OS6024 2.52GA User Guide
OS6024 2.52GA User Guide
E
June 2003
OmniStack® 6024
Users Guide
www.alcatel.com
An Alcatel service agreement brings your company the assurance of 7x24 no-excuses
technical support. You’ll also receive regular software updates to maintain and
maximize your Alcatel product’s features and functionality and on-site hardware
replacement through our global network of highly qualified service delivery partners.
Additionally, with 24-hour-a-day access to Alcatel’s Service and Support web page,
you’ll be able to view and update any case (open or closed) that you have reported to
Alcatel’s technical support, open a new case or access helpful release notes, technical
bulletins, and manuals. For more information on Alcatel’s Service Programs, see our
web page at www.ind.alcatel.com, call us at 1-800-995-2696, or email us at
[email protected].
Copyright© 2003 by Alcatel Internetworking, Inc. All rights reserved. This document may not be
reproduced in whole or in part without the express written permission of Alcatel Internetworking, Inc.
Alcatel® and the Alcatel logo are registered trademarks of Compagnie Financiére Alcatel, Paris,
France. OmniSwitch® and OmniStack® are registered trademarks of Alcatel Internetworking, Inc.
Omni Switch/Router™, SwitchExpertSM, the Xylan logo are trademarks of Alcatel Internetworking,
Inc. All other brand and product names are trademarks of their respective companies.
This equipment has been tested and found to comply with the limits for Class A digital
device pursuant to Part 15 of the FCC Rules. These limits are designed to provide
reasonable protection against harmful interference when the equipment is operated in a
commercial environment. This equipment generates, uses, and can radiate radio
frequency energy and, if not installed and used in accordance with the instructions in
this guide, may cause interference to radio communications. Operation of this equipment
in a residential area is likely to cause interference, in which case the user will be required
to correct the interference at his own expense.
The user is cautioned that changes and modifications made to the equipment without
approval of the manufacturer could void the user’s authority to operate this equipment.
It is suggested that the user use only shielded and grounded cables to ensure compliance
with FCC Rules.
This digital apparatus does not exceed the Class A limits for radio noise emissions from
digital apparatus set out in the radio interference regulations of the Canadian
department of communications.
Le present appareil numerique níemet pas de bruits radioelectriques depassant les
limites applicables aux appareils numeriques de la Class A prescrites dans le reglement
sur le brouillage radioelectrique edicte par le ministere des communications du Canada.
Contents
i
Contents
ii
Contents
iii
Contents
iv
Chapter 1: Switch Management
Configuration Options
For advanced management capability, the Management Module provides a
menu-driven system configuration program. This program can be accessed by a
direct connection to the serial port on the rear panel (out-of-band), or by a Telnet
connection over the network (in-band).
The management agent is based on SNMP (Simple Network Management
Protocol). This SNMP agent permits the OmniStack® 6024 (OS-6024) to be
managed from any PC in the network using in-band management software.
The management agent also includes an embedded HTTP Web agent. This Web
agent can be accessed using a standard Web browser from any computer attached
to the network.
The system configuration program and the SNMP agent support management
functions such as:
• Enable/disable any port
• Set the communication mode for any port
• Configure SNMP parameters
• Configure VLANs or multicast filtering
• Display system information or statistics
• Configure the switch to join a Spanning Tree
• Download system firmware
• Restart the system
Note the following points about master and backup management agents:
• The OS-6024 with software version 2.52 supports a master management agent
and a backup management agent. The agent with the lower stack ID will be the
master. If the system up time of the master is greater than 10 minutes, it downloads
data to the backup agent. Any configuration changes made to the master agent will
be synchronized with the backup agent within 1-2 minutes of the user selecting the
“apply” command.
• Up to a maximum of two Management Modules (one master and one back-up),
may exist within a stackable configuration, which may consist of two, three or four
switches.
• The Management Modules (master or backup) cannot be “hot” inserted. The “hot”
removal of the master or the backup Management Module will cause re-booting.
• The master management synchronizes the application software with that of the
backup management. Therefore, the backup Management Module always
contains the same application software as the master Management Module (for
version 2.52 or greater). The master management also synchronizes the
configuration file, including any configuration updates, with the backup
management.
1-1
Switch Management
• Upon the failure or “hot” removal of the master Management Module within a
stackable configuration, the following occurs:
- A “Trap” is sent, a “Log event” is logged, the switch is re-booted and the backup
Management Module takes over without loss of configuration settings.
- The fail-over time of master management to that of the backup management in
a stackable configuration is approximately 2 minutes. Consequently network
traffic is only interrupted for a short period of time.
- The backup management’s “Backup Master” state changes to a “Master” state
and the switch Unit IDs will also reflect the new change.
- All ports will still be active and the switch will continue forwarding traffic in a
normal operative manner. Rigorous testing has shown that the MAC address
table, VLAN, Spanning Tree, IEEE 802.1Q, IGMP Snooping, link aggregation
and other switch configuration settings are not affected and the switch continues
to operate normally.
- If a Management Module were to be re-installed (normally in OS-6024M), the
newly-installed Management Module would assume the role of “Master” agent
with the incumbent one changing status to that of “Backup Master” agent.
Required Connections
In-Band Connections
Prior to accessing the Management Module via a network connection, you must first
configure it with a valid IP address, subnet mask, and default gateway using an
out-of-band connection or the BOOTP protocol.
Note: By default BOOTP is disabled and the IP address is set to 192.168.10.1. To
enable BOOTP, see “IP Configuration” on page 2-10.
1-2
After configuring the switch’s IP parameters, you can access the on-board
configuration program from anywhere within the attached network. The on-board
configuration program can be accessed using Telnet from any computer attached to
the network. The switch and stack can also be managed by any computer using a
Web browser (Internet Explorer 4.0, or Netscape Navigator 4.0 or above), or from a
network computer using network management software.
Notes: 1. Use the Network Configuration menu to specify the maximum number of
simultaneous Telnet sessions that are supported by the system (up to four).
2. The on-board program only provides access to basic configuration functions.
To access the full range of SNMP management functions, you must use
SNMP-based network management software.
1-3
Switch Management
1-4
Chapter 2: Using the System Configuration Program
Login Screen
Once a direct connection to the serial port or a Telnet connection is established, the
login screen for the on-board configuration program appears as shown below.
Alcatel Internetworking
26801 West Agoura Road
Calabasas, CA, 91301
(818) 880-3500
Alcatel OmniStack
Copyright (c), 2003 Alcatel and its licensors.
All rights reserved.
OmniStack is a trademark of Alcatel registered in
the United States Patent and Trademark Office.
Username :
Password :
If this is your first time to log into the configuration program, then the default user
names are “admin” and “user,” both with a default password of “switch.” The
administrator has Read/Write access to all configuration parameters and statistics.
While the user has Read Only access to the management program.
You should define a new administrator password, record it and put it in a safe place.
Select Console Login Configuration from the Management Setup Menu and enter a
new password for the administrator. Note that passwords can consist of up to 11
alphanumeric characters and are not case sensitive.
Notes: 1. Based on the default configuration, a user is allowed three attempts to enter
the correct password; on the third failed attempt the current connection is
terminated.
2. A banner message may be configured to appear before the Login screen.
The banner message is a login security alert. (See “Configuring the Banner
Message” on page 2-21.)
2-1
Using the System Configuration Program
After you enter the user name and password, you will have access to the system
configuration program as illustrated by the following menu hierarchy:
IP Configuration
IP Connectivity Test(Ping)
Management Network Configuration HTTP Configuration
Setup Menu Serial Port Configuration
SNMP Configuration
Console Login Configuration SNMP Communities
TFTP Download IP Trap Managers
Configuration Save & Restore
Management Configuration
Banner Message Configuration
Authentication Configuration
Quit Current
Session
2-2
Main Menu
Main Menu
With the system configuration program you can define system parameters, manage
and control the switch, the connected stack and all its ports, or monitor network
conditions. The figure below of the Main Menu and the following table briefly
describe the selections available from this program.
Note: Options for the currently selected item are displayed in the highlighted area at the
bottom of the interface screen.
Menu Description
About this product
System Information Provides basic system description, including contact information.
Switch Information Shows hardware/firmware version numbers, power status, and
expansion modules used in the stack.
Management Setup Menu
Network Configuration Includes IP setup, Ping facility, HTTP (Web agent) setup, Telnet
configuration, and MAC address.
Serial Port Configuration Sets communication parameters for the serial port, including
management mode, baud rate, console time-out, and screen data
refresh interval.
SNMP Configuration Activates traps; and configures communities and trap managers.
Console Login Configuration Sets user names and passwords for system access, as well as the
invalid password threshold and lockout time.
TFTP Download Downloads new version of firmware to update your system (in-band).
Configuration Save & Restore Saves the switch configuration to a file on a TFTP server. This file can
be later downloaded to restore the configuration.
Management Configuration Allows management access to the switch from all VLANs or only from a
specified VLAN.
Banner Message Configuration Configures a login security alert message.
2-3
Using the System Configuration Program
Menu Description
Authentication Configuration Configures the authentication sequence for RADIUS and TACACS+,
and configures server parameters.
Device Control Menu
Port Configuration Enables any port, enables/disables flow control, and sets
communication mode to auto-negotiation, full duplex or half duplex.
Port State Displays operational status, including link state, flow control method,
and duplex mode.
Spanning Tree Configuration Enables Spanning Tree Algorithm; also sets parameters for hello time,
maximum message age, switch priority, and forward delay; as well as
port priority, path cost, and fast forwarding.
Spanning Tree Information Displays full listing of parameters for the Spanning Tree Algorithm.
Mirror Port Configuration Sets the source and target ports for mirroring.
Port Trunking Configuration Specifies ports to group into aggregate trunks.
IGMP Configuration Configures IGMP multicast filtering.
BStorm Control Configuration Allows you to enable/disable broadcast storm control on a per-port basis
and set the packet-per-second threshold.
Port Security Configures 802.1x Port Authentication commands.
Extended Bridge Configuration Displays extended bridge capabilities provided by this switch.
802.1P Configuration Configures default port priorities and queue assignments.
802.1Q VLAN Displays basic VLAN information, such as VLAN version number and
Base Information maximum VLANs supported.
802.1Q VLAN Current Table Displays VLAN groups and port members.
Information
802.1Q VLAN Static Table Configures VLAN groups via static assignments, including setting port
Configuration members, or restricting ports from being dynamically added to a port by
the GVRP protocol.
802.1Q VLAN Displays/configures port-specific VLAN settings, including PVID,
Port Configuration ingress filtering, and GVRP.
Port GARP Configuration* Configures settings used in multicast filtering.
Port GMRP Configuration* Configures GMRP multicast filtering.
Network Monitor Menu
Port Statistics Displays statistics on network traffic passing through the selected port.
RMON Statistics Displays detailed statistical information for the selected port such as
packet type and frame size counters.
Unicast Address Table Provides full listing for unicast addresses, as well as search and clear
functions.
Multicast Address Registration Provides full listing for multicast addresses, as well as search and clear
Table* functions.
IP Multicast Registration Table Displays all the multicast groups active on this switch, including
multicast IP addresses and corresponding VLAN IDs.
Static Unicast Address Table Used to manually configure host MAC addresses in the unicast table.
Configuration
Static Multicast Address Table Used to manually configure host MAC addresses in the multicast table.
Configuration*
Reset System Menu Restarts system with options to use POST, or to retain factory defaults,
IP settings, or user authentication settings.
2-4
System Information Menu
Menu Description
Quit Current Session Exits the configuration program.
* Not implemented in this firmware release.
System Information
Switch Information
<Ok>
Use <TAB> or arrow keys to move. <Enter> to select.
Menu Description
System Information Provides basic system description, including contact information.
Switch Information Shows hardware/firmware version numbers, power status, and
expansion modules used in the stack.
2-5
Using the System Configuration Program
Displaying System Information
Use the System Information screen to display descriptive information about the
switch, or for quick system identification as shown in the following figure and table.
System Contact :
System Location :
Parameter Description
System Description System hardware description.
System Object ID MIB II object identifier for switch’s network management subsystem.
System Up Time Length of time the current management agent has been running.
(Note that the first value is 1/100 seconds.)
Network Host Name* Name assigned to the switch system.
System Contact* Contact person for the system.
System Location* Specifies the area or location where the system resides.
* Maximum string length is 255, but the screen only displays 45 characters. You can use the arrow keys to
browse the whole string.
2-6
System Information Menu
Displaying Switch Version Information
Use the Switch Information screen to display hardware/firmware version numbers
for the main board, as well as the power status.
Main Board
Label
P/N : S/N : Revision :
Hardware Version : V3.0 Firmware Version : V1.11
Serial Number : 00-CB-00-00-00-00 Port Number : 26
Internal Power Status : Active Redundant Power Status : Inactive
Expansion Slot 1 : 2Port 100Base-FX(MMF)
Expansion Slot 2 : GBIC
Agent Module
Label
P/N : }-613526 S/N : 01150331 Revision : 1
Hardware Version : V3.0 (801 CPU) POST ROM Version : V1.10
Firmware Version : V2.52 SNMP Agent : Master
Parameter Description
Main Board
Label Indicates the Part Number, Serial Number, and Revision Number of the main
board.
Hardware Version Hardware version of the main board.
Firmware Version System firmware version in ROM.
Serial Number The serial number of the main board.
Port Number Number of ports on the switch (including modules).
Internal Power Status Indicates if the primary power is active or inactive.
Redundant Power Status Indicates if the redundant power is active or inactive.
Expansion Slot 1 Shows module type if inserted:
(100BASE-FX, 1000BASE-SX, 1000BASE-LX, 1000BASE-T or GBIC).
Expansion Slot 2 Shows module type if inserted:
(100BASE-FX, 1000BASE-SX, 1000BASE-LX, 1000BASE-T, GBIC or Stacking).
Agent Module
Label Indicates the Part Number, Serial Number, and Revision Number of the agent
board.
Hardware Version Hardware version of the agent module.
POST ROM Version Power-On Self-Test version number.
Firmware Version Firmware version of the agent module.
SNMP Agent Shows if this module is Master or Backup Master.
2-7
Using the System Configuration Program
Network Configuration
Serial Port Configuration
SNMP Configuration
Console Login Configuration
TFTP Download New Software
Configuration Save & Restore
Management Configuration ...
Banner Message Configuration
Authentication Configuration
<Ok>
Use <TAB> or arrow keys to move. <Enter> to select.
Menu Description
Network Configuration Includes IP setup, Ping facility, HTTP (Web agent) setup, Telnet
configuration, and MAC address.
Serial Port Configuration Sets communication parameters for the serial port, including
management mode, baud rate, console time-out, and screen data
refresh interval.
SNMP Configuration Activates traps; and configures communities and trap managers.
Console Login Configuration Sets user names and passwords for system access, as well as the
invalid password threshold and lockout time.
TFTP Download Downloads new version of firmware to update your system (in-band).
Configuration Save & Restore Saves the switch configuration to a file on a TFTP server. This file can
be later downloaded to restore the configuration.
Management Configuration Allows management access to the switch from all VLANs or only from
a specified VLAN.
Banner Message Configuration Configures a banner message. The banner message is a login
security alert message.
Authentication Configuration Configures a username and a password.
2-8
Management Setup Menu
Changing the Network Configuration
Use the Network Configuration menu to set the bootup option, configure the switch’s
Internet Protocol (IP) parameters, enable the on-board Web agent, or to set the
number of concurrent Telnet sessions allowed. The screen shown below is
described in the following table.
IP Configuration
IP Connectivity Test(Ping)
HTTP Configuration
Parameter Description
IP Configuration Screen used to set the bootup option, or configure the switch’s IP
parameters.
IP Connectivity Test (Ping) Screen used to test IP connectivity to a specified device.
HTTP Configuration Screen used to enable the Web agent.
MAX Number of Allowed Telnet The maximum number of Telnet sessions allowed to simultaneously
Sessions access the agent module.
Physical Address Physical address of the agent module.
2-9
Using the System Configuration Program
IP Configuration
Use the IP Configuration screen to set the bootup option, or configure the switch’s IP
parameters. The screen shown below is described in the following table.
IP Address : 192.168.10.1
Netmask : 255.255.255.0
Default Gateway :
IP State : USER-CONFIG
Parameter Description
Interface Type Indicates IP over Ethernet.
IP Address IP address of the stack you are managing. The system supports SNMP over UDP/
IP transport protocol. In this environment, all systems on the Internet, such as
network interconnection devices and any PC accessing the agent module (or
running management software) must have an IP address. The default setting is
192.168.10.1.
Valid IP addresses consist of four numbers, of 0 to 255, and separated by periods.
Anything outside of this format will not be accepted by the configuration program.
Netmask Subnet mask of the switch you have selected. This mask identifies the host
address bits used for routing to specific subnets.
Default Gateway Gateway used to pass trap messages from the system’s agent to the management
station. Note that the gateway must be defined if the management station is
located in a different IP segment. The default value is null.
IP State Specifies whether IP functionality is enabled via manual configuration, or set by
Boot Protocol (BOOTP). Options include:
USER-CONFIG - IP functionality is enabled based on the default or user specified
IP Configuration. (This is the default setting.)
BOOTP Get IP - IP is enabled but will not function until a BOOTP reply has been
received. BOOTP requests will be periodically broadcast by the switch in an effort
to learn its IP address. (BOOTP values can include the IP address, default
gateway, subnet mask, and TFTP server IP.)
2-10
Management Setup Menu
IP Connectivity Test (Ping)
Use the IP Connectivity Test to see if another site on the Internet can be reached.
The screen shown below is described in the following table.
IP Address :
Success : 0 Failure : 0
[Start]
<Ok>
Use <TAB> or arrow keys to move, other keys to make changes.
Parameter Description
IP Address IP address of the site you want to ping.
Test Times The number of ICMP echo requests to send to the specified site.
Range: 1~1000
Interval The interval (in seconds) between pinging the specified site.
Range: 1~10 seconds
Success/Failure The number of times the specified site has responded or not to
pinging.
2-11
Using the System Configuration Program
HTTP Configuration
Use the HTTP Configuration screen to enable/disable the on-board Web agent, and
to specify the TCP port that will provide HTTP service. The screen shown below is
described in the following table.
Parameter Description
HTTP Server Enables/disables access to the on-board Web agent.
HTTP Port Number Specifies the TCP port that will provide HTTP service.
Range : 0~65535
Default : Port 80
(Telnet Port 23 is prohibited.)
2-12
Management Setup Menu
Configuring the Serial Port
You can access the on-board configuration program by attaching a VT100
compatible device to the switch’s serial port. (For more information on connecting to
this port, see “Required Connections” on page 1-2.) The communication parameters
for this port can be accessed from the Serial Port Configuration screen shown below
and described in the following table.
2-13
Using the System Configuration Program
Assigning SNMP Parameters
Use the SNMP Configuration screen to display and modify parameters for the
Simple Network Management Protocol (SNMP). The switch includes an on-board
SNMP agent which monitors the status of its hardware, as well as the traffic passing
through its ports. A computer attached to the network, called a Network
Management Station (NMS), can be used to access this information. Access rights
to the on-board agent are controlled by community strings. To communicate with the
switch, the NMS must first submit a valid community string for authentication. The
options for configuring community strings and related trap functions are described in
the following sections.
SNMP Security
IP Trap Managers
Parameter Description
Send Authentication Fail Traps Issue a trap message to specified IP trap managers whenever authentication
of an SNMP request fails. (The default is disabled.)
SNMP Communities Assigns SNMP access based on specified strings.
IP Trap Managers Specifies management stations that will receive authentication failure
messages or other trap messages from the switch.
2-14
Management Setup Menu
Configuring Community Names
The following figure and table describe how to configure the community strings
authorized for management access. Up to 5 community names may be entered.
Parameter Description
Community Name A community entry authorized for management access.
Default strings: public (read only), private (read/write)
Maximum string length : 20 characters
Access Management access is restricted to Read Only or Read/Write.
Status Sets administrative status of entry to enabled or disabled.
2-15
Using the System Configuration Program
Configuring IP Trap Managers
The following figure and table describe how to specify management stations that will
receive authentication failure messages or other trap messages from the switch. Up
to 5 trap managers may be entered.
Parameter Description
IP Address IP address of the trap manager.
Community Name A community specified for trap management access.
Status Sets administrative status of selected entry to enabled or disabled.
2-16
Management Setup Menu
Console Login Configuration
Use the Management Setup: Console Login Configuration to restrict management
access based on specified user names and passwords, or to set the invalid
password threshold and time-out. There are only two user types defined, ADMIN
(Administrator) and GUEST, but you can set up to five different user names and
passwords. Only Administrators have write access for parameters governing the
switch. You should therefore assign a user name and password to the default
Administrator as soon as possible, and store it in a safe place. (If for some reason
your password is lost, or you cannot gain access to the System Configuration
Program, contact Alcatel Technical Support for assistance.) The parameters shown
on this screen are indicated in the following figure and table.
Password Threshold : 3
Lock-out Time (in minutes) : 0
2-17
Using the System Configuration Program
Downloading System Software
Download Server IP :
Parameter Description
Download Server IP IP address of a TFTP server.
Agent Software Upgrade Indicates that the switch is enabled for software upgrades.
Download Filename The binary file to download.
Download Mode Indicates a download to permanent flash ROM.
Download Status Indicates the status of a TFTP download process.
Backup Master Image Sync Indicates the status of software synchronization with a backup management
Status agent. The software synchronization function automatically copies new
system software from the master to the backup agent. In a stack with a
backup management agent installed, this process happens automatically
after a TFTP download has completed. (Note that this parameter is displayed
only when a stack has a backup agent installed.)
Note: You can also download firmware using the Web agent (page 3-15) or by a direct
console connection after a restart (page A-2).
2-18
Management Setup Menu
Saving the System Configuration
Use the Configuration Save & Restore menu to save the switch configuration
settings to a file on a TFTP server. The file can be later downloaded to the switch to
restore the switch’s settings. The success of the operation depends on the
accessibility of the TFTP server and the quality of the network connection.
Parameters shown on this screen are indicated in the following figure and table.
Upload Server IP :
Upload Filename :
Download Server IP :
Download Filename :
Parameter Description
Configuration Upload
Upload Server IP IP address of a TFTP server.
Upload Filename The name of the file to contain the switch configuration settings.
[Process TFTP Upload] Issues a request to upload the configuration settings to the specified file on
the TFTP server.
Upload Status Indicates if an upload is “Complete” or “In Progress.”
Configuration Download
Download Server IP IP address of a TFTP server.
Download Filename The name of the file that contains the switch configuration settings you wish
to restore.
[Process TFTP Download] Issues a request to the TFTP server to download the specified file.
Download Status Indicates if a download is “Complete” or “In Progress.”
2-19
Using the System Configuration Program
Managing the Switch
Use the Management Configuration screen to configure the management access of
the switch.
VLAN : 1
Parameter Description
Management VLAN Allows management access to the switch from all VLANs or only from a
specified VLAN. If this field is set to “ONE” then the single VLAN with
management acces must be set in the “VLAN” field.
VLAN The ID of the single VLAN with management access to the switch, if the
“Management VLAN” field is set to “ONE”.
ARP reply timer Sets the interval time (in seconds) for sending ARP (Address Resolution
Protocol) replies to other devices in the network. ARP is a protocol that allows
network devices to identify the MAC address of a device that corresponds to
a given IP address.
2-20
Management Setup Menu
Configuring the Banner Message
The banner message is a login security alert message. It will be presented to a user
attempting to log into the switch via console or telnet, before prompting for a user
name and password. Use the Banner Message Configuration screen to enter the
banner message. You can type, or paste, the banner message into the screen one
row at a time, using the arrow keys to move from one row to the next. For example,
to paste text using Windows HyperTerminal, select “Paste to Host” from the Edit
menu in the menu bar. Note that the maximum line length in the screen is 80
characters. The first page of a sample banner message is shown below.
SECURITY ALERT
This is an Organization Z computer system. This computer system,
including all related equipment, networks, and network devices
(specifically including Internet access and access to restricted sites)
is provided only for authorized use. Organization Z computer systems may
be monitored for all lawful purposes, including to ensure that their use
is authorized for management of the system, to facilitate protection
against unauthorized access, and to verify security procedures,
survivability, and operational security. Monitoring includes active
attacks by authorized Organization Z entities to test or verify the
security of this system. During monitoring, information may be examined,
recorded, copied and used for authorized purposes. All information,
including personal information, placed or sent over this system may be
monitored.
Use of this Organization Z computer system, authorized or unauthorized,
constitutes consent to monitoring of this system. Unauthorized use may
subject you to criminal prosecution.
Note: After entering text, use <Apply> to confirm the text that you have entered or <OK>
to confirm the text and return to the Management Setup menu. Use <Cancel> to
cancel the text that you have just entered and return to the Management Setup
menu. Use <Prev Page> and <Next Page> to scroll through the banner message.
2-21
Using the System Configuration Program
Authentication Configuration
You can configure the switch to authenticate users logging into the system for
management access using local or authentication-server methods.
Remote Authentication Dial-in User Service (RADIUS) and Terminal Access
Controller Access Control System Plus (TACACS+) are logon authentication
protocols that use software running on a central server to control access to
RADIUS-aware or TACACS+-aware devices on the network. An authentication
server contains a database of multiple user name/password pairs with associated
privilege levels for each user requiring management access to a switch.
RADIUS uses UDP while TACACS+ uses TCP. UDP only offers best effort delivery,
while TCP offers a connection-oriented transport. Also, note that RADIUS encrypts
only the password in the access-request packet from the client to the server, while
TACACS+ encrypts the entire body of the packet.
By default, management access is always checked against the authentication
database stored on the local switch. If a remote authentication server is used, you
must specify the authentication sequence and the corresponding parameters for the
remote authentication protocol.
Notes: 1. RADIUS and TACACS+ logon authentication control management access
via the console port, Web browser, or Telnet.
2. The local switch user database has to be set up by manually entering user
names and passwords via the console or Web interface..
RADIUS Settings
TACACS Settings
Parameter Description
Authentication Sequence Select the authentication, or authentication sequence required.
You can specify up to three authentication methods for any user to indicate the
authentication sequence. For example, if you select (1) RADIUS, (2) TACACS and
(3) Local, the user name and password on the RADIUS server is verified first. If
the RADIUS server is not available, then authentication is attempted using the
TACACS+ server, and finally the local user name and password is checked.
RADIUS Settings Provides access to RADIUS server settings.
TACACS Settings Provides access to TACACS+ server settings.
2-22
Management Setup Menu
RADIUS Settings
Use the RADIUS Settings screen to configure RADIUS server parameters.
RADIUS logon authentication assigns a specific privilege level for each user name/
password pair. The user name, password, and privilege level must be configured on
the authentication server.
Parameter Description
Server IP Address The IP address of the RADIUS server.
Server Port Number The UDP port number used by the RADIUS server.
Secret Text String Encryption key used to authenticate logon access for the client. Do not use
blank spaces in the string. (Maximum length: 11 characters)
Number of Server Transmits The number of request transmits to the RADIUS server before failure.
Timeout for a reply The number of seconds the switch waits for a reply from the RADIUS server
before it resends the request.
2-23
Using the System Configuration Program
TACACS Settings
Use the TACACS Settings screen to configure TACACS+ server parameters.
TACACS+ logon authentication assigns a specific privilege level for each user
name/password pair. The user name, password, and privilege level must be
configured on the authentication server.
Parameter Description
Server IP Address The IP address of the TACACS+ server.
Server Port Number The TCP port number used by the TACACS+ server.
Secret Text String Encryption key used to authenticate logon access for the client. Do not use
blank spaces in the string. (Maximum length: 11 characters)
2-24
Configuring the Switch
<Ok>
Use <TAB> or arrow keys to move. <Enter> to select.
Menu Description
Port Configuration Sets communication parameters for ports.
Port State Displays current port settings and port status.
Spanning Tree Configuration Configures the switch and its ports to participate in a local Spanning Tree.
Spanning Tree Information Displays the current Spanning Tree configuration for the switch and its ports.
Mirror Port Configuration Sets the source and target ports for mirroring.
Port Trunking Configuration Specifies ports to group into aggregate trunks.
IGMP Configuration Configures IGMP multicast filtering.
BStorm Control Configuration Allows you to enable/disable broadcast storm control on a per-port basis and
set the packet-per-second threshold.
Port Security Configuration Allows you to enable and configure port security for the switch.
Extended Bridge Configuration Displays/configures extended bridge capabilities provided by this switch.
802.1P Configuration Configures default port priorities and queue assignments.
802.1Q VLAN Displays basic VLAN information, such as VLAN version number and
Base Information maximum VLANs supported.
802.1Q VLAN Current Table Displays VLAN groups and port members.
Information
802.1Q VLAN Static Table Configures VLAN groups via static assignments, including setting port
Configuration members.
802.1Q VLAN Port ConfigurationDisplays/configures port-specific VLAN settings, including PVID and ingress
filtering.
Port GARP Configuration* Configures generic attribute settings used in the spanning tree protocol,
VLAN registration, multicast filtering.
Port GMRP Configuration* Configures GMRP multicast filtering.
* Not implemented in this firmware release.
2-25
Using the System Configuration Program
Configuring Port Parameters
Use the Port Configuration menus to set or display communication parameters for
any port or module in the stack.
<Apply> <Ok> <Cancel> <Up Unit> <Down Unit> <Prev Page> <Next Page>
Use <TAB> or arrow keys to move. <Enter> to select
2-26
Configuring the Switch
2-27
Using the System Configuration Program
Viewing the Current Port Configuration
The Port Information screen displays the port type, status, link state, and flow control
in use, as well as the communication speed and duplex mode. To change any of the
port settings, use the Port Configuration menu.
Parameter Description
Type Shows port type as:
10/100TX: 10BASE-T / 100BASE-TX
100FX: 100BASE-FX
1000SX: 1000BASE-SX
1000LX: 1000BASE-LX
1000T: 1000BASE-T
GBIC: 1000BASE-X Transceiver
Operational Shows if the port is functioning or not.
Link Indicates if the port has a valid connection to an external device.
FlowControl InUse Shows the flow control type in use. Flow control can eliminate frame loss
by “blocking” traffic from end stations connected directly to the switch. Back
pressure is used for half duplex and IEEE 802.3x for full duplex. Note that
flow control should not be used if a port is connected to a hub.
Speed and Duplex InUse Displays the current port speed and duplex mode used. (Note that
Auto-negotiation is not available for 100BASE-FX ports.)
Security State* Indicates the port’s security status:
DISABLED - security is disabled on the port.
LEARNING - the port is currently learning MAC addresses to “lock-in” for
secure access.
SECURED - the port has learned MAC addresses, or has them statically
configured and is operating in secure mode.
LOCKED - port has been disabled due to a security violation (only when the
security action is set to disable).
* For more information, see “Port Security Configuration” on page 2-41.
2-28
Configuring the Switch
Using the Spanning Tree Algorithm
The Spanning Tree Algorithm can be used to detect and disable network loops, and to
provide backup links between switches, bridges or routers. This allows the switch to
interact with other bridging devices (that is, an STA-compliant switch, bridge or router)
in your network to ensure that only one route exists between any two stations on the
network. For a more detailed description of how to use this algorithm, refer to
“Spanning Tree Algorithm” on page 4-1.
<Ok>
Use <TAB> or arrow keys to move. <Enter> to select.
2-29
Using the System Configuration Program
2-30
Configuring the Switch
Configuring STA for Ports
The following figure and table describe port STA configuration.
<Apply> <Ok> <Cancel> <Up unit> <Down unit> <Prev page> <Next page>
Use <TAB> or arrow keys to move. <Enter> to select
2-31
Using the System Configuration Program
Viewing the Current Spanning Tree Information
The Spanning Tree Information screen displays a summary of the STA information
for the overall bridge or for a specific port. To make any changes to the parameters
for the Spanning Tree, use the Spanning Tree Configuration menu.
<Ok>
Use <TAB> or arrow keys to move. <Enter> to select.
2-32
Configuring the Switch
Displaying the Current Bridge STA
The parameters shown in the following figure and table describe the current Bridge
STA State.
<Ok>
<Enter> to select.
Parameter Description
Bridge Priority Device priority is used in selecting the root device, root port, and designated
port. The device with the highest priority becomes the STA root device.
However, if all devices have the same priority, the device with the lowest
MAC address will then become the root device.
Hello Time The time interval (in seconds) at which the root device transmits a
configuration message.
Max Age The maximum time (in seconds) a device can wait without receiving a
configuration message before attempting to reconfigure.
Forward Delay The maximum time (in seconds) the root device will wait before changing
states (i.e., listening to learning to forwarding).
Hold Time The minimum interval between the transmission of consecutive
Configuration BPDUs.
Designated Root The priority and MAC address of the device in the Spanning Tree that this
switch has accepted as the root device.
Root Cost The path cost from the root port on this switch to the root device.
Root Port The number of the port on this switch that is closest to the root. This switch
communicates with the root device through this port. If there is no root port,
then this switch has been accepted as the root device of the Spanning Tree
network.
Configuration Changes The number of times the Spanning Tree has been reconfigured.
Topology Up Time The time since the Spanning Tree was last reconfigured.
2-33
Using the System Configuration Program
Displaying the Current STA for Ports
The parameters shown in the following figure and table are for port STA Information.
Parameter Description
Type Shows port type as:
10/100TX: 10BASE-T / 100BASE-TX
100FX: 100BASE-FX
1000SX: 1000BASE-SX
1000LX: 1000BASE-LX
1000T: 1000BASE-T
GBIC: 1000BASE-X Transceiver
Status Displays current state of this port within the Spanning Tree:
No Link No link has been established on this port.
Disabled Port has been disabled by the user or has failed diagnostics.
Blocking Port receives STA configuration messages, but does not forward
packets.
Listening Port will leave blocking state due to topology change, starts
transmitting configuration messages, but does not yet forward
packets.
Learning Port has transmitted configuration messages for an interval set by the
Forward Delay parameter without receiving contradictory information.
Port address table is cleared, and the port begins learning addresses.
Forwarding The port forwards packets, and continues learning addresses.
The rules defining port status are:
• A port on a network segment with no other STA-compliant bridging device is
always forwarding.
• If two ports of a switch are connected to the same segment and there is no other
STA device attached to this segment, the port with the smaller ID forwards packets
and the other is blocked.
• All ports are blocked when the switch is booted, then some of them change state
to listening, to learning, and then to forwarding.
2-34
Configuring the Switch
Parameter Description
Designated The cost for a packet to travel from this port to the root in the current Spanning Tree
Cost configuration. The slower the media, the higher the cost.
Designated Bridge The priority and MAC address of the device through which this port must communicate
(ID) to reach the root of the Spanning Tree.
Designated The priority and number of the port on the designated bridging device through which this
Port (ID) switch must communicate with the root of the Spanning Tree.
Status : DISABLED
Parameter Description
Mirror Source Port The port whose traffic will be monitored.
Mirror Target Port The port that will duplicate or “mirror” all the traffic happening on the
monitored port.
Status Enables or disables the mirror function.
2-35
Using the System Configuration Program
Configuring Port Trunks
Port trunks can be used to increase the bandwidth of a network connection or to
ensure fault recovery. You can configure up to five trunk connections (combining 2~4
ports into a fat pipe) between any two standalone OmniStack® 6024 switches, or up
to 12 for an entire stack. However, before making any physical connections between
devices, use the Trunk Configuration menu to specify the trunk on the devices at
both ends. When using a port trunk, note that:
• The ports used in a trunk must all be of the same media type (RJ-45, 100 Mbps
fiber, 1000BASE-SX or 1000BASE-LX). The ports that can be assigned to the
same trunk have certain other restrictions as described on page 2-38.
• Ports can only be assigned to one trunk.
• The ports at both ends of a connection must be configured as trunk ports.
• The ports at both ends of a trunk must be configured in an identical manner,
including speed, duplex mode, and VLAN assignments.
• None of the ports in a trunk can be configured as a mirror source port or mirror
target port.
• All the ports in a trunk have to be treated as a whole when moved from/to, added
or deleted from a VLAN.
• The Spanning Tree Algorithm will treat all the ports in a trunk as a whole.
• Enable the trunk prior to connecting any cable between the switches to avoid
creating a loop.
• Disconnect all trunk port cables or disable the trunk ports before removing a port
trunk to avoid creating a loop.
2-36
Configuring the Switch
You can use the Port Trunking Configuration screen to set up port trunks as shown
below:
<Ok>
Use <TAB> or arrow keys to move, other keys to make changes.
Parameter Description
Trunk ID Configure up to five trunks per switch.
Status Shows if the selected trunk is enabled or disabled.
Unit Specifies a switch unit in the stack (1~4).
Port Select from 2 ~ 4 ports per trunk.
[Show] Displays trunk settings, where the first trunk listed is specified by “Trunk ID.”
[More] Scrolls through the list of configured trunks.
[Enable] [Disable] Enables/disables the selected trunk.
[Add] [Delete] Adds/deletes the port specified by
Trunk ID / Member Unit / Member Port.
2-37
Using the System Configuration Program
The RJ-45 ports used for one side of a trunk must all be on the same internal switch
chip. The port groups permitted include:
Group 1 Group 2 Group 3
1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12,
13, 14, 15, 16 17, 18, 19, 20 21, 22, 23, 24
The 100BASE-FX fiber ports used for one side of a trunk must all be on the same
module. However, the 1000BASE-SX, 1000BASE-LX, 1000BASE-LH and
1000BASE-T ports used for one side of a trunk may be on any switch in the stack, or
both on the same switch if used standalone.
Media Module
100BASE-FX Any ports on a single module.
1000BASE-SX Up to four Gigabit ports from any switch in the stack, or both Gigabit ports on two
1000BASE-LX modules installed in a standalone switch.
1000BASE-T
For example, when using Gigabit ports to form a trunk within a stack, the Gigabit
ports will all be at Port 25. In this case, you could specify a trunk group consisting of:
(Unit1-Port25, Unit2-Port25, Unit3-Port25, Unit4-Port25),
or two trunks consisting of:
(Unit1-Port25, Unit2-Port25) and (Unit3-Port25, Unit4-Port25).
2-38
Configuring the Switch
IGMP Multicast Filtering
Multicasting is used to support real-time applications such as video conferencing or
streaming audio. A multicast server does not have to establish a separate
connection with each client. It merely broadcasts its service to the network, and any
hosts which want to receive the multicast register with their local multicast switch/
router. Although this approach reduces the network overhead required by a
multicast server, the broadcast traffic must be carefully pruned at every multicast
switch/router it passes through to ensure that traffic is only passed on the hosts
which subscribed to this service.
This switch uses IGMP (Internet Group Management Protocol) to query for any
attached hosts who want to receive a specific multicast service. The switch looks up
the IP Multicast Group used for this service and adds any port which received a
similar request to that group. It then propagates the service request on to any
neighboring multicast switch/router to ensure that it will continue to receive the
multicast service. (For more information, see “IGMP Protocol” on page 4-5.)
Configuring IGMP
This protocol allows a host to inform its local switch/router that it wants to receive
transmissions addressed to a specific multicast group. You can use the IGMP
Configuration screen to configure multicast filtering shown below.
Parameter Description
IGMP Status If enabled, the switch will monitor network traffic to determine which hosts want
to receive multicast traffic. This is also referred to as IGMP Snooping.
IGMP Query Count The maximum number of queries issued for which there has been no response
before the switch takes action to solicit reports. (Range 2 - 10.)
IGMP Report Delay The time (in seconds) between receiving an IGMP Report for an IP multicast
address on a port before the switch sends an IGMP Query out that port and
removes the entry from its list. (Range 5 - 30.)
2-39
Using the System Configuration Program
Configuring Broadcast Storm Control
Use the Broadcast Storm Control Configuration screen to enable broadcast storm
control for any port on the switch, as shown below.
<Apply> <Ok> <Cancel> <Up Unit> <Down Unit> <Prev Page> <Next Page>
Use <TAB> or arrow keys to move. <Enter> to select
Parameter Description
Broadcast control on all ports Allows you to enable/disable broadcast storm control for all ports on the switch.
Threshold The packet-per-second threshold for broadcast packets on the port.
(Default is 500 pps.)
Broadcast Control Enables/disables broadcast control for the port. When enabled, the switch will
employ a broadcast-control mechanism if the packet-per-second threshold is
exceeded. This mechanism limits the amount of broadcasts passed by the port
to half of the received packet-per-second count. The control mechanism
remains in effect until the number of received broadcasts falls back below the
packet-per-second threshold. (Default is Enabled.)
2-40
Configuring the Switch
Port Security Configuration
Use the Port Security Configuration screen to enable and configure port security for
the switch. Port security allows you to configure each port with one or more device
MAC addresses that are authorized to access the network through that port.
When enabled on a port, the switch can automatically learn the MAC addresses of
one or a limited number of devices attached to the port and “lock-in” these as the
only addresses authorized to access the port. If the port security is violated, the
switch will automatically disable the port and send a trap message.
<Ok> <Cancel> <Up Unit> <Down Unit> <Prev Page> <Next Page>
Use <TAB> or arrow keys to move, <Space> to scroll options.
Parameter Description
Security Mode Port security can be set to four modes:
AUTO — The port will automatically learn MAC addresses up to the number set in
the “Quota” field (1 is the default). When the quota is reached, the mode
automatically changes to the STATIC mode and the switch will execute the
configured “Security Action” if the port security is violated (default is to send a trap
message and disable the port).
STATIC — Port security is in operation using MAC addresses learned automatically
or manually configured from the “Advanced” screen.
DISABLE — Port security is disabled on the port and any authorized MAC addresses
are removed from the port’s secure-address list.
LOCKED — Allows you to manually lock a port for a security violation.
Security Action Defines the action to be taken if the port security is violated. There are three settings:
SEND_TRAP_&_DISABLE_PORT — Send a trap message and disable the port.
SEND_TRAP — Send a trap message.
DISABLE_PORT — Disable the port.
Quota The maximum number of authorized MAC addresses for the port. (Default is 1.)
Secure The current number of secure MAC addresses for the port.
<Advanced> Provides access to the Advanced Port Security screen where authorized MAC
addresses can be configured manually for each port.
2-41
Using the System Configuration Program
Advanced Setting
Use the Advanced Port Security Configuration screen to manually configure port
security for the switch.
<OK>
Use <TAB> or arrow keys to move, <Space> to scroll options.
Parameter Description
MAC Address A list of the authorized MAC addresses that can access the network through
the specified port.
Secure Address Count The total number of authorized MAC addresses configured on the switch.
Unit The stack unit ID.
Port The port number on the unit.
[Show] Displays authorized MAC addresses for the specified port.
[More] Displays more MAC addresses for the port.
Mode The mode field can be set to one of these states:
DISABLE — Disable port security on the port and remove any authorized MAC
addresses from the port’s secure-address list.
STATIC — Enable port security using the authorized MAC addresses in the list.
LEARNING — Learn MAC addresses on the port up to the allowed quota.
SEND_TRAP&DISABLE_PORT — Set security action to send a trap message
and disable the port.
SEND_TRAP — Set security action to send a trap message.
DISABLE_PORT — Set security action to disable the port.
LEARNING_SEND_TRAP — Set mode to learning and action to send a trap.
LEARNING_DISABLE_PORT — Set mode to learning and action to disable
port.
LEARNING_SEND_TRAP&DISABLE_PORT — Set mode to learning and
action to send a trap and disable port.
LOCK_SEND_TRAP — Set mode to lock and action to send a trap.
LOCK_DISABLE_PORT — Set mode to lock and action to disable.
LOCK_SEND_TRAP&DISABLE_PORT — Set mode to lock and action to
send a trap and disable port.
2-42
Configuring the Switch
Parameter Description
Violation MAC Displays the MAC address that triggered a port security violation.
MAC A specific MAC address to be added or deleted from the list.
[Add] Adds a new MAC address to the current list.
[Delete] Removes a MAC address from the current list.
[Apply] Applies a change of Mode to the port.
[Clear] Clears all the MAC addresses for the current port.
2-43
Using the System Configuration Program
Configuring Bridge MIB Extensions
The Bridge MIB includes extensions for managed devices that support Traffic
Classes and Virtual LANs. To display and configure these extensions, use the
Extended Bridge Configuration screen as shown below.
Bridge Settings :
Traffic Classes : TRUE
GMRP : DISABLED
GVRP : DISABLED
Parameter Description
Bridge Capability
Extended Multicast Filtering This switch does not support filtering of individual multicast addresses based
Services on GMRP (GARP Multicast Registration Protocol).
Traffic Classes This switch provides mapping of user priorities to multiple traffic classes.
(Refer to “802.1p Port Traffic Class Information” on page 2-47.)
Static Entry Individual Port This switch allows static filtering for unicast and multicast addresses. (Refer
to Network Monitor Menu / Static Unicast Address Table Configuration and
Static Multicast Address Table Configuration.)
VLAN Learning This switch uses Independent VLAN Learning (IVL), whereby each port
maintains its own VLAN filtering database.
Configurable This switch allows you to override the default PVID (Port VLAN ID) assigned
PVID Tagging to untagged incoming frames under “802.1Q VLAN Port Configuration” on
page 2-52.
Local VLAN Capable This switch does not support multiple local bridges (that is, multiple Spanning
Trees).
Bridge Settings
Traffic Class* Multiple traffic classes are supported by this switch as indicated under Bridge
Capabilities. However, you can disable this function by setting this parameter
to False.
GMRP* GARP Multicast Registration Protocol (GMRP) allows network devices to
register endstations with multicast groups.
IGMP Snooping is currently used by this switch to provide multicast filtering.
GVRP* GARP VLAN Registration Protocol (GVRP) defines a way for switches to
exchange VLAN information in order to register necessary VLAN members
on ports across the network. This function should be enabled to permit
VLANs groups which extend beyond the local switch.
* Not enabled in this firmware release.
2-44
Configuring the Switch
Configuring Traffic Classes
IEEE 802.1p defines up to 8 separate traffic classes. This switch supports Quality of
Service (QoS) by using two priority queues, with strict priority queuing for each port.
You can use the 802.1P Configuration menu to configure the default priority for each
port, or to display the mapping for the traffic classes as described in the following
sections.
<Ok>
Use <TAB> or arrow keys to move. <Enter> to select.
2-45
Using the System Configuration Program
Port Priority Configuration
Inbound frames that do not have any VLAN tags are tagged with the input port’s
default VLAN ID (PVID) and the Default Ingress User Priority as shown in the
following menu, and then sorted into the appropriate priority queue at the output
port. (Note that if the output port is an untagged member of the associated VLAN,
these frames are stripped of all VLAN tags prior to transmission.)
The default priority for all ingress ports is zero. Therefore, any inbound frames that
do not have priority tags will be placed in the low priority queue of the output port.
You can use the following menu to adjust default ingress priority for any port as shown
below.
<Apply> <Ok> <Cancel> <Up unit> <Down unit> <Prev page> <Next page>
Use <TAB> or arrow keys to move, other keys to make changes.
Parameter Description
Port Numeric identifier for switch port.
Default Ingress User Priority Default ingress priority can be set to any value from 0~7, where 0~3 specifies
the low priority queue and 4~7 specifies the high priority queue.
Number of Egress Traffic Indicates that this switch supports two priority output queues.
Classes
2-46
Configuring the Switch
802.1p Port Traffic Class Information
This switch provides two priority levels with strict priority queuing for port egress.
This means that any frames with a priority tag from 0~3 are sent to the low priority
queue “0” while those from 4~7 are sent to the high priority queue “1” as shown in
the following screen.
0 1 2 3 4 5 6 7
-----------------------------------------------------
1 0 0 0 0 1 1 1 1
2 0 0 0 0 1 1 1 1
3 0 0 0 0 1 1 1 1
4 0 0 0 0 1 1 1 1
5 0 0 0 0 1 1 1 1
6 0 0 0 0 1 1 1 1
7 0 0 0 0 1 1 1 1
8 0 0 0 0 1 1 1 1
9 0 0 0 0 1 1 1 1
10 0 0 0 0 1 1 1 1
11 0 0 0 0 1 1 1 1
12 0 0 0 0 1 1 1 1
Parameter Description
Port Numeric identifier for switch port.
User Priority Shows that user priorities 0~3 specify the low priority queue and 4~7 specify
the high priority queue.
2-47
Using the System Configuration Program
Configuring Virtual LANs
You can use the VLAN configuration menu to assign any port on the switch to any of
up to 256 LAN groups. In conventional networks with routers, broadcast traffic is
split up into separate domains. Switches do not inherently support broadcast
domains. This can lead to broadcast storms in large networks that handle traffic
such as IPX or NetBeui. By using IEEE 802.1Q compliant VLANs, you can organize
any group of network nodes into separate broadcast domains, confining broadcast
traffic to the originating group. This also provides a more secure and cleaner
network environment. For more information on how to use VLANs, see “Virtual
LANs” on page 4-2. The VLAN configuration screens are described in the following
sections.
<Ok>
<Enter> to select.
Parameter Description
VLAN Version Number The VLAN version used by this switch as specified in the IEEE 802.1Q
standard.
MAX VLAN ID Maximum VLAN ID recognized by this switch.
MAX Supported VLANs Maximum number of VLANs that can be configured on this switch.
Current Number of VLANs The number of VLANs currently configured on this switch.
Configured
2-48
Configuring the Switch
802.1Q VLAN Current Table Information
This screen shows the current port members of each VLAN and whether or not the
port supports VLAN tagging. Ports assigned to a large VLAN group that crosses
several switches should use VLAN tagging. However, if you just want to create a
small port-based VLAN for one or two switches, you can assign ports to the same
untagged VLAN. The current configuration is shown in the following screen.
<Ok>
Use <TAB> or arrow keys to move. <Enter> to select
Parameter Description
Deleted VLAN Entry Counts The number of times a VLAN entry has been deleted from this table.
VID The ID for the VLAN currently displayed.
Creation Time The value of sysUpTime (System Up Time) when this VLAN was created.
Status Shows how this VLAN was added to the switch.
Dynamic GVRP: Automatically learned via GVRP.
Permanent: Added as a static entry.
Unit Stack unit.
Current Egress Ports Shows the ports which have been added to the displayed VLAN group, where
“1” indicates that a port is a member and “0” that it is not.
Current Untagged Ports If a port has been added to the displayed VLAN (see Current Egress Ports),
its entry in this field will be “1” if the port is untagged or “0” if tagged.
Sorted by VID The VLAN ID number from which the display will start.
[Show] Displays the members for the VLAN indicated by the “Sorted by VID” field.
[More] Displays any subsequent VLANs if configured.
2-49
Using the System Configuration Program
802.1Q VLAN Static Table Configuration
Use this screen to create a new VLAN or modify the settings for an existing VLAN.
You can add/delete port members for a VLAN from any unit in the stack as a tagged
or untagged member. Or you can prevent a port from being automatically added to
a VLAN by the GVRP protocol.
Parameter Description
VID The ID for the VLAN currently displayed.
Range: 1-2048
VLAN Name A user-specified symbolic name for this VLAN.
String length: Up to 8 alphanumeric characters
Status Sets the current editing status for this VLAN as: Not in Service, Destroy or
Active.
Unit Stack unit.
Egress Ports Set the entry for any port in this field to “1” to add it to the displayed VLAN, or
“0” to remove it from the VLAN.
Forbidden Egress Ports Prevents a port from being automatically added to this VLAN via GVRP.
Note that GVRP is not supported in the current firmware release.
Untagged Ports You can add a port to the displayed VLAN as an untagged port by setting this
field to “1” or as a tagged port by setting it to “0.” This field is only enabled if
the corresponding port has been added to the displayed VLAN as an “Egress
Port.”
[Show] Displays settings for the specified VLAN.
[More] Displays consecutively numbered VLANs.
[New] Sets up the screen for configuring a new VLAN.
2-50
Configuring the Switch
For example, the following screen displays settings for VLAN 2, which includes
untagged ports 1-6, and forbidden port 8.
Notes: 1. To allow this switch to participate in a VLAN group that extends beyond
this switch, you must add the VLAN ID for the required external groups.
2. If a removed port is no longer assigned to any other group as an
untagged port, it will automatically be assigned to VLAN group 1 as
untagged.
2-51
Using the System Configuration Program
802.1Q VLAN Port Configuration
Use this screen to configure port-specific settings for IEEE 802.1Q VLAN features.
<Apply> <Ok> <Cancel> <Up unit> <Down unit> <Prev page> <Next page>
Use <TAB> or arrow keys to move, other keys to make changes.
Parameter Description
PVID The VLAN ID assigned to untagged frames received on this port.
Acceptable Frame Type1 This switch accepts “All” frame types, including VLAN tagged or VLAN
untagged frames. Note that all VLAN untagged frames received on this port
are assigned to the PVID for this port.
Ingress Filtering1 If set to “True,” incoming frames for VLANs which do not include this ingress
port in their member set will be discarded at the ingress port.
GVRP Status2 Enables or disables GVRP for this port. When disabled, any GVRP packets
received on this port will be discarded and no GVRP registrations will be
propagated from other ports.
Note that GVRP must be enabled for the switch before this setting can take
effect. (See Device Control Menu / Extended Bridge Configuration.)
GVRP Failed Registrations2 The total number of failed GVRP registrations, for any reason, on this port.
GVRP Last PDU Origin 2 The Source MAC Address of the last GVRP message received on this port.
1: These controls do not affect VLAN independent BPDU frames, such as GVRP or STP. However, they do
affect VLAN dependent BPDU frames, such as GMRP.
2: Not available for the current firmware release.
2-52
Monitoring the Switch
Port Statistics
RMON Statistics
Unicast Address Table
Multicast Address Registration Table
IP Multicast Registration Table
Static Unicast Address Table Configuration
Static Multicast Address Table Configuration
<Ok>
Use <TAB> or arrow keys to move. <Enter> to select.
Menu Description
Port Statistics Displays statistics on network traffic passing through the selected port.
RMON Statistics Displays detailed statistical information for the selected port such as packet
type and frame size counters.
Unicast Address Table Provides full listing of all unicast addresses stored in the switch, as well as
sort, search and clear functions.
Multicast Address Registration Displays the ports that belong to each GMRP Multicast group.
Table*
IP Multicast Displays the ports that belong to each IP Multicast group.
Registration Table
Static Unicast Address Table Allows you to display or configure static unicast addresses.
Configuration
Static Multicast Address Table Allows you to display or configure static GMRP multicast addresses.
Configuration*
* Not implemented in this firmware release.
2-53
Using the System Configuration Program
Displaying Port Statistics
Port Statistics display key statistics from the Ethernet-like MIB for each port. Error
statistics on the traffic passing through each port are displayed. This information can
be used to identify potential problems with the switch (such as a faulty port or
unusually heavy loading). The values displayed have been accumulated since the
last system reboot.
Select the required port. The statistics displayed are indicated in the following figure
and table.
Menu Description
FCS Errors The number of frames received that are an integral number of octets in length
but do not pass the FCS check.
Single Collision Frames* The number of successfully transmitted frames for which transmission is
inhibited by exactly one collision.
Multiple Collision Frames* A count of successfully transmitted frames for which transmission is inhibited
by more than one collision.
SQE Test Errors* A count of times that the SQE TEST ERROR message is generated by the
PLS sublayer.
Deferred Transmissions* A count of frames for which the first transmission attempt on a particular
interface is delayed because the medium was busy.
Late Collisions The number of times that a collision is detected later than 512 bit-times into
the transmission of a packet.
Excessive Collisions* The number of frames for which transmission failed due to excessive
collisions.
Internal Mac Transmit Errors* The number of frames for which transmission failed due to an internal MAC
sublayer transmit error.
Carrier Sense Errors* The number of times that the carrier sense condition was lost or never
asserted when attempting to transmit a frame.
Frames Too Long The number of frames received that exceed the maximum permitted frame
size.
2-54
Monitoring the Switch
Menu Description
Internal Mac Receive Errors The number of frames for which reception failed due to an internal MAC
sublayer receive error.
* The reported values will always be zero because these statistics are not supported by the internal chip set.
Note: Statistics are automatically refreshed every 5 seconds (see page 2-13).
Menu Description
Drop Events The total number of events in which packets were dropped due to lack of
resources.
Received Bytes Total number of bytes of data received on the network. This statistic can be
used as a reasonable indication of Ethernet utilization.
Received Frames The total number of frames (bad, broadcast and multicast) received.
Broadcast Frames The total number of good frames received that were directed to the broadcast
address. Note that this does not include multicast packets.
Multicast Frames The total number of good frames received that were directed to this multicast
address.
CRC/Alignment Errors The number of CRC/alignment errors (FCS or alignment errors).
Undersize Frames The total number of frames received that were less than 64 octets long
(excluding framing bits, but including FCS octets) and were otherwise well
formed.
2-55
Using the System Configuration Program
Menu Description
Oversize Frames The total number of frames received that were longer than 1518 octets
(excluding framing bits, but including FCS octets) and were otherwise well
formed.
Fragments The total number of frames received that were less than 64 octets in length
(excluding framing bits, but including FCS octets) and had either an FCS or
alignment error.
Jabbers The total number of frames received that were longer than 1518 octets
(excluding framing bits, but including FCS octets), and had either an FCS or
alignment error.
Collisions The best estimate of the total number of collisions on this Ethernet segment.
64 Byte Frames The total number of frames (including bad packets) received and transmitted
that were 64 octets in length (excluding framing bits but including FCS
octets).
65-127 Byte Frames The total number of frames (including bad packets) received and transmitted
that were between 65 and 127 octets in length inclusive (excluding framing
bits but including FCS octets).
128-255 Byte Frames The total number of packets (including bad packets) received and transmitted
that were between 128 and 255 octets in length inclusive (excluding framing
bits but including FCS octets).
1024-1518 Byte Frames The total number of packets (including bad packets) received and transmitted
that were between 1024 and 1518 octets in length inclusive (excluding
framing bits but including FCS octets).
Note: Statistics are automatically refreshed every 5 seconds (see page 2-13).
2-56
Monitoring the Switch
Displaying the Unicast Address Table
The Address Table contains the MAC addresses and VLAN identifier associated
with each port (that is, the source port associated with the address and VLAN),
sorted by MAC address or VLAN ID. You can search for a specific address, clear the
entire address table, or information associated with a specific address, or set the
aging time for deleting inactive entries. The information displayed in the Address
Table is indicated in the following figure and table.
Alcatel OmniStack 6024
Menu Description
Aging Time Time-out period in seconds for aging out dynamically learned forwarding information.
Range: 10 - 415 seconds; Default: 300 seconds
Dynamic Count The number of dynamically learned addresses in the table.
Static Count The number of static addresses in the table.
MAC The MAC address of a node.
VID The VLAN(s) associated with this address or port.
Unit Switch unit in the stack (1~4).
Port The port whose address table includes this MAC address.
Status Indicates address status as:
D: Dynamically learned, or
P: Fixed permanently by SNMP network management software.
Sorted/Cleared by Selects the primary key used to sort/clear the table: MAC or VID.
[Show] Displays the address table for the specified VLAN ID, sorted by primary key MAC or VID.
[More] Scrolls through the entries in the address table.
[Clear] Clears the specified MAC address.
[Clear ALL] Clears all dynamically learned MAC addresses in the table.
2-57
Using the System Configuration Program
Displaying the IP Multicast Registration Table
Use the IP Multicast Registration Table to display all the multicast groups active on
this switch, including multicast IP addresses and the corresponding VLAN ID.
<OK>
Use <TAB> or arrow keys to move, <Enter> to select.
Menu Description
VID VLAN ID assigned to this multicast group.
Multicast IP IP address for specific multicast services.
Unit Stack unit.
Dynamic Port Lists The switch ports registered for the indicated multicast service.
Learned by Indicates the manner in which this address was learned: Dynamic or IGMP.
Sorted by Selects the primary sort key for displaying table entries. Note that only
VID+Multicast IP is implemented in the current firmware release.
[Show] Displays the address table sorted on VID and then Multicast IP.
[More] Scrolls through the entries in the address table.
2-58
Monitoring the Switch
Configuring Static Unicast Addresses
Use the Static Unicast Address Table Configuration screen to manually configure
host MAC addresses in the unicast table. You can use this screen to associate a
MAC address with a specific VLAN ID and switch port as shown below.
<OK>
Use <TAB> or arrow keys to move, <Enter> to select.
Menu Description
VID The VLAN group this port is assigned to.
MAC Address The MAC address of a host device attached to this switch.
Unit The switch unit the host device is attached to.
Port The port the host device is attached to.
Status The status for an entry can be set to:
Permanent This entry is currently in use and will remain so after
the next reset of the switch.
DeleteOnReset This entry is currently in use and will remain so until
the next reset.
Invalid Removes the corresponding entry.
DeleteOnTimeOut This entry is currently in use and will remain so until
it is aged out. (Refer to “Aging Time” on page 2-57.)
Other This entry is currently in use but the conditions
under which it will remain so differ from the
preceding values.
Sorted by Selects the primary sort key for displaying table entries. Note that only
VID+MAC is implemented in the current firmware release.
[Show] Displays the static address table sorted on VID as the primary key and MAC
address as secondary key.
[More] Scrolls through entries in the static address table.
[Set] Adds the specified entry to the static address table, such as shown in the
following example:
VID : 1 MAC : 00-00-00-e8-34-22
Unit : 1 Port: 1
Status : Permanent
2-59
Using the System Configuration Program
Restart Option :
POST : YES
Reload Factory Defaults : NO
Keep IP Setting : NO
Keep User Authentication : NO
[Restart]
Menu Description
POST Runs the Power-On Self-Test
Reload Factory Defaults Reloads the factory defaults
Keep IP Setting Retains the settings defined in the IP Configuration menu.
Keep User Authentication Retains the user names and passwords defined in the Console Login
Configuration menu.
[Restart] Restarts the switch.
2-60
Chapter 3: Web-Based Management
2. Set the Administrator user name and password using an out-of-band serial
connection. Access to the Web agent is controlled by the same Administrator
user name and password as the on-board configuration program.
3-1
Web-Based Management
Home Page
When your Web browser connects with the switch’s Web agent, the home page is
displayed as shown below. The home page displays the Main Menu on the left-hand
side of the screen and System Information on the right-hand side. The Main Menu
links are used to navigate to other menus and display configuration parameters and
statistical data.
If this is your first time to access the management agent, you should define a new
Administrator password, record it and put it in a safe place. From the Main Menu,
select Security and enter a new password for the Administrator. Note that passwords
can consist of up to 11 alphanumeric characters and are not case sensitive.
Note: Based on the default configuration, a user is allowed three attempts to enter the
correct password; on the third failed attempt the current connection is terminated.
See “Console Login Configuration” on page 2-17.
3-2
Panel Display
Configuration Options
Configurable parameters have a dialog box or a drop-down list. Once a configuration
change has been made on a page, be sure to click on the “Apply” button at the
bottom of the page to confirm the new setting. The following table summarizes the
Web page configuration buttons.
Notes: 1. To ensure proper screen refresh, be sure that Internet Explorer 5.0 is
configured as follows: Under the menu “Tools / Internet Options / General /
Temporary Internet Files / Settings,” the setting for item “Check for newer
versions of stored pages” should be “Every visit to the page.”
2. When using Internet Explorer 5.0, you may have to manually refresh the screen
after making configuration changes by pressing the browser’s refresh button.
Panel Display
The Web agent displays an image of the switch’s ports, showing port links and
activity. Clicking on the image of a port displays statistics and configuration
information for the port. Clicking on the image of the Switch ID LCD display displays
the Console Configuration screen.
3-3
Web-Based Management
Port State Display
Click on any port to display a summary or port status as shown below, as well as
Etherlike statistics (page 3-45) and RMON statistics (page 3-46).
Parameter Description
Type Shows port type as:
10/100TX: 10BASE-T / 100BASE-TX
Admin Status Shows if the port is enabled, or has been disabled due to abnormal behavior or
for security reasons. See “Port Configuration” on page 3-36.
Link Status Indicates if the port has a valid connection to an external device.
Speed Status Indicates the current port speed.
Duplex Status Indicates the port’s current duplex mode.
Flow Control Status Shows the flow control type in use. Flow control can eliminate frame loss by
“blocking” traffic from end stations connected directly to the switch.
VLAN The VLAN ID assigned to untagged frames received on this port. You can set the
default Port VLAN ID (PVID) under “VLAN Port Configuration” on page 3-32 to
assign ports to the same untagged VLAN.
3-4
Panel Display
Console Configuration
If you are having difficulties making an out-of-band console connection to the serial
port on the agent module, you can display or modify the current settings for the
serial port through the Web agent. Click on the serial port icon in the switch image to
display or configure these settings, as shown below.
3-5
Web-Based Management
Main Menu
Using the on-board Web agent, you can define system parameters, manage and
control the switch, the connected stack and all its ports, or monitor network conditions.
The following table briefly describes the selections available from this program.
Menu Description
System Provides basic system description, including contact information.
Switch Shows hardware/firmware version numbers, power status, and expansion
modules in use.
IP Includes boot state, IP address, and the maximum number of Telnet sessions
allowed.
SNMP Configures communities and trap managers; and activates traps.
Authentication Sets password for system access and allows configuration of RADIUS and
TACACS+ server settings.
Security Sets password for system access.
Upgrade Downloads new version of firmware to update your system.
Configure Saves the switch configuration to a file on a TFTP server. This file can be later
downloaded to restore the configuration.
Address Table Provides full listing of unicast addresses, sorted by address or VLAN.
STA Enables Spanning Tree Algorithm; also sets parameters for switch priority, hello
time, maximum message age, and forward delay; as well as port priority and
path cost.
Bridge Extension Displays/configures extended bridge capabilities provided by this switch,
including support for traffic classes and VLAN extensions.
Priority Configures default port priorities and displays queue assignments.
VLAN Management Allows management access of the switch from all VLANs or only from a
specified VLAN.
VLAN Configures VLAN group members and other port-specific VLAN settings.
IGMP Configures IGMP multicast filtering.
Port Enables any port, sets communication mode to auto-negotiation, full duplex or
half duplex, and enables/disables flow control. Also configures broadcast storm
control and port security.
Mirror Sets the source and target ports for mirroring.
Trunk Specifies ports to group into aggregate trunks.
Statistics Displays statistics on network traffic passing through the selected port.
3-6
System Information
System Information
Use the System Information screen to display descriptive information about the
switch, or for quick system identification as shown in the following figure and table.
Parameter Description
System Name* Name assigned to the switch system.
IP Address IP address of the agent you are managing. The agent supports SNMP over UDP/
IP transport protocol. In this environment, all systems on the Internet, such as
network interconnection devices and any PC accessing the agent (or running
management software) must have an IP address. Valid IP addresses consist of
four numbers, of 0 to 255, separated by periods. Anything outside of this format
will not be accepted by the configuration program.
Object ID MIB II object identifier for switch’s network management subsystem.
Location* Specifies the area or location where the system resides.
Contact* Contact person for the system.
System Up Time Length of time the current management agent has been running.
*
Maximum string length is 255, but the screen only displays 45 characters. You can use the arrow keys to
browse the whole string.
3-7
Web-Based Management
Switch Information
Use the Switch Information screen to display hardware/firmware version numbers
for the main board, as well as the power status and modules plugged into the
system.
Main Board
Parameter Description
Serial Number Serial number of the main board.
Number of Ports Number of switch ports (including modules).
Hardware Version Hardware version of the main board.
Firmware Version System firmware version in ROM.
Internal Power Status Power status for the switch.
Redundant Power Status Redundant power status for the switch.
Agent Module
Parameter Description
Hardware Version Hardware version of the agent module.
POST ROM Version Agent module’s Power-On Self-Test version.
Firmware Version Agent module’s firmware version.
Role Shows if this module is Master or Slave.
3-8
Switch Information
Expansion Slot
Parameter Description
Expansion Slot 1 Shows module type if inserted (100BASE-FX, 1000BASE-SX, 1000BASE-LX,
1000BASE-GBIC or 1000BASE-T).
2-Port 100Base-FX-SC(MMF) : 100BASE-FX (multimode)
1-Port 1000Base-SX-SC : 1000BASE-SX (multimode)
1-Port 1000Base-LX-SC : 1000BASE-LX (singlemode)
1-Port 1000BASE-TX : 1000BASE-T
1-Port 1000Base-GBIC : 1000BASE-GBIC
Expansion Slot Shows module type if inserted (100BASE-FX, 1000BASE-SX, 1000BASE-LX,
1000BASE-GBIC, 1000BASE-T or Stacking).
2-Port 100Base-FX-SC(MMF) : 100BASE-FX (multimode)
1-Port 1000Base-SX-SC : 1000BASE-SX (multimode)
1-Port 1000Base-LX-SC : 1000BASE-LX (singlemode)
1-Port 1000BASE-TX : 1000BASE-T
1-Port 1000Base-GBIC : 1000BASE-GBIC
Stack Module
3-9
Web-Based Management
IP Configuration
Use the IP Configuration screen to set the bootup option, configure the IP address
for the on-board management agent, or set the number or concurrent Telnet
sessions allowed. The screen shown below is described in the following table.
3-10
SNMP Configuration
SNMP Configuration
Use the SNMP Configuration screen to display and modify parameters for the
Simple Network Management Protocol (SNMP). The stack should include an SNMP
agent module which monitors the status of its hardware, as well as the traffic
passing through its ports. A computer attached to the network, called a Network
Management Station (NMS), can be used to access this information. Access rights
to the agent module are controlled by community strings. To communicate with the
switch, the NMS must first submit a valid community string for authentication. The
options for configuring community strings and related trap functions are described in
the following figures and table.
SNMP Community
The following figure and table describe how to configure the community strings
authorized for management access. Up to 5 community names may be entered.
Parameter Description
SNMP Community Up to 5 community strings may be used.
Capability
Community String A community entry authorized for management access. (The maximum string
length is 20 characters.)
Access Mode Management access is restricted to Read Only or Read/Write.
Add/Remove Add/remove strings from the active list.
3-11
Web-Based Management
Trap Managers
The following figure and table describe how to specify management stations that will
receive authentication failure messages or other trap messages from the switch. Up
to 5 trap managers may be entered.
Parameter Description
Trap Manager Capability Up to 5 trap managers may be used.
Trap Manager IP address of the trap manager.
IP Address
Trap Manager Community A community authorized to receive trap messages.
String
Add/Remove Add/remove strings from the active list.
Enable Authentication Issues a trap message to specified IP trap managers whenever authentication of
Traps an SNMP request fails.
Default: enabled
3-12
Authentication Settings
Authentication Settings
You can configure the switch to authenticate users logging into the system for
management access using local or authentication-server methods.
Remote Authentication Dial-in User Service (RADIUS) and Terminal Access
Controller Access Control System Plus (TACACS+) are logon authentication
protocols that use software running on a central server to control access to
RADIUS-aware or TACACS+-aware devices on the network. An authentication
server contains a database of multiple user name/password pairs with associated
privilege levels for each user requiring management access to a switch.
RADIUS uses UDP while TACACS+ uses TCP. UDP only offers best effort delivery,
while TCP offers a connection-oriented transport. Also, note that RADIUS encrypts
only the password in the access-request packet from the client to the server, while
TACACS+ encrypts the entire body of the packet.
By default, management access is always checked against the authentication
database stored on the local switch. If a remote authentication server is used, you
must specify the authentication sequence and the corresponding parameters for the
remote authentication protocol.
Notes: 1. RADIUS and TACACS+ logon authentication control management access
via the console port, Web browser, or Telnet.
2. The local switch user database has to be set up by manually entering user
names and passwords via the console or Web interface.
RADIUS and TACACS+ logon authentication assign a specific privilege level for
each user name/password pair. The user name, password, and privilege level must
be configured on the authentication server.
Use the Authentication Settings page to configure RADIUS and TACACS+ server
parameters and the authentication sequence.
3-13
Web-Based Management
Parameter Description
Authentication Select the authentication, or authentication sequence required.
You can specify up to three authentication methods for any user to indicate
the authentication sequence. For example, if you select (1) RADIUS, (2)
TACACS and (3) Local, the user name and password on the RADIUS server
is verified first. If the RADIUS server is not available, then authentication is
attempted using the TACACS+ server, and finally the local user name and
password is checke.
RADIUS Settings
Server IP Address The IP address of the RADIUS server.
Server Port Number The UDP port number used by the RADIUS server.
Secret Text String Encryption key used to authenticate logon access for the client. Do not use
blank spaces in the string. (Maximum length: 11 characters)
Number of Server Transmits The number of request transmits to the RADIUS server before failure.
Timeout for a reply The number of seconds the switch waits for a reply from the RADIUS server
before it resends the request.
TACACS Settings
Server IP Address The IP address of the TACACS+ server.
Server Port Number The TCP port number used by the TACACS+ server.
Secret Text String Encryption key used to authenticate logon access for the client. Do not use
blank spaces in the string. (Maximum length: 11 characters)
Security Configuration
Use the Security Configuration screen to restrict management access based on a
specified password. The Administrator has write access for parameters governing
the SNMP agent. You should therefore assign a password to the default
Administrator as soon as possible, and store it in a safe place. (If for some reason
your password is lost, or you cannot gain access to the system’s configuration
program, contact Alcatel Technical Support for assistance.)
Change Password
This password is for the system Administrator, with access privilege of Read/Write
for all screens. Passwords can consist of up to 11 alphanumeric characters and are
not case sensitive. (The default user name is “admin” and the default password is
“switch.”)
3-14
Firmware Upgrade Options
Parameter Description
Upload Mode Uploads to permanent flash ROM.
File Name The binary file to download. Use the Browse button to locate the file on your local
network.
Start Web Upload Starts uploading the file over the network.
Parameter Description
Server IP Address IP address of a TFTP server.
Download Mode The system downloads to permanent flash ROM.
File Name The binary file to download.
Start TFTP Download Issues request to TFTP server to download the specified file.
3-15
Web-Based Management
Parameter Description
Server IP Address IP address of a TFTP server.
File Name The name of the file to contain the switch configuration settings.
Start Configuration Issues a request to upload the configuration settings to the specified file on
TFTP Upload the TFTP server.
Parameter Description
Server IP Address IP address of a TFTP server.
File Name The name of the file that contains the switch configuration settings you wish
to restore.
Start Configuration Issues a request to the TFTP server to download the specified file.
TFTP Download
3-16
Address Table Configuration
Parameter Description
Aging Time Time-out period in seconds for aging out dynamically learned forwarding
information.
Range: 10 - 415 secs; default: 300 secs.
Dynamic Address Counts The number of dynamically learned addresses.
Static Address Counts The number of statically configured addresses.
Address Table Sort Key Entries can be sorted by address or VLAN ID.
Address Table The system displays the MAC address of each node, and the port whose
address table includes this MAC address, the associated VLAN(s), and the
address status (i.e., dynamic or static).
New Static Address Use these fields to add or remove a static entry to the address table. Indicate
the address, stack unit, port and VLAN group when adding a new entry.
Add/Remove Adds/removes the selected address.
Clear Table Removes all addresses from the address table.
3-17
Web-Based Management
Spanning Tree
The parameters shown in the following figure and table describe the current bridge
STA Information.
Parameter Description
Spanning Tree State Shows if the switch is enabled to participate in an STA-compliant network.
Bridge ID A unique identifier for this bridge, consisting of bridge priority plus MAC
address (where the address is normally taken from the agent).
Max Age The maximum time (in seconds) a device can wait without receiving a
configuration message before attempting to reconfigure.
Hello Time The time interval (in seconds) at which the root device transmits a configuration
message.
Forward Delay The maximum time (in seconds) the root device will wait before changing
states (i.e., listening to learning to forwarding).
Designated Root The priority and MAC address of the device in the spanning tree that this switch
has accepted as the root device.
Root Port The number of the port on this switch that is closest to the root. This switch
communicates with the root device through this port. If there is no root port,
then this switch has been accepted as the root device of the spanning tree
network.
Root Path Cost The path cost from the root port on this switch to the root device.
Configuration Changes The number of times the spanning tree has been reconfigured.
Last Topology Change The time since the spanning tree was last reconfigured.
3-18
Spanning Tree Algorithm (STA)
Ports
The parameters shown in the following figure and table are for port STA Information.
Parameter Description
Port Status Displays the current state of this port within the spanning tree:
No Link No link has been established on this port.
Disabled Port has been disabled by the user or has failed diagnostics.
Blocked Port receives STA configuration messages, but does not forward
packets.
Listening Port will leave blocking state due to topology change, starts
transmitting configuration messages, but does not yet forward
packets.
Learning Port has transmitted configuration messages for an interval set by
the Forward Delay parameter without receiving contradictory
information. Port address table is cleared, and the port begins
learning addresses.
Forwarding The port forwards packets, and continues learning addresses.
The rules defining port status are:
• A port on a network segment with no other STA compliant bridging device is
always forwarding.
• If two ports of a switch are connected to the same segment and there is no other
STA device attached to this segment, the port with the smaller ID forwards
packets and the other is blocked.
• All ports are blocked when the switch is booted, then some of them change state
to listening, to learning, and then to forwarding.
Forward Transitions The number of times the port has changed status to forwarding state.
Designated Cost The cost for a packet to travel from this port to the root in the current spanning tree
configuration. The slower the media, the higher the cost.
Designated Bridge The priority and MAC address of the device through which this port must
communicate to reach the root of the spanning tree.
Designated Port The priority and number of the port on the designated bridging device through which
this switch must communicate with the root of the spanning tree.
3-19
Web-Based Management
Spanning Tree Configuration
The following figures and tables describe Bridge STA configuration.
Switch
3-20
Spanning Tree Algorithm (STA)
STA Port Configuration
The following figure and table describe STA configuration for ports or modules.
3-21
Web-Based Management
Bridge Capability
Parameter Description
Extended Multicast Enables filtering of individual multicast addresses based on GMRP (GARP Multicast
Filtering Services* Registration Protocol).
Traffic Classes This switch provides mapping of user priorities to multiple traffic classes. (Refer to
the Priority menu on page 3-24.)
Static Entry Individual This switch enables static filtering for unicast and multicast addresses. (Refer to the
Port Address Table Configuration on page 3-17.)
VLAN Learning This switch uses Independent VLAN Learning (IVL), whereby each port maintains its
own VLAN filtering database.
Configurable This switch allows you to override the default PVID (Port VLAN ID) assigned to
PVID Tagging untagged incoming frames under VLAN Port Configuration on page 3-32.
Local VLAN Capable* A local bridge (that is, dedicated Spanning Tree) is applied to each individual VLAN.
* These functions are not available for the current firmware release.
3-22
Configuring Bridge MIB Extensions
Bridge Settings
Parameter Description
Traffic Classes* Multiple traffic classes are supported by this switch as indicated under Bridge
Capabilities. However, you can disable this function by clearing the check box for this
parameter.
GMRP* GARP Multicast Registration Protocol (GMRP) allows network devices to register
endstations with multicast groups.
IGMP Snooping is currently used by this switch to provide automatic multicast filtering.
GVRP* GARP VLAN Registration Protocol (GVRP) defines a way for switches to exchange
VLAN information in order to register necessary VLAN members on ports across the
network. This function should be enabled to permit VLANs groups which extend
beyond the local switch.
* These functions are not available for the current firmware release.
3-23
Web-Based Management
Priority
IEEE 802.1p defines up to 8 separate traffic classes. This switch supports Quality of
Service (QoS) by using two priority queues, with strict priority queuing for each port.
You can use the Priority Menu to configure the default priority for each port, or to
display the mapping for the traffic classes.
Parameter Description
Port Numeric identifier for switch port.
Default Ingress Default priority can be set to any value from 0~7, where 0~3 specifies the low
User Priority priority queue and 4~7 specifies the high priority queue.
Number of Egress Traffic Indicates that this switch supports two priority output queues.
Classes
3-24
Management Configuration
Port Traffic Class Information
This switch provides two priority levels with strict priority queuing for port egress.
This means that any frames with a default or user priority from 0~3 are sent to the
low priority queue “0” while those from 4~7 are sent to the high priority queue “1” as
shown in the following screen.
Parameter Description
Port Numeric identifier for switch port.
User Priority Shows that user priorities 0~3 specify the low priority queue and 4~7 specify the
high priority queue.
Class Range The priority queue classes available on this switch.
Management Configuration
You an use the VLAN Management screen to configure the management access of
the switch.
Parameter Description
CPU Join VLAN Allows management access of the switch from all VLANs or only from a specified
VLAN. If this field is set to “ONE” then the single VLAN with management acces
must be set in the “VLAN” field.
VLAN ID The ID of the single VLAN with management access to the switch, if the “CPU
Join VLAN” field is set to “ONE”.
3-25
Web-Based Management
Parameter Description
VLAN Version Number The VLAN version used by this switch as specified in the IEEE 802.1Q standard.
MAX VLAN ID Maximum VLAN ID recognized by this switch.
MAX Supported VLANs Maximum number of VLANs that can be configured on this switch.
Current Number of VLANs The number of VLANs currently configured on this switch.
Configured
3-26
Configuring Virtual LANs
VLAN Current Table
This screen shows the current port members of each VLAN and whether or not the
port supports VLAN tagging. Ports assigned to a large VLAN group that crosses
several switches should use VLAN tagging. However, if you just want to create a
small port-based VLAN for one or two switches, you can assign ports to the same
untagged VLAN. The current configuration is shown in the following screen.
Parameter Description
VLAN Entry Delete Count The number of times a VLAN entry has been deleted from this table.
VLAN ID The ID for the VLAN currently displayed.
Up Time at Creation The value of System Up Time (sysUpTime) when this VLAN was created.
Status Shows how this VLAN was added to the switch.
Dynamic GVRP: Automatically learned via GVRP.
Permanent: Added as a static entry.
Egress Ports Shows the ports which have been added to the displayed VLAN group.
Untagged Ports Shows the untagged VLAN port members.
3-27
Web-Based Management
VLAN Static List
Use this screen to create or remove VLAN groups.
Parameter Description
Current Lists all the current VLAN groups created for this system. Up to 256 VLAN groups
can be defined.
To allow this switch to participate in a VLAN group that extends beyond this
switch, you must add the VLAN ID for the required external groups.
New Allows you to specify the name and numeric identifier for a new VLAN group. (The
VLAN name is only used for management on this system; it is not added to the
VLAN tag.)
Status Enables/disables the specified VLAN.
Add Adds a new VLAN group to the current list.
Remove Removes a VLAN group from the current list.
If a removed port is no longer be assigned to any other group as an untagged
port, it will automatically be assigned to VLAN group 1 as untagged.
3-28
Configuring Virtual LANs
VLAN Static Table
Use this screen to modify the settings for an existing VLAN. You can add/delete port
members for a VLAN from any unit in the stack. (Note that VLAN 1 is fixed as an
untagged VLAN containing all ports in the stack, and cannot be modified via this
screen.)
Parameter Description
VLAN The ID for the VLAN currently displayed.
Range: 1-2048
Name A user-specified symbolic name for this VLAN.
String length: 8 alphanumeric characters
Status Enables/disables the specified VLAN.
Use the following menu to add or remove a port to the displayed VLAN group. As
you can see from this example, all ports are included in VLAN 1 by default.
Parameter Description
Egress Ports Adds ports to the specified VLAN.
3-29
Web-Based Management
Use the menu shown below to prevent a port from being dynamically added to the
displayed VLAN group through GVRP.
Parameter Description
Forbidden Egress Ports Prevents a port from being automatically added to this VLAN via GVRP. Note that
GVRP is not supported by the current firmware version.
Use the menu shown below to assign ports to the specified VLAN group as an IEEE
802.1Q tagged or untagged port. Assign ports as tagged if they are connected to
802.1Q VLAN compliant devices, or untagged if they are connected to
VLAN-unaware devices.
Parameter Description
Untagged Ports Adds an authorized egress port to the displayed VLAN as an untagged port.
Note: If a removed port is no longer assigned to any other group as an untagged port, it
will automatically be assigned to VLAN group 1 as untagged.
3-30
Configuring Virtual LANs
VLAN Static Membership by Port
Use the screen shown below to assign VLAN groups to the selected port. To perform
detailed port configuration for a specific VLAN, use the VLAN Static Table (page
3-29).
Parameter Description
Port Number Port number on the switch selected from the upper display panel.
Add/Remove Add or remove selected VLAN groups for the port indicated in the Port Number
field.
3-31
Web-Based Management
VLAN Port Configuration
Use this screen to configure port-specific settings for IEEE 802.1Q VLAN features.
Parameter Description
PVID The VLAN ID assigned to untagged frames received on this port. Use the PVID
to assign ports to the same untagged VLAN.
Acceptable Frame Type This switch accepts “All” frame types, including VLAN tagged or VLAN untagged
frames. Note that all VLAN untagged frames received on this port are assigned
to the PVID for this port.
Ingress Filtering If set to “True,” incoming frames for VLANs which do not include this port in their
member set will be discarded at the inbound port.
GVRP Status* Enables or disables GVRP for this port. When disabled, any GVRP packets
received on this port will be discarded and no GVRP registrations will be
propagated from other ports.
Note that GVRP must be enabled for the switch before this setting to take effect.
(See “Configuring Bridge MIB Extensions” on page 3-22.)
GVRP Failed The total number of failed GVRP registrations, for any reason, on this port.
Registrations*
GVRP Last PDU Origin* The Source MAC Address of the last GVRP message received on this port.
* GVRP is not available for the current firmware release.
3-32
IGMP Multicast Filtering
Configuring IGMP
This protocol allows a host to inform its local switch/router that it wants to receive
transmissions addressed to a specific multicast address group. Use the IGMP
Configuration screen to set key parameters for multicast filtering as shown below.
Parameter Description
IGMP Status If enabled, the switch will monitor network traffic to determine which hosts want
to receive multicast traffic.
Act as IGMP Querier* If enabled, the switch can serve as the “querier,” which is responsible for asking
hosts if they want to receive multicast traffic.
IGMP Query Count The maximum number of queries issued for which there has been no response
before the switch takes action to solicit reports.
IGMP Report Delay The time (in seconds) between receiving an IGMP Report for an IP multicast
address on a port before the switch sends an IGMP Query out that port and
removes the entry from its list.
* This function is not available for the current firmware release.
3-33
Web-Based Management
IP Multicast Registration Table
Use the IP Multicast Registration Table to display all the multicast groups active on
this switch, including multicast IP addresses and the corresponding VLAN ID.
Parameter Description
VLAN ID VLAN ID assigned to this multicast group.
Multicast IP Address IP address for specific multicast services.
Learned by Indicates the manner in which this address was learned: Dynamic or IGMP.
Multicast Group Port Lists The switch ports registered for the indicated multicast service.
3-34
Port Menus
Port Menus
Port Information
The Port Information screen displays the port status, link state, the communication
speed and duplex mode, as well as the flow control in use. To change any of the port
settings, use the Port Configuration menu. The parameters are shown in the
following figure and table.
Parameter Description
Admin Status Shows if the port is enabled or not.
Link Status Indicates if the port has a valid connection to an external device.
Speed Status Shows the port speed (10M, 100M or 1000M).
Duplex Status Displays the current duplex mode.
Flow Control Status Shows the flow control type in use. Flow control can eliminate frame loss by
“blocking” traffic from end stations connected directly to the switch. Back pressure
is used for half duplex and IEEE 802.3x for full duplex. Note that flow control
should not be used if a port is connected to a hub.
Security Status* Indicates the port’s security status:
Disable - security is disabled on the port.
Learning - the port is currently learning MAC addresses to “lock-in” for secure
access.
Secured - the port has learned MAC addresses, or has them statically configured
and is operating in secure mode.
Locked - port has been disabled due to a security violation (only when the security
action is set to disable).
* For more information, see “Port Security Configuration” on page 3-40.
3-35
Web-Based Management
Port Configuration
Use the Port Configuration menu to configure any port on the switch.
3-36
Port Menus
Expansion Port Information
The Expansion Port Information screen displays the port status, link state, the
communication speed and duplex mode, as well as the flow control in use. To
change any of the port settings, use the Expansion Port Configuration menu. The
parameters shown in the following figure and table are for expansion ports.
Parameter Description
Admin Status Shows if the port is enabled or not.
Link Status Indicates if the port has a valid connection to an external device.
Speed Status Shows the port speed (10M, 100M or 1000M).
Duplex Status Displays the current duplex mode.
Flow Control Status Shows the flow control type in use. Flow control can eliminate frame loss by
“blocking” traffic from end stations connected directly to the switch. Back pressure
is used for half duplex and IEEE 802.3x for full duplex. Note that flow control
should not be used if a port is connected to a hub.
Security Status* Indicates the port’s security status:
Disable - security is disabled on the port.
Learning - the port is currently learning MAC addresses to “lock-in” for secure
access.
Secured - the port has learned MAC addresses, or has them statically configured
and is operating in secure mode.
Locked - port has been disabled due to a security violation (only when the security
action is set to disable).
* For more information, see “Port Security Configuration” on page 3-40.
3-37
Web-Based Management
Expansion Port Configuration
Use the Expansion Port Configuration menus to configure any module port on the
switch.
3-38
Port Menus
Port Broadcast Storm Protect Configuration
Use the Port Broadcast Storm Protect Configuration screen to configure broadcast
storm control for any port on the switch.
3-39
Web-Based Management
Port Security Configuration
Use the Port Security Configuration screen to enable and configure port security for
the switch. Port security allows you to configure each port with one or more device
MAC addresses that are authorized to access the network through that port.
When enabled on a port, the switch can automatically learn the MAC addresses of
one or a limited number of devices attached to the port and “lock-in” these as the
only addresses authorized to access the port. If the port security is violated, the
switch will automatically disable the port and send a trap message.
Parameter Description
Security Mode Port security can be set to three modes:
Auto — The port will automatically learn MAC addresses up to the number set
in the “Quota” field (1 is the default). When the quota is reached, the mode
automatically changes to the STATIC mode and the switch will execute the
configured “Security Action” if the port security is violated (default is to send a
trap message and disable the port).
Static — Port security is in operation using MAC addresses learned
automatically or manually configured.
Disable — Port security is disabled on the port and any authorized MAC
addresses are removed from the port’s secure-address list.
Lock — Allows you to manually lock a port for a security violation.
Security Action Defines the action to be taken if the port security is violated. There are three
settings:
Send-Trap&Disable-Port — Send a trap message and disable the port.
Send-Trap — Send a trap message.
Disable-Port — Disable the port.
Learn Quota The maximum number of authorized MAC addresses for the port. (Default is 1.)
Secure The current number of secure MAC addresses for the port.
Violation MAC Displays the MAC address that triggered a port security violation.
3-40
Port Menus
Manual Setting
Use the bottom section of the Port Security Configuration screen to manually
configure port security for the switch.
Parameter Description
Port Number The port number on the unit.
Status The status field can be set to one of these states:
Disabled — Disable port security on the port and remove any authorized MAC
addresses from the port’s secure-address list.
Enabled — Enable port security using the authorized MAC addresses in the
list.
Learning — Learn MAC addresses on the port up to the allowed quota.
Send trap and disable port — Set security action to send a trap message and
disable the port.
Send trap when intrusion — Set security action to send a trap message.
Disable port when intrusion — Set security action to disable the port.
Learning trap — Set mode to learning and action to send a trap.
Learning disable port — Set mode to learning and action to disable port.
Learning trap and disable port — Set mode to learning and action to send a
trap and disable port.
Lock trap — Set mode to lock and action to send a trap.
Lock disable port — Set mode to lock and action to disable port.
Lock trap and disable port — Set mode to lock and action to send a trap and
disable port.
MAC Address List A list of the authorized MAC addresses that can access the network through
the specified port.
New Address A specific MAC address to be added to the list.
Add Adds a new specified MAC address to the current list.
Remove Removes a MAC address from the current list.
Clear All Clears all the MAC addresses for the current port.
3-41
Web-Based Management
Parameter Description
Status Enables/disables port mirroring.
Mirror Source Unit The switch containing the mirror source port.
Mirror Source Port The port whose traffic will be monitored.
Mirror Target Unit The switch containing the mirror target port.
Mirror Target Port The port that will duplicate or “mirror” all the traffic happening on the monitored
port.
3-42
Port Trunk Configuration
3-43
Web-Based Management
Use the Port Trunking Configuration screen to set up port trunks as shown below:
Parameter Description
Trunk A unique identifier for this trunk. You can configure up to five trunks per switch.
Status Enables or disables the displayed trunk.
Member List You can create up to 12 trunks for the entire stack by specifying the trunk
identifier, switch unit and port number, and then clicking on the “Add” button. Each
trunk can contain from 2 to 4 ports.
The RJ-45 ports used for one side of a trunk must all be on the same internal switch
chip. The port groups permitted include:
Group 1 Group 2 Group 3
1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12,
13, 14, 15, 16 17, 18, 19, 20 21, 22, 23, 24
The 100BASE-FX fiber ports used for one side of a trunk must all be on the same
module. However, the 1000BASE-SX, 1000BASE-LX and 1000BASE-T ports used
for one side of a trunk may be on any switch in the stack, or both on the same switch
if used standalone.
Media Module
100BASE-FX Any ports on a single module.
1000BASE-SX Up to four Gigabit ports from any switch in the stack, or both Gigabit ports on two
1000BASE-LX modules installed in a standalone switch.
1000BASE-T
For example, when using Gigabit ports to form a trunk within a stack, the Gigabit
ports will all be at Port 25. In this case, you could specify a trunk group consisting of:
(Unit1-Port25, Unit2-Port25, Unit3-Port25, Unit4-Port25),
or two trunks consisting of:
(Unit1-Port25, Unit2-Port25) and (Unit3-Port25, Unit4-Port25).
3-44
Port Statistics
Port Statistics
Use the Port Statistics menu to display Etherlike or RMON statistics for any port on
the switch. The statistics displayed are indicated in the following figure and table.
Etherlike Statistics
Etherlike Statistics display key statistics from the Ethernet-like MIB for each port.
Error statistics on the traffic passing through each port are displayed. This
information can be used to identify potential problems with the switch (such as a
faulty port or unusually heavy loading). Values displayed have been accumulated
since the last system reboot.
Parameter Description
FCS Errors The number of frames received that are an integral number of octets in length but
do not pass the FCS check.
Single Collision Frames* The number of successfully transmitted frames for which transmission is inhibited
by exactly one collision.
Multiple Collision Frames* A count of successfully transmitted frames for which transmission is inhibited by
more than one collision.
SQE Test Errors* A count of times that the SQE TEST ERROR message is generated by the PLS
sublayer.
Deferred Transmissions* A count of frames for which the first transmission attempt on a particular interface
is delayed because the medium was busy.
Late Collisions The number of times that a collision is detected later than 512 bit-times into the
transmission of a packet.
Excessive Collisions* The number of frames for which transmission failed due to excessive collisions.
Internal Mac Transmit The number of frames for which transmission failed due to an internal MAC
Errors* sublayer transmit error.
Carrier The number of times that the carrier sense condition was lost or never asserted
Sense Errors* when attempting to transmit a frame.
Frames Too Long The number of frames received that exceed the maximum permitted frame size.
Internal Mac Receive The number of frames for which reception failed due to an internal MAC sublayer
Errors receive error.
* The reported values will always be zero because these statistics are not supported by the internal chip set
used in this switch.
Note: Statistics are automatically refreshed every 60 seconds.
3-45
Web-Based Management
RMON Statistics
RMON Statistics display key statistics for each port or media module from RMON
group 1. (RMON groups 2, 3 and 9 can only be accessed using SNMP management
software.) The following screen displays overall statistics on traffic passing through
each port. RMON statistics provide access to a broad range of statistics, including a
total count of different frame types passing through each port. Values displayed
have been accumulated since the last system reboot.
Parameter Description
Drop Events The total number of events in which packets were dropped due to lack of
resources.
Received Bytes Total number of bytes of data received on the network. This statistic can be used
as a reasonable indication of Ethernet utilization.
Received Frames The total number of frames (bad, broadcast and multicast) received.
Broadcast Frames The total number of good frames received that were directed to the broadcast
address. Note that this does not include multicast packets.
Multicast Frames The total number of good frames received that were directed to this multicast
address.
CRC/Alignment Errors The number of CRC/alignment errors (FCS or alignment errors).
Undersize Frames The total number of frames received that were less than 64 octets long (excluding
framing bits, but including FCS octets) and were otherwise well formed.
Oversize Frames The total number of frames received that were longer than 1518 octets (excluding
framing bits, but including FCS octets) and were otherwise well formed.
Fragments The total number of frames received that were less than 64 octets in length
(excluding framing bits, but including FCS octets) and had either an FCS or
alignment error.
Jabbers The total number of frames received that were longer than 1518 octets (excluding
framing bits, but including FCS octets), and had either an FCS or alignment error.
Collisions The best estimate of the total number of collisions on this Ethernet segment.
64 Byte Frames The total number of frames (including bad packets) received and transmitted that
were 64 octets in length (excluding framing bits but including FCS octets).
65-127 Byte Frames The total number of frames (including bad packets) received and transmitted that
were between 65 and 127 octets in length inclusive (excluding framing bits but
including FCS octets).
128-255 Byte Frames The total number of packets (including bad packets) received and transmitted that
were between 128 and 255 octets in length inclusive (excluding framing bits but
including FCS octets).
3-46
Port Statistics
Parameter Description
256-511 Byte Frames The total number of packets (including bad packets) received and transmitted that
were between 256 and 511 octets in length inclusive (excluding framing bits but
including FCS octets).
512-1023 Byte Frames The total number of packets (including bad packets) received and transmitted that
were between 512 and 1023 octets in length inclusive (excluding framing bits but
including FCS octets).
1024-1518 Byte Frames The total number of packets (including bad packets) received and transmitted that
were between 1024 and 1518 octets in length inclusive (excluding framing bits
but including FCS octets).
Note: Statistics are automatically refreshed every 60 seconds.
3-47
Web-Based Management
3-48
Chapter 4: Advanced Topics
The OmniStack® 6024 supports Layer 2 switching and other advanced features,
which are described in this chapter.
Layer 2 Switching
When a frame enters a port, its destination MAC address is checked in the address
database to see which port leads to this destination. If the destination address
belongs to the incoming port, the frame is dropped or “filtered” because it addressed
to the local segment. If the destination address if found on another port, the frame is
forwarded to that port and queued for output. But, if the destination address is not
found in the address database, the frame is sent to one or more output ports based
on the rules for handling tagged or untagged VLAN frames.
If the source MAC address of the frame was not found in the address database, it is
recorded along with the incoming port number where it entered the switch. This
information is then used to make later decisions for frame forwarding.
Switching involves the following steps:
• VLAN Classification
• Learning
• Filtering
• Forwarding
• Aging
4-1
Advanced Topics
Once a stable network topology has been established, all bridges listen for Hello
BPDUs (Bridge Protocol Data Units) transmitted from the Root Bridge. If a bridge
does not get a Hello BPDU after a predefined interval (Maximum Age), the bridge
assumes that the link to the Root Bridge is down. This bridge will then initiate
negotiations with other bridges to reconfigure the network to reestablish a valid
network topology.
The following figure gives an illustration of how the Spanning Tree Algorithm assigns
bridging device ports.
Virtual LANs
Switches do not inherently support broadcast domains, which can lead to broadcast
storms in large networks that handle a lot of IPX or NetBeui traffic. In conventional
networks with routers, broadcast traffic is split up into physically separate domains to
confine broadcast traffic to the originating group and provide a much cleaner network
environment. This switch creates segregated broadcast domains based on easily
configurable VLANs, these are then linked, as required, via a router or Layer 3
switch.
An IEEE 802.1Q VLAN is a group of ports that can be located anywhere in the
network, but communicate as though they belong to the same physical segment.
VLANs help to simplify network management by allowing you to move devices to a
new VLAN without having to change any physical connections. VLANs can be easily
organized to reflect departmental groups (such as Marketing or R&D), usage groups
(such as e-mail), or multicast groups (used for multimedia applications such as video
conferencing).
VLANs provide greater network efficiency by reducing broadcast traffic, but also
allow you to make network changes without having to update IP addresses or IP
subnets. VLANs inherently provide a high level of network security, since traffic must
pass through a Layer 3 switch or a router to reach a different VLAN.
4-2
Virtual LANs
This switch supports the following VLAN features:
• Up to 256 VLANs based on the IEEE 802.1Q standard
• Distributed VLAN learning across multiple switches using explicit or implicit tagging
and GVRP protocol
• Port overlapping, allowing a port to participate in multiple VLANs
• End stations can belong to multiple VLANs
• Passing traffic between VLAN-aware and VLAN-unaware devices
• Priority tagging
• Port trunking with VLANs
Port Overlapping
Port overlapping can be used to allow access to commonly shared network
resources among different VLAN groups, such as file servers or printers. Note that if
you implement VLANs which do not overlap, but still need to communicate, you can
connect them using a router or Layer 3 switch.
4-3
Advanced Topics
GVRP-compliant devices to be automatically configured for VLAN groups based
solely on endstation requests.
4-4
Multicast Filtering
Multicast Filtering
Multicasting sends data to a group of nodes instead of a single destination. The
simplest way to implement multicasting is to broadcast data to all nodes on the
network. However, such an approach wastes a lot of bandwidth if the target group is
small compared to overall the broadcast domain.
Since applications such as video conferencing and data sharing are more widely
used today, efficient multicasting has become vital. A common approach is to use a
group registration protocol that lets nodes join or leave multicast groups. A switch or
router can then easily determine which ports contain group members and send data
out to those ports only. This procedure is called multicast filtering.
The purpose of multicast filtering is to optimize a switched network’s performance,
so multicast packets will only be forwarded to those ports containing multicast group
hosts or multicast routers/switches instead of flooding to all ports in the subnet
(VLAN). This OmniStack® model supports multicast filtering by passively monitoring
IGMP Query and Report messages.
IGMP Snooping
A Layer 2 switch can passively snoop on IGMP Query and Report packets
transferred between IP Multicast Routers/Switches and IP Multicast host groups to
learn the IP Multicast group members. It simply monitors the IGMP packets passing
through it, picks out the group registration information, and configures multicast
filters accordingly. IGMP Snooping generates no additional network traffic, allowing
you to significantly reduce the multicast traffic passing through your switch.
IGMP Protocol
The Internet Group Management Protocol (IGMP) runs between hosts and their
immediately neighboring multicast router/switch. IGMP is a multicast host
registration protocol that allows any host to inform its local router that it wants to
receive transmissions addressed to a specific multicast group.
A router, or multicast-enabled switch, can periodically ask their hosts is they want to
receive multicast traffic. If there is more than one router/switch on the LAN
performing IP multicasting, one of these devices is elected “querier” and assumes
the responsibility of querying the LAN for group members.
Based on the group membership information learned from IGMP, a router/switch can
determine which (if any) multicast traffic needs to be forwarded to each of its ports.
At Layer 3, multicast routers use this information, along with a multicast routing
protocol such as DVMRP, to support IP multicasting across the Internet.
Note that IGMP neither alters nor routes any IP multicast packets. A multicast router/
switch must be used to deliver IP multicast packets across different subnetworks.
4-5
Advanced Topics
Port Trunks
Ports can be combined into an aggregate link to increase the bandwidth of a network
connection or ensure fault recovery. You can group ports into trunks that consist of
two, three or four ports, creating an aggregate bandwidth of up to 8 Gbps when
grouping multiple Gigabit ports. Besides balancing the load across each port in the
trunk, the additional ports provide redundancy by taking over the load if another port
in the trunk should fail.
When using port trunks, remember that:
• Before removing a port trunk via the configuration menu, you must disable all the
ports in the trunk or remove all the network cables. Otherwise, a loop may be
created.
• To disable a single link within a port trunk, you should first remove the network
cable, and then disable both ends of the link via the configuration menu. This
allows the traffic passing across that link to be automatically distributed to the other
links in the trunk, without losing any significant amount of traffic.
4-6
Remote Monitoring
Remote Monitoring
Remote Monitoring (RMON) provides a cost-effective way to monitor large networks
by placing embedded or external probes on distributed network equipment (hubs,
switches or routers). Network management software can access the probes
embedded in network products to perform traffic analysis, troubleshoot network
problems, evaluate historical trends, or implement proactive management policies.
RMON has already become a valuable tool for network managers faced with a
quickly changing network landscape that contains dozens or hundreds of separate
segments. RMON is the only way to retain control of the network and analyze
applications running at multi-megabit speeds. It provides the tools you need to
implement either reactive or proactive policies that can keep your network running
based on real-time access to key statistical information.
This switch provides support for basic RMON which contains the four key groups
required for basic remote monitoring. These groups include:
Statistics: Includes all the tools needed to monitor your network for common errors
and overall traffic rates. Information is provided on bandwidth utilization, peak
utilization, packet types, errors and collisions, as well as the distribution of packet
sizes.
History: Can be used to create a record of network utilization, packet types, errors
and collisions. You need a historical record of activity to be able to track down
intermittent problems. Historical data can also be used to establish normal baseline
activity, which may reveal problems associated with high traffic levels, broadcast
storms, or other unusual events. Historical information can also be used to predict
network growth and plan for expansion before your network becomes too
overloaded.
Alarms: Can be set to test data over any specified time interval, and can monitor
absolute or changing values (such as a statistical counter reaching a specific value,
or a statistic changing by a certain amount over the set interval). Alarms can be set
to respond to either rising or falling thresholds.
Events: Defines the action to take when an alarm is triggered. The response to an
alarm can include recording the alarm in the Log Table or sending a message to a
trap manager. Note that the Alarm and Event Groups are used together to record
important events or immediately respond to critical network problems.
4-7
Advanced Topics
4-8
Appendix A: Troubleshooting
Troubleshooting Chart
Troubleshooting Chart
Symptom Action
Cannot connect using • Be sure to have configured the agent with a valid IP address, subnet
Telnet, Web browser, or mask and default gateway.
SNMP software
• Check that you have a valid network connection to the switch and that
the port you are using has not been disabled.
• Check network cabling between the management station and the
switch.
• If you cannot connect using Telnet, you may have exceeded the
maximum number of concurrent Telnet sessions permitted. Try
connecting again at a later time.
Cannot access the • Be sure to have set the terminal emulator program to VT100 compatible,
on-board configuration 8 data bits, 1 stop bit, no parity and 9600 bps.
program via a serial port
connection • If the switch is configured for Auto (baud rate detection), the terminal
emulator program must be set at 2400~19200 baud, 8 data bits, 1 stop
bit, no parity, and flow control set to none. Also, you must first press the
Enter key once to set the data rate and initialize the connection.
• Check that the null-modem serial cable conforms to the pin-out
connections provided in Appendix B.
A-1
Troubleshooting
2. When the system initialization screen appears as shown below, press “D” to
download system firmware, and then indicate the code type (1: Runtime, 2:
POST, 3: Mainboard).
For example, if you select 1 (for downloading agent firmware), the system will
display the following message:
3. Change your baud rate to 115200 bps, and press Enter to enable download
mode. From the terminal emulation program, select the file you want to
download, set the protocol to XModem, and then initialize downloading.
A-2
Upgrading Firmware via the Serial Port
3. After the file has been downloaded, the console screen will display information
similar to that shown below. Press “s” to start the management interface, change
the baud rate back to 9600, and press Enter. The Logon screen will then appear.
For details on managing the switch, refer to Chapter 2 for information on the
out-of-band console interface, or Chapter 3 for information on the Web interface.
A-3
Troubleshooting
A-4
Appendix B: Pin Assignments
B-1
Pin Assignments
B-2
Glossary
Bandwidth Utilization
The percentage of packets received over time as compared to overall bandwidth.
BOOTP
Boot protocol used to load the operating system for devices connected to the
network.
IEEE 802.1D
Specifies a general method for the operation of MAC bridges, including the
Spanning Tree Protocol.
IEEE 802.1Q
VLAN Tagging defines Ethernet frame tags which carry VLAN information. It allows
switches to assign end-stations to different virtual LANs, and defines a standard way
for VLANs to communicate across switched networks.
IEEE 802.3ac
Defines frame extensions for VLAN tagging.
In-Band Management
Management of the network from a station that is attached to the network.
Glossary-1
Glossary
Link Aggregation
See Port Trunk.
MIB
An acronym for Management Information Base. It is a set of database objects that
contains information about the device. It defines variables needed by the SNMP
protocol to monitor and control components in a network.
Out-of-Band Management
Management of the network from a station that is not attached to the network.
Port Mirroring
A method whereby data on a target port is mirrored to an analysis port for
troubleshooting with a network sniffer or RMON probe. This allows data on the target
port to be studied unobtrusively.
Port Trunk
Defines network link aggregation and trunking standards which specify how to
create a single high-speed logical link that combines several lower-speed physical
links.
Glossary-2
Glossary
Telnet
Defines a remote communication facility for interfacing to a terminal device over
TCP/IP.
XModem
A protocol used to transfer files between devices. Data is grouped in 128-byte
blocks and error-corrected.
Glossary-3
Glossary
Glossary-4
Index
A F
analyzer port configuration 2-35, 3-42 Fast Forwarding 3-21
automatic VLAN registration 4-3 Fast STA
See Fast Forwarding 3-21
B firmware
banner message configuration 2-21 information 2-7, 3-8
baud rate configuration 2-13, 3-5 upgrades 3-15, A-2
BOOTP flow control configuration 2-26, 3-36,
enabling 2-10, 3-10 3-38
for IP configuration 1-2
Bridge Protocol Data Units (BPDUs) 4-2 G
bridge STA information 2-33, 3-18 GVRP 4-3
Broadcast Storm Control 2-40, 2-41
H
C hardware information 2-7, 3-8
Class-of-Service 4-6 HTTP configuration 2-12
community names, configuring 2-15,
I
3-11
IGMP 2-39
connections
configuration 2-39, 3-33
serial port 1-2
protocol 4-5
Web browser 1-3
query 4-5
console interface
report 4-5
device control menu 2-25
snooping 4-5
logging off 2-60
in-band connections 1-2
login screen 2-1
Internet Group Management Protocol
main menu 2-3
See IGMP 4-5
management setup menu 2-8
IP configuration 2-10, 3-10
network monitor menu 2-53
system information 2-5 L
system restart menu 2-60 Layer-2 switching 4-1
console port link aggregation 2-36, 3-43, 4-6
configuration 2-13, 3-5 login
connections 1-2 configuration 2-17, 3-14
pin assignments B-1 console interface 2-1
logon authentication
D
RADIUS server 3-13
downloading software 2-18, 3-15, A-2
TACACS server 3-13
duplex mode configuration 2-27, 3-36,
3-38 M
MAC address of system 2-9
E
MAC address table, displaying 2-57,
Etherlike statistics 3-45
3-17
Index-1
Index
Index-2
Index
Index-3
Index
Index-4
F2.52 E062003-R05
150359-102