![Qtech QSW-2800v2 [155/230] Chapter7](/img/pdf.png)
Qtech QSW-2800v2 [155/230] Chapter7
![Qtech QSW-2800v2 [155/230] Chapter7](/views2/1596593/page155/bg9b.png)
Chapter7 Security Configuration
7-1
Chapter7
Security Configuration
7.1 Summary
This chapter mainly introduces related security configuration of QSW-2800 including
802.1x, AAA, RADIUS, ACL configuration and etc.
This chapter includes the following section.
Content
Page
7.1 Summary
7-1
7.2 ACL Configuration
7-1
7.2 ACL Configuration
In this section, ACL means access control list for IPv4 message, ACL6 means access control list for
IPv6 message.
7.2.1 ACL Introduction
ACL Function
User can configure rules and action of ACL (Access Control List) to determine which
kind of data is allowed to pass or to deny so as to control data transmission and to
improve network performance and guarantee service security.
ACL is a series of sequential rules and action composed of layer2 MAC and layer3 IP.
Using the rules to filter data packet according to the source and destination address
and port number of data. Applying ACL to QSW-2800, device determines which data
to be received or to deny and other action to deal with the data according the rules of
ACL.
ACL classification supported of QSW-2800
QSW-2800 supports Layer2 ACL, Layer3 ACL, Mixed ACL and Layer3 ACL6.
Note:
Содержание
- Layer 2 ethernet switch 1
- Qsw 2800 1
- Content introduction 2
- Customers who are familiar with network fundamentals 2
- Ethernet switch telecommunication level hereinafter referred to as the qsw 2800 2
- From the simple principle function configuration step and configuration example in 2
- Including the basic configuration the two layers configuration operation of the qsw 2
- Intended audience 2
- Ip service qos configuration multicasting security reliability device 2
- Management and network management etc the above operation are introduced 2
- Manual instruction 2
- Method of qsw 2800 and understand its application scenarios more specialized 2
- Network administrators 2
- Network engineers 2
- Of various functional modules and service operation guidelines based on cli 2
- Preface 2
- Professional to use maintenance and management of qsw 2800 2
- The manual is intended for the following readers 2
- This manual introduces the qsw 2800 series carrier class layer 2 full giga 2
- Three ways the configuration operation helps user to master the configuration 2
- General format 3
- Introduce general format symbol convention keyboard mouse operation and safety 3
- Keyboard operation convention 3
- Manual convention 3
- Release update instruction 3
- Symbol convention 3
- Brackets 4
- Caused by possible pretermission inaccuracy or error in this manual 4
- Contents however does not take any legal responsibility of any loss or damage 4
- During operation installation or maintenance 4
- Legal disclaimer 4
- Mouse operation convention 4
- Qtech co commits itself to ensure accuracy fidelity and reliability to the manual 4
- Safety signs 4
- This manual utilizes general 3 safety signs to emphasis significances 4
- Table of contents 5
- Figure 10
- Basic configuration 12
- Chapter1 12
- Interface introduction 12
- Management interface 12
- Summary 12
- Login switch 13
- Login through console port 13
- Physical interface 13
- Parameter description when logging qsw 2800 switch through serial 15
- Please set the parameters according to table shown in table 1 1 15
- Property setting of qsw 2800 switch 15
- Result 15
- Serial port setting please perform the settings according to serial port 15
- To confirm 15
- Admin and password is 12345 16
- Login through telnet 16
- Login through ssh 17
- Generate ssh private public key 2 23
- Menu of the dialog and click next for confirmation referring to figure 23
- Select generation method by choosing dsa or rsa from the drop down 23
- Click next button if the generation is finished referring to figure 25
- Generate ssh private public key 5 25
- The generation of private public key will be displayed in the pop up dialog 25
- Category taking the admin user category as the example 27
- Button ok referring to figure ssh login parameters input 2 29
- During the creation of public key dialog i e value in step 4 and click 29
- From the pop up dialog input the passphrase that has been defined 29
- Keygen sshd auth ssh login metho 29
- Result 29
- Device file upload and download 30
- Ftp configuration 30
- According to the different purposes execute corresponding step please refer to the 32
- Appended list 32
- Following table 32
- Ftp download file 32
- Process 32
- Purpose 32
- This section introduces how to download file through ftp 32
- According to the different purposes execute corresponding step please refer to the 33
- Appended list 33
- Following table 33
- According to the different purposes execute corresponding step please refer to the 34
- Appended list 34
- Following table 34
- Ftp delete file 34
- Process 34
- Purpose 34
- This section introduces how to delete file through ftp 34
- Fetch switch config file 36
- File config from the switch the ftp client application shall be purchased and 36
- Installed by the user 36
- Notice 36
- Start ftp client program at pc and establish ftp connection with the switch 36
- Upgrade operation to the switch after the upload is finished 36
- Upload switch application switch z to switch flash root and download configuration 36
- Username and password configuration through command adduser 36
- Able to log into remote qsw 2800 switch via telnet and download switch application 37
- Backup and software upgrade 37
- Boot up and reboot the switch that the switch is able to implement auto upgrade to its 37
- From the ftp server to switch flash so that to implement remote upgrade to the 37
- Ftp client example 37
- Ftp with username 123 and password 123 pc ip address is 10 8 the user is 37
- Network requirement 37
- Purpose 37
- Remote pc as ftp server and the switch as ftp client with configuration 37
- Switch 37
- The user is able to use command upgrade os as auto start application for next switch 37
- This section introduces the example of switch as ftp client implementing config file 37
- Topology 37
- Tftp configuration 38
- According to the different purposes execute corresponding step please refer to the 39
- Address ipv4 and ipv6 39
- Addresses of tftp client side and server side and make sure that the routing 39
- Before tftp configuration the network administrator needs to configure ip 39
- Between client and server is available 39
- Configure tftp server on off 39
- Following table 39
- Process 39
- Purpose 39
- The qsw 2800 switch supports tftp functionality under two types of network 39
- This section introduces how to open or close tftp server of the switch 39
- According to the different purposes execute corresponding step please refer to the 40
- Confirmation from it the following commands can be applied for file upload 40
- Following table 40
- Notice 40
- Parameter description 40
- Process 40
- Purpose 40
- Request packet towards tftp server and sends data to the server along with 40
- Tftp upload file 40
- When the switch needs to upload file to tftp server the switch as client side sends 40
- According to the different purposes execute corresponding step please refer to the 41
- Following table 41
- Notice 41
- Os is downloaded from the host to the device for config modification or os upgrade 41
- Practical device operation and maintenance it is usually required that the config file or 41
- Process 41
- Purpose 41
- Server and receives data from the server along with configuration towards it in 41
- Tftp download file 41
- The command is applied for file downloading to the device 41
- When file download is required the client side sends request packet to the tftp 41
- Application program switch z is saved in the pc the switch downloads 42
- Backup and software upgrade 42
- Connecting with switch and pc is belonging to particular vlan pc ip address is 42
- Network requirement 42
- Parameter description 42
- Purpose 42
- Switch z from tftp server through the tftp and uploads switch config file to 42
- Tftp client example 42
- The switch as tftp client and pc as tftp server the tftp server has been tftp 42
- This section introduces the example of switch as tftp client implementing config file 42
- Working category configured inband switch ip address is 1 and the port 42
- Zmodem configuration 43
- According to the different purposes execute corresponding step please refer to the 45
- Appended list 45
- Following table 45
- Process 45
- Section 45
- To implement file download through device serial port with operation introduced in this 45
- Chapter2 46
- Ethernet interface configuration 46
- Layer 2 ethernet configuration 46
- Summary 46
- According to the different purposes execute corresponding step please refer to the 47
- Background 47
- Enter the ethernet interface view 47
- Ethernet interface 47
- Ethernet interface basic attribute configuration 47
- Following table 47
- It needs to enter the ethernet interface configuration view first and then configure the 47
- Open shutdown ethernet interface 47
- Procedure 47
- According to the different purposes execute corresponding step please refer to the 48
- Background 48
- Before using the command the command negotiation auto must be used to 48
- Can be provisioned as full duplex mode if port receiving and sending data packet is 48
- Configure ethernet interface duplex state 48
- Following table 48
- From the device as info please configure negotiation auto disable first 48
- If it is required that the port is able to receive data packet while sending then the port 48
- Implement that only when the fast ethernet port is working under non auto negotiation 48
- Mode that it can be configured as port duplex mode otherwise there will be prompt 48
- Negotiated by both the local port and peer port 48
- Precondition 48
- Procedure 48
- Required to be separated then it can be provisioned as half duplex mode similarly if 48
- The port is configured as auto negotiation the duplex mode can be automatically 48
- According to the different purposes execute corresponding step please refer to the 49
- And determined by both the local port and peer port 49
- Background 49
- Configure ethernet interface flow control 49
- Configure ethernet interface rate 49
- Congestion happens to local switch on the other side the peer switch will stop 49
- Following table 49
- Longer send flow control frame to peer 49
- Message sending to local switch once it receives the inform message and vice versa 49
- Procedure 49
- Rate provisioned is working under auto negotiation mode its rate is auto negotiated 49
- Sends message to peer switch to inform peer switch to stop sending message if 49
- The following command can be used to set the ethernet port rate when the port to be 49
- The mechanism is able to avoid message loss the following command can be used 49
- To enable or disable local ethernet port flow control once disabled the port will no 49
- When local and peer switches both start function of flow control the local switch 49
- According to the different purposes execute corresponding step please refer to the 50
- Configure ethernet interface broadcast multicast message suppression function 50
- Following table 50
- In order to prevent port congestion caused by flush of broadcast multicast message 50
- Procedure 50
- Purpose 50
- The command 50
- The switch provides storm suppression function to broadcast multicast message the 50
- User is allowed to restrain broadcast multicast message by configuring bandwidth via 50
- According to the different purposes execute corresponding step please refer to the 51
- Background 51
- Configure ethernet interface rate suppression function 51
- Different due to different interface type 51
- Following table 51
- Procedure 51
- Provide different bandwidth for different users the function of rate suppression 51
- Provides such ability the particular input output bandwidth control granularity may be 51
- There are particular situations that port rate is required to be controlled so that to 51
- According to the different purposes execute corresponding step please refer to the 52
- Background 52
- By configuring the priority of different interfaces it assures that the most important 52
- Command to configure the frame size 52
- Configure ethernet interface mtu 52
- Configure ethernet interface priority 52
- Ethernet _snap form is 1492 52
- Following table 52
- Or packet disassembly the mtu of using ethernet _ii form is 1500 the mtu of using 52
- Procedure 52
- Running at the same time 52
- Service cannot be influenced by delay or discard and guarantees the network efficient 52
- The long frame more than the standard ethernet frame length use the following 52
- The mtu of ethernet interface only influences the ip packaging on ethernet interface 52
- When exchanging data in high throughput such as file transmission it may encounter 52
- According to the different purposes execute corresponding step please refer to the 53
- Clear current ethernet interface statistics information 53
- Configure cable type adaptation 53
- Following table 53
- Interface when there is a large amount of information to be cleared 53
- Procedure 53
- Purpose 53
- Support cross cable type default 53
- Type it needs to configure the connected cable adaption method interface does not 53
- Use this section operation to clear the statistics information of current ethernet 53
- When the connection cable type of interface needs to match with the real used cable 53
- According to the different purposes execute corresponding step please refer to the 54
- Configure interface loopback detection 54
- Descript ethernet interface 54
- Distinguish each port 54
- Ethernet interface senior attribution configuration 54
- Following table 54
- Procedure 54
- Purpose 54
- Use the following command to configure interface description character string to 54
- According to the different purposes execute corresponding step please refer to the 55
- And configure the interval of timing monitoring outside loopback situation so as to 55
- Display ethernet interface state 55
- Following table 55
- Loop switch will make this interface be in controllable working state 55
- Procedure 55
- Timing monitor each interface whether to be outer loop if finding one interface to be 55
- Use the following configuration task to enable interface loopback monitoring function 55
- According to the different purposes execute corresponding step please refer to the 56
- Address table switch will update the corresponding table if mac source has not been 56
- After configuring the attributes of the current interface this section operation can be 56
- Following table 56
- In order to quickly forward message switch needs to maintain mac address table the 56
- Interface number of switch connected with the device the dynamic item not configured 56
- Mac address is as the following if one port supposed to be porta receives a data frame 56
- Mac address table includes the mac address of device connected with switch and the 56
- Mac table configuration 56
- Manually in the mac address table is learned by switch the method of switch learning 56
- Procedure 56
- Purpose 56
- Source and consider that the message with the destination mac address of mac 56
- Source can be forwarded by porta if mac source has been existed in the mac 56
- Switch to different ethernet interface configuration view 56
- Switch will analyze the source mac address of this data frame supposed to be mac 56
- Used to configure attributes of other interfaces 56
- Configure mac address table 57
- According to the changes in the network if user configures the aging time too short 58
- According to the different purposes execute corresponding step please refer to the 58
- Background 58
- Broadcast many data messages which cannot find destination mac address and it will 58
- Configure system mac address aging time 58
- Following table 58
- Hole list will not be aged and lost 58
- Influence the running performance of switch if user configures the aging time too long 58
- Notice 58
- Once the system is reset dynamic list will be lost but the stored static list and black 58
- Procedure 58
- Switch may delete effective mac address item 58
- Switch may save many old mac address items and this will exhaust mac address 58
- Table resources and cause that the switch cannot update mac address table 58
- The appropriate aging time can realize the mac address aging function effectively 58
- The longer or shorter aging time configured by user may result in that switch will 58
- According to the different purposes execute corresponding step please refer to the 59
- Add delete static arp mapping item manually 59
- Arp configuration 59
- Arp mapping table can dynamically be maintained or manually maintained usually 59
- By arp mapping table aging time and at the same time also cannot dynamically 59
- Can check add and delete arp mapping item in arp table by related manually 59
- Display layer 2 mac address table 59
- During the working time of device 59
- Following table 59
- Mac table item for user to query for specific information conveniently 59
- Maintained commands 59
- Map the ip address manually configured to mac address it is called static arp user 59
- Procedure 59
- Purpose 59
- Static arp mapping table can only be configured manually and will not be influenced 59
- This section introduces how to add delete static arp mapping table manually 59
- This section introduces how to quickly locate the relevant information of the specified 59
- Update this mapping relationship static arp mapping table continues to be effective 59
- According to the different purposes execute corresponding step please refer to the 60
- Address and may result in that user cannot access some nodes so user needs to use 60
- Check arp information 60
- Clear dynamic arp table 60
- Execute this command to cancel the mapping relationship of ip address and mac 60
- Following table 60
- Manually when necessary 60
- Procedure 60
- Purpose 60
- This command carefully 60
- This section helps user to delete device all dynamic arp mapping table items 60
- This section introduces how to clear dynamic arp mapping table 60
- According to the different purposes execute corresponding step please refer to the 61
- Configure dynamic arp mapping item aging time 61
- Corresponding relationship between network address and local hardware address 61
- Debug arp 61
- Each corresponding record keeps a period of time in cache and then gives up 61
- Following table 61
- Procedure 61
- Purpose 61
- The aging time of arp mapping item can reduce the address parse error problem that 61
- The dynamic arp table is not updated in time 61
- This section introduces how to check arp related information this section helps user 61
- This section introduces how to configure the aging time of dynamic arp mapping 61
- This section introduces how to debug arp 61
- To check arp mapping table in lan and detect fault of lan arp established 61
- According to the different purposes execute corresponding step please refer to the 62
- Aggregation only 62
- Background 62
- Configure aggregation group 62
- Connecting reliability link aggregation can be divided into manual aggregation 62
- Dynamic aggregation and static lacp aggregation pots in a same aggregation trunk 62
- Following table 62
- Group shall have a same port type i e if one of the ports is electric optical port all the 62
- Group to implement egress load sharing of each member ports as well as provide high 62
- Interface aggregation introduction 62
- Link aggregation configuration 62
- Link aggregation is to aggregate multiple ports into one single aggregation trunk 62
- Others must be the same 62
- Purpose 62
- The qsw 2800 is currently supporting manual aggregation and static lacp 62
- According to the different purposes execute corresponding step please refer to the 63
- Following table 63
- Functions as well as add member ports for enhancement of bandwidth and reliability 63
- Operations in this section can be used to provision trunk group with its basic 63
- Procedure 63
- Appendix list 64
- Port priority 64
- System priority 64
- According to the different purposes execute corresponding step please refer to the 65
- Following table 65
- Maintenance and debug 65
- Procedure 65
- Purpose 65
- When lacp function is abnormal it needs to check and debug 65
- Appendix list 66
- As the following 66
- Bandwidth and reliability between the two devices and the detailed requirements are 66
- Configure link aggregation group on two directly connected switches to increase the 66
- Example 66
- Network requirement 66
- The link between two devices has the ability of redundant backup when part of 66
- The links is failed the backup link can be used to replace the fault link and keep 66
- The transmission no break 66
- Active link has the ability of load sharing 67
- Configuration of one peer 67
- Configuration step 67
- Network topology 67
- Note the configuration of two peers is the same and this only display 67
- Divide lan local area network into multiple subclasses in logic and each subclass 68
- Enhance the network robust 68
- Generally speaking vlan divides the devices in the lan into multiple network 68
- Has its own broadcast domain that is vlan virtual local area network 68
- In the large scale of network it can restrict the network fault in vlan and 68
- Isolate broadcast domain and reduce broadcast storm and enhance the security 68
- Lan technologically 68
- Segments logically but not physically to realize the isolated broadcast domains in a 68
- Vlan configuration 68
- Vlan function 68
- Vlan introduction 68
- Vlan meaning 68
- According to the different purposes execute corresponding step please refer to the 69
- Appendix list 69
- Configure vlan based on interface 69
- Create vlan 69
- Following table 69
- Procedure 69
- Purpose 69
- This section introduces how to create vlan and it is the basic precondition for other 69
- Vlan function configuration 69
- According to the different purposes execute corresponding step please refer to the 70
- Following table 70
- Procedure 70
- This section introduces how to configure vlan based on interface 70
- According to the different purposes execute corresponding step please refer to the 71
- Appendix list 71
- Configure vlan based on mac address 71
- Following table 71
- Procedure 71
- Purpose 71
- This section introduces how to configure divided vlan based on mac address 71
- According to the different purposes execute corresponding step please refer to the 72
- Appendix list 72
- Configure vlan based on ip sub network 72
- Following table 72
- Procedure 72
- Purpose 72
- This section introduces how to configure vlan divided based on ip sub network 72
- According to the different purposes execute corresponding step please refer to the 73
- Appendix list 73
- Configure vlan based on protocol 73
- Following table 73
- Procedure 73
- Purpose 73
- This section introduces how to configure vlan divided based on protocol 73
- Appendix list 74
- According to the different purposes execute corresponding step please refer to the 75
- Configure vlan other parameters 75
- Following table 75
- Parameters according to real situation 75
- Procedure 75
- Purpose 75
- User can choose to use this section operation to configure other vlan related 75
- According to the different purposes execute corresponding step please refer to the 77
- Appendix list 77
- Following table 77
- Maintenance and debug 77
- Procedure 77
- Purpose 77
- When vlan function is abnormal it needs to check and debug 77
- Access server1 and the staff of market department can access server2 and the two 79
- And switchb to connect it requires that the staff of development department can 79
- Appendix list 79
- Departments cannot communicate with each other 79
- Example 79
- Network requirement 79
- The development department and market department of enterprise user use switcha 79
- Bind vlan translation item with interface 82
- Vlan translation configuration 82
- According to the different purposes execute corresponding step please refer to the 83
- Appendix list 83
- Configure or delete vlan translation item 83
- Following table 83
- Procedure 83
- Purpose 83
- This section introduces how to configure or delete vlan translation item 83
- Appendix list 89
- According to the different purposes execute corresponding step please refer to the 90
- Check vlan translation item related information 90
- Following table 90
- Interface or egress binding of interface or ingress and egress binding of interface at 90
- Procedure 90
- Purpose 90
- The same time 90
- This operation helps user to check the device interface whether to bind vlan 90
- This section introduces how to configure the related information of vlan translation 90
- Translation item including vlan translation item index information ingress binding of 90
- Access to the carrier network at last 91
- After passing the swticha the voice service data with vlan10 of user1 is transmitted 91
- Example 91
- In the access network family user connects with switcha through family gateway and 91
- Internet online business data with vlan12 of user2 is transmitted to be tagged 91
- Network requirement 91
- Tagged vlan11 through the gateway internet online business data of user2 is tagged 91
- To be tagged vlan100 of carrier operator and the internet online business data with 91
- Vlan101 91
- Vlan11 of user1 is transmitted to be tagged vlan101 of carrier operator the 91
- Vlan12 through the gateway 91
- Voice service data of user1 is tagged vlan10 and internet online business data is 91
- Chapter3 95
- Dhcp configuration 95
- Dhcp introduction 95
- Ip service configuration 95
- Summary 95
- Dhcp server 99
- Dhcp relay 100
- Configure dhcp server 103
- According to the different purposes execute corresponding step please refer to the 104
- Following table 104
- Procedure 104
- Appendix list 105
- Configure dhcp server supported option 105
- Dchp server has been configured already 105
- Precondition 105
- According to the different purposes execute corresponding step please refer to the 106
- Appendix list 106
- Following table 106
- Procedure 106
- According to the different purposes execute corresponding step please refer to the 107
- Appendix list 107
- Configure dhcp server security function 107
- Dchp server has been configured already 107
- Following table 107
- Precondition 107
- Procedure 107
- According to the different purposes execute corresponding step please refer to the 108
- Configure dhcp relay 108
- Configure dhcp relay to realize ip address assigned to user of dhcp server 108
- Crossing network 108
- Following table 108
- Procedure 108
- Purpose 108
- Appendix list 109
- According to the different purposes execute corresponding step please refer to the 110
- Following table 110
- Maintenance and debug 110
- Procedure 110
- Purpose 110
- When dhcp function is abnormal it can use this section operation to check and 110
- Appendix list 113
- Dhcp server assigns ip address dynamically for clients of different network segment 113
- Example 113
- Network requirement 113
- The detailed requirements are as follows 113
- The network segments of user are 10 24 and 10 24 113
- Chapter4 routing configuration 116
- Configure static routing 116
- Static routing configuration 116
- Static routing introduction 116
- Summary 116
- According to the different purposes execute corresponding step please refer to the 118
- Appended list 118
- Following table 118
- Maintenance and debug 118
- Process 118
- Purpose 118
- Requires function check debug and defection orientation 118
- The operation in this section is for situation when static route works abnormal and 118
- Appended list 119
- Chapter5 120
- Qos configuration 120
- Queue scheduling and congestion control configuration 120
- Queue scheduling and congestion control introduction 120
- Summary 120
- According to different destination please execute corresponding steps refer to the 123
- Balance delay and delay jitter of all kinds of packets in this way message of key 123
- Before configuring queue scheduling and congestion control it needs to configure 123
- Can be dealt fairly 123
- Capability of queue scheduling drr scheduling allows negative weight to 123
- Configure queue scheduling and congestion control 123
- Filter rule of acl please refer to command of 7 to configure acl action to specify 123
- Following table 123
- Guarantee that the long message can be scheduled but at the next time of round 123
- Interface queue priority for data to pass 123
- Prerequisite 123
- Process 123
- Purpose 123
- Robin this queue will not be scheduled until its weight is positive 123
- Scheduling in accordance with message length if message length exceeds the 123
- Service can be processed with high priority and non key service with same priority 123
- Using the operation in this section when there is congestion in the network qsw 123
- Will deal with message according to the configured scheduling policy so as to 123
- Wrr is a scheduling in accordance with the message number drr is a 123
- Attached list 124
- According to different destination please execute corresponding steps refer to the 125
- Attached list 125
- Configure sp scheduling 125
- Example 125
- Flow is from interface 1 0 1 1 0 2 1 0 3 of host1 to host2 there is congestion on 125
- Following table 125
- Interface 1 0 1 of host2 require to use sp algorithm 125
- Maintenance and debug 125
- Network diagram 125
- Network requirements 125
- Process 125
- Purpose 125
- This operation to check or debug 125
- When queue scheduling and congestion of qos function is abnormal user can use 125
- Chapter6 128
- Igmp configuration 128
- Igmp snooping configuration 128
- Summary 128
- Configure static layer 2 multicast 130
- Appendix list 131
- According to the different purposes execute corresponding step please refer to the 132
- Configure multicast vlan copy 132
- Following table 132
- Procedure 132
- According to the different purposes execute corresponding step please refer to the 133
- Appendix list 133
- Background 133
- Configure igmp snooping 133
- Following table 133
- Igmp snooping based on vlan runs on the switch between router and user host by 133
- Listening the igmp snooping message sent between upper router and host to 133
- Maintain the igmp message forwarding table so it can manage and control to 133
- Procedure 133
- Transmit the multicast data message to realize the multicast of layer 2 133
- Appendix list 135
- According to the different purposes execute corresponding step please refer to the 136
- Configure controllable multicast 136
- Following table 136
- It is usually used in the multicast of layer 2 scenarios to control iptv program 136
- Number and guarantee the service quality of most users 136
- Procedure 136
- Purpose 136
- According to the different purposes execute corresponding step please refer to the 138
- Following table 138
- Maintenance and debug 138
- Procedure 138
- Purpose 138
- User can use operation of this section 138
- When igmp snooping is abnormal and it needs to check debug or locate problem 138
- Example 141
- Acl configuration 155
- Acl introduction 155
- Chapter7 155
- Security configuration 155
- Summary 155
- According to different destination please execute corresponding steps refer to the 156
- Acl type number to be from 1 to 1000 156
- Background information 156
- Before configuring layer2 acl rules first need to create one layer2 acl and specify 156
- Configure layer2 acl 156
- Destination ip source port number destination port number protocol type priority 156
- Destination port number protocol type hop limitation the next head traffic class 156
- Destination port number protocol type priority fragment lifetime rate limitation 156
- Flow flag rate limitation template time range template and etc to classify the 156
- Following table 156
- Layer2 acl mainly based on source mac destination mac vlan priority 156
- Layer3 acl mainly based on source ip destination ip source port number 156
- Layer3 acl6 mainly based on source ipv6 destination ipv6 source port number 156
- Mixed acl mainly based on source mac destination mac source ip 156
- One acl is composed of some rules and actions 156
- Process 156
- Protocol type rate limitation template time range template and etc to classify the 156
- Template time range template and etc to classify the data 156
- Vlan rate limitation template time range template and etc to classify the data 156
- Acl type number to be from 1001 to 2000 159
- Attached list 159
- Background information 159
- Before configuring layer3 acl rules first need to create one layer3 acl and specify 159
- Configure layer3 acl 159
- One acl is composed of some rules and actions 159
- Process 159
- According to different destination please execute corresponding steps refer to the 160
- Following table 160
- Attached list 163
- According to different destination please execute corresponding steps refer to the 164
- Acl type number to be from 2001 to 3000 164
- Background information 164
- Before configuring mixed acl rules first need to create one mixed acl and specify 164
- Configure mixed acl 164
- Following table 164
- One acl is composed of some rules and actions 164
- Process 164
- According to different destination please execute corresponding steps refer to the 166
- Attached list 166
- Background information 166
- Before configuring layer3 acl6 rules first need to create one layer3 acl6 and 166
- Configure layer3 acl6 166
- Following table 166
- One acl is composed of some rules and actions 166
- Process 166
- Specify acl type number to be from 3001 to 4000 166
- Attached list 169
- Configure acl optional function 170
- Attached list 172
- According to different destination please execute corresponding steps refer to the 173
- Following table 173
- Maintenance and debug 173
- Process 173
- Purpose 173
- When acl function is abnormal user can use this operation to check or debug 173
- Attached list 175
- Example 176
- Chapter8 183
- Mstp configuration 183
- Reliability configuration 183
- Summary 183
- Rstp introduction 184
- Mstp introduction 186
- A cist priority vector calculation 187
- Assumptions 187
- Bridge b from the pd port of bridge d is as follow the total root is rd the 187
- Cost is ercb the domain root is rrb the inner root path cost is ircb the 187
- Designated bridge id is b the designated port is b the designated port id 187
- In cist priority vector is composed of the total root outer root path cost domain 187
- In order to facilitate the subsequent description we make the following 187
- In the initial condition the information carried in the message sent out by the 187
- Is pb the id of port receiving bpdu message is pb 187
- Msti priority vector calculation method as follow 187
- Pb port of the bridge b is as follow the total root is rb the outer root path 187
- Port receiving bpdu message 187
- Priority vector calculation 187
- Priority vector of the spanning tree we will introduce the cist priority vector and 187
- Root inner root path cost designated bridge id designated port id and the id of 187
- The information carried in the message which is received by pb port of 187
- The message the most important information carried in the message is the 187
- The mstp role of all bridges is computed according to the carrying information in 187
- A switch a role selection process 190
- And the switchb is better than switchc the link path costs are 4 5 and 10 190
- Another domain alone 190
- Figure 8 1 supposing that the bridge priority of switcha is better than switch b 190
- In initial state the port of every device will be calculated to be the designated port and 190
- Role selection process 190
- State of the figure 8 1 is shown in the table 8 2 190
- Switcha and switchb belong to the same domain and switchc belongs to 190
- The cist instance calculation process will be introduced briefly as follow with the 190
- The message priority vector carried in the message sent out by the device in initial 190
- The port priority vector of all ports of device keep the same as the message priority 190
- Vector in initial state 190
- Will send out the message priority vector which makes it to be the root bridge 190
- According to different destination please execute corresponding steps refer to the 193
- As long as the same configuration the two switches belong to the same domain 193
- Background information 193
- Before configuring switch to join designated mst domain it needs to configure 193
- Configure device to join designated mst domain 193
- Following table 193
- Mst domain name 193
- Mst domain revision level 193
- Msti and vlan mapping relationship 193
- Physical attribute of interface and interface vlan characteristic 193
- Process 193
- Purpose 193
- This section introduces how to configure switch to join mst domain 193
- Attached list 194
- According to different destination please execute corresponding steps refer to the 195
- Background information 195
- Before modifying mstp parameters please first finish the following tasks 195
- Configure interface physical attribute 195
- Configure interface to join in vlan 195
- Configure mstp parameter 195
- Configure switch to join in designated mst domain 195
- Following table 195
- In some specific network environment user can modify mstp parameters to achieve 195
- Introduce how to modify mstp parameters in this section 195
- Process 195
- Purpose 195
- The best result 195
- Default to configure 196
- Attached list 197
- Anyone forges configuration message and attacks switch maliciously when the 198
- Background information 198
- Bpdu protection 198
- Circumstances the edge interface will not receive bpdu message of stp but if 198
- Configure mstp protection function 198
- Configured the as edge interface to realize interface fast switching under normal 198
- Edge interface receives the configuration message system will configure these 198
- For the access layer device the access interface usually connects with user 198
- Interfaces to be non edge interface automatically and will calculate stp again 198
- Prevent this network attack 198
- Terminal such as pc or file server at this time the access interface can be 198
- This will results in network topology concussion bpdu protection function can 198
- According to different destination please execute corresponding steps refer to the 200
- After enabling tc bpdu message attack function the number of times which 200
- Deletion operation will cause great burden to the device and bring great hidden 200
- Following table 200
- It can avoid frequent deletion of mac table item and arp table item so as to 200
- Mstp processes bpdu message of tc type can be configured per unit time if 200
- Process 200
- Protect the switch 200
- Purpose 200
- Specified by threshold for other bpdu messages of tc type beyond the 200
- The configured threshold the mstp process only deals with the designated times 200
- The number of bpdu messages of tc type received by mstp process exceeds 200
- Threshold after the timer expires mstp process only deals with once in this way 200
- Trouble to the network stability 200
- When need to configure mstp protection user can use this section operation 200
- According to different destination please execute corresponding steps refer to the 201
- Attached list 201
- Following table 201
- Maintenance and debug 201
- Process 201
- Purpose 201
- When mstp function is abnormal user can use this operation to check or debug 201
- Attached list 203
- Basic function as following 203
- Example 203
- Network requirements 203
- Now there are four switches to support mstp protocol they are switcha switchb 203
- Switchc and switchd are other series switch produced by qtech configure mstp 203
- Switchc and switchd switcha and switchb are the qsw 2800 series switch 203
- Rlink configuration 208
- Rlink introduction 208
- Configure resilient link group function 209
- According to different destination please execute corresponding steps refer to the 210
- Following table 210
- Function to realize redundancy link backup and fast switching under double uplinks 210
- Network environment 210
- Process 210
- Purpose 210
- Using the operation in this section to configure resilient link group and its basic 210
- According to different destination please execute corresponding steps refer to the 211
- Attached list 211
- Background information 211
- Configure monitor link group function 211
- Following table 211
- Function to realize interface linkage function 211
- Process 211
- Purpose 211
- To use the operation in this section to configure monitor link group and its basic 211
- Attached list 212
- Background information 212
- Configure rlink other related parameter 212
- Enable rlink returning function after returning timer terminating it will switch to 212
- Keeps blocked state and do not preempt if needing to recover it to be the main link 212
- The main link 212
- The original main link fault recovers in order to keep flow stability the main link 212
- Use manual main standby switching of rlink group to enforce link switching 212
- User can use the following two methods 212
- When there is fault in the main link of rlink group it will switch to standby link after 212
- According to different destination please execute corresponding steps refer to the 213
- Can choose which step to use according to your need but first rlink group or mlink 213
- Following table 213
- Group should be configured 213
- Process 213
- Purpose 213
- Use the operation in this section to configure other related parameters of rlink user 213
- According to different destination please execute corresponding steps refer to the 214
- Attached list 214
- Following table 214
- Maintenance and debug 214
- Process 214
- Purpose 214
- When rlink function is abnormal user can use this operation to check or debug 214
- Attached list 216
- Configuration steps 217
- Configure protection vlan rlink group based on vlan 217
- Configure single point uplink 217
- Create rlink group1 217
- Example 217
- In single point uplink network environment configure rlink function the master and 217
- Network diagram 217
- Network requirements 217
- Optional default to be single mode 217
- Slave interfaces are on the same switch they are fe1 1 and fe1 2 217
- Switch config rlink group 1 217
- Switch config rlink1 type single 217
- Switch configure 217
- Chapter9 224
- Enable or disable poe power supply function 224
- Poe configuration 224
- Poe function configuration 224
- Summary 224
- According to the different purposes execute corresponding step please refer to the 225
- Auto mode it is recommended that user uses the force standard or force high mode 225
- Background information 225
- Configure power supply mode 225
- Following table 225
- Function 225
- Generally it is recommended that user uses the default mode of half auto 225
- If using one of the two modes user must enable the enhanced detection power supply 225
- Progress 225
- Qsw 2800 pe pe supports four power supply modes they are auto force 225
- Standard force high and half auto 225
- When the device cannot supply electricity normally using non standard pd in half 225
- According to the interface number the interface number is greater the priority is 226
- Background information 226
- Configure poe power supply parameter 226
- Configure the pd device description connected with the interface on the device it is 226
- Convenient for user to manage the downstream pd device 226
- Critical equipment can be first powered when the power consumption of pd equipment 226
- Currently qsw 2800 pe pe only supports power supply in signal line mode timing 226
- Electricity for it 226
- Higher and the port with greater interface number will be powered first 226
- Insufficient if the priority of different ports is the same it will order the priority 226
- Is greater than the total power supplied by the pse when the pse power is 226
- Poe power supply port supports three priorities the port priority ensures that the 226
- Power supply and power supply alarm function 226
- Progress 226
- Pse can only detect the standard pd and supply electricity for it after enabling pse 226
- The command of configuring the threshold power of pse in the global configuration 226
- The pd device according with the 802 af protocol is the standard pd device usually 226
- To detect the non standard pd pse can detect the non standard pd and supply 226
- View is used to protect the switch to avoid the influence of the unstable power supply 226
- According to the different purposes execute corresponding step please refer to the 227
- Following table 227
- According to the different purposes execute corresponding step please refer to the 228
- Check poe configuration information 228
- Following table 228
- Progress 228
- Purpose 228
- Right or wrong 228
- This operation is mainly used to check the configured poe function and its parameters 228
- Appendix a 229
Похожие устройства
- Qtech QSW-3200-24T Руководство пользователя
- Qtech QSW-3200-24T Техническое описание
- Qtech QSW-3200-28T Руководство пользователя
- Qtech QSW-3200-28T Техническое описание
- Qtech QSW-3200-28FC Руководство пользователя
- Qtech QSW-3200-28FC Техническое описание
- Qtech QSW-3900-24-Т-AC Руководство пользователя v1-1
- Qtech QSW-3900-24-Т-AC Руководство пользователя v1-7
- Qtech QSW-3900-24-Т-AC Руководство пользователя
- Qtech QSW-3900-48-SFP-AC Руководство пользователя v1-1
- Qtech QSW-3900-48-SFP-AC Руководство пользователя v1-7
- Qtech QSW-3900-48-SFP-AC Руководство пользователя
- Qtech QSW-3900-48-SFP-DC Руководство пользователя v1-1
- Qtech QSW-3900-48-SFP-DC Руководство пользователя v1-7
- Qtech QSW-3900-48-SFP-DC Руководство пользователя
- Qtech QSW-3900-48-Т-AC Руководство пользователя v1-1
- Qtech QSW-3900-48-Т-AC Руководство пользователя v1-7
- Qtech QSW-3900-48-Т-AC Руководство пользователя
- Qtech QSW-3900-48-Т-DC Руководство пользователя v1-1
- Qtech QSW-3900-48-Т-DC Руководство пользователя v1-7