Tp-Link T1600G-52TS V2 Configuration Guide онлайн [10/790] 394684

Содержание

• Configuration guide 1
• T1600g series switches 1
• About this guide 2
• Accessing the switch 2
• Command line interface access 11 2
• Contents 2
• Conventions 2
• Intended readers 2
• Managing system 2
• More information 2
• Overview 2
• System 22 2
• System info configurations 24 2
• Web interface access 2
• Access security configurations 55 3
• System tools configurations 45 3
• User management configurations 37 3
• Appendix default parameters 73 4
• Basic parameters configurations 78 4
• Configuration examples 97 4
• Loopback detection configuration 93 4
• Managing physical interfaces 4
• Physical interface 77 4
• Port isolation configurations 90 4
• Port mirror configuration 82 4
• Port security configuration 86 4
• Sdm template configuration 70 4
• Address configurations 33 5
• Appendix default parameters 05 5
• Appendix default parameters 23 5
• Appendix default parameters 29 5
• Configuration example 18 5
• Configuring lag 5
• Lag 08 5
• Lag configuration 09 5
• Mac address table 31 5
• Managing mac address table 5
• Monitoring traffic 5
• Traffic monitor 25 5
• Appendix default parameters 50 6
• Configuration example 60 6
• Configuring 802 q vlan 6
• Example for security configurations 47 6
• Overview 52 6
• Q vlan configuration 53 6
• Security configurations 41 6
• Appendix default parameters 66 7
• Appendix default parameters 82 7
• Configuration example 74 7
• Configuration example 91 7
• Configuring mac vlan 7
• Configuring protocol vlan 7
• Mac vlan configuration 69 7
• Overview 68 7
• Overview 84 7
• Protocol vlan configuration 85 7
• Appendix default parameters 03 8
• Configuring spanning tree 8
• Mstp configurations 23 8
• Spanning tree 05 8
• Stp rstp configurations 13 8
• Stp security configurations 43 8
• Appendix default parameters 68 9
• Configuration example for mstp 49 9
• Configuring layer 2 multicast 9
• Igmp snooping configurations 73 9
• Layer 2 multicast 71 9
• Configuring mld snooping 11 11
• Viewing multicast snooping configurations 46 12
• Appendix default parameters 78 13
• Configuration examples 50 13
• Configuring logical interfaces 13
• Logical interfaces configurations 83 13
• Overview 82 13
• Appendix default parameter 09 14
• Appendix default parameters 94 14
• Configuring dhcp 14
• Configuring static routing 14
• Dhcp 11 14
• Dhcp client configuration 14 14
• Dhcp relay configuration 17 14
• Example for static routing 05 14
• Ipv4 static routing configuration 97 14
• Ipv6 static routing configuration 99 14
• Overview 96 14
• Viewing routing table 02 14
• Appendix default parameters 30 15
• Arp configurations 33 15
• Bandwidth control configuration 53 15
• Configuration examples 26 15
• Configuring arp 15
• Configuring qos 15
• Diffserv configuration 40 15
• Overview 32 15
• Qos 39 15
• Appendix default parameters 05 16
• Appendix default parameters 76 16
• Configuration example 88 16
• Configuration examples 60 16
• Configuring poe 16
• Configuring voice vlan 16
• Overview 79 16
• Poe 07 16
• Voice vlan configuration 81 16
• Acl 29 17
• Acl configurations 30 17
• Appendix default parameters 27 17
• Configuring acl 17
• Example for poe configurations 23 17
• Poe power management configurations 08 17
• Time range function configurations 16 17
• Appendix default parameters 57 18
• Arp inspection configurations 79 18
• Configuration example for acl 50 18
• Configuring network security 18
• Dhcp snooping configuration 71 18
• Ip mac binding configurations 64 18
• Network security 59 18
• Aaa configuration 04 19
• Configuration examples 23 19
• Dos defend configuration 86 19
• X configuration 90 19
• Appendix default parameters 42 20
• Configuration example 71 20
• Configuring lldp 20
• Lldp 47 20
• Lldp configurations 48 20
• Lldp med configurations 56 20
• Viewing lldp med settings 68 20
• Viewing lldp settings 63 20
• Appendix default parameters 90 21
• Configuring maintenance 21
• Diagnosing the device 03 21
• Maintenance 92 21
• Monitoring the system 93 21
• System log configurations 96 21
• Appendix default parameters 11 22
• Configuring snmp rmon 22
• Diagnosing the network 05 22
• Example for configuring remote log 09 22
• Notification configurations 28 22
• Rmon configurations 38 22
• Rmon overview 37 22
• Snmp configurations 14 22
• Snmp overview 13 22
• Appendix default parameters 61 23
• Configuration example 49 23
• About this guide 24
• Conventions 24
• Intended readers 24
• More information 25
• Accessing the switch 26
• Chapters 26
• Part 1 26
• Overview 27
• Web interface access 28
• Save config function 29
• Disable the web server 30
• Http config disable the http server and click apply 30
• You can shut down the http server or https server to block any access to the web interface 30
• Configure the switch s ip address and default gateway 31
• Check the routing table to verify the default gateway you configured the entry marked in red box displays the valid default gateway 33
• Click save config to save the settings 33
• Command line interface access 34
• Console login only for switch with console port 34
• Enter enable to enter the user exec mode to further configure the switch 35
• Telnet login 36
• Password authentication mode 37
• Ssh login 37
• Key authentication mode 38
• After the keys are successfully generated click save public key to save the public key to a tftp server click save private key to save the private key to the host pc 39
• After negotiation is completed enter the username to log in if you can log in without entering the password the key authentication completed successfully 41
• Disable telnet login 41
• Telnet config disable the telnet function and click apply 41
• Using the gui 41
• You can shut down the telnet function to block any telnet access to the cli interface 41
• Copy running config startup config 42
• Disable ssh login 42
• Change the switch s ip address and default gateway 43
• Chapters 44
• Managing system 44
• Part 2 44
• Access security 45
• Overview 45
• Supported features 45
• System 45
• System info 45
• System tools 45
• User management 45
• Sdm template 46
• System info configurations 47
• Using the gui 47
• Viewing the system summary 47
• Click a port to view the bandwidth utilization on this port 48
• Move the cursor to the port to view the detailed information of the port 48
• Setting the system time 49
• Specifying the device description 49
• Choose one method to set the system time and specify the information 50
• Click apply 50
• In the time config section follow these steps to configure the system time 50
• Choose one method to set the daylight saving time of the switch and specify the information 51
• Daylight saving time to load the following page 51
• Follow these steps to configure daylight saving time 51
• In the dst config section select enable to enable the daylight saving time function 51
• Setting the daylight saving time 51
• Click apply 52
• Gi1 0 1 linkdown n a n a n a disable copper 52
• Gi1 0 2 linkdown n a n a n a disable copper 52
• On privileged exec mode or any other configuration mode you can use the following command to view the system information of the switch 52
• Port status speed duplex flowctrl jumbo active medium 52
• Switch show interface status 52
• The following example shows how to view the interface status and the system information of the switch 52
• Using the cli 52
• Viewing the system summary 52
• Contact information www tp link com 53
• Follow these steps to specify the device description 53
• Gi1 0 3 linkup 1000m full disable disable copper 53
• Gi1 0 50 linkdown n a n a n a disable fiber 53
• Gi1 0 51 linkdown n a n a n a disable fiber 53
• Gi1 0 52 linkdown n a n a n a disable fiber 53
• Hardware version t1600g 52ts 2 53
• Running time 2 day 4 hour 55 min 36 sec 53
• Serial number 53
• Software version 2 build 20160923 rel 9814 s 53
• Specifying the device description 53
• Switch show system info 53
• System description jetstream 48 port gigabit l2 managed switch with 4 sfp slots 53
• System location shenzhen 53
• System name t1600g 52ts 53
• System time 2006 01 03 12 54 41 53
• Setting the system time 54
• Backup ntp server 139 8 00 63 57
• Follow these steps and choose one method to set the daylight saving time 57
• Last successful ntp server 133 00 57
• Prefered ntp server 133 00 57
• Setting the daylight saving time 57
• Switch config end 57
• Switch config show system time ntp 57
• Switch config system time ntp utc 08 00 133 00 139 8 00 63 11 57
• Switch configure 57
• Switch copy running config startup config 57
• The following example shows how to set the system time by get time from ntp server and set the time zone as utc 08 00 set the ntp server as 133 00 set the backup ntp server as 139 8 00 63 and set the update rate as 11 57
• Time zone utc 08 00 57
• Update rate 11 hour s 57
• Dst configuration is one off 59
• Dst ends at 01 00 00 on sep 1 2016 59
• Dst offset is 50 minutes 59
• Dst starts at 01 00 00 on aug 1 2016 59
• Switch config end 59
• Switch config show system time dst 59
• Switch config system time dst date aug 1 01 00 2016 sep 1 01 00 2016 50 59
• Switch configure 59
• Switch copy running config startup config 59
• The following example shows how to set the daylight saving time by date mode set the start time as 01 00 august 1st 2016 set the end time as 01 00 september 1st 2016 and set the offset as 50 59
• Creating admin accounts 60
• User management configurations 60
• Using the gui 60
• Click create 61
• Creating accounts of other types 61
• Creating an account 61
• Follow these steps to create an account of other types 61
• In the user info section select the access level from the drop down list and specify the user name and password 61
• User config to load the following page 61
• You can create accounts with the access level of operator power user and user here you also need to go to the aaa section to create an enable password for these accounts the enable password is used to change the users access level to admin 61
• Creating admin accounts 63
• Follow these steps to create an admin account 63
• Using the cli 63
• Creating accounts of other types 64
• Follow these steps to create an account of other type 64
• You can create accounts with the access level of operator power user and user here you also need to go to the aaa section to create an enable password for these accounts the enable password is used to change the users access level to admin 64
• The aaa function applies another method to manage the access users name and password for details refer to aaa configuration in configuring network security 66
• The logged in users can enter the enable password on this page to get the administrative privileges 66
• Configuring the boot file 68
• System tools configurations 68
• Using the gui 68
• Click apply 69
• Click import to import the configuration file 69
• Config restore to load the following page 69
• Follow these steps to restore the configuration of the switch 69
• In the config restore section select one unit and one configuration file 69
• Restoring the configuration of the switch 69
• Backing up the configuration file 70
• Upgrading the firmware 70
• Configuring the reboot schedule 71
• Rebooting the switch 71
• Configuring the boot file 72
• Follow these steps to configure the boot file 72
• In the system reset section select the desired unit and click reset 72
• Reseting the switch 72
• System reset to load the following page 72
• Using the cli 72
• Backup image image2 bin 73
• Boot config 73
• Current startup image image1 bin 73
• Follow these steps to restore the configuration of the switch 73
• Next startup image image1 bin 73
• Restoring the configuration of the switch 73
• Switch config boot application filename image1 startup 73
• Switch config boot application filename image2 backup 73
• Switch config end 73
• Switch config show boot 73
• Switch configure 73
• Switch copy running config startup config 73
• The following example shows how to set the next startup image as image 1 and set the backup image as image 2 73
• Backing up the configuration file 74
• Backup user config file ok 74
• Enable 74
• Follow these steps to back up the current configuration of the switch in a file 74
• Follow these steps to upgrade the firmware 74
• Operation ok now rebooting system 74
• Start to backup user config file 74
• Start to load user config file 74
• Switch copy startup config tftp ip address 192 68 00 filename file2 74
• Switch copy tftp startup config ip address 192 68 00 filename file1 74
• The following example shows how to backup the configuration file named file2 from tftp server with ip address 192 68 00 74
• The following example shows how to restore the configuration file named file1 from the tftp server with ip address 192 68 00 74
• Upgrading the firmware 74
• Configuring the reboot schedule 75
• Enable 75
• Follow these steps and choose one type to configure the reboot schedule 75
• Follow these steps to reboot the switch 75
• It will only upgrade the backup image continue y n y 75
• Operation ok 75
• Reboot with the backup image y n y 75
• Rebooting the switch 75
• Switch firmware upgrade ip address 192 68 00 filename file3 bin 75
• The following example shows how to upgrade the firmware using the configuration file named file3 bin the tftp server is 190 68 00 75
• Reboot schedule at 2016 01 15 12 00 in 17007 minutes 76
• Reboot schedule settings 76
• Reboot system at 15 01 2016 12 00 continue y n y 76
• Save before reboot yes 76
• Switch config end 76
• Switch config reboot schedule at 12 00 15 01 2016 save_before_reboot 76
• Switch configure 76
• Switch copy running config startup config 76
• The following example shows how to set the switch to reboot at 12 00 on 15 01 2016 76
• Follow these steps to reset the switch 77
• Reseting the switch 77
• Access security configurations 78
• Configuring the access control feature 78
• Using the gui 78
• Click apply 79
• When the ip based mode is selected the following section will display 79
• When the port based mode is selected the following section will display 79
• Configuring the http function 80
• Configuring the https function 81
• In the access user number section select enable and specify the parameters click apply 82
• In the certificate download and key download section download the certificate and key 82
• In the ciphersuite config section select the algorithm to be enabled and click apply 82
• In the session config section specify the session timeout and click apply 82
• Configuring the ssh feature 83
• In the global config section select enable to enable ssh function and specify other parameters 83
• Ssh config to load the following page 83
• Configuring the access control 84
• Enabling the telnet function 84
• Using the cli 84
• Switch config show user configuration 85
• Switch config user access control ip based 192 68 00 255 55 55 snmp telnet http https 85
• Switch configure 85
• The following example shows how to set the type of access control as ip based set the ip address as 192 68 00 set the subnet mask as 255 55 55 and make the switch support snmp telnet http and https 85
• 68 24 snmp telnet http https 86
• Configuring the http function 86
• Follow these steps to configure the http function 86
• Index ip address access interface 86
• Switch config end 86
• Switch configure 86
• Switch copy running config startup config 86
• The following example shows how to set the session timeout as 9 set the maximum admin number as 6 and set the maximum guest number as 5 86
• User authentication mode ip based 86
• Configuring the https function 87
• Follow these steps to configure the https function 87
• Http max admin users 6 87
• Http max guest users 5 87
• Http session timeout 9 87
• Http status enabled 87
• Http user limitation enabled 87
• Switch config end 87
• Switch config ip http max user 6 5 87
• Switch config ip http server 87
• Switch config ip http session timeout 9 87
• Switch config show ip http configuration 87
• Switch copy running config startup config 87
• Switch config ip http secure protocol ssl3 tls1 88
• Switch config ip http secure server 88
• Switch configure 88
• The following example shows how to configure the https function enable ssl3 and tls1 protocol enable the ciphersuite of 3des ede cbc sha set the session timeout time as 15 the admin number as 1 and the guest number as 2 download the certificate named ca crt and the key named ca key from the tftp server with the ip address 192 68 00 88
• Configuring the ssh feature 89
• Switch config ip ssh server 90
• Switch config ip ssh version v1 90
• The following example shows how to configure the ssh function set the version as ssh v1 and ssh v2 enable the aes128 cbc and cast128 cbc encryption algorithm enable the hmac md5 data integrity algorithm choose the key type as ssh 2 rsa dsa 90
• Enabling the telnet function 92
• Follow these steps enable the telnet function 92
• Switch config end 92
• Switch copy running config startup config 92
• In select options section select one template and click apply the setting will be effective after the reboot 93
• Sdm template configuration 93
• Sdm template function is used to configure system resources in the switch to optimize support for specific features the switch provides three templates and the hardware resources allocation is different users can choose one according to how the switch is used in the network 93
• Sdm template to load the following page 93
• Using the gui 93
• Follow these steps to configure the sdm template function 94
• The template table displays the resources allocation of each template 94
• Using the cli 94
• Appendix default parameters 96
• Default settings of system info are listed in the following tables 96
• Default settings of system tools are listed in the following table 96
• Default settings of user management are listed in the following table 96
• Default settings of access security are listed in the following tables 97
• Default settings of sdm template are listed in the following table 98
• Chapters 99
• Managing physical interfaces 99
• Part 3 99
• Basic parameters 100
• Loopback detection 100
• Overview 100
• Physical interface 100
• Port isolation 100
• Port mirror 100
• Port security 100
• Supported features 100
• Basic parameters configurations 101
• Follow these steps to set basic parameters for ports 101
• Port config to load the following page 101
• Select and configure your desired ports or lags then click apply 101
• Using the gui 101
• Follow these steps to set basic parameters for the ports 102
• Using the cli 102
• The following example shows how to implement the basic configurations of port1 0 1 including setting a description for the port making the port autonegotiate speed and duplex with the neighboring port and enabling the flow control and jumbo feature on t1600g 52ts 103
• Port mirror configuration 105
• Using the gui 105
• Follow these steps to configure port mirror 106
• In the destination port section specify a monitoring port for the mirror session and click apply 106
• In the source port section select one or multiple monitored ports for configuration then set the parameters and click apply 106
• Follow these steps to configure port mirror 107
• Monitor session 1 107
• Switch config monitor session 1 destination interface gigabitethernet 1 0 10 107
• Switch config monitor session 1 source interface gigabitethernet 1 0 1 3 both 107
• Switch config show monitor session 107
• Switch configure 107
• The following example shows how to copy the received and transmitted packets on port 1 0 1 2 3 to port 1 0 10 107
• Using the cli 107
• Follow these steps to configure port security 109
• Port security configuration 109
• Port security to load the following page 109
• Select one or multiple ports for security configuration 109
• Specify the maximum number of the mac addresses that can be learned on the port and then select the learn mode of the mac addresses 109
• Using the gui 109
• Click apply 110
• Follow these steps to configure port security 110
• Select the status of the port security feature 110
• Using the cli 110
• Gi1 0 1 30 0 permanent drop 111
• Port max learn current learn mode status 111
• Switch config if mac address table max mac count max number 30 mode permanent status drop 111
• Switch config if show mac address table max mac count interface gigabitethernet 1 0 1 111
• Switch config interface gigabitethernet 1 0 1 111
• Switch configure 111
• The following example shows how to set the maximum number of mac addresses that can be learned on port 1 0 1 as 30 and configure the mode as permanent and the status as drop 111
• Switch config if end 112
• Switch copy running config startup config 112
• Port isolation configurations 113
• Using the gui 113
• Click apply 114
• Follow these steps to configure port isolation 114
• In the forward portlist section select the forward ports or lags which the isolated ports can only communicate with it is multi optional 114
• In the port section select one or multiple ports to be isolated 114
• Using the cli 114
• Loopback detection configuration 116
• Using the gui 116
• Follow these steps to configure loopback detection 117
• In the port config section select one or multiple ports for configuration then set the parameters and click apply 117
• Using the cli 117
• View the loopback detection information on this page 117
• Switch configure 118
• The following example shows how to enable loopback detection globally keeping the default parameters 118
• Configuration examples 120
• Configuration scheme 120
• Example for port mirror 120
• Network requirements 120
• Using the gui 120
• As shown below three hosts and a server are connected to the switch and all belong to vlan 10 with the vlan configuration unchanged host a is not allowed to communicate with the other hosts except the server even if the mac address or ip address of host a is changed 122
• Destination port gi1 0 1 122
• Example for port isolation 122
• Monitor session 1 122
• Network requirements 122
• Source ports egress gi1 0 2 5 122
• Source ports ingress gi1 0 2 5 122
• Switch config end 122
• Switch config monitor session 1 destination interface gigabitethernet 1 0 1 122
• Switch config monitor session 1 source interface gigabitethernet 1 0 2 5 both 122
• Switch configure 122
• Switch copy running config startup config 122
• Switch show monitor session 1 122
• Using the cli 122
• Verify the configuration 122
• Configuration scheme 123
• Using the gui 123
• Using the cli 124
• Verify the configuration 124
• Configuration scheme 125
• Example for loopback detection 125
• Network requirements 125
• Using the gui 125
• Using the cli 126
• Verify the configuration 127
• Appendix default parameters 128
• Default settings of switching are listed in th following tables 128
• Chapters 130
• Configuring lag 130
• Part 4 130
• Overview 131
• Static lag 131
• Supported features 131
• Configuration guidelines 132
• Lag configuration 132
• Configuring load balancing algorithm 133
• In the global config section select the load balancing algorithm click apply 133
• Lag table to load the following page 133
• Load balancing algorithm is effective only for outgoing traffic if the data stream is not well shared by each link you can change the algorithm of the outgoing interface 133
• Please properly choose the load balancing algorithm to avoid data stream transferring only on one physical link for example switch a receives packets from several hosts and forwards them to the server with the fixed mac address and ip address then both dstmac and dst ip options are not recommended because all the received packets have the same destination mac addresses and ip addresses and will be transferred on the same physical link you can choose the other options as the load balancing algorithm 133
• Using the gui 133
• Configuring static lag or lacp 134
• Configuring lacp 135
• Follow these steps to configure lacp 135
• Lacp to load the following page 135
• Select member ports for the lag and configure the related parameters click apply 135
• Specify the system priority for the switch and click apply 135
• Configuring load balancing algorithm 136
• Follow these steps to configure the load balancing algorithm 136
• Using the cli 136
• Configuring static lag 137
• Configuring static lag or lacp 137
• Etherchannel load balancing addresses used per protocol 137
• Etherchannel load balancing configuration src dst mac 137
• Follow these steps to configure static lag 137
• Ipv4 source xor destination mac address 137
• Ipv6 source xor destination mac address 137
• Non ip source xor destination mac address 137
• Switch config end 137
• Switch config port channel load balance src dst mac 137
• Switch config show etherchannel load balance 137
• Switch configure 137
• Switch copy running config startup config 137
• The following example shows how to set the global load balancing mode as src dst mac 137
• You can choose only one lag mode for a port static lag or lacp and make sure both ends of a link use the same lag mode 137
• Configuration example 141
• Configuration scheme 141
• Network requirements 141
• Using the gui 142
• Using the cli 143
• Verify the configuration 144
• Appendix default parameters 146
• Default settings of switching are listed in the following tables 146
• Monitoring traffic 147
• Traffic monitor 148
• Using the gui 148
• Viewing the traffic summary 148
• Follow these steps to view the traffic statistics in detail 149
• To get the real time traffic statistics enable auto refresh in the auto refresh section or click refresh at the bottom of the page 149
• Traffic statistics to load the following page 149
• Viewing the traffic statistics in detail 149
• In port select select a port or lag and click select 150
• In the statistics section view the detailed information of the selected port or lag 150
• On privileged exec mode or any other configuration mode you can use the following command to view the traffic information of each port or lag 151
• Using the cli 151
• Appendix default parameters 152
• Chapters 153
• Managing mac address table 153
• Part 6 153
• Address configurations 154
• Mac address table 154
• Overview 154
• Supported features 154
• Security configurations 155
• Adding static mac address entries 156
• Address configurations 156
• Using the gui 156
• Click apply 158
• Dynamic address to load the following page 158
• Follow these steps to modify the aging time of dynamic address entries 158
• In the aging config section enable auto aging and enter your desired length of time 158
• Modifying the aging time of dynamic address entries 158
• Adding mac filtering address entries 159
• Viewing address table entries 159
• Adding static mac address entries 160
• Address table to load the following page 160
• Follow these steps to add static mac address entries 160
• Using the cli 160
• Modifying the aging time of dynamic address entries 161
• Adding mac filtering address entries 162
• Aging time is 500 sec 162
• Follow these steps to add mac filtering address entries 162
• Switch config end 162
• Switch config mac address table aging time 500 162
• Switch config show mac address table aging time 162
• Switch configure 162
• Switch copy running config startup config 162
• The following example shows how to modify the aging time to 500 seconds a dynamic entry remains in the mac address table for 500 seconds after the entry is used or updated 162
• Configuring mac notification traps 164
• Security configurations 164
• Using the gui 164
• Configure snmp and set a management host for detailed snmp configurations please refer to configuring snmp rmon 165
• Follow these steps to configure mac notification traps 165
• In the mac notification global config section enable this feature configure the relevant options and click apply 165
• In the mac notification port config section select your desired port and enable its notification traps you can enable these three types learned mode change exceed max learned and new mac learned click apply 165
• Choose the mode that the switch adopts when the maximum number of mac addresses in the specified vlan is exceeded 166
• Click create 166
• Enter the vlan id to limit the number of mac addresses that can be learned in the specified vlan 166
• Enter your desired value in max learned mac to set a threshold 166
• Follow these steps to limit the number of mac addresses in vlans 166
• Limiting the number of mac addresses in vlans 166
• Mac vlan security to load the following page 166
• Configuring mac notification traps 167
• Follow these steps to configure mac notification traps 167
• Using the cli 167
• Limiting the number of mac addresses in vlans 168
• 100 0 drop 169
• Switch config end 169
• Switch config mac address table security vid 10 max learn 100 drop 169
• Switch config show mac address table security vid 10 169
• Switch configure 169
• Switch copy running config startup config 169
• The following example shows how to limit the number of mac addresses to 100 in vlan 10 and configure the switch to drop packets of new source mac addresses when the limit is exceeded 169
• Vlanid max learn current learn status 169
• Configuration scheme 170
• Example for security configurations 170
• Network requirements 170
• Using the gui 171
• Using the cli 172
• Verify the configurations 172
• Appendix default parameters 173
• Default settings of the mac address table are listed in the following tables 173
• Chapters 174
• Configuring 802 q vlan 174
• Part 7 174
• Overview 175
• Configuring the pvid of the port 176
• Q vlan configuration 176
• Using the gui 176
• Click apply 178
• Configuring the vlan 178
• Enter a vlan id and a description for identification to create a vlan 178
• Follow these steps to configure vlan 178
• Select the untagged port s and the tagged port s respectively to add to the created vlan based on the network topology 178
• Vlan config and click create to load the following page 178
• Creating a vlan 179
• Follow these steps to create a vlan 179
• Rd active 179
• Switch config vlan 2 179
• Switch config vlan end 179
• Switch config vlan name rd 179
• Switch config vlan show vlan id 2 179
• Switch configure 179
• The following example shows how to create vlan 2 and name it as rd 179
• Using the cli 179
• Vlan name status ports 179
• Configuring the port 180
• Follow these steps to configure the port 180
• Link type trunk 180
• Member in lag n a 180
• Member in vlan 180
• Port gi1 0 5 180
• Pvid 2 180
• Switch config if show interface switchport gigabitethernet 1 0 5 180
• Switch config if switchport mode trunk 180
• Switch config if switchport pvid 2 180
• Switch config interface gigabitethernet 1 0 5 180
• Switch configure 180
• Switch copy running config startup config 180
• The following example shows how to configure the link type of port 1 0 5 as trunk the pvid of port 1 0 5 as vlan 2 180
• Adding the port to the specified vlan 181
• Follow these steps to add the port to the specified vlan 181
• Switch config if end 181
• Switch config interface gigabitethernet 1 0 5 181
• Switch configure 181
• Switch copy running config startup config 181
• System vlan tagged 181
• The following example shows how to add the general port 1 0 5 to vlan 2 and specify its egress rule as tagged 181
• Vlan name egress rule 181
• Configuration example 183
• Configuration scheme 183
• Network requirements 183
• Network topology 184
• Using the gui 184
• Using the cli 187
• Verify the configurations 187
• Appendix default parameters 189
• Default settings of 802 q vlan are listed in the following table 189
• Chapters 190
• Configuring mac vlan 190
• Part 8 190
• Overview 191
• Ptops department a uses server a and laptop a while department b uses server b and laptop b server a is in vlan 10 while server b is in vlan 20 it is required that laptop a can only access server a and laptop b can only access server b no matter which meeting room the laptops are being used in to meet this requirement simply bind the mac addresses of the laptops to the corresponding vlans respectively in this way the mac address rather than the access port determines the vlan each laptop joins each laptop can access only the server in the vlan it joins 191
• The figure below shows a common application scenario of mac vlan 191
• Two departments share all the meeting rooms in the company but use different servers and l 191
• Vlan is generally divided by ports this way of division is simple but isn t suitable for those networks that require frequent topology changes with the popularity of mobile office a terminal device may access the switch via different ports for example a terminal device that accessed the switch via port 1 last time may change to port 2 this time if port 1 and port 2 belong to different vlans the user has to re configure the switch to access the original vlan using mac vlan can free the user from such a problem it divides vlans based on the mac addresses of terminal devices in this way terminal devices always belong to their original vlans even when their access ports change 191
• Configuring 802 q vlan 192
• Mac vlan configuration 192
• Using the gui 192
• Binding the mac address to the vlan 193
• By default mac vlan is disabled on all ports you need to enable mac vlan for your desired ports manually 193
• Click create to create the mac vlan 193
• Enabling mac vlan for the port 193
• Enter the mac address of the device give it a description and enter the vlan id to bind it to the vlan 193
• Follow these steps to bind the mac address to the vlan 193
• Mac vlan to load the following page 193
• Before configuring mac vlan create an 802 q vlan and set the port type according to network requirements for details refer to configuring 802 q vlan 194
• Binding the mac address to the vlan 194
• Configuring 802 q vlan 194
• Follow these steps to bind the mac address to the vlan 194
• Follow these steps to enable mac vlan for the port 194
• Port enable to load the following page 194
• Select your desired ports to enable mac vlan and click apply 194
• Using the cli 194
• 19 56 8a 4c 71 dept a 10 195
• Enabling mac vlan for the port 195
• Follow these steps to enable mac vlan for the port 195
• Mac addr name vlan id 195
• Switch config end 195
• Switch config mac vlan mac address 00 19 56 8a 4c 71 vlan 10 description dept a 195
• Switch config show mac vlan vlan 10 195
• Switch configure 195
• Switch copy running config startup config 195
• The following example shows how to bind the mac address 00 19 56 8a 4c 71 to vlan 10 with the address description as dept a 195
• Configuration example 197
• Configuration scheme 197
• Create vlan 10 and vlan 20 on each of the three switches set different port types and add the ports to the vlans based on the network topology note for the ports connecting the laptops set the link type as general and set the egress rule as 197
• Network requirements 197
• Two departments share all the meeting rooms in the company but use different servers and laptops department a uses server a and laptop a while department b uses server b and laptop b server a is in vlan 10 while server b is in vlan 20 it is required that laptop a can only access server a and laptop b can only access server b no matter which meeting room the laptops are being used in the figure below shows the network topology 197
• You can configure mac vlan to meet this requirement on switch 1 and switch 2 bind the mac addresses of the laptops to the corresponding vlans respectively in this way each laptop can access only the server in the vlan it joins no matter which meeting room the laptops are being used in the overview of the configuration is as follows 197
• Using the gui 198
• Using the cli 202
• Verify the configurations 204
• Appendix default parameters 205
• Default settings of mac vlan are listed in the following table 205
• Chapters 206
• Configuring protocol vlan 206
• Part 9 206
• Overview 207
• Protocol vlan is a technology that divides vlans based on the network layer protocol with the protocol vlan rule configured on the basis of the existing 802 q vlan the switch can analyze special fields of received packets encapsulate the packets in specific formats and forward the packets of different protocols to the corresponding vlans since different applications and services use different protocols network administrators can use protocol vlan to manage the network based on specific applications and services of network users 207
• The figure below shows a common application scenario of protocol vlan with protocol vlan configured switch 2 can forward ipv4 and ipv6 packets from different vlans to the ipv4 and ipv6 networks respectively 207
• Configuring 802 q vlan 208
• Protocol vlan configuration 208
• Using the gui 208
• Check whether your desired template already exists in the protocol template table section if not create it in the create protocol template section 209
• Click create to create the protocol template 209
• Creating protocol template 209
• Follow these steps to create a protocol template 209
• Protocol template to load the following page 209
• Configuring 802 q vlan 210
• Configuring protocol vlan 210
• Using the cli 210
• Creating a protocol template 211
• Follow these steps to create a protocol template 211
• Index protocol name protocol type 211
• Ip ethernetii ether type 0800 211
• Switch config protocol vlan template name ipv6 frame ether_2 ether type 86dd 211
• Switch config show protocol vlan template 211
• Switch configure 211
• The following example shows how to create an ipv6 protocol template on t1600g 52ts 211
• Arp ethernetii ether type 0806 212
• At snap ether type 809b 212
• Configuring protocol vlan 212
• Follow these steps to configure protocol vlan 212
• Ipv6 ethernetii ether type 86dd 212
• Ipx snap ether type 8137 212
• Rarp ethernetii ether type 8035 212
• Switch config end 212
• Switch copy running config startup config 212
• A company uses both ipv4 and ipv6 hosts and these hosts access the ipv4 network and ipv6 network respectively via different routers it is required that ipv4 packets are forwarded to the ipv4 network ipv6 packets are forwarded to the ipv6 network and other packets are dropped 214
• Configuration example 214
• Configuration scheme 214
• Network requirements 214
• The figure below shows the network topology the ipv4 host belongs to vlan 10 the ipv6 host belongs to vlan 20 and these hosts access the network via switch 1 switch 2 is connected to two routers to access the ipv4 network and ipv6 network respectively the routers belong to vlan 10 and vlan 20 respectively 214
• You can configure protocol vlan on port 1 0 1 of switch 2 to meet this requirement when this port receives packets switch 2 will forward them to the corresponding vlans according to their protocol types the overview of the configuration on switch 2 is as follows 214
• Using the gui 215
• Using the cli 221
• Verify the configurations 224
• Appendix default parameters 226
• Default settings of protocol vlan are listed in the following table 226
• Chapters 227
• Configuring spanning tree 227
• Part 10 227
• Basic concepts 228
• Overview 228
• Spanning tree 228
• Stp rstp concepts 228
• Bridge id 229
• Port role 229
• Root bridge 229
• Port status 230
• Path cost 231
• Root path cost 231
• Mst instance 232
• Mst region 232
• Mstp concepts 232
• Stp security 233
• Vlan instance mapping 233
• Configuring stp rstp parameters on ports 236
• Stp rstp configurations 236
• Using the gui 236
• Click apply 238
• Configuring stp rstp globally 238
• Stp config to load the following page 238
• Follow these steps to configure stp rstp globally 239
• In the global config section enable spanning tree function choose the stp mode as stp rstp and click apply 239
• In the parameters config section configure the global parameters of stp rstp and click apply 239
• Stp summary to load the following page 240
• The stp summary section shows the summary information of spanning tree 240
• Verify the stp rstp information of your switch after all the configurations are finished 240
• Verifying the stp rstp configurations 240
• Configuring stp rstp parameters on ports 241
• Follow these steps to configure stp rstp parameters on ports 241
• Using the cli 241
• Switch config if show spanning tree interface gigabitethernet 1 0 3 242
• Switch config if spanning tree 242
• Switch config if spanning tree common config port priority 32 242
• Switch config interface gigabitethernet 1 0 3 242
• Switch configure 242
• The following example shows how to enable spanning tree function on port 1 0 3 and configure the port priority as 32 242
• Configuring global stp rstp parameters 243
• Follow these steps to configure global stp rstp parameters of the switch 243
• Gi1 0 3 enable 32 auto auto no no auto n a n a lnkdwn 243
• Interface state prio ext cost int cost edge p2p mode role status 243
• Switch config if end 243
• Switch copy running config startup config 243
• Enable rstp 36864 2 12 20 5 20 244
• Enabling stp rstp globally 244
• Follow these steps to configure the spanning tree mode as stp rstp and enable spanning tree function globally 244
• State mode priority hello time fwd time max age hold count max hops 244
• Switch config end 244
• Switch config show spanning tree bridge 244
• Switch config spanning tree priority 36864 244
• Switch config spanning tree timer forward time 12 244
• Switch configure 244
• Switch copy running config startup config 244
• This example shows how to configure the priority of the switch as 36864 the forward delay as 12 seconds 244
• Configuring parameters on ports in cist 246
• Mstp configurations 246
• Using the gui 246
• Besides configure the priority of the switch the priority and path cost of ports in the desired instance 248
• Click apply 248
• Configure the region name revision level vlan instance mapping of the switch the switches with the same region name the same revision level and the same vlan instance mapping are considered as in the same region 248
• Configuring the mstp region 248
• Configuring the region name and revision level 248
• Region config to load the following page 248
• Configuring mstp globally 253
• Follow these steps to configure mstp globally 253
• In the parameters config section configure the global parameters of mstp and click apply 253
• Stp config to load the following page 253
• In the global config section enable spanning tree function and choose the stp mode as mstp and click apply 254
• Stp summary to load the following page 255
• The stp summary section shows the summary information of cist 255
• Verifying the mstp configurations 255
• Configuring parameters on ports in cist 256
• Follow these steps to configure the parameters of the port in cist 256
• The mstp summary section shows the information in mst instances 256
• Using the cli 256
• Switch configure 257
• This example shows how to enable spanning tree function for port 1 0 3 and configure the port priority as 32 257
• Configuring the mst region 258
• Configuring the mstp region 258
• Follow these steps to configure the mst region and the priority of the switch in the instance 258
• Gi1 0 3 144 200 n a lnkdwn 258
• Gi1 0 3 enable 32 auto auto no no auto n a n a lnkdwn 258
• Interface prio cost role status 258
• Interface state prio ext cost int cost edge p2p mode role status 258
• Mst instance 0 cist 258
• Mst instance 5 258
• Switch config if end 258
• Switch config if show spanning tree interface gigabitethernet 1 0 3 258
• Switch config if spanning tree 258
• Switch config if spanning tree common config port priority 32 258
• Switch config interface gigabitethernet 1 0 3 258
• Switch copy running config startup config 258
• Region name r1 259
• Revision 100 259
• Switch config mst instance 5 vlan 2 6 259
• Switch config mst name r1 259
• Switch config mst revision 100 259
• Switch config mst show spanning tree mst configuration 259
• Switch config spanning tree mst configuration 259
• Switch configure 259
• This example shows how to create an mst region of which the region name is r1 the revision level is 100 and vlan 2 vlan 6 are mapped to instance 5 259
• 7 4094 260
• Configuring the parameters on ports in instance 260
• Follow these steps to configure the priority and path cost of ports in the specified instance 260
• Mst instance vlans mapped 260
• Switch config mst end 260
• Switch copy running config startup config 260
• Configuring global mstp parameters 261
• Switch config if spanning tree timer forward time 12 262
• Switch config spanning tree priority 36864 262
• Switch configure 262
• This example shows how to configure the cist priority as 36864 the forward delay as 12 seconds the hold count as 8 and the max hop as 25 262
• Enable mstp 36864 2 12 20 8 25 263
• Enabling spanning tree globally 263
• Follow these steps to configure the spanning tree mode as mstp and enable spanning tree function globally 263
• Spanning tree is enabled 263
• State mode priority hello time fwd time max age hold count max hops 263
• Switch config if end 263
• Switch config if show spanning tree bridge 263
• Switch config if spanning tree hold count 8 263
• Switch config if spanning tree max hops 25 263
• Switch config show spanning tree active 263
• Switch config spanning tree 263
• Switch config spanning tree mode mstp 263
• Switch configure 263
• Switch copy running config startup config 263
• This example shows how to configure the spanning tree mode as mstp and enable spanning tree function globally 263
• Configuring the stp security 266
• Stp security configurations 266
• Using the gui 266
• Configure the port protect features for the selected ports and click apply 267
• Configuring the threshold and cycle of tc protect 267
• T1600g 18ts does not support configuring the threshold and cycle of tc protect 267
• When you enable tc protect function on ports set the tc threshold and tc protect cycle here if the number of the received tc bpdus exceeds the maximum number you set in the tc threshold field the switch will not remove mac address entries in the tc protect cycle 267
• Configure the parameters of tc protect feature and click apply 268
• Configuring the stp security 268
• Featur 268
• Follow these steps to configure the root protect feature bpdu protect feature and bpdu filter feature for ports 268
• Tc protect to load the following page 268
• Using the cli 268
• Gi1 0 3 enable enable enable enable disable 269
• Interface bpdu filter bpdu guard loop protect root protect tc protect 269
• Switch config if end 269
• Switch config if show spanning tree interface security gigabitethernet 1 0 3 269
• Switch config if spanning tree bpdufilter 269
• Switch config if spanning tree bpduguard 269
• Switch config if spanning tree guard loop 269
• Switch config if spanning tree guard root 269
• Switch config interface gigabitethernet 1 0 3 269
• Switch configure 269
• Switch copy running config startup config 269
• This example shows how to enable loop protect root protect bpdu filter and bpdu protect functions on port 1 0 3 269
• Configuring the tc protect 270
• Follow these steps to configure tc protect feature for ports 270
• Switch config if show spanning tree interface security gigabitethernet 1 0 3 270
• Switch config if spanning tree guard tc 270
• Switch config interface gigabitethernet 1 0 3 270
• Switch config spanning tree tc defend threshold 25 period 8 270
• Switch configure 270
• This example shows how to enable the tc protect function on port 1 0 3 with the tc threshold is 25 and the tc protect cycle is 8 demonstrated with t1600g 52ts 270
• As shown in figure 5 1 the network consists of three switches traffic in vlan 101 vlan 106 is transmitted in this network the link speed between the switches is 100mb s the default path cost of the port is 200000 272
• Configuration example for mstp 272
• Configuration scheme 272
• Here we configure two instances to meet the requirement as is shown below 272
• It is required that traffic in vlan 101 vlan 103 and traffic in vlan 104 vlan 106 should be transmitted along different paths 272
• Mstp backwards compatible with stp and rstp can map vlans to instances to enable load balancing thus providing a more flexible method in network management here we take the mstp configuration as an example 272
• Network requirements 272
• To meet this requirement you are suggested to configure mstp function on the switches map the vlans to different instances to ensure traffic can be transmitted along the respective instance 272
• Using the gui 273
• Instance port config to load the following page set the path cost of port 1 0 1 in instance 1 as 400000 275
• Instance port config to load the following page set the path cost of port 1 0 2 in instance 2 as 400000 279
• Using the cli 284
• Verify the configurations 286
• Appendix default parameters 291
• Default settings of the spanning tree feature are listed in the following table 291
• Chapters 293
• Configuring layer 2 multicast 293
• Part 11 293
• Layer 2 multicast 294
• Overview 294
• Configuration guide 272 295
• Configuring layer 2 multicast layer 2 multicast 295
• Demonstrated as below 295
• Figure 1 1 igmp snooping 295
• Layer 2 multicast protocol for ipv4 igmp snooping 295
• Layer 2 multicast protocol for ipv6 mld snooping 295
• On the layer 2 device igmp snooping transmits data on demand on data link layer by analyzing igmp packets between layer 3 devices and users to build and maintain layer 2 multicast forwarding table 295
• On the layer 2 device mld snooping multicast listener discovery snooping transmits data on demand on data link layer by analyzing igmp packets between layer 3 devices and users to build and maintain layer 2 multicast forwarding table 295
• Supported layer 2 multicast protocols 295
• Configuring igmp snooping globally 296
• Igmp snooping configurations 296
• Using the gui 296
• Click apply 297
• Configure unknown multicast as forward or discard 297
• Configuring router port time and member port time 297
• Enable or disable report message suppression globally 297
• Enabling report message suppression can reduce the number of packets in the network 297
• Follow these steps to configure report message suppression 297
• Follow these steps to configure the aging time of the router ports and the member ports 297
• Follow these steps to configure unknown multicast 297
• Optional configuring report message suppression 297
• Snooping config page at the same time 297
• Specify the aging time of the member ports 297
• Specify the aging time of the router ports 297
• Click apply 298
• Configure the last listener query interval and last listener query count when the switch receives an igmp leave message if specified count of multicast address specific queries masqs are sent and no report message is received the switch will delete the multicast address from the multicast forwarding table 298
• Configuring igmp snooping last listener query 298
• Follow these steps to configure last listener query interval and last listener query count in the global config section 298
• Igmp snooping status table displays vlans and ports with igmp snooping enabled 298
• Specify the interval between masqs 298
• Specify the number of masqs to be sent 298
• Verifying igmp snooping status 298
• Configuring the port s basic igmp snooping features 299
• Enabling igmp snooping on the port 299
• Optional configuring fast leave 299
• Configuring igmp snooping globally in the vlan 300
• Configuring igmp snooping in the vlan 300
• Click create 301
• Configure the forbidden router ports in the designate vlan 301
• Configure the router ports in the designate vlan 301
• Configuring the multicast vlan 301
• Follow these steps to configure static router ports in the designate vlan 301
• Follow these steps to forbid the selected ports to be the router ports in the designate vlan 301
• In old multicast transmission mode when users in different vlans apply for data from the same multicast group the layer 3 device will duplicate this multicast data and deliver copies to the layer 2 devices 301
• Optional configuring the forbidden router ports in the vlan 301
• Optional configuring the static router ports in the vlan 301
• With multicast vlan configured all multicast group members will be added to a vlan layer 3 device only need to send one piece of multicast data to a layer 2 device and the layer 2 device will send the data to all member ports of the vlan in this way multicast vlan saves bandwidth and reduces network load of layer 3 devices 301
• Creating multicast vlan and configuring basic settings 302
• Enable multicast vlan configure the specific vlan to be the multicast vlan and configure the router port time and member port time 302
• In the multicast vlan section follow these steps to enable multicast vlan and to finish the basic settings 302
• Multicast vlan to load the following page 302
• Set up the vlan that the router ports and the member ports are in for details please refer to configuring 802 q vlan 302
• Click apply 303
• Configure the new multicast source ip 303
• Configure the router ports in the designate vlan 303
• Configure the router ports in the multicast vlan 303
• Follow these steps to configure static router ports in the multicast vlan 303
• Follow these steps to forbid the selected ports to be the router ports in the multicast vlan 303
• Optional configuring the forbidden router ports 303
• Optional configuring the static router ports 303
• Optional creating replace source ip 303
• This function allows you to use a new ip instead of the source ip to send data to multicast group members in the multicast vlan section follow these steps to configure replace source ip 303
• This table displays all the dynamic router ports in the multicast vlan 303
• Viewing dynamic router ports in the multicast vlan 303
• Click add 304
• Configuring the querier 304
• Follow these steps to configure the querier 304
• Optional configuring the querier 304
• Querier config to load the following page 304
• Specify a vlan and configure the querier on this vlan 304
• The igmp snooping querier table displays all the related settings of the igmp querier 304
• Viewing settings of igmp querier 304
• You can edit the settings in the igmp snooping querier table 304
• Click create 305
• Configuring igmp profile 305
• Create a profile and configure its filtering mode 305
• Creating profile 305
• Enter the search condition in the search option field to search the profile in the igmp profile info table 305
• Follow these steps to create a profile and configure its filtering mode 305
• Profile config to load the following page 305
• Searching profile 305
• Binding profile and member ports 306
• Click edit in the igmp profile info table edit its ip range and click add to save the settings 306
• Click submit to save the settings click back to go back to the previous page 306
• Editing ip range of the profile 306
• Follow these steps to edit profile mode and its ip range 306
• In the ip range table you can select an ip range and click delete to delete an ip range 306
• Profile binding to load the following page 306
• Binding profile and member ports 307
• Click apply 307
• Configuring max groups a port can join 307
• Follow these steps to bind the profile to the port 307
• Follow these steps to configure the maximum groups a port can join and overflow action 307
• Select a port to configure its max group and overflow action 307
• Select the port to be bound and enter the profile id in the profile id column 307
• Click apply 308
• Configuring auto refresh 308
• Enable or disable auto refresh 308
• Follow these steps to configure auto refresh 308
• Packet statistic to load the following page 308
• Viewing igmp statistics on each port 308
• Click apply 309
• Enabling igmp accounting and authentication 309
• Igmp authentication to load the following 309
• T1600g 18ts does not support this feature 309
• The igmp statistics table displays all kinds of igmp statistics of all the ports 309
• Viewing igmp statistics 309
• Configuring igmp accounting globally 310
• Configuring igmp authentication on the port 310
• Configuring static member port 310
• Click create 311
• Configuring static member port 311
• Enter the multicast ip and vlan id specify the static member port 311
• Follow these steps to configure static member port 311
• Static multicast ip table displays details of all igmp static multicast groups 311
• Viewing igmp static multicast groups 311
• You can search igmp static multicast entries by using multicast ip vlan id or forward port as the search option 311
• Enabling igmp snooping globally 312
• Enabling igmp snooping on the port 312
• Switch config ip igmp snooping 312
• Switch configure 312
• The following example shows how to enable igmp snooping globally and enable igmp snooping on port 1 0 3 312
• Using the cli 312
• Configuring igmp snooping parameters globally 313
• Configuring report message suppression 313
• Enable port gi1 0 3 313
• Enable vlan 313
• Global authentication accounting disable 313
• Global member age time 260 313
• Global report suppression disable 313
• Global router age time 300 313
• Igmp snooping enable 313
• Last query interval 1 313
• Last query times 2 313
• Switch config if end 313
• Switch config if ip igmp snooping 313
• Switch config if show ip igmp snooping 313
• Switch config interface gigabitethernet 1 0 3 313
• Switch copy running config startup config 313
• Unknown multicast pass 313
• Configuring unknown multicast 314
• Enable port 314
• Enable vlan 314
• Global authentication accounting disable 314
• Global member age time 260 314
• Global report suppression enable 314
• Global router age time 300 314
• Igmp snooping enable 314
• Last query interval 1 314
• Last query times 2 314
• Switch config if end 314
• Switch config ip igmp snooping 314
• Switch config ip igmp snooping report suppression 314
• Switch config show ip igmp snooping 314
• Switch configure 314
• Switch copy running config startup config 314
• The following example shows how to enable report message suppression 314
• Unknown multicast pass 314
• Configuring igmp snooping parameters on the port 315
• Configuring router port time and member port time 315
• Configuring fast leave 316
• Enable port 316
• Enable vlan 316
• Global authentication accounting disable 316
• Global member age time 200 316
• Global report suppression disable 316
• Global router age time 200 316
• Igmp snooping enable 316
• Last query interval 1 316
• Last query times 2 316
• Switch config if end 316
• Switch config ip igmp snooping 316
• Switch config ip igmp snooping mtime 200 316
• Switch config ip igmp snooping rtime 200 316
• Switch config show ip igmp snooping 316
• Switch configure 316
• Switch copy running config startup config 316
• The following example shows how to configure the global router port time and member port time as 200 seconds 316
• Unknown multicast pass 316
• Configuring max group and overflow action on the port 317
• Gi1 0 3 enable enable 317
• Port igmp snooping fast leave 317
• Switch config if end 317
• Switch config if ip igmp snooping 317
• Switch config if ip igmp snooping immediate leave 317
• Switch config if show ip igmp snooping interface gigabitethernet 1 0 3 basic config 317
• Switch config interface gigabiteternet 1 0 3 317
• Switch config ip igmp snooping 317
• Switch configure 317
• Switch copy running config startup config 317
• The following example shows how to enable fast leave on port 1 0 3 317
• Configuring igmp snooping last listener query 318
• Gi1 0 3 500 drop 318
• Port max groups overflow action 318
• Switch config if end 318
• Switch config if ip igmp snooping 318
• Switch config if ip igmp snooping max groups 500 318
• Switch config if ip igmp snooping max groups action drop 318
• Switch config if show ip igmp snooping interface gigabitethernet 1 0 3 max groups 318
• Switch config interface gigabiteternet 1 0 3 318
• Switch config ip igmp snooping 318
• Switch configure 318
• Switch copy running config startup config 318
• The following example shows how to configure the max group as 500 and the overflow action as drop on port 1 0 3 318
• Enable port 319
• Enable vlan 319
• Global authentication accounting disable 319
• Global member age time 260 319
• Global report suppression disable 319
• Global router age time 300 319
• Igmp snooping enable 319
• Last query interval 5 319
• Last query times 5 319
• Switch config end 319
• Switch config ip igmp snooping 319
• Switch config ip igmp snooping last listener query count 5 319
• Switch config ip igmp snooping last listener query interval 5 319
• Switch config show ip igmp snooping 319
• Switch configure 319
• Switch copy running config startup config 319
• The following example shows how to configure the last listener query count as 5 and the last listener query interval as 5 seconds 319
• Unknown multicast pass 319
• Configuring igmp snooping parameters in the vlan 320
• Configuring router port time and member port time 320
• Dynamic router port none 320
• Forbidden router port none 320
• Member time 400 320
• Router time 500 320
• Static router port none 320
• Switch config ip igmp snooping 320
• Switch config ip igmp snooping vlan config 2 3 mtime 400 320
• Switch config ip igmp snooping vlan config 2 3 rtime 500 320
• Switch config show ip igmp snooping vlan 2 320
• Switch config show ip igmp snooping vlan 3 320
• Switch configure 320
• The following example shows how to enable igmp snooping in vlan 2 and vlan 3 configure the router port time as 500 seconds and the member port time as 400 seconds 320
• Vlan id 2 320
• Vlan id 3 320
• Configuring static router port 321
• Dynamic router port none 321
• Forbidden router port none 321
• Member time 0 321
• Member time 400 321
• Router time 0 321
• Static router port gi1 0 2 321
• Static router port none 321
• Switch config end 321
• Switch config ip igmp snooping 321
• Switch config ip igmp snooping vlan config 2 rport interface gigabitethernet 1 0 2 321
• Switch config show ip igmp snooping vlan 2 321
• Switch configure 321
• Switch copy running config startup config 321
• The following example shows how to enable igmp snooping in vlan 2 and configure port 1 0 2 as the static router port 321
• Vlan id 2 321
• Configuring forbidden router port 322
• Dynamic router port none 322
• Forbidden router port gi1 0 4 6 322
• Member time 0 322
• Router time 0 322
• Static router port none 322
• Switch config end 322
• Switch config ip igmp snooping 322
• Switch config ip igmp snooping vlan config 2 router ports forbidden interface gigabitethernet 1 0 4 6 322
• Switch config show ip igmp snooping vlan 2 322
• Switch configure 322
• Switch copy running config startup config 322
• The following example shows how to enable igmp snooping in vlan 2 and forbid port 1 0 4 6 from becoming router ports port 1 0 4 6 will drop all multicast data from layer 3 devices 322
• Vlan id 2 322
• 2 static gi1 0 9 10 323
• Configuring igmp snooping parameters in the multicast vlan 323
• Configuring router port time and member port time 323
• Configuring static multicast multicast ip and forward port 323
• Multicast ip vlan id addr type switch port 323
• Switch config end 323
• Switch config ip igmp snooping 323
• Switch config ip igmp snooping vlan config 2 static 226 interface gigabitethernet 1 0 9 10 323
• Switch config show ip igmp snooping groups static 323
• Switch configure 323
• Switch copy running config startup config 323
• The following example shows how to configure 226 as the static multicast ip and specify port 1 0 9 10 as the forward ports 323
• Configuring static router port 324
• Dynamic router port none 324
• Forbidden router port none 324
• Member time 400 324
• Multicast vlan enable 324
• Replace source ip 0 324
• Router time 500 324
• Static router port none 324
• Switch config end 324
• Switch config ip igmp snooping 324
• Switch config ip igmp snooping multi vlan config 5 mtime 400 324
• Switch config ip igmp snooping multi vlan config 5 rtime 500 324
• Switch config show ip igmp snooping multi vlan 324
• Switch configure 324
• Switch copy running config startup config 324
• The following example shows how to configure vlan 5 as the multicast vlan set the router port time as 500 seconds and the member port time as 400 seconds 324
• Vlan id 5 324
• Configuring forbidden router port 325
• Dynamic router port none 325
• Forbidden router port none 325
• Member time 260 325
• Multicast vlan enable 325
• Replace source ip 0 325
• Router time 300 325
• Static router port gi1 0 5 325
• Switch config end 325
• Switch config ip igmp snooping 325
• Switch config ip igmp snooping multi vlan config 5 rport interface gigabitethernet 1 0 5 325
• Switch config show ip igmp snooping multi vlan 325
• Switch configure 325
• Switch copy running config startup config 325
• The following example shows how to configure vlan 5 as the multicast vlan and set port 1 0 5 as the static router port 325
• Vlan id 5 325
• Configuring replace source ip 326
• Dynamic router port none 326
• Forbidden router port gi1 0 6 326
• Member time 260 326
• Multicast vlan enable 326
• Replace source ip 0 326
• Router time 300 326
• Static router port none 326
• Switch config end 326
• Switch config ip igmp snooping 326
• Switch config ip igmp snooping multi vlan config 5 router ports forbidden interface gigabitethernet 1 0 6 326
• Switch config show ip igmp snooping multi vlan 326
• Switch configure 326
• Switch copy running config startup config 326
• The following example shows how to configure vlan 5 as the multicast vlan and set port 1 0 6 as the forbidden router port 326
• Vlan id 5 326
• Configuring the querier 327
• Dynamic router port none 327
• Enabling igmp querier 327
• Forbidden router port none 327
• Member time 260 327
• Multicast vlan enable 327
• Replace source ip 192 68 327
• Router time 300 327
• Static router port none 327
• Switch config end 327
• Switch config ip igmp snooping 327
• Switch config ip igmp snooping multi vlan config 5 replace sourceip 192 68 327
• Switch config show ip igmp snooping multi vlan 327
• Switch configure 327
• Switch copy running config startup config 327
• The following example shows how to configure vlan 5 as the multicast vlan and replace the source ip in the igmp packets sent by the switch with 192 68 327
• Vlan id 5 327
• Configuring query interval max response time and general query source ip 328
• General query source ip 192 68 328
• Maximum response time 10 328
• Query interval 60 328
• Switch config end 328
• Switch config ip igmp snooping 328
• Switch config ip igmp snooping querier vlan 4 328
• Switch config show ip igmp snooping querier 328
• Switch configure 328
• Switch copy running config startup config 328
• The following example shows how to enable igmp snooping and igmp querier in vlan 4 328
• Vlan 4 328
• Configuring multicast filtering 329
• Creating profile 329
• Binding profile to the port 330
• Igmp profile 1 330
• Range 226 226 0 330
• Switch config end 330
• Switch config igmp profile deny 330
• Switch config igmp profile range 226 226 0 330
• Switch config igmp profile show ip igmp profile 330
• Switch config ip igmp profile 1 330
• Switch config ip igmp snooping 330
• Switch configure 330
• Switch copy running config startup config 330
• The following example shows how to configure profile 1 so that the switch filters multicast data sent to 226 226 0 330
• Binding port s 331
• Gi1 0 2 331
• Igmp profile 1 331
• Range 226 226 0 331
• Switch config end 331
• Switch config if ip igmp filter 1 331
• Switch config if ip igmp snooping 331
• Switch config if show ip igmp profile 331
• Switch config igmp profile deny 331
• Switch config igmp profile exit 331
• Switch config igmp profile range 226 226 0 331
• Switch config interface gigabitethernet 1 0 2 331
• Switch config ip igmp profile 1 331
• Switch config ip igmp snooping 331
• Switch configure 331
• Switch copy running config startup config 331
• The following example shows how to bind profile 1 to port 1 0 2 so that port 1 0 2 filters multicast data sent to 226 226 0 331
• Enabling igmp accounting and authentication 332
• Enabling igmp authentication on the port 332
• Gi1 0 2 enable 332
• Port igmp authentication 332
• Switch config end 332
• Switch config if ip igmp snooping 332
• Switch config if ip igmp snooping authentication 332
• Switch config if show ip igmp snooping interface gigabitethernet 1 0 2 authentication 332
• Switch config interface gigabitethernet 1 0 2 332
• Switch config ip igmp snooping 332
• Switch configure 332
• Switch copy running config startup config 332
• T1600g 18ts does not support this feature 332
• The following example shows how to enable igmp authentication on port 1 0 2 332
• Enabling igmp accounting globally 333
• Configuring mld snooping 334
• Configuring mld snooping globally 334
• Using the gui 334
• Click apply 335
• Configure unknown multicast as forward or discard 335
• Configuring router port time and member port time 335
• Enable or disable report message suppression globally 335
• Enabling report message suppression can reduce the number of packets in the network 335
• Follow these steps to configure report message suppression 335
• Follow these steps to configure the aging time of the router ports and the member ports 335
• Follow these steps to configure unknown multicast 335
• Optional configuring report message suppression 335
• Snooping config page at the same time 335
• Specify the aging time of the member ports 335
• Specify the aging time of the router ports 335
• Click apply 336
• Configure the last listener query interval and last listener query count when the switch receives an mld leave message if specified count of multicast address specific queries masqs are sent and no report message is received the switch will delete the multicast address from the multicast forwarding table 336
• Configuring mld snooping last listener query 336
• Follow these steps to configure last listener query interval and last listener query count in the global config section 336
• Mld snooping status table displays vlans and ports with mld snooping enabled 336
• Specify the interval between masqs 336
• Specify the number of masqs to be sent 336
• Verifying mld snooping status 336
• Configuring the port s basic mld snooping features 337
• Enabling mld snooping on the port 337
• Optional configuring fast leave 337
• Configuring mld snooping globally in the vlan 338
• Configuring mld snooping in the vlan 338
• Click create 339
• Configure the forbidden router ports in the designate vlan 339
• Configure the router ports in the designate vlan 339
• Configuring the multicast vlan 339
• Follow these steps to configure static router ports in the designate vlan 339
• Follow these steps to forbid the selected ports to be the router ports in the designate vlan 339
• In old multicast transmission mode when users in different vlans apply for data from the same multicast group the layer 3 device will duplicate this multicast data and deliver copies to the layer 2 devices 339
• Optional configuring the forbidden router ports in the vlan 339
• Optional configuring the static router ports in the vlan 339
• With multicast vlan configured all multicast group members will be added to a vlan layer 3 device only need to send one piece of multicast data to a layer 2 device and the layer 2 device will send the data to all member ports of the vlan in this way multicast vlan saves bandwidth and reduces network load of layer 3 devices 339
• Creating multicast vlan and configuring basic settings 340
• Enable multicast vlan configure the specific vlan to be the multicast vlan and configure the router port time and member port time 340
• In the multicast vlan section follow these steps to enable multicast vlan and to finish the basic settings 340
• Multicast vlan to load the following page 340
• Set up the vlan that the router ports and the member ports are in for details please refer to configuring 802 q vlan 340
• Click apply 341
• Configure the new multicast source ip 341
• Configure the router ports in the designate vlan 341
• Configure the router ports in the multicast vlan 341
• Follow these steps to configure static router ports in the multicast vlan 341
• Follow these steps to forbid the selected ports to be the router ports in the multicast vlan 341
• Optional configuring the forbidden router ports 341
• Optional configuring the static router ports 341
• Optional creating replace source ip 341
• This function allows you to use a new ip instead of the source ip to send data to multicast group members in the multicast vlan section follow these steps to configure replace source ip 341
• This table displays all the dynamic router ports in the multicast vlan 341
• Viewing dynamic router ports in the multicast vlan 341
• Click add 342
• Configuring the querier 342
• Follow these steps to configure the querier 342
• Optional configuring the querier 342
• Querier config to load the following page 342
• Specify a vlan and configure the querier on this vlan 342
• The mld snooping querier table displays all the related settings of the mld querier 342
• Viewing settings of mld querier 342
• You can edit the settings in the mld snooping querier table 342
• Click create 343
• Configuring mld profile 343
• Create a profile and configure its filtering mode 343
• Creating profile 343
• Enter the search condition in the search option field to search the profile in the mld profile info table 343
• Follow these steps to create a profile and configure its filtering mode 343
• Profile config to load the following page 343
• Searching profile 343
• Editing ip range of the profile 344
• Binding profile and member ports 345
• Click apply 345
• Follow these steps to bind the profile to the port 345
• Profile binding to load the following page 345
• Select the port to be bound and enter the profile id in the profile id column 345
• Click apply 346
• Configuring max groups a port can join 346
• Follow these steps to configure the maximum groups a port can join and overflow action 346
• Select a port to configure its max group and overflow action 346
• Click apply 347
• Configuring auto refresh 347
• Enable or disable auto refresh 347
• Follow these steps to configure auto refresh 347
• Packet statistic to load the following page 347
• The mld statistics table displays all kinds of mld statistics of all the ports 347
• Viewing mld statistics 347
• Viewing mld statistics on each port 347
• Configuring static member port 348
• Viewing mld static multicast groups 348
• Enabling mld snooping globally 349
• Enabling mld snooping on the port 349
• Switch config interface gigabitethernet 1 0 3 349
• Switch config ipv6 mld snooping 349
• The following example shows how to enable mld snooping globally and enable mld snooping switch configure 349
• Using the cli 349
• Configuring mld snooping parameters globally 350
• Configuring report message suppression 350
• Enable port gi1 0 3 350
• Enable vlan 350
• Global member age time 260 350
• Global report suppression disable 350
• Global router age time 300 350
• Last query interval 1 350
• Last query times 2 350
• Mld snooping enable 350
• Switch config if end 350
• Switch config if ipv6 mld snooping 350
• Switch config if show ipv6 mld snooping 350
• Switch config ipv6 mld snooping 350
• Switch configure 350
• Switch copy running config startup config 350
• The following example shows how to enable report message suppression 350
• Unknown multicast pass 350
• Configuring unknown multicast 351
• Enable port 351
• Enable vlan 351
• Global member age time 260 351
• Global report suppression enable 351
• Global router age time 300 351
• Igmp snooping and mld snooping share the setting of unknown multicast so you have to enable igmp snooping globally at the same time 351
• Last query interval 1 351
• Last query times 2 351
• Mld snooping enable 351
• Switch config end 351
• Switch config ipv6 mld snooping 351
• Switch config ipv6 mld snooping report suppression 351
• Switch config show ipv6 mld snooping 351
• Switch configure 351
• Switch copy running config startup config 351
• The following example shows how to configure the switch to discard unknown multicast data 351
• Unknown multicast pass 351
• Configuring mld snooping parameters on the port 352
• Configuring router port time and member port time 352
• Enable port 352
• Enable vlan 352
• Global member age time 260 352
• Global report suppression disable 352
• Global router age time 300 352
• Last query interval 1 352
• Last query times 2 352
• Mld snooping enable 352
• Switch config end 352
• Switch config ip igmp snooping 352
• Switch config ipv6 mld snooping drop unknown 352
• Switch config show ipv6 mld snooping 352
• Switch configure 352
• Switch copy running config startup config 352
• The following example shows how to configure the global router port time and member port time as 200 seconds 352
• Unknown multicast discard 352
• Configuring fast leave 353
• Enable port 353
• Enable vlan 353
• Global member age time 200 353
• Global report suppression disable 353
• Global router age time 200 353
• Last query interval 1 353
• Last query times 2 353
• Mld snooping enable 353
• Switch config end 353
• Switch config ipv6 mld snooping 353
• Switch config ipv6 mld snooping mtime 200 353
• Switch config ipv6 mld snooping rtime 200 353
• Switch config show ipv6 mld snooping 353
• Switch copy running config startup config 353
• Unknown multicast pass 353
• Configuring max group and overflow action on the port 354
• Gi1 0 3 enable enable 354
• Port mld snooping fast leave 354
• Switch config if end 354
• Switch config if ipv6 mld snooping 354
• Switch config if ipv6 mld snooping immediate leave 354
• Switch config if show ipv6 mld snooping interface gigabitethernet 1 0 3 basic config 354
• Switch config interface gigabiteternet 1 0 3 354
• Switch config ipv6 mld snooping 354
• Switch configure 354
• Switch copy running config startup config 354
• The following example shows how to enable fast leave on port 1 0 3 354
• Configuring mld snooping last listener query 355
• Gi1 0 3 500 drop 355
• Port max groups overflow action 355
• Switch config if end 355
• Switch config if ipv6 mld snooping 355
• Switch config if ipv6 mld snooping max groups 500 355
• Switch config if ipv6 mld snooping max groups action drop 355
• Switch config if show ipv6 mld snooping interface gigabitethernet 1 0 3 max groups 355
• Switch config interface gigabiteternet 1 0 3 355
• Switch config ipv6 mld snooping 355
• Switch configure 355
• Switch copy running config startup config 355
• The following example shows how to configure the max group as 500 and the overflow action as drop on port 1 0 3 355
• Configuring mld snooping parameters in the vlan 356
• Configuring router port time and member port time 356
• Enable port 356
• Enable vlan 356
• Global member age time 260 356
• Global report suppression disable 356
• Global router age time 300 356
• Last query interval 5 356
• Last query times 5 356
• Mld snooping enable 356
• Switch config end 356
• Switch config ipv6 mld snooping 356
• Switch config ipv6 mld snooping last listener query count 5 356
• Switch config ipv6 mld snooping last listener query interval 5 356
• Switch config show ipv6 mld snooping 356
• Switch configure 356
• Switch copy running config startup config 356
• The following example shows how to configure the last listener query count as 5 and the last listener query interval as 5 seconds 356
• Unknown multicast pass 356
• Configuring static router port 357
• Configuring forbidden router port 358
• Dynamic router port none 358
• Forbidden router port none 358
• Member time 0 358
• Router time 0 358
• Static router port gi1 0 2 358
• Switch config end 358
• Switch config ipv6 mld snooping 358
• Switch config ipv6 mld snooping vlan config 2 rport interface gigabitethernet 1 0 2 358
• Switch config show ipv6 mld snooping vlan 2 358
• Switch configure 358
• Switch copy running config startup config 358
• The following example shows how to enable mld snooping in vlan 2 and configure port 1 0 2 as the static router port 358
• Vlan id 2 358
• Configuring static multicast multicast ip and forward port 359
• Dynamic router port none 359
• Forbidden router port gi1 0 4 6 359
• Member time 0 359
• Router time 0 359
• Static router port none 359
• Switch config 359
• Switch config end 359
• Switch config ipv6 mld snooping 359
• Switch config ipv6 mld snooping vlan config 2 router ports forbidden interface gigabitethernet 1 0 4 6 359
• Switch config show ipv6 mld snooping vlan 2 359
• Switch copy running config startup config 359
• The following example shows how to enable mld snooping in vlan 2 and forbid port 1 0 4 6 from becoming router ports port 1 0 4 6 will drop all multicast data from layer 3 devices 359
• Vlan id 2 359
• Configuring mld snooping parameters in the multicast vlan 360
• Configuring router port time and member port time 360
• Ff01 1234 02 2 static gi1 0 9 10 360
• Multicast ip vlan id addr type switch port 360
• Switch config end 360
• Switch config ipv6 mld snooping 360
• Switch config ipv6 mld snooping vlan config 2 static ff01 1234 02 interface gigabitethernet 1 0 9 10 360
• Switch config show ipv6 mld snooping groups static 360
• Switch configure 360
• Switch copy running config startup config 360
• The following example shows how to configure ff01 1234 02 as the static multicast ip and specify port 1 0 9 10 as the forward ports 360
• Configuring static router port 361
• Dynamic router port none 361
• Forbidden router port none 361
• Member time 400 361
• Multicast vlan enable 361
• Replace source ip 361
• Router time 500 361
• Static router port none 361
• Switch config end 361
• Switch config ipv6 mld snooping 361
• Switch config ipv6 mld snooping multi vlan config 5 mtime 400 361
• Switch config ipv6 mld snooping multi vlan config 5 rtime 500 361
• Switch config show ipv6 mld snooping multi vlan 361
• Switch configure 361
• Switch copy running config startup config 361
• The following example shows how to configure vlan 5 as the multicast vlan set the router port time as 500 seconds and the member port time as 400 seconds 361
• Vlan id 5 361
• Configuring forbidden router port 362
• Dynamic router port none 362
• Forbidden router port none 362
• Member time 260 362
• Multicast vlan enable 362
• Replace source ip 362
• Router time 300 362
• Static router port gi1 0 5 362
• Switch config end 362
• Switch config ipv6 mld snooping 362
• Switch config ipv6 mld snooping multi vlan config 5 rport interface gigabitethernet 1 0 5 362
• Switch config show ipv6 mld snooping multi vlan 362
• Switch configure 362
• Switch copy running config startup config 362
• The following example shows how to configure vlan 5 as the multicast vlan and set port 1 0 5 as the static router port 362
• Vlan id 5 362
• Configuring replace source ip 363
• Dynamic router port none 363
• Forbidden router port gi1 0 6 363
• Member time 260 363
• Multicast vlan enable 363
• Replace source ip 363
• Router time 300 363
• Static router port none 363
• Switch config end 363
• Switch config ipv6 mld snooping 363
• Switch config ipv6 mld snooping multi vlan config 5 router ports forbidden interface gigabitethernet 1 0 6 363
• Switch config show ipv6 mld snooping multi vlan 363
• Switch configure 363
• Switch copy running config startup config 363
• The following example shows how to configure vlan 5 as the multicast vlan and set port 1 0 6 as the forbidden router port 363
• Vlan id 5 363
• Configuring the querier 364
• Dynamic router port none 364
• Enabling mld querier 364
• Forbidden router port none 364
• Member time 260 364
• Multicast vlan enable 364
• Replace source ip fe80 2ff ffff fe00 1 364
• Router time 300 364
• Static router port none 364
• Switch config end 364
• Switch config ipv6 mld snooping 364
• Switch config ipv6 mld snooping multi vlan config 5 replace sourceip fe80 02ff ffff fe00 0001 364
• Switch config show ipv6 mld snooping multi vlan 364
• Switch configure 364
• Switch copy running config startup config 364
• The following example shows how to configure vlan 5 as the multicast vlan and replace the source ip in the mld packets sent by the switch with fe80 02ff ffff fe00 0001 364
• Vlan id 5 364
• Configuring query interval max response time and general query source ip 365
• General query source ip fe80 2ff ffff fe00 1 365
• Maximum response time 10 365
• Query interval 60 365
• Switch config end 365
• Switch config ipv6 mld snooping 365
• Switch config ipv6 mld snooping querier vlan 4 365
• Switch config show ipv6 mld snooping querier 365
• Switch configure 365
• Switch copy running config startup config 365
• The following example shows how to enable mld snooping and mld querier in vlan 4 365
• The following example shows how to enable mld snooping and mld querier in vlan 4 set the query interval as 100 seconds the max response time as 20 seconds and the general query source ip as fe80 2ff ffff fe00 1 365
• Vlan 4 365
• Configuring multicast filtering 366
• Creating profile 366
• General query source ip fe80 2ff ffff fe00 1 366
• Maximum response time 20 366
• Query interval 100 366
• Switch config end 366
• Switch config ipv6 mld snooping 366
• Switch config ipv6 mld snooping querier vlan 4 general query source ip fe80 2ff ffff fe00 1 366
• Switch config ipv6 mld snooping querier vlan 4 max response time 20 366
• Switch config ipv6 mld snooping querier vlan 4 query interval 100 366
• Switch config show ipv6 mld snooping querier 366
• Switch copy running config startup config 366
• Vlan 4 366
• Binding profile to the port 367
• Mld profile 1 367
• Range ff01 1234 5 ff01 1234 8 367
• Switch config end 367
• Switch config ipv6 mld profile 1 367
• Switch config ipv6 mld snooping 367
• Switch config mld profile deny 367
• Switch config mld profile range ff01 1234 5 ff01 1234 8 367
• Switch config mld profile show ipv6 mld profile 367
• Switch configure 367
• Switch copy running config startup config 367
• The following example shows how to configure profile 1 so that the switch filters multicast data sent to ff01 1234 5 ff01 1234 8 367
• Using the gui 369
• Viewing ipv4 multicast snooping configurations 369
• Viewing multicast snooping configurations 369
• Ipv6 multicast table to view all valid multicast ip vlan port entries 370
• Using the cli 370
• Viewing ipv4 multicast snooping configurations 370
• Viewing ipv6 multicast snooping configurations 370
• Viewing ipv6 multicast snooping configurations 371
• Configuration examples 373
• Configuration scheme 373
• Example for configuring basic igmp snooping 373
• Network requirements 373
• Using the gui 374
• Vlan config to load the following page create vlan 10 and add untagged port 1 0 1 3 and tagged port 1 0 4 to vlan 10 375
• Using the cli 377
• Verify the configurations 378
• Configuration scheme 379
• Example for configuring multicast vlan 379
• Network requirements 379
• Network topology 379
• Demonstrated with t1600g 52ts this section provides configuration procedures in two ways using the gui and using the cli 380
• Internet 380
• Snooping config to load the following page enable igmp snooping globally and keep the default values in the router port time and member port time fields 380
• Using the gui 380
• Snooping config to load the following page enable igmp snooping on port 1 0 1 4 381
• Using the cli 383
• Verify the configurations 384
• Example for configuring unknown multicast and fast leave 385
• Network requirement 385
• Configuration scheme 386
• Using the gui 386
• Port config to load the following page enable igmp snooping on port 1 0 2 and port 1 0 4 and enable fast leave on port 1 0 2 387
• Vlan config to load the following page enable igmp snooping in vlan 10 388
• Using the cli 389
• Verify the configurations 389
• Configuration scheme 390
• Example for configuring multicast filtering 390
• Network requirements 390
• Network topology 390
• Demonstrated with t1600g 52ts this section provides configuration procedures in two ways using the gui and using the cli 391
• Internet 391
• Snooping config to load the following page enable igmp snooping globally and keep the default values in the router port time and member port time fields 391
• Using the gui 391
• Snooping config to load the following page 392
• Using the cli 398
• Verify the configurations 400
• Appendix default parameters 401
• Default parameters for igmp snooping 401
• Default parameters for mld snooping 402
• Chapters 404
• Configuring logical interfaces 404
• Part 12 404
• Interfaces of a device are used to exchange data and interact with interfaces of other network devices interfaces are classified into physical interfaces and logical interfaces 405
• Logical interfaces are manually configured and do not physically exist such as loopback interfaces and routing interfaces 405
• Overview 405
• Physical interfaces are the ports on the front panel or rear panel of the switch 405
• This chapter introduces the configurations for logical interfaces the supported types of logical interfaces are shown as below 405
• Creating a layer 3 interface 406
• Logical interfaces configurations 406
• Using the gui 406
• Configuring ipv4 parameters of the interface 407
• Figure 2 407
• In the interface list section you can view the corresponding interface entry you create 407
• In the modify interface section specify an interface id and configure relevant parameters for the interface according to your actual needs then click apply 407
• List section on the corresponding interface entry click edit to load the following page and configure the ipv4 parameters of the interface 407
• You can view the corresponding interface entry you create in the interface 407
• Configuring ipv6 parameters of the interface 408
• Figure 2 408
• In the secondary ip create section configure the secondary ip for the specified interface which allows you to have two logical subnets using one physical subnet then click create 408
• In the secondary ip list section you can view the corresponding secondary ip entry you create 408
• List section on the corresponding interface entry click edit ipv6 to load the following page and configure the ipv6 parameters of the interface 408
• You can view the corresponding interface entry you create in the interface 408
• Configure the ipv6 link local address of the interface manually or automatically in the link local address config section then click apply 409
• Enable ipv6 function on the interface of switch in the general config section then click apply 409
• Configure one or more ipv6 global addresses of the interface via following three ways 410
• Manually 410
• Via dhcpv6 server 410
• Via ra message 410
• View the global address entry in the global address table 410
• Creating a layer 3 interface 411
• Figure 2 411
• Follow these steps to create a layer 3 interface you can create a vlan interface a loopback interface a routed port or a port channel interface according to your needs 411
• List section on the corresponding interface entry click detail to load the following page and view the detail information of the interface 411
• Using the cli 411
• Viewing detail information of the interface 411
• You can view the corresponding interface entry you create in the interface 411
• Switch config if description vlan 2 412
• Switch config if end 412
• Switch config interface vlan 2 412
• Switch configure 412
• Switch copy running config startup config 412
• The following example shows how to create a vlan interface with a description of vlan 2 412
• Configuring ipv4 parameters of the interface 413
• Follow these steps to configure the ipv4 parameters of the interface 413
• Switch config if ip address 192 68 00 255 55 55 413
• Switch config if no switchport 413
• Switch config if show ip interface brief 413
• Switch config interface gigabitethernet 1 0 1 413
• Switch configure 413
• The following example shows how to configure the ipv4 parameters of a routed port including setting a static ip address for the port and enabling the layer 3 capabilities 413
• Configuring ipv6 parameters of the interface 414
• Follow these steps to configure the ipv6 parameters of the interface 414
• Interface ip address method status protocol shutdown gi1 0 1 192 68 00 24 static up up no 414
• Switch config if end 414
• Switch copy running config startup config 414
• Global address dhcpv6 enable 415
• Global address ra disable 415
• Global unicast address es ff02 1 ff13 237b 415
• Ipv6 is enable link local address fe80 20a ebff fe13 237bnor 415
• Joined group address es ff02 1 415
• Switch config if ipv6 address autoconfig 415
• Switch config if ipv6 address dhcp 415
• Switch config if ipv6 enable 415
• Switch config if show ipv6 interface 415
• Switch config interface vlan 2 415
• Switch configure 415
• The following example shows how to enable the ipv6 function and configure the ipv6 parameters of a vlan interface 415
• Vlan2 is up line protocol is up 415
• Appendix default parameters 417
• Default settings of interface are listed in the following tables 417
• Chapters 418
• Configuring static routing 418
• Part 13 418
• Overview 419
• In the ipv4 static route table section you can view and modify the ipv4 static routing entries 420
• In the ipv4 static routing config section configure the corresponding parameters to add an ipv4 static route then click create 420
• Ipv4 static routing config to load the following page 420
• Ipv4 static routing configuration 420
• Using the gui 420
• C 192 68 24 is directly connected vlan1 421
• Candidate default 421
• Codes c connected s static 421
• Follow these steps to create an ipv4 static route 421
• S 192 68 24 1 0 via 192 68 vlan1 421
• Switch config end 421
• Switch config ip route 192 68 255 55 55 192 68 421
• Switch config show ip route 421
• Switch configure 421
• Switch copy running config startup config 421
• The following example shows how to create an ipv4 static route with the destination ip address as 192 68 the subnet mask as 255 55 55 and the next hop address as 192 68 421
• Using the cli 421
• In the ipv6 routing section enable ipv6 routing function and click apply 422
• In the ipv6 static routing config section configure corresponding parameters to add an ipv6 static route then click create 422
• Ipv6 static routing config to load the following page 422
• Ipv6 static routing configuration 422
• Using the gui 422
• C 3000 64 is directly connected vlan1 423
• Candidate default 423
• Codes c connected s static 423
• Follow these steps to enable ipv6 routing function and create an ipv6 static route 423
• In the ipv6 static route table section you can view and modify the ipv6 static routing entries 423
• S 3200 64 1 0 via 3100 1234 vlan2 423
• Switch config ipv6 route 3200 64 3100 1234 423
• Switch config show ipv6 route static 423
• Switch configure 423
• The following example shows how to create an ipv6 static route with the destination ip address as 3200 64 and the next hop address as 3100 1234 423
• Using the cli 423
• Switch config end 424
• Switch copy running config startup config 424
• Using the gui 425
• Viewing ipv4 routing table 425
• Viewing routing table 425
• Ipv6 routing table to load the following page 426
• On privileged exec mode or any other configuration mode you can use the following command to view ipv4 routing table 426
• Using the cli 426
• View the ipv6 routes in the ipv6 routing information summary section 426
• Viewing ipv4 routing table 426
• Viewing ipv6 routing table 426
• On privileged exec mode or any other configuration mode you can use the following command to view ipv6 routing table 427
• Viewing ipv6 routing table 427
• Configuration scheme 428
• Example for static routing 428
• Network requirements 428
• Using the gui 428
• Using the cli 429
• Verify the configurations 430
• Appendix default parameter 432
• Default setting of static routing is listed in the following table 432
• Chapters 433
• Configuring dhcp 433
• Part 14 433
• Dhcp client 434
• Dhcp relay 434
• Overview 434
• Supported features 434
• As the following figure shows no ip addresses are assigned to vlan 10 and vlan 20 but a default relay agent interface is configured with the ip address 192 68 24 the switch uses ip address of the default agent interface 192 68 24 to apply for ip addresses for clients in both vlan 10 and vlan 20 as a result the dhcp server will assign ip addresses on 192 68 24 the same subnet with the ip address of the default agent interface to clients in both vlan 10 and vlan 20 436
• In dhcp vlan relay you can simply specify a layer 3 interface as default agent interface for all vlans the swith will fill this default agent interface s ip address in the relay agent ip address field of the dhcp packets from all vlans 436
• Click create 437
• Dhcp client configuration 437
• Follow these steps to configure dhcp client 437
• In the creating interface section select interface vlan or routed port as the interface type and enter the interface id select dhcp or bootp as the ip address mode set the admin status as enable and enter the interface name optional 437
• Interface config to load the following page 437
• Using the gui 437
• Follow these steps to configure dhcp client 438
• Switch configure 438
• The following example shows how to configure port 1 0 5 as an layer 3 interface and to configure its ip address mode as dhcp 438
• Using the cli 438
• Dhcp relay configuration 440
• Enabling dhcp relay and configuring option 82 440
• Using the gui 440
• Click apply 441
• Dhcp interface relay 441
• Dhcp interface relay to load the following page 441
• Dhcp server to load the following page 441
• Follow these steps to specify dhcp server for the interface 441
• In the add dhcp server address section select the interface type and enter the interface id and then enter the server address of the interface 441
• Specifying dhcp server for the interface or vlan 441
• You can specify dhcp server for an layer 3 interface or for a vlan the following respectively introduces how to configure dhcp interface relay and dhcp vlan relay 441
• Click create to specify the dhcp server for the interface 442
• Dhcp vlan relay 442
• Dhcp vlan relay to load the following page 442
• Follow these steps to specify dhcp server for the specific vlan 442
• In the default relay agent interface section specify the type and id of the interface that needs to be configured as the default relay agent interface then click apply 442
• Only t1600g 18ts supports this feature 442
• Dhcp relay is enabled 443
• Enabling dhcp relay 443
• Follow these steps to configure option 82 443
• Follow these steps to enable dhcp relay 443
• In the add dhcp server address section specify the vlan in which the clients needs ip addresses and the server address click add 443
• Optional configuring option 82 443
• Switch config end 443
• Switch config service dhcp relay 443
• Switch config show ip dhcp relay 443
• Switch configure 443
• Switch copy running config startup config 443
• The following example shows how to enable dhcp relay 443
• Using the cli 443
• Switch config ip dhcp relay information 444
• Switch config ip dhcp relay information policy keep 444
• Switch configure 444
• The following example shows how to enable option 82 and configure the process of option 82 information as keep 444
• Dhcp interface relay 445
• Dhcp relay option 82 is enabled 445
• Existed option 82 field operation keep 445
• Follow these steps to dhcp interface relay 445
• Specifying dhcp server for interface or vlan 445
• Switch config end 445
• Switch config show ip dhcp relay 445
• Switch copy running config startup config 445
• You can specify dhcp server for an layer 3 interface or for a vlan the following respectively introduces how to configure dhcp interface relay and dhcp vlan relay 445
• Configuration examples 449
• Configuration scheme 449
• Example for dhcp interface relay 449
• Network requirements 449
• Using the gui 450
• Using the cli 451
• Verify the configurations 451
• Appendix default parameters 453
• Default setting of dhcp client is listed in the following table 453
• Default settings of dhcp relay are listed in the following table 453
• Arp address resolution protocol is used to map ip addresses to mac addresses taking an ip address as input arp learns the associated mac address and stores the ip mac address association in an arp entry for rapid retrieval 455
• Overview 455
• Arp configurations 456
• Using the gui 456
• Viewing the arp entries 456
• Adding static arp entries 457
• Adding static arp entries manually 457
• Configuring arp function 457
• Follow these steps to add arp entries 457
• Follow these steps to add static arp entries 457
• In the arp config section enter the ip address and mac address and click create 457
• Static arp to load the following page 457
• Using the cli 457
• You can add desired static arp entries by mannually specifying the ip addresses and mac addresses 457
• Configuring the aging time of dynamic arp entries 458
• Follow these steps to configure the aging time of dynamic arp entries 458
• Interface address hardware addr type 458
• Switch config arp 192 68 00 11 22 33 44 55 arpa 458
• Switch config end 458
• Switch config show arp 192 68 458
• Switch configure 458
• Switch copy running config startup config 458
• This example shows how to create a static arp entry with the ip as 192 68 and the mac as 00 11 22 33 44 55 458
• Vlan1 192 68 00 11 22 33 44 55 static 458
• Clearing dynamic entries 459
• On privileged exec mode or any other configuration mode you can use the following command to view arp entries 459
• Switch config if arp timeout 1000 459
• Switch config if end 459
• Switch config interface vlan 2 459
• Switch configure 459
• Switch copy running config startup config 459
• This example shows how to configure the aging time of dynamic arp entries as 1000 seconds for vlan interface 2 459
• Viewing arp entries 459
• Chapters 461
• Configuring qos 461
• Part 16 461
• Bandwidth control 462
• Diffserv 462
• Overview 462
• Supported features 462
• 802 p priority 463
• Configuration guidelines 463
• Diffserv configuration 463
• Dscp priority 463
• Port priority 463
• Configuring priority mode 464
• Using the gui 464
• Click apply 465
• Configuring dscp priority 465
• Dscp priority to load the following page 465
• Click apply 466
• Configure the dscp tc mapping relations 466
• Configuring port priority 466
• Enable dscp priority and click apply dscp priority is disabled by default 466
• Follow these steps to configure the dscp priority 466
• Configuring schedule mode 467
• Follow these steps to configure the schedule mode 468
• Optional configure the weight value of the each tc queue if the schedule mode is wrr of sp wrr 468
• Select a schedule mode 468
• Click apply 469
• Configuring 802 priority 469
• Configuring priority mode 469
• The instructions of the three priority modes are described respectively in this section 469
• Using cli 469
• Configuring dscp priority 470
• Dscp priority is disabled 470
• P priority is enabled 470
• Switch config end 470
• Switch config qos queue cos map 2 0 470
• Switch config show qos cos map 470
• Switch config show qos status 470
• Switch configure 470
• Switch copy running config startup config 470
• Tag 0 1 2 3 4 5 6 7 470
• Tc tc1 tc0 tc0 tc3 tc4 tc5 tc6 tc7 470
• The following example shows how to map cos2 to tc0 and keep other cos id tc as default 470
• Switch config qos queue dscp map 10 14 0 471
• Switch config show qos cos map 471
• Switch configure 471
• Tag 0 1 2 3 4 5 6 7 471
• Tc tc1 tc0 tc0 tc3 tc4 tc5 tc6 tc7 471
• The following example shows how to map dscp values 10 14 to tc1 and keep other mapping relations as default 471
• Configuring port priority 472
• Cos cos1 cos1 cos0 cos0 cos0 cos0 cos0 cos1 472
• Dscp 8 9 10 11 12 13 14 15 472
• Dscp priority is enabled 472
• P priority is disabled 472
• Select the desired port to set the priority packets from this ingress port are mapped to the tc queue based on port priority 472
• Switch config end 472
• Switch config show qos dscp map 472
• Switch config show qos status 472
• Switch copy running config startup config 472
• Configuring schedule mode 474
• Follow these steps to configure the schedule mode to control the forwarding sequence of different tc queues when congestion occurs 474
• Bandwidth control configuration 476
• Configuring rate limit 476
• Using the gui 476
• Click apply 477
• Configuring storm control 477
• Follow these steps to configure the storm control function 477
• Select the port s and configure the upper rate limit for forwarding broadcast packets multicast packets and ul frames 477
• Storm control to load the following page 477
• Click apply 478
• Configure the upper rate limit for the port to receive and send packets 479
• Configuring rate limit on port 479
• Switch config interface gigabitethernet 1 0 5 479
• Switch configure 479
• The following example shows how to configure the ingress rate as 5120 kbps and egress rate as 1024 kbps for port 1 0 5 479
• Using the cli 479
• Configuring storm control 480
• Configuration examples 483
• Configuration scheme 483
• Example for configuring sp mode 483
• Network requirements 483
• Using the gui 484
• Using the cli 485
• Example for configuring wrr mode 486
• Network requirements 486
• Verify the configuration 486
• Configuration scheme 487
• Configurations for switch a demonstrated with t1600g 52ts 487
• Configure switch a to add different vlan tags to the packets from the two departments respectively 487
• Configure switch b to classify the incoming packets from the two departments according to the vlan tags and to map them into different tc queues configure the schedule mode as wrr mode to implement the qos feature 487
• This chapter provides configuration procedures in two ways using the gui and using the cli 487
• Using the gui 487
• Vlan config and click create to load the following page create vlan 10 with the description of rd add port 1 0 1 as an untagged port and port 1 0 3 as a tagged port to vlan 10 then click apply 487
• Using the cli 494
• Verify the configuration 497
• Appendix default parameters 499
• Diffserv 499
• Bandwidth control 500
• Chapters 501
• Configuring voice vlan 501
• Part 17 501
• Overview 502
• Because the voice vlan in automatic mode supports only tagged voice traffic you need to make sure traffic from the voice device is tagged to do so there are mainly two ways 504
• Before configuring voice vlan you need to create a vlan for voice traffic for details about vlan configuration please refer to configuring 802 q vlan 504
• Configuration guidelines 504
• Configure oui addresses 504
• Configure voice vlan globally 504
• Configure voice vlan mode on ports 504
• Configuring lld 504
• Create a vlan 504
• If your switch provides the lldp med feature you can also configure it to instruct the voice device to send tagged voice traffic for details about lldp med please refer to 504
• Only one vlan can be set as the voice vlan on the switch 504
• To apply the voice vlan configuration you may need to further configure pvid port vlan id and the link type of the port which is connected to voice devices we recommend that you choose the mode according to your needs and configure the port as the following table shows 504
• To complete the voice vlan configuration follow these steps 504
• Vlan 1 is a default vlan and cannot be configured as the voice vlan 504
• Voice vlan configuration 504
• You can configure the voice device to forward traffic with a voice vlan tag 504
• Click create to add an oui address to the table 505
• Configuring oui addresses 505
• Enter an oui address and the corresponding mask and give a description about the oui address 505
• Follow these steps to add oui addresses 505
• If the oui address of your voice device is not in the oui table you need to add the oui address to the table 505
• Oui config to load the following page 505
• Using the gui 505
• Click apply 506
• Configuring voice vlan globally 506
• Enable the voice vlan feature and enter a vlan id 506
• Follow these steps to configure the voice vlan globally 506
• Global config to load the following page 506
• Set the aging time for the voice vlan 506
• Specify a priority for the voice vlan 506
• Configuring voice vlan mode on ports 507
• Follow these steps to configure voice vlan mode on ports 507
• Port config to load the following page 507
• Select your desired ports and choose the port mode 507
• Set the security mode for selected ports 507
• Click apply 508
• Follow these steps to configure the voice vlan 508
• Using the cli 508
• Avoid attacks from malicious data flows 511
• Configuration example 511
• Configuration scheme 511
• Ip phones share switch ports used by computers because no more ports are available for ip phones 511
• Network requirements 511
• Network topology 511
• Transmit voice traffic in an exclusive path with high quality 511
• Demonstrated with t1600g 28ts this chapter provides configuration procedures in two ways using the gui and using the cli 512
• In the meeting room computers and ip phones are connected to different ports of switch b ports connected to ip phones use the voice vlan for voice traffic and ports connected to computers use the default vlan for data traffic 512
• Internet 512
• Voice traffics from switch a and switch b are forwarded to voice gateway and internet through switch c 512
• Using the gui 513
• Vlan config and edit vlan 10 to load the following page add port 1 0 2 to the voice vlan 515
• Using the cli 523
• Verify the configurations 526
• Appendix default parameters 528
• Default settings of voice vlan are listed in the following tables 528
• Chapters 529
• Configuring poe 529
• Part 18 529
• Overview 530
• Poe power management 530
• Supported features 530
• Time range function 530
• Configuring the poe parameters manually 531
• Poe power management configurations 531
• Using the gui 531
• In the port config section select the port you want to configure and specify the parameters click apply 532
• Click apply 533
• Configuring the poe parameters using the profile 533
• Creating a poe profile 533
• Follow these steps to create a poe profile 533
• In the create poe profile section specify the desired configurations of the profile 533
• Poe profile to load the following page 533
• Binding the profile to the corresponding ports 534
• Follow these steps to bind the profile to the corresponding ports 534
• In the global config section specify the system power limit and click apply 534
• In the port config section select a profile and bind it to the corresponding ports click apply 534
• Configuring the poe parameters manually 535
• Follow these steps to configure the basic poe parameters 535
• Using the cli 535
• Gi1 0 5 enable middle class3 no limit none 536
• Interface poe status poe prio power limit w time range poe profile 536
• Switch config if power inline consumption class3 536
• Switch config if power inline priority middle 536
• Switch config if power inline supply enable 536
• Switch config if show power inline 536
• Switch config if show power inline configuration interface gigabitethernet 1 0 5 536
• Switch config interface gigabitethernet 1 0 5 536
• Switch config power inline consumption 160 536
• Switch configure 536
• System power consumption 0 w 536
• System power limit 160 w 536
• System power remain 160 w 536
• The following example shows how to set the system power limit as 160w set the priority as middle and set the power limit as class3 in the port 1 0 5 536
• Configuring the poe parameters using the profile 537
• Follow these steps to configure the poe profile 537
• Gi1 0 5 1 26 53 class 2 on 537
• Interface power w current ma voltage v pd class power status 537
• Switch config end 537
• Switch config if show power inline information interface gigabitethernet 1 0 5 537
• Switch copy running config startup config 537
• Creating a time range 539
• Time range function configurations 539
• Using the gui 539
• Click apply 540
• In the add absolute or periodic section specify the parameters and click add 540
• When the absolute mode is selected the following section will be shown 540
• When the periodic mode is selected the following section will be shown 540
• Configuring the holiday parameters 541
• Viewing the time range table 541
• Configuring a time range 542
• Follow these steps to create a time range 542
• Using the cli 542
• 01 00 to 23 00 on 5 543
• 09 08 2016 00 00 to 09 10 2016 24 00 543
• Holiday include 543
• Number of absolute time 1 543
• Number of periodic time 1 543
• Switch config power time range time range1 543
• Switch config show power time range time range1 543
• Switch config time range absolute from 09 08 2016 00 00 to 09 10 2016 24 00 543
• Switch config time range exit 543
• Switch config time range holiday include 543
• Switch config time range periodic start 01 00 end 23 00 day of the week 5 543
• Switch configure 543
• The following example shows how to create a time range named time range1 select include to make the settings take affected on holiday set absolute mode from 2016 09 08 00 00 to 2016 09 10 24 00 set the periodic mode from 01 00 to 23 00 in friday bind the time range to the port 1 0 7 543
• Time range entry time range1 active 543
• Configuring the holiday parameters 544
• Follow these steps to configure the holiday parameters 544
• Holiday1 08 6 08 0 544
• Index holiday name start end 544
• Switch config end 544
• Switch config if end 544
• Switch config if power inline time range time range1 544
• Switch config interface gigabitethernet 1 0 7 544
• Switch config power holiday holiday1 start date 08 16 end date 08 20 544
• Switch config show power holiday 544
• Switch configure 544
• Switch copy running config startup config 544
• The following example shows how to create a holiday named holiday1 set the starting date as 08 16 set the ending date as 08 20 544
• 01 01 2000 00 00 to 12 31 2099 24 00 by default 545
• 08 30 to 18 00 on 1 2 3 4 5 545
• Holiday include 545
• Number of absolute time 0 545
• Number of periodic time 1 545
• On privileged exec mode or any other configuration mode you can use the following command to view the time range table 545
• Switch copy running config startup config 545
• Switch end 545
• Switch show power time range 545
• The following example shows how to view the time range table 545
• Time range entry office time active 545
• Viewing the time range table 545
• Configuring scheme 546
• Example for poe configurations 546
• Network requirements 546
• Using the gui 546
• Using the cli 548
• Verify the configuration 549
• Appendix default parameters 550
• Chapters 551
• Configuring acl 551
• Part 19 551
• Acl binding 552
• Overview 552
• Policy binding 552
• Supported features 552
• Acl configurations 553
• Creating an acl 553
• Using the gui 553
• Configuring acl rules 554
• Click apply 555
• Configure the rule s packet matching criteria 555
• Configuring the standard ip acl rule 555
• Follow these steps to create the standard ip acl rule 555
• Select a standard ip acl from the drop down list enter a rule id and specify the operation for the matched packets 555
• Standard i 555
• Standard ip acl to load the following page 555
• Tandard i 555
• Click apply 556
• Configure the rule s packet matching criteria 556
• Configuring the extend ip acl rule 556
• Extend ip ac 556
• Extend ip acl to load the following page 556
• Follow these steps to create the extend ip acl rule 556
• Select an extend ip acl from the drop down list enter a rule id and specify the operation for the matched packets 556
• Click apply 557
• Configure the rule s packet matching criteri 557
• Configuring the ipv6 acl rule 557
• Follow these steps to create the ipv6 acl rule 557
• Ipv6 acl to load the following page 557
• Select an ipv6 acl from the drop down list enter a rule id and specify the operation for the rule 557
• Click apply 558
• Configure the rule s packet matching criteri 558
• In the acl rule table you can view all the acls and their rules you can also delete an acl or an acl rule or change the matching order if needed 558
• The rules in an acl are listed in ascending order of configuration time regardless of their rule ids by default a rule configured earlier is listed before a rule configured later the switch matches a received packet with the rules in order when a packet matches a rule the device stops the match process and performs the action defined in the rule 558
• Verifying the rule table 558
• Configuring policy 559
• Configuring the acl binding 560
• Configuring the acl binding and policy binding 560
• Verifying the binding configuration 562
• Configuring acl 564
• Configuring the mac acl 564
• Follow the steps to create different types of acl and configure the acl rules 564
• Using the cli 564
• You can define the rules based on source or destination ip addresses source or destination mac addresses protocol type and so on 564
• Configuring the standard ip acl 565
• Mac access list 50 565
• Rule 1 permit smac 00 34 a2 d4 34 b5 smask ff ff ff ff ff ff 565
• Switch config mac access list 50 565
• Switch config mac acl end 565
• Switch config mac acl rule 1 permit smac 00 34 a2 d4 34 b5 smask ff ff ff ff ff ff 565
• Switch config mac acl show access list 50 565
• Switch configure 565
• Switch copy running config startup config 565
• The following example shows how to create mac acl 50 and configure rule 1 to permit packets with source mac address 00 34 a2 d4 34 b5 565
• Configuring the extend ip acl 566
• Rule 1 permit sip 192 68 00 smask 255 55 55 55 566
• Standard ip access list 600 566
• Switch config access list create 600 566
• Switch config end 566
• Switch config rule 1 permit sip 192 68 00 smask 255 55 55 55 566
• Switch config show access list 600 566
• Switch configure 566
• Switch copy running config startup config 566
• The following example shows how to create standard ip acl 600 and configure rule 1 to permit packets with source ip address 192 68 00 566
• Extended ip access list 1700 567
• Rule 7 deny sip 192 68 00 smask 255 55 55 55 protocol 6 d port 23 567
• Switch config access list create 1700 567
• Switch config access list extended 1700 rule 7 deny sip 192 68 00 smask 255 55 55 55 protocol 6 d port 23 567
• Switch config end 567
• Switch config show access list 1700 567
• Switch configure 567
• Switch copy running config startup config 567
• The following example shows how to create extend ip acl 1700 and configure rule7 to deny telnet packets with source ip192 68 00 567
• Configuring the ipv6 acl 568
• Configuring policy 569
• Follow the steps below to create a policy and configure the policy actions 569
• Ipv6 access list 3600 569
• Rule 1 deny sip cdcd 910a 2222 5498 8475 1111 3900 2020 sip mask ffff ff ff ffff ffff 569
• Switch config access list create 3600 569
• Switch config access list ipv6 3600 rule 1 deny sip cdcd 910a 2222 5498 8475 1111 3900 2020 sip mask ffff ffff ffff ffff 569
• Switch config end 569
• Switch config show access list 3600 569
• Switch configure 569
• Switch copy running config startup config 569
• The following example shows how to create ipv6 acl 3600 and configure rule 1 to deny packets with source ipv6 address cdcd 910a 2222 5498 8475 1111 3900 2020 569
• Access list 600 570
• Acl binding 570
• Acl binding and policy binding 570
• Policy name rd 570
• Switch config access list policy action rd 600 570
• Switch config access list policy name rd 570
• Switch config action exit 570
• Switch config end 570
• Switch config show access list policy rd 570
• Switch configure 570
• Switch copy running config startup config 570
• The following example shows how to create policy rd and apply acl 600 to policy rd 570
• You can bind the acl to a port or a vlan the received packets will then be matched and processed according to the acl rules 570
• You can select acl binding or policy binding according to your needs an acl rule and policy takes effect only after they are bound to a port or vlan 570
• Configuration example for acl 573
• Configuration scheme 573
• Network requirements 573
• Network topology 573
• Using the gui 574
• Extend acl to load the the following page configure rule 2 and rule 3 to permit packets with source ip 10 0 0 and destination port tcp 80 http service port and udp 443 https service port 575
• Using the cli 578
• Verify the configurations 579
• Appendix default parameters 580
• For extend ip acl 580
• For ipv6 acl 580
• For mac acl 580
• For standard ip acl 580
• Chapters 581
• Configuring network security 581
• Part 20 581
• Dhcp snooping 582
• Ip mac binding 582
• Network security 582
• Overview 582
• Supported features 582
• Arp inspection 583
• Dos defend 584
• Binding entries manually 587
• Ip mac binding configurations 587
• Using the gui 587
• Arp scanning 588
• Binding entries dynamically 588
• Click bind 588
• Select protect type for the entry 588
• Select the port that is connected to this host 588
• The binding entries can be dynamically learned from arp scanning and dhcp snooping 588
• With arp scanning the switch sends the arp request packets of the specified ip field to the hosts upon receiving the arp reply packet the switch can get the ip address mac address vlan id and the connected port number of the host you can bind these entries conveniently 588
• Arp scanning to load the following page 589
• Follow these steps to configure ip mac binding via arp scanning 589
• In the scanning option section specify an ip address range and a vlan id then click scan to scan the entries in the specified ip address range and vlan 589
• In the scanning result section select one or more entries and configure the relevant parameters then click apply 589
• Binding table to load the following page 590
• Dhcp snooping 590
• For instructions on how to configure dhcp snooping refer to dhcp snooping configurations 590
• In the search section specify the search criteria to search your desired entries 590
• Viewing the binding entries 590
• With dhcp snooping enabled the switch can monitor the ip address obtaining process of the host and record the ip address mac address vlan id and the connected port number of the host 590
• With the binding table you can view and search the specified binding entries 590
• Binding entries manually 591
• Binding entries via arp scanning is not supported by the cli binding entries via dhcp snooping is introduced in dhcp snooping configurations the following sections introduce how to bind entries manually and view the binding entries 591
• Follow these steps to manually bind entries 591
• In the binding table section you can view the searched entries additionally you can configure the host name and protect type for one or more entries and click apply 591
• Using the cli 591
• You can manually bind the ip address mac address vlan id and the port number together on the condition that you have got the related information of the hosts 591
• Host1 192 68 5 aa bb cc dd ee ff 10 gi1 0 5 arp d 592
• Switch config end 592
• Switch config ip source binding host1 192 68 5 aa bb cc dd ee ff vlan 10 interface gigabitethernet 1 0 5 arp detection 592
• Switch config show ip source binding 592
• Switch configure 592
• Switch copy running config startup config 592
• The following example shows how to bind an entry with the hostname host1 ip address 192 68 5 mac address aa bb cc dd ee ff vlan id 10 port number 1 0 5 and enable this entry for the arp detection feature 592
• U no host ip addr mac addr vid port acl col 592
• On privileged exec mode or any other configuration mode you can use the following command to view binding entries 593
• Viewing binding entries 593
• Dhcp snooping configuration 594
• Enabling dhcp snooping on vlan 594
• Using the gui 594
• Click apply 595
• Configuring dhcp snooping on ports 595
• Follow these steps to configure dhcp snooping on the specified port 595
• Port config to load the following page 595
• Select one or more ports and configure the parameters 595
• Click apply 596
• Follow these steps to configure option 82 596
• Option 82 config to load the following page 596
• Option 82 records the location of the dhcp client the switch can add option 82 to the dhcp request packet and then transmit the packet to the dhcp server administrators can check the location of the dhcp client via option 82 the dhcp server supporting option 82 can also set the distribution policy of ip addresses and other parameters providing a more flexible address distribution way 596
• Optional configuring option 82 596
• Select one or more ports and configure the parameters 596
• Click apply 597
• Enabling dhcp snooping on vlan 597
• Follow these steps to globally configure dhcp snooping 597
• Using the cli 597
• Configuring dhcp snooping on ports 598
• Follow these steps to configure dhcp snooping on the specified ports 598
• Global status enable 598
• Switch config if end 598
• Switch config ip dhcp snooping 598
• Switch config ip dhcp snooping vlan 5 598
• Switch config show ip dhcp snooping 598
• Switch configure 598
• Switch copy running config startup config 598
• The following example shows how to enable dhcp snooping globally and on vlan 5 598
• Vlan id 5 598
• Gi1 0 1 enable enable 10 20 n a 599
• Interface trusted mac verify limit rate dec rate lag 599
• Switch config if end 599
• Switch config if ip dhcp snooping decline rate 20 599
• Switch config if ip dhcp snooping limit rate 10 599
• Switch config if ip dhcp snooping mac verify 599
• Switch config if ip dhcp snooping trust 599
• Switch config if show ip dhcp snooping interface gigabitethernet 1 0 1 599
• Switch config interface gigabitethernet 1 0 1 599
• Switch configure 599
• Switch copy running config startup config 599
• The following example shows how to configure port 1 0 1 as a trusted port enable the mac verify feature and set the limit rate as 10 pps and decline rate as 20 pps on this port 599
• Follow these steps to configure option 82 600
• Option 82 records the location of the dhcp client the switch can add the option 82 to the dhcp request packet and then transmit the packet to the dhcp server administrators can check the location of the dhcp client via option 82 the dhcp server supporting option 82 can also set the distribution policy of ip addresses and other parameters providing more flexible address distribution way 600
• Optional configuring option 82 600
• Arp inspection configurations 602
• Configuring arp detection 602
• Using the gui 602
• Arp defend to load the following page 603
• Configuring arp defend 603
• Follow these steps to configure arp defend 603
• Select one or more ports and configure the parameters 603
• With arp defend enabled the switch can terminate receiving the arp packets for 300 seconds when the transmission speed of the legal arp packet on the port exceeds the defined value so as to avoid arp attack flood 603
• Arp statistics to load the following page 604
• Click apply 604
• In the auto refresh section you can enable the auto refresh feature and specify the refresh interval and thus the web page will be automatically refreshed 604
• Viewing arp statistics 604
• You can view the number of the illegal arp packets received on each port which facilitates you to locate the network malfunction and take the related protection measures 604
• Configuring arp detection 605
• Follow these steps to configure arp detection 605
• In the illegal arp packet section you can view the number of illegal arp packets on each port 605
• Switch configure 605
• The arp detection feature allows the switch to detect the arp packets basing on the binding entries in the ip mac binding table and filter the illegal arp packets before configuring arp detection complete ip mac binding configuration for details refer to ip mac binding configurations 605
• The following example shows how to globally enable arp detection and configure port 1 0 1 as a trusted port 605
• Using the cli 605
• Arp detection global status enabled 606
• Configuring arp defend 606
• Follow these steps to configure arp defend 606
• Gi1 0 1 yes 606
• Gi1 0 2 no 606
• Port trusted 606
• Switch config if end 606
• Switch config if ip arp inspection trust 606
• Switch config if show ip arp inspection 606
• Switch config interface gigabitethernet 1 0 1 606
• Switch config ip arp inspection 606
• Switch copy running config startup config 606
• With arp defend enabled the switch can terminate receiving the arp packets for 300 seconds when the transmission speed of the legal arp packet on the port exceeds the defined value so as to avoid arp attack flood 606
• Gi1 0 1 disabled 15 n a normal n a 608
• On privileged exec mode or any other configuration mode you can use the following command to view arp statistics 608
• Port overspeed rate current status lag 608
• Switch config if end 608
• Switch copy running config startup config 608
• Viewing arp statistics 608
• Dos defend configuration 609
• Follow these steps to configure dos defend 609
• In the configure section enable dos protection 609
• In the defend table section select one or more defend types according to your needs the following table introduces each type of dos attack 609
• Using the gui 609
• Click apply 610
• Follow these steps to configure dos defend 610
• Using the cli 610
• Configuring the radius server 613
• Using the gui 613
• X configuration 613
• Adding the radius server 614
• Click apply 614
• Configuring the radius server group 614
• Follow these steps to create a protocol template 614
• In the server config section configure the parameters of radius server 614
• Radius config to load the following page 614
• You can configure the radius servers for authentication and accounting if multiple radius servers are available you are suggested to add them to different server groups respectively for authentication and accounting 614
• Configuring 802 x globally 617
• Follow these steps to configure 802 x global parameters 617
• Global config to load the following page 617
• In the global config section enable 802 x globally and click apply 617
• In the authentication config section enable quiet configure the quiet timer and click apply 618
• Configure 802 x authentication on the desired port and click apply 619
• Configuring 802 x on ports 619
• Port config to load the following page 619
• Configuring the radius server 620
• Follow these steps to configure radius 620
• Using the cli 620
• The following example shows how to enable aaa add a radius server to the server group named radius1 and apply this server group to the 802 x authentication the ip address of the radius server is 192 68 00 the shared key is 123456 the authentication port is 1812 the accounting port is 1813 621
• Configuring 802 x globally 622
• Configuring 802 x on ports 624
• Switch configure 625
• The following example shows how to enable 802 x authentication on port 1 0 2 configure the control type as port based and configure the control mode as auto 625
• Aaa configuration 627
• Configuration guidelines 627
• Adding servers 628
• Globally enabling aaa 628
• Using the gui 628
• Adding tacacs server 629
• Click add to add the radius server on the switch 629
• Follow these steps to add a radius server 629
• Follow these steps to add a tacacs server 629
• In the server config section configure the following parameters 629
• Tacacs conifg to load the following page 629
• Configuring server groups 630
• Configuring the method list 631
• Click add to add the new method 632
• In the add method list section configure the parameters for the method to be added 632
• Method list to load the following page 632
• There are two default methods respectively for the login authentication and the enable authentication 632
• You can edit the default methods or follow these steps to add a new method 632
• Configuring login account and enable password 633
• Configuring the aaa application list 633
• Globally enabling aaa 634
• Using the cli 634
• Aaa global status enable 635
• Adding radius server 635
• Adding servers 635
• Follow these steps to add radius server on the switch 635
• Switch config aaa enable 635
• Switch config end 635
• Switch config show aaa global 635
• Switch configure 635
• Switch copy running config startup config 635
• You can add one or more radius tacacs servers on the switch for authentication if multiple servers are added the server with the highest priority authenticates the users trying to access the switch and the others act as backup servers in case the first one breaks down 635
• 68 0 49 8 123456 637
• Server ip port timeout shared key 637
• Switch config end 637
• Switch config show tacacs server 637
• Switch config tacacs server host 192 68 0 auth port 49 timeout 8 key 123456 637
• Switch configure 637
• Switch copy running config startup config 637
• The following example shows how to add a tacacs server on the switch set the ip address of the server as 192 68 0 the authentication port as 49 the shared key as 123456 and the timeout as 8 seconds 637
• Configuring server groups 638
• Switch aaa group server 192 68 0 638
• Switch aaa group show aaa group radius1 638
• Switch config aaa group radius radius1 638
• Switch configure 638
• The following example shows how to create a radius server group named radius1 and add the existing two radius servers whose ip address is 192 68 0 and 192 68 0 to the group 638
• The switch has two built in server groups one for radius and the other for tacacs the servers running the same protocol are automatically added to the default server group you can add new server groups as needed 638
• The two default server groups cannot be deleted or edited follow these steps to add a server group 638
• A method list describes the authentication methods and their sequence to authenticate the users the switch supports login method list for users of all types to gain access to the switch and enable method list for guests to get administrative privileges 639
• Configuring the method list 639
• Follow these steps to configure the method list 639
• Switch aaa group end 639
• Switch config aaa authentication login login1 radius local 639
• Switch config show aaa authentication login 639
• Switch configure 639
• Switch copy running config startup config 639
• The following example shows how to create a login method list named login1 and configure the method 1 as the default radius server group and the method 2 as local 639
• Configuring the aaa application list 640
• Follow these steps to apply the login and enable method lists for the application ssh 641
• Http default default 641
• Module login list enable list 641
• Ssh default default 641
• Switch config line enable authentication enable1 641
• Switch config line end 641
• Switch config line login authentication login1 641
• Switch config line show aaa global 641
• Switch config line telnet 641
• Switch configure 641
• Switch copy running config startup config 641
• Telnet login1 enable1 641
• The following example shows how to apply the existing login method list named login1 and enable method list named enable1 for the application telnet 641
• Follow these steps to apply the login and enable method lists for the application http 642
• Http default default 642
• Module login list enable list 642
• Ssh login1 enable1 642
• Switch config line enable authentication enable1 642
• Switch config line end 642
• Switch config line login authentication login1 642
• Switch config line show aaa global 642
• Switch config line ssh 642
• Switch configure 642
• Switch copy running config startup config 642
• Telnet default default 642
• The following example shows how to apply the existing login method list named login1 and enable method list named enable1 for the application ssh 642
• Configuring login account and enable password 643
• Http login1 enable1 643
• Module login list enable list 643
• Ssh default default 643
• Switch config end 643
• Switch config ip http enable authentication enable1 643
• Switch config ip http login authentication login1 643
• Switch config show aaa global 643
• Switch configure 643
• Switch copy running config startup config 643
• Telnet default default 643
• The following example shows how to apply the existing login method list named login1 and enable method list named enable1 for the application http 643
• The login account and enable password can be configured locally on the switch or centrally on the radius tacacs server s 643
• For enable password configuration 644
• For login authentication configuration more than one login account can be created on the server besides both the user name and password can be customized 644
• On radius server the user name should be set as enable and the enable password is customizable all the users trying to get administrative privileges share this enable password 644
• On the server 644
• On the switch 644
• Some configuration principles on the server are as follows 644
• The accounts created by the radius tacacs server can only view the configurations and some network information without the enable password 644
• The local username and password for login can be configured in the user management feature for details refer to managing system 644
• To configure the local enable password for getting administrative privileges follow these steps 644
• Configuration examples 646
• Configuration scheme 646
• Example for dhcp snooping and arp detection 646
• Network requirements 646
• Using the gui 647
• Using the cli 650
• Verify the configuration 651
• Configuration scheme 652
• Example for 802 x 652
• Network requirements 652
• Network topology 653
• Using the gui 653
• Using the cli 656
• Verify the configurations 657
• Example for aaa 658
• Network requirements 658
• Configuration scheme 659
• Using the gui 659
• Using the cli 662
• Verify the configuration 663
• Appendix default parameters 665
• Default settings of network security are listed in the following tables 665
• Chapters 669
• Configuring lldp 669
• Part 21 669
• Overview 670
• Supported features 670
• Global config 671
• Lldp configurations 671
• Using the gui 671
• Follow these steps to enable lldp and configure the lldp feature globally 672
• In the global config section enable lldp you can also enable the switch to forward lldp messages when lldp function is disabled click apply 672
• In the parameters config section configure the lldp parameters click apply 672
• Follow these steps to configure the lldp feature for the interface 673
• Policy config to load the following page 673
• Port config 673
• Select the desired port and set its admin status and notification mode 673
• Select the tlvs type length value included in the lldp packets according to your needs 673
• Enable the lldp feature on the switch and configure the lldp parameters 674
• Global config 674
• Optional configure the port s management address for identifying the devices 674
• Using the cli 674
• Lldp status enabled 675
• Switch config lldp 675
• Switch config lldp hold multiplier 4 675
• Switch config lldp timer tx interval 30 tx delay 2 reinit delay 3 notify interval 5 fast count 3 675
• Switch config show lldp 675
• Switch configure 675
• The following example shows how to configure the following parameters lldp timer 4 tx interval 30 seconds tx delay 2 seconds reinit delay 3 seconds notify iinterval 5 seconds fast count 3 675
• Fast packet count 3 676
• Initialization delay 2 seconds 676
• Lldp forward message disabled 676
• Lldp med fast start repeat count 4 676
• Port config 676
• Select the desired port and set its admin status notification mode and the tlvs included in the lldp packets 676
• Switch config end 676
• Switch copy running config startup config 676
• Trap notification interval 5 seconds 676
• Ttl multiplier 4 676
• Tx delay 2 seconds 676
• Tx interval 30 seconds 676
• Global config 679
• Lldp med configurations 679
• Using the gui 679
• Port config 680
• Global config 682
• Lldp status enabled 682
• Switch config lldp 682
• Switch config lldp med fast count 4 682
• Switch config show lldp 682
• Switch configure 682
• The following example shows how to configure lldp med fast count as 4 682
• Tx interval 30 seconds 682
• Using the cli 682
• Fast packet count 3 683
• Initialization delay 2 seconds 683
• Lldp med fast start repeat count 4 683
• Port config 683
• Select the desired port enable lldp med and select the tlvs type length value included in the outgoing lldp packets according to your needs 683
• Switch config end 683
• Switch copy running config startup config 683
• Trap notification interval 5 seconds 683
• Ttl multiplier 4 683
• Tx delay 2 seconds 683
• Using gui 686
• Viewing lldp device info 686
• Viewing lldp settings 686
• Follow these steps to view the local information 687
• In the auto refresh section enable the auto refresh feature and set the refresh rate according to your needs click apply 687
• In the local info section select the desired port and view its associated local device information 687
• Viewing lldp statistics 689
• Using cli 690
• Viewing lldp statistics 690
• Viewing the local info 690
• Viewing the neighbor info 690
• Using gui 691
• Viewing lldp med settings 691
• Follow these steps to view lldp med neighgbor information 692
• In the auto refresh section enable the auto refresh feature and set the refresh rate according to your needs click apply 692
• In the lldp med neighbor info section select the desired port and view the lldp med settings 692
• Viewing the neighbor info 692
• Using cli 693
• Viewing lldp statistics 693
• Viewing the local info 693
• Viewing the neighbor info 693
• Configuration example 694
• Configuration scheme 694
• Example for configuring lldp 694
• Network requirements 694
• Network topology 694
• Using the gui 694
• Using cli 695
• Verify the configurations 696
• Configuration scheme 701
• Example for configuring lldp med 701
• Network requirements 701
• Network topology 701
• Using the gui 702
• Using the cli 706
• Verify the configurations 707
• Appendix default parameters 713
• Default lldp med settings 713
• Default lldp settings 713
• Default settings of lldp are listed in the following tables 713
• Chapters 714
• Configuring maintenance 714
• Part 22 714
• Device diagnose 715
• Maintenance 715
• Network diagnose 715
• Overview 715
• Supported features 715
• System monitor 715
• Monitoring the cpu 716
• Monitoring the system 716
• Using the gui 716
• Monitoring the memory 717
• Monitoring the cpu 718
• Monitoring the memory 718
• Using the cli 718
• Backing up log files 719
• Configuration guidelines 719
• Configuring the local log 719
• Configuring the remote log 719
• Logs are classified into the following eight levels messages of levels 0 to 4 mean the functionality of the switch is affected please take actions according to the log message 719
• System log configurations 719
• System log configurations include 719
• Viewing the log table 719
• Click apply 720
• Configuring the local log 720
• Follow these steps to configure the local log 720
• Local log to load the following page 720
• Select your desired channel and configure the corresponding severity and status 720
• Using the gui 720
• Backing up the log file 721
• Configuring the remote log 721
• Configuring the local log 722
• Follow these steps to configure the local log 722
• Log table to load the following page 722
• Select a module and a severity to view the corresponding log information 722
• Using the cli 722
• Viewing the log table 722
• Switch config logging buffer 723
• Switch config logging buffer level 5 723
• Switch config logging file flash 723
• Switch config logging file flash frequency periodic 10 723
• Switch configure 723
• The following example shows how to configure the local log on the switch save logs of levels 0 to 5 to the log buffer and synchronize logs of levels 0 to 2 to the flash every 10 hours 723
• Buffer 5 enable immediately 724
• Channel level status sync periodic 724
• Configuring the remote log 724
• Flash 2 enable 10 hour s 724
• Follow these steps to set the remote log 724
• Monitor 5 enable immediately 724
• Remote log enables the switch to send system logs to a host to display the logs the host should run a log server that complies with the syslog standard 724
• Switch config end 724
• Switch config logging file flash level 2 724
• Switch config show logging local config 724
• Switch copy running config startup config 724
• Cable test to load the following page 726
• Diagnosing the device 726
• In the port section select your desired port for the test 726
• In the result section click apply and check the test results 726
• Using the gui 726
• Gi1 0 2 pair a normal 2 10m 727
• On privileged exec mode or any other configuration mode you can use the following command to check the connection status of the cable that is connected to the switch 727
• Pair b normal 2 10m 727
• Pair c normal 0 10m 727
• Pair d normal 2 10m 727
• Port pair status length error 727
• Switch show cable diagnostics interface gigabitehternet 1 0 2 727
• The following example shows how to check the cable diagnostics of port 1 0 2 727
• Using the cli 727
• Configuring the ping test 728
• Diagnosing the network 728
• Using the gui 728
• Configuring the tracert test 729
• Follow these steps to test connectivity between the switch and routers along the path from the source to the destination 729
• In the ping result section check the test results 729
• In the tracert config section enter the ip address of the destination set the max hop and then click tracert to start the test 729
• In the tracert result section check the test results 729
• Tracert to load the following page 729
• Approximate round trip times in milli seconds 730
• Configuring the ping test 730
• Minimum 0ms maximum 0ms average 0ms 730
• On privileged exec mode or any other configuration mode you can use the following command to test the connectivity between the switch and one node of the network 730
• Packets sent 3 received 3 lost 0 0 loss 730
• Ping statistics for 192 68 0 730
• Pinging 192 68 0 with 1000 bytes of data 730
• Reply from 192 68 0 bytes 1000 time 16ms ttl 64 730
• Switch ping ip 192 68 0 n 3 l 1000 i 500 730
• The following example shows how to test the connectivity between the switch and the destination device with the ip address 192 68 0 specify the ping times as 3 the data size as 1000 bytes and the interval as 500 milliseconds 730
• Using the cli 730
• Configuring the tracert test 731
• Ms 1 ms 2 ms 192 68 731
• Ms 2 ms 2 ms 192 68 00 731
• On privileged exec mode or any other configuration mode you can use the following command to test the connectivity between the switch and routers along the path from the source to the destination 731
• Switch tracert 192 68 00 2 731
• The following example shows how to test the connectivity between the switch and the network device with the ip address 192 68 00 set the maxhops as 2 731
• Trace complete 731
• Tracing route to 192 68 00 over a maximum of 2 hops 731
• Configuration scheme 732
• Example for configuring remote log 732
• Network requirements 732
• Using the gui 732
• Using the cli 733
• Verify the configurations 733
• Appendix default parameters 734
• Default settings of maintenance are listed in the following tables 734
• Chapters 735
• Configuring snmp rmon 735
• Part 23 735
• Snmp overview 736
• Snmp simple network management protocol is a standard network management protocol widely used on tcp ip networks it facilitates device management using nms network management system software with snmp network managers can view or modify network device information and troubleshoot according to notifications sent by those devices in a timely manner 736
• The device supports three snmp versions snmpv1 snmpv2c and snmpv3 table 1 1 lists features supported by different snmp versions and table 1 2 shows corresponding application scenarios 736
• Snmp configurations 737
• Creating an snmp view 738
• Enabling snmp 738
• Using the gui 738
• Create an snmp group and configure related parameters 739
• Creating an snmp group 739
• Set the view name and one mib variable that is related to the view choose the view type and click create to add the view entry 739
• Follow these steps to create an snmp group 740
• Set the group name and security model if you choose snmpv3 as the security model you need to further configure security level 740
• Set the read write and notify view of the snmp group click create 740
• Snmp group to load the following page 740
• Creating snmp users 741
• Follow these steps to create an snmp user 741
• Snmp user to load the following page 741
• Specify the user name user type and the group which the user belongs to set the security model according to the related parameters of the specified group if you choose snmpv3 you need to configure the security level 741
• Click create 742
• Creating snmp communities 742
• If you have chosen authnopriv or authpriv as the security level you need to set corresponding auth mode or privacy mode if not skip the step 742
• If you want to use snmpv1 or snmpv2c as the security model you can create snmp communities directly 742
• Enabling snmp 743
• Set the community name access rights and the related view click create 743
• Snmp community to load the following page 743
• Using the cli 743
• Bad snmp version errors 744
• Encoding errors 744
• Get request pdus 744
• Illegal operation for community name supplied 744
• Number of altered variables 744
• Number of requested variables 744
• Snmp agent is enabled 744
• Snmp packets input 744
• Switch config show snmp server 744
• Switch config snmp server 744
• Switch config snmp server engineid remote 123456789a 744
• Switch configure 744
• The following example shows how to enable snmp and set 123456789a as the remote engine id 744
• Unknown community name 744
• Bad value errors 745
• Creating an snmp view 745
• General errors 745
• Get next pdus 745
• Local engine id 80002e5703000aeb132397 745
• No such name errors 745
• Remote engine id 123456789a 745
• Response pdus 745
• Set request pdus 745
• Snmp packets output 745
• Specify the oid object identifier of the view to determine objects to be managed 745
• Switch config end 745
• Switch config show snmp server engineid 745
• Switch copy running config startup config 745
• Too big errors maximum packet size 1500 745
• Trap pdus 745
• Creating an snmp group 746
• No name sec mode sec lev read view write view notify view 1 nms monitor v3 authpriv view view 747
• Switch config end 747
• Switch config show snmp server group 747
• Switch config snmp server group nms monitor smode v3 slev authpriv read view notify view 747
• Switch configure 747
• Switch copy running config startup config 747
• The following example shows how to create an snmpv3 group name the group as nms monitor enable auth mode and privacy mode and set the view as read view and notify view 747
• Configure users of the snmp group users belong to the group and use the same security level and access rights as the group 748
• Creating snmp users 748
• The following example shows how to create an snmp user on the switch name the user as admin and set the user as a remote user snmpv3 as the security mode authpriv as the 748
• Admin remote nms monitor v3 authpriv sha des 749
• Creating snmp communities 749
• For snmpv1 and snmpv2c the community name is used for authentication functioning as the password 749
• No u name u type g name s mode s lev a mode p mode 749
• Security level sha as the authentication algorithm 1234 as the authentication password des as the privacy algorithm and 1234 as the privacy password 749
• Switch config end 749
• Switch config show snmp server user 749
• Switch config snmp server user admin remote nms monitor smode v3 slev authpriv cmode sha cpwd 1234 emode des epwd 1234 749
• Switch configure 749
• Switch copy running config startup config 749
• The following example shows how to set an snmp community name the community as the nms monitor and allow the nms to view and modify parameters of view 749
• Configuration guidelines 751
• Notification configurations 751
• Using the gui 751
• Choose a notification type based on the snmp version if you choose the inform type you need to set retry times and timeout interval 752
• Click create 752
• Specify the user name or community name used by the nms and configure the security model and security level based on the settings of the user or community 752
• Configure parameters of the nms host and packet handling mechanism 753
• Configuring the host 753
• Using the cli 753
• 68 22 162 admin v3 authpriv inform 3 100 754
• Enabling snmp notification 754
• Enabling the snmp standard trap 754
• No des ip udp name secmode seclev type retry timeout 754
• Switch config end 754
• Switch config show snmp server host 754
• Switch config snmp server host 172 68 22 162 admin smode v3 slev authpriv type inform retries 3 timeout 100 754
• Switch configure 754
• Switch copy running config startup config 754
• The following example shows how to set the nms host ip address as 172 68 22 udp port as port 162 name used by the nms as admin security model as snmpv3 security level as authpriv notification type as inform retry times as 3 and the timeout interval as 100 seconds 754
• Optional enabling the snmp extended trap 755
• Switch config end 755
• Switch config snmp server traps snmp linkup 755
• Switch configure 755
• Switch copy running config startup config 755
• The following example shows how to configure the switch to send linkup traps 755
• Switch config end 756
• Switch config snmp server traps bandwidth control 756
• Switch configure 756
• Switch copy running config startup config 756
• The following example shows how to configure the switch to enable bandwidth control traps 756
• Optional enabling the ddm trap 757
• Switch config end 757
• Switch config snmp server traps ddm create 757
• Switch configure 757
• Switch copy running config startup config 757
• The following example shows how to configure the switch to enable ddm created trap 757
• Optional enabling the illegal dhcp server trap 758
• Optional enabling the link status trap 758
• Switch config end 758
• Switch config snmp server traps ddm 758
• Switch config snmp server traps security dhcp snoop 758
• Switch configure 758
• Switch copy running config startup config 758
• The following example shows how to configure the switch to enable all the snmp ddm trap 758
• The following example shows how to configure the switch to enable illegal dhcp server trap 758
• Switch config if end 759
• Switch config if snmp server traps link status 759
• Switch config interface gigabitethernet 1 0 1 759
• Switch configure 759
• Switch copy running config startup config 759
• The following example shows how to configure the switch to enable link status trap 759
• Rmon overview 760
• Configuring statistics 761
• Rmon configurations 761
• Using the gui 761
• Configuring history 762
• Follow these steps to configure history 762
• History to load the following page 762
• Select a history entry and specify a port to be monitored 762
• Set the sample interval and the maximum buckets of history entries 762
• Specify the entry id the port to be monitored and the owner name of the entry set the entry as valid or undercreation and click create 762
• Choose an event entry and set the snmp user of the entry 763
• Configuring event 763
• Enter the owner name and set the status of the entry click apply 763
• Event to load the following page 763
• Follow these steps to configure event 763
• Set the description and type of the event 763
• Alarm to load the following page 764
• Before you begin please complete configurations of statistics entries and event entries because the alarm entries must be associated with statistics and event entries 764
• Configuring alarm 764
• Enter the owner name and set the status of the entry click apply 764
• Follow these steps to configure alarm 764
• Select an alarm entry choose a variable to be monitored and associate the entry with a statistics entry 764
• Set the sample type the rising and falling threshold the corresponding event action and the alarm type of the entry 765
• Configuring statistics 766
• Enter the owner name and set the status of the entry click apply 766
• Using the cli 766
• Configuring history 767
• Gi1 0 1 monitor valid 767
• Gi1 0 2 monitor valid 767
• Index port owner state 767
• Switch config end 767
• Switch config rmon statistics 1 interface gigabitethernet 1 0 1 owner monitor status valid 767
• Switch config rmon statistics 2 interface gigabitethernet 1 0 2 owner monitor status valid 767
• Switch config show rmon statistics 767
• Switch configure 767
• Switch copy running config startup config 767
• The following example shows how to create two statistics entries on the switch to monitor port 1 0 1 and 1 0 2 respectively the owner of the entry is monitor and the entry is valid 767
• Configuring event 768
• Gi1 0 1 100 50 monitor enable 768
• Index port interval buckets owner state 768
• Switch config end 768
• Switch config rmon history 1 interface gigabitethernet 1 0 1 interval 100 owner monitor buckets 50 768
• Switch config show rmon history 768
• Switch configure 768
• Switch copy running config startup config 768
• The following example shows how to create a history entry on the switch to monitor port 1 0 1 set the sample interval as 100 seconds max buckets as 50 and the owner as monitor 768
• Admin rising notify notify monitor enable 769
• Index user description type owner state 769
• Switch config end 769
• Switch config rmon event 1 user admin description rising notify type notify owner monitor 769
• Switch config show rmon event 769
• Switch configure 769
• Switch copy running config startup config 769
• The following example shows how to create an event entry on the switch set the user name as admin the event type as notify set the switch to initiate notifications to the nms and the owner as monitor 769
• Configuring alarm 770
• Configuration example 772
• Configuration scheme 772
• Network requirements 772
• Network topology 773
• Using the gui 773
• Using the cli 778
• Verify the configurations 780
• Appendix default parameters 784
• Default settings of snmp are listed in the following table 784
• Default settings of notification are listed in the following table 785
• Ce mark warning 788
• Copyright trademarks 788
• Fcc statement 788
• Industry canada statement 788
• Bsmi notice 789
• Ce doc 789
• Safety information 789
• Explanation of the symbols on the product label 790