, return mailing and shipping addresses, e-mail address, and RMA number.

On any products returned and accepted with an RMA number, return freight charges following repair of items under warranty shall be paid by PureLink, shipping by the standard ground carrier of its choice.

ADVANCE WARRANTY REPLACEMENTS

PureLink ’ s advance replacement service offers a Replacement Unit upon request - free of charge for eligible products purchased less than one (1) year of the warranty claim. Products purchased more than one (1) year prior to the warranty claim do not qualify for advance replacement services.

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Advance replacement requests must be validated by a member of PureLink ’ s Technical Support Team. Replacement units may be new or refurbished and is subject to availability. PureLink is responsible for shipping the Replacement Unit to your designated location by standard ground service. All other shipping methods will be responsibility of the Dealer.

Original Unit Return – the Original Unit must be returned within thirty (30) calendar days of the return authorization date. Failure to return the Original Unit within this period will be subject to a minimum 15% re-stocking fee. Dealer is solely responsible for the shipping of the Original Unit to PureLink.

TO MAKE A WARRANTY CLAIM

To make a warranty claim, promptly notify PureLink within the warranty periods described above by calling PureLink’ s Technical

Support Department at 1-201-488-3232. PureLink, in its sole discretion, will determine what action, if any, is required under this warranty.

Most problems can be corrected over the phone through close cooperation between Customer and a PureLink technician. To better enable PureLink to address a warra nty claim, please have the Product’s serial and model numbers. If PureLink, in its sole discretion, determines that an on-site visit or other remedial action is necessary, PureLink may send a representative to

Customer ’ s site.

CUSTOMER SERVICE

Technical support inquiries can be submitted electronically through the PureLink website at www.purelinkav.com

. For immediate assistance please contact PureLink ’ s Customer Care Team at

+1 (201) 488-3232

VIP-NET-M28A Network Switch - USER MANUAL

VERSION 1.0

Salut! Sunt un chatbot AI special antrenat pentru a te ajuta cu PureLink VIP-NET-M28A User Manual. Am analizat cu atenție documentul și te pot ajuta să găsești informațiile exacte de care ai nevoie sau să explic conținutul în termeni clari și simpli. Indiferent dacă ești în căutarea unui ghidaj privind anumite funcții, pași de depanare sau utilizare generală, nu ezita să pui întrebări. Cu cât oferi mai multe detalii despre preocupările sau nevoile tale, cu atât mai precis și eficient te pot ajuta!

Asistentul scrie

Asistentul nu mai este la tastatură. Te rugăm să încerci din nou mai târziu.

Publicitate

1G L3 Modular Network Switch

USER MANUAL

[email protected]

[email protected].

Contents

What’s in the box

Optional Accessories

Recommended with all Media Hub switches:

Modules

1G modules Slots 1 <> 3

1G modules Slot 4

10G modules Slot 4

Product Description

Features

Front Panel

Rear Panel

Connecting to the VIP-NET-M28A to the Network

Windows 8.1 and Windows 10 Computer LAN Port Setup

Setting up your Mac computer to communicate on the same subnet

Network switch requirements for Video Over IP Closed Systems

Specifications

Connections

Power

These circuits MUST be from different phases!

Diagnostic LEDs

RJ45 LED

RJ45 LED

LINK

Green LED

ACT

Orange LED

Status

On

Flash

Description

Ethernet connected

Data transmission

RJ45 cable pin information

1. Orange-white Data 1 + 5. Blue-white

2. Orange Data 1 - 6. Green

3. Green-white Data 2 + 7. Brown-white

4. Blue Data 3 + 8. Brown

Data 3 -

Data 2 -

Data 4 +

Data 4 –

Rear Panel

Rack Mounting

Module Installation

Power Modules

Grounding

Fault Relay

Redundant Power Inputs

O-Ring

Coupling Ring

Dual Homing

O-Chain

Redundancy

O-Ring

Configurations

Label

Description

O-Chain

STP/RSTP/MSTP

STP Bridge Status

STP Port Status

STP Statistics

STP Bridge Configurations

MSTP

Port Settings

Mapping

Priority

CIST

Port Settings

Fast Recovery

anagement

Preparing for Web Management

System Login

Basic Settings

System Information