ZYXEL XS3800-28 28-Port 10 GbE L3 Managed Switch User Guide

User Guide for ZYXEL models including: XS3800-28, 28-Port 10 GbE L3 Managed Switch

File Info : application/pdf, 648 Pages, 10.61MB

XS3800-28 V4.70 Ed1

User's Guide

XS3800-28
28-port 10GbE L3 Managed Switch

Default Login Details

Out-of-Band MGMT Port In-Band Ports
User Name Password

http://192.168.0.1
http://DHCP-assigned IP or
http://192.168.1.1 admin 1234

Version 4.70 Edition 1, 10/2020

IMPO RTANT! READ C AREFULLY BEFO RE USE. KEEP THIS G UIDE FO R FUTURE REFERENC E.
Screenshots and graphics in this book may differ slightly from your product due to differences in your product firmware or your computer operating system. Every effort has been made to ensure that the information in this manual is accurate.
Re la te d Do c um e nta tio n
· CLI Reference Guide This guide explains how to use the Command-Line Interface (CLI) to configure the Switch.
Note: It is recommended you use the Web Configurator to configure the Switch. · Web Configurator Online Help
Click the help icon in any screen for help in configuring that screen and supplementary information. · More Information
Go to https:/ / b usine ssfo rum .zyxe l.c o m for product discussions. Go to suppo rt.zyxe l.c o m to find other information on the Switch.
XS3800-28 User's Guide
2

Do c um e nt C o nve ntio ns

Wa rning s a nd No te s
These are how warnings and notes are shown in this guide.
Wa rning s te ll yo u a b o ut thing s tha t c o uld ha rm yo u o r yo ur de vic e .
Note: Notes tell you other important information (for example, other things you may need to configure or helpful tips) or recommendations.

Synta x C o nve ntio ns
· All models may be referred to as the "Switch" in this guide.
· Product labels, screen names, field labels and field choices are all in bo ld font.
· A right angle bracket ( > ) within a screen name denotes a mouse click. For example, Ba sic Se tting > IP Se tup > IP C o nfig ura tio n > Ne two rk Pro xy C o nfig ura tio n means you first click Ba sic Se tting in the navigation panel, then the IP Se tup sub menu, then IP C o nfig ura tio n and finally Ne two rk Pro xy C o nfig ura tio n to get to that screen.

Ic o ns Use d in Fig ure s
Figures in this user guide may use the following generic icons. The Switch icon is not an exact representation of your device.

Switch

Generic Router

Wireless Router / Access Point

Generic Switch

Smart TV

Desktop

Laptop

IP Camera

Printer

Server

XS3800-28 User's Guide
3

Contents Overview
C o nte nts O ve rvie w
Use r's G uide ......................................................................................................................................24
Getting to Know Your Switch .............................................................................................................. 25 Hardware Installation and Connection ............................................................................................. 34 Hardware Panels .................................................................................................................................. 38
Te c hnic a l Re fe re nc e ........................................................................................................................47
Web Configurator ................................................................................................................................. 48 Initial Setup Example ............................................................................................................................ 64 Tutorials .................................................................................................................................................. 69 Status ...................................................................................................................................................... 81 Basic Setting .......................................................................................................................................... 87 VLAN .................................................................................................................................................... 131 Static MAC Forwarding ...................................................................................................................... 158 Static Multicast Forwarding ............................................................................................................... 161 Filtering ................................................................................................................................................. 165 Spanning Tree Protocol ...................................................................................................................... 167 Bandwidth Control ............................................................................................................................. 193 Broadcast Storm Control ................................................................................................................... 196 Mirroring ............................................................................................................................................... 199 Link Aggregation ................................................................................................................................ 210 Port Authentication ............................................................................................................................ 220 Port Security ......................................................................................................................................... 237 Time Range ......................................................................................................................................... 241 Classifier ............................................................................................................................................... 243 Policy Rule ........................................................................................................................................... 252 Queuing Method ................................................................................................................................ 257 VLAN Stacking .................................................................................................................................... 261 Multicast .............................................................................................................................................. 269 AAA ...................................................................................................................................................... 295 IP Source Guard .................................................................................................................................. 308 DHCP Snooping .................................................................................................................................. 313 ARP Inspection .................................................................................................................................... 324 Loop Guard ......................................................................................................................................... 342 VLAN Mapping ................................................................................................................................... 346 Layer 2 Protocol Tunneling ................................................................................................................ 350 sFlow ..................................................................................................................................................... 355 PPPoE ................................................................................................................................................... 359 Error Disable ......................................................................................................................................... 368
XS3800-28 User's Guide
4

Contents Overview
VLAN Isolation ..................................................................................................................................... 376 MAC Pinning ....................................................................................................................................... 378 Private VLAN ....................................................................................................................................... 381 Green Ethernet ................................................................................................................................... 385 Link Layer Discovery Protocol (LLDP) ................................................................................................ 388 Anti-Arpscan ....................................................................................................................................... 416 BPDU Guard ........................................................................................................................................ 422 OAM ..................................................................................................................................................... 426 ZULD ...................................................................................................................................................... 435 NLB ........................................................................................................................................................ 441 Wol Relay ............................................................................................................................................. 446 Static Route ......................................................................................................................................... 448 Policy Routing ..................................................................................................................................... 452 RIP ......................................................................................................................................................... 456 OSPF ..................................................................................................................................................... 459 IGMP ..................................................................................................................................................... 474 DVMRP ................................................................................................................................................. 478 Differentiated Services ....................................................................................................................... 482 DHCP .................................................................................................................................................... 487 VRRP ..................................................................................................................................................... 507 Router Setup ........................................................................................................................................ 516 ARP Setup ............................................................................................................................................ 518 Maintenance ...................................................................................................................................... 524 Access Control .................................................................................................................................... 541 Diagnostic ........................................................................................................................................... 566 System Log .......................................................................................................................................... 570 Syslog Setup ........................................................................................................................................ 571 Cluster Management ......................................................................................................................... 574 MAC Table ........................................................................................................................................... 580 IP Table ................................................................................................................................................. 583 ARP Table ............................................................................................................................................ 585 Routing Table ...................................................................................................................................... 587 Path MTU Table ................................................................................................................................... 589 Configure Clone ................................................................................................................................. 590 IPv6 Neighbor Table ........................................................................................................................... 594 Port Status ............................................................................................................................................ 596 Service Register ................................................................................................................................... 606
Tro ub le sho o ting a nd Appe ndic e s .................................................................................................608
Troubleshooting .................................................................................................................................. 609
XS3800-28 User's Guide
5

Table of Contents
Ta b le o f C o nte nts
Do c um e nt C o nve ntio ns ......................................................................................................................3
C o nte nts O ve rvie w ..............................................................................................................................4
Ta b le o f C o nte nts .................................................................................................................................6
Pa rt I: Use r's G uide .......................................................................................... 24
C ha pte r 1 G e tting to Kno w Yo ur Switc h ............................................................................................................25
1.1 Introduction ..................................................................................................................................... 25 1.1.1 Multi-Gigabit .......................................................................................................................... 26 1.1.2 Stacking Mode ...................................................................................................................... 27 1.1.3 Management Method ......................................................................................................... 28 1.1.4 Management Modes ........................................................................................................... 28 1.1.5 Mode Changing ................................................................................................................... 28 1.1.6 ZON Utility ............................................................................................................................... 29
1.2 Example Applications .................................................................................................................... 30 1.2.1 Bridging Example .................................................................................................................. 30 1.2.2 High Performance Switching Example ............................................................................... 30 1.2.3 IEEE 802.1Q VLAN Application Examples ........................................................................... 31 1.2.4 IPv6 Support ........................................................................................................................... 32
1.3 Ways to Manage the Switch ......................................................................................................... 32 1.4 Good Habits for Managing the Switch ........................................................................................ 32
C ha pte r 2 Ha rdwa re Insta lla tio n a nd C o nne c tio n ...........................................................................................34
2.1 Safety Precautions .......................................................................................................................... 34 2.2 Freestanding Installation Procedure ............................................................................................ 34 2.3 Mounting the Switch on a Rack ................................................................................................... 35
2.3.1 Installation Requirements ..................................................................................................... 35 2.3.2 Precautions ............................................................................................................................ 35 2.3.3 Attaching the Mounting Brackets to the Switch ............................................................... 36 2.3.4 Mounting the Switch on a Rack .......................................................................................... 36
C ha pte r 3 Ha rdwa re Pa ne ls ................................................................................................................................38
3.1 Front Panel Connections ............................................................................................................... 38
XS3800-28 User's Guide
6

Table of Contents
3.1.1 Ethernet Ports ......................................................................................................................... 39 3.1.2 SFP/SFP+ Slots ......................................................................................................................... 39 3.1.3 Dual Personality Interfaces .................................................................................................. 42 3.1.4 Management Port ................................................................................................................ 42 3.1.5 Console Port .......................................................................................................................... 42 3.2 Rear Panel ....................................................................................................................................... 42 3.2.1 Grounding .............................................................................................................................. 43 3.2.2 AC Power Connection ......................................................................................................... 44 3.3 LEDs .................................................................................................................................................. 45
Pa rt II: Te c hnic a l Re fe re nc e ........................................................................... 47
C ha pte r 4 We b C o nfig ura to r...............................................................................................................................48
4.1 Overview ......................................................................................................................................... 48 4.2 System Login .................................................................................................................................... 48 4.3 Zyxel One Network (ZON) Utility .................................................................................................... 51
4.3.1 Requirements ......................................................................................................................... 51 4.3.2 Run the ZON Utility ................................................................................................................. 51 4.4 Web Configurator Layout .............................................................................................................. 55 4.4.1 Change Your Password ........................................................................................................ 60 4.5 Save Your Configuration ................................................................................................................ 61 4.6 Switch Lockout ................................................................................................................................ 61 4.7 Reset the Switch ............................................................................................................................. 62 4.7.1 Using the RESTORE Button ..................................................................................................... 62 4.7.2 Reload the Configuration File .............................................................................................. 62 4.8 Log Out of the Web Configurator ................................................................................................ 63 4.9 Help .................................................................................................................................................. 63
C ha pte r 5 Initia l Se tup Exa m ple .........................................................................................................................64
5.1 Overview ......................................................................................................................................... 64 5.1.1 Create a VLAN ...................................................................................................................... 64 5.1.2 Set Port VID ............................................................................................................................ 65 5.1.3 Configure Switch Management IP Address ....................................................................... 66
C ha pte r 6 Tuto ria ls ...............................................................................................................................................69
6.1 Overview ......................................................................................................................................... 69 6.2 How to Use DHCPv4 Snooping on the Switch ............................................................................. 69 6.3 How to Use DHCPv4 Relay on the Switch .................................................................................... 73
XS3800-28 User's Guide
7

Table of Contents
6.3.1 DHCP Relay Tutorial Introduction ........................................................................................ 73 6.3.2 Create a VLAN ...................................................................................................................... 74 6.3.3 Configure DHCPv4 Relay ..................................................................................................... 76 6.3.4 Troubleshooting ..................................................................................................................... 76 6.4 How to Use Auto Configuration via a DHCP Server on the Switch ........................................... 77
C ha pte r 7 Sta tus ...................................................................................................................................................81
7.1 Overview ......................................................................................................................................... 81 7.1.1 What You Can Do ................................................................................................................. 81
7.2 Status ................................................................................................................................................ 81 7.2.1 Neighbor Screen ................................................................................................................... 83 7.2.2 Neighbor Detail ..................................................................................................................... 85
C ha pte r 8 Ba sic Se tting .......................................................................................................................................87
8.1 Overview ......................................................................................................................................... 87 8.1.1 What You Can Do ................................................................................................................. 87
8.2 System Information ......................................................................................................................... 87 8.2.1 System Information Stacking Hardware Monitor ............................................................... 90
8.3 General Setup ................................................................................................................................. 92 8.4 Introduction to VLANs .................................................................................................................... 94 8.5 Switch Setup .................................................................................................................................... 94 8.6 IP Setup ............................................................................................................................................ 96
8.6.1 IP Interfaces ........................................................................................................................... 97 8.6.2 IP Status .................................................................................................................................. 97 8.6.3 IP Status Details ...................................................................................................................... 98 8.6.4 IP Configuration .................................................................................................................... 99 8.6.5 Network Proxy Configuration ............................................................................................. 103 8.7 Port Setup ...................................................................................................................................... 104 8.8 Interface Setup ............................................................................................................................. 107 8.9 IPv6 ................................................................................................................................................. 108 8.9.1 IPv6 Status ............................................................................................................................ 109 8.9.2 IPv6 Interface Status ........................................................................................................... 109 8.9.3 IPv6 Configuration .............................................................................................................. 111 8.9.4 IPv6 Global Setup ................................................................................................................ 112 8.9.5 IPv6 Interface Setup ............................................................................................................ 113 8.9.6 IPv6 Link-Local Address Setup ............................................................................................ 114 8.9.7 IPv6 Global Address Setup ................................................................................................. 114 8.9.8 IPv6 Neighbor Discovery Setup ......................................................................................... 116 8.9.9 IPv6 Router Discovery Setup .............................................................................................. 117 8.9.10 IPv6 Prefix Setup ................................................................................................................ 118 8.9.11 IPv6 Neighbor Setup ......................................................................................................... 119
XS3800-28 User's Guide
8

Table of Contents
8.9.12 DHCPv6 Client Setup ........................................................................................................ 121 8.10 Loopback Interface ................................................................................................................... 122
8.10.1 IPv4 Loopback Interface .................................................................................................. 122 8.11 Stacking ....................................................................................................................................... 123
8.11.1 Stacking Status .................................................................................................................. 124 8.11.2 Stacking Slot ...................................................................................................................... 125 8.11.3 Stacking Configuration .................................................................................................... 126 8.12 Cloud Management .................................................................................................................. 129 8.12.1 Nebula Center Control Discovery ................................................................................... 129 8.12.2 Nebula Switch Registration .............................................................................................. 130
C ha pte r 9 V LA N .. .... ... .... .... ... .... .... ... .... .... .... ... .... .... ... .... .... ... .... .... ... .... .... ... .... .... ... .... .... ... .... .... .... ... .... .... ... .... .... 1 3 1
9.1 Overview ....................................................................................................................................... 131 9.1.1 What You Can Do ............................................................................................................... 131 9.1.2 What You Need to Know ................................................................................................... 131
9.2 Introduction to IEEE 802.1Q Tagged VLANs ............................................................................... 132 9.3 VLAN Status ................................................................................................................................... 134
9.3.1 VLAN Details ........................................................................................................................ 135 9.4 Private VLAN Status ...................................................................................................................... 137 9.5 VLAN Configuration ..................................................................................................................... 137 9.6 Configure a Static VLAN .............................................................................................................. 138 9.7 Configure VLAN Port Settings ...................................................................................................... 141 9.8 Subnet Based VLANs .................................................................................................................... 143 9.9 Protocol Based VLANs .................................................................................................................. 146
9.9.1 Configuring Protocol Based VLAN .................................................................................... 146 9.10 Voice VLAN ................................................................................................................................. 149 9.11 MAC Based VLAN ....................................................................................................................... 151 9.12 Vendor ID Based VLAN .............................................................................................................. 152 9.13 Port-Based VLAN Setup .............................................................................................................. 154
9.13.1 Configure a Port-Based VLAN ......................................................................................... 154
C ha pte r 10 Sta tic MAC Fo rwa rding ....................................................................................................................158
10.1 Overview ..................................................................................................................................... 158 10.1.1 What You Can Do ............................................................................................................. 158
10.2 Configure Static MAC Forwarding ........................................................................................... 158
C ha pte r 11 Sta tic Multic a st Fo rwa rding .............................................................................................................161
11.1 Overview ..................................................................................................................................... 161 11.1.1 What You Can Do ............................................................................................................. 161 11.1.2 What You Need To Know ................................................................................................. 161
XS3800-28 User's Guide
9

Table of Contents
11.2 Configure Static Multicast Forwarding ..................................................................................... 162
C ha pte r 12 Filte ring ..............................................................................................................................................165
12.1 Filtering Overview ....................................................................................................................... 165 12.1.1 What You Can Do ............................................................................................................. 165
12.2 Configure a Filtering Rule .......................................................................................................... 165
C ha pte r 13 Spa nning Tre e Pro to c o l ...................................................................................................................167
13.1 Spanning Tree Protocol Overview ............................................................................................ 167 13.1.1 What You Can Do ............................................................................................................. 167 13.1.2 What You Need to Know ................................................................................................. 167
13.2 Spanning Tree Protocol Status .................................................................................................. 170 13.3 Spanning Tree Configuration .................................................................................................... 170 13.4 Rapid Spanning Tree Protocol Status ....................................................................................... 171 13.5 Configure Rapid Spanning Tree Protocol ................................................................................ 173 13.6 Configure Multiple Spanning Tree Protocol ............................................................................ 175
13.6.1 Multiple Spanning Tree Protocol Port Configuration ..................................................... 179 13.7 Multiple Spanning Tree Protocol Status .................................................................................... 181 13.8 Configure Multiple Rapid Spanning Tree Protocol ................................................................. 185 13.9 Multiple Rapid Spanning Tree Protocol Status ........................................................................ 187 13.10 Technical Reference ................................................................................................................ 190
13.10.1 MSTP Network Example .................................................................................................. 190 13.10.2 MST Region ....................................................................................................................... 190 13.10.3 MST Instance .................................................................................................................... 191 13.10.4 Common and Internal Spanning Tree (CIST) ............................................................... 191
C ha pte r 14 Ba ndwidth C o ntro l ...........................................................................................................................193
14.1 Bandwidth Control Overview .................................................................................................... 193 14.1.1 What You Can Do ............................................................................................................. 193 14.1.2 CIR and PIR ........................................................................................................................ 193
14.2 Bandwidth Control Setup .......................................................................................................... 193
C ha pte r 15 Bro a dc a st Sto rm C o ntro l .................................................................................................................196
15.1 Broadcast Storm Control Overview .......................................................................................... 196 15.1.1 What You Can Do ............................................................................................................. 196
15.2 Broadcast Storm Control Setup ................................................................................................ 196
C ha pte r 16 Mirro ring ............................................................................................................................................199
XS3800-28 User's Guide
10

Table of Contents
16.1 Mirroring Overview ..................................................................................................................... 199 16.1.1 What You Need to Know ................................................................................................. 199
16.2 Local Port Mirroring ..................................................................................................................... 200 16.2.1 Remote Port Mirroring ....................................................................................................... 203 16.2.2 Source ................................................................................................................................ 203 16.2.3 Destination ......................................................................................................................... 205 16.2.4 Connected Port ................................................................................................................ 207
C ha pte r 17 Link Ag g re g a tio n .............................................................................................................................210
17.1 Link Aggregation Overview ....................................................................................................... 210 17.1.1 What You Can Do ............................................................................................................. 210 17.1.2 What You Need to Know ................................................................................................. 210
17.2 Link Aggregation Status ............................................................................................................. 211 17.3 Link Aggregation Setting ........................................................................................................... 213
17.3.1 Link Aggregation Control Protocol ................................................................................. 215 17.4 Technical Reference .................................................................................................................. 218
17.4.1 Static Trunking Example ................................................................................................... 218
C ha pte r 18 Po rt Authe ntic a tio n ..........................................................................................................................220
18.1 Port Authentication Overview .................................................................................................. 220 18.1.1 What You Can Do ............................................................................................................. 220 18.1.2 What You Need to Know ................................................................................................. 221 18.1.3 MAC Authentication ........................................................................................................ 221
18.2 Port Authentication Configuration ........................................................................................... 222 18.3 Activate IEEE 802.1x Security ..................................................................................................... 222 18.4 Activate MAC Authentication .................................................................................................. 225 18.5 Guest VLAN ................................................................................................................................. 228 18.6 Compound Authentication ....................................................................................................... 231 18.7 Technical Reference .................................................................................................................. 234
18.7.1 IEEE 802.1x .......................................................................................................................... 234 18.7.2 RADIUS ................................................................................................................................ 234 18.7.3 EAP (Extensible Authentication Protocol) Authentication ........................................... 235 18.7.4 EAPOL (EAP over LAN) ...................................................................................................... 236
C ha pte r 19 Po rt Se c urity ......................................................................................................................................237
19.1 About Port Security ..................................................................................................................... 237 19.2 Port Security Setup ...................................................................................................................... 237 19.3 VLAN MAC Address Limit ........................................................................................................... 239
C ha pte r 20 Tim e Ra ng e .......................................................................................................................................241
XS3800-28 User's Guide
11

Table of Contents
20.1 Time Range Overview ................................................................................................................ 241 20.1.1 What You Can Do ............................................................................................................. 241
20.2 Configuring Time Range ............................................................................................................ 241
C ha pte r 21 C la ssifie r............................................................................................................................................243
21.1 Classifier Overview ..................................................................................................................... 243 21.1.1 What You Can Do ............................................................................................................. 243 21.1.2 What You Need to Know ................................................................................................. 243
21.2 Classifier Status ............................................................................................................................ 244 21.3 Classifier Configuration .............................................................................................................. 244
21.3.1 Viewing and Editing Classifier Configuration Summary ............................................... 248 21.4 Classifier Global Setting Configuration .................................................................................... 249 21.5 Classifier Example ....................................................................................................................... 250
C ha pte r 22 Po lic y Rule ........................................................................................................................................252
22.1 Policy Rules Overview ................................................................................................................ 252 22.1.1 What You Can Do ............................................................................................................. 252 22.1.2 DiffServ ................................................................................................................................ 252 22.1.3 DSCP and Per-Hop Behavior ........................................................................................... 252
22.2 Configuring Policy Rules ............................................................................................................ 253 22.3 Policy Example ............................................................................................................................ 255
C ha pte r 23 Q ue uing Me tho d ..............................................................................................................................257
23.1 Queuing Method Overview ...................................................................................................... 257 23.1.1 What You Can Do ............................................................................................................. 257 23.1.2 What You Need to Know ................................................................................................. 257
23.2 Configuring Queuing ................................................................................................................. 258
C ha pte r 24 VLAN Sta c king ..................................................................................................................................261
24.1 VLAN Stacking Overview ........................................................................................................... 261 24.1.1 VLAN Stacking Example ................................................................................................... 261
24.2 VLAN Stacking Port Roles ........................................................................................................... 262 24.3 VLAN Tag Format ........................................................................................................................ 262
24.3.1 Frame Format .................................................................................................................... 263 24.4 Configuring VLAN Stacking ....................................................................................................... 263
24.4.1 Port-based Q-in-Q ............................................................................................................. 265 24.4.2 Selective Q-in-Q ................................................................................................................ 267
C ha pte r 25 Multic a st............................................................................................................................................269
XS3800-28 User's Guide
12

Table of Contents
25.1 Multicast Overview ..................................................................................................................... 269 25.1.1 What You Can Do ............................................................................................................. 269 25.1.2 What You Need to Know ................................................................................................. 270
25.2 Multicast Setup ........................................................................................................................... 273 25.3 IPv4 Multicast Status ................................................................................................................... 273
25.3.1 IGMP Snooping .................................................................................................................. 274 25.3.2 IGMP Snooping VLAN ....................................................................................................... 278 25.3.3 IGMP Filtering Profile ......................................................................................................... 279 25.4 IPv6 Multicast Status ................................................................................................................... 280 25.4.1 MLD Snooping-proxy ........................................................................................................ 281 25.4.2 MLD Snooping-proxy VLAN .............................................................................................. 281 25.4.3 MLD Snooping-proxy VLAN Port Role Setting ................................................................. 283 25.4.4 MLD Snooping-proxy Filtering .......................................................................................... 285 25.4.5 MLD Snooping-proxy Filtering Profile ............................................................................... 287 25.5 General MVR Configuration ...................................................................................................... 288 25.5.1 MVR Group Configuration ............................................................................................... 291 25.5.2 MVR Configuration Example ........................................................................................... 293
C ha pte r 26 AAA ...................................................................................................................................................295
26.1 Authentication, Authorization and Accounting (AAA) ......................................................... 295 26.1.1 What You Can Do ............................................................................................................. 295 26.1.2 What You Need to Know ................................................................................................. 295
26.2 AAA Screens ............................................................................................................................... 296 26.3 RADIUS Server Setup ................................................................................................................... 296 26.4 TACACS+ Server Setup ............................................................................................................... 298 26.5 AAA Setup ................................................................................................................................... 300 26.6 Technical Reference .................................................................................................................. 302
26.6.1 Vendor Specific Attribute ................................................................................................ 302 26.6.2 Supported RADIUS Attributes ........................................................................................... 304 26.6.3 Attributes Used for Authentication .................................................................................. 304 26.6.4 Attributes Used for Accounting ....................................................................................... 305
C ha pte r 27 IP So urc e G ua rd ...............................................................................................................................308
27.1 IP Source Guard Overview ........................................................................................................ 308 27.1.1 What You Can Do ............................................................................................................. 308 27.1.2 What You Need to Know ................................................................................................. 308
27.2 IP Source Guard .......................................................................................................................... 309 27.3 IPv4 Source Guard Setup ........................................................................................................... 310 27.4 IPv4 Source Guard Static Binding ............................................................................................. 310
C ha pte r 28 DHC P Sno o ping ................................................................................................................................313
XS3800-28 User's Guide
13

Table of Contents
28.1 DHCP Snooping Overview ......................................................................................................... 313 28.1.1 What You Can Do ............................................................................................................. 313
28.2 DHCP Snooping .......................................................................................................................... 313 28.3 DHCP Snooping Configure ........................................................................................................ 316
28.3.1 DHCP Snooping Port Configure ...................................................................................... 317 28.3.2 DHCP Snooping VLAN Configure .................................................................................... 319 28.3.3 DHCP Snooping VLAN Port Configure ............................................................................ 320 28.4 Technical Reference .................................................................................................................. 321 28.4.1 DHCP Snooping Overview ............................................................................................... 321
C ha pte r 29 ARP Inspe c tio n .................................................................................................................................324
29.1 ARP Inspection Status ................................................................................................................. 324 29.1.1 ARP Inspection VLAN Status ............................................................................................. 325 29.1.2 ARP Inspection Log Status ................................................................................................ 325
29.2 ARP Inspection Configure .......................................................................................................... 326 29.2.1 ARP Inspection Port Configure ........................................................................................ 328 29.2.2 ARP Inspection VLAN Configure ..................................................................................... 329
29.3 IPv6 Source Guard Overview .................................................................................................... 330 29.4 IPv6 Source Binding Status ......................................................................................................... 331 29.5 IPv6 Static Binding Setup ........................................................................................................... 332 29.6 IPv6 Source Guard Policy Setup ............................................................................................... 334 29.7 IPv6 Source Guard Port Setup ................................................................................................... 335 29.8 IPv6 Snooping Policy Setup ....................................................................................................... 336 29.9 IPv6 Snooping VLAN Setup ........................................................................................................ 337 29.10 IPv6 DHCP Trust Setup .............................................................................................................. 338 29.11 Technical Reference ................................................................................................................ 340
29.11.1 ARP Inspection Overview ............................................................................................... 340
C ha pte r 30 Lo o p G ua rd ......................................................................................................................................342
30.1 Loop Guard Overview ............................................................................................................... 342 30.1.1 What You Can Do ............................................................................................................. 342 30.1.2 What You Need to Know ................................................................................................. 342
30.2 Loop Guard Setup ...................................................................................................................... 344
C ha pte r 31 VLAN Ma pping .................................................................................................................................346
31.1 VLAN Mapping Overview .......................................................................................................... 346 31.1.1 VLAN Mapping Example .................................................................................................. 346 31.1.2 What You Can Do ............................................................................................................. 347
31.2 Enable VLAN Mapping .............................................................................................................. 347 31.2.1 VLAN Mapping Configure ............................................................................................... 348
XS3800-28 User's Guide
14

Table of Contents
C ha pte r 32 La ye r 2 Pro to c o l Tunne ling ..............................................................................................................350
32.1 Layer 2 Protocol Tunneling Overview ....................................................................................... 350 32.1.1 What You Can Do ............................................................................................................. 350 32.1.2 What You Need to Know ................................................................................................. 350
32.2 Configuring Layer 2 Protocol Tunneling ................................................................................... 351
C ha pte r 33 sFlo w..................................................................................................................................................355
33.1 sFlow Overview ........................................................................................................................... 355 33.2 sFlow Port Configuration ............................................................................................................ 355
33.2.1 sFlow Collector Configuration ......................................................................................... 357
C ha pte r 34 PPPo E.................................................................................................................................................359
34.1 PPPoE Intermediate Agent Overview ...................................................................................... 359 34.1.1 What You Can Do ............................................................................................................. 359 34.1.2 What You Need to Know ................................................................................................. 359
34.2 PPPoE ........................................................................................................................................... 361 34.3 PPPoE Intermediate Agent ........................................................................................................ 362
34.3.1 PPPoE IA Per-Port ............................................................................................................... 363 34.3.2 PPPoE IA Per-Port Per-VLAN ............................................................................................. 365 34.3.3 PPPoE IA for VLAN ............................................................................................................. 366
C ha pte r 35 Erro r Disa b le ......................................................................................................................................368
35.1 Error Disable Overview ............................................................................................................... 368 35.1.1 CPU Protection Overview ................................................................................................ 368 35.1.2 Error-Disable Recovery Overview .................................................................................... 368 35.1.3 What You Can Do ............................................................................................................. 368
35.2 Error Disable Settings .................................................................................................................. 369 35.3 Error-Disable Status ..................................................................................................................... 369 35.4 CPU Protection Configuration ................................................................................................... 371 35.5 Error-Disable Detect Configuration .......................................................................................... 373 35.6 Error-Disable Recovery Configuration ...................................................................................... 374
C ha pte r 36 VLAN Iso la tio n ..................................................................................................................................376
36.1 VLAN Isolation Overview ............................................................................................................ 376 36.2 Configuring VLAN Isolation ........................................................................................................ 376
C ha pte r 37 MAC Pinning .....................................................................................................................................378
XS3800-28 User's Guide
15

Table of Contents
37.1 MAC Pinning Overview .............................................................................................................. 378 37.2 MAC Pinning Configuration ...................................................................................................... 378
C ha pte r 38 Priva te VLAN .....................................................................................................................................381
38.1 Private VLAN Overview .............................................................................................................. 381 38.1.1 Configuration .................................................................................................................... 382
C ha pte r 39 G re e n Ethe rne t .................................................................................................................................385
39.1 Green Ethernet Overview .......................................................................................................... 385 39.2 Configuring Green Ethernet ...................................................................................................... 385
C ha pte r 40 Link La ye r Disc o ve ry Pro to c o l (LLDP) .............................................................................................388
40.1 LLDP Overview ............................................................................................................................ 388 40.2 LLDP-MED Overview ................................................................................................................... 389 40.3 LLDP Settings ............................................................................................................................... 390 40.4 LLDP Local Status ........................................................................................................................ 391
40.4.1 LLDP Local Port Status Detail ........................................................................................... 393 40.5 LLDP Remote Status .................................................................................................................... 396
40.5.1 LLDP Remote Port Status Detail ....................................................................................... 397 40.6 LLDP Configuration ..................................................................................................................... 403
40.6.1 LLDP Configuration Basic TLV Setting .............................................................................. 405 40.6.2 LLDP Configuration Org-specific TLV Setting ................................................................. 406 40.7 LLDP-MED Configuration ............................................................................................................ 408 40.8 LLDP-MED Network Policy .......................................................................................................... 409 40.9 LLDP-MED Location .................................................................................................................... 411
C ha pte r 41 Anti- Arpsc a n ....................................................................................................................................416
41.1 Anti-Arpscan Overview .............................................................................................................. 416 41.1.1 What You Can Do ............................................................................................................. 416 41.1.2 What You Need to Know ................................................................................................. 416
41.2 Anti-Arpscan Status .................................................................................................................... 417 41.3 Anti-Arpscan Host Status ............................................................................................................ 418 41.4 Anti-Arpscan Trust Host .............................................................................................................. 419 41.5 Anti-Arpscan Configure ............................................................................................................. 419
C ha pte r 42 BPDU G ua rd ......................................................................................................................................422
42.1 BPDU Guard Overview ............................................................................................................... 422 42.1.1 What You Can Do ............................................................................................................. 422
XS3800-28 User's Guide
16

Table of Contents
42.2 BPDU Guard Status ..................................................................................................................... 422 42.3 BPDU Guard Configuration ....................................................................................................... 423
C ha pte r 43 O AM ..................................................................................................................................................426
43.1 OAM Overview ........................................................................................................................... 426 43.1.1 What You Can Do ............................................................................................................. 426
43.2 OAM Status .................................................................................................................................. 426 43.2.1 OAM Details ....................................................................................................................... 428
43.3 OAM Configuration .................................................................................................................... 431 43.4 OAM Remote Loopback ........................................................................................................... 433
C ha pte r 44 ZULD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . 4 3 5
44.1 ZULD Overview ............................................................................................................................ 435 44.1.1 What You Can Do ............................................................................................................. 435 44.1.2 What You Need to Know ................................................................................................. 435
44.2 ZULD Status .................................................................................................................................. 436 44.3 ZULD Configuration .................................................................................................................... 438
C ha pte r 45 NLB. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . 4 4 1
45.1 NLB Overview .............................................................................................................................. 441 45.1.1 What You Can Do ............................................................................................................. 441 45.1.2 What You Need to Know ................................................................................................. 442
45.2 MAC Forwarding ........................................................................................................................ 442 45.3 IP Configuration .......................................................................................................................... 444
C ha pte r 46 Wo l Re la y ..........................................................................................................................................446
46.1 Wol Relay Overview ................................................................................................................... 446 46.2 Wol Relay ..................................................................................................................................... 446
C ha pte r 47 Sta tic Ro ute .......................................................................................................................................448
47.1 Static Routing Overview ............................................................................................................ 448 47.1.1 What You Can Do ............................................................................................................. 448
47.2 Static Routing .............................................................................................................................. 449 47.3 IPv4 Static Route ......................................................................................................................... 449 47.4 IPv6 Static Route ......................................................................................................................... 450
C ha pte r 48 Po lic y Ro uting ...................................................................................................................................452
XS3800-28 User's Guide
17

Table of Contents
48.1 Policy Route Overview ............................................................................................................... 452 48.1.1 Benefits ............................................................................................................................... 452
48.2 Configuring Policy Routing Profile ............................................................................................. 452 48.2.1 Policy Routing Rule Configuration .................................................................................. 453
C ha pte r 49 RIP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . 4 5 6
49.1 RIP Overview ............................................................................................................................... 456 49.1.1 Administrative Distance ................................................................................................... 456
49.2 RIP Configuration ........................................................................................................................ 457 49.3 Configuring IPv4 RIP ................................................................................................................... 457
C ha pte r 50 O SPF ..................................................................................................................................................459
50.1 OSPF Overview ............................................................................................................................ 459 50.1.1 OSPF Autonomous Systems and Areas ........................................................................... 459 50.1.2 How OSPF Works ................................................................................................................ 460 50.1.3 Interfaces and Virtual Links .............................................................................................. 460 50.1.4 OSPF and Router Elections ............................................................................................... 460 50.1.5 Configuring OSPF .............................................................................................................. 461
50.2 OSPF Screen ................................................................................................................................ 461 50.3 IPv4 OSPF Status .......................................................................................................................... 462 50.4 IPv4 OSPF Configuration ............................................................................................................ 464 50.5 Configure IPv4 OSPF Areas ........................................................................................................ 465
50.5.1 View OSPF Area Information Table ................................................................................. 467 50.6 Configuring IPv4 OSPF Redistribution ....................................................................................... 467 50.7 Configuring IPv4 OSPF Interfaces ............................................................................................. 469 50.8 IPv4 OSPF Virtual-Links ................................................................................................................ 471
C ha pte r 51 IG MP..................................................................................................................................................474
51.1 IGMP Overview ........................................................................................................................... 474 51.1.1 How IGMP Works ............................................................................................................... 475
51.2 Port-based IGMP ........................................................................................................................ 476 51.3 Configuring IGMP ....................................................................................................................... 476
C ha pte r 52 DV M RP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . 4 7 8
52.1 DVMRP Overview ....................................................................................................................... 478 52.2 How DVMRP Works ..................................................................................................................... 478
52.2.1 DVMRP Terminology .......................................................................................................... 479 52.3 Configuring DVMRP .................................................................................................................... 479
52.3.1 DVMRP Configuration Error Messages ............................................................................ 480
XS3800-28 User's Guide
18

Table of Contents
52.4 Default DVMRP Timer Values ..................................................................................................... 481
C ha pte r 53 Diffe re ntia te d Se rvic e s ....................................................................................................................482
53.1 DiffServ Overview ....................................................................................................................... 482 53.1.1 What You Can Do ............................................................................................................. 482 53.1.2 What You Need to Know ................................................................................................. 482
53.2 Activating DiffServ ...................................................................................................................... 483 53.3 DSCP-to-IEEE 802.1p Priority Settings ......................................................................................... 485
53.3.1 Configuring DSCP Settings ............................................................................................... 485
C ha pte r 54 DHC P .................................................................................................................................................487
54.1 DHCP Overview .......................................................................................................................... 487 54.1.1 What You Can Do ............................................................................................................. 487 54.1.2 What You Need to Know ................................................................................................. 487
54.2 DHCP Configuration ................................................................................................................... 488 54.3 DHCPv4 Status ............................................................................................................................ 488
54.3.1 DHCPv4 Server Status Detail ............................................................................................ 489 54.4 DHCPv4 Relay ............................................................................................................................. 490
54.4.1 DHCPv4 Relay Agent Information ................................................................................... 490 54.4.2 DHCPv4 Option 82 Profile ................................................................................................. 491 54.4.3 Configuring DHCPv4 Global Relay ................................................................................. 493 54.4.4 Configure DHCPv4 Global Relay Port ............................................................................ 494 54.4.5 Global DHCP Relay Configuration Example .................................................................. 495 54.4.6 DHCPv4 VLAN Setting ....................................................................................................... 496 54.4.7 Configure DHCPv4 VLAN Port ......................................................................................... 498 54.4.8 Example: DHCP Relay for Two VLANs ............................................................................. 499 54.5 DHCPv6 Status ............................................................................................................................ 500 54.6 DHCPv6 Information ................................................................................................................... 501 54.7 DHCPv6 Prefix Delegation ......................................................................................................... 502 54.8 DHCPv6 Relay ............................................................................................................................. 503 54.9 DHCP Server Guard .................................................................................................................... 505
C ha pte r 55 VRRP ..................................................................................................................................................507
55.1 VRRP Overview ........................................................................................................................... 507 55.2 VRRP Status .................................................................................................................................. 508 55.3 VRRP Configuration .................................................................................................................... 508
55.3.1 IP Interface Setup .............................................................................................................. 508 55.3.2 VRRP Parameters .............................................................................................................. 509 55.3.3 Configuring VRRP Parameters ......................................................................................... 510 55.3.4 Viewing VRRP Summary ................................................................................................... 511
XS3800-28 User's Guide
19

Table of Contents
55.4 VRRP Configuration Examples .................................................................................................. 512 55.4.1 One Subnet Network Example ........................................................................................ 512 55.4.2 Two Subnets Example ....................................................................................................... 513
C ha pte r 56 Ro ute r Se tup .....................................................................................................................................516
56.1 Router Setup Overview .............................................................................................................. 516 56.2 Configuring Router Setup .......................................................................................................... 516
C ha pte r 57 ARP Se tup..........................................................................................................................................518
57.1 ARP Overview ............................................................................................................................. 518 57.1.1 What You Can Do ............................................................................................................. 518 57.1.2 What You Need to Know ................................................................................................. 518
57.2 ARP Setup .................................................................................................................................... 520 57.2.1 ARP Learning ..................................................................................................................... 520 57.2.2 Static ARP ........................................................................................................................... 522
C ha pte r 58 Ma inte na nc e ....................................................................................................................................524
58.1 Overview ..................................................................................................................................... 524 58.1.1 What You Can Do ............................................................................................................. 524
58.2 Maintenance Settings ................................................................................................................ 524 58.2.1 Erase Running-Configuration ........................................................................................... 526 58.2.2 Save Configuration ........................................................................................................... 526 58.2.3 Reboot System .................................................................................................................. 527 58.2.4 Stacking Default ................................................................................................................ 527 58.2.5 Factory Default .................................................................................................................. 528 58.2.6 Custom Default ................................................................................................................. 528
58.3 Firmware Upgrade ...................................................................................................................... 529 58.4 Restore Configuration ................................................................................................................ 531 58.5 Backup Configuration ................................................................................................................ 531 58.6 Auto Configuration .................................................................................................................... 532 58.7 Tech-Support ............................................................................................................................... 533
58.7.1 Tech-Support Download .................................................................................................. 535 58.8 Certificates .................................................................................................................................. 535
58.8.1 HTTPS Certificates .............................................................................................................. 537 58.9 Technical Reference .................................................................................................................. 538
58.9.1 FTP Command Line ........................................................................................................... 538 58.9.2 Filename Conventions ...................................................................................................... 538 58.9.3 FTP Command Line Procedure ........................................................................................ 539 58.9.4 GUI-based FTP Clients ....................................................................................................... 539 58.9.5 FTP Restrictions ................................................................................................................... 539
XS3800-28 User's Guide
20

Table of Contents
C ha pte r 59 Ac c e ss C o ntro l.................................................................................................................................541
59.1 Access Control Overview .......................................................................................................... 541 59.1.1 What You Can Do ............................................................................................................. 541
59.2 Access Control Main Settings .................................................................................................... 541 59.3 Configure SNMP .......................................................................................................................... 542
59.3.1 Configure SNMP Trap Group ........................................................................................... 543 59.3.2 Enable or Disable Sending of SNMP Traps on a Port ..................................................... 544 59.3.3 Configure SNMP User ........................................................................................................ 546 59.4 Set Up Login Accounts ............................................................................................................... 548 59.5 Service Access Control .............................................................................................................. 549 59.6 Remote Management ............................................................................................................... 550 59.7 Technical Reference .................................................................................................................. 551 59.7.1 About SNMP ....................................................................................................................... 552 59.7.2 SSH Overview ..................................................................................................................... 558 59.7.3 Introduction to HTTPS ........................................................................................................ 560 59.7.4 Google Chrome Warning Messages .............................................................................. 564
C ha pte r 60 Dia g no stic .........................................................................................................................................566
60.1 Overview ..................................................................................................................................... 566 60.2 Diagnostic ................................................................................................................................... 566
C ha pte r 61 Syste m Lo g ........................................................................................................................................570
61.1 Overview ..................................................................................................................................... 570 61.2 System Log .................................................................................................................................. 570
C ha pte r 62 Syslo g Se tup .....................................................................................................................................571
62.1 Syslog Overview .......................................................................................................................... 571 62.1.1 What You Can Do ............................................................................................................. 571
62.2 Syslog Setup ................................................................................................................................ 571
C ha pte r 63 C luste r Ma na g e m e nt.......................................................................................................................574
63.1 Cluster Management Overview ............................................................................................... 574 63.1.1 What You Can Do ............................................................................................................. 575
63.2 Cluster Management Status ..................................................................................................... 575 63.3 Clustering Management Configuration .................................................................................. 576 63.4 Technical Reference .................................................................................................................. 577
63.4.1 Cluster Member Switch Management ........................................................................... 578
XS3800-28 User's Guide
21

Table of Contents
C ha pte r 64 MAC Ta b le ........................................................................................................................................580
64.1 MAC Table Overview ................................................................................................................. 580 64.1.1 What You Can Do ............................................................................................................. 580 64.1.2 What You Need to Know ................................................................................................. 580
64.2 Viewing the MAC Table ............................................................................................................. 581
C ha pte r 65 IP Ta b le ..............................................................................................................................................583
65.1 IP Table Overview ....................................................................................................................... 583 65.2 Viewing the IP Table ................................................................................................................... 584
C ha pte r 66 ARP Ta b le ..........................................................................................................................................585
66.1 Overview ..................................................................................................................................... 585 66.1.1 What You Can Do ............................................................................................................. 585 66.1.2 What You Need to Know ................................................................................................. 585
66.2 Viewing the ARP Table ............................................................................................................... 585
C ha pte r 67 Ro uting Ta b le ....................................................................................................................................587
67.1 Routing Table Overview ............................................................................................................ 587 67.2 The Routing Table Main Screen ................................................................................................ 587 67.3 IPv4 Routing Table ...................................................................................................................... 587 67.4 IPv6 Routing Table ...................................................................................................................... 588
C ha pte r 68 Pa th MTU Ta b le .................................................................................................................................589
68.1 Path MTU Overview .................................................................................................................... 589 68.2 Viewing the Path MTU Table ..................................................................................................... 589
C ha pte r 69 C o nfig ure C lo ne ...............................................................................................................................590
69.1 Overview ..................................................................................................................................... 590 69.2 Configure Clone ......................................................................................................................... 590
C ha pte r 70 IPv6 Ne ig hb o r Ta b le .........................................................................................................................594
70.1 IPv6 Neighbor Table Overview .................................................................................................. 594 70.2 Viewing the IPv6 Neighbor Table ............................................................................................. 594
C ha pte r 71 Po rt Sta tus .........................................................................................................................................596
XS3800-28 User's Guide
22

Table of Contents
71.1 Overview ..................................................................................................................................... 596 71.2 Status ............................................................................................................................................ 596 71.3 Port Status .................................................................................................................................... 596
71.3.1 Port Details ......................................................................................................................... 598 71.3.2 DDMI ................................................................................................................................... 601 71.3.3 DDMI Details ...................................................................................................................... 602 71.3.4 Port Utilization .................................................................................................................... 604 C ha pte r 72 Se rvic e Re g iste r................................................................................................................................606 72.1 Service Register Overview ......................................................................................................... 606 72.2 Service Register Screen ............................................................................................................. 606
Pa rt III: Tro ub le sho o ting a nd Appe ndic e s .................................................. 608
C ha pte r 73 Tro ub le sho o ting ................................................................................................................................609
73.1 Power, Hardware Connections, and LEDs ............................................................................... 609 73.2 Switch Access and Login ........................................................................................................... 610 73.3 Switch Configuration .................................................................................................................. 612
Appendix A Customer Support ..................................................................................................... 613 Appendix B Common Services ...................................................................................................... 619 Appendix C IPv6.............................................................................................................................. 622 Appendix D Legal Information ...................................................................................................... 630
Inde x .................................................................................................................................................635
XS3800-28 User's Guide
23

PA RT I
Use r's G uide
24

C HA PTER 1 G e tting to Kno w Yo ur Switc h
1.1 Intro duc tio n
This chapter introduces the main features and applications of the Switch. Your Switch is a stackable, layer-3, 10 Gigabit Ethernet (GbE) switch supporting Multi-Gigabit. See Section 1.1.1 on page 26 for more information about Multi-Gigabit. The Switch comes with two power slots for dual AC power supply modules. You could use 10 Gigabit SFP+ slots for fiber connections to the backbone switches, and you could use the 10 Gbps Ethernet ports for connections to other Ethernet devices requiring high-bandwidth, such as network-attached storage (NAS), game consoles, servers, and so on. The last four combo ports can also be used for stacking. When working in stacking mode, the Switch can operate together with other Switches of the same model and firmware version and allows you to remotely manage them from one switch using one single IP address. The Switch performs full layer-2 switching features and basic layer-3 routing features, such as static route, and IGMP.
XS3800-28 User's Guide
25

Chapter 1 Getting to Know Your Switch Fig ure 1 Switch Application
1.1.1 Multi- G ig a b it
A 10 Gigabit port supports speeds of 10 Gbps if the connected device supports 10 Gbps and a Cat 6a (up to 100 m) or Cat 6 cable (up to 50 m) is used. The speed drops to 1G if these criteria are not met; it drops to 100 Mbps if a Cat 5 cable is used (up to 100 m). If a network device such as a 5G network card, gaming computer, server, Network Attached Storage (NAS) or Access Point (AP) only supports 2.5 Gigabit or 5 Gigabit connectivity, then the maximum speed potential of these devices is never reached. In addition, at the time of writing, most existing cabling is Cat 5e or Cat 6, further limiting maximum speed or distance potential. Multi-Gigabit (IEEE 802.3bz) solves these problems by additionally supporting 2.5 Gigabit and 5 Gigabit Ethernet connections over Cat 5e and higher Ethernet cables. Multi-Gigabit ports are also backward compatible with 100 Mbps and 1 Gigabit ports.
XS3800-28 User's Guide
26

Chapter 1 Getting to Know Your Switch Fig ure 2 Multi-Gigabit Application

See the following table for the cables required and distance limitation to attain the corresponding speed.

Table 1 Cable Types

C ABLE

TRANSMISSIO N SPEED MAXIMUM DISTANC E

Category 5

100 Mbps

100 m

Category 5e 1 Gbps/2.5 Gbps/5Gbps

100 m

Category 6

5 Gbps/10 Gbps

50 m

Category 6a

10 Gbps

100 m

Category 7

10 Gbps

100 m

BANDWIDTH C APAC ITY 100 MHz 100 MHz 250 MHz 500 MHz 650 MHz

Note: Make sure to select the correct speed for the port in Ba sic Se tting > Po rt Se tup.

1.1.2 Sta c king Mo de
The Switch can work in stacking mode and directly connect to other switches. The switches then operate together and act as a single switch or a virtual chassis. The stackable switches can be managed from a master switch in the stack.
Note: To set the Switch to stacking mode, go to the Ba sic Se tting > Sta c king > C o nfig ura tio n screen.
Note: When the Switch is in stacking mode, it uses the default static IP address 192.168.1.1.

XS3800-28 User's Guide
27

Chapter 1 Getting to Know Your Switch
Fig ure 3 Stacking Example
1.1.3 Ma na g e m e nt Me tho d
With its built-in Web Configurator, managing and configuring the Switch is easy. In addition, the Switch can also be managed via Telnet, any terminal emulator program using the Command Line Interface (CLI), or third-party SNMP management.
1.1.4 Ma na g e m e nt Mo de s
NebulaFlex for `hybrid mode' means you can set the Switch to operate in only one of either direct standalone or cloud mode (not both at the same time). The Nebula Control Center (NCC) is an alternative cloud-based network management system that allows you to remotely manage and monitor the Switch in cloud mode. Note: Hybrid mode and NCC registration are reserved for future use. Use the Web Configurator to configure and manage the Switch directly in standalone mode or use Nebula Control Center (NCC) to configure and manage the Switch in cloud mode. You may also access a minimized version of the Web Configurator in cloud mode.
1.1.5 Mo de C ha ng ing
This section describes how to change the Switch's management mode. Note: Hybrid mode and NCC registration are reserved for future use. Note: If you change the Switch's management mode from standalone mode to Nebula-
managed mode, the configuration settings of the Switch will be overwritten with what you have configured in Nebula. Note: If you change the Switch's management mode from Nebula-managed mode to standalone mode, the Switch will reset to its factory-default settings.
Fro m Sta nda lo ne to Ne b ula C lo ud Ma na g e m e nt
To manage your Switch via Nebula, connect the Switch to the Internet, and register it to a site and organization at the Nebula web portal (https://nebula.zyxel.com). See the following steps or the Switch Quick Start Guide for how to do device registration.
G o to the NC C to Re g iste r the Switc h
1 Go to the Nebula web portal in one of three ways.
XS3800-28 User's Guide
28

Chapter 1 Getting to Know Your Switch
· Type https://nebula.zyxel.com in a supported web browser. See the Nebula User's Guide for more information about supported browsers.
· Click Visit Ne b ula in the Switch's login page. · Click the Ne bula icon in the upper right corner of the Switch's Web Configurator.
2 Click Lo g in in the Nebula web portal. Enter your myZyxel account information. You will be redirected to another screen where you can sign up for a myZyxel account if you do not have one.
3 Create an organization and a site or select an existing site using the Nebula setup wizard.
4 Register the Switch by entering its MAC address and serial number and assign it to the site. The serial number and MAC address can be found in the Sta tus screen or the device back label on the Switch.
Use the Zyxe l Ne b ula Mo b ile App to Re g iste r the Switc h
1 Download and open the Zyxel Nebula Mobile app in your mobile device. Click Sig n Up to create a myZyxel account or enter your existing account information to log in.
2 Create an organization and site, or select an existing site using the Zyxel Nebula Mobile app.
3 Select a site and scan the Switch's QR code to add it to the site. You can find the QR code: · On a label on the Switch or · On its box or · In the Web Configurator at Ba sic > C lo ud Ma na g e m e nt > Ne b ula Switc h Re g istra tio n.
See Section 3.3 on page 45 for more information about the C LO UD LED or Section 7.2 on page 81 for more information about the Hyb rid Mo de field in the Sta tus screen to see if the Switch goes into Nebula cloud management mode successfully.
Note: The Switch goes into Nebula-managed mode automatically after it can access the Nebula web portal and is successfully registered there. Its login password and settings are then overwritten with what you have configured in the Nebula web portal.
Fro m Ne b ula - m a na g e d to Sta nda lo ne
To return to direct management standalone mode, just remove (unregister) the Switch from the organization or site in the Nebula web portal. The Switch will reboot and restore the factory default settings.
1.1.6 ZO N Utility
With its built-in Web Configurator, including the Neighbor Management feature (Section 7.2.1 on page 83), viewing, managing and configuring the Switch and its neighboring devices is simplified.
In addition, Zyxel offers a proprietary software program called Zyxel One Network (ZON) Utility, it is a utility tool that assists you to set up and maintain network devices in a more simple and efficient way. You can download the ZON Utility at www.zyxel.com and install it on a PC (Windows operation system). For more information on ZON Utility see Section 4.3 on page 51.
The following table shows which firmware version supports ZON and Neighbor Management (Smart Connect) for each Switch. The firmware on each Switch is identified by the firmware trunk version, followed by a unique model code and release number in brackets. For example, 4.70(ABML.0) is a
XS3800-28 User's Guide
29

Chapter 1 Getting to Know Your Switch

firmware version for the Switch where 4.70 is the firmware trunk version, ABML identifies the Switch and .0 is the first release of trunk version 4.70.

Table 2 Models and Firmware Version

SWITC H MO DEL

FIRMWARE VERSIO N

XS3800-28

4.70(ABML.0) and later

1.2 Exa m ple Applic a tio ns
This section shows a few examples of using the Switch in various network environments. Note that the Switch in the figure is just an example Switch and not your actual Switch.
1.2.1 Bridg ing Exa m ple
In this example, the Switch connects different company departments (RD and Sa le s) to the corporate backbone. It can alleviate bandwidth contention and eliminate server and network bottlenecks. All users that need high bandwidth can connect to high-speed department servers via the Switch. You can provide a super-fast uplink connection by using a Gigabit Ethernet or SFP port on the Switch.
Fig ure 4 Bridging Application

1.2.2 Hig h Pe rfo rm a nc e Switc hing Exa m ple
The Switch is ideal for connecting two geographically dispersed networks that need high bandwidth. In the following example, a company uses the 10 Gigabit uplink ports to connect the headquarters to a branch office network. Within the headquarters network, a company can use trunking to group several physical ports into one logical higher-capacity link. Trunking can be used if for example, it is cheaper to use multiple lower-speed links than to under-utilize a high-speed, but more costly, single-port link.
XS3800-28 User's Guide
30

Chapter 1 Getting to Know Your Switch Fig ure 5 High Performance Switching
1.2.3 IEEE 802.1Q VLAN Applic a tio n Exa m ple s
A VLAN (Virtual Local Area Network) allows a physical network to be partitioned into multiple logical networks. Stations on a logical network belong to one or more groups. With VLAN, a station cannot directly talk to or hear from stations that are not in the same groups unless such traffic first goes through a router.
1.2.3.1 Ta g - b a se d VLAN Exa m ple
Ports in the same VLAN group share the same frame broadcast domain thus increase network performance through reduced broadcast traffic. VLAN groups can be modified at any time by adding, moving or changing ports without any re-cabling. Shared resources such as a server can be used by all ports in the same VLAN as the server. In the following figure only ports that need access to the server need to be part of VLAN 1. Ports can belong to other VLAN groups too. Fig ure 6 Shared Server Using VLAN Example
XS3800-28 User's Guide
31

Chapter 1 Getting to Know Your Switch
1.2.4 IPv6 Suppo rt
IPv6 (Internet Protocol version 6), is designed to enhance IP address size and features. The increase in IPv6 address size to 128 bits (from the 32-bit IPv4 address) allows up to 3.4 x 1038 IP addresses. At the time of writing, the Switch supports the following features.
· Static address assignment · Neighbor Discovery Protocol (a protocol used to discover other IPv6 devices in a network) · Remote Management using ping SNMP, SSH, telnet, HTTP and FTP services · ICMPv6 to report errors encountered in packet processing and perform diagnostic functions, such as
"ping" · IPv4/IPv6 dual stack; the Switch can run IPv4 and IPv6 at the same time · DHCPv6 client and relay · Multicast Listener Discovery (MLD) snooping and proxy
For more information on IPv6, refer to Appendix C on page 622 and the CLI Reference Guide.
1.3 Wa ys to Ma na g e the Switc h
Use any of the following methods to manage the Switch.
· NCC (Zyxel Nebula Control Center). With the NCC, you can remotely manage and monitor the Switch through a cloud-based network management system. See Section 8.12 on page 129 or the NCC User's Guide for detailed information about how to access the NCC and manage your Switch via the NCC. See the NCC User's Guide for how to configure Nebula managed devices.
· Web Configurator. This is recommended for everyday management of the Switch using a (supported) web browser. See Chapter 4 on page 48.
· Command Line Interface. Line commands offer an alternative to the Web Configurator and in some cases are necessary to configure advanced features. See the CLI Reference Guide.
· FTP. Use File Transfer Protocol for firmware upgrades and configuration backup or restore. See Section 58.9.1 on page 538.
· SNMP. The Switch can be monitored and/or managed by an SNMP manager. See Section 59.7.1 on page 552.
· Cluster Management. Cluster Management allows you to manage multiple switches through one switch, called the cluster manager. See Chapter 63 on page 574.
· ZON Utility. ZON Utility is a program designed to help you deploy and perform initial setup on a network more efficiently. See Section 4.3 on page 51.
1.4 G o o d Ha b its fo r Ma na g ing the Switc h
Do the following things regularly to make the Switch more secure and to manage the Switch more effectively.
· Change the password. Use a password that is not easy to guess and that consists of different types of characters, such as numbers and letters.
· Write down the password and put it in a safe place.
XS3800-28 User's Guide
32

Chapter 1 Getting to Know Your Switch · Back up the configuration (and make sure you know how to restore it). Restoring an earlier working
configuration may be useful if the device becomes unstable or even crashes. If you forget your password, you will have to reset the Switch to its factory default settings. If you backed up an earlier configuration file, you would not have to totally re-configure the Switch. You could simply restore your last configuration.
XS3800-28 User's Guide
33

C HA PTER 2 Ha rdwa re Insta lla tio n a nd
C o nne c tio n
This chapter shows you how to install and connect the Switch.
2.1 Sa fe ty Pre c a utio ns
Please observe the following before using the Switch: · It is recommended to ask an authorized technician to attach the Switch on a desk or to the rack or
wall. Use the proper screws to prevent damage to the Switch. See the Insta lla tio n Re q uire m e nts sections in this chapter to know the types of screws and screwdrivers for each mounting method. · Make sure there is at least 2 cm of clearance on the top and bottom of the Switch, and at least 5 cm of clearance on all four sides of the Switch. This allows air circulation for cooling. · Do NOT block the ventilation holes nor store cables or power cords on the Switch. Allow clearance for the ventilation holes to prevent your Switch from overheating. This is especially crucial when your Switch does not have fans. Overheating could affect the performance of your Switch, or even damage it. · The surface of the Switch could be hot when it is functioning. Do NOT put your hands on it. You may get burned. This could happen especially when you are using a fanless Switch. · The Switches with fans are not suitable for use in locations where children are likely to be present. To start using the Switch, simply connect the power cables and turn it on.
2.2 Fre e sta nding Insta lla tio n Pro c e dure
1 Make sure the Switch is clean and dry. 2 Remove the adhesive backing from the rubber feet. 3 Attach the rubber feet to each corner on the bottom of the Switch. These rubber feet help protect the
Switch from shock or vibration and ensure space between devices when stacking.
XS3800-28 User's Guide
34

Chapter 2 Hardware Installation and Connection
Fig ure 7 Attaching Rubber Feet
4 Set the Switch on a smooth, level surface strong enough to support the weight of the Switch and the connected cables. Make sure there is a power outlet nearby.
C a utio ns:
· Avoid stacking fanless Switches to prevent overheating. · Ensure enough clearance around the Switch to allow air circulation for cooling. · Do NOT remove the rubber feet as it provides space for air circulation.
2.3 Mo unting the Switc h o n a Ra c k
The Switch can be mounted on an EIA standard size, 19-inch rack or in a wiring closet with other equipment. Follow the steps below to mount your Switch on a standard EIA rack using a rack-mounting kit. Note: Make sure there is enough clearance between each equipment on the rack for air
circulation.
2.3.1 Insta lla tio n Re q uire m e nts
· Two mounting brackets. · Eight M3 flat head screws and a #2 Philips screwdriver. · Four M5 flat head screws and a #2 Philips screwdriver.
2.3.2 Pre c a utio ns
· Make sure the rack will safely support the combined weight of all the equipment it contains. The maximum weight a bracket can hold is 21.5 kg.
· Make sure the position of the Switch does not make the rack unstable or top-heavy. Take all necessary precautions to anchor the rack securely before installing the unit.
XS3800-28 User's Guide
35

Chapter 2 Hardware Installation and Connection
2.3.3 Atta c hing the Mo unting Bra c ke ts to the Switc h
1 Position a mounting bracket on one side of the Switch, lining up the four screw holes on the bracket with the screw holes on the side of the Switch. Fig ure 8 Attaching the Mounting Brackets
2 Using a #2 Philips screwdriver, install the M3 flat head screws through the mounting bracket holes into the Switch.
3 Repeat steps 1 and 2 to install the second mounting bracket on the other side of the Switch. 4 You may now mount the Switch on a rack. Proceed to the next section.
2.3.4 Mo unting the Switc h o n a Ra c k
1 Position a mounting bracket (that is already attached to the Switch) on one side of the rack, lining up the two screw holes on the bracket with the screw holes on the side of the rack. Fig ure 9 Mounting the Switch on a Rack
XS3800-28 User's Guide
36

Chapter 2 Hardware Installation and Connection 2 Using a #2 Philips screwdriver, install the M5 flat head screws through the mounting bracket holes into
the rack. Note: Make sure you tighten all the four screws to prevent the Switch from getting slanted. 3 Repeat steps 1 and 2 to attach the second mounting bracket on the other side of the rack.
XS3800-28 User's Guide
37

Chapter 3 Hardware Panels
C HA PTER 3 Ha rdwa re Pa ne ls

This chapter describes the front panel and rear panel of the Switch and shows you how to make the hardware connections.
3.1 Fro nt Pa ne l C o nne c tio ns
The Switch supports 16 SFP+ slots and four 10 Gigabit Ethernet ports. The Switch also comes with eight dual personality interfaces of 10 Gigabit. A dual personality interface includes one Gigabit port and one slot for a SFP+ module with one port active at a time. Ethernet ports support Multi-Gigabit (100 Mbps, 1 Gbps, 2.5 Gbps, 5 Gbps, and 10 Gbps). The figure below shows the front panel of the Switch. Fig ure 10 Front Panel: XS3800-28

The following table describes the ports.

Table 3 Panel Connections

C O NNEC TO R

DESC RIPTIO N

16 10 GbE SFP+ Slots Use SFP+ transceivers in these ports for high-bandwidth backbone connections. You can also insert an SFP+ Direct Attach Copper (DAC) in the SFP+ slot.

4 100 Mbps, 1 Gbps, 2.5 Gbps, 5 Gbps, and 10 Gbps RJ-45 Ethernet Ports

These are 10GBase-T auto-negotiating and auto-crossover Ethernet ports. Connect these ports to a computer, a hub, a router, or an Ethernet switch.

8 10 GbE Combo Ports (Dual Personality Interfaces)

Each interface has one 10GBase-T copper RJ-45 port and one SFP slot, with one port active at a time.
· 8 10GBase-T Ports:
Connect these ports to a computer, an Ethernet switch or router.

· 8 SFP+ Slots: Use Small Form-Factor Pluggable (SFP) transceivers in these ports for fiber-optic connections to an Ethernet switch or router.

RJ-45 out-of-band Connect to a computer using an RJ-45 Ethernet cable for local configuration of the Switch. Management Port

Console Port

Only connect this port to your computer (using an RS-232 cable) if you want to configure the Switch using the command line interface (CLI) via the console port.

XS3800-28 User's Guide
38

Chapter 3 Hardware Panels

Table 3 Panel Connections (continued)

C O NNEC TO R

DESC RIPTIO N

RESET

Press the RESETbutton to reboot the Switch without turning the power off.

RESTORE

Press the RESTO RE button for 3 to 6 seconds to have the Switch automatically reboot and restore the last-saved custom default file.

Press the RESTO RE button for more than 7 seconds to have the Switch automatically reboot and restore the factory default file.

3.1.1 Ethe rne t Po rts
The Switch has 10GBase-T auto-negotiating, auto-crossover Ethernet ports. In Multi-Gigabit Ethernet, the speed can be 100 Mbps, 1 Gbps, 2.5 Gbps, 5 Gbps, or 10 Gbps. The duplex mode can be full duplex at 100 Mbps and full duplex only at 1000 Mbps.
An auto-negotiating port can detect and adjust to the optimum Ethernet speed (10/100/1000 Mbps) and full duplex mode of the connected device.
An auto-negotiating port can detect and adjust to the optimum Ethernet speed (100 Mbps, 1 Gbps, 2.5 Gbps, 5 Gbps, and 10 Gbps) and full duplex mode of the connected device.
An auto-crossover (auto-MDI/MDI-X) port automatically works with a straight-through or crossover Ethernet cable.
When auto-negotiation is turned on, an Ethernet port negotiates with the peer automatically to determine the connection speed and duplex mode. If the peer Ethernet port does not support autonegotiation or turns off this feature, the Switch determines the connection speed by detecting the signal on the cable and using half duplex mode. When the Switch's auto-negotiation is turned off, an Ethernet port uses the pre-configured speed and duplex mode when making a connection, thus requiring you to make sure that the settings of the peer Ethernet port are the same in order to connect.
3.1.1.1 De fa ult Ethe rne t Ne g o tia tio n Se tting s
The factory default negotiation settings for the Ethernet ports on the Switch are:
· Speed: Auto · Duplex: Auto · Flow control: Off · Dual Personality Interface: Fiber module first
3.1.2 SFP/ SFP+ Slo ts
The transceiver slots are for Small Form-Factor Pluggable (SFP), SFP+ transceivers or DAC (Direct Attach Cables) cable. The SFP+ (SFP Plus) and the DAC cable are enhanced versions of the SFP and support data rates of up to 10 Gbps. A transceiver is a single unit that houses a transmitter and a receiver. Use a transceiver or a DAC cable to connect a fiber cable to the Switch. The Switch does not come with transceivers nor DAC cables. You must use transceivers or DAC cables that comply with the Small Formfactor Pluggable (SFP) Transceiver MultiSource Agreement (MSA). See the SFF committee's INF-8074i specification Rev 1.0 for details.
You can change transceivers or the DAC cables while the Switch is operating. You can use different transceivers to connect to Ethernet switches with different types of fiber connectors.
XS3800-28 User's Guide
39

· Type: SFP connection interface · Connection speed: 1 or 10 Gigabit per second (Gbps) · Type: SFP+/DAC connection interface
WARNING ! To a vo id po ssib le e ye injury, do no t lo o k into a n o pe ra ting fib e r m o dule 's c o nne c to rs. HANDLING ! All tra nsc e ive rs a re sta tic se nsitive . To pre ve nt da m a g e fro m e le c tro sta tic disc ha rg e (ESD), it is re c o m m e nde d yo u a tta c h a n ESD pre ve ntive wrist stra p to yo ur wrist a nd to a b a re m e ta l surfa c e whe n yo u insta ll o r re m o ve a tra nsc e ive r. STO RAG E! All m o dule s a re dust se nsitive . Whe n no t in use , a lwa ys ke e p the dust plug o n. Avo id g e tting dust a nd o the r c o nta m ina nt into the o ptic a l b o re s, a s the o ptic s do no t wo rk c o rre c tly whe n o b struc te d with d ust. 3.1.2.1 Tra nsc e ive r Insta lla tio n
Use the following steps to install a transceiver.
1 Attach an ESD preventive wrist strap to your wrist and to a bare metal surface. 2 Align the transceiver in front of the slot opening. 3 Make sure the latch is in the lock position (latch styles vary), then insert the transceiver into the slot with
the exposed section of PCB board facing down. 4 Press the transceiver firmly until it clicks into place. 5 The Switch automatically detects the installed transceiver. Check the LEDs to verify that it is functioning
properly. 6 Remove the dust plugs from the transceiver and cables (dust plug styles vary). 7 Identify the signal transmission direction of the fiber cables and the transceiver. Insert the fiber cable into
the transceiver. Fig ure 11 Latch in the Lock Position
Fig ure 12 Transceiver Installation Example
XS3800-28 User's Guide
40

Chapter 3 Hardware Panels Fig ure 13 Connecting the Fiber Cables
3.1.2.2 Tra nsc e ive r Re m o va l
Use the following steps to remove an SFP transceiver. 1 Attach an ESD preventive wrist strap to your wrist and to a bare metal surface on the chassis. 2 Remove the fiber cables from the transceiver. 3 Pull out the latch and down to unlock the transceiver (latch styles vary).
Note: Make sure the transceiver's latch is pushed all the way down, so the transceiver can be pulled out successfully.
4 Pull the latch, or use your thumb and index finger to grasp the tabs on both sides of the transceiver, and carefully slide it out of the slot. Note: Do NOT pull the transceiver out by force. You could damage it. If the transceiver will not slide out, grasp the tabs on both sides of the transceiver with a slight up or down motion and carefully slide it out of the slot. If unsuccessful, contact Zyxel Support to prevent damage to your Switch and transceiver.
5 Insert the dust plug into the ports on the transceiver and the cables. Fig ure 14 Removing the Fiber Cables
Fig ure 15 Opening the Transceiver's Latch Example
Fig ure 16 Transceiver Removal Example
XS3800-28 User's Guide
41

Chapter 3 Hardware Panels
3.1.3 Dua l Pe rso na lity Inte rfa c e s
A combo port is for uplink connections. It consists of a 10 Gigabit Ethernet port for Ethernet connection, and a SFP+ transceiver slot for fiber connection. The fiber connection takes priority if the corresponding Gigabit port is also connected. · 100 Mbps/1 Gbps/2.5 Gbps/5 Gbps/10 Gbps Connect these ports to high-bandwidth backbone
network Ethernet switches using Category 5e/6/6a/7 copper cables. · Transceiver Slots Use SFP/SFP+ transceivers in these slots for connections to backbone Ethernet
switches. Fig ure 17 Combo Port Example: 10 Gigabit Port and SFP+ Transceiver Slot
3.1.4 Ma na g e m e nt Po rt
The 1000Base-T Ethernet MG MT(management) port is used for local management. Connect directly to this port using an Ethernet cable. You can configure the Switch via Telnet or the Web Configurator. The default IP address of the management port is 192.168.0.1 with a subnet mask of 255.255.255.0.
3.1.5 C o nso le Po rt
This console port is for troubleshooting only. With instructions from customer support, connect the male 9pin end of the RS-232 console cable to the console port of the Switch. Connect the female end to a serial port (COM1, COM2 or other COM port) of your computer. You can use a computer with terminal emulation software configured to the following parameters: · VT100 terminal emulation · 115200 bps · No parity, 8 data bits, 1 stop bit · No flow control
3.2 Re a r Pa ne l
The following figures show the rear panels of the Switch. The rear panels contain: · Two AC power receptacles (A and B) Fig ure 18 Rear Panel: XS3800-28
A B
XS3800-28 User's Guide
42

Chapter 3 Hardware Panels
3.2.1 G ro unding
Grounding is a safety measure to direct excess electric charge to the ground. It prevents damage to the Switch, and protects you from electrocution. Use the grounding screw on the rear panel and the ground wire of the AC power supply to ground the Switch. The grounding terminal and AC power ground where you install the Switch must follow your country's regulations. Qualified service personnel must ensure the building's protective earthing terminals are valid terminals. Installation of Ethernet cables must be separate from AC power lines. To avoid electric surge and electromagnetic interference, use a different electrical conduit or raceway (tube/trough or enclosed conduit for protecting electric wiring) that is 15 cm apart, or as specified by your country's electrical regulations. Any device that is located outdoors and connected to this product must be properly grounded and surge protected. To the extent permissible by your country's applicable law, failure to follow these guidelines could result in damage to your Switch which may not be covered by its warranty. Note: The specification for surge or ESD protection assumes that the Switch is properly
grounded. 1 Remove the M4 ground screw from the Switch's rear panel. 2 Secure a green or yellow ground cable (16 AWG or smaller) to the Switch's rear panel using the M4
ground screw. Fig ure 19 Grounding
3 Attach the other end of the ground cable to a grounding bar located on the rack where you install the Switch or to an on-site grounding terminal. Fig ure 20 Attach Ground Cable to Grounding Bar or On-site Grounding Terminal
XS3800-28 User's Guide
43

Chapter 3 Hardware Panels 4 The grounding terminal of the server rack or on-site grounding terminal must also be grounded and
connected to the building's main grounding electrode. Make sure the grounding terminal is connected to the buildings grounding electrode and has an earth resistance of less than 10 ohms, or according to your country's electrical regulations. Fig ure 21 Connecting to the Building's Main Grounding Electrode
If you are uncertain that suitable grounding is available, contact the appropriate electrical inspection authority or an electrician.
This de vic e m ust b e g ro unde d. Do this b e fo re yo u m a ke o the r c o nne c tio ns.
3.2.2 AC Po we r C o nne c tio n
Note: Make sure you are using the correct power source as shown on the panel and that no objects obstruct the airflow of the fans (located on the side of the unit).
The Switch uses two power supply modules, one of which is redundant, so if one power module fails the system can operate on the remaining module.
C o nne c ting the Po we r
Use the following procedures to connect the Switch to a power source after you have installed it in a rack. Note: Use the included power cord for the AC power connection. 1 Connect the female end of the power cord to the AC power socket. 2 Connect the other end of the cord to a power outlet.
XS3800-28 User's Guide
44

Chapter 3 Hardware Panels
Disc o nne c ting the Po we r
The power input connectors can be disconnected from the power source individually. 1 Disconnect the power cord from the power outlet. 2 Disconnect the power cord from the AC power socket.

3.3 LEDs

The following table describes the LEDs.

Table 4 LEDs

LED

C O LO R

PWR1

Green

STA TUS On

Blinking

Amber

On Blinking

PWR2

Off

Green

Blinking

Amber

On Blinking

SYS (System) Green Red

Off
On Blinking On Off

DESC RIPTIO N
The Switch is receiving power from the power module in the first power slot.
The Switch is returning to the last-saved custom default configuration settings.
The Switch is returning to its factory default configuration settings.
The PWR1 LED will blink in amber in the following situations:
· The Switch detected a power supply failure with the power cable connected to the Switch and a power source.
· The fans are not functioning at a proper speed or malfunctioning.
The Switch is not receiving power from the power module in the first power slot.
The Switch is receiving power from the power module in the second power slot.
The Switch is returning to the last-saved custom default configuration settings.
The Switch is returning to its factory default configuration settings.
The PWR2 LED will blink in amber in the following situations:
· The Switch detected a power supply failure with the power cable connected to the Switch and a power source.
· The fans are not functioning at a proper speed or malfunctioning.
The Switch is not receiving power from the power module in the second power slot.
The Switch is on and functioning properly.
The Switch is rebooting and performing self-diagnostic tests.
The Switch is functioning abnormally.
The power is off or the system is not ready or malfunctioning.

XS3800-28 User's Guide
45

Chapter 3 Hardware Panels

Table 4 LEDs (continued)

LED

C O LO R STATUS

CLOUD

Green

Amber

Blinking On

Blinking

Off

DESC RIPTIO N
The Switch has successfully connected to the NCC (Nebula Control Center).
The Switch cannot connect to the NCC because it is not registered.
The Switch is registered at the NCC but cannot connect to the NCC. Please check the Internet connection of the Switch.
The Switch is not registered at the NCC and cannot connect to the NCC. Please check the Internet connection of the Switch and register the Switch at NCC.
The Switch is operating in standalone mode. Nebula Control Center Discovery is disabled in Ba sic > C lo ud Ma na g e m e nt > Ne b ula C o ntro l C e nte r Disc o ve ry in the Switch Web Configurator.

Note: Hybrid mode and NCC registration are reserved for future use.

LOCATOR Blue

Blinking

MAST (Master)

Off

Green

Off

Amber On

Ethernet Ports

17 28

Green

On Blinking

Blue

SFP+ Slots
1 16; 21 28

Green Blue

MGMT

Green

(Manageme (Right)

nt)

Amber (Left)

On Blinking Off
On Blinking On Blinking Off On Blinking
On Blinking

Off

STACK ID

The Switch is uploading firmware. While the Switch is doing this, do not turn off the power. Shows the actual location of the Switch between several devices in a rack. The default timer is 30 minutes when you are configuring the Switch. The locator is not functioning or malfunctioning. The Switch is acting as a standalone switch or the master in stacking. The Switch is acting as a non-master member in a stack or it is in standalone mode. There is an error occurred when the Switch is selected as the master member in a stack.
The port has a successful 100 Mbps/1 Gbps/2.5 Gbps/5 Gbps connection. The port is receiving or transmitting data at 100 Mbps/1 Gbps/2.5 Gbps/5 Gbps. The port has a successful 10 Gbps connection. The port is receiving or transmitting data at 10 Gbps. This link is disconnected or the port is disabled.
The port has a successful 1000 Mbps connection. The port is receiving or transmitting data at 1000 Mbps. The port has a successful 10 Gbps connection. The port is receiving or transmitting data 10 Gbps. This link is disconnected. The MG MTport is connected at 10/1000 Mbps. The system is transmitting or receiving to or from an Ethernet device at 10/ 1000 Mbps through the MG MTport. The MG MTport is connected at 100 Mbps. The system is transmitting or receiving to or from an Ethernet device at 100 Mbps through the MG MTport. The MG MTport is not connected to an Ethernet device, or the port is disabled. The LED is showing the Stack ID number of the Switch.
ID 0 means it is a standalone Switch.

XS3800-28 User's Guide
46

PA RT II
Te c hnic a l Re fe re nc e
47

C HA PTER 4 We b C o nfig ura to r
4.1 O ve rvie w
This section introduces the configuration and functions of the Web Configurator. The Web Configurator is an HTML-based management interface that allows easy system setup and management via Internet browser. Use a browser that supports HTML5, such as Microsoft Edge, Internet Explorer 11, Mozilla Firefox, or Google Chrome. The recommended screen resolution is 1024 by 768 pixels. In order to use the Web Configurator you need to allow: · Web browser pop-up windows from your device. · JavaScript (enabled by default). · Java permissions (enabled by default).
4.2 Syste m Lo g in
1 Start your web browser. 2 The Switch is a DHCP client by default. Type "http://DHCP-assigned IP" in the Lo c a tio n or Addre ss field.
Press [ENTER]. If the Switch is not connected to a DHCP server, type "http://" and the static IP address of the Switch (for example, the default management IP address is 192.168.1.1 through an in-band (non-MG MT) port and 192.168.0.1 through the MG MTport) in the Lo c a tio n or Addre ss field. Press [ENTER]. Your computer must be in the same subnet in order to access this website address. Also, you can use the ZON Utility to check your Switch's IP address. See Section 4.3 on page 51 for more information on the ZON utility. 3 The following screen appears.
XS3800-28 User's Guide
48

Chapter 4 Web Configurator Fig ure 22 Web Configurator: Login
4 Click Lo g in to log into the Web Configurator to manage the Switch directly. The default user name is a dm in and associated default password is 1234.
5 If you did not change the default administrator password and/or SNMP community values, a warning screen displays each time you log into the Web Configurator. Click Pa sswo rd / SNMP to open a screen where you can change the administrator password and SNMP community string simultaneously. Otherwise, click Ig no re to close it.
Pa sswo rd/ SNMP Se tting
Fig ure 23 Web Configurator: Warning
XS3800-28 User's Guide
49

Chapter 4 Web Configurator Fig ure 24 Web Configurator: Password

Change the default administrator and/or SNMP passwords, and then click Apply to save your changes.

Table 5 Web Configurator: Password/SNMP

LA BEL

DESC RIPTIO N

Administrator

This is the default administrator account with the "admin" user name. You cannot change the default administrator user name.

Old Password

Type the existing system password (1234 is the default password when shipped).

New Password

Enter your new system password.

Retype to confirm Retype your new system password for confirmation.

General Setting

Use this section to specify the SNMP version and community (password) values.

Version

Select the SNMP version for the Switch. The SNMP version on the Switch must match the version on the SNMP manager. Choose SNMP version 2c (v2c ), SNMP version 3 (v3) or both (v3v2c ).

Get Community Set Community Trap Community Apply Cancel

Note: SNMP version 2c is backwards compatible with SNMP version 1.
Enter the G e t C o m m unity string, which is the password for the incoming Get- and GetNextrequests from the management station.
The G e t C o m m unity string is only used by SNMP managers using SNMP version 2c or lower.
Enter the Se t C o m m unity string, which is the password for the incoming Set- requests from the management station.
The Se t C o m m unity string is only used by SNMP managers using SNMP version 2c or lower.
Enter the Tra p C o m m unity string, which is the password sent with each trap to the SNMP manager.
The Tra p C o m m unity string is only used by SNMP managers using SNMP version 2c or lower.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
50

Chapter 4 Web Configurator
4.3 Zyxe l O ne Ne two rk (ZO N) Utility
ZON Utility is a program designed to help you deploy and manage a network more efficiently. It detects devices automatically and allows you to do basic settings on devices in the network without having to be near it. The ZON Utility issues requests via Zyxel Discovery Protocol (ZDP) and in response to the query, the device responds back with basic information including IP address, firmware version, location, system and model name in the same broadcast domain. The information is then displayed in the ZON Utility screen and you can perform tasks like basic configuration of the devices and batch firmware upgrade in it. You can download the ZON Utility at www.zyxel.com and install it in a computer (Windows operating system).
4.3.1 Re q uire m e nts
Before installing the ZON Utility in your computer, please make sure it meets the requirements listed below.
O pe ra ting Syste m
At the time of writing, the ZON Utility is compatible with: · Windows 7 (both 32-bit / 64-bit versions) · Windows 8 (both 32-bit / 64-bit versions) · Windows 8.1 (both 32-bit / 64-bit versions) · Windows 10 (both 32-bit / 64-bit versions) Note: To check for your Windows operating system version, right-click on My C o m pute r >
Pro pe rtie s. You should see this information in the G e ne ra l tab.
Ha rdwa re
Here are the minimum hardware requirements to use the ZON Utility on your computer. · Core i3 processor · 2 GB RAM · 100 MB free hard disk · WXGA (Wide XGA 1280 by 800)
4.3.2 Run the ZO N Utility
1 Double-click the ZON Utility to run it. 2 The first time you run the ZON Utility, you will see if your device and firmware version support the ZON
Utility. Click the O K button to close this screen.
XS3800-28 User's Guide
51

Chapter 4 Web Configurator Fig ure 25 Supported Devices and Versions
If you want to check the supported models and firmware versions later, you can click the Sho w info rm a tio n a bo ut ZO N icon in the upper right hand corner of the screen. Then select the Suppo rte d m o de l a nd firm wa re ve rsio n link. If your device is not listed here, see the device release notes for ZON Utility support. The release notes are in the firmware zip file on the Zyxel web site. Fig ure 26 ZON Utility Screen
XS3800-28 User's Guide
52

Chapter 4 Web Configurator
3 Select a network adapter to which your supported devices are connected. Fig ure 27 Network Adapter

4 Click the G o button for the ZON Utility to discover all supported devices in your network. Fig ure 28 Discovery

5 The ZON Utility screen shows the devices discovered. Fig ure 29 ZON Utility Screen

11 12 13

6 Select a device and then use the icons to perform actions. Some functions may not be available for your devices.
Note: You must know the selected device admin password before taking actions on the device using the ZON Utility icons.
XS3800-28 User's Guide
53

Chapter 4 Web Configurator Fig ure 30 Password Prompt

The following table describes the icons numbered from left to right in the ZON Utility screen.

Table 6 ZON Utility Icons

IC O N

DESC RIPTIO N

1 IP Configuration

Change the selected device's IP address.

2 Renew IP Address

Update a DHCP-assigned dynamic IP address.

3 Reboot Device

Use this icon to restart the selected devices. This may be useful when troubleshooting or upgrading new firmware.

4 Reset Configuration to Default

Use this icon to reload the factory-default configuration file. This means that you will lose all previous configurations.

5 Locator LED

Use this icon to locate the selected device by causing its Lo c a to r LED to blink.

6 Web GUI

Use this to access the selected device Web Configurator from your browser. You will need a user name and password to log in.

7 Firmware Upgrade

Use this icon to upgrade new firmware to selected devices of the same model. Make sure you have downloaded the firmware from the Zyxel website to your computer and unzipped it in advance.

8 Change Password

Use this icon to change the admin password of the selected device. You must know the current admin password before changing to a new one.

9 Configure NCC Discovery

You must have Internet access to use this feature. Use this icon to enable or disable the Nebula Control Center (NCC) discovery feature on the selected device. If it is enabled, the selected device will try to connect to the NCC. Once the selected device is connected to and has registered in the NCC, it will go into the Nebula cloud management mode.

10 ZAC

Use this icon to run the Zyxel AP Configurator of the selected AP.

11 Clear and Rescan

Use this icon to clear the list and discover all devices on the connected network again.

12 Save Configuration

Use this icon to save configuration changes to permanent memory on a selected device.

13 Settings

Use this icon to select a network adapter for the computer on which the ZON utility is installed, and the utility language.

The following table describes the fields in the ZON Utility main screen.

Table 7 ZON Utility Fields

LA BEL

DESC RIPTIO N

Type

This field displays an icon of the kind of device discovered.

Model

This field displays the model name of the discovered device.

Firmware Version

This field displays the firmware version of the discovered device.

MAC Address

This field displays the MAC address of the discovered device.

XS3800-28 User's Guide
54

Chapter 4 Web Configurator

Table 7 ZON Utility Fields (continued)

LA BEL

DESC RIPTIO N

IP Address

This field displays the IP address of an internal interface on the discovered device that first received a ZDP discovery request from the ZON Utility.

System Name

This field displays the system name of the discovered device.

Location

This field displays where the discovered device is.

Status

This field displays whether changes to the discovered device have been done successfully. As the Switch does not support IP C o nfig ura tio n, Re ne w IP a ddre ss and Fla sh Lo c a to r LED, this field displays "Update failed", "Not support Renew IP address" and "Not support Flash Locator LED" respectively.

Controller Discovery

This field displays if the discovered device supports the Nebula Control Center (NCC) discovery feature. If it is enabled, the selected device will try to connect to the NCC. Once the selected device is connected to and has registered in the NCC, it will go into the Nebula cloud management mode.

Serial Number

Enter the admin password of the discovered device to display its serial number.

Hardware Version

This field displays the hardware version of the discovered device.

4.4 We b C o nfig ura to r La yo ut
The Sta tus screen is the first screen that displays when you access the Web Configurator. The following figure shows the navigating components of a Web Configurator screen. Fig ure 31 Web Configurator Layout
B CD E FG
H
A

XS3800-28 User's Guide
55

Chapter 4 Web Configurator A Click the menu items to open sub-menu links, and then click on a sub-menu link to open the screen in the main window. B, C , D, E, F, G These are quick links which allow you to perform certain tasks no matter which screen you are currently working in. B Click this link to update the information in the screen you are viewing currently. C Click this link to save your configuration into the Switch's non-volatile memory. Non-volatile memory is the configuration of your Switch that stays the same even if the Switch's power is turned off. D Click this link to go to the status page of the Switch. E Click this link to log out of the Web Configurator. F Click this link to display web help pages. The help pages provide descriptions for all of the configuration screens. G Click this link to go to the Zyxel Community Biz Forum. H Click this link to go to the Ne ig hbo r screen where you can see and manage neighbor devices learned by the Switch. In the navigation panel, click a main link to reveal a list of sub-menu links.
XS3800-28 User's Guide
56

Chapter 4 Web Configurator

In the navigation panel, click a main link to reveal a list of sub-menu links.

Table 8 Navigation Panel Sub-links Overview

BASIC SETTING

ADVANC ED APPLIC ATIO N

IP APPLIC ATIO N

MANAG EMENT

The following table describes the links in the navigation panel.

Table 9 Navigation Panel Links

LINK

DESC RIPTIO N

Basic Settings

System Info

This link takes you to a screen that displays general system and hardware monitoring information.

General Setup

This link takes you to a screen where you can configure general identification information and time settings for the Switch.

Switch Setup

This link takes you to a screen where you can set up global Switch parameters such as VLAN type, MAC address learning, GARP and priority queues.

IP Setup

This link takes you to a screen where you can configure the IP address, subnet mask (necessary for Switch management) and set up to 128 IP routing domains.

XS3800-28 User's Guide
57

Chapter 4 Web Configurator

Table 9 Navigation Panel Links (continued)

LINK

DESC RIPTIO N

Port Setup

This link takes you to screens where you can configure speed, flow control and priority settings for individual Switch ports.

Interface Setup

This link takes you to a screen where you can create virtual interfaces on the Switch.

IPv6

This link takes you to a screen where you can enable an IPv6 interface and configure the IPv6

settings on the Switch.

Loopback Interface

This link takes you to a screen where you can configure the IPv4 loopback interface settings on the Switch.

Stacking

This link takes you to a screen where you can view and configure stacking system for the Switch.

DNS

This link takes you to a screen where you can configure DNS (domain name server) IP addresses.

Cloud Management

This screen displays a link to a screen where you can enable or disable the Ne b ula C o ntro l C e nte r Disc o ve ry feature. If it's enabled, you can have the Switch search for the NCC (Nebula Control Center). Another link takes you to the Ne b ula Switc h Re g istra tio n screen which has a QR code containing the Switch's serial number and MAC address for handy registration of the Switch at NCC.

Advanced Application

VLAN

This link takes you to screens where you can configure port-based or 802.1Q VLAN (depending on what you configured in the Switch Setup menu). You can also configure a protocol based VLAN or a subnet based VLAN in these screens.

Static MAC Forwarding

This link takes you to screens where you can configure static MAC addresses for a port. These static MAC addresses do not age out.

Static Multicast Forwarding

This link takes you to a screen where you can configure static multicast MAC addresses for port(s). These static multicast MAC addresses do not age out.

Filtering

This link takes you to a screen to set up filtering rules.

Spanning Tree Protocol

This link takes you to screens where you can configure the RSTP/MRSTP/MSTP to prevent network loops.

Bandwidth Control This link takes you to screens where you can cap the maximum bandwidth allowed on a port.

Broadcast Storm Control

This link takes you to a screen to set up broadcast filters.

Mirroring

This link takes you to screens where you can copy traffic from one port or ports to another port in order that you can examine the traffic from the first port without interference.

Link Aggregation

This link takes you to screen where you can logically aggregate physical links to form one logical, higher-bandwidth link.

Port Authentication This link takes you to a screen where you can configure IEEE 802.1x port authentication as well as MAC authentication for clients communicating via the Switch.

Port Security

This link takes you to a screen where you can activate MAC address learning and set the maximum number of MAC addresses to learn on a port.

Time Range

This link takes you to a screen where you can configure time range for time-oriented features like Classifier.

Classifier

This link takes you to screens where you can configure the Switch to group packets based on the specified criteria.

Policy Rule

This link takes you to a screen where you can configure the Switch to perform special treatment on the grouped packets.

Queuing Method

This link takes you to a screen where you can configure queuing with associated queue weights for each port.

VLAN Stacking

This link takes you to screens where you can activate and configure VLAN stacking.

Multicast

This link takes you to screen where you can configure various multicast features, IGMP snooping, MLD snooping-proxy and create multicast VLANs.

XS3800-28 User's Guide
58

Chapter 4 Web Configurator

Table 9 Navigation Panel Links (continued)

LINK

DESC RIPTIO N

AAA

This link takes you to a screen where you can configure authentication, authorization and accounting services via external servers. The external servers can be either RADIUS (Remote Authentication Dial-In User Service) or TACACS+ (Terminal Access Controller Access-Control System Plus).

IP Source Guard

This link takes you to screens where you can configure filtering of unauthorized DHCP and ARP packets in your network.

Loop Guard

This link takes you to a screen where you can configure protection against network loops that occur on the edge of your network.

VLAN Mapping

This link takes you to screens where you can configure VLAN mapping settings on the Switch.

Layer 2 Protocol Tunneling

This link takes you to a screen where you can configure L2PT (Layer 2 Protocol Tunneling) settings on the Switch.

sFlow

This link takes you to screens where you can configure sFlow settings on the Switch.

PPPoE

This link takes you to screens where you can configure how the Switch gives a PPPoE termination server additional subscriber information that the server can use to identify and authenticate a PPPoE client.

Errdisable

This link takes you to a screens where you can view errdisable status and configure errdisable settings in CPU protection, errdisable detect, and errdisable recovery.

VLAN Isolation

This link takes you to a screen where you can block traffic between ports in a VLAN on the Switch.

MAC Pinning

This link takes you to a screen where you can set specific ports to have priority over other ports in MAC address learning.

Private VLAN

This link takes you to a screen where you can block traffic between ports in a VLAN on the Switch.

Green Ethernet

This link takes you to a screen where you can configure the Switch to reduce port power consumption.

LLDP

This link takes you to a screen where you can configure LLDP settings.

Anti-Arpscan

This link takes you to screens where you can enable anti-arpscan on the Switch and ports, and view the port state. You can also create trusted hosts, view blocked hosts and unblock them.

BPDU Guard

This link takes you to screens where you can enable BPDU guard on the Switch and ports, and view the port state.

OAM

This link takes you to screens where you can enable Ethernet OAM on the Switch, view the configuration of ports on which Ethernet OAM is enabled and perform remote-loopback tests.

ZULD

This link takes you to screens where you can enable ZULD on a port and configure related settings.

NLB

This link takes you to screens where you can configure to which MAC addresses and ports the

Switch should forward the incoming NLB traffic, and map the IP address to the MAC address

of a cluster for layer-3 forwarding.

Wol Relay

This link takes you to a screen where you can configure settings on Wake On LAN relay.

IP Application

Static Routing

This link takes you to a screen where you can configure static routes. A static route defines how the Switch should forward traffic by configuring the TCP/IP parameters manually.

Policy Routing

This link takes you to screens where you can configure policy routing rules.

RIP

This link takes you to a screen where you can configure the RIP (Routing Information Protocol)

direction and version for IPv4 RIP timer, and the method of preventing routing loops.

OSPF

This link takes you to a screen where you can view the OSPF status and configure OSPF settings for IPv4.

IGMP

This link takes you to a screen where you can configure the IGMP settings.

XS3800-28 User's Guide
59

Chapter 4 Web Configurator

Table 9 Navigation Panel Links (continued)

LINK

DESC RIPTIO N

DVMRP

This link takes you to a screen where you can configure the DVMRP (Distance Vector Multicast Routing Protocol) settings.

DiffServ

This link takes you to screens where you can enable DiffServ, configure marking rules and set DSCP-to-IEEE802.1p mappings.

DHCP

This link takes you to screens where you can configure the DHCP settings.

VRRP

This link takes you to screens where you can configure redundant virtual router for your network.

Router Setup

This link takes you to a screen where you can enable Equal-Cost MultiPath (ECMP) routing and set the criteria the Switch uses to determine the routing path for a packet.

ARP Setup

This link takes you to a screen where you can configure ARP learning mode on a per-port basis and create static ARP entries which do not age out.

Management

Maintenance

This link takes you to screens where you can perform firmware and configuration file maintenance as well as reboot the system.

Access Control

This link takes you to screens where you can change the system login password and configure SNMP and remote management.

Diagnostic

This link takes you to screens where you can ping IP addresses, run traceroute, test ports.

System Log

This link takes you to a screen where you can view system logs.

Syslog Setup

This link takes you to a screen where you can setup system logs and a system log server.

Cluster Management

This link takes you to a screen where you can configure clustering management and view its status.

MAC Table

This link takes you to a screen where you can view the MAC address and VLAN ID of a device attach to a port. You can also view what kind of MAC address it is.

IP Table

This link takes you to a screen where you can view the IP addresses and VLAN ID of a device attached to a port.You can also view what kind of device it is.

ARP Table

This link takes you to a screen where you can view the MAC address IP address resolution table.

Routing Table

This link takes you to a screen where you can view the routing table.

Path MTU Table

This link takes you to a screen where you can view the IPv6 path MTU table.

Configure Clone This link takes you to a screen where you can copy attributes of one port to other ports.

IPv6 Neighbor Table

This link takes you to a screen where you can view the Switch's IPv6 neighbor table.

Port Status

This link takes you to a screen where you can view the port statistics.

Service Register

This link takes you to a screen where you can view the status of your service registrations and upgrade licenses.

4.4.1 C ha ng e Yo ur Pa sswo rd
After you log in for the first time, it is recommended you change the default administrator password. Click Ma na g e m e nt > Ac c e ss C o ntro l > Lo g ins to display the next screen.

XS3800-28 User's Guide
60

Chapter 4 Web Configurator Fig ure 32 Change Administrator Login Password
4.5 Sa ve Yo ur C o nfig ura tio n
When you are done modifying the settings in a screen, click Apply to save your changes back to the run-time memory. Settings in the run-time memory are lost when the Switch's power is turned off. Click the Sa ve link in the upper right hand corner of the Web Configurator to save your configuration to non-volatile memory. Non-volatile memory refers to the Switch's storage that remains even if the Switch's power is turned off. Note: Use the Sa ve link when you are done with a configuration session.
4.6 Switc h Lo c ko ut
You could block yourself (and all others) from using in-band-management (managing through the data ports) if you do one of the following: 1 Delete the management VLAN (default is VLAN 1). 2 Delete all port-based VLANs with the CPU port as a member. The "CPU port" is the management port of the Switch. 3 Filter all traffic to the CPU port. 4 Disable all ports. 5 Misconfigure the text configuration file.
XS3800-28 User's Guide
61

Chapter 4 Web Configurator
6 Forget the password and/or IP address. 7 Prevent all services from accessing the Switch. 8 Change a service port number but forget it. 9 You forgot to log out of the Switch from a computer before logging in again on another computer.
Note: Be careful not to lock yourself and others out of the Switch. If you do lock yourself out, try using out-of-band management (via the management port) to configure the Switch.
4.7 Re se t the Switc h
If you lock yourself (and others) from the Switch or forget the administrator password, you will need to reload the factory-default configuration file or reset the Switch back to the factory defaults.
4.7.1 Using the RESTO RE Butto n
See Table 3 on page 38 to see how to use the RESTO RE button to restore the factory default file.
4.7.2 Re lo a d the C o nfig ura tio n File
Uploading the factory-default configuration file replaces the current configuration file with the factorydefault configuration file. This means that you will lose all previous configurations and the speed of the console port will be reset to the default of 115200 bps with 8 data bit, no parity, one stop bit and flow control set to none. The password will also be reset to "1234" and the IP address to 192.168.1.1 or DHCPassigned IP. To upload the configuration file, do the following:
1 Connect to the console port using a computer with terminal emulation software. 2 Disconnect and reconnect the Switch's power to begin a session. When you reconnect the Switch's
power, you will see the initial screen. 3 When you see the message "Press any key to enter Debug Mode within 3 seconds ..." press
any key to enter debug mode. 4 Type atlc after the "Enter Debug Mode" message. 5 Wait for the "Starting XMODEM upload" message before activating XMODEM upload on your
terminal. 6 After a configuration file upload, type atgo to restart the Switch.
XS3800-28 User's Guide
62

Chapter 4 Web Configurator
Fig ure 33 Resetting the Switch: Via the Console Port Bootbase Version: V1.00 | 02/21/2016 15:43:29 RAM: Size = 1048576 Kbytes FLASH: 64M ZyNOS Version: V4.60(ABML.0) | 04/18/2017 11:41:8 Press any key to enter debug mode within 1 second. ..................................... Enter Debug Mode ras> atlc Starting XMODEM upload (CRC mode).... CCCCCCCCCCCCCCCC Total 393216 bytes received. Erasing.. ................................................................ OK ras> atgo
The Switch is now reinitialized with a default configuration file including the default password of "1234".
4.8 Lo g O ut o f the We b C o nfig ura to r
Click Lo g o ut in a screen to exit the Web Configurator. You have to log in with your password again after you log out. This is recommended after you finish a management session for security reasons. Fig ure 34 Web Configurator: Logout Screen
4.9 He lp
The Web Configurator's online help has descriptions of individual screens and some supplementary information. Click the He lp link from a Web Configurator screen to view an online help description of that screen.
XS3800-28 User's Guide
63

Chapter 5 Initial Setup Example
C HA PTER 5 Initia l Se tup Exa m ple
5.1 O ve rvie w
This chapter shows how to set up the Switch for an example network. The following lists the configuration steps for the initial setup: · Create a VLAN · Set Port VID · Configure Switch Management IP Address
5.1.1 C re a te a VLAN
VLANs confine broadcast frames to the VLAN group in which the ports belongs. You can do this with port-based VLAN or tagged static VLAN with fixed port members. In this example, you want to configure port 1 as a member of VLAN 2. Fig ure 35 Initial Setup Network Example: VLAN
1 Click Adva nc e d Applic a tio n > VLAN > VLAN C o nfig ura tio n in the navigation panel and click the Sta tic VLAN Se tup link.
XS3800-28 User's Guide
64

Chapter 5 Initial Setup Example
2 In the Sta tic VLAN screen, select AC TIVE, enter a descriptive name in the Na m e field and enter 2 in the VLAN G ro up ID field for the VLAN2 network.
Note: The VLAN G ro up ID field in this screen and the VID field in the IP Se tup screen refer to the same VLAN ID.
3 Since the VLAN2 network is connected to port 1 on the Switch, select Fixe d to configure port 1 to be a permanent member of the VLAN only.
4 To ensure that VLAN-unaware devices (such as computers and hubs) can receive frames properly, clear the TX Ta g g ing check box to set the Switch to remove VLAN tags before sending.
5 Click Add to save the settings to the run-time memory. Settings in the run-time memory are lost when the Switch's power is turned off.
5.1.2 Se t Po rt VID
Use PVID to add a tag to incoming untagged frames received on that port so that the frames are forwarded to the VLAN group that the tag defines. In the example network, configure 2 as the port VID on port 1 so that any untagged frames received on that port get sent to VLAN 2.
XS3800-28 User's Guide
65

Chapter 5 Initial Setup Example Fig ure 36 Initial Setup Network Example: Port VID
1 Click Adva nc e d Applic a tio ns > VLAN > VLAN C o nfig ura tio n in the navigation panel. Then click the VLAN Po rt Se tup link.
2 Enter 2 in the PVID field for port 1 and click Apply to save your changes back to the runtime memory. Settings in the run-time memory are lost when the Switch's power is turned off.
5.1.3 C o nfig ure Switc h Ma na g e m e nt IP Addre ss
If the Switch fails to obtain an IP address from a DHCP server, the Switch will use 192.168.1.1 as the management IP address. You can configure another IP address in a different subnet for management purposes. The following figure shows an example.
XS3800-28 User's Guide
66

Chapter 5 Initial Setup Example Fig ure 37 Initial Setup Example: Management IP Address
1 Connect your computer to any Ethernet port on the Switch. Make sure your computer is in the same subnet as the Switch.
2 Open your web browser and enter 192.168.1.1 (the default IP address) in the address bar to access the Web Configurator. See Section 4.2 on page 48 for more information.
3 Click Ba sic Se tting > IP Se tup > IP C o nfig ura tio n in the navigation panel.
XS3800-28 User's Guide
67

Chapter 5 Initial Setup Example
4 Configure the related fields in the IP C o nfig ura tio n screen. 5 For the VLAN2 network, enter 192.168.2.1 as the IP address and 255.255.255.0 as the subnet mask. 6 In the VID field, enter the ID of the VLAN group to which you want this management IP address to
belong. This is the same as the VLAN ID you configure in the Sta tic VLAN screen. 7 Click Add to save your changes back to the run-time memory. Settings in the run-time memory are lost
when the Switch's power is turned off.
XS3800-28 User's Guide
68

Chapter 6 Tutorials
C HA PTER 6 Tuto ria ls
6.1 O ve rvie w
This chapter provides some examples of using the Web Configurator to set up and use the Switch. The tutorials include: · How to Use DHCPv4 Snooping on the Switch · How to Use DHCPv4 Relay on the Switch · How to Use Auto Configuration via a DHCP Server on the Switch
6.2 Ho w to Use DHC Pv4 Sno o ping o n the Switc h
You only want DHCP server A connected to port 4 to assign IP addresses to all devices in VLAN network (V). Create a VLAN containing ports 5, 6 and 7. Connect a computer M to the Switch for management. Fig ure 38 Tutorial: DHCP Snooping Tutorial Overview

The settings in this tutorial are as the following.

Table 10 Tutorial: Settings in this Tutorial

HO ST

PO RTC O NNEC TED

DHCP Server (A)

DHCP Client (B)

DHCP Client (C )

V LA N 1 and 100 1 and 100 1 and 100

PVID 100 100 100

DHC P SNO O PING PO RTTRUSTED Yes No No

1 Access the Switch through http:/ / 192.168.1.1 by default. Log into the Switch by entering the user name (default: a dm in) and password (default: 1234).

XS3800-28 User's Guide
69

Chapter 6 Tutorials 2 Go to Adva nc e d Applic a tio n > VLAN > VLAN C o nfig ura tio n > Sta tic VLAN Se tup, and create a VLAN with
ID of 100. Add ports 5, 6 and 7 in the VLAN by selecting Fixe d in the C o ntro l field as shown. De-select Tx Ta g g ing because you do not want outgoing traffic to contain this VLAN tag. Click Add. Fig ure 39 Tutorial: Create a VLAN and Add Ports to It
3 Go to Adva nc e d Applic a tio n > VLAN > VLAN C o nfig ura tio n > VLAN Po rt Se tup, and set the PVID of the ports 5, 6 and 7 to 100. This tags untagged incoming frames on ports 5, 6 and 7 with the tag 100. Fig ure 40 Tutorial: Tag Untagged Frames
XS3800-28 User's Guide
70

Chapter 6 Tutorials 4 Go to Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv4 So urc e G ua rd Se tup > DHC P Sno o ping >
C o nfig ure , activate and specify VLAN 100 as the DHCP VLAN as shown. Click Apply. Fig ure 41 Tutorial: Specify DHCP VLAN
5 Click the Po rt link at the top right corner. 6 The DHC P Sno o ping Po rt C o nfig ure screen appears. Select Truste d in the Se rve r Truste d sta te field for port
5 because the DHCP server is connected to port 5. Keep ports 6 and 7 Untruste d because they are connected to DHCP clients. Click Apply.
XS3800-28 User's Guide
71

Fig ure 42 Tutorial: Set the DHCP Server Port to Trusted
7 Go to Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv4 So urc e G ua rd Se tup > DHC P Sno o ping > C o nfig ure > VLAN, show VLAN 100 by entering 100 in the Sta rt VID and End VID fields and click Apply. Then select Ye s in the Ena ble d field of the VLAN 100 entry shown at the bottom section of the screen. If you want to add more information in the DHCP request packets such as source VLAN ID or system name, you can also select an O ptio n82 Pro file in the entry. Fig ure 43 Tutorial: Enable DHCP Snooping on this VLAN
8 Click Sa ve at the top right corner of the Web Configurator to save the configuration permanently. XS3800-28 User's Guide
72

Chapter 6 Tutorials
9 Connect your DHCP server to port 5 and a computer (as DHCP client) to either port 6 or 7. The computer should be able to get an IP address from the DHCP server. If you put the DHCP server on port 6 or 7, the computer will NOT be able to get an IP address.
10 To check if DHCP snooping works, go to Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv4 So urc e G ua rd Se tup, you should see an IP assignment with the type DHC P- Sno o ping as shown. Fig ure 44 Tutorial: Check the Binding If DHCP Snooping Works

You can also telnet. Use the command "show dhcp snooping binding" to see the DHCP snooping binding table as shown next.

sysname# show dhcp snooping binding

MacAddress

IpAddress

----------------- ---------------

00:02:00:00:00:1c

10.10.1.16

Total number of bindings: 1

Lease ------------
6d23h59m20s

Type ------------dhcp-snooping

VLAN ----
100

Port -----
6

6.3 Ho w to Use DHC Pv4 Re la y o n the Switc h
This tutorial describes how to configure your Switch to forward DHCP client requests to a specific DHCP server. The DHCP server can then assign a specific IP address based on the information in the DHCP requests.
6.3.1 DHC P Re la y Tuto ria l Intro duc tio n
In this example, you have configured your DHCP server (192.168.2.3) and want to have it assign a specific IP address (say 172.16.1.18) to DHCP client A based on the system name, VLAN ID and port number in the DHCP request. Client A connects to the Switch's port 2 in VLAN 102.
Fig ure 45 Tutorial: DHCP Relay Scenario

XS3800-28 User's Guide
73

Chapter 6 Tutorials
6.3.2 C re a te a VLAN
Follow the steps below to configure port 2 as a member of VLAN 102. 1 Access the Web Configurator through the Switch's management port. 2 Go to Ba sic Se tting > Switc h Se tup and set the VLAN type to 802.1Q . Click Apply to save the settings to
the run-time memory. Fig ure 46 Tutorial: Set VLAN Type to 802.1Q
3 Click Adva nc e d Applic a tio n > VLAN > VLAN C o nfig ura tio n > Sta tic VLAN Se tup. 4 In the Sta tic VLAN screen, select AC TIVE, enter a descriptive name (VLAN 102 for example) in the Na m e
field and enter 102 in the VLAN G ro up ID field. 5 Select Fixe d to configure port 2 to be a permanent member of this VLAN. 6 Clear the TX Ta g g ing check box to set the Switch to remove VLAN tags before sending. 7 Click Add to save the settings to the run-time memory. Settings in the run-time memory are lost when the
Switch's power is turned off.
XS3800-28 User's Guide
74

Chapter 6 Tutorials Fig ure 47 Tutorial: Create a Static VLAN
8 Click the VLAN C o nfig ura tio n link in the Sta tic VLAN Se tup screen and then the VLAN Po rt Se tup link in the VLAN C o nfig ura tio n screen. Fig ure 48 Tutorial: Click the VLAN Port Setting Link
9 Enter 102 in the PVID field for port 2 to add a tag to incoming untagged frames received on that port so that the frames are forwarded to the VLAN group that the tag defines.
10 Click Apply to save your changes back to the run-time memory.
XS3800-28 User's Guide
75

Fig ure 49 Tutorial: Add Tag for Frames Received on Port 2
11 Click the Sa ve link in the upper right corner of the Web Configurator to save your configuration permanently.
6.3.3 C o nfig ure DHC Pv4 Re la y
Follow the steps below to enable DHCP relay on the Switch and allow the Switch to add relay agent information (such as the VLAN ID) to DHCP requests. 1 Click IP Applic a tio n > DHC P > DHC Pv4 and then the G lo b a l link to open the DHC P Re la y screen. 2 Select the Ac tive check box. 3 Enter the DHCP server's IP address (192.168.2.3 in this example) in the Re m o te DHC P Se rve r 1 field. 4 Select de fa ult1 or de fa ult2 in the O ptio n 82 Pro file field. 5 Click Apply to save your changes back to the run-time memory. Fig ure 50 Tutorial: Set DHCP Server and Relay Information
6 Click the Sa ve link in the upper right corner of the Web Configurator to save your configuration permanently.
7 The DHCP server can then assign a specific IP address based on the DHCP request.
6.3.4 Tro ub le sho o ting
Check client A's IP address. If it did not receive the IP address 172.16.1.18, make sure: XS3800-28 User's Guide
76

Chapter 6 Tutorials
1 Client A is connected to the Switch's port 2 in VLAN 102. 2 You configured the correct VLAN ID, port number and system name for DHCP relay on both the DHCP
server and the Switch. 3 You clicked the Sa ve link on the Switch to have your settings take effect.
6.4 Ho w to Use Auto C o nfig ura tio n via a DHC P Se rve r o n the Switc h
Follow the steps below to set up configurations on a DHCP server, TFTP server, and the Switch, so you can load an auto configuration file automatically from a TFTP server when you reboot the Switch. Note that you can set up a DHCP server and TFTP server either on the same device or different devices. Also, make sure the Switch can communicate with the TFTP server. Note: Steps order could vary according to different programs you use. Note: You need to set up configurations on a DHCP server and TFTP server first to use auto
configuration.
Se tting up a DHC P Se rve r
1 Set up a dynamic IP addresses pool so the DHCP server will assign an IP address to the Switch in that range.
2 Set up a TFTP server IP address, so the Switch will know where to load the auto configuration file. 3 Set up the filename of the auto configuration file, so the Switch will know which file to load when you
reboot the Switch. · Enter the filename of an auto configuration file. The Switch will load this auto configuration file when rebooting with DHCP option 60 disabled. · If you want to load the auto configuration file with DHCP option 60 enabled and a Vendor Class Identifier assigned when you reboot the Switch, follow the instruction below. Otherwise, skip this step. Enter the filename of an auto configuration file. Set up a Vendor Class Identifier. To have the Switch load this auto configuration file, two conditions listed above must be met. Please refer to the following steps to see how to set up a Vendor Class Identifier on the Switch.
Se tting up a TFTP Se rve r
1 Select a directory on the TFTP server. 2 Put the configuration files in that directory.
XS3800-28 User's Guide
77

Chapter 6 Tutorials
Se tting up the Switc h
1 Open the Web Configurator. Go to the Ma na g e m e nt > Ma inte na nc e screen, and click the C lic k He re button next to the Auto C o nfig ura tio n field. Fig ure 51 Tutorial: Auto Configuration Screen
2 Select the check box in the Ac tive field to enable auto configuration. Select DHC P in the Mo de field, and enter the VLAN ID where the DHCP server belongs to in the DHC P VLAN ID field. Click Apply to save your changes. Fig ure 52 Tutorial: Enable Auto Configuration
3 Go to the Ba sic Se tting > IP Se tup > IP C o nfig ura tio n screen. Select the check box in the DHC P C lie nt field.
4 If you want to load the auto configuration file with DHCP option 60 enabled and a Vendor Class Identifier assigned when you reboot the Switch, follow the instruction below. Otherwise, skip this step. In the Ba sic Se tting > IP Se tup > IP C o nfig ura tio n screen, select the check box in the O ptio n- 60 field, and enter a Vendor Class Identifier in the C la ss- ID field. In this example, we use "ZyxelCorp". Click Apply to save your changes.
XS3800-28 User's Guide
78

Chapter 6 Tutorials Fig ure 53 Tutorial: Enable DHCP Client & Option 60
5 You need to save the current configuration in a configuration file, so the Switch will load the auto configuration file from the TFTP server automatically when rebooting. Go to the Ma na g e m e nt > Ma inte na nc e screen. Click the C o nfig 1, C o nfig 2, or C usto m De fa ult button next to the Sa ve C o nfig ura tio n field.
6 Click the same button next to Re bo o t Syste m field to reboot the Switch, and load the auto configuration setting as configured before. For example, if you save the auto configuration setting to C o nfig 1, you need to click the C o nfig 1 button next to the Re b o o t Syste m field.
XS3800-28 User's Guide
79

Chapter 6 Tutorials Fig ure 54 Tutorial: Save Configuration and Reboot System
7 Go to the Ma na g e m e nt > Syste m Lo g screen to see if auto configuration was performed successfully. Fig ure 55 Tutorial: Log
8 Check the screens to see if it is the configuration file you want to load. If it is not, go through the steps above to check your configurations. If it is, click Sa ve at the top right corner of the Web Configurator to save the configuration permanently. Fig ure 56 Tutorial: Save
XS3800-28 User's Guide
80

Chapter 7 Status
C HA PTER 7 Sta tus
7.1 O ve rvie w
This chapter describes the screens for System Status and Neighbor Details.
7.1.1 Wha t Yo u C a n Do
· Use the Sta tus screen (Section 7.2 on page 81) to see the Switch's general device information, system status, and IP addresses. You can also display other status screens for more information.
· Use the Ne ig hbo r screen (Section 7.2.1 on page 83) to view a summary and manage Switch's neighbor devices.
· Use the Ne ig hb o r De ta il screen (Section 7.2.2 on page 85) to view more detailed information on the Switch's neighbor devices.
7.2 Sta tus
The Sta tus screen displays when you log into the Switch or click Sta tus at the top right corner of the Web Configurator. The Sta tus screen displays general device information, system status, and its IP addresses.
XS3800-28 User's Guide
81

Fig ure 57 Status

Chapter 7 Status

The following table describes the labels in this screen.

Table 11 Status

LA BEL

DESC RIPTIO N

Device Information

Device Type

This field displays the model name of this Switch.

System Name This field displays the name used to identify the Switch on any network.

Boot Version

This field displays the version number and date of the boot module that is currently on the Switch.

System Location This field displays the geographic location of your Switch. You can change the setting in the Ba sic Se tting > G e ne ra l Se tup screen.

Firmware Version

This field displays the version number and date of the firmware the Switch is currently running.

System Time

This field displays the current date and time in the UAG. The format is mm-dd-yyyy hh:mm:ss.

Hardware Version

This field displays the hardware version number of the Switch. The integer is the generation number of the Switch series, and the decimal is the version of the hardware change. For example, V1.0 is a hardware version for the Switch where 1 identifies the first generation of the Switch series, and .0 is the first hardware change.

System Up Time This field displays how long the Switch has been running since it last restarted or was turned on.

MAC Address This field displays the MAC addresses of the Switch.

This field displays how many minutes a management session can be left idle before the session times out. After it times out you have to log in with your password again.

Serial Number

This field displays the serial number of this Switch. The serial number is used for device tracking and control.

XS3800-28 User's Guide
82

Table 11 Status (continued)

LA BEL

DESC RIPTIO N

Registration MAC Address

This field displays the MAC address of the Switch that you must use to register at myZyxel.com or the NCC (Nebula Control Center).

Hybrid Mode

This field displays whether the Switch is in Sta nda lo ne mode or C lo ud mode. In Sta nda lo ne mode you can see a link to a QR code to register the Switch to use NCC (Nebula Control Center).

Cloud Control Status

This field displays the registration and connection status between the Switch and the NCC (Nebula Control Center).

In Standalone mode, the status will display Disc o nne c te d or Unre g iste re d. In cloud mode the status will display C o nne c te d or Disc o nne c te d.

C o nne c te d The Switch is registered with and connected to the NCC.

Disc o nne c te d The Switch is not connected to the NCC.

Unre g iste re d The Switch is not registered with the NCC.

Service Status

This field displays the service name (Ba sic Ro uting for example) if a service license is enabled at myZyxel or No t Lic e nse d if the service license is not enabled. It also shows the amount of time that remains if you enabled a trial license (Ba sic Ro uting | Tria l 30 da y(s) 0 ho ur(s) for example).

Detail

Click this link to go to the Ba sic Se tting > Syste m Info screen to check other detailed information, such as system resource usage and the Switch temperature, fan speeds or voltage.

IP Address Information

IPv4 Address

This field displays the Switch's current IPv4 address.

Subnet Mask

This field displays the Switch's subnet mask.

Default Gateway

This field displays the IP address of the Switch's default gateway.

IP Setup

Click the link to go to the Ba sic Se tting > IP Se tup screen.

IPV6 Global

This field displays the Switch's IPv6 global unicast address

Unicast Address

IPV6 Link-Local Address

This field displays the Switch's IPv6 link-local address.

IPv6 configuration

Click the link to go to the Ba sic Se tting > IPv6 screen.

Device Status and Quick Configuration

This section shows whether a feature is enabled or not on the Switch. You can click a feature's Se tting link to go to the configuration screen for the feature.
Hover your cursor over a red exclamation mark to display information about the feature.

Quick Links

This section provides the shortcut link to a specific configuration screen.

7.2.1 Ne ig hb o r Sc re e n
The Ne ig hbo r screen allows you to view a summary and manage the Switch's neighboring devices. It uses Layer Link Discovery Protocol (LLDP) to discover all neighbor devices connected to the Switch including non-Zyxel devices. You can use this screen to perform tasks on the neighboring devices like login.
This screen shows the neighboring device first recognized on an Ethernet port of the Switch. Device information is displayed in gray when the neighboring device is offline.
Click Sta tus > Ne ig hb o r to see the following screen.

XS3800-28 User's Guide
83

Fig ure 58 Status > Neighbor

Chapter 7 Status

The following table describes the fields in the above screen.

Table 12 Status > Neighbor

LA BEL

DESC RIPTIO N

Port

This shows the port of the Switch, on which the neighboring device is discovered.

Port Name

This shows the port description of the Switch.

Link

This shows the speed (either 10M for 10 Mbps, 100M for 100 Mbps, or 1G for 1 Gbps) and the

duplex (F for full duplex or H for half). This field displays Do wn if the port is not connected to

any device.

System Name

This shows the system name of the neighbor device.

IPv4

This shows the IPv4 address of the neighbor device. The IPv4 address is a hype r link that you

can click to log into and manage the neighbor device through its Web Configurator.

IPv6

This shows the IPv6 address of the neighbor device. The IPv6 address is a hype r link that you

can click to log into and manage the neighbor device through its Web Configurator.

Select an entry's check box to select a specific port. Otherwise, select the check box in the table heading row to select all ports.

Flush

Click the Flush button to remove information about neighbors learned on the selected ports.

XS3800-28 User's Guide
84

Chapter 7 Status
7.2.2 Ne ig hb o r De ta il
Use this screen to view detailed information about the neighboring devices. Device information is displayed in gray when the neighboring device is currently offline.
Up to 10 neighboring device records per Ethernet port can be retained in this screen even when the devices are offline. When the maximum number of neighboring device records per Ethernet port is reached, new device records automatically overwrite existing offline device records, starting with the oldest existing offline device record first.
Click the Ne ig hbo r De ta il link in the Sta tus > Ne ig hbo r screen to see the following screen.
Fig ure 59 Status > Neighbor > Neighbor Detail

The following table describes the fields in the above screen.

Table 13 Status > Neighbor > Neighbor Detail

LA BEL

DESC RIPTIO N

Local Port

This shows the port of the Switch, on which the neighboring device is discovered.

Desc.

This shows the port description of the Switch.

Link

This shows the speed (either 10M for 10 Mbps, 100M for 100 Mbps, or 1G for 1 Gbps) and

the duplex (F for full duplex or H for half). This field displays Do wn if the port is not

connected to any device.

Remote

XS3800-28 User's Guide
85

Chapter 7 Status

Table 13 Status > Neighbor > Neighbor Detail (continued)

LA BEL

DESC RIPTIO N

System Name

This shows the system name of the neighbor device.

Model

This shows the model name of the neighbor device. This field will show "" for devices that do not support the ZON utility.

Firmware

This shows the firmware version of the neighbor device. This field will show "" for devices that do not support the ZON utility.

MAC

This shows the MAC address of the neighbor device.

IPv4

This shows the IPv4 address of the neighbor device. The IPv4 address is a hype r link that

you can click to log into and manage the neighbor device through its Web Configurator.

IPv6

This shows the IPv6 address of the neighbor device. The IPv6 address is a hype r link that

you can click to log into and manage the neighbor device through its Web Configurator.

Port

This show the number of the neighbor device's port which is connected to the Switch.

Desc.

This shows the description of the neighbor device's port which is connected to the Switch.

Location

This shows the geographic location of the neighbor device. This field will show "" for devices that do not support the ZON utility.

XS3800-28 User's Guide
86

Chapter 8 Basic Setting
C HA PTER 8 Ba sic Se tting
8.1 O ve rvie w
This chapter describes how to configure the Syste m Info , G e ne ra l Se tup, Switc h Se tup, IP Se tup, Po rt Se tup, Inte rfa c e Se tup, IPv6, Lo o pb a c k Inte rfa c e , Sta c king , and C lo ud Ma na g e m e nt screens.
8.1.1 Wha t Yo u C a n Do
· Use the Syste m Info screen (Section 8.2 on page 87) to check the firmware version number and monitor the Switch temperature.
· Use the G e ne ra l Se tup screen (Section 8.3 on page 92) to configure general settings such as the system name and time.
· Use the Switc h Se tup screen (Section 8.5 on page 94) to choose your VLAN type and assign priorities to queues.
· Use the IP Se tup screen (Section 8.6 on page 96) to configure the Switch IP address, default gateway device, management VLAN ID, and proxy server.
· Use the Po rt Se tup screen (Section 8.7 on page 104) to configure Switch port settings. · Use the Inte rfa c e Se tup screens (Section 8.8 on page 107) to configure Switch interface type and
interface ID settings. · Use the IPv6 screens (Section 8.9 on page 108) to view IPv6 status and IPv6 configuration. · Use the Lo o pb a c k Inte rfa c e screen (Section 8.10 on page 122) to configure the IPv4 loopback
interface settings on the Switch. · Use the Sta c king screen (Section 8.11 on page 123) to view and configure stacking system for the
Switch. · Use the C lo ud Ma na g e m e nt screen (Section 8.12 on page 129) to display links to Ne b ula C o ntro l
C e nte r Disc o ve ry and Ne b ula Switc h Re g istra tio n screens.
8.2 Syste m Info rm a tio n
In the navigation panel, click Ba sic Se tting > Syste m Info to display the screen as shown. Use this screen to view general system information.
XS3800-28 User's Guide
87

Chapter 8 Basic Setting Fig ure 60 Basic Setting > System Info (Standalone Mode)
XS3800-28 User's Guide
88

Fig ure 61 Basic Setting > System Info (Stacking Mode)

The following table describes the labels in this screen.

Table 14 Basic Setting > System Info

LA BEL

DESC RIPTIO N

System Name This field displays the descriptive name of the Switch for identification purposes.

Product Model This field displays the product model of the Switch. Use this information when searching for firmware upgrade or looking for other support information in the website.

ZyNOS F/W Version

This field displays the version number of the Switch 's current firmware including the date created.

Ethernet Address

This field refers to the Ethernet MAC (Media Access Control) address of the Switch.

CPU Utilization CPU utilization quantifies how busy the system is. C urre nt (% ) displays the current percentage of CPU utilization.

Memory Utilization

Memory utilization shows how much DRAM memory is available and in use. It also displays the current percentage of memory utilization.

Name

This field displays the name of the memory pool.

Total (byte) This field displays the total number of bytes in this memory pool.

Used (byte) This field displays the number of bytes being used in this memory pool.

Utilization (%)

This field displays the percentage (%) of memory being used in this memory pool.

Hardware Monitor

Temperature Unit

The Switch has temperature sensors that are capable of detecting and reporting if the temperature rises above the threshold. You may choose the temperature unit (Centigrade or Fahrenheit) in this field.

Temperature (C/F)

BO ARD / MAC and PHY/PO WER refers to the location of the temperature sensor on the Switch printed circuit board.

Current

This shows the current temperature at this sensor.

MAX

This field displays the maximum temperature measured at this sensor.

MIN

This field displays the minimum temperature measured at this sensor.

Threshold This field displays the upper temperature limit at this sensor.

Status

This field displays No rm a l for temperatures below the threshold and Erro r for those above.

XS3800-28 User's Guide
89

Chapter 8 Basic Setting

Table 14 Basic Setting > System Info (continued)

LA BEL FAN Speed (RPM)
Current MAX MIN
Threshold Status
Voltage(V)
Current MAX MIN Threshold Status
Power Source Status

DESC RIPTIO N
A properly functioning fan is an essential component (along with a sufficiently ventilated, cool operating environment) in order for the device to stay within the temperature threshold. Each fan has a sensor that is capable of detecting and reporting if the fan speed falls below the threshold shown.
This field displays this fan's current speed in Revolutions Per Minute (RPM).
This field displays this fan's maximum speed measured in Revolutions Per Minute (RPM).
This field displays this fan's minimum speed measured in Revolutions Per Minute (RPM). "<41" is displayed for speeds too small to measure (under 2000 RPM).
This field displays the minimum speed at which a normal fan should work.
No rm a l indicates that this fan is functioning above the minimum speed. Erro r indicates that this fan is functioning below the minimum speed.
The power supply for each voltage has a sensor that is capable of detecting and reporting if the voltage falls out of the tolerance range.
This is the current voltage reading.
This field displays the maximum voltage measured at this point.
This field displays the minimum voltage measured at this point.
This field displays the percentage tolerance of the voltage with which the Switch still works.
No rm a l indicates that the voltage is within an acceptable operating range at this point; otherwise Erro r is displayed.
This field lists the power supply modules installed in the Switch. PSU_1 is PWR1, and PSU_2 is PWR2.
Ac tive indicates the Switch is currently operating from the power source to which the power module is connected.

Sta ndb y indicates the power module is connected to a power source but the Switch is NOT operating from it.

N/ A is displayed when the power module is not connected to a power source and there is no available power.

Hardware Status (Stacking Mode)

Slot

This number identifies the Switch in the stack. Click the number to see more detailed information

on the Switch.

Name

This is the system name of the Switch in the stack.

Voltage

This shows if the power supply voltage sensor is within normal tolerance range.

Temperature

This shows if the temperature sensors on the Switch printed circuit board are within normal tolerance range.

Fan

This shows if the fan sensors are within normal tolerance range.

Power Source This shows if the Switch is properly operating from the connected power source.

8.2.1 Syste m Info rm a tio n Sta c king Ha rdwa re Mo nito r
Click a slot number in the Syste m Info rmation screen to display more detailed hardware information on a Switch.

XS3800-28 User's Guide
90

Chapter 8 Basic Setting Fig ure 62 Basic Setting > System Info > Hardware Monitor (Stacking Mode)

The following table describes the labels in this screen.

Table 15 Basic Setting > System Info > Hardware Monitor (Stacking Mode)

LA BEL

DESC RIPTIO N

SLOT

This number identifies the Switch in the stack.

Temperature Unit The Switch has temperature sensors that are capable of detecting and reporting if the temperature rises above the threshold. You may choose the temperature unit (Centigrade or Fahrenheit) in this field.

Temperature

BO ARD, PHY, C PU and MAC refer to the location of the temperature sensors on the Switch printed circuit board.

Current

This shows the current temperature at this sensor.

MAX

This field displays the maximum temperature measured at this sensor.

MIN

This field displays the minimum temperature measured at this sensor.

Threshold

This field displays the upper temperature limit at this sensor.

Status

This field displays No rm a l for temperatures below the threshold and Erro r for those above.

Fan Speed (RPM)

A properly functioning fan is an essential component (along with a sufficiently ventilated, cool operating environment) in order for the device to stay within the temperature threshold. Each fan has a sensor that is capable of detecting and reporting if the fan speed falls below the threshold shown.

Current

This field displays this fan's current speed in Revolutions Per Minute (RPM).

MAX

This field displays this fan's maximum speed measured in RPM.

MIN

This field displays this fan's minimum speed measured in RPM. "<41" is displayed for speeds too

small to measure (under 2000 RPM).

Threshold

This field displays the minimum speed at which a normal fan should work.

XS3800-28 User's Guide
91

Chapter 8 Basic Setting

Table 15 Basic Setting > System Info > Hardware Monitor (Stacking Mode) (continued)

LA BEL

DESC RIPTIO N

Status

No rm a l indicates that this fan is functioning above the minimum speed. Erro r indicates that this fan is functioning below the minimum speed.

Voltage (V)

The power supply for each voltage has a sensor that is capable of detecting and reporting if the voltage falls out of the tolerance range.

Current

This is the current voltage reading.

MAX

This field displays the maximum voltage measured at this point.

MIN

This field displays the minimum voltage measured at this point.

Threshold

This field displays the percentage tolerance of the voltage with which the Switch still works.

Status

No rm a l indicates that the voltage is within an acceptable operating range at this point; otherwise Erro r is displayed.

Power Source

This field lists which power sources can be connected.

Status

Ac tive indicates the Switch is currently operating from the power source. Otherwise, N/ A is displayed.

8.3 G e ne ra l Se tup
Use this screen to configure general settings such as the system name and time. Click Ba sic Se tting > G e ne ra l Se tup in the navigation panel to display the screen as shown.
Fig ure 63 Basic Setting > General Setup

XS3800-28 User's Guide
92

Chapter 8 Basic Setting

The following table describes the labels in this screen.

Table 16 Basic Setting > General Setup

LA BEL

DESC RIPTIO N

System Name

Choose a descriptive name for identification purposes. This name consists of up to 64 printable characters; spaces are allowed.

Location

Enter the geographic location of your Switch. You can use up to 32 printable ASCII characters; spaces are allowed.

Contact Person's Enter the name of the person in charge of this Switch. You can use up to 32 printable ASCII

Name

characters; spaces are allowed.

Use Time Server when Bootup

Enter the time service protocol that your time server uses. Not all time servers support all protocols, so you may have to use trial and error to find a protocol that works. The main differences between them are the time format.

When you select the Da ytim e (RFC 867) format, the Switch displays the day, month, year and time with no time zone adjustment. When you use this format it is recommended that you use a Daytime timeserver within your geographical time zone.

Tim e (RFC - 868) format displays a 4-byte integer giving the total number of seconds since 1970/ 1/1 at 0:0:0.

NTP (RFC - 1305) is similar to Tim e (RFC - 868).

Time Server IP Address Time Server Sync Interval Current Time New Time (hh:min:ss) Current Date New Date (yyyymm-dd) Time Zone
Daylight Saving Time

No ne is the default value. Enter the time manually. Each time you turn on the Switch, the time and date will be reset to 1970-1-1 0:0:0.
Enter the IP address or domain name of your timeserver. The Switch searches for the timeserver for up to 60 seconds.
Enter the period in minutes between each time server synchronization. The Switch checks the time server after every synchronization interval.
This field displays the time you open this menu (or refresh the menu).
Enter the new time in hour, minute and second format. The new time then appears in the C urre nt Tim e field after you click Apply.
This field displays the date you open this menu.
Enter the new date in year, month and day format. The new date then appears in the C urre nt Da te field after you click Apply.
Select the time difference between UTC (Universal Time Coordinated, formerly known as GMT, Greenwich Mean Time) and your time zone from the drop-down list box.
Daylight saving is a period from late spring to early fall when many countries set their clocks ahead of normal local time by one hour to give more daytime light in the evening.

Start Date

Select this option if you use Daylight Saving Time.
Configure the day and time when Daylight Saving Time starts if you selected Da ylig ht Sa ving Tim e . The time is displayed in the 24 hour format. Here are a couple of examples:

Daylight Saving Time starts in most parts of the United States on the second Sunday of March. Each time zone in the United States starts using Daylight Saving Time at 2 A.M. local time. So in the United States you would select Se c o nd, Sunda y, Ma rc h and 2:00.

Daylight Saving Time starts in the European Union on the last Sunday of March. All of the time zones in the European Union start using Daylight Saving Time at the same moment (1 A.M. GMT or UTC). So in the European Union you would select La st, Sunda y, Ma rc h and the last field depends on your time zone. In Germany for instance, you would select 2:00 because Germany's time zone is one hour ahead of GMT or UTC (GMT+1).

XS3800-28 User's Guide
93

Chapter 8 Basic Setting

Table 16 Basic Setting > General Setup (continued)

LA BEL End Date

DESC RIPTIO N
Configure the day and time when Daylight Saving Time ends if you selected Da ylig ht Sa ving Tim e . The time field uses the 24 hour format. Here are a couple of examples:

Daylight Saving Time ends in the United States on the first Sunday of November. Each time zone in the United States stops using Daylight Saving Time at 2 A.M. local time. So in the United States you would select First, Sunda y, No ve m b e r and 2:00.

Apply Cancel

Daylight Saving Time ends in the European Union on the last Sunday of October. All of the time zones in the European Union stop using Daylight Saving Time at the same moment (1 A.M. GMT or UTC). So in the European Union you would select La st, Sunda y, O c to b e r and the last field depends on your time zone. In Germany for instance, you would select 2:00 because Germany's time zone is one hour ahead of GMT or UTC (GMT+1).
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

8.4 Intro duc tio n to VLANs
A VLAN (Virtual Local Area Network) allows a physical network to be partitioned into multiple logical networks. Devices on a logical network belong to one group. A device can belong to more than one group. With VLAN, a device cannot directly talk to or hear from devices that are not in the same groups; the traffic must first go through a router.
In MTU (Multi-Tenant Unit) applications, VLAN is vital in providing isolation and security among the subscribers. When properly configured, VLAN prevents one subscriber from accessing the network resources of another on the same LAN, thus a user will NOT see the printers and hard disks of another user in the same building.
VLAN also increases network performance by limiting broadcasts to a smaller and more manageable logical broadcast domain. In traditional switched environments, all broadcast packets go to each and every individual port. With VLAN, all broadcasts are confined to a specific broadcast domain.
Note: VLAN is unidirectional; it only governs outgoing traffic.
8.5 Switc h Se tup
Click Ba sic Se tting > Switc h Se tup in the navigation panel to display the screen as shown. The VLAN setup screens change depending on whether you choose 802.1Q or Po rt Ba se d in the VLAN Type field in this screen (in Standalone mode).

XS3800-28 User's Guide
94

Chapter 8 Basic Setting Fig ure 64 Basic Setting Switch Setup (Standalone Mode)

Fig ure 65 Basic Setting > Switch Setup (Stacking Mode)

The following table describes the labels in this screen.

Table 17 Basic Setting > Switch Setup

LA BEL

DESC RIPTIO N

VLAN Type
(Standalone mode only)

Choose 802.1Q or Po rt Ba se d. The VLAN Se tup screen changes depending on whether you choose 802.1Q VLAN type or Po rt Ba se d VLAN type in this screen.
The Switch does not have port-based VLAN available in stacking mode (Ac tive is enabled in Ba sic Se tting > Sta c king > C o nfig ura tio n), so this field does not display in stacking mode.

Bridge Control Protocol Transparency

Select Ac tive to allow the Switch to handle bridging control protocols (STP, for example). You also need to define how to treat a BPDU in the Po rt Se tup screen.

MAC Address Learning

MAC address learning reduces outgoing traffic broadcasts. For MAC address learning to occur on a port, the port must be active.

Aging Time

Enter a time from 10 to 1000000 seconds. This is how long all dynamically learned MAC addresses remain in the MAC address table before they age out (and must be relearned).

XS3800-28 User's Guide
95

Chapter 8 Basic Setting

Table 17 Basic Setting > Switch Setup (continued)

LA BEL

DESC RIPTIO N

ARP Aging Time

Aging Time

Enter a time from 60 to 1000000 seconds. This is how long dynamically learned ARP entries remain in the ARP table before they age out (and must be relearned). The setting here applies to ARP entries which are newly added in the ARP table after you click Apply.

GARP Timer: Switches join VLANs by making a declaration. A declaration is made by issuing a Jo in message using GARP. Declarations are withdrawn by issuing a Le a ve message. A Le a ve All message terminates all registrations. GARP timers set declaration timeout values. See the chapter on VLAN setup for more background information.

Join Timer

Join Timer sets the duration of the Join Period timer for GVRP in milliseconds. Each port has a Jo in Pe rio d timer. The allowed Jo in Tim e range is between 100 and 65535 milliseconds; the default is 200 milliseconds. See the chapter on VLAN setup for more background information.

Leave Timer

Leave Time sets the duration of the Le a ve Pe rio d timer for GVRP in milliseconds. Each port has a single Le a ve Pe rio d timer. Leave Time must be two times larger than Jo in Tim e r; the default is 600 milliseconds.

Leave All Timer

Leave All Timer sets the duration of the Leave All Period timer for GVRP in milliseconds. Each port has a single Leave All Period timer. Leave All Timer must be larger than Leave Timer.

Priority Queue Assignment

IEEE 802.1p defines up to eight separate traffic types by inserting a tag into a MAC-layer frame that contains bits to define class of service. Frames without an explicit priority tag are given the default priority of the ingress port. Use the next fields to configure the priority level-to-physical queue mapping.

The Switch has eight physical queues that you can map to the eight priority levels. On the Switch, traffic assigned to higher index queues gets through faster while traffic in lower index queues is dropped if the network is congested.
Priority Level (The following descriptions are based on the traffic types defined in the IEEE 802.1d standard (which incorporates the 802.1p).

To map a priority level to a physical queue, select a physical queue from the drop-down menu on the right.

Priority 7

Typically used for network control traffic such as router configuration messages.

Priority 6

Typically used for voice traffic that is especially sensitive to jitter (jitter is the variations in delay).

Priority 5

Typically used for video that consumes high bandwidth and is sensitive to jitter.

Priority 4

Typically used for controlled load, latency-sensitive traffic such as SNA (Systems Network Architecture) transactions.

Priority 3

Typically used for "excellent effort" or better than best effort and would include important business traffic that can tolerate some delay.

Priority 2

This is for "spare bandwidth".

Priority 1

This is typically used for non-critical "background" traffic such as bulk transfers that are allowed but that should not affect other applications and users.

Priority 0

Typically used for best-effort traffic.

Apply

Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.

Cancel

Click C a nc e l to begin configuring this screen afresh.

8.6 IP Se tup
Use the IP Se tup screen to configure the default gateway device, the default domain name server and add IP domains.

XS3800-28 User's Guide
96

Chapter 8 Basic Setting
8.6.1 IP Inte rfa c e s
The Switch needs an IP address for it to be managed over the network. When the Switch (in Standalone mode) fails to obtain an IP address from a DHCP server, the static IP address 192.168.1.1 will be automatically added and used as the Switch's management IP address.
On the Switch, an IP address is not bound to any physical ports. Since each IP address on the Switch must be in a separate subnet, the configured IP address is also known as IP interface (or routing domain). In addition, this allows routing between subnets based on the IP address without additional routers.
You can configure multiple routing domains on the same VLAN as long as the IP address ranges for the domains do not overlap. To change the IP address of the Switch in a routing domain, simply add a new routing domain entry with a different IP address in the same subnet.
You can configure up to 128 IP domains which are used to access and manage the Switch from the ports belonging to the pre-defined VLANs.
Note: You must configure a VLAN first. Each VLAN can have multiple management IP addresses, and you can log into the Switch via different management IP addresses simultaneously.
8.6.2 IP Sta tus
Fig ure 66 Basic Setting > IP Status

The following table describes the labels in this screen.

Table 18 Basic Setting > IP Status

LA BEL

DESC RIPTIO N

IP Status

Domain Name Server

This field displays the IP address of the DNS server.

Source

This field displays whether the DNS server address is configured manually (Sta tic ) or obtained automatically using DHC Pv4.

IP Interface

Index

This field displays the index number of an entry.

IP Address

This field displays the IP address of the Switch in the IP domain.

IP Subnet Mask This field displays the subnet mask of the Switch in the IP domain.

VID

This field displays the VLAN identification number of the IP domain on the Switch.

Type

This shows whether this IP address is dynamically assigned from a DHCP server or manually assigned (Sta tic ).

XS3800-28 User's Guide
97

Chapter 8 Basic Setting

Table 18 Basic Setting > IP Status (continued)

LA BEL

DESC RIPTIO N

Renew

Click this to renew the dynamic IP address.

Release

Click this to release the dynamic IP address.

8.6.3 IP Sta tus De ta ils
Use this screen to view IP status details. Click a number in the Inde x column in the IP Sta tus screen to display the screen as shown next.
Fig ure 67 Basic Setting > IP Setup > IP Status Details: Static

The following table describes the labels in this screen.

Table 19 Basic Setting > IP Setup > IP Status Details: Static

LA BEL

DESC RIPTIO N

Type

This shows the IP address is manually assigned (Sta tic ).

VID

This is the VLAN identification number to which an IP routing domain belongs.

IP Address

This is the IP address of your Switch in dotted decimal notation for example 192.168.1.1.

IP Subnet Mask This is the IP subnet mask of your Switch in dotted decimal notation for example 255.255.255.0.

Fig ure 68 Basic Setting > IP Setup > IP Status Details: DHCP

The following table describes the labels in this screen.

Table 20 Basic Setting > IP Setup > IP Status Details: DHCP

LA BEL

DESC RIPTIO N

Type

This shows the IP address is dynamically assigned from a DHCP server (DHC P).

VID

This is the VLAN identification number to which an IP routing domain belongs.

IP Address

This is the IP address of your Switch in dotted decimal notation for example 192.168.1.1.

IP Subnet Mask This is the IP subnet mask of your Switch in dotted decimal notation for example 255.255.255.0.

XS3800-28 User's Guide
98

Chapter 8 Basic Setting

Table 20 Basic Setting > IP Setup > IP Status Details: DHCP (continued)

LA BEL

DESC RIPTIO N

Lease Time

This displays the length of time in seconds that this interface can use the current dynamic IP address from the DHCP server.

Renew Time

This displays the length of time from the lease start that the Switch will request to renew its current dynamic IP address from the DHCP server.

Rebind Time

This displays the length of time from the lease start that the Switch will request to get any dynamic IP address from the DHCP server.

Lease Time Start This displays the date and time that the current dynamic IP address assignment from the DHCP server began. You should configure date and time in Ba sic Se tting > G e ne ra l Se tup.

Lease Time End

This displays the date and time that the current dynamic IP address assignment from the DHCP server will end. You should configure date and time in Ba sic Se tting > G e ne ra l Se tup.

Default Gateway

This displays the IP address of the default gateway assigned by the DHCP server. 0.0.0.0 means no gateway is assigned.

DNS Server

This displays the IP address of the primary and secondary DNS servers assigned by the DHCP server. 0.0.0.0 means no DNS server is assigned.

8.6.4 IP C o nfig ura tio n
Use this screen to configure the default gateway device, the default domain name server and add IP domains.

XS3800-28 User's Guide
99

Chapter 8 Basic Setting Fig ure 69 Basic Setting > IP Setup > IP Configuration

The following table describes the labels in this screen.

Table 21 Basic Setting > IP Setup > IP Configuration

LA BEL

DESC RIPTIO N

Domain Name Server 1/2

Enter a domain name server IPv4 address in order to be able to use a domain name instead of an IP address.

Default Management IP Address

Use these fields to create or edit IP routing domains on the Switch.

DHCP Client Select this option if you have a DHCP server that can assign the Switch an IP address, subnet mask, a default gateway IP address and a domain name server IP address automatically.

Option-60

DHCP Option 60 is used by the Switch for identification to the DHCP server using the VCI (Vendor Class Identifier) on the DHCP server. The Switch adds it in the initial DHCP discovery message that a DHCP client broadcasts in search of an IP address. The DHCP server can assign different IP addresses or options to clients with the specific VCI or reject the request from clients without the specific VCI.

Class-ID

XS3800-28 User's Guide
100

Chapter 8 Basic Setting

Table 21 Basic Setting > IP Setup > IP Configuration (continued)

LA BEL

DESC RIPTIO N

Static IP Address

Select this option if you do not have a DHCP server or if you wish to assign static IP address information to the Switch. You need to fill in the following fields when you select this option.

IP Address

Enter the IP address of your Switch in dotted decimal notation, for example, 172.21.40.x. This is the IP address of the Switch in an IP routing domain.

IP Subnet Mask

Enter the IP subnet mask of an IP routing domain in dotted decimal notation, for example, 255.255.252.0.

Default Gateway

Type the IP address of the default outgoing gateway in dotted decimal notation, for example 172.21.43.254.

VID

Enter the VLAN identification number to which an IP routing domain belongs.

Apply

Cancel

Click C a nc e l to reset the fields to your previous configuration.

Management IP Address

Use these fields to set the settings for the management port.

IP Address

Enter the out-of-band management IP address of your Switch in dotted decimal notation. For example, 192.168.0.1.

IP Subnet Mask

Enter the IP subnet mask of your Switch in dotted decimal notation, for example, 255.255.255.0.

VID

Enter the VLAN identification number to which an IP routing domain belongs.

Default Gateway

Enter the IP address of the default outgoing gateway in dotted decimal notation, for example, 192.168.0.254.

Add

Click this to create a new entry.

Cancel Index IP Address IP Subnet Mask VID Default Gateway
Delete

This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Click C a nc e l to reset the fields to your previous configuration. This field displays the index number of an entry. This field displays IP address of the Switch in the IP domain. This field displays the subnet mask of the Switch in the IP domain. This field displays the VLAN identification number of the IP domain on the Switch. This field displays the IP address of the default outgoing gateway in dotted decimal notation.
Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries. Click De le te to remove the selected entry from the summary table.

Cancel

Note: Deleting all IP subnets locks you out of the Switch.
Click C a nc e l to clear the check boxes.

XS3800-28 User's Guide
101

Chapter 8 Basic Setting

The following table describes the labels in this screen.

Table 22 Basic Setting > IP Setup > IP Configuration

LA BEL

DESC RIPTIO N

Default Gateway

Type the IP address of the default outgoing gateway in dotted decimal notation, for example 192.168.1.254.

Domain Name Server 1/2

Enter a domain name server IPv4 address in order to be able to use a domain name instead of an IP address.

Default Management

Specify which traffic flow (In- Ba nd or O ut- o f- b a nd) the Switch is to send packets originating from itself (such as SNMP traps) or packets with unknown source.

Select O ut- o f- b a nd to have the Switch send the packets to the management port labeled MG MT. This means that devices connected to the other ports do not receive these packets.

Select In- Ba nd to have the Switch send the packets to all ports except the management port (labeled MG MT) to which connected devices do not receive these packets.

Apply

Cancel

Click C a nc e l to reset the fields to your previous configuration.

Out-of-band Management IP Address

Use these fields to set the settings for the out-of-band management port.

IP Address

Enter the out-of-band management IP address of your Switch in dotted decimal notation. For example, 192.168.0.1.

IP Subnet Mask

Enter the IP subnet mask of your Switch in dotted decimal notation, for example, 255.255.255.0.

Default Gateway

Enter the IP address of the default outgoing gateway in dotted decimal notation, for example, 192.168.0.254.

Apply

Cancel

Click C a nc e l to reset the fields to your previous configuration.

IP Interface

Use these fields to create or edit IP routing domains on the Switch.

DHCP Client Select this option if you have a DHCP server that can assign the Switch an IP address, subnet mask, a default gateway IP address and a domain name server IP address automatically.

Option-60

Class-ID
Static IP Address IP Address
IP Subnet Mask VID

Select this and enter the device identity you want the Switch to add in the DHCP discovery frames that go to the DHCP server. This allows the Switch to identify itself to the DHCP server.
Type a string of up to 32 characters to identify this Switch to the DHCP server. For example, ZyxelTW.
Select this option if you do not have a DHCP server or if you wish to assign static IP address information to the Switch. You need to fill in the following fields when you select this option.
Enter the IP address of your Switch in dotted decimal notation, for example, 192.168.1.1. This is the IP address of the Switch in an IP routing domain.
Enter the IP subnet mask of an IP routing domain in dotted decimal notation, for example, 255.255.255.0.
Enter the VLAN identification number to which an IP routing domain belongs.

XS3800-28 User's Guide
102

Chapter 8 Basic Setting

Table 22 Basic Setting > IP Setup > IP Configuration (continued)

LA BEL

DESC RIPTIO N

Add

Click this to create a new entry.

Cancel Index IP Address IP Subnet Mask VID Type
Delete

Cancel

Note: Deleting all IP subnets locks you out of the Switch.
Click C a nc e l to clear the check boxes.

8.6.5 Ne two rk Pro xy C o nfig ura tio n
The proxy server of an organization may prohibit communication between the Switch and NCC (Nebula Control Center) (Section 8.12 on page 129). Use this screen to enable communication between the Switch and NCC through the proxy server.
Fig ure 70 Network Proxy Configuration Application

As of this writing, this setting only allows communication between the Switch and the NCC. Fig ure 71 Basic Setting > IP Setup > IP Configuration > Network Proxy Configuration

XS3800-28 User's Guide
103

Chapter 8 Basic Setting

The following table describes the labels in this screen.

Table 23 Basic Setting > IP Setup > IP Configuration > Network Proxy Configuration

LA BEL

DESC RIPTIO N

Active

Select this option to enable communication between the Switch and NCC through a proxy server.

Server

Enter the IP address (dotted decimal notation) or host name of the proxy server. When entering the host name, up to 128 alphanumeric characters are allowed for the Se rve r including special characters inside the square quotes [~!@#$%^&*()_+{}|:"<>?=[]\;',./`]

Port

Enter the port number of the proxy server (1 65535).

Authentication Select this option to enable proxy server authentication using a Use rna m e and Pa sswo rd.

Username

Enter a login user name from the proxy server administrator. Up to 32 alphanumeric characters are allowed for the Use rna m e including special characters inside the square quotes [~!@#$%^&*()_+{}|:"<>?=[]\;',./`].

Password

Enter a login password from the proxy server administrator. Up to 32 alphanumeric characters are allowed for the Pa sswo rd including special characters inside the square quotes [~!@#$%^&*()_+{}|:"<>?=[]\;',./`].

Apply

Cancel

Click C a nc e l to reset the fields to your previous configuration.

8.7 Po rt Se tup
Use this screen to configure Switch port settings. Click Ba sic Se tting > Po rt Se tup in the navigation panel to display the configuration screen.

XS3800-28 User's Guide
104

Chapter 8 Basic Setting Fig ure 72 Basic Setting > Port Setup (Standalone Mode)
XS3800-28 User's Guide
105

Chapter 8 Basic Setting Fig ure 73 Basic Setting > Port Setup (Stacking Mode)

The following table describes the labels in this screen.

Table 24 Basic Setting > Port Setup

LA BEL

DESC RIPTIO N

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This is the port index number. In stacking mode, the first number represents the slot ID and the

second one is the port number. Please note that the default stacking ports (the last four ports of

your Switch) cannot be configured. They are reserved for stacking only.

Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Active Name

Note: Changes in this row are copied to all the ports as soon as you make them.
Select this check box to enable a port. The factory default for all ports is enabled. A port must be enabled for data transmission to occur.
Type a descriptive name that identifies this port. You can enter up to 128 alpha-numerical characters.

Note: Due to space limitations, the port name may be truncated in some Web Configurator screens.

XS3800-28 User's Guide
106

Chapter 8 Basic Setting

Table 24 Basic Setting > Port Setup (continued)

LA BEL

DESC RIPTIO N

Speed/Duplex

Select the speed and the duplex mode of the Ethernet connection on this port. The choices are Auto , Auto - 1G , 2.5G / Full Duple x, 5G / Full Duple x, and 100M / Full Duple x for a 100Base-T connection. 1G / Full Duple x is supported by both 1000Base-T and 1000Base-X connections. 10G / Full Duple x is supported by the 10 Gigabit Ethernet connections on the Switch that has a 10 Gigabit interface.

Flow Control

Selecting Auto - 1G or Auto (auto-negotiation) allows one port to negotiate with a peer port automatically to obtain the connection speed and duplex mode that both ends support. When auto-negotiation is turned on, a port on the Switch negotiates with the peer automatically to determine the connection speed and duplex mode. If the peer port does not support autonegotiation or turns off this feature, the Switch determines the connection speed by detecting the signal on the cable and using half duplex mode. When the Switch's auto-negotiation is turned off, a port uses the pre-configured speed and duplex mode when making a connection, thus requiring you to make sure that the settings of the peer port are the same in order to connect.
A concentration of traffic on a port decreases port bandwidth and overflows buffer memory causing packet discards and frame losses. Flo w C o ntro l is used to regulate transmission of signals to match the bandwidth of the receiving port.

The Switch uses IEEE 802.3x flow control in full duplex mode and backpressure flow control in half duplex mode.

IEEE 802.3x flow control is used in full duplex mode to send a pause signal to the sending port, causing it to temporarily stop sending signals when the receiving port memory buffers fill.

802.1p Priority BPDU Control

Back Pressure flow control is typically used in half duplex mode to send a "collision" signal to the sending port (mimicking a state of packet collision) causing the sending port to temporarily stop sending signals and resend later. Select Flo w C o ntro l to enable it.
This priority value is added to incoming frames without a (802.1p) priority queue tag.
Configure the way to treat BPDUs received on this port. You must activate bridging control protocol transparency in the Switch Se tup screen first.

Select Pe e r to process any BPDU (Bridge Protocol Data Units) received on this port.

Select Tunne l to forward BPDUs received on this port.

Select Disc a rd to drop any BPDU received on this port.

Media Type

Select Ne two rk to process a BPDU with no VLAN tag and forward a tagged BPDU.
You can insert either an SFP+ transceiver or an SFP+ Direct Attach Copper (DAC) cable into the 10 Gigabit interface of the Switch.

Apply Cancel

Select the media type (sfp_plus or da c 10g ) of the SFP+ module that is attached to the 10 Gigabit interface.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

8.8 Inte rfa c e Se tup
An IPv6 address is configured on a per-interface basis. The interface can be a physical interface (for example, an Ethernet port) or a virtual interface (for example, a VLAN). The Switch supports the VLAN interface type for IPv6 at the time of writing.
Use this screen to set IPv4 loopback interfaces for routing protocols or IPv6 interfaces on which you can
XS3800-28 User's Guide
107

Chapter 8 Basic Setting
configure an IPv6 address to access and manage the Switch. Click Ba sic Se tting > Inte rfa c e Se tup in the navigation panel to display the configuration screen. Fig ure 74 Basic Setting > Interface Setup

The following table describes the labels in this screen.

Table 25 Basic Setting > Interface Setup

LA BEL

DESC RIPTIO N

Interface Type Select the type of IPv6 interface for which you want to configure. The Switch supports the VLAN interface type for IPv6 at the time of writing.

Interface ID

Specify a unique identification number (from 1 to 4094) for the VLAN interface or a unique identification number (from 0 to 2) for the loopback interface.

Add

To have IPv6 function properly, you should configure a static VLAN with the same ID number in the Adva nc e d Applic a tio n > VLAN screens.
Click this to create a new entry.

Cancel Index Interface Type Interface ID Interface
Delete Cancel

This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to reset the fields to your previous configuration.
This field displays the index number of an entry.
This field displays the type of interface.
This field displays the identification number of the interface.
This field displays the interface's descriptive name which is generated automatically by the Switch. The name is from a combination of the interface type and ID number.
Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.
Click De le te to remove the selected entry from the summary table.
Click C a nc e l to clear the check boxes.

8.9 IPv6
Use this screen to view the IPv6 interface status and configure the Switch's management IPv6 addresses.

XS3800-28 User's Guide
108

Chapter 8 Basic Setting
8.9.1 IPv6 Sta tus
Click Ba sic Se tting > IPv6 in the navigation panel to display the IPv6 status screen as shown next. Fig ure 75 Basic Setting > IPv6

The following table describes the labels in this screen.

Table 26 Basic Setting > IPv6

LA BEL

DESC RIPTIO N

IPv6 Status

Domain Name This field displays the IP address of the DNS server. Server

Source

This field displays whether the DNS server address is configured manually (Sta tic ) or obtained automatically using DHC Pv6.

IPv6 Table

Index

This field displays the index number of an IPv6 interface. Click on an index number to view more interface details.

Interface

This is the name of the IPv6 interface you created.

Active

This field displays whether the IPv6 interface is activated or not.

8.9.2 IPv6 Inte rfa c e Sta tus
Use this screen to view a specific IPv6 interface status and detailed information. Click an interface index number in the Ba sic Se tting > IPv6 screen. The following screen opens.

XS3800-28 User's Guide
109

Chapter 8 Basic Setting Fig ure 76 Basic Setting > IPv6 > IPv6 Interface Status

The following table describes the labels in this screen.

Table 27 Basic Setting > IPv6 > IPv6 Interface Status

LA BEL

DESC RIPTIO N

IPv6 Active

This field displays whether the IPv6 interface is activated or not.

MTU Size

This field displays the Maximum Transmission Unit (MTU) size for IPv6 packets on this interface.

ICMPv6 Rate Limit Bucket Size

This field displays the maximum number of ICMPv6 error messages which are allowed to transmit in a given time interval. If the bucket is full, subsequent error messages are suppressed.

ICMPv6 Rate Limit Error Interval

This field displays the time period (in milliseconds) during which ICMPv6 error messages of up to the bucket size can be transmitted. 0 means no limit.

Link Local Address

This field displays the Switch's link-local IP address and prefix generated by the interface. It also shows whether the IP address is preferred, which means it is a valid address and can be used as a sender or receiver address.

Global Unicast This field displays the Switch's global unicast address to identify this interface. Address(es)

Joined Group This field displays the IPv6 multicast addresses of groups the Switch's interface joins. Address(es)

XS3800-28 User's Guide
110

Chapter 8 Basic Setting

Table 27 Basic Setting > IPv6 > IPv6 Interface Status (continued)

LA BEL

DESC RIPTIO N

ND DAD Active This field displays whether Neighbor Discovery (ND) Duplicate Address Detection (DAD) is enabled on the interface.

Number of

This field displays the number of consecutive neighbor solicitations the Switch sends for this

DAD Attempts interface.

NS-Interval (millisecond)

This field displays the time interval (in milliseconds) at which neighbor solicitations are re-sent for this interface.

ND Reachable This field displays how long (in milliseconds) a neighbor is considered reachable for this interface. Time (millisecond)

DHCPv6 Client This field displays whether the Switch acts as a DHCPv6 client to get an IPv6 address from a

Active

DHCPv6 server.

Identity Association

An Identity Association (IA) is a collection of addresses assigned to a DHCP client, through which the server and client can manage a set of related IP addresses. Each IA must be associated with exactly one interface.

IA Type

The IA type is the type of address in the IA. Each IA holds one type of address. IA_NA means an identity association for non-temporary addresses and IA_TA is an identity association for temporary addresses.

IAID

Each IA consists of a unique IAID and associated IP information.

This field displays the DHCPv6 T1 timer. After T1, the Switch sends the DHCPv6 server a Renew

message.

T2 State

An IA_NA option contains the T1 and T2 fields, but an IA_TA option does not. The DHCPv6 server uses T1 and T2 to control the time at which the client contacts with the server to extend the lifetimes on any addresses in the IA_NA before the lifetimes expire.
This field displays the DHCPv6 T2 timer. If the time T2 is reached and the server does not respond, the Switch sends a Rebind message to any available server.
This field displays the state of the TA. It shows

Ac tive when the Switch obtains addresses from a DHCpv6 server and the TA is created.

Re ne w when the TA's address lifetime expires and the Switch sends out a Renew message.

SID Address Preferred Lifetime Valid Lifetime DNS Domain List
Restart DHCPv6 Client

Re bind when the Switch does not receive a response from the original DHCPv6 server and sends out a Rebind message to another DHCPv6 server. This field displays the DHCPv6 server's unique ID. This field displays the Switch's global address which is assigned by the DHCPv6 server. This field displays how long (in seconds) that the global address remains preferred.
This field displays how long (in seconds) that the global address is valid.
This field displays the DNS server address assigned by the DHCPv6 server. This field displays the address record when the Switch queries the DNS server to resolve domain names. Click C lic k He re to send a new DHCP request to the DHCPv6 server and update the IPv6 address and DNS information for this interface.

8.9.3 IPv6 C o nfig ura tio n
Use this screen to configure IPv6 settings on the Switch. Click the IPv6 C o nfig ura tio n link in the Ba sic Se tting > IPv6 screen. The following screen opens.

XS3800-28 User's Guide
111

Chapter 8 Basic Setting Fig ure 77 Basic Setting > IPv6 > IPv6 Configuration

The following table describes the labels in this screen.

Table 28 Basic Setting > IPv6 > IPv6 Configuration

LA BEL

DESC RIPTIO N

IPv6 Global Setup

Click the link to go to a screen where you can configure the global IPv6 settings on the Switch.

IPv6 Interface Setup Click the link to go to a screen where you can enable an IPv6 interface on the Switch.

IPv6 Addressing

IPv6 Link-Local Address Setup

Click the link to go to a screen where you can configure the IPv6 link-local address for an interface.

IPv6 Global Address Setup

Click the link to go to a screen where you can configure the IPv6 global address for an interface.

IPv6 Neighbor Discovery

IPv6 Neighbor

Click the link to go to a screen where you can configure the IPv6 neighbor discovery

Discovery Setup settings.

IPv6 Router

Click the link to go to a screen where you can configure the IPv6 router discovery settings.

Discovery Setup

IPv6 Prefix Setup Click the link to go to a screen where you can configure the Switch's IPv6 prefix list.

IPv6 Neighbor Setup Click the link to go to a screen where you can create a static IPv6 neighbor entry in the Switch's IPv6 neighbor table.

DHCPv6 Client Setup Click the link to go to a screen where you can configure the Switch DHCPv6 client settings.

8.9.4 IPv6 G lo b a l Se tup
Use this screen to configure the global IPv6 settings. Click the link next to IPv6 G lo b a l Se tup in the IPv6 C o nfig ura tio n screen to display the screen as shown next.
Fig ure 78 Basic Setting > IPv6 > IPv6 Configuration > IPv6 Global Setup

XS3800-28 User's Guide
112

Chapter 8 Basic Setting

The following table describes the labels in this screen.

Table 29 Basic Setting > IPv6 > IPv6 Configuration > IPv6 Global Setup

LA BEL

DESC RIPTIO N

IPv6 Hop Limit

Specify the maximum number of hops (from 1 to 255) in router advertisements. This is the maximum number of hops on which an IPv6 packet is allowed to transmit before it is discarded by an IPv6 router, which is similar to the TTL field in IPv4.

ICMPv6 Rate Limit Bucket Size

Specify the maximum number of ICMPv6 error messages (from 1 to 200) which are allowed to transmit in a given time interval. If the bucket is full, subsequent error messages are suppressed.

ICMPv6 Rate Limit Error Interval

Specify the time period (from 0 to 2147483647 milliseconds) during which ICMPv6 error messages of up to the bucket size can be transmitted. 0 means no limit.

Apply

Cancel

Click C a nc e l to begin configuring this screen afresh.

Clear

Click C le a r to reset the fields to the factory defaults.

8.9.5 IPv6 Inte rfa c e Se tup
Use this screen to turn on or off an IPv6 interface. Click the link next to IPv6 Inte rfa c e Se tup in the IPv6 C o nfig ura tio n screen to display the screen as shown next.
Fig ure 79 Basic Setting > IPv6 > IPv6 Configuration > IPv6 Interface Setup

The following table describes the labels in this screen.

Table 30 Basic Setting > IPv6 > IPv6 Configuration > IPv6 Interface Setup

LA BEL

DESC RIPTIO N

Interface

Select the IPv6 interface you want to configure.

Active

Select this option to enable the interface.

Apply

Cancel

Click C a nc e l to begin configuring this screen afresh.

Clear

Click C le a r to reset the fields to the factory defaults.

Index

This is the interface index number. Click on an index number to change the settings.

Interface

This is the name of the IPv6 interface you created.

Active

This field displays whether the IPv6 interface is activated or not.

XS3800-28 User's Guide
113

Chapter 8 Basic Setting
8.9.6 IPv6 Link- Lo c a l Addre ss Se tup
A link-local address uniquely identifies a device on the local network (the LAN). It is similar to a "private IP address" in IPv4. You can have the same link-local address on multiple interfaces on a device. A linklocal unicast address has a predefined prefix of fe80::/10. Use this screen to configure the interface's link-local address and default gateway. Click the link next to IPv6 Link- Lo c a l Addre ss Se tup in the IPv6 C o nfig ura tio n screen to display the screen as shown next. Fig ure 80 Basic Setting > IPv6 > IPv6 Configuration > IPv6 Link-Local Address Setup

The following table describes the labels in this screen.

Table 31 Basic Setting > IPv6 > IPv6 Configuration > IPv6 Link-Local Address Setup

LA BEL

DESC RIPTIO N

Interface

Select the IPv6 interface you want to configure.

Link-Local Address

Manually configure a static IPv6 link-local address for the interface.

Default Gateway

Set the default gateway IPv6 address for the interface. When an interface cannot find a routing information for a frame's destination, it forwards the packet to the default gateway.

Apply

Cancel

Click C a nc e l to begin configuring this screen afresh.

Clear

Click C le a r to reset the fields to the factory defaults.

Index

This is the interface index number. Click an index number to change the settings.

Interface

This is the name of the IPv6 interface you created.

IPv6 Link-Local This is the static IPv6 link-local address for the interface. Address

IPv6 Default Gateway

This is the default gateway IPv6 address for the interface.

8.9.7 IPv6 G lo b a l Addre ss Se tup
Use this screen to configure the interface's IPv6 global address. Click the link next to IPv6 G lo ba l Addre ss Se tup in the IPv6 C o nfig ura tio n screen to display the screen as shown next.

XS3800-28 User's Guide
114

Chapter 8 Basic Setting Fig ure 81 Basic Setting > IPv6 > IPv6 Configuration > IPv6 Global Address Setup

The following table describes the labels in this screen.

Table 32 Basic Setting > IPv6 > IPv6 Configuration > IPv6 Global Address Setup

LA BEL

DESC RIPTIO N

Domain Name Server 1/2 Apply
Cancel Interface IPv6 Global Address Prefix Length
EUI-64 Add

Enter a domain name server IPv6 address in order to be able to use a domain name instead of an IP address. Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Click this to reset the Do m a in Na m e Se rve r values in this screen to their last-saved values. Select the IPv6 interface you want to configure. Manually configure a static IPv6 global address for the interface.
Specify an IPv6 prefix length that specifies how many most significant bits (start from the left) in the address compose the network address. Select this option to have the interface ID be generated automatically using the EUI-64 format. Click this to create a new entry.

Cancel
Clear
Index
Interface
IPv6 Global Address/Prefix Length
EUI-64

XS3800-28 User's Guide
115

Chapter 8 Basic Setting

Table 32 Basic Setting > IPv6 > IPv6 Configuration > IPv6 Global Address Setup (continued)

LA BEL

DESC RIPTIO N

Delete

Check the entries that you want to remove and then click De le te to remove the selected entries from the summary table.

Cancel

Click C a nc e l to clear the check boxes.

8.9.8 IPv6 Ne ig hb o r Disc o ve ry Se tup
Use this screen to configure neighbor discovery settings for each interface. Click the link next to IPv6 Ne ig hb o r Disc o ve ry Se tup in the IPv6 C o nfig ura tio n screen to display the screen as shown next.
Fig ure 82 Basic Setting > IPv6 > IPv6 Configuration > IPv6 Neighbor Discovery Setup

The following table describes the labels in this screen.

Table 33 Basic Setting > IPv6 > IPv6 Configuration > IPv6 Neighbor Discovery Setup

LA BEL

DESC RIPTIO N

Interface

Select the IPv6 interface you want to configure.

DAD Attempts The Switch uses Duplicate Address Detection (DAD) with neighbor solicitation and advertisement messages to check whether an IPv6 address is already in use before assigning it to an interface.

NS Interval
Reachable Time Apply
Cancel Clear Index Interface DAD Attempts

Specify the number of consecutive neighbor solicitations (from 0 to 600) the Switch sends for this interface. Enter 0 to turn off DAD.
Specify the time interval (from 1000 to 3600000 milliseconds) at which neighbor solicitations are resent for this interface.
Specify how long (from 1000 to 3600000 milliseconds) a neighbor is considered reachable for this interface.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.
Click C le a r to reset the fields to the factory defaults.
This is the interface index number. Click on an index number to change the settings.
This is the name of the IPv6 interface you created.
This field displays the number of consecutive neighbor solicitations the Switch sends for this interface.

XS3800-28 User's Guide
116

Chapter 8 Basic Setting

Table 33 Basic Setting > IPv6 > IPv6 Configuration > IPv6 Neighbor Discovery Setup (continued)

LA BEL

DESC RIPTIO N

NS Interval

This field displays the time interval (in milliseconds) at which neighbor solicitations are re-sent for this interface.

Reachable Time

This field displays how long (in milliseconds) a neighbor is considered reachable for this interface.

8.9.9 IPv6 Ro ute r Disc o ve ry Se tup
Use this screen to configure router discovery settings for each interface. Click the link next to IPv6 Ro ute r Disc o ve ry Se tup in the IPv6 C o nfig ura tio n screen to display the screen as shown next.
Fig ure 83 Basic Setting > IPv6 > IPv6 Configuration > IPv6 Router Discovery Setup

The following table describes the labels in this screen.

Table 34 Basic Setting > IPv6 > IPv6 Configuration > IPv6 Router Discovery Setup

LA BEL

DESC RIPTIO N

Interface

Select the IPv6 interface you want to configure.

Flags

Select the Ma na g e d C o nfig Fla g option to have the Switch set the "managed address configuration" flag (the M flag) to 1 in IPv6 router advertisements, which means IPv6 hosts use DHCPv6 to obtain IPv6 stateful addresses. De-select the option to set the flag to 0 and the host will not use DHCPv6 to obtain IPv6 stateful addresses.

Minimum Interval

Select the O the r C o nfig Fla g option to have the Switch set the "Other stateful configuration" flag (the O flag) to 1 in IPv6 router advertisements, which means IPv6 hosts use DHCPv6 to obtain additional configuration settings, such as DNS information. De-select the option to set the flag to 0 and the host will not use DHCPv6 to obtain additional configuration settings.
Specify the minimum time interval (from 3 to 1350 seconds) at which the Switch sends router advertisements for this interface.

Maximum Interval

Note: The minimum time interval cannot be greater than three-quarters of the maximum time interval.
Specify the maximum time interval (from 4 to 1800 seconds) at which the Switch sends router advertisements for this interface.

XS3800-28 User's Guide
117

Chapter 8 Basic Setting

Table 34 Basic Setting > IPv6 > IPv6 Configuration > IPv6 Router Discovery Setup (continued)

LA BEL

DESC RIPTIO N

Lifetime

Specify how long (from 0 to 9000 seconds) the router in router advertisements can be used as a default router for this interface.

Suppress

Select this option to set the Switch to not send router advertisements and responses to router solicitations on this interface.

Apply

Cancel

Click C a nc e l to begin configuring this screen afresh.

Clear

Click C le a r to reset the fields to the factory defaults.

Index

This is the interface index number. Click an index number to change the settings.

Interface

This is the name of the IPv6 interface you created.

Flags

This field displays whether IPv6 hosts use DHCPv6 to obtain IPv6 stateful addresses (M) and/ or additional configuration settings (O ).

Minimum Interval

This field displays the minimum time interval at which the Switch sends router advertisements for this interface.

Maximum Interval

This field displays the maximum time interval at which the Switch sends router advertisements for this interface.

Lifetime

This field displays how long the router in router advertisements can be used as a default router for this interface.

Suppress

This field displays whether the Switch sends router advertisements and responses to router solicitations on this interface (No ) or not (Ye s).

8.9.10 IPv6 Pre fix Se tup
Use this screen to configure the Switch's IPv6 prefix list for each interface. Click the link next to IPv6 Pre fix Se tup in the IPv6 C o nfig ura tio n screen to display the screen as shown next.
Fig ure 84 Basic Setting > IPv6 > IPv6 Configuration > IPv6 Prefix Setup

XS3800-28 User's Guide
118

Chapter 8 Basic Setting

The following table describes the labels in this screen.

Table 35 Basic Setting > IPv6 > IPv6 Configuration > IPv6 Prefix Setup

LA BEL Interface Prefix Prefix Length Valid Lifetime
Preferred Lifetime

DESC RIPTIO N
Select the IPv6 interface you want to configure.
Set the IPv6 prefix that the Switch includes in router advertisements for this interface.
Set the prefix length that the Switch includes in router advertisements for this interface.
Specify how long (from 0 to 4294967295 seconds) the prefix is valid for on-link determination.
Specify how long (from 0 to 4294967295 seconds) that addresses generated from the prefix remain preferred.

Flags

The preferred lifetime cannot exceed the valid lifetime. Select No - Auto c o nfig Fla g to not allow IPv6 hosts to use this prefix.

Select No - O nlink Fla g to not allow the specified prefix to be used for on-link determination.

Add

Select No - Adve rtise Fla g to set the Switch to not include the specified IPv6 prefix, prefix length in router advertisements for this interface.
Click this to create a new entry or to update an existing one.

Cancel Clear Index Interface Prefix/Prefix Length
Valid Lifetime Preferred Lifetime
Delete
Cancel

This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.
Click C le a r to reset the fields to the factory defaults.
This is the interface index number. Click an index number to change the settings.
This is the name of the IPv6 interface you created.
This field displays the IPv6 prefix and prefix length that the Switch includes in router advertisements for this interface.
This field displays the IPv6 prefix valid lifetime.
This field displays the preferred lifetime of an IPv6 address generated from the prefix.
Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.
Check the entries that you want to remove in the De le te column and then click De le te to remove the selected entries from the summary table.
Click C a nc e l to clear the De le te check boxes.

8.9.11 IPv6 Ne ig hb o r Se tup
Use this screen to create a static IPv6 neighbor entry in the Switch's IPv6 neighbor table to store the neighbor information permanently. Click the link next to IPv6 Ne ig hb o r Se tup in the IPv6 C o nfig ura tio n screen to display the screen as shown next.

XS3800-28 User's Guide
119

Chapter 8 Basic Setting Fig ure 85 Basic Setting > IPv6 > IPv6 Configuration > IPv6 Neighbor Setup

The following table describes the labels in this screen.

Table 36 Basic Setting > IPv6 > IPv6 Configuration > IPv6 Neighbor Setup

LA BEL

DESC RIPTIO N

Interface Type Select the type of IPv6 interface for which you want to configure. The Switch supports the VLAN interface type for IPv6 at the time of writing.

Interface ID

Specify a unique identification number (from 1 to 4094) for the interface.

A static IPv6 neighbor entry displays in the Ma na g e m e nt > IPv6 Ne ig hbo r Ta b le screen only when the interface ID is also created in the Ba sic Se tup > Inte rfa c e Se tup screen.

Neighbor Address MAC
Add

To have IPv6 function properly, you should configure a static VLAN with the same ID number in the Adva nc e d Applic a tio n > VLAN screens. Specify the IPv6 address of the neighboring device which can be reached through the interface.
Specify the MAC address of the neighboring device which can be reached through the interface. Click this to create a new entry or to update an existing one.

Cancel Clear Index Interface Neighbor Address MAC
Delete
Cancel

This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.
Click C le a r to reset the fields to the factory defaults.
This is the interface index number. Click an index number to change the settings.
This is the name of the IPv6 interface you created.
This field displays the IPv6 address of the neighboring device which can be reached through the interface.
This field displays the MAC address of the neighboring device which can be reached through the interface.
Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.
Check the entries that you want to remove and then click De le te to remove the selected entries from the summary table.
Click C a nc e l to clear the check boxes.

XS3800-28 User's Guide
120

Chapter 8 Basic Setting
8.9.12 DHC Pv6 C lie nt Se tup
Use this screen to configure the Switch's DHCP settings when it is acting as a DHCPv6 client. Click the link next to DHC Pv6 C lie nt Se tup in the IPv6 C o nfig ura tio n screen to display the screen as shown next. Fig ure 86 Basic Setting > IPv6 > IPv6 Configuration > DHCPv6 Client Setup

The following table describes the labels in this screen.

Table 37 Basic Setting > IPv6 > IPv6 Configuration > DHCPv6 Client Setup

LA BEL

DESC RIPTIO N

Interface IA Type

Select the IPv6 interface you want to configure.
Select IA- NA to set the Switch to get a non-temporary IP address from the DHCPv6 server for this interface.

Options
Information Refresh Minimum Apply
Cancel Clear Index Interface IA-NA Rapid-Commit
DNS

Optionally, you can also select Ra pid- C o m m it to have the Switch send its DHCPv6 Solicit message with a Rapid Commit option to obtain information from the DHCPv6 server by a rapid twomessage exchange. The Switch discards any Reply messages that do not include a Rapid Commit option. The DHCPv6 server should also support the Rapid Commit option to have it work well.
Select DNS to have the Switch obtain DNS server IPv6 addresses and/or select Do m a in- List to have the Switch obtain a list of domain names from the DHCP server.
Specify the time interval (from 600 to 4294967295 seconds) at which the Switch exchanges other configuration information with a DHCPv6 server again.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.
Click C le a r to reset the fields to the factory defaults.
This is the interface index number. Click an index number to change the settings.
This is the name of the IPv6 interface you created.
This field displays whether the Switch obtains a non-temporary IP address from the DHCPv6 server.
This field displays whether the Switch obtains information from the DHCPv6 server by a rapid twomessage exchange.
This field displays whether the Switch obtains DNS server IPv6 addresses from the DHCPv6 server.

XS3800-28 User's Guide
121

Chapter 8 Basic Setting

Table 37 Basic Setting > IPv6 > IPv6 Configuration > DHCPv6 Client Setup (continued)

LA BEL

DESC RIPTIO N

Domain-List

This field displays whether the Switch obtains a list of domain names from the DHCP server.

Information Refresh Minimum

This field displays the time interval (in seconds) at which the Switch exchanges other configuration information with a DHCPv6 server again.

8.10 Lo o pb a c k Inte rfa c e
The loopback interface is a virtual interface which can be assigned an IP address and used by routing protocols. The loopback interface does not need to be connected to any devices and will always be available if the Switch is functioning normally and connected to a network. You can enable multiple loopback interfaces on the Switch, and each loopback interface must be uniquely identified.
The Switch can use a loopback interface address as the source address of all packets that originate from the Switch. Filters can then be applied to the loopback address to protect the system.
Click the link next to IPv4 Lo o pba c k Inte rfa c e in the Ba sic Se tting > Lo o pb a c k Inte rfa c e screen. The following screen opens.
Fig ure 87 Basic Setting > Loopback Interface

8.10.1 IPv4 Lo o pb a c k Inte rfa c e
Use this screen to configure IPv4 loopback interfaces on the Switch. Fig ure 88 Basic Setting > Loopback Interface > IPv4 Loopback Interface

XS3800-28 User's Guide
122

Chapter 8 Basic Setting

The following table describes the labels in this screen.

Table 38 Basic Setting > Loopback Interface > IPv4 Loopback Interface

LA BEL

DESC RIPTIO N

Loopback Interface ID

Select the ID of loopback interface you want to configure.

Active

Select this option to enable the interface.

Name

Enter a descriptive name for the IPv4 loopback interface for identification purposes. This name consists of up to 64 printable characters; spaces are allowed.

IP Address

Enter the IP address of your Switch in dotted decimal notation, for example, 192.168.1.1. This is the IP address of the Switch in an IP routing domain.

IP Subnet Mask Enter the IP subnet mask of an IP routing domain in dotted decimal notation, for example, 255.255.255.0.

Add

Click this to create a new entry.

Cancel Clear ID Active Name IP Address IP Subnet Mask
Delete Cancel

This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Click C a nc e l to reset the fields to the factory defaults. Click C le a r to begin configuring this screen afresh. This field displays the identification number of the interface. This field displays whether the IPv4 loopback interface is activated or not. This field displays the descriptive name for this IPv4 loopback interface. This field displays the IP address of the Switch in the IP domain. This field displays the subnet mask of the Switch in the IP domain. Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries. Click De le te to remove the selected entry from the summary table. Click C a nc e l to clear the check boxes.

8.11 Sta c king
Stacking is directly connecting Switches to form a larger system that behaves as a single Switch or a virtual chassis with increased port density.
Fig ure 89 Switch Stacking Concept

The last four combo ports of your Switch are dedicated for Switch stacking. At the time of writing, the Switch can only connect to another Switch of the same model and firmware version.
Note: Up to four Switches per stack are allowed.
You can manage each Switch in the stack from a master Switch using its Web Configurator or console. Each Switch supports up to two stacking channels. The stacking ports used to form the same stacking
XS3800-28 User's Guide
123

Chapter 8 Basic Setting

channel must be connected to the ports of the same channel on a neighboring Switch. For example, ports 25 and 26 (channel 1) on Switch A can connect to ports 25 and 26 (channel 1) or ports 27 and 28 (channel 2) on Switch B.

Table 39 Stacking Channels and Ports

STAC KING C HANNEL STAC KING PO RTS

25, 26

27, 28

You can build a Switch stack using a ring or chain topology. In a ring topology, the last Switch is connected to the first.
Fig ure 90 Stacking Topology

Use the master Switch to assign a `slot ID' for each `linecard' non-master Switch. `Slot' refers to a Switch in the `virtual chassis' stack.
The advantages of stacking are:
· High port density for example, two 24-port Switches can become one 48-port logical Switch · Centralized management log into a single IP address of the master switch to control all Switches in
the stacking system using the web configurator, CLI, SNMP or FTP · Redundancy Data redundancy allows traffic to be forwarded even if one Switch in the stack fails.
Management redundancy lets you still manage the stack even if one Switch in the stack fails · Modularity and hot-swappable you can add, remove, or replace Switches to increase or decrease
the stack with minimum disruption to ongoing network traffic
8.11.1 Sta c king Sta tus
Click Ba sic Se tting > Sta c king in the navigation panel to display the Sta c king Sta tus screen as shown next.
Fig ure 91 Basic Setting > Stacking > Stacking Status

XS3800-28 User's Guide
124

Chapter 8 Basic Setting

The following table describes the labels in this screen.

Table 40 Basic Setting > Stacking > Stacking Status

LA BEL Slot
Name Status

DESC RIPTIO N
`Slot' refers to a Switch in the `virtual chassis' stack. This field displays the slot ID of the stacked Switch. You can click the ID number to go to the Sta c king Slo t Sta tus screen.
This field displays the model name of the stacked Switch.
This field displays whether the stacked Switch is a c tive or ina c tive in a stack system.

Init means the slot ID is being initialized by the master Switch.

a c tive * means the Switch is in the stack, but some items failed to initiate. See the system logs for details. If the Switch is not a master, disconnect and reconnect the stacking port and wait. Restart the Switch if it still displays a c tive *. If the Switch is a master, restart it or choose another master.

MAC address

This field displays the MAC address of the stacked Switch.

Role

This field displays whether the Switch is a master, backup or linecard. There's only one master and one backup Switch in the stacking mode; all others are linecard Switches.

Stacking Topology: Ring/Chain

Slot No.

This field displays the slot ID number of the stacked Switch.

Stacking Channel1

Neighbor

This field displays the neighbor Switch that is connected using slot channel 1 of the Switch.

Speed

This field displays the Ethernet speed of stacking channel 1 of the Switch.

Stacking Channel2

Neighbor

This field displays the neighbor Switch that is connected to slot channel 2 of the Switch.

Speed

This field displays the Ethernet speed of stacking channel 2 of the Switch.

8.11.2 Sta c king Slo t
Click a stack number in Ba sic Se tting > Sta c king > Sta c king Sta tus to display the Sta c king Slo t Sta tus screen as shown next.
Fig ure 92 Basic Setting > Stacking > Stacking Status > Slot

XS3800-28 User's Guide
125

Chapter 8 Basic Setting

The following table describes the labels in this screen.

Table 41 Basic Setting > Stacking > Stacking Status > Slot

LA BEL Slot Stacking Role Force Master Mode
Priority Slot ID After Reboot Stacking Status

DESC RIPTIO N
This field displays the slot ID of the Switch.
This field displays whether the Switch is active in the stacking system.
This field displays whether the stacked Switch is a master, backup or linecard Switch.
This field displays whether the Force Master Mode is enabled or disabled on this Switch. The Ac tive Fo rc e Ma ste r Mo de forces this Switch to become a master Switch. This Switch will have the highest priority over all other Switch in the stack. If two Switches are set as masters, they will have the same priority level, but the Switch that has the longest active run-time will be selected as the master Switch automatically.
This field displays the priority level of the Switch. A higher number represents higher priority.
This field displays the slot ID of the Switch after a reboot. You can save the slot ID of the Switch after a reboot by clicking Fre e ze in the Sta c king C o nfig ura tio n screen.
This field displays whether the stacked Switch is a c tive or ina c tive in a stack system.

Init means the slot ID is being initialized by the master Switch.

Master Capable This field displays whether the Switch has capacity to become a master Switch. Auto means the stack system master election process will determine if the Switch can be assigned as a master Switch.

Stacking MAC Address

This field displays the stacking Switch MAC address.

Stacking Channel 1

This field displays the status of the port stacking channel 1 of the Switch. It will display up for active or down for inactive.

Stacking Channel 2

This field displays the status of the port stacking channel 2 of the Switch. It will display up for active or down for inactive.

Stacking Up Time

This field displays the time that the active Switch in a stack has been running.

ZyNOS version *Running/Flash

This field displays the ZyNOS firmware that is currently running on the Switch.

8.11.3 Sta c king C o nfig ura tio n
A supported Switch can change between stacking and standalone mode by selecting the Ac tive check box in the Ba sic Se tting > Sta c king > C o nfig ura tio n screen.
Note: When you change modes, all configurations except user accounts, but including running configuration, config01, config02 and custom default configuration will be erased and the Switch will reboot with a new config01. Therefore, you should back up previous configurations if you want to reload them later.
Note: When the Switch is in stacking mode, it uses the default static IP address 192.168.1.1.
Stacking will automatically choose a master Switch in a stack but you can overwrite that by actively forcing a Switch to become a master Switch. In the Sta c king C o nfig ura tio n screen, click Fo rc e Ma ste r Mo de to choose the master Switch. This master Switch will have the highest priority over all other stacked Switches even when they have same priority value.
XS3800-28 User's Guide
126

Chapter 8 Basic Setting
If two or more Switches have Fo rc e Ma ste r Mo de enabled, they have the same Syste m Prio rity. Then the Switch with the longest up-time is selected. Uptime is measured in increments of 10 minutes. The Switch with the higher number of increments is selected. If they have the same uptime, then the Switch with the lowest MAC address will be the master. This is the master election priority in a stack system:
1 Active Fo rc e Ma ste r Mo de 2 Highest Sta c king Prio rity 3 Longest Syste m Up Tim e 4 Lowest MAC Address
Note: Master election occurs when a stacking port link status changes (up or down). The link status changes when (for example): a stacking port cable is disconnected a Switch in the stack reboots (as happens after you change stacking mode to standalone) you add a Switch to the stack or a Switch in the stack shuts down.
Use the following procedure to create a stack:
1 Select a Switch to be the master. Change its mode to stacking mode. You will see a message asking you to confirm the change. Click O K to confirm and the Switch will reboot automatically using a new config01 and the default static IP address 192.168.1.1.
2 After reboot completes, the master LED will turn on. 3 Configure the Switch stacking priority to a high value, such as 63. 4 Change a second Switch to stacking mode and wait for it to finish rebooting automatically. This master
LED will also turn on. 5 Connect the two Switches using the stacking ports for the Switch defined. 6 The second Switch master LED will then turn off, and its Sys LED will blink while it is initializing. Please wait
until it stops blinking, indicating that it has joined the stack. 7 Repeat steps 4 to 6 to connect other Switches to the stack.
XS3800-28 User's Guide
127

Chapter 8 Basic Setting
When the Switch is in Stacking mode, the Web Configurator will change port and VLAN port settings to support the stacking mode. Click Ba sic Se tting > Sta c king > C o nfig ura tio n to see the following screen. Fig ure 93 Basic Setting > Stacking > Configuration

The following table describes the labels in this screen.

Table 42 Basic Setting > Stacking > Configuration

LA BEL

DESC RIPTIO N

Active

Select the Ac tive check box to put the Switch in stacking mode. This will erase the running configuration, config01 and config02. The master Switch's login will remain unchanged. If you want to reload a previous configuration, please back one up first.

Apply

Click Apply to activate the stacking mode.

Cancel

Click C a nc e l to clear the Active check box.

Force Master Mode

Select the Fo rc e Ma ste r Mo de check box to force this Switch to become a master Switch.

System Priority

Enter a number (from1 to 63) to assign a priority for the stacking Switch. The higher the number, the higher the priority.

Apply

Click Apply to save the Ac tive Fo rc e Ma ste r Mo de and Syste m Prio rity fields.

Cancel

Click C a nc e l to clear the Ac tive Fo rc e Ma ste r Mo de and Syste m Prio rity fields.

Slot ID Freeze

Click the Fre e ze button to have the Switch retain its slot ID after reboot.

Slot

This field displays the slot or port channel of the stacked Switch.

MAC Address

This field displays the MAC address of the stacked Switch.

Type

This field displays the model name of the Switch.

Slot ID After Reboot

Choose Auto to have a new slot ID assigned after reboot. If you want to keep the original slot ID after reboot, you can click Fre e ze or select an ID in the Slo t ID Afte r Re b o o t list box.

Apply

Click Apply to save the Slo t ID Afte r Re b o o t field.

Cancel

Click C a nc e l to clear the Slo t ID Afte r Re b o o t field.

XS3800-28 User's Guide
128

Chapter 8 Basic Setting
8.12 C lo ud Ma na g e m e nt
The Zyxel Nebula Control Center (NCC) is a cloud-based network management system that allows you to remotely manage and monitor Zyxel Nebula APs, Ethernet switches and security gateways. The Switch is managed and provisioned automatically by the NCC (Nebula Control Center) when: · It is connected to the Internet. · The Ne bula C o ntro l C e nte r Disc o ve ry feature is enabled. · It has been registered in the NCC. This screen displays links to Ne bula C o ntro l C e nte r Disc o ve ry where you can have the Switch search for the NCC (Nebula Control Center) and to Ne b ula Switc h Re g istra tio n which has a QR code containing the Switch's serial number and MAC address for handy registration of the Switch at NCC. Click Ba sic Se tting > C lo ud Ma na g e m e nt in the navigation panel to display this screen. Fig ure 94 Basic Setting > Cloud Management
8.12.1 Ne b ula C e nte r C o ntro l Disc o ve ry
Click Ba sic Se tting > C lo ud Ma na g e m e nt > Ne b ula C o ntro l C e nte r Disc o ve ry to display this screen. Fig ure 95 Basic Setting > Cloud Management > Nebula Control Center Discovery
Select Ac tive to turn on NCC discovery on the Switch. If the Switch has Internet access and has been registered in the NCC, it will go into cloud management mode. In cloud management mode, then NCC will first check if the firmware on the Switch needs to be upgraded. If it does, the Switch will upgrade the firmware immediately. If the firmware does not need to be upgraded, but there is newer firmware available for the Switch, then it will be upgraded according to the firmware upgrade schedule for the Switch on the NCC. Below is the process for upgrading firmware: 1 Download firmware via the NCC. 2 Upgrade the firmware and reboot. Note: While the Switch is rebooting, do NOT turn off the power.
XS3800-28 User's Guide
129

Chapter 8 Basic Setting Clear Ac tive to turn off NCC discovery on the Switch. The Switch will NOT discover the NCC and remain in standalone mode.
8.12.2 Ne b ula Switc h Re g istra tio n
Click Ba sic Se tting > C lo ud Ma na g e m e nt > Ne b ula Switc h Re g istra tio n to display this screen. Fig ure 96 Basic Setting > Cloud Management > Nebula Switch Registration
This screen has a QR code containing the Switch's serial number and MAC address for handy NCC registration of the Switch using the Nebula Mobile app. First, download the app from the Google Play store for Android devices or the App Store for iOS devices and create an organization and site.
XS3800-28 User's Guide
130

C HA PTER 9 V LA N
9.1 O ve rvie w
This chapter shows you how to configure 802.1Q tagged and port-based VLANs.
The type of screen you see here depends on the VLAN Type you selected in the Switc h Se tup screen which is only available in standalone mode. The Switch does not support port-based VLANs in stacking mode.
9.1.1 Wha t Yo u C a n Do
· Use the VLAN screen (Section 9.3 on page 134) to view and search all static VLAN groups. · Use the VLAN De ta il screen (Section 9.3.1 on page 135) to view detailed port settings and status of the
static VLAN group. · Use the Priva te VLAN Sta tus screen (Section 9.4 on page 137) to view all private VLANs created on the
Switch. · Use the Sta tic VLAN Se tup screen (Section 9.6 on page 138) to configure a static VLAN for the Switch. · Use the VLAN Po rt Se tup screen (Section 9.7 on page 141) to configure the static VLAN (IEEE 802.1Q)
settings on a port. · Use the Sub ne t Ba se d VLAN Se tup screen (Section 9.8 on page 143) to set up VLANs that allow you to
group traffic into logical VLANs based on the source IP subnet you specify. · Use the Pro to c o l Ba se d VLAN Se tup screen (Section 9.9 on page 146) to set up VLANs that allow you
to group traffic into logical VLANs based on the protocol you specify. · Use the Vo ic e VLAN Se tup screen (Section 9.10 on page 149) to set up VLANs that allow you to group
voice traffic with defined priority and enable the Switch port to carry the voice traffic separately from data traffic to ensure the sound quality does NOT deteriorate. · Use the MAC Ba se d VLAN Se tup screen (Section 9.11 on page 151) to set up VLANs that allow you to group untagged packets into logical VLANs based on the source MAC address of the packet. This eliminates the need to reconfigure the Switch when you change ports. The Switch will forward the packets based on the source MAC address you set up previously. · Use the Ve ndo r ID Ba se d VLAN Se tup screen (Section 9.12 on page 152) to set up VLANs that allow you to group untagged packets into logical VLANs based on the source MAC address of the packet. You can specify a mask for the MAC address to create a MAC address filter and enter a weight to set the VLAN rule's priority.
9.1.2 Wha t Yo u Ne e d to Kno w
Read this section to know more about VLAN and how to configure the screens.
XS3800-28 User's Guide
131

Chapter 9 VLAN

9.2 Intro duc tio n to IEEE 802.1Q Ta g g e d VLANs

A tagged VLAN uses an explicit tag (VLAN ID) in the MAC header to identify the VLAN membership of a frame across bridges they are not confined to the switch on which they were created. The VLANs can be created statically by hand or dynamically through GVRP. The VLAN ID associates a frame with a specific VLAN and provides the information that switches need to process the frame across the network. A tagged frame is 4 bytes longer than an untagged frame and contains 2 bytes of TPID (Tag Protocol Identifier, residing within the type or length field of the Ethernet frame) and 2 bytes of TCI (Tag Control Information, starts after the source address field of the Ethernet frame).
The CFI (Canonical Format Indicator) is a single-bit flag, always set to zero for Ethernet switches. If a frame received at an Ethernet port has a CFI set to 1, then that frame should not be forwarded as it is to an untagged port. The remaining twelve bits define the VLAN ID, giving a possible maximum number of 4096 VLANs. Note that user priority and VLAN ID are independent of each other. A frame with VID (VLAN Identifier) of null (0) is called a priority frame, meaning that only the priority level is significant and the default VID of the ingress port is given as the VID of the frame. Of the 4096 possible VIDs, a VID of 0 is used to identify priority frames and value 4095 (FFF) is reserved, so the maximum possible VLAN configurations are 4094.

TPID 2 Bytes

User Priority 3 Bits

CFI VLAN ID 1 Bit 12 bits

Fo rwa rding Ta g g e d a nd Unta g g e d Fra m e s
Each port on the Switch is capable of passing tagged or untagged frames. To forward a frame from an 802.1Q VLAN-aware switch to an 802.1Q VLAN-unaware switch, the Switch first decides where to forward the frame and then strips off the VLAN tag. To forward a frame from an 802.1Q VLAN-unaware switch to an 802.1Q VLAN-aware switch, the Switch first decides where to forward the frame, and then inserts a VLAN tag reflecting the ingress port's default VID. The default PVID is VLAN 1 for all ports, but this can be changed.
A broadcast frame (or a multicast frame for a multicast group that is known by the system) is duplicated only on ports that are members of the VID (except the ingress port itself), thus confining the broadcast to a specific domain.
9.2.0.1 Auto m a tic VLAN Re g istra tio n
GARP and GVRP are the protocols used to automatically register VLAN membership across switches.
G ARP
GARP (Generic Attribute Registration Protocol) allows network switches to register and de-register attribute values with other GARP participants within a bridged LAN. GARP is a protocol that provides a generic mechanism for protocols that serve a more specific application, for example, GVRP.
G ARP Tim e rs
Switches join VLANs by making a declaration. A declaration is made by issuing a Join message using GARP. Declarations are withdrawn by issuing a Leave message. A Leave All message terminates all registrations. GARP timers set declaration timeout values.

XS3800-28 User's Guide
132

Chapter 9 VLAN

G VRP
GVRP (GARP VLAN Registration Protocol) is a registration protocol that defines a way for switches to register necessary VLAN members on ports across the network. Enable this function to permit VLAN groups beyond the local Switch.

Please refer to the following table for common IEEE 802.1Q VLAN terminology.

Table 43 IEEE 802.1Q VLAN Terminology

VLAN PARAMETER TERM

VLAN Type

Permanent VLAN

DESC RIPTIO N This is a static VLAN created manually.

VLAN Administrative Control
VLAN Tag Control
VLAN Port

Dynamic VLAN
Registration Fixed Registration Forbidden Normal Registration Tagged
Untagged
Port VID
Acceptable Frame Type
Ingress filtering

This is a VLAN configured by a GVRP registration or de-registration process.
Fixed registration ports are permanent VLAN members.
Ports with registration forbidden are forbidden to join the specified VLAN.
Ports dynamically join a VLAN using GVRP.
Ports belonging to the specified VLAN tag all outgoing frames transmitted.
Ports belonging to the specified VLAN do not tag all outgoing frames transmitted.
This is the VLAN ID assigned to untagged frames that this port received.
You may choose to accept both tagged and untagged incoming frames, just tagged incoming frames or just untagged incoming frames on a port.
If set, the Switch discards incoming frames for VLANs that do not have this port as a member.

9.2.0.2 Po rt VLAN Trunking
Enable VLAN Trunking on a port to allow frames belonging to unknown VLAN groups to pass through that port. This is useful if you want to set up VLAN groups on end devices without having to configure the same VLAN groups on intermediary devices.
Refer to the following figure. Suppose you want to create VLAN groups 1 and 2 (V1 and V2) on devices A and B. Without VLAN Trunking , you must configure VLAN groups 1 and 2 on all intermediary switches C, D and E; otherwise they will drop frames with unknown VLAN group tags. However, with VLAN Trunking enabled on ports in each intermediary switch you only need to create VLAN groups in the end devices (A and B). C, D and E automatically allow frames with VLAN group tags 1 and 2 (VLAN groups that are unknown to those switches) to pass through their VLAN trunking ports.
Fig ure 97 Port VLAN Trunking

XS3800-28 User's Guide
133

Chapter 9 VLAN
9.2.0.3 Se le c t the VLAN Type
Select a VLAN type in the Ba sic Se tting > Switc h Se tup screen. VLAN Type is not applicable in stacking mode. Fig ure 98 Basic Setting > Switch Setup > Select VLAN Type
802.1Q Sta tic VLAN
Make sure 802.1Q is selected in the Ba sic Se tting > Switc h Se tup screen. Use a static VLAN to decide whether an incoming frame on a port should be · sent to a VLAN group as normal depending on its VLAN tag. · sent to a group whether it has a VLAN tag or not. · blocked from a VLAN group regardless of its VLAN tag. You can also tag all outgoing frames (that were previously untagged) from a port with the specified VID.
9.3 VLAN Sta tus
Use this screen to view and search all static VLAN groups. Click Adva nc e d Applic a tio n > VLAN from the navigation panel to display the VLAN Sta tus screen as shown next.
XS3800-28 User's Guide
134

Chapter 9 VLAN Fig ure 99 Advanced Application > VLAN: VLAN Status

The following table describes the labels in this screen.

Table 44 Advanced Application > VLAN: VLAN Status

LA BEL
VLAN Search by VID

DESC RIPTIO N
Enter (an) existing VLAN ID numbers (use a comma (,) to separate individual VLANs or a dash () to indicate a range of VLANs. For example, "3,4" or "39") and click Se a rc h to display only the specified VLANs in the list below.

The Number of VLAN The Number of Search Results
Index VID
Name

Leave this field blank and click Se a rc h to display all VLANs configured on the Switch. This is the number of VLANs configured on the Switch.
This is the number of VLANs that match the searching criteria and display in the list below. This field displays only when you use the Se a rc h button to look for certain VLANs. This is the VLAN index number. Click an index number to view more VLAN details. This is the VLAN identification number that was configured in the corresponding VLAN configuration screen. This fields shows the descriptive name of the VLAN.

Tagged Port

This field shows the tagged ports that are participating in the VLAN.

Untagged Port This field shows the untagged ports that are participating in the VLAN.

Elapsed Time Status
Change Pages

This field shows how long it has been since a normal VLAN was registered or a static VLAN was set up.
This field shows how this VLAN was added to the Switch.
· Dyna m ic using GVRP · Sta tic manually added as a normal VLAN · Priva te manually added as a private VLAN (primary, isolated or community) · RMirro r manually added as a remote port mirroring VLAN · MVR added via Multicast VLAN Registration (MVR)
Click Pre vio us or Ne xt to show the previous or next screen if all status information cannot be seen in one screen.

9.3.1 VLAN De ta ils
Use this screen to view detailed port settings and status of the static VLAN group. Click an index number in the VLAN Sta tus screen to display VLAN details.

XS3800-28 User's Guide
135

Chapter 9 VLAN Fig ure 100 Advanced Application > VLAN > VLAN Detail (Standalone Mode)
Fig ure 101 Advanced Application > VLAN > VLAN Detail (Stacking Mode)

The following table describes the labels in this screen.

Table 45 Advanced Application > VLAN > VLAN Detail

LA BEL

DESC RIPTIO N

VLAN Status

Click this to go to the VLAN Sta tus screen.

VID Slot Port Number Elapsed Time Status
Private VLAN Status
Primary VLAN Secondary VLAN Type

This is the VLAN identification number that was configured in the corresponding VLAN configuration screen. `Slot' refers to a Switch in the `virtual chassis' stack. This field displays the slot ID of the stacked Switch. This column displays the ports that are participating in a VLAN. A tagged port is marked as T, an untagged port is marked as U and ports not participating in a VLAN are marked as "". This field shows how long it has been since a normal VLAN was registered or a static VLAN was set up. This field shows how this VLAN was added to the Switch.
· Dyna m ic using GVRP · Sta tic manually added as a normal VLAN · Priva te manually added as a private VLAN (primary, isolated or community) · RMirro r manually added as a remote port mirroring VLAN · MVR added via Multicast VLAN Registration (MVR) These fields show private VLAN information for the selected VLAN.
This field shows the primary VLAN ID in the selected VLAN.
This field shows the secondary VLAN ID in the selected VLAN.
This field shows the type of private VLAN: Prim a ry, C o m m unity or Iso la te d.

XS3800-28 User's Guide
136

Chapter 9 VLAN

Table 45 Advanced Application > VLAN > VLAN Detail (continued)

LA BEL

DESC RIPTIO N

Port List

This shows the ports mapped to the private VLAN using the Adva nc e d Applic a tio n > Priva te VLAN or Adva nc e d Applic a tio n > VLAN > Sta tic VLAN screen.

Change Pages

Click Pre vio us or Ne xt to show the previous or next screen if all status information cannot be seen in one screen.

9.4 Priva te VLAN Sta tus
Use this screen to view all private VLANs created on the Switch. Click Adva nc e d Applic a tio n > VLAN > Priva te VLAN Sta tus to see the following screen.
Fig ure 102 Advanced Application > VLAN > Private VLAN Status

The following table describes the labels in this screen.

Table 46 Advanced Application > VLAN > Private VLAN Status

LA BEL

DESC RIPTIO N

Private VLAN Status

These fields show information for the all private VLANs. See also Adva nc e d Applic a tio n > Priva te VLA N.

Primary VLAN

This field shows the primary VLAN ID in a private VLAN.

Secondary This field shows the secondary VLAN ID in a private VLAN. VLAN

Type

This field shows the type of private VLAN: Prim a ry, C o m m unity or Iso la te d.

Port List

This shows the ports mapped to the private VLAN using the Adva nc e d Applic a tio n > Priva te VLAN or Adva nc e d Applic a tio n > VLAN > Sta tic VLAN screen.

Change Pages Use the Pre vio us and Ne xt buttons to display different pages.

9.5 VLAN C o nfig ura tio n
Use this screen to view IEEE 802.1Q VLAN parameters for the Switch. Click Adva nc e d Applic a tio n > VLAN > VLAN C o nfig ura tio n to see the following screen.

XS3800-28 User's Guide
137

Chapter 9 VLAN Fig ure 103 Advanced Application > VLAN > VLAN Configuration

The following table describes the labels in the above screen.

Table 47 Advanced Application > VLAN > VLAN Configuration

LA BEL

DESC RIPTIO N

Static VLAN Setup

Click C lic k He re to configure the Static VLAN for the Switch.

VLAN Port Setup

Click C lic k He re to configure the VLAN Port for the Switch.

Subnet Based VLAN Setup Click C lic k He re to configure the Subnet Based VLAN for the Switch.

Protocol Based VLAN Setup Click C lic k He re to configure the Protocol Based VLAN for the Switch.

Voice VLAN Setup

Click C lic k He re to configure the Voice VLAN for the Switch.

MAC Based VLAN Setup

Click C lic k He re to configure the MAC Based VLAN for the Switch.

Vendor ID Based VLAN Setup

Click C lic k He re to configure the Vendor ID Based VLAN for the Switch.

9.6 C o nfig ure a Sta tic VLAN
Use this screen to configure a static VLAN for the Switch. Click the Sta tic VLAN Se tup link in the VLAN C o nfig ura tio n screen to display the screen as shown next.

XS3800-28 User's Guide
138

Chapter 9 VLAN Fig ure 104 Advanced Application > VLAN > VLAN Configuration > Static VLAN Setup (Standalone
Mode)
XS3800-28 User's Guide
139

Chapter 9 VLAN Fig ure 105 Advanced Application > VLAN > VLAN Configuration > Static VLAN Setup (Stacking Mode)

The following table describes the related labels in this screen.

Table 48 Advanced Application > VLAN > VLAN Configuration > Static VLAN Setup

LA BEL

DESC RIPTIO N

ACTIVE

Select this check box to activate the VLAN settings.

Name

Enter a descriptive name for the VLAN group for identification purposes. This name consists of up to 64 printable characters. Spaces are allowed.

VLAN Group ID Enter the VLAN ID for this static entry; the valid range is between 1 and 4094.

VLAN Type Association VLAN List
SLOT

Note: Do NOT add a VLAN ID that has been used in the Vo ic e VLAN Se tup.
Select No rm a l (static) or Priva te . For Priva te VLANs, select Prim a ry, Iso la te d or C o m m unity.
Prim a ry private VLANs can associate with several (secondary) C o m m unity private VLANs and up to one (secondary) Iso la te d private VLAN.
You only configure VLAN Asso c ia tio n List for Prim a ry private VLANs. Use a dash to associate consecutive VLANs and a comma (no spaces) to associate non-consecutive VLANs. For example, 5153 includes 51, 52 and 53, but 51,53 does not include 52.
Secondary private VLANs can only be associated with one primary private VLAN.
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

XS3800-28 User's Guide
140

Chapter 9 VLAN

Table 48 Advanced Application > VLAN > VLAN Configuration > Static VLAN Setup (continued)

LA BEL Port
*

DESC RIPTIO N
The port number identifies the port you are configuring. In stacking mode, the first number represents the slot ID and the second one is the port number. Please note that the default stacking ports (the last four ports of your Switch) cannot be configured. They are reserved for stacking only.
Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Control
Tagging Add
Cancel Clear VID Active Name VLAN Type Association VLAN List
Delete Cancel

Note: Changes in this row are copied to all the ports as soon as you make them.
Select No rm a l for the port to dynamically join this VLAN group using GVRP. This is the default selection.
Select Fixe d for the port to be a permanent member of this VLAN group.
Select Fo rb idde n if you want to prohibit the port from joining this VLAN group. Select TX Ta g g ing if you want the port to tag all outgoing frames transmitted with this VLAN Group ID. Click this to create a new entry or to update an existing one.
This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Click C a nc e l to begin configuring this screen afresh. Click C le a r to start configuring the screen again. This field displays the ID number of the VLAN group. Click the number to edit the VLAN settings. This field indicates whether the VLAN settings are enabled (Ye s) or disabled (No ). This field displays the descriptive name for this VLAN group. This field displays the No rm a l or Priva te (Prim a ry, Iso la te d or C o m m unity) type VLAN configured in the top part of this screen. This field displays which secondary private VLANs are associated with a primary private VLAN configured in the top part of this screen. Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries. Click De le te to remove the selected entry from the summary table. Click C a nc e l to clear the check boxes.

9.7 C o nfig ure VLAN Po rt Se tting s
Use this screen to configure the static VLAN (IEEE 802.1Q) settings on a port. Click the VLAN Po rt Se tup link in the VLAN C o nfig ura tio n screen.

XS3800-28 User's Guide
141

Chapter 9 VLAN Fig ure 106 Advanced Application > VLAN > VLAN Configuration > VLAN Port Setup (Standalone Mode)
Fig ure 107 Advanced Application > VLAN > VLAN Configuration > VLAN Port Setup (Stacking Mode)
XS3800-28 User's Guide
142

Chapter 9 VLAN

The following table describes the labels in this screen.

Table 49 Advanced Application > VLAN > VLAN Configuration > VLAN Port Setup

LA BEL GVRP

DESC RIPTIO N
GVRP (GARP VLAN Registration Protocol) is a registration protocol that defines a way for switches to register necessary VLAN members on ports across the network.

SLOT Port *

Select this check box to permit VLAN groups beyond the local Switch.
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.
This field displays the port number of the Switch. In stacking mode, the first number represents the slot ID and the second is the port number. Please note that the default stacking ports (the last four ports of your Switch) cannot be configured. They are reserved for stacking only.
Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Ingress Check
PVID
GVRP Acceptable Frame Type

Note: Changes in this row are copied to all the ports as soon as you make them.
If this check box is selected, the Switch discards incoming frames on a port for VLANs that do not include this port in its member set.
Clear this check box to disable ingress filtering. A PVID (Port VLAN ID) is a tag that adds to incoming untagged frames received on a port so that the frames are forwarded to the VLAN group that the tag defines.
Enter a number between 1and 4094 as the port VLAN ID. Select this check box to allow GVRP on this port. Specify the type of frames allowed on a port. Choices are All, Ta g O nly and Unta g O nly.
Select All from the drop-down list box to accept all untagged or tagged frames on this port. This is the default setting.
Select Ta g O nly to accept only tagged frames on this port. All untagged frames will be dropped.
Select Unta g O nly to accept only untagged frames on this port. All tagged frames will be dropped.

VLAN Trunking Isolation Apply Cancel

Note: When the Switch is in stacking mode and the master Switch has VLAN1, all other ports will be configured to untagged port.
Enable VLAN Trunking on ports connected to other switches or routers (but not ports directly connected to end users) to allow frames belonging to unknown VLAN groups to pass through the Switch.
Select this to allows this port to communicate only with the CPU management port and the ports on which the isolation feature is NOT enabled.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

9.8 Sub ne t Ba se d VLANs
Subnet based VLANs allow you to group traffic into logical VLANs based on the source IP subnet you specify. When a frame is received on a port, the Switch checks if a tag is added already and the IP
XS3800-28 User's Guide
143

Chapter 9 VLAN subnet it came from. The untagged packets from the same IP subnet are then placed in the same subnet based VLAN. One advantage of using subnet based VLANs is that priority can be assigned to traffic from the same IP subnet. Note: Subnet based VLAN applies to un-tagged packets and is applicable only when you use
IEEE 802.1Q tagged VLAN. For example, an ISP (Internet Services Provider) may divide different types of services it provides to customers into different IP subnets. Traffic for voice services is designated for IP subnet 172.16.1.0/24, video for 192.168.1.0/24 and data for 10.1.1.0/24. The Switch can then be configured to group incoming traffic based on the source IP subnet of incoming frames. You configure a subnet based VLAN with priority 6 and VID of 100 for traffic received from IP subnet 172.16.1.0/24 (voice services). You also have a subnet based VLAN with priority 5 and VID of 200 for traffic received from IP subnet 192.168.1.0/24 (video services). Lastly, you configure VLAN with priority 3 and VID of 300 for traffic received from IP subnet 10.1.1.0/24 (data services). All untagged incoming frames will be classified based on their source IP subnet and prioritized accordingly. That is video services receive the highest priority and data the lowest. Fig ure 108 Subnet Based VLAN Application Example
XS3800-28 User's Guide
144

Chapter 9 VLAN Fig ure 109 Advanced Application > VLAN > VLAN Configuration > Subnet Based VLAN Setup

The following table describes the labels in this screen.

Table 50 Advanced Application > VLAN > VLAN Configuration > Subnet Based VLAN Setup

LA BEL

DESC RIPTIO N

Active
DHCP-Vlan Override

Check this box to activate this subnet based VLANs on the Switch.
When DHCP snooping is enabled DHCP clients can renew their IP address through the DHCP VLAN or via another DHCP server on the subnet based VLAN.

Apply
Active Name IP Mask-Bits
VID
Priority Add

Select this check box to force the DHCP clients in this IP subnet to obtain their IP addresses through the DHCP VLAN.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Check this box to activate the IP subnet VLAN you are creating or editing.
Enter up to 32 alpha numeric characters to identify this subnet based VLAN.
Enter the IP address of the subnet for which you want to configure this subnet based VLAN.
Enter the bit number of the subnet mask. To find the bit number, convert the subnet mask to binary format and add all the 1's together. Take "255.255.255.0" for example. 255 converts to eight 1s in binary. There are three 255s, so add three eights together and you get the bit number (24).
Enter the ID of a VLAN with which the untagged frames from the IP subnet specified in this subnet based VLAN are tagged. This must be an existing VLAN which you defined in the Adva nc e d Applic a tio n > VLAN > Sta tic VLAN screen.
Select the priority level that the Switch assigns to frames belonging to this VLAN.
Click this to create a new entry or to update an existing one.

Cancel Index

XS3800-28 User's Guide
145

Chapter 9 VLAN

Table 50 Advanced Application > VLAN > VLAN Configuration > Subnet Based VLAN Setup (continued)

LA BEL

DESC RIPTIO N

Active

This field shows whether the subnet based VLAN is active or not.

Name

This field shows the name the subnet based VLAN.

This field shows the IP address of the subnet for this subnet based VLAN.

Mask-Bits

This field shows the subnet mask in bit number format for this subnet based VLAN.

VID

This field shows the VLAN ID of the frames which belong to this subnet based VLAN.

Priority

This field shows the priority which is assigned to frames belonging to this subnet based VLAN.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Click this to delete the subnet based VLANs which you marked for deletion.

Cancel

Click C a nc e l to clear the check boxes.

9.9 Pro to c o l Ba se d VLANs
Protocol based VLANs allow you to group traffic into logical VLANs based on the protocol you specify. When an upstream frame is received on a port (configured for a protocol based VLAN), the Switch checks if a tag is added already and its protocol. The untagged packets of the same protocol are then placed in the same protocol based VLAN. One advantage of using protocol based VLANs is that priority can be assigned to traffic of the same protocol.
Note: Protocol-based VLAN applies to un-tagged packets and is applicable only when you use IEEE 802.1Q tagged VLAN.
For example, port 1, 2, 3 and 4 belong to static VLAN 100, and port 4, 5, 6, 7 belong to static VLAN 120. You configure a protocol based VLAN A with priority 3 for ARP traffic received on port 1, 2 and 3. You also have a protocol based VLAN B with priority 2 for Apple Talk traffic received on port 6 and 7. All upstream ARP traffic from port 1, 2 and 3 will be grouped together, and all upstream Apple Talk traffic from port 6 and 7 will be in another group and have higher priority than ARP traffic, when they go through the uplink port to a backbone switch C.
Fig ure 110 Protocol Based VLAN Application Example

9.9.1 C o nfig uring Pro to c o l Ba se d VLAN
Click the Pro to c o l Ba se d VLAN Se tup link in the VLAN C o nfig ura tio n screen to display the configuration screen as shown.
XS3800-28 User's Guide
146

Chapter 9 VLAN Fig ure 111 Advanced Application > VLAN > VLAN Configuration > Protocol Based VLAN Setup
(Standalone Mode)
Fig ure 112 Advanced Application > VLAN > VLAN Configuration > Protocol Based VLAN Setup (Stacking Mode)

The following table describes the labels in this screen.

Table 51 Advanced Application > VLAN > VLAN Configuration > Protocol Based VLAN Setup

LA BEL

DESC RIPTIO N

Active

Check this box to activate this protocol based VLAN.

Port

Type a port number to be included in this protocol based VLAN. In stacking mode, the first

box field is the slot ID and the second field is the port number.

Name Ethernet-type

This port must belong to a static VLAN in order to participate in a protocol based VLAN.
Enter up to 32 alpha numeric characters to identify this protocol based VLAN.
Use the drop down list box to select a predefined protocol to be included in this protocol based VLAN or select O the rs and type the protocol number in hexadecimal notation. For example the IP protocol in hexadecimal notation is 0800, and Novell IPX protocol is 8137.

Note: Protocols in the hexadecimal number range of 0x0000 to 0x05ff are not allowed to be used for protocol based VLANs.

VID

Enter the ID of a VLAN to which the port belongs. This must be an existing VLAN which you

defined in the Adva nc e d Applic a tio n > VLAN > Sta tic VLAN screen.

XS3800-28 User's Guide
147

Chapter 9 VLAN

Table 51 Advanced Application > VLAN > VLAN Configuration > Protocol Based VLAN Setup

LA BEL

DESC RIPTIO N

Priority

Select the priority level that the Switch will assign to frames belonging to this VLAN.

Add

Click this to create a new entry or to update an existing one.

Cancel Index
Active Port
Name Ethernet-type VID Priority
Delete Cancel

This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.
This is the index number identifying this protocol based VLAN. Click any of these numbers to edit an existing protocol based VLAN.
This field shows whether the protocol based VLAN is active or not.
This field shows which port belongs to this protocol based VLAN. In stacking mode, the first number represents the slot ID and the second is the port number.
This field shows the name of the protocol based VLAN.
This field shows which Ethernet protocol is part of this protocol based VLAN.
This field shows the VLAN ID of the port.
This field shows the priority which is assigned to frames belonging to this protocol based VLAN.
Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.
Click this to delete the protocol based VLANs which you marked for deletion.
Click C a nc e l to clear the check boxes.

9.9.1.1 C re a te a n IP- b a se d VLAN Exa m ple
This example shows you how to create an IP VLAN which includes ports 1, 4 and 8. Follow these steps using the screen below:

1 Activate this protocol based VLAN. 2 Type the port number you want to include in this protocol based VLAN. Type 1. 3 Give this protocol-based VLAN a descriptive name. Type IP- VLAN. 4 Select the protocol. Leave the default value IP. 5 Type the VLAN ID of an existing VLAN. In our example we already created a static VLAN with an ID of 5.
Type 5.
6 Leave the priority set to 0 and click Add.

XS3800-28 User's Guide
148

Chapter 9 VLAN Fig ure 113 Protocol Based VLAN Configuration Example
EXAMPLE
To add more ports to this protocol based VLAN. 1 Click the index number of the protocol based VLAN entry. Click 1. 2 Change the value in the Po rt field to the next port you want to add. 3 Click Add.
9.10 Vo ic e VLAN
Voice VLAN is a VLAN that is specifically allocated for voice traffic. It ensures that the sound quality of an IP phone is preserved from deteriorating when the data traffic on the Switch ports is high. It groups the voice traffic with defined priority into an assigned VLAN which enables the separation of voice and data traffic coming onto the Switch port. The Switch can determine whether a received packet is · an untagged voice packet when the incoming port is a fixed port for voice VLAN. · a tagged voice packet when the incoming port and VLAN tag belongs to a voice VLAN. It then checks the source packet's MAC address against an OUI list. If a match is found, the packet is considered as a voice packet. You can set priority level to the Voice VLAN and add MAC address of IP phones from specific manufacturers by using its ID from the Organizationally Unique Identifiers (OUI). Click the Vo ic e VLAN Se tup link in the VLAN C o nfig ura tio n screen to display the configuration screen as shown.
XS3800-28 User's Guide
149

Chapter 9 VLAN Fig ure 114 Advanced Application > VLAN > VLAN Configuration > Voice VLAN Setup

The following table describes the fields in the above screen.

Table 52 Advanced Application > VLAN > VLAN Configuration > Voice VLAN Setup

LA BEL

DESC RIPTIO N

Voice VLAN Global Setup

Voice VLAN

Click the second radio button if you want to enable the Voice VLAN feature. Type a VLAN ID number in the box next to the radio button that is associated with the Voice VLAN. You also need to create a static VLAN with the same VID in the Sta tic VLAN Se tup screen, and then connect the IP phone with the specified OUI MAC address to a port that joins the static VLAN.

Priority
Apply
Cancel Clear Voice VLAN OUI Setup OUI address
OUI mask

Click Disa b le radio button if you do not want to enable the Voice VLAN feature. Select the priority level of the voice traffic from 0 to 7. Default setting is 5. The higher the numeric value you assign, the higher the priority for this voice traffic. Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Click C a nc e l to begin configuring this section afresh. Click C le a r to reset the fields to default settings.
Enter the IP phone manufacturer's OUI MAC address. The first 3 byes is the manufacturer identifier, the last 3 bytes is a unique station ID. Enter the mask for the specified IP phone manufacturer's OUI MAC address to determine which bits a packet's MAC address should match.

Description Add

XS3800-28 User's Guide
150

Chapter 9 VLAN

Table 52 Advanced Application > VLAN > VLAN Configuration > Voice VLAN Setup (continued)

LA BEL

DESC RIPTIO N

Cancel

Click C a nc e l to begin configuring this section afresh.

Index

This field displays the index number of the Voice VLAN.

OUI address

This field displays the OUI address of the Voice VLAN.

OUI mask

This field displays the OUI mask address of the Voice VLAN.

Description

This field displays the description of the Voice VLAN with OUI address.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Click De le te to remove the selected entry from the summary table.

Cancel

Click C a nc e l to clear the check boxes.

9.11 MAC Ba se d VLAN
The MAC-based VLAN feature assigns incoming untagged packets to a VLAN and classifies the traffic based on the source MAC address of the packet. When untagged packets arrive at the Switch, the source MAC address of the packet is looked up in a MAC to VLAN mapping table. If an entry is found, the corresponding VLAN ID is assigned to the packet. The assigned VLAN ID is verified against the VLAN table. If the VLAN is valid, ingress processing on the packet continues; otherwise, the packet is dropped.
This feature allows users to change ports without having to reconfigure the VLAN. You can assign priority to the MAC-based VLAN and define a MAC to VLAN mapping table by entering a specified source MAC address in the MAC-based VLAN setup screen. You can also delete a MAC-based VLAN entry in the same screen.
Click the MAC Ba se d VLAN Se tup link in the VLAN C o nfig ura tio n screen to see the following screen.
Fig ure 115 Advanced Application > VLAN > VLAN Configuration > MAC Based VLAN Setup

XS3800-28 User's Guide
151

Chapter 9 VLAN

The following table describes the fields in the above screen.

Table 53 Advanced Application > VLAN > VLAN Configuration > MAC Based VLAN Setup

LA BEL

DESC RIPTIO N

Name

Type a name up to 32 alpha numeric characters for the MAC-based VLAN entry.

MAC Address

Type a MAC address that is bind to the MAC-based VLAN entry. This is the source MAC address of the data packet that is looked up when untagged packets arrive at the Switch.

VID

Type an ID (from 1 to 4094) for the VLAN that is associated with the MAC-based VLAN entry.

Priority

Type a priority (0 to 7) that the Switch assigns to frames belonging to this VLAN. The higher the numeric value you assign, the higher the priority for this MAC-based VLAN entry.

Add

Click Add to save the new MAC-based VLAN entry.

Cancel

Click C a nc e l to clear the fields in the MAC-based VLAN entry.

Index

This field displays the index number of the MAC-based VLAN entry.

Name

This field displays the name of the MAC-based VLAN entry.

MAC Address

This field displays the source MAC address that is bind to the MAC-based VLAN entry.

VID

This field displays the VLAN ID of the MAC-based VLAN entry.

Priority

This field displays the priority level which is assigned to frames belonging to this MAC-based VLAN entity.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Click De le te to remove the selected entry from the summary table.

Cancel

Click C a nc e l to clear the check boxes.

9.12 Ve ndo r ID Ba se d VLAN
The Vendor ID based VLAN feature assigns incoming untagged packets to a VLAN and classifies the traffic based on the source MAC address of the packet. When untagged packets arrive at the switch, the source MAC address of the packet is looked up in a Vendor ID to VLAN mapping table. If an entry is found, the corresponding VLAN ID is assigned to the packet. The assigned VLAN ID is verified against the VLAN table. If the VLAN is valid, ingress processing on the packet continues; otherwise, the packet is dropped.
This feature allows users to change ports without having to reconfigure the VLAN. You can assign a 802.1p priority to the vendor ID based VLAN and define a vendor ID to VLAN mapping table by entering a specified source MAC address and mask in the vendor ID based VLAN setup screen. You can also delete a vendor ID based VLAN entry in the same screen.
For every vendor ID based VLAN rule you set, you can specify a weight number to define the rule's priority level. As rules are processed one after the other, stating a priority order will let you choose which rule has to be applied first and which second.
Click the Ve ndo r ID Ba se d VLAN Se tup link in the VLAN C o nfig ura tio n screen to see the following screen.

XS3800-28 User's Guide
152

Chapter 9 VLAN Fig ure 116 Advanced Application > VLAN > VLAN Configuration > Vendor ID Based VLAN Setup

The following table describes the fields in the above screen.

Table 54 Advanced Application > VLAN > VLAN Configuration > Vendor ID Based VLAN Setup

LA BEL

DESC RIPTIO N

Name MAC Address
Mask

Type a name up to 32 alpha numeric characters for the vendor ID based VLAN entry.
Type a MAC address that is bind to the vendor ID-based VLAN entry. This is the source MAC address of the data packet that is looked up when untagged packets arrive at the Switch.
Type the mask for the specified source MAC address to determine which bits a packet's MAC address should match.

VLAN
Priority
Weight
Add Cancel Index Name MAC Address Mask
VLAN Priority
Weight

Enter "f" for each bit of the specified MAC address that the traffic's MAC address should match. Enter "0" for the bits of the matched traffic's MAC address, which can be of any hexadecimal characters. For example, if you set the MAC address to 00:13:49:00:00:00 and the mask to ff:ff:ff:00:00:00, a packet with a MAC address of 00:13:49:12:34:56 matches this criteria.
Type an ID (from 1 to 4094) for the VLAN that is associated with the vendor ID based VLAN entry.
Select the priority level that the Switch assigns to frames belonging to this VLAN. The higher the numeric value you assign, the higher the priority for this vendor ID based VLAN entry.
Enter a number between 0 and 255 to specify the rule's weight. This is to decide the priority in which the rule is applied. The higher the number, the higher the rule's priority.
Click Add to save the new vendor ID based VLAN entry.
Click C a nc e l to clear the fields in the vendor ID based VLAN entry.
This field displays the index number of the vendor ID based VLAN entry.
This field displays the name of the vendor ID based VLAN entry.
This field displays the source MAC address that is bind to the vendor ID based VLAN entry.
This field displays the mask for the source MAC address that is bind to the vendor ID based VLAN entry.
This field displays the VLAN ID of the vendor ID based VLAN entry.
This field displays the priority level which is assigned to frames belonging to this vendor ID based VLAN.
This field displays the weight of the vendor ID based VLAN entry.

XS3800-28 User's Guide
153

Chapter 9 VLAN

Table 54 Advanced Application > VLAN > VLAN Configuration > Vendor ID Based VLAN Setup

LA BEL

DESC RIPTIO N

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Click De le te to remove the selected entry from the summary table.

Cancel

Click C a nc e l to clear the check boxes.

9.13 Po rt- Ba se d VLAN Se tup
Port-based VLANs are VLANs where the packet forwarding decision is based on the destination MAC address and its associated port.
Port-based VLANs require allowed outgoing ports to be defined for each port. Therefore, if you wish to allow two subscriber ports to talk to each other, for example, between conference rooms in a hotel, you must define the egress (an egress port is an outgoing port, that is, a port through which a data packet leaves) for both ports.
Port-based VLANs are specific only to the Switch on which they were created.
Note: When you activate port-based VLAN, the Switch uses a default VLAN ID of 1. You cannot change it.
Note: In screens (such as IP Se tup and Filte ring ) that require a VID, you must enter 1 as the VID.
The port-based VLAN setup screen is shown next. The C PU management port forms a VLAN with all Ethernet ports.
9.13.1 C o nfig ure a Po rt- Ba se d VLAN
Select Po rt Ba se d as the VLAN Type in the Ba sic Se tting > Switc h Se tup screen and then click Adva nc e d Applic a tio n > VLAN from the navigation panel to display the next screen.
Select either All C o nne c te d or Po rt Iso la te d from the drop-down list depending on your VLAN and VLAN security requirements. If VLAN members need to communicate directly with each other, then select All C o nne c te d. Select Po rt Iso la te d if you want to restrict users from communicating directly. Click Apply to save your settings.
The following screen shows users on a port-based, all-connected VLAN configuration.

XS3800-28 User's Guide
154

Chapter 9 VLAN Fig ure 117 Advanced Application > VLAN > Port Based VLAN Setup (All Connected)
The following screen shows users on a port-based, port-isolated VLAN configuration.
XS3800-28 User's Guide
155

Chapter 9 VLAN Fig ure 118 Advanced Application > VLAN: Port Based VLAN Setup (Port Isolation)

The following table describes the labels in this screen.

Table 55 Advanced Application > VLAN: Port Based VLAN Setup

LA BEL

DESC RIPTIO N

Setting Wizard Choose All c o nne c te d or Po rt iso la tio n.

All c o nne c te d means all ports can communicate with each other, that is, there are no virtual LANs. All incoming and outgoing ports are selected. This option is the most flexible but also the least secure.

Po rt iso la tio n means that each port can only communicate with the CPU management port and cannot communicate with each other. All incoming ports are selected while only the CPU outgoing port is selected. This option is the most limiting but also the most secure.

Incoming Outgoing

After you make your selection, click Apply (top right of screen) to display the screens as mentioned above. You can still customize these settings by adding or deleting incoming or outgoing ports, but you must also click Apply at the bottom of the screen.
These are the ingress ports; an ingress port is an incoming port, that is, a port through which a data packet enters. If you wish to allow two subscriber ports to talk to each other, you must define the ingress port for both ports. The numbers in the top row denote the incoming port for the corresponding port listed on the left (its outgoing port). C PU refers to the Switch management port. By default it forms a VLAN with all Ethernet ports. If it does not form a VLAN with a particular port then the Switch cannot be managed from that port.
These are the egress ports; an egress port is an outgoing port, that is, a port through which a data packet leaves. If you wish to allow two subscriber ports to talk to each other, you must define the egress port for both ports. C PU refers to the Switch management port. By default it forms a VLAN with all Ethernet ports. If it does not form a VLAN with a particular port then the Switch cannot be managed from that port.

XS3800-28 User's Guide
156

Chapter 9 VLAN

Table 55 Advanced Application > VLAN: Port Based VLAN Setup (continued)

LA BEL

DESC RIPTIO N

Apply

Cancel

Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
157

C HA PTER 1 0 Sta tic MAC Fo rwa rding
10.1 O ve rvie w
This chapter discusses how to configure forwarding rules based on MAC addresses of devices on your network. Use these screens to configure static MAC address forwarding.
10.1.1 Wha t Yo u C a n Do
Use the Sta tic MAC Fo rwa rding screen (Section 10.2 on page 158) to assign static MAC addresses for a port.
10.2 C o nfig ure Sta tic MAC Fo rwa rding
A static MAC address is an address that has been manually entered in the MAC address table. Static MAC addresses do not age out. When you set up static MAC address rules, you are setting static MAC addresses for a port. This may reduce the need for broadcasting. Click Adva nc e d Applic a tio n > Sta tic MAC Fo rwa rding in the navigation panel to display the configuration screen as shown. Fig ure 119 Advanced Application > Static MAC Forwarding (Standalone Mode)
XS3800-28 User's Guide
158

Chapter 10 Static MAC Forwarding Fig ure 120 Advanced Application > Static MAC Forwarding (Stacking Mode)

The following table describes the labels in this screen.

Table 56 Advanced Application > Static MAC Forwarding

LA BEL

DESC RIPTIO N

Active

Select this check box to activate your rule. You may temporarily deactivate a rule without deleting it by clearing this check box.

Name

Enter a descriptive name for identification purposes for this static MAC address forwarding rule.

MAC Address Enter the MAC address in valid MAC address format, that is, six hexadecimal character pairs.

VID Port
Add
Cancel Clear Index Active Name MAC Address VID Port

Note: Static MAC addresses do NOT age out.
Enter the VLAN identification number.
Enter the port where the MAC address entered in the previous field will be automatically forwarded. In stacking mode, the first box field is the slot ID and the second field is the port number.
Click this to create a new entry or to update an existing one.
This saves your rule to the Switch's run-time memory. The Switch loses this rule if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the nonvolatile memory when you are done configuring.
Click C a nc e l to reset the fields to their last saved values.
Click C le a r to begin configuring this screen afresh.
Click an index number to modify a static MAC address rule for a port.
This field displays whether this static MAC address forwarding rule is active (Ye s) or not (No ). You may temporarily deactivate a rule without deleting it.
This field displays the descriptive name for identification purposes for this static MAC addressforwarding rule.
This field displays the MAC address that will be forwarded and the VLAN identification number to which the MAC address belongs.
This field displays the ID number of the VLAN group.
This field displays the port where the MAC address shown in the next field will be forwarded.
In stacking mode, the first number represents the slot ID and the second is the port number.
Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

XS3800-28 User's Guide
159

Chapter 10 Static MAC Forwarding

Table 56 Advanced Application > Static MAC Forwarding (continued)

LA BEL

DESC RIPTIO N

Delete

Click De le te to remove the selected entry from the summary table.

Cancel

Click C a nc e l to clear the check boxes.

XS3800-28 User's Guide
160

Chapter 11 Static Multicast Forwarding
C HA PTER 1 1 Sta tic Multic a st Fo rwa rding
11.1 O ve rvie w
This chapter discusses how to configure forwarding rules based on multicast MAC addresses of devices on your network. Use these screens to configure static multicast address forwarding.
11.1.1 Wha t Yo u C a n Do
Use the Sta tic Multic a st Fo rwa rding screen (Section 11.2 on page 162) to configure rules to forward specific multicast frames, such as streaming or control frames, to specific ports.
11.1.2 Wha t Yo u Ne e d To Kno w
A multicast MAC address is the MAC address of a member of a multicast group. A static multicast address is a multicast MAC address that has been manually entered in the multicast table. Static multicast addresses do not age out. Static multicast forwarding allows you (the administrator) to forward multicast frames to a member without the member having to join the group first. If a multicast group has no members, then the switch will either flood the multicast frames to all ports or drop them. Figure 121 on page 161 shows such unknown multicast frames flooded to all ports. With static multicast forwarding, you can forward these multicasts to ports within a VLAN group. Figure 122 on page 162 shows frames being forwarded to devices connected to port 3. Figure 123 on page 162 shows frames being forwarded to ports 2 and 3 within VLAN group 4. Fig ure 121 No Static Multicast Forwarding
XS3800-28 User's Guide
161

Chapter 11 Static Multicast Forwarding Fig ure 122 Static Multicast Forwarding to a Single Port
Fig ure 123 Static Multicast Forwarding to Multiple Ports
11.2 C o nfig ure Sta tic Multic a st Fo rwa rding
Use this screen to configure rules to forward specific multicast frames, such as streaming or control frames, to specific ports. Click Adva nc e d Applic a tio n > Sta tic Multic a st Fo rwa rding to display the configuration screen as shown.
XS3800-28 User's Guide
162

Chapter 11 Static Multicast Forwarding Fig ure 124 Advanced Application > Static Multicast Forwarding

The following table describes the labels in this screen.

Table 57 Advanced Application > Static Multicast Forwarding

LA BEL Active Name MAC Address
VID
Port

DESC RIPTIO N
Select this check box to activate your rule. You may temporarily deactivate a rule without deleting it by clearing this check box.
Type a descriptive name (up to 32 printable ASCII characters) for this static multicast MAC address forwarding rule. This is for identification only.
Enter a multicast MAC address which identifies the multicast group. The last binary bit of the first octet pair in a multicast MAC address must be 1. For example, the first octet pair 00000001 is 01 and 00000011 is 03 in hexadecimal, so 01:00:5e:00:00:0A and 03:00:5e:00:00:27 are valid multicast MAC addresses.
You can forward frames with matching destination MAC address to ports within a VLAN group. Enter the ID that identifies the VLAN group here. If you do NOT have a specific target VLAN, enter 1.
Enter the ports where frames with destination MAC address that matched the entry above are forwarded. You can enter multiple ports separated by (no space) comma (,) or hyphen () for a range. For example, enter "35" for ports 3, 4, and 5. Enter "3,5,7" for ports 3, 5, and 7.

Add

In stacking mode, the first number represents the slot ID and the second is the port number. Enter 1/1-1/24,2/23 for ports 1 to 24 for the Switch in slot 1 and port 23 for the Switch in slot 2, for example.
Click this to create a new entry or to update an existing one.

Cancel Clear Index Active
Name
MAC Address

This saves your rule to the Switch's run-time memory. The Switch loses this rule if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the nonvolatile memory when you are done configuring.
Click C a nc e l to reset the fields to their last saved values.
Click C le a r to begin configuring this screen afresh.
Click an index number to modify a static multicast MAC address rule for ports.
This field displays whether a static multicast MAC address forwarding rule is active (Ye s) or not (No ). You may temporarily deactivate a rule without deleting it.
This field displays the descriptive name for identification purposes for a static multicast MAC address-forwarding rule.
This field displays the multicast MAC address that identifies a multicast group.

XS3800-28 User's Guide
163

Chapter 11 Static Multicast Forwarding

Table 57 Advanced Application > Static Multicast Forwarding (continued)

LA BEL

DESC RIPTIO N

VID

This field displays the ID number of a VLAN group to which frames containing the specified

multicast MAC address will be forwarded.

Port

This field displays the ports within an identified VLAN group to which frames containing the

specified multicast MAC address will be forwarded.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Click De le te to remove the selected entry from the summary table.

Cancel

Click C a nc e l to clear the check boxes.

XS3800-28 User's Guide
164

Chapter 12 Filtering
C HA PTER 1 2 Filte ring
12.1 Filte ring O ve rvie w
This chapter discusses MAC address port filtering. Filtering means sifting traffic going through the Switch based on the source and/or destination MAC addresses and VLAN group (ID).
12.1.1 Wha t Yo u C a n Do
Use the Filte ring screen (Section 12.2 on page 165) to create rules for traffic going through the Switch.
12.2 C o nfig ure a Filte ring Rule
Use this screen to create rules for traffic going through the Switch. Click Adva nc e d Applic a tio n > Filte ring in the navigation panel to display the screen as shown next. Fig ure 125 Advanced Application > Filtering
XS3800-28 User's Guide
165

Chapter 12 Filtering

The following table describes the related labels in this screen.

Table 58 Advanced Application > Filtering

LA BEL

DESC RIPTIO N

Active

Make sure to select this check box to activate your rule. You may temporarily deactivate a rule without deleting it by de-selecting this check box.

Name

Type a descriptive name (up to 32 printable ASCII characters) for this rule. This is for identification only.

Action

Select Disc a rd so urc e to drop the frames from the source MAC address (specified in the MAC field). The Switch can still send frames to the MAC address.

Select Disc a rd de stina tio n to drop the frames to the destination MAC address (specified in the MAC address). The Switch can still receive frames originating from the MAC address.

MAC VID Add

Select Disc a rd so urc e and Disc a rd de stina tio n to block traffic to or from the MAC address specified in the MAC field. Type a MAC address in valid MAC address format, that is, six hexadecimal character pairs. Type the VLAN group identification number. Click this to create a new entry or to update an existing one.

Cancel

Click C a nc e l to reset the fields to your previous configuration.

Clear

Click C le a r to clear the fields to the factory defaults.

Index

This field displays the index number of the rule. Click an index number to change the settings.

Active

This field displays Ye s when the rule is activated and No when is it deactivated.

Name

This field displays the descriptive name for this rule. This is for identification purpose only.

MAC Address This field displays the source or destination MAC address with the VLAN identification number to which the MAC address belongs.

VID

This field displays the VLAN group identification number.

Action

This field displays Disc a rd so urc e , Disc a rd de stina tio n, or Disc a rd b o th depending on what you configured above.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Check the rules that you want to remove and then click the De le te button.

Cancel

Click C a nc e l to clear the selected check boxes.

XS3800-28 User's Guide
166

Chapter 13 Spanning Tree Protocol
C HA PTER 1 3 Spa nning Tre e Pro to c o l
13.1 Spa nning Tre e Pro to c o l O ve rvie w
The Switch supports Spanning Tree Protocol (STP), Rapid Spanning Tree Protocol (RSTP) and Multiple Spanning Tree Protocol (MSTP) as defined in the following standards. · IEEE 802.1D Spanning Tree Protocol · IEEE 802.1w Rapid Spanning Tree Protocol · IEEE 802.1s Multiple Spanning Tree Protocol The Switch also allows you to set up multiple STP configurations (or trees). Ports can then be assigned to the trees.
13.1.1 Wha t Yo u C a n Do
· Use the Spa nning Tre e Pro to c o l Sta tus screen (Section 13.2 on page 170) to view the STP status in the different STP modes (RSTP, MRSTP or MSTP) you can configure on the Switch.
· Use the Spa nning Tre e C o nfig ura tio n screen (Section 13.3 on page 170) to activate one of the STP modes on the Switch.
· Use the Ra pid Spa nning Tre e Pro to c o l Sta tus screen (Section 13.4 on page 171) to view the RSTP status. · Use the Ra pid Spa nning Tre e Pro to c o l screen (Section 13.5 on page 173) to configure RSTP settings. · Use the Multiple Spa nning Tre e Pro to c o l screen (Section 13.6 on page 175) to configure MSTP. · Use the Multiple Spa nning Tre e Pro to c o l Sta tus screen (Section 13.7 on page 181) to view the MSTP
status. · Use the Multiple Ra pid Spa nning Tre e Pro to c o l screen (Section 13.8 on page 185) to configure MRSTP. · Use the Multiple Ra pid Spa nning Tre e Pro to c o l Sta tus screen (Section 13.9 on page 187) to view the
MRSTP status.
13.1.2 Wha t Yo u Ne e d to Kno w
Read on for concepts on STP that can help you configure the screens in this chapter.
(Ra pid) Spa nning Tre e Pro to c o l
(R)STP detects and breaks network loops and provides backup links between switches, bridges or routers. It allows a switch to interact with other (R)STP-compliant switches in your network to ensure that only one path exists between any two stations on the network. The Switch uses IEEE 802.1w RSTP (Rapid Spanning Tree Protocol) that allows faster convergence of the
XS3800-28 User's Guide
167

Chapter 13 Spanning Tree Protocol

spanning tree than STP (while also being backwards compatible with STP-only aware bridges). In RSTP, topology change information is directly propagated throughout the network from the device that generates the topology change. In STP, a longer delay is required as the device that causes a topology change first notifies the root bridge that then notifies the network. Both RSTP and STP flush unwanted learned addresses from the filtering database. In RSTP, the port states are Discarding, Learning, and Forwarding.
Note: In this user's guide, "STP" refers to both STP and RSTP.

STP Te rm ino lo g y

The root bridge is the base of the spanning tree.

Path cost is the cost of transmitting a frame onto a LAN through that port. The recommended cost is assigned according to the speed of the link to which a port is attached. The slower the media, the higher the cost.

Table 59 STP Path Costs
LINK SPEED Path Cost 4 Mbps Path Cost 10 Mbps Path Cost 16 Mbps Path Cost 100 Mbps Path Cost 1 Gbps Path Cost 10 Gbps

REC O MMENDED VALUE 250 100 62 19 4 2

REC O MMENDED RANG E 100 to 1000 50 to 600 40 to 400 10 to 60 3 to 10 1 to 5

ALLO WED RANG E 1 to 65535 1 to 65535 1 to 65535 1 to 65535 1 to 65535 1 to 65535

On each bridge, the root port is the port through which this bridge communicates with the root. It is the port on this switch with the lowest path cost to the root (the root path cost). If there is no root port, then this switch has been accepted as the root bridge of the spanning tree network.
For each LAN segment, a designated bridge is selected. This bridge has the lowest cost to the root among the bridges connected to the LAN.

Ho w STP Wo rks
After a bridge determines the lowest cost-spanning tree with STP, it enables the root port and the ports that are the designated ports for connected LANs, and disables all other ports that participate in STP. Network packets are therefore only forwarded between enabled ports, eliminating any possible network loops.
STP-aware switches exchange Bridge Protocol Data Units (BPDUs) periodically. When the bridged LAN topology changes, a new spanning tree is constructed.
Once a stable network topology has been established, all bridges listen for Hello BPDUs (Bridge Protocol Data Units) transmitted from the root bridge. If a bridge does not get a Hello BPDU after a predefined interval (Max Age), the bridge assumes that the link to the root bridge is down. This bridge then initiates negotiations with other bridges to reconfigure the network to re-establish a valid network topology.

STP Po rt Sta te s
STP assigns five port states to eliminate packet looping. A bridge port is not allowed to go directly from

XS3800-28 User's Guide
168

Chapter 13 Spanning Tree Protocol

blocking state to forwarding state so as to eliminate transient loops.

Table 60 STP Port States

PO RTSTATE DESC RIPTIO N

Disabled

STP is disabled (default).

Blocking

Only configuration and management BPDUs are received and processed.

Listening

All BPDUs are received and processed.

Learning Forwarding

Note: The listening state does NOT exist in RSTP.
All BPDUs are received and processed. Information frames are submitted to the learning process but not forwarded.
All BPDUs are received and processed. All information frames are received and forwarded.

Multiple RSTP
MRSTP (Multiple RSTP) is Zyxel's proprietary feature that is compatible with RSTP and STP. With MRSTP, you can have more than one spanning tree on your Switch and assign ports to each tree. Each spanning tree operates independently with its own bridge information.
In the following example, there are two RSTP instances (MRSTP 1 and MRSTP2) on switch A.
To set up MRSTP, activate MRSTP on the Switch and specify which ports belong to which spanning tree.
Note: Each port can belong to one STP tree only.
Fig ure 126 MRSTP Network Example

Multiple STP
Multiple Spanning Tree Protocol (IEEE 802.1s) is backward compatible with STP/RSTP and addresses the limitations of existing spanning tree protocols (STP and RSTP) in networks to include the following features:
· One Common and Internal Spanning Tree (CIST) that represents the entire network's connectivity. · Grouping of multiple bridges (or switching devices) into regions that appear as one single bridge on
the network. · A VLAN can be mapped to a specific Multiple Spanning Tree Instance (MSTI). MSTI allows multiple
VLANs to use the same spanning tree. · Load-balancing is possible as traffic from different VLANs can use distinct paths in a region.
XS3800-28 User's Guide
169

Chapter 13 Spanning Tree Protocol
13.2 Spa nning Tre e Pro to c o l Sta tus
The Spanning Tree Protocol status screen changes depending on what standard you choose to implement on your network. Click Adva nc e d Applic a tio n > Spa nning Tre e Pro to c o l to see the screen as shown. Fig ure 127 Advanced Application > Spanning Tree Protocol (Standalone mode)

13.3 Spa nning Tre e C o nfig ura tio n
Use the Spa nning Tre e C o nfig ura tio n screen to activate one of the STP modes on the Switch. Click C o nfig ura tio n in the Adva nc e d Applic a tio n > Spa nning Tre e Pro to c o l.
Fig ure 128 Advanced Application > Spanning Tree Protocol > Configuration

The following table describes the labels in this screen.

Table 61 Advanced Application > Spanning Tree Protocol > Configuration

LA BEL

DESC RIPTIO N

Spanning Tree Mode

You can activate one of the STP modes on the Switch. Select Ra pid Spa nning Tre e , Multiple Ra pid Spa nning Tre e or Multiple Spa nning Tre e .

Apply

Cancel

Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
170

Chapter 13 Spanning Tree Protocol
13.4 Ra pid Spa nning Tre e Pro to c o l Sta tus
The Spanning Tree Protocol status screen changes depending on what standard you choose to implement on your network. Click Adva nc e d Applic a tio n > Spa nning Tre e Pro to c o l in the navigation panel to display the status screen as shown next. See Section 13.1 on page 167 for more information on RSTP. Note: This screen is only available after you activate RSTP on the Switch. Fig ure 129 Advanced Application > Spanning Tree Protocol > Spanning Tree Protocol Status: RSTP
(Standalone Mode)
Fig ure 130 Advanced Application > Spanning Tree Protocol > Spanning Tree Protocol Status: RSTP (Stacking Mode)

The following table describes the labels in this screen.

Table 62 Advanced Application > Spanning Tree Protocol > Spanning Tree Protocol Status: RSTP

LA BEL

DESC RIPTIO N

Configuration

Click C o nfig ura tio n to specify which STP mode you want to activate. Click RSTP to edit RSTP settings on the Switch.

Bridge

Ro o t refers to the base of the spanning tree (the root bridge). O ur Bridg e is this Switch. This Switch may also be the root bridge.

Bridge ID

This is the unique identifier for this bridge, consisting of bridge priority plus MAC address. This ID is the same for Ro o t and O ur Bridg e if the Switch is the root switch.

Hello Time (second)

This is the time interval (in seconds) at which the root switch transmits a configuration message. The root bridge determines He llo Tim e , Ma x Ag e and Fo rwa rding De la y.

XS3800-28 User's Guide
171

Table 62 Advanced Application > Spanning Tree Protocol > Spanning Tree Protocol Status: RSTP

LA BEL

DESC RIPTIO N

Max Age (second) This is the maximum time (in seconds) the Switch can wait without receiving a configuration message before attempting to reconfigure.

Forwarding Delay This is the time (in seconds) the root switch will wait before changing states (that is, listening to

(second)

learning to forwarding).

Cost to Bridge Port ID
Topology Changed Times Time Since Last Change SLOT
Port
Port State

Note: The listening state does NOT exist in RSTP.
This is the path cost from the root port on this Switch to the root switch. This is the priority and number of the port on the Switch through which this Switch must communicate with the root of the Spanning Tree. This is the number of times the spanning tree has been reconfigured.
This is the time since the spanning tree was last reconfigured.
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack. This field displays the number of the port on the Switch. In stacking mode, the first number represents the slot ID and the second is the port number. This field displays the port state in STP.

Port Role

· Disc a rding The port does not forward or process received frames or learn MAC addresses, but still listens for BPDUs.
· Le a rning The port learns MAC addresses and processes BPDUs, but does NOT forward frames yet.
· Fo rwa rding The port is operating normally. It learns MAC addresses, processes BPDUs and forwards received frames.
This field displays the role of the port in STP.

Designated Bridge ID Designated Port ID Designated Cost
Root Guard State

· Ro o t A forwarding port on a non-root bridge, which has the lowest path cost and is the best port from the non-root bridge to the root bridge. A root bridge does NOT have a root port.
· De sig na te d A forwarding port on the designated bridge for each connected LAN segment. A designated bridge has the lowest path cost to the root bridge among the bridges connected to the LAN segment. All the ports on a root bridge (root switch) are designated ports.
· Alte rna te A blocked port, which has a best alternate path to the root bridge. This path is different from using the root port. The port moves to the forwarding state when the designated port for the LAN segment fails.
· Ba c kup A blocked port, which has a backup or redundant path to a LAN segment where a designated port is already connected when a switch has two links to the same LAN segment.
· Disa b le d Not strictly part of STP. The port can be disabled manually.
This field displays the identifier of the designated bridge to which this port belongs when the port is a designated port. Otherwise, it displays the identifier of the designated bridge for the LAN segment to which this port is connected.
This field displays the priority and number of the bridge port (on the designated bridge), through which the designated bridge transmits the stored configuration messages.
This field displays the path cost to the LAN segment to which the port is connected when the port is a designated port. Otherwise, it displays the path cost to the root bridge from the designated port for the LAN segment to which this port is connected.
This field displays the state of the port on which root guard is enabled.

· Ro o t- inc o nsiste nt the Switch receives superior BPDUs on the port and blocks the port. · Fo rwa rding the Switch unblocks and allows the port to forward frames again.

XS3800-28 User's Guide
172

Chapter 13 Spanning Tree Protocol
13.5 C o nfig ure Ra pid Spa nning Tre e Pro to c o l
Use this screen to configure RSTP settings, see Section 13.1 on page 167 for more information on RSTP. Click RSTP in the Adva nc e d Applic a tio n > Spa nning Tre e Pro to c o l screen. Fig ure 131 Advanced Application > Spanning Tree Protocol > RSTP (Standalone Mode)
XS3800-28 User's Guide
173

Fig ure 132 Advanced Application > Spanning Tree Protocol > RSTP (Stacking Mode)

The following table describes the labels in this screen.

Table 63 Advanced Application > Spanning Tree Protocol > RSTP

LA BEL Status Bridge Priority

DESC RIPTIO N
Click Sta tus to display the RSTP Sta tus screen.
Bridge priority is used in determining the root switch, root port and designated port. The Switch with the highest priority (lowest numeric value) becomes the STP root switch. If all Switches have the same priority, the Switch with the lowest MAC address will then become the root switch. Select a value from the drop-down list box.

The lower the numeric value you assign, the higher the priority for this bridge.

Hello Time Max Age
Forwarding Delay

Bridge Priority determines the root bridge, which in turn determines Hello Time, Max Age and Forwarding Delay.
This is the time interval in seconds between BPDU (Bridge Protocol Data Units) configuration message generations by the root switch. The allowed range is 1 to 10 seconds.
This is the maximum time (in seconds) the Switch can wait without receiving a BPDU before attempting to reconfigure. All Switch ports (except for designated ports) should receive BPDUs at regular intervals. Any port that ages out STP information (provided in the last BPDU) becomes the designated port for the attached LAN. If it is a root port, a new root port is selected from among the Switch ports attached to the network. The allowed range is 6 to 40 seconds.
This is the maximum time (in seconds) the Switch will wait before changing states. This delay is required because every Switch must receive information about topology changes before it starts to forward frames. In addition, each port needs time to listen for conflicting information that would make it return to a blocking state; otherwise, temporary data loops might result. The allowed range is 4 to 30 seconds.

As a general rule:

SLOT

2 * (Forward Delay 1) >= Max Age >= 2 * (Hello Time + 1)
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

XS3800-28 User's Guide
174

Chapter 13 Spanning Tree Protocol

Table 63 Advanced Application > Spanning Tree Protocol > RSTP (continued)

LA BEL

DESC RIPTIO N

Port

This field displays the port number. In stacking mode, the first number represents the slot ID and

the second is the port number. Please note that the default stacking ports (the last four ports

of your Switch) cannot be configured. They are reserved for stacking only.

Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Active Edge

Note: Changes in this row are copied to all the ports as soon as you make them.
Select this check box to activate RSTP on this port.
Select this check box to configure a port as an edge port when it is directly attached to a computer. An edge port changes its initial STP port state from blocking state to forwarding state immediately without going through listening and learning states right after the port is configured as an edge port or when its link status changes.

Root Guard
Priority Path Cost Apply Cancel

Note: An edge port becomes a non-edge port as soon as it receives a Bridge Protocol Data Unit (BPDU).
Select this check box to enable root guard on this port in order to prevent the switches attached to the port from becoming the root bridge.
With root guard enabled, a port is blocked when the Switch receives a superior BPDU on it. The Switch allows traffic to pass through this port again when the switch connected to the port stops to send superior BPDUs.
Configure the priority for each port here.
Priority decides which port should be disabled when more than one port forms a loop in a switch. Ports with a higher priority numeric value are disabled first. The allowed range is between 0 and 255 and the default value is 128.
Path cost is the cost of transmitting a frame on to a LAN through that port. It is recommended to assign this value according to the speed of the bridge. The slower the media, the higher the cost.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

13.6 C o nfig ure Multiple Spa nning Tre e Pro to c o l
To configure MSTP, click MSTP in the Adva nc e d Applic a tio n > Spa nning Tre e Pro to c o l screen.

XS3800-28 User's Guide
175

Chapter 13 Spanning Tree Protocol Fig ure 133 Advanced Application > Spanning Tree Protocol > MSTP (Standalone Mode)
XS3800-28 User's Guide
176

Chapter 13 Spanning Tree Protocol Fig ure 134 Advanced Application > Spanning Tree Protocol > MSTP (Stacking Mode)

The following table describes the labels in this screen.

Table 64 Advanced Application > Spanning Tree Protocol > MSTP

LA BEL

DESC RIPTIO N

Status

Click Sta tus to display the MSTP Sta tus screen.

Port

Click Po rt to display the MSTP Po rt screen.

Active

Select this check box to activate MSTP on the Switch. Clear this check box to disable MSTP on the Switch.

Hello Time

Note: You must also activate Multiple Spa nning Tre e in the Adva nc e d Applic a tio n > Spa nning Tre e Pro to c o l > C o nfig ura tio n screen to enable MSTP on the Switch.
This is the time interval in seconds between BPDU (Bridge Protocol Data Units) configuration message generations by the root switch. The allowed range is 1 to 10 seconds.

XS3800-28 User's Guide
177

Table 64 Advanced Application > Spanning Tree Protocol > MSTP (continued)

LA BEL

DESC RIPTIO N

MaxAge

This is the maximum time (in seconds) a switch can wait without receiving a BPDU before attempting to reconfigure. All switch ports (except for designated ports) should receive BPDUs at regular intervals. Any port that ages out STP information (provided in the last BPDU) becomes the designated port for the attached LAN. If it is a root port, a new root port is selected from among the Switch ports attached to the network. The allowed range is 6 to 40 seconds.

Forwarding Delay

This is the maximum time (in seconds) a switch will wait before changing states. This delay is required because every switch must receive information about topology changes before it starts to forward frames. In addition, each port needs time to listen for conflicting information that would make it return to a blocking state; otherwise, temporary data loops might result. The allowed range is 4 to 30 seconds. As a general rule:

Maximum hops Configuration Name Revision Number Apply Cancel Instance Instance Bridge Priority
VLAN Range
Enabled VLAN(s) SLOT Port *

Note: 2 * (Forward Delay 1) >= Max Age >= 2 * (Hello Time + 1)
Enter the number of hops (between 1 and 255) in an MSTP region before the BPDU is discarded and the port information is aged.
Enter a descriptive name (up to 32 characters) of an MST region.
Enter a number to identify a region's configuration. Devices must have the same revision number to belong to the same region.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.
Use this section to configure MSTI (Multiple Spanning Tree Instance) settings.
Enter the number you want to use to identify this MST instance on the Switch. The Switch supports instance numbers 0 15.
Set the priority of the Switch for the specific spanning tree instance. The lower the number, the more likely the Switch will be chosen as the root bridge within the spanning tree instance.
Enter priority values between 0 and 61440 in increments of 4096 (thus valid values are 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768, 36864, 40960, 45056, 49152, 53248, 57344 and 61440).
Enter the start of the VLAN ID range that you want to add or remove from the VLAN range edit area in the Sta rt field. Enter the end of the VLAN ID range that you want to add or remove from the VLAN range edit area in the End field.
Next click:
· Add to add this range of VLANs to be mapped to the MST instance. · Re m o ve to remove this range of VLANs from being mapped to the MST instance. · C le a r to remove all VLANs from being mapped to this MST instance.
This field displays which VLANs are mapped to this MST instance.
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.
This field displays the port number. In stacking mode, the first number represents the slot ID and the second is the port number. Please note that the default stacking ports (the last four ports of your Switch) cannot be configured. They are reserved for stacking only.
Settings in this row apply to all ports.
Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Active

Note: Changes in this row are copied to all the ports as soon as you make them.
Select this check box to add this port to the MST instance.

XS3800-28 User's Guide
178

Chapter 13 Spanning Tree Protocol

Table 64 Advanced Application > Spanning Tree Protocol > MSTP (continued)

LA BEL

DESC RIPTIO N

Priority

Configure the priority for each port here.

Path Cost Add

Priority decides which port should be disabled when more than one port forms a loop in the Switch. Ports with a higher priority numeric value are disabled first. The allowed range is between 0 and 255 and the default value is 128.
Path cost is the cost of transmitting a frame on to a LAN through that port. It is recommended to assign this value according to the speed of the bridge. The slower the media, the higher the cost.
Click this to create a new entry or to update an existing one.

Cancel Instance VLAN Active Port
Delete Cancel

This saves your changes to the Switch's run-time memory. The Switch loses this change if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.
This field displays the ID of an MST instance.
This field displays the VID (or VID ranges) to which the MST instance is mapped.
This field display the ports configured to participate in the MST instance.
Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.
Check the rules that you want to remove and then click the De le te button.
Click C a nc e l to clear the selected check boxes.

13.6.1 Multiple Spa nning Tre e Pro to c o l Po rt C o nfig ura tio n
Click Adva nc e d Applic a tio n > Spa nning Tre e Pro to c o l > MSTP > Po rt in the navigation panel to display the status screen as shown next.

XS3800-28 User's Guide
179

Fig ure 135 Advanced Application > Spanning Tree Protocol > MSTP > Port (Standalone Mode)

Fig ure 136 Advanced Application > Spanning Tree Protocol > MSTP > Port (Stacking Mode)

The following table describes the labels in this screen.

Table 65 Advanced Application > Spanning Tree Protocol > MSTP > Port

LA BEL

DESC RIPTIO N

MSTP

Click MSTP to edit MSTP settings on the Switch.

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

XS3800-28 User's Guide
180

Chapter 13 Spanning Tree Protocol

Table 65 Advanced Application > Spanning Tree Protocol > MSTP > Port (continued)

LA BEL

DESC RIPTIO N

Port

This field displays the port number. In stacking mode, the first number represents the slot ID

and the second is the port number. Please note that the default stacking ports (the last four

ports of your Switch) cannot be configured. They are reserved for stacking only.

Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Edge

Note: Changes in this row are copied to all the ports as soon as you make them.
Select this check box to configure a port as an edge port when it is directly attached to a computer. An edge port changes its initial STP port state from blocking state to forwarding state immediately without going through listening and learning states right after the port is configured as an edge port or when its link status changes.

Root Guard
Apply Cancel

13.7 Multiple Spa nning Tre e Pro to c o l Sta tus
Click Adva nc e d Applic a tio n > Spa nning Tre e Pro to c o l in the navigation panel to display the status screen as shown next.
Note: This screen is only available after you activate MSTP on the Switch.

XS3800-28 User's Guide
181

Chapter 13 Spanning Tree Protocol Fig ure 137 Advanced Application > Spanning Tree Protocol > Status: MSTP (Standalone Mode)
XS3800-28 User's Guide
182

Chapter 13 Spanning Tree Protocol Fig ure 138 Advanced Application > Spanning Tree Protocol > Status: MSTP (Stacking Mode)

The following table describes the labels in this screen.

Table 66 Advanced Application > Spanning Tree Protocol > Status: MSTP

LA BEL

DESC RIPTIO N

Configuration

Click C o nfig ura tio n to specify which STP mode you want to activate. Click MSTP to edit MSTP settings on the Switch.

CST

This section describes the Common Spanning Tree settings.

Bridge

Ro o t refers to the base of the spanning tree (the root bridge). O ur Bridg e is this switch. This Switch may also be the root bridge.

Bridge ID

This is the unique identifier for this bridge, consisting of bridge priority plus MAC address. This ID is the same for Ro o t and O ur Bridg e if the Switch is the root switch.

Hello Time (second)

This is the time interval (in seconds) at which the root switch transmits a configuration message. The root bridge determines He llo Tim e , Ma x Ag e and Fo rwa rding De la y.

Max Age (second) This is the maximum time (in seconds) the Switch can wait without receiving a configuration message before attempting to reconfigure.

Forwarding Delay This is the time (in seconds) the root switch will wait before changing states (that is, listening to

(second)

learning to forwarding).

Cost to Bridge

This is the path cost from the root port on this Switch to the root switch.

Port ID

This is the priority and number of the port on the Switch through which this Switch must communicate with the root of the Spanning Tree.

Configuration Name

This field displays the configuration name for this MST region.

Revision Number This field displays the revision number for this MST region.

XS3800-28 User's Guide
183

Chapter 13 Spanning Tree Protocol

Table 66 Advanced Application > Spanning Tree Protocol > Status: MSTP (continued)

LA BEL

DESC RIPTIO N

Configuration Digest

A configuration digest is generated from the VLAN-MSTI mapping information.
This field displays the 16-octet signature that is included in an MSTP BPDU. This field displays the digest when MSTP is activated on the system.

Topology Changed Times

This is the number of times the spanning tree has been reconfigured.

Time Since Last Change

This is the time since the spanning tree was last reconfigured.

Instance

These fields display the MSTI to VLAN mapping. In other words, which VLANs run on each spanning tree instance.

Instance

This field displays the MSTI ID.

VLAN

This field displays which VLANs are mapped to an MSTI.

MSTI

Select the MST instance settings you want to view.

Bridge

Ro o t refers to the base of the MST instance. O ur Bridg e is this switch. This Switch may also be the root bridge.

Bridge ID

This is the unique identifier for this bridge, consisting of bridge priority plus MAC address. This ID is the same for Ro o t and O ur Bridg e if the Switch is the root switch.

Internal Cost

This is the path cost from the root port in this MST instance to the regional root switch.

Port ID

This is the priority and number of the port on the Switch through which this Switch must communicate with the root of the MST instance.

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This field displays the number of the port on the Switch. In stacking mode, the first number

represents the slot ID and the second is the port number.

Port State

This field displays the port state in STP.

Port Role

· Disc a rding The port does not forward or process received frames or learn MAC addresses, but still listens for BPDUs.
· Le a rning The port learns MAC addresses and processes BPDUs, but does not forward frames yet.
· Fo rwa rding The port is operating normally. It learns MAC addresses, processes BPDUs and forwards received frames.
This field displays the role of the port in STP.

Designated Bridge ID
Designated Port ID

· Ro o t A forwarding port on a non-root bridge, which has the lowest path cost and is the best port from the non-root bridge to the root bridge. A root bridge does not have a root port.
· De sig na te d A forwarding port on the designated bridge for each connected LAN segment. A designated bridge has the lowest path cost to the root bridge among the bridges connected to the LAN segment. All the ports on a root bridge (root switch) are designated ports.
· Alte rna te A blocked port, which has a best alternate path to the root bridge. This path is different from using the root port. The port moves to the forwarding state when the designated port for the LAN segment fails.
· Ba c kup A blocked port, which has a backup or redundant path to a LAN segment where a designated port is already connected when a switch has two links to the same LAN segment.
· Disa b le d Not strictly part of STP. The port can be disabled manually.
This field displays the identifier of the designated bridge to which this port belongs when the port is a designated port. Otherwise, it displays the identifier of the designated bridge for the LAN segment to which this port is connected.
This field displays the priority and number of the bridge port (on the designated bridge), through which the designated bridge transmits the stored configuration messages.

XS3800-28 User's Guide
184

Chapter 13 Spanning Tree Protocol

Table 66 Advanced Application > Spanning Tree Protocol > Status: MSTP (continued)

LA BEL

DESC RIPTIO N

Designated Cost

This field displays the path cost to the LAN segment to which the port is connected when the port is a designated port. Otherwise, it displays the path cost to the root bridge from the designated port for the LAN segment to which this port is connected.

Root Guard State This field displays the state of the port on which root guard is enabled.

· Ro o t- inc o nsiste nt the Switch receives superior BPDUs on the port and blocks the port. · Fo rwa rding the Switch unblocks and allows the port to forward frames again.

13.8 C o nfig ure Multiple Ra pid Spa nning Tre e Pro to c o l
To configure MRSTP, click MRSTP in the Adva nc e d Applic a tio n > Spa nning Tre e Pro to c o l screen. Fig ure 139 Advanced Application > Spanning Tree Protocol > MRSTP (Standalone Mode)

XS3800-28 User's Guide
185

Chapter 13 Spanning Tree Protocol Fig ure 140 Advanced Application > Spanning Tree Protocol > MRSTP (Stacking Mode)

The following table describes the labels in this screen.

Table 67 Advanced Application > Spanning Tree Protocol > MRSTP

LA BEL

DESC RIPTIO N

Status

Click Sta tus to display the MRSTP Sta tus screen.

Tree

This is a read only index number of the STP trees.

Active

Select this check box to activate an STP tree. Clear this check box to disable an STP tree.

Bridge Priority
Hello Time Max Age

Note: You must also activate Multiple Ra pid Spa nning Tre e in the Adva nc e d Applic a tio n > Spa nning Tre e Pro to c o l > C o nfig ura tio n screen to enable MRSTP on the Switch.
Bridge priority is used in determining the root switch, root port and designated port. The switch with the highest priority (lowest numeric value) becomes the STP root switch. If all switches have the same priority, the switch with the lowest MAC address will then become the root switch. Select a value from the drop-down list box.
The lower the numeric value you assign, the higher the priority for this bridge.
Bridge Priority determines the root bridge, which in turn determines He llo Tim e , Ma x Ag e and Fo rwa rding De la y.
This is the time interval in seconds between BPDU (Bridge Protocol Data Units) configuration message generations by the root switch. The allowed range is 1 to 10 seconds.
This is the maximum time (in seconds) the Switch can wait without receiving a BPDU before attempting to reconfigure. All Switch ports (except for designated ports) should receive BPDUs at regular intervals. Any port that ages out STP information (provided in the last BPDU) becomes the designated port for the attached LAN. If it is a root port, a new root port is selected from among the Switch ports attached to the network. The allowed range is 6 to 40 seconds.

XS3800-28 User's Guide
186

Chapter 13 Spanning Tree Protocol

Table 67 Advanced Application > Spanning Tree Protocol > MRSTP (continued)

LA BEL Forwarding Delay

DESC RIPTIO N
This is the maximum time (in seconds) the Switch will wait before changing states. This delay is required because every switch must receive information about topology changes before it starts to forward frames. In addition, each port needs time to listen for conflicting information that would make it return to a blocking state; otherwise, temporary data loops might result. The allowed range is 4 to 30 seconds.

As a general rule:

SLOT Port *

2 * (Forward Delay 1) >= Max Age >= 2 * (Hello Time + 1)
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.
This field displays the port number. In stacking mode, the first number represents the slot ID and the second is the port number. Please note that the default stacking ports (the last four ports of your Switch) cannot be configured. They are reserved for stacking only.
Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Active Edge

Note: Changes in this row are copied to all the ports as soon as you make them.
Select this check box to activate STP on this port.
Select this check box to configure a port as an edge port when it is directly attached to a computer. An edge port changes its initial STP port state from blocking state to forwarding state immediately without going through listening and learning states right after the port is configured as an edge port or when its link status changes.

Root Guard
Priority
Path Cost Tree Apply Cancel

Note: An edge port becomes a non-edge port as soon as it receives a Bridge Protocol Data Unit (BPDU).
Select this check box to enable root guard on this port in order to prevent the switch(es) attached to the port from becoming the root bridge.
With root guard enabled, a port is blocked when the Switch receives a superior BPDU on it. The Switch allows traffic to pass through this port again when the switch connected to the port stops to send superior BPDUs.
Configure the priority for each port here.
Priority decides which port should be disabled when more than one port forms a loop in a switch. Ports with a higher priority numeric value are disabled first. The allowed range is between 0 and 255 and the default value is 128.
Path cost is the cost of transmitting a frame on to a LAN through that port. It is recommended to assign this value according to the speed of the bridge. The slower the media, the higher the cost.
Select which STP tree configuration this port should participate in.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

13.9 Multiple Ra pid Spa nning Tre e Pro to c o l Sta tus
Click Adva nc e d Applic a tio n > Spa nning Tre e Pro to c o l in the navigation panel to display the status screen as shown next. See Section 13.9 on page 187 for more information on MRSTP.
XS3800-28 User's Guide
187

Chapter 13 Spanning Tree Protocol Note: This screen is only available after you activate MRSTP on the Switch. Fig ure 141 Advanced Application > Spanning Tree Protocol > Status: MRSTP (Standalone Mode)
Fig ure 142 Advanced Application > Spanning Tree Protocol > Status: MRSTP (Stacking Mode)

The following table describes the labels in this screen.

Table 68 Advanced Application > Spanning Tree Protocol > Status: MRSTP

LA BEL

DESC RIPTIO N

Configuration

Click C o nfig ura tio n to specify which STP mode you want to activate. Click MRSTP to edit MRSTP settings on the Switch.

Tree

Select which STP tree configuration you want to view.

Bridge

Ro o t refers to the base of the spanning tree (the root bridge). O ur Bridg e is this switch. This Switch may also be the root bridge.

Bridge ID

This is the unique identifier for this bridge, consisting of bridge priority plus MAC address. This ID is the same for Ro o t and O ur Bridg e if the Switch is the root switch.

Hello Time (second)

This is the time interval (in seconds) at which the root switch transmits a configuration message. The root bridge determines He llo Tim e , Ma x Ag e and Fo rwa rding De la y.

Max Age (second) This is the maximum time (in seconds) the Switch can wait without receiving a configuration message before attempting to reconfigure.

XS3800-28 User's Guide
188

Chapter 13 Spanning Tree Protocol

Table 68 Advanced Application > Spanning Tree Protocol > Status: MRSTP (continued)

LA BEL

DESC RIPTIO N

Forwarding Delay This is the time (in seconds) the root switch will wait before changing states (that is, listening to

(second)

learning to forwarding).

Cost to Bridge Port ID
Topology Changed Times Time Since Last Change SLOT
Port
Port State

Note: The listening state does not exist in RSTP.
This is the path cost from the root port on this Switch to the root switch. This is the priority and number of the port on the Switch through which this Switch must communicate with the root of the Spanning Tree. This is the number of times the spanning tree has been reconfigured.
This is the time since the spanning tree was last reconfigured.
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack. This field displays the number of the port on the Switch. In stacking mode, the first number represents the slot ID and the second is the port number. This field displays the port state in STP.

Port Role

· Disc a rding The port does not forward or process received frames or learn MAC addresses, but still listens for BPDUs.
· Le a rning The port learns MAC addresses and processes BPDUs, but does not forward frames yet.
· Fo rwa rding The port is operating normally. It learns MAC addresses, processes BPDUs and forwards received frames.
This field displays the role of the port in STP.

Designated Bridge ID Designated Port ID Designated Cost
Root Guard State

· Ro o t inconsistent the Switch receives superior BPDUs on the port and blocks the port. · Fo rwa rding the Switch unblocks and allows the port to forward frames again.

XS3800-28 User's Guide
189

Chapter 13 Spanning Tree Protocol
13.10 Te c hnic a l Re fe re nc e
This section provides technical background information on the topics discussed in this chapter.
13.10.1 MSTP Ne two rk Exa m ple
The following figure shows a network example where two VLANs are configured on the two switches. If the switches are using STP or RSTP, the link for VLAN 2 will be blocked as STP and RSTP allow only one link in the network and block the redundant link. Fig ure 143 STP/RSTP Network Example
With MSTP, VLANs 1 and 2 are mapped to different spanning trees in the network. Thus traffic from the two VLANs travel on different paths. The following figure shows the network example using MSTP. Fig ure 144 MSTP Network Example
13.10.2 MSTRe g io n
An MST region is a logical grouping of multiple network devices that appears as a single device to the rest of the network. Each MSTP-enabled device can only belong to one MST region. When BPDUs enter an MST region, external path cost (of paths outside this region) is increased by one. Internal path cost (of paths within this region) is increased by one when BPDUs traverse the region. Devices that belong to the same MST region are configured to have the same MSTP configuration identification settings. These include the following parameters: · Name of the MST region · Revision level as the unique number for the MST region
XS3800-28 User's Guide
190

Chapter 13 Spanning Tree Protocol · VLAN-to-MST Instance mapping
13.10.3 MSTInsta nc e
An MST Instance (MSTI) is a spanning tree instance. VLANs can be configured to run on a specific MSTI. Each created MSTI is identified by a unique number (known as an MST ID) known internally to a region. Thus an MSTI does not span across MST regions. The following figure shows an example where there are two MST regions. Regions 1 and 2 have two spanning tree instances. Fig ure 145 MSTIs in Different Regions
13.10.4 C o m m o n a nd Inte rna l Spa nning Tre e (C IST)
A CIST represents the connectivity of the entire network and it is equivalent to a spanning tree in an STP/ RSTP. The CIST is the default MST instance (MSTID 0). Any VLANs that are not members of an MST instance are members of the CIST. In an MSTP-enabled network, there is only one CIST that runs between MST regions and single spanning tree devices. A network may contain multiple MST regions and other network segments running RSTP.
XS3800-28 User's Guide
191

Chapter 13 Spanning Tree Protocol Fig ure 146 MSTP and Legacy RSTP Network Example
XS3800-28 User's Guide
192

C HA PTER 1 4 Ba ndwidth C o ntro l
14.1 Ba ndwidth C o ntro l O ve rvie w
This chapter shows you how you can cap the maximum bandwidth using the Ba ndwidth C o ntro l screen. Bandwidth control means defining a maximum allowable bandwidth for incoming and/or out-going traffic flows on a port.
14.1.1 Wha t Yo u C a n Do
Use the Ba ndwidth C o ntro l screen (Section 14.2 on page 193) to limit the bandwidth for traffic going through the Switch.
14.1.2 C IR a nd PIR
The Committed Information Rate (CIR) is the guaranteed bandwidth for the incoming traffic flow on a port. The Peak Information Rate (PIR) is the maximum bandwidth allowed for the incoming traffic flow on a port when there is no network congestion. The CIR and PIR should be set for all ports that use the same uplink bandwidth. If the CIR is reached, packets are sent at the rate up to the PIR. When network congestion occurs, packets through the ingress port exceeding the CIR will be marked for drop. Note: The CIR should be less than the PIR. Note: The sum of CIRs cannot be greater than or equal to the uplink bandwidth.
14.2 Ba ndwidth C o ntro l Se tup
Click Adva nc e d Applic a tio n > Ba ndwidth C o ntro l in the navigation panel to bring up the screen as shown next.
XS3800-28 User's Guide
193

Chapter 14 Bandwidth Control Fig ure 147 Advanced Application > Bandwidth Control (Standalone Mode)
Fig ure 148 Advanced Application > Bandwidth Control (Stacking Mode)

The following table describes the related labels in this screen.

Table 69 Advanced Application > Bandwidth Control

LA BEL

DESC RIPTIO N

Active

Select this check box to enable bandwidth control on the Switch.

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This field displays the port number. In stacking mode, the first number represents the slot ID and the

second is the port number. Please note that the default stacking ports (the last four ports of your

Switch) cannot be configured. They are reserved for stacking only.

XS3800-28 User's Guide
194

Chapter 14 Bandwidth Control

Table 69 Advanced Application > Bandwidth Control (continued)

LA BEL *

DESC RIPTIO N Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Note: Changes in this row are copied to all the ports as soon as you make them.

Ingress Rate

Active

Select this check box to activate commit rate limits on this port.

Commit Rate

Specify the guaranteed bandwidth allowed in kilobits per second (Kbps) for the incoming traffic flow on a port. The commit rate should be less than the peak rate. The sum of commit rates cannot be greater than or equal to the uplink bandwidth.

Active

Select this check box to activate peak rate limits on this port.

Peak Rate Specify the maximum bandwidth allowed in kilobits per second (Kbps) for the incoming traffic flow on a port.

Active

Select this check box to activate egress rate limits on this port.

Egress Rate

Specify the maximum bandwidth allowed in kilobits per second (Kbps) for the out-going traffic flow on a port.

Apply

Cancel

Click C a nc e l to reset the fields.

XS3800-28 User's Guide
195

Chapter 15 Broadcast Storm Control
C HA PTER 1 5 Bro a dc a st Sto rm C o ntro l
15.1 Bro a dc a st Sto rm C o ntro l O ve rvie w
This chapter introduces and shows you how to configure the broadcast storm control feature. Broadcast storm control limits the number of broadcast, multicast and destination lookup failure (DLF) packets the Switch receives per second on the ports. When the maximum number of allowable broadcast, multicast and/or DLF packets is reached per second, the subsequent packets are discarded. Enable this feature to reduce broadcast, multicast and/or DLF packets in your network. You can specify limits for each packet type on each port.
15.1.1 Wha t Yo u C a n Do
Use the Bro a dc a st Sto rm C o ntro l screen (Section 15.2 on page 196) to limit the number of broadcast, multicast and destination lookup failure (DLF) packets the Switch receives per second on the ports.
15.2 Bro a dc a st Sto rm C o ntro l Se tup
Click Adva nc e d Applic a tio n > Bro a dc a st Sto rm C o ntro l in the navigation panel to display the screen as shown next.
XS3800-28 User's Guide
196

Chapter 15 Broadcast Storm Control Fig ure 149 Advanced Application > Broadcast Storm Control (Standalone Mode)

Fig ure 150 Advanced Application > Broadcast Storm Control (Stacking Mode)

The following table describes the labels in this screen.

Table 70 Advanced Application > Broadcast Storm Control

LA BEL

DESC RIPTIO N

Active

Select this check box to enable traffic storm control on the Switch. Clear this check box to disable this feature.

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

XS3800-28 User's Guide
197

Chapter 15 Broadcast Storm Control

Table 70 Advanced Application > Broadcast Storm Control (continued)

LA BEL

DESC RIPTIO N

Port

This field displays the port number. In stacking mode, the first number represents the slot ID and

the second is the port number. Please note that the default stacking ports (the last four ports of

your Switch) cannot be configured. They are reserved for stacking only.

Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Note: Changes in this row are copied to all the ports as soon as you make them.
Broadcast (pkt/s) Select this option to enable and specify how many broadcast packets the Switch accepts per second on the port.

Multicast (pkt/s)

The Switch will generate a trap and/or log when the actual rate is higher than the specified threshold.
Select this option to enable and specify how many multicast packets the Switch accepts per second on the port.

DLF (pkt/s) Apply Cancel

The Switch will generate a trap and/or log when the actual rate is higher than the specified threshold.
Select this option and specify how many destination lookup failure (DLF) packets the port receives per second.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to reset the fields.

XS3800-28 User's Guide
198

Chapter 16 Mirroring
C HA PTER 1 6 Mirro ring
16.1 Mirro ring O ve rvie w
This chapter discusses port mirroring setup screens. Port mirroring allows you to copy a traffic flow to a monitor port (the port you copy the traffic to) in order that you can examine the traffic from the monitor port without interference.
16.1.1 Wha t Yo u Ne e d to Kno w
Read on for concepts on Mirroring that can help you configure the screens in this chapter. The Switch supports both local port mirroring and remote port mirroring. In local port mirroring, the mirroring ports (through which traffic you copy passes) and the monitor port are on the same device.
In remote port mirroring (RMirror), the mirroring ports and monitor port can be on different devices in a network. You can use it to monitor multiple switches across your network. The traffic from the source device's mirroring ports is sent to a reflector port for VLAN tagging and copied to the connected ports. Traffic are then carried over the specified remote port mirroring (RMirror) VLAN and sent to the destination device's monitor port through the connected ports that connect to other switches.
XS3800-28 User's Guide
199

Chapter 16 Mirroring
Sing le - De stina tio n RMirro r
If the mirrored traffic is forwarded to one single destination switch, you can disable the reflector port. The Switch adds RMirror VLAN tag and forwards mirrored traffic from the mirroring port to the connected port directly.
16.2 Lo c a l Po rt Mirro ring
Click Adva nc e d Applic a tio n > Mirro ring in the navigation panel to display the Mirro ring screen. Use this screen to select a monitor port and specify the traffic flow to be copied to the monitor port.
XS3800-28 User's Guide
200

Chapter 16 Mirroring Fig ure 151 Advanced Application > Mirroring (Standalone Mode)
XS3800-28 User's Guide
201

Chapter 16 Mirroring Fig ure 152 Advanced Application > Mirroring (Stacking Mode)

The following table describes the labels in this screen.

Table 71 Advanced Application > Mirroring

LA BEL Active
Monitor Port

DESC RIPTIO N
Select this check box to activate port mirroring on the Switch. Clear this check box to disable the feature.
The monitor port is the port you copy the traffic to in order to examine it in more detail without interfering with the traffic flow on the original ports. Type the port number of the monitor port.

SLOT Port *

In stacking mode, the first box field is the slot ID and the second field is the port number.
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.
This field displays the port number. In stacking mode, the first number represents the slot ID and the second is the port number. Please note that the default stacking ports (the last four ports of your Switch) cannot be configured. They are reserved for stacking only.
Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Mirrored Direction Apply
Cancel

XS3800-28 User's Guide
202

Chapter 16 Mirroring
16.2.1 Re m o te Po rt Mirro ring
Use this screen to create a remote port mirroring (RMirror) VLAN through which the mirrored traffic is forwarded. Note: Your Switch automatically creates a static VLAN (with the same VID) when you create
a RMirror VLAN in this screen. Click the RMirro r link in the Adva nc e d Applic a tio n > Mirro ring screen. The following screen opens. Fig ure 153 Advanced Application > Mirroring > RMirror

The following table describes the labels in this screen.

Table 72 Advanced Application > Mirroring > RMirror

LA BEL

DESC RIPTIO N

Active

Select the option to enable the VLAN.

RMirror VLAN ID Specify the ID number of remote port mirroring (RMirror) VLAN.

Apply

Cancel

Click C a nc e l to begin configuring this screen afresh.

VLAN

This field displays the ID number of the RMirror VLAN. Click on the VLAN ID number to change the settings.

Active

This field displays whether the VLAN is enabled or not.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Check the rules that you want to remove and then click the De le te button.

Cancel

Click C a nc e l to clear the selected check boxes.

16.2.2 So urc e
Use this screen to configure the reflector port and specify the traffic flow to be copied to the monitor port when the Switch is the source device in remote port mirroring.
Click the So urc e link in the RMirro r screen. The following screen opens.

XS3800-28 User's Guide
203

Chapter 16 Mirroring Fig ure 154 Advanced Application > Mirroring > RMirror > Source (Standalone Mode)
Fig ure 155 Advanced Application > Mirroring > RMirror > Source (Stacking Mode)
XS3800-28 User's Guide
204

Chapter 16 Mirroring

The following table describes the labels in this screen.

Table 73 Advanced Application > Mirroring > RMirror > Source

LA BEL RMirror VLAN ID Priority Reflector Port

DESC RIPTIO N Select the RMirror VLAN over which the mirrored traffic is forwarded. Enter the priority of the mirrored traffic. Select the check box to enable the specified reflector port.

Enter the number of reflector port that adds the RMirror VLAN tag to all mirrored traffic and forwards traffic to the connected ports in the same RMirror VLAN.

SLOT Port *

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Mirrored Direction
Apply
Cancel VLAN
Priority Mirror Port
Ingress Egress Both
Reflector Port

Note: Changes in this row are copied to all the ports as soon as you make them.
Select this option to mirror the traffic on a port. Specify the direction of the traffic to mirror by selecting from the drop-down list box. Choices are Eg re ss (outgoing), Ing re ss (incoming) and Bo th. Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Click C a nc e l to begin configuring this screen afresh. This field displays the ID number of RMirror VLAN over which the mirrored traffic is forwarded. This field displays the priority of the mirrored traffic.
This field displays the number of ports on which the incoming traffic is mirrored. This field displays the number of ports on which the outgoing traffic is mirrored. This field displays the number of ports on which the incoming and outgoing traffic is mirrored. This field displays whether the reflector port is enabled and the number of reflector port in this RMirror VLAN.

16.2.3 De stina tio n
Use this screen to specify the RMirror VLAN and configure the monitor port when the Switch is the destination device in remote port mirroring.
Click the De stina tio n link in the RMirro r screen. The following screen opens.

XS3800-28 User's Guide
205

Chapter 16 Mirroring Fig ure 156 Advanced Application > Mirroring > RMirror > Destination (Standalone Mode)
Fig ure 157 Advanced Application > Mirroring > RMirror > Destination (Stacking Mode)

The following table describes the labels in this screen.

Table 74 Advanced Application > Mirroring > RMirror > Destination

LA BEL

DESC RIPTIO N

RMirror VLAN ID Monitor Port

Select the RMirror VLAN over which the mirrored traffic is forwarded.
Specify the port to which you copy the traffic in order to examine it in more detail without interfering with the traffic flow on the original ports.

Tagging Apply
Cancel VLAN Monitor Port Tagging
Delete Cancel

In stacking mode, the first box field is the slot ID and the second field is the port number.
Select whether to add the RMirror VLAN tag to mirrored traffic on the monitor port.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.
This field displays the ID number of RMirror VLAN over which the mirrored traffic is forwarded.
This field displays the number of port that receives the mirrored traffic from the source device for analysis.
This field displays whether the mirrored traffic is tagged with the RMirror VLAN ID.
Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.
Check the rules that you want to remove in the De le te column and then click the De le te button.
Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
206

16.2.4 C o nne c te d Po rt
Use this screen to select the RMirror VLAN and specify the ports that helps forward mirrored traffic to other connected switches and/or receive mirrored traffic from other connected port in the same RMirror VLAN. Click the C o nne c te d Po rt link in the RMirro r screen. The following screen opens. Fig ure 158 Advanced Application > Mirroring > RMirror > Connected Port (Standalone Mode)
XS3800-28 User's Guide
207

Chapter 16 Mirroring Fig ure 159 Advanced Application > Mirroring > RMirror > Connected Port (Stacking Mode)

The following table describes the labels in this screen.

Table 75 Advanced Application > Mirroring > RMirror > Connected Port

LA BEL RMirror VLAN ID SLOT Port
*

DESC RIPTIO N
Select the RMirror VLAN over which the mirrored traffic is forwarded.
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.
This field displays the port number. In stacking mode, the first number represents the slot ID and the second is the port number. Please note that the default stacking ports (the last four ports of your Switch) cannot be configured. They are reserved for stacking only.
Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Connected Port
Apply Cancel

Note: Changes in this row are copied to all the ports as soon as you make them.
When the Switch is a source device in remote port mirroring, select this option to have the port help forward mirrored traffic to the connected port of the intermediate or destination device in the same RMirror VLAN.
When the Switch is an intermediate device in remote port mirroring, select this option to have the port receive mirrored traffic from the connected source or another intermediate device or forward mirrored traffic to the connected destination or another intermediate device in the same RMirror VLAN.
When the Switch is a destination device in remote port mirroring, select this option to have the port receive mirrored traffic from the connected source or intermediate device in the same RMirror VLAN.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
208

Table 75 Advanced Application > Mirroring > RMirror > Connected Port (continued)

LA BEL

DESC RIPTIO N

VLAN

This field displays the ID number of port mirroring VLAN over which the mirrored traffic is forwarded.

Connected Port

This field displays the number of ports that helps forward mirrored traffic to other connected switches.

XS3800-28 User's Guide
209

Chapter 17 Link Aggregation
C HA PTER 1 7 Link Ag g re g a tio n
17.1 Link Ag g re g a tio n O ve rvie w
This chapter shows you how to logically aggregate physical links to form one logical, higher-bandwidth link. Link aggregation (trunking) is the grouping of physical ports into one logical higher-capacity link. You may want to trunk ports if for example, it is cheaper to use multiple lower-speed links than to under-utilize a high-speed, but more costly, single-port link. However, the more ports you aggregate then the fewer available ports you have. A trunk group is one logical link containing multiple ports. The beginning port of each trunk group must be physically connected to form a trunk group.
17.1.1 Wha t Yo u C a n Do
· Use the Link Ag g re g a tio n Sta tus screen (Section 17.2 on page 211) to view ports you have configured to be in the trunk group, ports that are currently transmitting data as one logical link in the trunk group and so on.
· Use the Link Ag g re g a tio n Se tting screen (Section 17.3 on page 213) to configure static link aggregation.
· Use the Link Ag g re g a tio n C o ntro l Pro to c o l screen (Section 17.3.1 on page 215) to enable Link Aggregation Control Protocol (LACP).
17.1.2 Wha t Yo u Ne e d to Kno w
The Switch supports both static and dynamic link aggregation.
Note: In a properly planned network, it is recommended to implement static link aggregation only. This ensures increased network stability and control over the trunk groups on your Switch.
See Section 17.4.1 on page 218 for a static port trunking example.
Dyna m ic Link Ag g re g a tio n
The Switch adheres to the IEEE 802.3ad standard for static and dynamic (LACP) port trunking. The IEEE 802.3ad standard describes the Link Aggregation Control Protocol (LACP) for dynamically creating and managing trunk groups. When you enable LACP link aggregation on a port, the port can automatically negotiate with the ports at the remote end of a link to establish trunk groups. LACP also allows port redundancy, that is, if an
XS3800-28 User's Guide
210

Chapter 17 Link Aggregation

operational port fails, then one of the "standby" ports become operational without user intervention. Please note that:
· You must connect all ports point-to-point to the same Ethernet switch and configure the ports for LACP trunking.
· LACP only works on full-duplex links. · All ports in the same trunk group must have the same media type, speed, duplex mode and flow
control settings.
Configure trunk groups or LACP before you connect the Ethernet switch to avoid causing network topology loops.

Link Ag g re g a tio n ID

LACP aggregation ID consists of the following information1:

Table 76 Link Aggregation ID: Local Switch

SYSTEM PRIO RITY MAC ADDRESS

KEY

0000

00-00-00-00-00-00

0000

PO RTPRIO RITY 00

Table 77 Link Aggregation ID: Peer Switch

SYSTEM PRIO RITY MAC ADDRESS

0000

00-00-00-00-00-00

KEY 0000

PO RTPRIO RITY 00

PO RTNUMBER 0000
PO RTNUMBER 0000

Tra ffic Distrib utio n C rite ria
The Switch supports both unicast and non-unicast traffic (broadcast and multicast) network load sharing over link aggregation. Load sharing works by statically splitting the traffic based on source or destination IP/MAC address, and then distributing the load across multiple paths. In link aggregation, this allows the trunk group (ports) to transmit data as one logical link to a single or group of hosts on the network.
Unicast and non-unicast traffic network load sharing over link aggregation (trunking) is enabled by default.

17.2 Link Ag g re g a tio n Sta tus
Click Adva nc e d Applic a tio n > Link Ag g re g a tio n in the navigation panel. The Link Ag g re g a tio n Sta tus screen displays by default. See Section 17.1 on page 210 for more information.

1. Port Priority and Port Number are 0 as it is the aggregator ID for the trunk group, not the individual port.
XS3800-28 User's Guide
211

Chapter 17 Link Aggregation Fig ure 160 Advanced Application > Link Aggregation Status

The following table describes the labels in this screen.

Table 78 Advanced Application > Link Aggregation Status

LA BEL

DESC RIPTIO N

Group ID

This field displays the group ID to identify a trunk group, that is, one logical link containing multiple ports.

Enabled Ports These are the ports you have configured in the Link Ag g re g a tio n screen to be in the trunk group.

Synchronized Ports
Aggregator ID

The port numbers displays only when this trunk group is activated and there is a port belonging to this group. These are the ports that are currently transmitting data as one logical link in this trunk group.
Link Aggregator ID consists of the following: system priority, MAC address, key, port priority and port number.

Criteria

The ID displays only when there is a port belonging to this trunk group and LACP is also enabled for this group.
This shows the outgoing traffic distribution algorithm used in this trunk group. Packets from the same source and/or to the same destination are sent over the same link within the trunk.

src - m a c means the Switch distributes traffic based on the packet's source MAC address.

dst- m a c means the Switch distributes traffic based on the packet's destination MAC address.

src - dst- m a c means the Switch distributes traffic based on a combination of the packet's source and destination MAC addresses.

src - ip means the Switch distributes traffic based on the packet's source IP address.

dst- ip means the Switch distributes traffic based on the packet's destination IP address.

Status

src - dst- ip means the Switch distributes traffic based on a combination of the packet's source and destination IP addresses.
This field displays how these ports were added to the trunk group. It displays:

· Sta tic if the ports are configured as static members of a trunk group. · LAC P if the ports are configured to join a trunk group via LACP.

XS3800-28 User's Guide
212

17.3 Link Ag g re g a tio n Se tting
Click Adva nc e d Applic a tio n > Link Ag g re g a tio n > Link Ag g re g a tio n Se tting to display the screen shown next. See Section 17.1 on page 210 for more information on link aggregation. Fig ure 161 Advanced Application > Link Aggregation > Link Aggregation Setting (Standalone Mode)
XS3800-28 User's Guide
213

Chapter 17 Link Aggregation Fig ure 162 Advanced Application > Link Aggregation > Link Aggregation Setting (Stacking Mode)

The following table describes the labels in this screen.

Table 79 Advanced Application > Link Aggregation > Link Aggregation Setting

LA BEL

DESC RIPTIO N

Link Aggregation Setting

This is the only screen you need to configure to enable static link aggregation.

Group ID

The field identifies the link aggregation group, that is, one logical link containing multiple ports.

Active

Select this option to activate a trunk group.

XS3800-28 User's Guide
214

Chapter 17 Link Aggregation

Table 79 Advanced Application > Link Aggregation > Link Aggregation Setting (continued)

LA BEL Criteria

DESC RIPTIO N
Select the outgoing traffic distribution type. Packets from the same source and/or to the same destination are sent over the same link within the trunk. By default, the Switch uses the src - dst- m a c distribution type. If the Switch is behind a router, the packet's destination or source MAC address will be changed. In this case, set the Switch to distribute traffic based on its IP address to make sure port trunking can work properly.

Select src - m a c to distribute traffic based on the packet's source MAC address.

Select dst- m a c to distribute traffic based on the packet's destination MAC address.

Select src - dst- m a c to distribute traffic based on a combination of the packet's source and destination MAC addresses.

Select src - ip to distribute traffic based on the packet's source IP address.

Select dst- ip to distribute traffic based on the packet's destination IP address.

SLOT Port Group

Select src - dst- ip to distribute traffic based on a combination of the packet's source and destination IP addresses.
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.
This field displays the port number. In stacking mode, the first number represents the slot ID and the second is the port number. Please note that the default stacking ports (the last four ports of your Switch) cannot be configured. They are reserved for stacking only.
Select the trunk group to which a port belongs.

Apply Cancel

Note: When you enable the port security feature on the Switch and configure port security settings for a port, you cannot include the port in an active trunk group.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

17.3.1 Link Ag g re g a tio n C o ntro l Pro to c o l
Click Adva nc e d Applic a tio n > Link Ag g re g a tio n > Link Ag g re g a tio n Se tting > LAC P to display the screen shown next. See Dynamic Link Aggregation on page 210 for more information on dynamic link aggregation.

XS3800-28 User's Guide
215

Chapter 17 Link Aggregation Fig ure 163 Advanced Application > Link Aggregation > Link Aggregation Setting > LACP (Standalone
Mode)
XS3800-28 User's Guide
216

Chapter 17 Link Aggregation
Fig ure 164 Advanced Application > Link Aggregation > Link Aggregation Setting > LACP (Stacking Mode)

The following table describes the labels in this screen.

Table 80 Advanced Application > Link Aggregation > Link Aggregation Setting > LACP

LA BEL

DESC RIPTIO N

Link Aggregation Control Protocol

Note: Do NOT configure this screen unless you want to enable dynamic link aggregation.

Active

Select this check box to enable Link Aggregation Control Protocol (LACP).

System Priority

LACP system priority is a number between 1 and 65535. The switch with the lowest system priority (and lowest port number if system priority is the same) becomes the LACP "server". The LACP "server" controls the operation of LACP setup. Enter a number to set the priority of an active port using Link Aggregation Control Protocol (LACP). The smaller the number, the higher the priority level.

Group ID

The field identifies the link aggregation group, that is, one logical link containing multiple ports.

LACP Active

Select this option to enable LACP for a trunk.

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

XS3800-28 User's Guide
217

Chapter 17 Link Aggregation

Table 80 Advanced Application > Link Aggregation > Link Aggregation Setting > LACP (continued)

LA BEL

DESC RIPTIO N

Port

This field displays the port number. In stacking mode, the first number represents the slot ID and

the second is the port number. Please note that the default stacking ports (the last four ports of

your Switch) cannot be configured. They are reserved for stacking only.

Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

LACP Timeout
Apply Cancel

Note: Changes in this row are copied to all the ports as soon as you make them.
Timeout is the time interval between the individual port exchanges of LACP packets in order to check that the peer port in the trunk group is still up. If a port does not respond after three tries, then it is deemed to be "down" and is removed from the trunk. Set a short timeout (1 second) for busy trunked links to ensure that disabled ports are removed from the trunk group as soon as possible.
Select either 1 second or 30 seconds.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

17.4 Te c hnic a l Re fe re nc e
This section provides technical background information on the topics discussed in this chapter.
17.4.1 Sta tic Trunking Exa m ple
This example shows you how to create a static port trunk group for ports 2 5.
1 Ma ke yo ur physic a l c o nne c tio ns make sure that the ports that you want to belong to the trunk group are connected to the same destination. The following figure shows ports 2 5 on switch A connected to switch B. Fig ure 165 Trunking Example Physical Connections

2 C o nfig ure sta tic trunking Click Adva nc e d Applic a tio n > Link Ag g re g a tio n > Link Ag g re g a tio n Se tting . In this screen activate trunk group T1, select the traffic distribution algorithm used by this group and select the ports that should belong to this group as shown in the figure below. Click Apply when you are done.
XS3800-28 User's Guide
218

Chapter 17 Link Aggregation Fig ure 166 Trunking Example Configuration Screen
EXAMPLE
Your trunk group 1 (T1) configuration is now complete.
XS3800-28 User's Guide
219

Chapter 18 Port Authentication
C HA PTER 1 8 Po rt Authe ntic a tio n
18.1 Po rt Authe ntic a tio n O ve rvie w
This chapter describes the IEEE 802.1x, MAC, Guest VLAN, and Compound authentication methods. Port authentication is a way to validate access to ports on the Switch to clients based on an external server (authentication server). The Switch supports the following methods for port authentication: · IEEE 802.1x2 An authentication server validates access to a port based on a user name and
password provided by the user. · MAC Authe ntic a tio n An authentication server validates access to a port based on the MAC address
and password of the client. · G ue st VLAN A user that fails an authentication server can still access the port, but traffic from the
user is forwarded to the guest VLAN port. · C o m po und Authe ntic a tio n An authentication server validates access to a port based on a user
name and password provided by the user and/or MAC address and password of the client. All types of authentication use the RADIUS (Remote Authentication Dial In User Service, RFC 2138, 2139) protocol to validate users.
Note: If you enable IEEE 802.1x authentication and MAC authentication on the same port, the Switch performs IEEE 802.1x authentication first. If a user fails to authenticate via the IEEE 802.1x method, then access to the port is denied.
18.1.1 Wha t Yo u C a n Do
· Use the Po rt Authe ntic a tio n screen (Section 18.2 on page 222) to display the links to the configuration screens where you can enable the port authentication methods.
· Use the 802.1x screen (Section 18.3 on page 222) to activate IEEE 802.1x security. · Use the MAC Authe ntic a tio n screen (Section 18.4 on page 225) to activate MAC authentication. · Use the G ue st Vla n screen (Section 18.5 on page 228) to enable and assign a guest VLAN to a port. · Use the C o m po und Authe ntic a tio n screen (Section 18.6 on page 231) to allow network access for
clients that pass either IEEE 802.1x authentication OR MAC authentication, or pass both IEEE 802.1x authentication AND MAC authentication.
2. At the time of writing, IEEE 802.1x is not supported by all operating systems. See your operating system documentation. If your operating system does not support 802.1x, then you may need to install 802.1x client software.
XS3800-28 User's Guide
220

Chapter 18 Port Authentication
18.1.2 Wha t Yo u Ne e d to Kno w
IEEE 802.1x Authe ntic a tio n
The following figure illustrates how a client connecting to a IEEE 802.1x authentication enabled port goes through a validation process. The Switch prompts the client for login information in the form of a user name and password after the client responds to its identity request. When the client provides the login credentials, the Switch sends an authentication request to a RADIUS server. The RADIUS server validates whether this client is allowed access to the port. Fig ure 167 IEEE 802.1x Authentication Process
18.1.3 MAC Authe ntic a tio n
MAC authentication works in a very similar way to IEEE 802.1x authentication. The main difference is that the Switch does not prompt the client for login credentials. The login credentials are based on the source MAC address of the client connecting to a port on the Switch along with a password configured specifically for MAC authentication on the Switch.
XS3800-28 User's Guide
221

Chapter 18 Port Authentication Fig ure 168 MAC Authentication Process
18.2 Po rt Authe ntic a tio n C o nfig ura tio n
To enable port authentication, first activate the port authentication methods (both on the Switch and the ports), then configure the RADIUS server settings in the AAA > RADIUS Se rve r Se tup screen. Click Adva nc e d Applic a tio n > Po rt Authe ntic a tio n in the navigation panel to display the screen as shown. Select a port authentication method's link in the screen that appears. Fig ure 169 Advanced Application > Port Authentication
18.3 Ac tiva te IEEE 802.1x Se c urity
Use this screen to activate IEEE 802.1x security. In the Po rt Authe ntic a tio n screen click 802.1x to display the configuration screen as shown.
XS3800-28 User's Guide
222

Chapter 18 Port Authentication Fig ure 170 Advanced Application > Port Authentication > 802.1x (Standalone Mode)
XS3800-28 User's Guide
223

Chapter 18 Port Authentication Fig ure 171 Advanced Application > Port Authentication > 802.1x (Stacking Mode)

The following table describes the labels in this screen.

Table 81 Advanced Application > Port Authentication > 802.1x

LA BEL

DESC RIPTIO N

Active

Select this check box to permit 802.1x authentication on the Switch.

EAPOL flood

Note: You must first enable 802.1x authentication on the Switch before configuring it on each port.
Select this check box to flood EAPOL packets to all ports in the same VLAN.
EAP over LAN (EAPOL) is a port authentication protocol used in IEEE 802.1x. It is used to encapsulate and transmit EAP packets between the supplicant (a client device that requests access to the network resources or services) and authenticator (the Switch) directly over the LAN.

SLOT Port *

Note: EAPO Lflo o d will not take effect when 802.1x authentication is enabled.
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.
This field displays the port number. In stacking mode, the first number represents the slot ID and the second is the port number. Please note that the default stacking ports (the last four ports of your Switch) cannot be configured. They are reserved for stacking only.
Settings in this row apply to all ports.
Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Active

Note: Changes in this row are copied to all the ports as soon as you make them.
Select this to permit 802.1x authentication on this port. You must first allow 802.1x authentication on the Switch before configuring it on each port.

XS3800-28 User's Guide
224

Chapter 18 Port Authentication

Table 81 Advanced Application > Port Authentication > 802.1x (continued)

LA BEL Max-Req

DESC RIPTIO N
Specify the number of times the Switch tries to authenticate clients before sending unresponsive ports to the Guest VLAN.

This is set to 2 by default. That is, the Switch attempts to authenticate a client twice. If the client does not respond to the first authentication request, the Switch tries again. If the client still does not respond to the second request, the Switch sends the client to the Guest VLAN. The client needs to send a new request to be authenticated by the Switch again.

Reauth

Specify if a subscriber has to periodically re-enter his or her user name and password to stay connected to the port.

Reauth-period secs

Specify the length of time required to pass before a client has to re-enter his or her user name and password to stay connected to the port.

Quiet-period secs Specify the number of seconds the port remains in the HELD state and rejects further authentication requests from the connected client after a failed authentication exchange.

Tx-period secs

Specify the number of seconds the Switch waits for client's response before re-sending an identity request to the client.

Supp-Timeout secs

Specify the number of seconds the Switch waits for client's response to a challenge request before sending another request.

Apply

Cancel

Click C a nc e l to begin configuring this screen afresh.

18.4 Ac tiva te MAC Authe ntic a tio n
Use this screen to activate MAC authentication. In the Po rt Authe ntic a tio n screen click MAC Authe ntic a tio n to display the configuration screen as shown.

XS3800-28 User's Guide
225

Chapter 18 Port Authentication Fig ure 172 Advanced Application > Port Authentication > MAC Authentication (Standalone Mode)
XS3800-28 User's Guide
226

Chapter 18 Port Authentication Fig ure 173 Advanced Application > Port Authentication > MAC Authentication (Stacking Mode)

The following table describes the labels in this screen.

Table 82 Advanced Application > Port Authentication > MAC Authentication

LA BEL

DESC RIPTIO N

Active

Select this check box to permit MAC authentication on the Switch.

Name Prefix
Delimiter Case Password Type Password

Note: You must first enable MAC authentication on the Switch before configuring it on each port.
Type the prefix that is appended to all MAC addresses sent to the RADIUS server for authentication. You can enter up to 32 printable ASCII characters.
If you leave this field blank, then only the MAC address of the client is forwarded to the RADIUS server.
Select the delimiter the RADIUS server uses to separate the pairs in MAC addresses used as the account user name (and password). You can select Da sh (), C o lo n (:), or No ne to use no delimiters at all in the MAC address.
Select the case (Uppe r or Lo we r) the RADIUS server requires for letters in MAC addresses used as the account user name (and password).
Select Sta tic to have the Switch send the password you specify below or MAC - Addre ss to use the client MAC address as the password.
Type the password the Switch sends along with the MAC address of a client for authentication with the RADIUS server. You can enter up to 32 printable ASCII characters.

XS3800-28 User's Guide
227

Chapter 18 Port Authentication

Table 82 Advanced Application > Port Authentication > MAC Authentication (continued)

LA BEL Timeout

DESC RIPTIO N
Specify the amount of time before the Switch allows a client MAC address that fails authentication to try and authenticate again. Maximum time is 3000 seconds.

When a client fails MAC authentication, its MAC address is learned by the MAC address table with a status of denied. The timeout period you specify here is the time the MAC address entry stays in the MAC address table until it is cleared. If you specify 0 for the timeout value, the Switch uses the Ag ing Tim e configured in the Switc h Se tup screen.

SLOT Port *

Note: If the Ag ing Tim e in the Switc h Se tup screen is set to a lower value, then it supersedes this setting.
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.
This field displays the port number. In stacking mode, the first number represents the slot ID and the second is the port number. Please note that the default stacking ports (the last four ports of your Switch) cannot be configured. They are reserved for stacking only.
Use this row to make the setting the same for all ports. Use this row first and then make adjustments on a port-by-port basis.

Active Trusted VLAN List Apply Cancel

Note: Changes in this row are copied to all the ports as soon as you make them.
Select this check box to permit MAC authentication on this port. You must first allow MAC authentication on the Switch before configuring it on each port.
Enter the ID numbers of the trusted VLANs (separated by a comma). If a client's VLAN ID is specified here, the client can access the port and the connected networks without MAC authentication.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

18.5 G ue st VLAN
When 802.1x port authentication is enabled on the Switch and its ports, clients that do not have the correct credentials are blocked from using the ports. You can configure your Switch to have one VLAN that acts as a guest VLAN. If you enable the guest VLAN (102 in the example) on a port (2 in the example), the user (A in the example) that is not IEEE 802.1x capable or fails to enter the correct user name and password can still access the port, but traffic from the user is forwarded to the guest VLAN. That is, unauthenticated users can have access to limited network resources in the same guest VLAN, such as the Internet. The rights granted to the Guest VLAN depends on how the network administrator configures switches or routers with the guest network feature.

XS3800-28 User's Guide
228

Chapter 18 Port Authentication Fig ure 174 Guest VLAN Example
Use this screen to enable and assign a guest VLAN to a port. In the Po rt Authe ntic a tio n screen click G ue st Vla n to display the configuration screen as shown. Fig ure 175 Advanced Application > Port Authentication > Guest VLAN (Standalone Mode)
XS3800-28 User's Guide
229

Chapter 18 Port Authentication Fig ure 176 Advanced Application > Port Authentication > Guest VLAN (Stacking Mode)

The following table describes the labels in this screen.

Table 83 Advanced Application > Port Authentication > Guest VLAN

LA BEL

DESC RIPTIO N

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This field displays the port number. In stacking mode, the first number represents the slot ID and

the second is the port number. Please note that the default stacking ports (the last four ports of

your Switch) cannot be configured. They are reserved for stacking only.

Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Active

Changes in this row are copied to all the ports as soon as you make them. Select this check box to enable the guest VLAN feature on this port.

Guest Vlan

Clients that fail authentication are placed in the guest VLAN and can receive limited services.
A guest VLAN is a pre-configured VLAN on the Switch that allows non-authenticated users to access limited network resources through the Switch. You must also enable IEEE 802.1x authentication on the Switch and the associated ports. Enter the number that identifies the guest VLAN.

Host-mode

Make sure this is a VLAN recognized in your network.
Specify how the Switch authenticates users when more than one user connect to the port (using a hub).

Select Multi- Ho st to authenticate only the first user that connects to this port. If the first user enters the correct credential, any other users are allowed to access the port without authentication. If the first user fails to enter the correct credential, they are all put in the guest VLAN. Once the first user who did authentication logs out or disconnects from the port, the rest of the users are blocked until a user does the authentication process again.

Select Multi- Se c ure to authenticate each user that connects to this port.
Multi-Secure Num If you set Ho st- m o de to Multi- Se c ure , specify the maximum number of users (between 1 and 24) that the Switch will authenticate on this port.

XS3800-28 User's Guide
230

Chapter 18 Port Authentication

Table 83 Advanced Application > Port Authentication > Guest VLAN (continued)

LA BEL

DESC RIPTIO N

Apply

Cancel

Click C a nc e l to begin configuring this screen afresh.

18.6 C o m po und Authe ntic a tio n
Use this screen to allow network access for clients that:
· pass either IEEE 802.1x authentication OR MAC authentication, or · pass both IEEE 802.1x authentication AND MAC authentication.
The authentication modes are:
· In IEEE 802.1x authentication, the Switch prompts the client for login information in the form of a user name and password. When the client provides the login credentials, the Switch sends an authentication request to a RADIUS server. The RADIUS server validates whether this client is allowed access to the port. Use the AAA > RADIUS Se rve r Se tup screen to configure the RADIUS server.
· In MAC authentication, the login credentials are based on the source MAC address of the client connecting to a port on the Switch along with a password configured specifically for MAC authentication on the Switch.
In the Po rt Authe ntic a tio n screen click C o m po und Authe ntic a tio n Mo de to display the configuration screen as shown.

XS3800-28 User's Guide
231

Chapter 18 Port Authentication Fig ure 177 Advanced Application > Port Authentication > Compound Authentication Mode
(Standalone Mode)
XS3800-28 User's Guide
232

Chapter 18 Port Authentication
Fig ure 178 Advanced Application > Port Authentication > Compound Authentication Mode (Stacking Mode)

The following table describes the labels in this screen.

Table 84 Advanced Application > Port Authentication > Compound Authentication Mode

LA BEL

DESC RIPTIO N

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This field displays the port number. In stacking mode, the first number represents the slot ID and

the second is the port number. Please note that the default stacking ports (the last four ports of

your Switch) cannot be configured. They are reserved for stacking only.

Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Compound Authentication Mode

Changes in this row are copied to all the ports as soon as you make them. Specify how the Switch authenticates clients for network access.
Select Stric t to allow network access to clients only when clients passes IEEE 802.1x authentication AND MAC authentication at the same time.

Apply Cancel

Select Lo o se to allow network access to clients when clients passes IEEE 802.1x authentication OR MAC authentication.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
233

Chapter 18 Port Authentication
18.7 Te c hnic a l Re fe re nc e
This section provides technical background information on the topics discussed in this chapter.
18.7.1 IEEE 802.1x
The IEEE 802.1x is a standard for authentication as well as providing additional accounting and control features. It can be implemented both on wired and wireless networks. It is supported by Windows XP and a number of network devices. Some advantages of IEEE 802.1x are: · User based identification · Support for RADIUS (Remote Authentication Dial In User Service, RFC 2138, 2139) for centralized user
profile and accounting management on a network RADIUS server. · Support for EAP (Extensible Authentication Protocol, RFC 2486) that allows additional authentication
methods to be deployed with no changes to the switch or the wired clients.
18.7.2 RADIUS
RADIUS is based on a client-server model that supports authentication, authorization and accounting. The RADIUS server handles the following tasks: · Authentication Determines the identity of the users. · Authorization Determines the network services available to authenticated users once they are connected to the network. · Accounting Keeps track of the actions that are perform on the switch, such as login events. RADIUS is a simple package exchange in which your switch acts as a message relay between the wired client and the network RADIUS server.
18.7.2.1 Type s o f RADIUS Me ssa g e s
The following types of RADIUS messages are exchanged between the switch and the RADIUS server for user authentication: · Access-Request Sent by a switch requesting authentication. · Access-Reject Sent by a RADIUS server rejecting access. · Access-Accept Sent by a RADIUS server allowing access.
XS3800-28 User's Guide
234

Chapter 18 Port Authentication
· Access-Challenge
Sent by a RADIUS server requesting more information in order to allow access. The switch sends a proper response from the user and then sends another Access-Request message.
The following types of RADIUS messages are exchanged between the switch and the RADIUS server for user accounting:
· Accounting-Request
Sent by the switch requesting accounting.
· Accounting-Response
Sent by the RADIUS server to indicate that it has started or stopped accounting.
The switch and the RADIUS server use a shared secret key, which is a password, they both know to authenticate the communications between them, and ensure network security. A shared key is not sent over the network.
The switch forwards the RADIUS requests of a client to the RADIUS server. The login password information exchanged is sent over the network and encrypted to protect the network from unauthorized access.
18.7.3 EAP (Exte nsib le Authe ntic a tio n Pro to c o l) Authe ntic a tio n
This section discusses some popular authentication types: EAP-MD5, EAP-TLS, EAP-TTLS, PEAP and LEAP. Your wired LAN device may not support all authentication types.
EAP (Extensible Authentication Protocol) is an authentication protocol that runs on top of the IEEE 802.1x transport mechanism in order to support multiple types of user authentication. By using EAP to interact with an EAP-compatible RADIUS server, a switch helps a wired station and a RADIUS server perform authentication.
The type of authentication you use depends on the RADIUS server and an intermediary switch that supports IEEE 802.1x.
For EAP-TLS authentication type, you must first have a wired connection to the network and obtain the certificates from a certificate authority (CA). A certificate (also called digital IDs) can be used to authenticate users and a CA issues certificates and guarantees the identity of each certificate owner.
· EAP-MD5 (Message-Digest Algorithm 5)
MD5 authentication is the simplest one-way authentication method. The authentication server sends a challenge to the wired client. The wired client `proves' that it knows the password by encrypting the password with the challenge and sends back the information. Password is not sent in plain text.
However, MD5 authentication has some weaknesses. Since the authentication server needs to get the plain text passwords, the passwords must be stored. Thus someone other than the authentication server may access the password file. In addition, it is possible to impersonate an authentication server as MD5 authentication method does not perform mutual authentication. Finally, MD5 authentication method does not support data encryption with dynamic session key. You must configure WEP encryption keys for data encryption.
· EAP-TLS (Transport Layer Security)
XS3800-28 User's Guide
235

Chapter 18 Port Authentication
With EAP-TLS, digital certifications are needed by both the server and the wired clients for mutual authentication. The server presents a certificate to the client. After validating the identity of the server, the client sends a different certificate to the server. The exchange of certificates is done in the open before a secured tunnel is created. This makes user identity vulnerable to passive attacks. A digital certificate is an electronic ID card that authenticates the sender's identity. However, to implement EAPTLS, you need a Certificate Authority (CA) to handle certificates, which imposes a management overhead.
· EAP-TTLS (Tunneled Transport Layer Service)
EAP-TTLS is an extension of the EAP-TLS authentication that uses certificates for only the server-side authentications to establish a secure connection. Client authentication is then done by sending user name and password through the secure connection, thus client identity is protected. For client authentication, EAP-TTLS supports EAP methods and legacy authentication methods such as PAP, CHAP, MS-CHAP and MS-CHAP v2.
· PEAP (Protected EAP)
Like EAP-TTLS, server-side certificate authentication is used to establish a secure connection, then use simple user name and password methods through the secured connection to authenticate the clients, thus hiding client identity. However, PEAP only supports EAP methods, such as EAP-MD5, EAP-MSCHAPv2 and EAP-GTC (EAP-Generic Token Card), for client authentication. EAP-GTC is implemented only by Cisco.
· LEAP
LEAP (Lightweight Extensible Authentication Protocol) is a Cisco implementation of IEEE 802.1x.
18.7.4 EAPO L (EAP o ve r LAN)
EAPOL is a port authentication protocol used in IEEE 802.1x. It encapsulates and sends EAP packets from the LAN. EAPOL exchanges the following messages between a wired client and switch.
· EAPOL-Start
A wired client will send this message to a switch to let it know the wired client is ready.
· EAPOL-Key
The switch will send an encryption key to the wired client. It will be allowed access to the network when both of the switch and wired client have the correct encryption keys.
· EAP-Packet
Both of the wired client and the switch will send this message to complete the authentication process.
· EAPOL-Logoff
This message will be sent when the wired client wants to be disconnected from the network.
· EAPOL-Encapsulated-ASF-Alert
This message is sent If the authentication process is not completed yet, and alerts needs to be forwarded.
XS3800-28 User's Guide
236

C HA PTER 1 9 Po rt Se c urity
This chapter shows you how to set up port security.
19.1 Ab o ut Po rt Se c urity
Port security allows only packets with dynamically learned MAC addresses and/or configured static MAC addresses to pass through a port on the Switch. The Switch can learn up to 32K MAC addresses in total with no limit on individual ports other than the sum cannot exceed 32K. For maximum port security, enable this feature, disable MAC address learning and configure static MAC addresses for a port. It is not recommended you disable port security together with MAC address learning as this will result in many broadcasts. By default, MAC address learning is still enabled even though the port security is not activated.
19.2 Po rt Se c urity Se tup
Click Adva nc e d Applic a tio n > Po rt Se c urity in the navigation panel to display the screen as shown. Fig ure 179 Advanced Application > Port Security (Standalone Mode)
XS3800-28 User's Guide
237

Chapter 19 Port Security Fig ure 180 Advanced Application > Port Security (Stacking Mode)

The following table describes the labels in this screen.

Table 85 Advanced Application > Port Security

LA BEL

DESC RIPTIO N

Port List

Enter the number of the ports (separated by a comma) on which you want to enable port security and disable MAC address learning. In stacking mode, the first number represents the slot and the second the port number. Enter 1/11/24,2/23 for ports 1 to 24 for the Switch in slot 1 and port 23 for the Switch in slot 2, for example. After you click MAC fre e ze , all previously learned MAC addresses on the specified ports will become static MAC addresses and display in the Sta tic MAC Fo rwa rding screen.

MAC freeze

Click MAC fre e ze to have the Switch automatically select the Ac tive check boxes and clear the Addre ss Le a rning check boxes only for the ports specified in the Po rt List.

Active

Select this option to enable port security on the Switch.

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This field displays the port number. In stacking mode, the first number represents the slot ID and

the second is the port number. Please note that the default stacking ports (the last four ports of

your Switch) cannot be configured. They are reserved for stacking only.

Settings in this row apply to all ports.

Use this row only if you want to make some of the settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Active

Note: Changes in this row are copied to all the ports as soon as you make them.
Select this check box to enable the port security feature on this port. The Switch forwards packets whose MAC addresses is in the MAC address table on this port. Packets with no matching MAC addresses are dropped.
Clear this check box to disable the port security feature. The Switch forwards all packets on this port.

XS3800-28 User's Guide
238

Chapter 19 Port Security

Table 85 Advanced Application > Port Security (continued)

LA BEL

DESC RIPTIO N

Address Learning MAC address learning reduces outgoing broadcast traffic. For MAC address learning to occur on a port, the port itself must be active with address learning enabled.

Limited Number of Learned MAC Address

Use this field to limit the number of (dynamic) MAC addresses that may be learned on a port. For example, if you set this field to "5" on port 2, then only the devices with these five learned MAC addresses may access port 2 at any one time. A sixth device must wait until one of the five learned MAC addresses ages out. MAC address aging out time can be set in the Switc h Se tup screen. The valid range is from "0" to "32K". "0" means this feature is disabled.

Apply

Cancel

Click C a nc e l to begin configuring this screen afresh.

19.3 VLAN MAC Addre ss Lim it
Use this screen to set the MAC address learning limit on per-port and per-VLAN basis. Click VLAN MAC Addre ss Lim it in the Adva nc e d Applic a tio n > Po rt Se c urity screen to display the screen as shown.
Fig ure 181 Advanced Application > Port Security > VLAN MAC Address Limit (Standalone Mode)

Fig ure 182 Advanced Application > Port Security > VLAN MAC Address Limit (Stacking Mode)

XS3800-28 User's Guide
239

Chapter 19 Port Security

The following table describes the labels in this screen.

Table 86 Advanced Application > Port Security > VLAN MAC Address Limit

LA BEL Active Port VID Limit Number
Add

DESC RIPTIO N
Select this option to activate this rule.
Enter the number of the port to which this rule is applied. In stacking mode, the first box field is the slot ID and the second field is the port number.
Enter the VLAN identification number.
Use this field to limit the number of (dynamic) MAC addresses that may be learned on a port in a specified VLAN. For example, if you set this field to "5" on port 2, then only the devices with these five learned MAC addresses may access port 2 at any one time. A sixth device would have to wait until one of the five learned MAC addresses aged out. MAC address aging out time can be set in the Switc h Se tup screen. The valid range is from "0" to "32K". "0" means this feature is disabled.
Click this to create a new entry or to update an existing one.

Cancel Clear Index Active Port VID Limit Number
Delete
Cancel

This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to reset the fields to your previous configuration.
Click C le a r to reset the fields to the factory defaults.
This field displays the index number of the rule. Click an index number to change the settings.
This field displays Ye s when the rule is activated and No when is it deactivated.
This field displays the number of the port to which this rule is applied.
This is the VLAN ID number to which the port belongs.
This is the maximum number of MAC addresses which a port can learn in a VLAN.
Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.
Check the rules that you want to remove in the De le te column and then click the De le te button.
Click C a nc e l to clear the selected check boxes in the De le te column.

XS3800-28 User's Guide
240

Chapter 20 Time Range
C HA PTER 2 0 Tim e Ra ng e
20.1 Tim e Ra ng e O ve rvie w
You can set a time range for time-oriented features such as Classifier ACL (Access Control List) rule which categorizes data packets into different network traffic flow. The advantage of the time range feature is that it allows you to schedule the active time of configurations. The time range can be configured in two ways Absolute and Periodic. Absolute is a fixed time range with a start and end time. Periodic is recurrence of a time range and does not have an end time.
20.1.1 Wha t Yo u C a n Do
Use the Tim e Ra ng e screen (Section 20.2 on page 241) to view or define a schedule on the Switch.
20.2 C o nfig uring Tim e Ra ng e
Click Adva nc e d Applic a tio n > Tim e Ra ng e in the navigation panel to display the screen as shown. Fig ure 183 Advanced Application > Time Range
XS3800-28 User's Guide
241

Chapter 20 Time Range

The following table describes the labels in this screen.

Table 87 Advanced Application > Time Range

LA BEL

DESC RIPTIO N

Name

Enter a descriptive name for this rule for identifying purposes.

Type

Select Abso lute to create a one-time schedule. One-time schedules begin on a specific start date and time and end on a specific stop date and time. One-time schedules are useful for long holidays and vacation periods.

Absolute Start End
Periodic

Alternatively, select Pe rio dic to create a recurring schedule. Recurring schedules begin at a specific start time and end at a specific stop time on selected days of the week (Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, and Saturday). Recurring schedules are useful for defining the workday and off-work hours.
This section is available only when you set Type to Ab so lute .
Specify the year, month, day, hour and minute when the schedule begins.
Specify the year, month, day, hour and minute when the schedule ends.
This section is available only when you set Type to Pe rio dic .

Select the first option if you want to define a recurring schedule for a consecutive time period. You then select the day of the week, hour and minute when the schedule begins and ends respectively.

Add
Cancel Clear Index Name Type Range
Delete Cancel

Select the second option if you want to define a recurring schedule for multiple nonconsecutive time periods. You need to select each day of the week the recurring schedule is effective. You also need to specify the hour and minute when the schedule begins and ends each day. The schedule begins and ends in the same day.
Click Add to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to reset the fields to your previous configuration.
Click C le a r to clear the fields to the factory defaults.
This field displays the index number of the rule. Click an index number to change the settings.
This field displays the descriptive name for this rule. This is for identification purpose only.
This field displays the type of the schedule.
This field displays the time periods to which this schedule applies.
Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.
Check the rules that you want to remove and then click the De le te button.
Click C a nc e l to clear the selected check boxes.

XS3800-28 User's Guide
242

Chapter 21 Classifier
C HA PTER 2 1 C la ssifie r
21.1 C la ssifie r O ve rvie w
This chapter introduces and shows you how to configure the packet classifier on the Switch. It also discusses Quality of Service (QoS) and classifier concepts as employed by the Switch.
21.1.1 Wha t Yo u C a n Do
· Use the C la ssifie r Sta tus screen (Section 21.2 on page 244) to view the classifiers configured on the Switch and how many times the traffic matches the rules.
· Use the C la ssifie r C o nfig ura tio n screen (Section 21.3 on page 244) to define the classifiers and view a summary of the classifier configuration. After you define the classifier, you can specify actions (or policy) to act upon the traffic that matches the rules.
· Use the C la ssifie r G lo b a l Se tting screen (Section 21.4 on page 249) to configure the match order and enable logging on the Switch.
21.1.2 Wha t Yo u Ne e d to Kno w
Quality of Service (QoS) refers to both a network's ability to deliver data with minimum delay, and the networking methods used to control the use of bandwidth. Without QoS, all traffic data is equally likely to be dropped when the network is congested. This can cause a reduction in network performance and make the network inadequate for time-critical application such as video-on-demand. A classifier groups traffic into data flows according to specific criteria such as the source address, destination address, source port number, destination port number or incoming port number. For example, you can configure a classifier to select traffic from the same protocol port (such as Telnet) to form a flow. Configure QoS on the Switch to group and prioritize application traffic and fine-tune network performance. Setting up QoS involves two separate steps:
1 Configure classifiers to sort traffic into different flows. 2 Configure policy rules to define actions to be performed on a classified traffic flow (refer to Chapter 22
on page 252 to configure policy rules). You can also configure policy routing to forward a classified traffic flow to a different gateway for cost savings and load sharing.
XS3800-28 User's Guide
243

Chapter 21 Classifier
21.2 C la ssifie r Sta tus
Use this screen to view the classifiers configured on the Switch and how many times the traffic matches the rules. Click Adva nc e d Applic a tio n > C la ssifie r in the navigation panel to display the configuration screen as shown. Fig ure 184 Advanced Application > Classifier > Classifier Status

The following table describes the labels in this screen.

Table 88 Advanced Application > Classifier > Classifier Status

LA BEL Index Active Weight

DESC RIPTIO N
This field displays the index number of the rule. Click an index number to edit the rule. This field displays Ye s when the rule is activated and No when it is deactivated. This field displays the rule's weight. This is to indicate a rule's priority when the match order is set to m a nua l in the C la ssifie r > C la ssifie r C o nfig ura tio n > C la ssifie r G lo b a l Se tting screen.

Name Match Count
Rule Any Classifier
Clear

The higher the number, the higher the rule's priority. This field displays the descriptive name for this rule. This is for identification purpose only. This field displays the number of times a rule is applied. It displays '' if the rule does not have count enabled. This field displays a summary of the classifier rule's settings. Select Any, then click C le a r to clear the matched count for all classifiers. Select C la ssifie r, enter a classifier rule name and then click C le a r to erase the recorded statistical information for that classifier, or select Any to clear statistics for all classifiers. Click C le a r to erase the recorded statistical information for the classifier.

21.3 C la ssifie r C o nfig ura tio n
Use the C la ssifie r C o nfig ura tio n screen to define the classifiers. After you define the classifier, you can specify actions (or policy) to act upon the traffic that matches the rules.
In the C la ssifie r Sta tus screen click C la ssifie r C o nfig ura tio n to display the configuration screen as shown.

XS3800-28 User's Guide
244

Chapter 21 Classifier Fig ure 185 Advanced Application > Classifier > Classifier Configuration
XS3800-28 User's Guide
245

Chapter 21 Classifier

The following table describes the labels in this screen.

Table 89 Advanced Application > Classifier > Classifier Configuration

LA BEL

DESC RIPTIO N

Active

Select this option to enable this rule.

Name

Enter a descriptive name for this rule for identifying purposes.

Weight

Enter a number between 0 and 65535 to specify the rule's weight. When the match order is in manual mode in the C la ssifie r G lo b a l Se tting screen, a higher weight means a higher priority.

Log

Select this option to have the Switch create a log message when the rule is applied and record the

number of matched packets in a particular time interval.

Count
Time Range

Note: Make sure you also enable logging in the C la ssifie r G lo b a l Se tting screen.
Select this option to have the Switch count how many times the rule is applied.
Select the name of the pre-configured schedule that you want to apply to the rule. The rule will be active only at the scheduled date and/or time.

If you select No ne , the rule will be active all the time.

Ingress Port

Port

Type the port number to which the rule should be applied. You may choose one port only or all ports

(A ny ).

You can enter multiple ports separated by (no space) comma (,) or hyphen () for a range. For example, enter "35" for ports 3, 4, and 5. Enter "3,5,7" for ports 3, 5, and 7.

Trunk

Layer 2

To specify a trunk group, select the second choice and type a trunk group ID.

Specify the fields below to configure a layer 2 classifier.

VLAN

VLAN Select Any to classify traffic from any VLAN or select the second option and specify the source VLAN ID in the field provided.

Inner Select Any to classify traffic from any inner VLAN (the customer's VLAN) or select the second option VLAN and specify the source VLAN ID in the field provided.

Priority

Priority Select Any to classify traffic from any priority level or select the second option and specify a priority level in the field provided.

Inner Select Any to classify traffic from any inner priority level or select the second option and specify a Priority priority level in the field provided.

Ethernet Type

Select an Ethernet type or select O the r and enter the Ethernet type number in hexadecimal value.

Source

MAC Address

Select Any to apply the rule to all MAC addresses.
To specify a source, select MAC / Ma sk to enter the source MAC address of the packet in valid MAC address format (six hexadecimal character pairs) and type the mask for the specified MAC address to determine which bits a packet's MAC address should match.

XS3800-28 User's Guide
246

Chapter 21 Classifier

Table 89 Advanced Application > Classifier > Classifier Configuration (continued)

LA BEL

DESC RIPTIO N

Destination

MAC Address

Select Any to apply the rule to all MAC addresses.
To specify a destination, select MAC / Ma sk to enter the destination MAC address of the packet in valid MAC address format (six hexadecimal character pairs) and type the mask for the specified MAC address to determine which bits a packet's MAC address should match.

Layer 3

Specify the fields below to configure a layer 3 classifier.

IP Packet Click Any to classify any size of packet length or manually enter a range of number (from/to) of

Length

packet size in the field provided.

DSCP IPv4/IPv6

Select Any to classify traffic from any DSCP or select the second option and specify a DSCP (DiffServ Code Point) number between 0 and 63 in the field provided.

Preceden Select Any to classify traffic from any precedence or select the second option and specify an IP

Precedence (the first 3 bits of the 8-bit ToS field) value between 0 and 7 in the field provided.

ToS

Select Any to classify traffic from any ToS or select the second option and specify Type of Service (the

last 5 bits of the 8-bit ToS field) value between 0 and 255 in the field provided.

IP Protocol Select an IPv4 protocol type or select O the r and enter the protocol number in decimal value.

IPv6 Next Header

You may select Esta b lish O nly for TC P protocol type. This means that the Switch will pick out the packets that are sent to establish TCP connections.
Select an IPv6 protocol type or select O the r and enter an 8-bit next header in the IPv6 packet. The Next Header field is similar to the IPv4 Protocol field. The IPv6 protocol number ranges from 1 to 255.

You may select Esta b lish O nly for TC P protocol type. This means that the Switch will identify packets that initiate or acknowledge (establish) TCP connections.

Source

IP Address/ Address Prefix

Enter a source IP address in dotted decimal notation.
Specify the address prefix by entering the number of ones in the subnet mask.
A subnet mask can be represented in a 32-bit notation. For example, the subnet mask "255.255.255.0" can be represented as "11111111.11111111.11111111.00000000", and counting up the number of ones in this case results in 24.

Destination

IP Address/ Address Prefix

Enter a destination IP address in dotted decimal notation. Specify the address prefix by entering the number of ones in the subnet mask.

Layer 4

Specify the fields below to configure a layer 4 classifier.

Source

Socket Number

Note: You must select either UDP or TC P in the IP Pro to c o l field before you configure the socket numbers.

Select Any to apply the rule to all TCP/UDP protocol port numbers or select the second option and enter a TCP/UDP protocol port number.

XS3800-28 User's Guide
247

Chapter 21 Classifier

Table 89 Advanced Application > Classifier > Classifier Configuration (continued)

LA BEL

DESC RIPTIO N

Destination

Socket Number

Note: You must select either UDP or TC P in the IP Pro to c o l field before you configure the socket numbers.

Add
Cancel Clear

Select Any to apply the rule to all TCP/UDP protocol port numbers or select the second option and enter a TCP/UDP protocol port number.
Click this to create a new entry or to update an existing one.
This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the nonvolatile memory when you are done configuring. Click C a nc e l to reset the fields back to your previous configuration. Click C le a r to set the above fields back to the factory defaults.

21.3.1 Vie wing a nd Editing C la ssifie r C o nfig ura tio n Sum m a ry
To view a summary of the classifier configuration, scroll down to the summary table at the bottom of the C la ssifie r screen. To change the settings of a rule, click a number in the Inde x field.
Note: When two rules conflict with each other, a higher layer rule has priority over lower layer rule.
Fig ure 186 Advanced Application > Classifier > Classifier Configuration: Summary Table

The following table describes the labels in this screen.

Table 90 Advanced Application > Classifier > Classifier Configuration: Summary Table

LA BEL

DESC RIPTIO N

Index

This field displays the index number of the rule. Click an index number to edit the rule.

Active

This field displays Ye s when the rule is activated and No when it is deactivated.

Weight

The field displays the priority of the rule when the match order is in m a nua l mode. A higher weight means a higher priority.

Name

This field displays the descriptive name for this rule. This is for identification purpose only.

Rule

This field displays a summary of the classifier rule's settings.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Click De le te to remove the selected entry from the summary table.

Cancel

Click C a nc e l to clear the check boxes.

XS3800-28 User's Guide
248

Chapter 21 Classifier

The following table shows some other common Ethernet types and the corresponding protocol number.

Table 91 Common Ethernet Types and Protocol Numbers

ETHERNET TYPE

PRO TO C O L NUMBER

IP ETHII

0800

X.75 Internet

0801

NBS Internet

0802

ECMA Internet

0803

Chaosnet

0804

X.25 Level 3

0805

XNS Compat

0807

Banyan Systems

0BAD

BBN Simnet

5208

IBM SNA

80D5

AppleTalk AARP

80F3

Some of the most common TCP and UDP port numbers are:

Table 92 Common TCP and UDP Port Numbers

PRO TO C O L NAME

TC P/ UDP PO RTNUMBER

FTP

Telnet

SMTP

DNS

HTTP

POP3

110

21.4 C la ssifie r G lo b a l Se tting C o nfig ura tio n
Use this screen to configure the match order and enable logging on the Switch. In the C la ssifie r C o nfig ura tio n screen click C la ssifie r G lo b a l Se tting to display the configuration screen as shown.
Fig ure 187 Advanced Application > Classifier > Classifier Configuration > Classifier Global Setting

XS3800-28 User's Guide
249

Chapter 21 Classifier

The following table describes the labels in this screen.

Table 93 Advanced Application > Classifier > Classifier Configuration > Classifier Global Setting

LA BEL
Match Order

DESC RIPTIO N
Select m a nua l to have classifier rules applied according to the weight of each rule you configured in Adva nc e d Applic a tio n > C la ssifie r > C la ssifie r C o nfig ura tio n.

Logging Active Interval Apply
Cancel

Alternatively, select a uto to have classifier rules applied according to the layer of the item configured in the rule. Layer-4 items have the highest priority, and layer-2 items has the lowest priority. For example, you configure a layer-2 item (VLAN ID) in classifier A and configure a layer-3 item (source IP address) in classifier B. When an incoming packet matches both classifier rules, classifier B has priority over classifier A.
Select this to allow the Switch to create a log when packets match a classifier rule during a defined time interval.
Select the length of the time period (in seconds) to count matched packets for a classifier rule. Enter an integer from 0 65535. 0 means that no logging is done.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

21.5 C la ssifie r Exa m ple
The following screen shows an example where you configure a classifier that identifies all traffic from MAC address 00:50:ba:ad:4f:81 on port 2.

XS3800-28 User's Guide
250

Fig ure 188 Classifier: Example
EXAMPLE
After you have configured a classifier, you can configure a policy (in the Po lic y screen) to define actions on the classified traffic flow.
XS3800-28 User's Guide
251

Chapter 22 Policy Rule
C HA PTER 2 2 Po lic y Rule

22.1 Po lic y Rule s O ve rvie w
This chapter shows you how to configure policy rules.
A classifier distinguishes traffic into flows based on the configured criteria (refer to Chapter 21 on page 243 for more information). A policy rule ensures that a traffic flow gets the requested treatment in the network.

22.1.1 Wha t Yo u C a n Do
Use the Po lic y Rule screen (Section 22.2 on page 253) to enable the policy and display the active classifiers you configure in the C la ssifie r screen.

22.1.2 DiffSe rv
DiffServ (Differentiated Services) is a class of service (CoS) model that marks packets so that they receive specific per-hop treatment at DiffServ-compliant network devices along the route based on the application types and traffic flow. Packets are marked with DiffServ Code Points (DSCPs) indicating the level of service desired. This allows the intermediary DiffServ-compliant network devices to handle the packets differently depending on the code points without the need to negotiate paths or remember state information for every flow. In addition, applications do not have to request a particular service or give advanced notice of where the traffic is going.

22.1.3 DSC P a nd Pe r- Ho p Be ha vio r

DiffServ defines a new DS (Differentiated Services) field to replace the Type of Service (TOS) field in the IP header. The DS field contains a 2-bit unused field and a 6-bit DSCP field which can define up to 64 service levels. The following figure illustrates the DS field.
DSCP is backward compatible with the three precedence bits in the ToS octet so that non-DiffServ compliant, ToS-enabled network device will not conflict with the DSCP mapping.

DSCP (6 bits)

Unused (2 bits)

The DSCP value determines the forwarding behavior, the PHB (Per-Hop Behavior), that each packet gets across the DiffServ network. Based on the marking rule, different kinds of traffic can be marked for different kinds of forwarding. Resources can then be allocated according to the DSCP values and the configured policies.

XS3800-28 User's Guide
252

22.2 C o nfig uring Po lic y Rule s
You must first configure a classifier in the C la ssifie r screen. Click Adva nc e d Applic a tio n > Po lic y Rule in the navigation panel to display the screen as shown. Fig ure 189 Advanced Application > Policy Rule

The following table describes the labels in this screen.

Table 94 Advanced Application > Policy Rule

LA BEL

DESC RIPTIO N

Active

Select this option to enable the policy.

Name

Enter a descriptive name for identification purposes.

XS3800-28 User's Guide
253

Chapter 22 Policy Rule

Table 94 Advanced Application > Policy Rule (continued)

LA BEL

DESC RIPTIO N

Classifier(s)

This field displays the active classifiers you configure in the C la ssifie r screen.

Parameters

Select the classifiers to which this policy rule applies. To select more than one classifier, press [SHIFT] and select the choices at the same time.

Set the fields below for this policy. You only have to set the fields that is related to the actions you configure in the Ac tio n field.

General

Egress Port

Type the number of an outgoing port. In stacking mode, the first number represents the slot and the second the port number.

Priority

Specify a priority level.

DSCP

Specify a DSCP (DiffServ Code Point) number between 0 and 63.

TOS

Specify the type of service (TOS) priority level.

Metering

You can configure the desired bandwidth available to a traffic flow. Traffic that exceeds the maximum bandwidth allocated (in cases where the network is congested) is called out-ofprofile traffic.

Bandwidth

Specify the bandwidth in kilobit per second (Kbps). Enter a number between 1 and 1000000.

Out-of-Profile Specify a new DSCP number (between 0 and 63) if you want to replace or remark the DSCP

DSCP

number for out-of-profile traffic.

Action

Specify the actions the Switch takes on the associated classified traffic flow.

Forwarding

Select No c ha ng e to forward the packets.

Select Disc a rd the pa c ke t to drop the packets.

Priority

Select Do no t dro p the m a tc hing fra m e pre vio usly m a rke d fo r dro pping to retain the frames that were marked to be dropped before.
Select No c ha ng e to keep the priority setting of the frames.

Select Se t the pa c ke t's 802.1p prio rity a nd se nd the pa c ke t to prio rity q ue ue to replace the packet's 802.1p priority field with the value you set in the Prio rity field and put the packets in the designated queue.

Select Re pla c e the 802.1p prio rity fie ld with the IP TO S va lue a nd se nd the pa c ke t to prio rity q ue ue to replace the packet's 802.1p priority field with the value you set in the TO S field and put the packets in the designated queue.

Diffserv

Select Re pla c e the 802.1p prio rity fie ld with the inne r 802.1p prio rity va lue a nd se nd the pa c ke t to prio rity q ue ue to replace the packet's 802.1p priority field with the existing customer priority level carried in the frames and put the packets in the designated queue.
Select No c ha ng e to keep the TOS and/or DSCP fields in the packets.

Select Se t the pa c ke t's TO S fie ld to set the TOS field with the value you configure in the TO S field.

Select Re pla c e the IP TO S with the 802.1p prio rity va lue to replace the TOS field with the value you configure in the Prio rity field.

Outgoing

Select Se t the Diffse rv C o de po int fie ld in the fra m e to set the DSCP field with the value you configure in the DSC P field.
Select Se nd the pa c ke t to the m irro r po rt to send the packet to the mirror port.

Metering

Select Se nd the pa c ke t to the e g re ss po rt to send the packet to the egress port.
Select Ena ble to activate bandwidth limitation on the traffic flows then set the actions to be taken on out-of-profile packets.

XS3800-28 User's Guide
254

Chapter 22 Policy Rule

Table 94 Advanced Application > Policy Rule (continued)

LA BEL

DESC RIPTIO N

Out-of-profile action

Select the actions to be performed for out-of-profile traffic. Select Dro p the pa c ke t to discard the out-of-profile traffic.

Select C ha ng e the DSC P va lue to replace the DSCP field with the value specified in the O ut o f pro file DSC P field.

Select Se t O ut- Dro p Pre c e de nc e to mark out-of-profile traffic and drop it when network is congested.

Add

Select Do no t dro p the m a tc hing fra m e pre vio usly m a rke d fo r dro pping to queue the frames that are marked to be dropped.
Click this to create a new entry or to update an existing one.

Cancel Clear Index Active Name Classifier(s)
Delete Cancel

This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Click C a nc e l to begin configuring this screen afresh. Click C le a r to set the above fields back to the factory defaults. This field displays the policy index number. Click an index number to edit the policy. This field displays Ye s when policy is activated and No when is it deactivated. This field displays the name you have assigned to this policy. This field displays the names of the classifier to which this policy applies. Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries. Click De le te to remove the selected entry from the summary table. Click C a nc e l to clear the check boxes.

22.3 Po lic y Exa m ple
The figure below shows an example Po lic y screen where you configure a policy to limit bandwidth and discard out-of-profile traffic on a traffic flow classified using the Exa m ple classifier (refer to Section 21.5 on page 250).

XS3800-28 User's Guide
255

Fig ure 190 Policy Example

Chapter 22 Policy Rule

EXAMPLE

XS3800-28 User's Guide
256

C HA PTER 2 3 Q ue uing Me tho d
23.1 Q ue uing Me tho d O ve rvie w
This chapter introduces the queuing methods supported.
Queuing is used to help solve performance degradation when there is network congestion. Use the Q ue uing Me tho d screen to configure queuing algorithms for outgoing traffic. See also Prio rity Q ue ue Assig nm e nt in Switc h Se tup and 802.1p Prio rity in Po rt Se tup for related information.
23.1.1 Wha t Yo u C a n Do
Use the Q ue uing Me tho d screen (Section 23.2 on page 258) to set priorities for the queues of the Switch. This distributes bandwidth across the different traffic queues.
23.1.2 Wha t Yo u Ne e d to Kno w
Queuing algorithms allow switches to maintain separate queues for packets from each individual source or flow and prevent a source from monopolizing the bandwidth.
Stric tly Prio rity Q ue uing
Strictly Priority Queuing (SPQ) services queues based on priority only. As traffic comes into the Switch, traffic on the highest priority queue, Q7 is transmitted first. When that queue empties, traffic on the next highest-priority queue, Q6 is transmitted until Q6 empties, and then traffic is transmitted on Q5 and so on. If higher priority queues never empty, then traffic on lower priority queues never gets sent. SPQ does not automatically adapt to changing network requirements.
We ig hte d Fa ir Q ue uing
Weighted Fair Queuing is used to guarantee each queue's minimum bandwidth based on its bandwidth weight (portion) (the number you configure in the Weight field) when there is traffic congestion. WFQ is activated only when a port has more traffic than it can handle. Queues with larger weights get more guaranteed bandwidth than queues with smaller weights. This queuing mechanism is highly efficient in that it divides any available bandwidth across the different traffic queues. By default, the weight for Q0 is 1, for Q1 is 2, for Q2 is 3, and so on.
We ig hte d Ro und Ro b in Sc he duling (WRR)
Round Robin Scheduling services queues on a rotating basis and is activated only when a port has more traffic than it can handle. A queue is given an amount of bandwidth irrespective of the incoming traffic on that port. This queue then moves to the back of the list. The next queue is given an equal amount of bandwidth, and then moves to the end of the list; and so on, depending on the number of queues being used. This works in a looping fashion until a queue is empty.
XS3800-28 User's Guide
257

Chapter 23 Queuing Method Weighted Round Robin Scheduling (WRR) uses the same algorithm as round robin scheduling, but services queues based on their priority and queue weight (the number you configure in the queue We ig ht field) rather than a fixed amount of bandwidth. WRR is activated only when a port has more traffic than it can handle. Queues with larger weights get more service than queues with smaller weights. This queuing mechanism is highly efficient in that it divides any available bandwidth across the different traffic queues and returns to queues that have not yet emptied.
23.2 C o nfig uring Q ue uing
Use this screen to set priorities for the queues of the Switch. This distributes bandwidth across the different traffic queues. Click Adva nc e d Applic a tio n > Q ue uing Me tho d in the navigation panel. Fig ure 191 Advanced Application > Queuing Method (Standalone Mode)
XS3800-28 User's Guide
258

Chapter 23 Queuing Method Fig ure 192 Advanced Application > Queuing Method (Stacking Mode)

The following table describes the labels in this screen.

Table 95 Advanced Application > Queuing Method

LA BEL

DESC RIPTIO N

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This field displays the port number. In stacking mode, the first number represents the slot ID and the

second is the port number. Please note that the default stacking ports (the last four ports of your

Switch) cannot be configured. They are reserved for stacking only.

Port

This field displays the port number. In stacking mode, the first number represents the slot ID and the

second is the port number.

Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Note: Changes in this row are copied to all the ports as soon as you make them.

XS3800-28 User's Guide
259

Chapter 23 Queuing Method

Table 95 Advanced Application > Queuing Method (continued)

LA BEL Method

DESC RIPTIO N Select SPQ (Strictly Priority Queuing), WFQ (Weighted Fair Queuing) or WRR (Weighted Round Robin).

Strictly Priority Queuing services queues based on priority only. When the highest priority queue empties, traffic on the next highest-priority queue begins. Q7 has the highest priority and Q0 the lowest.

Weighted Fair Queuing is used to guarantee each queue's minimum bandwidth based on their bandwidth portion (weight) (the number you configure in the We ig ht field). Queues with larger weights get more guaranteed bandwidth than queues with smaller weights.

Weighted Round Robin Scheduling services queues on a rotating basis based on their queue weight (the number you configure in the queue We ig ht field). Queues with larger weights get more service than queues with smaller weights.

Weight

When you select WFQ or WRR enter the queue weight here. Bandwidth is divided across the different traffic queues according to their weights.

Hybrid-SPQ LowestQueue

This field is applicable only when you select WFQ or WRR.
Select a queue (Q 0 to Q 7) to have the Switch use SPQ to service the subsequent queues after and including the specified queue for the port. For example, if you select Q 5, the Switch services traffic on Q 5, Q 6 and Q 7 using SPQ .

Apply Cancel

Select No ne to always use WFQ or WRR for the port.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
260

Chapter 24 VLAN Stacking
C HA PTER 2 4 VLAN Sta c king
This chapter shows you how to configure VLAN stacking on your Switch. See the chapter on VLANs for more background information on Virtual LANs (VLANs).
24.1 VLAN Sta c king O ve rvie w
A service provider can use VLAN stacking to allow it to distinguish multiple customers VLANs, even those with the same (customer-assigned) VLAN ID, within its network. Use VLAN stacking to add an outer VLAN tag to the inner IEEE 802.1Q tagged frames that enter the network. By tagging the tagged frames ("double-tagged" frames), the service provider can manage up to 4094 VLAN groups with each group containing up to 4094 customer VLANs. This allows a service provider to provide different service, based on specific VLANs, for many different customers. A service provider's customers may require a range of VLANs to handle multiple applications. A service provider's customers can assign their own inner VLAN tags on ports for these applications. The service provider can assign an outer VLAN tag for each customer. Therefore, there is no VLAN tag overlap among customers, so traffic from different customers is kept separate.
24.1.1 VLAN Sta c king Exa m ple
In the following example figure, both A and B are Service Provider's Network (SPN) customers with VPN tunnels between their head offices and branch offices respectively. Both have an identical VLAN tag for their VLAN group. The service provider can separate these two VLANs within its network by adding tag 37 to distinguish customer A and tag 48 to distinguish customer B at edge device 1 and then stripping those tags at edge device 2 as the data frames leave the network.
XS3800-28 User's Guide
261

Chapter 24 VLAN Stacking Fig ure 193 VLAN Stacking Example

24.2 VLAN Sta c king Po rt Ro le s
Each port can have three VLAN stacking "roles", No rm a l, Ac c e ss Po rt and Tunne l Po rt (the latter is for Gigabit ports only).
· Select No rm a l for "regular" (non-VLAN stacking) IEEE 802.1Q frame switching. · Select Ac c e ss Po rt for ingress ports on the service provider's edge devices (1 and 2 in the VLAN
stacking example figure). The incoming frame is treated as "untagged", so a second VLAN tag (outer VLAN tag) can be added.
Note: Static VLAN Tx Ta g g ing MUST be disabled on a port where you choose No rm a l or Ac c e ss Po rt.
· Select Tunne l Po rt (available for Gigabit ports only) for egress ports at the edge of the service provider's network. All VLANs belonging to a customer can be aggregated into a single service provider's VLAN (using the outer VLAN tag defined by the Service Provider's (SP) VLAN ID (VID)).
Note: Static VLAN Tx Ta g g ing MUST be enabled on a port where you choose Tunne l Po rt.

24.3 VLAN Ta g Fo rm a t

A VLAN tag (service provider VLAN stacking or customer IEEE 802.1Q) consists of the following three fields.

Table 96 VLAN Tag Format

Type

Priority

VID

XS3800-28 User's Guide
262

Chapter 24 VLAN Stacking

Type is a standard Ethernet type code identifying the frame and indicates that whether the frame carries IEEE 802.1Q tag information. SP TPID (Service Provider Tag Protocol Identifier) is the service provider VLAN stacking tag type. Many vendors use 0x8100 or 0x9100.
TPID (Tag Protocol Identifier) is the customer IEEE 802.1Q tag.
· If the VLAN stacking port role is Ac c e ss Po rt, then the Switch adds the SP TPID tag to all incoming frames on the service provider's edge devices (1 and 2 in the VLAN stacking example figure).
· If the VLAN stacking port role is Tunne l Po rt, then the Switch only adds the SP TPID tag to all incoming frames on the service provider's edge devices (1 and 2 in the VLAN stacking example figure) that have an SP TPID different to the one configured on the Switch. (If an incoming frame's SP TPID is the same as the one configured on the Switch, then the Switch will not add the tag.)
Prio rity refers to the IEEE 802.1p standard that allows the service provider to prioritize traffic based on the class of service (CoS) the customer has paid for.
· On the Switch, configure priority level of the inner IEEE 802.1Q tag in the Po rt Se tup screen. · "0" is the lowest priority level and "7" is the highest.
VID is the VLAN ID. SP VID is the VID for the second (service provider's) VLAN tag.

24.3.1 Fra m e Fo rm a t

The frame format for an untagged Ethernet frame, a single-tagged 802.1Q frame (customer) and a "double-tagged" 802.1Q frame (service provider) is shown next.

Configure the fields as highlighted in the Switch VLAN Sta c king screen.

Table 97 Single and Double Tagged 802.1Q Frame Format

SA Len/Etype Data FCS

TPID Prio rity

VID Len/Etype Data FCS

DA SA SPTPID

Prio rity

VID TPID Prio rity

VID Len/Etype Data FCS

Untagged Ethernet frame
IEEE 802.1Q customer tagged frame
Double-tagged frame

Table 98 802.1Q Frame

Destination Address

Source Address

(SP)TPID (Service Provider) Tag Protocol IDentifier

VID

VLAN ID

Priority Len/Etype Data FCS

802.1p Priority Length and type of Ethernet frame Frame data Frame Check Sequence

24.4 C o nfig uring VLAN Sta c king
Click Adva nc e d Applic a tio n > VLAN Sta c king to display the screen as shown.

XS3800-28 User's Guide
263

Chapter 24 VLAN Stacking Fig ure 194 Advanced Application > VLAN Stacking (Standalone Mode)
Fig ure 195 Advanced Application > VLAN Stacking (Stacking Mode)

The following table describes the labels in this screen.

Table 99 Advanced Application > VLAN Stacking

LA BEL

DESC RIPTIO N

Active

Select this check box to enable VLAN stacking on the Switch.

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This field displays the port number. In stacking mode, the first number represents the slot ID and the

second is the port number. Please note that the default stacking ports (the last four ports of your

Switch) cannot be configured. They are reserved for stacking only.

XS3800-28 User's Guide
264

Chapter 24 VLAN Stacking

Table 99 Advanced Application > VLAN Stacking (continued)

LA BEL *

DESC RIPTIO N Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Role Tunnel TPID

Note: Changes in this row are copied to all the ports as soon as you make them.
Select No rm a l to have the Switch ignore frames received (or transmitted) on this port with VLAN stacking tags. Anything you configure in SPVID and Prio rity of the Po rt- b a se d Q inQ or the Se le c tive Q inQ screen are ignored.
Select Ac c e ss Po rt to have the Switch add the SP TPID tag to all incoming frames received on this port. Select Ac c e ss Po rt for ingress ports at the edge of the service provider's network.
Select Tunne l Po rt (available for Gigabit ports only) for egress ports at the edge of the service provider's network. Select Tunne l Po rt to have the Switch add the Tunne l TPID tag to all outgoing frames sent on this port.
In order to support VLAN stacking on a port, the port must be able to allow frames of 1526 Bytes (1522 Bytes + 4 Bytes for the second tag) to pass through it.
TPID is a standard Ethernet type code identifying the frame and indicates whether the frame carries IEEE 802.1Q tag information. Enter a four-digit hexadecimal number from 0000 to FFFF that the Switch adds in the outer VLAN tag of the frames sent on the tunnel ports. The Switch also uses this to check if the received frames are double-tagged.
The value of this field is 0x8100 as defined in IEEE 802.1Q. It is used to identify the customer tag of an incoming frame. If the Switch needs to communicate with other vendors' devices, they should use the same TPID.

Apply Cancel

Note: You can define up to four different tunnel TPIDs (including 8100) in this screen at a time.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

24.4.1 Po rt- b a se d Q - in- Q
Port-based Q-in-Q lets the Switch treat all frames received on the same port as the same VLAN flows and add the same outer VLAN tag to them, even if they have different customer VLAN IDs.
Click Po rt- b a se d Q inQ in the Adva nc e d Applic a tio n > VLAN Sta c king screen to display the screen as shown.

XS3800-28 User's Guide
265

Chapter 24 VLAN Stacking Fig ure 196 Advanced Application > VLAN Stacking > Port-based QinQ (Standalone Mode)

Fig ure 197 Advanced Application > VLAN Stacking > Port-based QinQ (Stacking Mode)

The following table describes the labels in this screen.

Table 100 Advanced Application > VLAN Stacking > Port-based QinQ

LA BEL

DESC RIPTIO N

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This field displays the port number. In stacking mode, the first number represents the slot ID and the

second is the port number. Please note that the default stacking ports (the last four ports of your

Switch) cannot be configured. They are reserved for stacking only.

XS3800-28 User's Guide
266

Chapter 24 VLAN Stacking

Table 100 Advanced Application > VLAN Stacking > Port-based QinQ (continued)

LA BEL *

DESC RIPTIO N Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

SPVID Priority
Apply Cancel

Note: Changes in this row are copied to all the ports as soon as you make them.
SPVID is the service provider's VLAN ID (the outer VLAN tag). Enter the service provider ID (from 1 to 4094) for frames received on this port.
Select a priority level (from 0 to 7). This is the service provider's priority level that adds to the frames received on this port.
"0" is the lowest priority level and "7" is the highest.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

24.4.2 Se le c tive Q - in- Q
Selective Q-in-Q is VLAN-based. It allows the Switch to add different outer VLAN tags to the incoming frames received on one port according to their inner VLAN tags.
Note: Selective Q-in-Q rules are only applied to single-tagged frames received on the access ports. If the incoming frames are untagged or single-tagged but received on a tunnel port or cannot match any selective Q-in-Q rules, the Switch applies the port-based Qin-Q rules to them.
Click Se le c tive Q inQ in the Adva nc e d Applic a tio n > VLAN Sta c king screen to display the screen as shown.
Fig ure 198 Advanced Application > VLAN Stacking > Selective QinQ (Standalone Mode)

XS3800-28 User's Guide
267

Chapter 24 VLAN Stacking Fig ure 199 Advanced Application > VLAN Stacking > Selective QinQ (Stacking Mode)

The following table describes the labels in this screen.

Table 101 Advanced Application > VLAN Stacking > Selective QinQ

LA BEL

DESC RIPTIO N

Active

Check this box to activate this rule.

Name

Enter a descriptive name (up to 32 printable ASCII characters) for identification purposes.

Port

The port number identifies the port you are configuring. In stacking mode, the first field is the slot ID

and the second field is the port number.

CVID

Enter a customer VLAN ID (the inner VLAN tag) from 1 to 4094. This is the VLAN tag carried in the packets from the subscribers.

SPVID

SPVID is the service provider's VLAN ID (the outer VLAN tag). Enter the service provider ID (from 1 to 4094) for frames received on this port.

Priority

Select a priority level (from 0 to 7). This is the service provider's priority level that adds to the frames received on this port.

Add

"0" is the lowest priority level and "7" is the highest. Click this to create a new entry or to update an existing one.

Cancel Index Active Name Port
CVID SPVID Priority
Delete Cancel

This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Click C a nc e l to begin configuring this screen afresh. This is the number of the selective VLAN stacking rule. Click an index number to change the settings. This shows whether this rule is activated or not. This is the descriptive name for this rule. This is the port number to which this rule is applied. In stacking mode, the first number represents the slot and the second the port number. This is the customer VLAN ID in the incoming packets. This is the service provider's VLAN ID that adds to the packets from the subscribers. This is the service provider's priority level in the packets. Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries. Check the rules that you want to remove in the De le te column and then click the De le te button. Click C a nc e l to clear the De le te check boxes.

XS3800-28 User's Guide
268

Chapter 25 Multicast
C HA PTER 2 5 Multic a st
25.1 Multic a st O ve rvie w
This chapter shows you how to configure various multicast features.
Traditionally, IP packets are transmitted in one of either two ways Unicast (one sender to one recipient) or Broadcast (one sender to everybody on the network). Multicast delivers IP packets to just a group of hosts on the network.
IGMP (Internet Group Management Protocol) is a network-layer protocol used to establish membership in a multicast group it is not used to carry user data. Refer to RFC 1112, RFC 2236 and RFC 3376 for information on IGMP versions 1, 2 and 3 respectively.
The Multicast Listener Discovery (MLD) protocol (defined in RFC 2710) is derived from IPv4's Internet Group Management Protocol version 2 (IGMPv2). MLD uses ICMPv6 message types, rather than IGMP message types. MLDv1 is similar to IGMPv2 and MLDv2 is similar to IGMPv3. MLD allows an IPv6 switch or router to discover the presence of MLD listeners who wish to receive multicast packets and the IP addresses of multicast groups the hosts want to join on its network.
MLD snooping and MLD proxy are analogous to IGMP snooping and IGMP proxy in IPv4. MLD filtering controls which multicast groups a port can join.
25.1.1 Wha t Yo u C a n Do
· Use the Multic a st Se tup screen (Section 25.2 on page 273) to display the links to the configuration screens where you can configure IPv4 multicast settings.
· Use the IPv4 Multic a st Sta tus screen (Section 25.3 on page 273) to view multicast group information. · Use the IG MP Sno o ping screen (Section 25.3.1 on page 274) to enable IGMP snooping to forward
group multicast traffic only to ports that are members of that group. · Use the IG MP Sno o ping VLAN screen (Section 25.3.2 on page 278) to perform IGMP snooping on up to
16 VLANs. · Use the IG MP Filte ring Pro file (Section 25.3.3 on page 279) to specify a range of multicast groups that
clients connected to the Switch are able to join. · Use the IPv6 Multic a st Sta tus screen (Section 25.4 on page 280) to view multicast group information. · Use the MLD Sno o ping - pro xy screen (Section 25.4.1 on page 281) to enable the upstream port to
report group changes to a connected multicast router and forward MLD messages to other upstream ports. · Use the MVR screens (Section 25.5 on page 288) to create multicast VLANs and select the receiver ports and a source port for each multicast VLAN.
XS3800-28 User's Guide
269

Chapter 25 Multicast
25.1.2 Wha t Yo u Ne e d to Kno w
Read on for concepts on Multicasting that can help you configure the screens in this chapter.
IP Multic a st Addre sse s
In IPv4, a multicast address allows a device to send packets to a specific group of hosts (multicast group) in a different subnetwork. A multicast IP address represents a traffic receiving group, not individual receiving devices. IP addresses in the Class D range (224.0.0.0 to 239.255.255.255) are used for IP multicasting. Certain IP multicast numbers are reserved by IANA for special purposes (see the IANA website for more information).
In IPv6, multicast addresses provide the same functionality as IPv4 broadcast addresses. Broadcasting is not supported in IPv6. A multicast address allows a host to send packets to all hosts in a multicast group. Multicast scope allows you to determine the size of the multicast group. A multicast address has a predefined prefix of ff00::/8.
IG MP Filte ring
With the IGMP filtering feature, you can control which IGMP groups a subscriber on a port can join. This allows you to control the distribution of multicast services (such as content information distribution) based on service plans and types of subscription.
You can set the Switch to filter the multicast group join reports on a per-port basis by configuring an IGMP filtering profile and associating the profile to a port.
IG MP Sno o ping
A Switch can passively snoop on IGMP packets transferred between IP multicast routers or switches and IP multicast hosts to learn the IP multicast group membership. It checks IGMP packets passing through it, picks out the group registration information, and configures multicasting accordingly. IGMP snooping allows the Switch to learn multicast groups without you having to manually configure them.
The Switch forwards multicast traffic destined for multicast groups (that it has learned from IGMP snooping or that you have manually configured) to ports that are members of that group. IGMP snooping generates no additional network traffic, allowing you to significantly reduce multicast traffic passing through your Switch.
IG MP Sno o ping a nd VLANs
The Switch can perform IGMP snooping on up to 16 VLANs. You can configure the Switch to automatically learn multicast group membership of any VLANs. The Switch then performs IGMP snooping on the first 16 VLANs that send IGMP packets. This is referred to as auto mode. Alternatively, you can specify the VLANs that IGMP snooping should be performed on. This is referred to as fixed mode. In fixed mode the Switch does not learn multicast group membership of any VLANs other than those explicitly added as an IGMP snooping VLAN.
MLD Sno o ping - pro xy
MLD snooping-proxy is a Zyxel-proprietary feature. IPv6 MLD proxy allows only one upstream interface on a switch, while MLD snooping-proxy supports more than one upstream port on a switch. The upstream port in MLD snooping-proxy can report group changes to a connected multicast router and forward
XS3800-28 User's Guide
270

MLD messages to other upstream ports. This helps especially when you want to have a network that uses STP to provide backup links between switches and also performs MLD snooping and proxy functions. MLD snooping-proxy, like MLD proxy, can minimize MLD control messages and allow better network performance. In MLD snooping-proxy, if one upstream port is learned via snooping, all other upstream ports on the same device will be added to the same group. If one upstream port requests to leave a group, all other upstream ports on the same device will also be removed from the group. In the following MLD snooping-proxy example, all connected upstream ports (1 7) are treated as one interface. The connection between ports 8 and 9 is blocked by STP to break the loop. If there is one query from a router (X) or MLD Done or Report message from any upstream port, it will be broadcast to all connected upstream ports.
MLD Me ssa g e s
A multicast router or switch periodically sends general queries to MLD hosts to update the multicast forwarding table. When an MLD host wants to join a multicast group, it sends an MLD Report message for that address. An MLD Done message is similar to an IGMP Leave message. When an MLD host wants to leave a multicast group, it can send a Done message to the router or switch. If the leave mode is not set to Im me dia te , the router or switch sends a group-specific query to the port on which the Done message is received to determine if other devices connected to this port should remain in the group.
MVR O ve rvie w
Multicast VLAN Registration (MVR) is designed for applications (such as Media-on-Demand (MoD)) that use multicast traffic across an Ethernet ring-based service provider network.
XS3800-28 User's Guide
271

Chapter 25 Multicast
MVR allows one single multicast VLAN to be shared among different subscriber VLANs on the network. While isolated in different subscriber VLANs, connected devices can subscribe to and unsubscribe from the multicast stream in the multicast VLAN. This improves bandwidth utilization with reduced multicast traffic in the subscriber VLANs and simplifies multicast group management. MVR only responds to IGMP join and leave control messages from multicast groups that are configured under MVR. Join and leave reports from other multicast groups are managed by IGMP snooping. The following figure shows a network example. The subscriber VLAN (1, 2 and 3) information is hidden from the streaming media server, S. In addition, the multicast VLAN information is only visible to the Switch and S. Fig ure 200 MVR Network Example
Type s o f MVR Po rts
In MVR, a source port is a port on the Switch that can send and receive multicast traffic in a multicast VLAN while a receiver port can only receive multicast traffic. Once configured, the Switch maintains a forwarding table that matches the multicast stream to the associated multicast group.
MVR Mode s
You can set your Switch to operate in either dynamic or compatible mode. In dynamic mode, the Switch sends IGMP leave and join reports to the other multicast devices (such as multicast routers or servers) in the multicast VLAN. This allows the multicast devices to update the multicast forwarding table to forward or not forward multicast traffic to the receiver ports. In compatible mode, the Switch does not send any IGMP reports. In this case, you must manually configure the forwarding settings on the multicast devices in the multicast VLAN.
Ho w MVR Wo rks
The following figure shows a multicast television example where a subscriber device (such as a computer) in VLAN 1 receives multicast traffic from the streaming media server, S, via the Switch. Multiple subscriber devices can connect through a port configured as the receiver on the Switch. When the subscriber selects a television channel, computer A sends an IGMP report to the Switch to join the appropriate multicast group. If the IGMP report matches one of the configured MVR multicast group addresses on the Switch, an entry is created in the forwarding table on the Switch. This maps the subscriber VLAN to the list of forwarding destinations for the specified multicast traffic. When the subscriber changes the channel or turns off the computer, an IGMP leave message is sent to
XS3800-28 User's Guide
272

the Switch to leave the multicast group. The Switch sends a query to VLAN 1 on the receiver port (in this case, an uplink port on the Switch). If there is another subscriber device connected to this port in the same subscriber VLAN, the receiving port will still be on the list of forwarding destination for the multicast traffic. Otherwise, the Switch removes the receiver port from the forwarding table.
Fig ure 201 MVR Multicast Television Example

25.2 Multic a st Se tup
Use this screen to configure IGMP for IPv4. Click Adva nc e d Applic a tio n > Multic a st in the navigation panel.
Fig ure 202 Advanced Application > Multicast Setup

The following table describes the labels in this screen.

Table 102 Advanced Application > Multicast Setup

LA BEL

DESC RIPTIO N

IPv4 Multicast

Click the link to open screens where you can configure IGMP snooping and IGMP filtering for IPv4.

IPv6 Multicast

Click the link to open screens where you can configure MLD snooping-proxy and MLD filtering for IPv6.

MVR

Click the link to open screens where you can create multicast VLANs.

25.3 IPv4 Multic a st Sta tus
Click Adva nc e d Applic a tio n > Multic a st > IPv4 Multic a st to display the screen as shown. This screen shows the IPv4 multicast group information. See Section 25.1 on page 269 for more information on multicasting.
Fig ure 203 Advanced Application > Multicast > IPv4 Multicast

XS3800-28 User's Guide
273

Chapter 25 Multicast

The following table describes the labels in this screen.

Table 103 Advanced Application > Multicast > IPv4 Multicast

LA BEL Index VID Port

DESC RIPTIO N This is the index number of the entry. This field displays the multicast VLAN ID. This field displays the port number that belongs to the multicast group.

Multicast Group

In stacking mode, the first number represents the slot and the second is the port number. This field displays IP multicast group addresses.

25.3.1 IG MP Sno o ping
Click the IG MP Sno o ping link in the Adva nc e d Applic a tio n > Multic a st > IPv4 Multic a st screen to display the screen as shown. See Section 25.1 on page 269 for more information on multicasting.
Fig ure 204 Advanced Application > Multicast > IPv4 Multicast > IGMP Snooping (Standalone Mode)

XS3800-28 User's Guide
274

Chapter 25 Multicast Fig ure 205 Advanced Application > Multicast > IPv4 Multicast > IGMP Snooping (Stacking Mode)

The following table describes the labels in this screen.

Table 104 Advanced Application > Multicast > IPv4 Multicast > IGMP Snooping

LA BEL

DESC RIPTIO N

IGMP Snooping

Use these settings to configure IGMP snooping.

Active

Select Ac tive to enable IGMP Snooping to forward group multicast traffic only to ports that are members of that group.

Querier

Select this option to allow the Switch to send IGMP General Query messages to the VLANs with the multicast hosts attached.

Querier Version IGMP snooping query works only when both host and Switch support the same IGMP version.

Select v2 to allow the Switch to send IGMPv2 queries only.

Select v3 to allow the Switch to send IGMPv3 queries only.

XS3800-28 User's Guide
275

Chapter 25 Multicast

Table 104 Advanced Application > Multicast > IPv4 Multicast > IGMP Snooping (continued)

LA BEL

DESC RIPTIO N

Report Proxy

Select this option to allow the Switch to act as the IGMP report proxy and leave proxy. It will report group changes to a connected multicast router.

The Switch not only checks IGMP packets between multicast routers or switches and multicast hosts to learn the multicast group membership, but also replaces the source MAC address in an IGMP v1/v2 report with its own MAC address before forwarding to the multicast router or switch. When the Switch receives more than one IGMP v1/v2 join report that requests to join the same multicast group, it only sends a new join report with its MAC address. This helps reduce the number of multicast join reports passed to the multicast router or switch.

Host Timeout 802.1p Priority IGMP Filtering

The Switch sends a leave message with its MAC address to the multicast router or switch only when it receives the leave message from the last host in a multicast group.
Specify the time (from 1 to 16711450) in seconds that elapses before the Switch removes an IGMP group membership entry if it does not receive report messages from the port.
Select a priority level (0 7) to which the Switch changes the priority in outgoing IGMP control packets. Otherwise, select No - C ha ng e to not replace the priority.
Select Ac tive to enable IGMP filtering to control which IGMP groups a subscriber on a port can join.

If you enable IGMP filtering, you must create and assign IGMP filtering profiles for the ports that you want to allow to join multicast groups.

Unknown Multicast Frame

Specify the action to perform when the Switch receives an unknown multicast frame.
· Select Dro p to discard the frames. · Select Flo o ding to send the frames to all ports. · Select Dro p o n VLAN and enter the VLAN ID numbers to discard the frames on the
specified VLANs. Use a dash to specify consecutive VLANs and a comma (no spaces) to specify non-consecutive VLANs. For example, 5153 includes 51, 52 and 53, but 51,53 does not include 52.

Unknown Multicast Frame to Querier Port

Specify the action to perform when Unkno wn Multic a st Fra m e is set to Dro p.
· Select Dro p to discard the frames. · Select Fo rwa rding to send the frames to all querier ports. · Select Fo rwa rding o n VLAN and enter the VLAN ID numbers to send the frames to the ports
which are used as an IGMP query port on the specified VLANs. Use a dash to specify consecutive VLANs and a comma (no spaces) to specify non-consecutive VLANs. For example, 5153 includes 51, 52 and 53, but 51,53 does not include 52.

Reserved Multicast Group

The IP address range of 224.0.0.0 to 224.0.0.255 are reserved for multicasting on the local network only. For example, 224.0.0.1 is for all hosts on a local network segment and 224.0.0.9 is used to send RIP routing information to all RIP v2 routers on the same network segment. A multicast router will not forward a packet with the destination IP address within this range to other networks. See the IANA web site for more information.

The layer-2 multicast MAC addresses used by Cisco layer-2 protocols, 01:00:0C:CC:CC:CC and 01:00:0C:CC:CC:CD, are also included in this group.

Specify the action to perform when the Switch receives a frame with a reserved multicast address.

SLOT Port

· Select Dro p to discard the frames. · Select Flo o ding to send the frames to all ports.
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.
This field displays the port number. In stacking mode, the first number represents the slot ID and the second is the port number. Please note that the default stacking ports (the last four ports of your Switch) cannot be configured. They are reserved for stacking only.

XS3800-28 User's Guide
276

Table 104 Advanced Application > Multicast > IPv4 Multicast > IGMP Snooping (continued)

LA BEL

DESC RIPTIO N

Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Immed. Leave

Changes in this row are copied to all the ports as soon as you make them.
Select this option to set the Switch to remove this port from the multicast tree when an IGMP version 2 leave message is received on this port.

Normal Leave

Select this option if there is only one host connected to this port.
Enter an IGMP normal leave timeout value (from 200 to 6348800) in miliseconds. Select this option to have the Switch use this timeout to update the forwarding table for the port.

In normal leave mode, when the Switch receives an IGMP leave message from a host on a port, it forwards the message to the multicast router. The multicast router then sends out an IGMP Group-Specific Query (GSQ) message to determine whether other hosts connected to the port should remain in the specific multicast group. The Switch forwards the query message to all hosts connected to the port and waits for IGMP reports from hosts to update the forwarding table.

Fast Leave

This defines how many seconds the Switch waits for an IGMP report before removing an IGMP snooping membership entry when an IGMP leave message is received on this port from a host.
Enter an IGMP fast leave timeout value (from 200 to 6348800) in miliseconds. Select this option to have the Switch use this timeout to update the forwarding table for the port.

In fast leave mode, right after receiving an IGMP leave message from a host on a port, the Switch itself sends out an IGMP Group-Specific Query (GSQ) message to determine whether other hosts connected to the port should remain in the specific multicast group. This helps speed up the leave process.

Group Limited Max Group Num.
Throttling

This defines how many seconds the Switch waits for an IGMP report before removing an IGMP snooping membership entry when an IGMP leave message is received on this port from a host.
Select this option to limit the number of multicast groups this port is allowed to join.
Enter the number of multicast groups this port is allowed to join. Once a port is registered in the specified number of multicast groups, any new IGMP join report frames is dropped on this port.
IGMP throttling controls how the Switch deals with the IGMP reports when the maximum number of the IGMP groups a port can join is reached.

Select De ny to drop any new IGMP join report received on this port until an existing multicast forwarding table entry is aged out.

IGMP Filtering Profile

Select Re pla c e to replace an existing entry in the multicast forwarding table with the new IGMP reports received on this port.
Select the name of the IGMP filtering profile to use for this port. Otherwise, select De fa ult to prohibit the port from joining any multicast group.

IGMP Querier Mode

You can create IGMP filtering profiles in the Multic a st > IPv4 Multic a st > IG MP Sno o ping > IG MP Filte ring Pro file screen.
The Switch treats an IGMP query port as being connected to an IGMP multicast router (or server). The Switch forwards IGMP join or leave packets to an IGMP query port.

Select Auto to have the Switch use the port as an IGMP query port if the port receives IGMP query packets.

Select Fixe d to have the Switch always use the port as an IGMP query port. Select this when you connect an IGMP multicast server to the port.

Select Edg e to stop the Switch from using the port as an IGMP query port. The Switch will not keep any record of an IGMP router being connected to this port. The Switch does not forward IGMP join or leave packets to this port.

XS3800-28 User's Guide
277

Chapter 25 Multicast

Table 104 Advanced Application > Multicast > IPv4 Multicast > IGMP Snooping (continued)

LA BEL

DESC RIPTIO N

Apply

Cancel

Click C a nc e l to begin configuring this screen afresh.

25.3.2 IG MP Sno o ping VLAN
Click Adva nc e d Applic a tio n > Multic a st > IPv4 Multic a st in the navigation panel. Click the IG MP Sno o ping link and then the IG MP Sno o ping VLAN link to display the screen as shown. See IGMP Snooping and VLANs on page 270 for more information on IGMP Snooping VLAN.
Fig ure 206 Advanced Application > Multicast > IPv4 Multicast > IGMP Snooping > IGMP Snooping VLAN

The following table describes the labels in this screen.

Table 105 Advanced Application > Multicast > IPv4 Multicast > IGMP Snooping > IGMP Snooping VLAN

LA BEL Mode

DESC RIPTIO N
Select a uto to have the Switch learn multicast group membership information of any VLANs automatically.

Select fixe d to have the Switch only learn multicast group membership information of the VLANs that you specify below.

In either a uto or fixe d mode, the Switch can learn up to 16 VLANs (including up to five VLANs you configured in the MVR screen). For example, if you have configured one multicast VLAN in the MVR screen, you can only specify up to 15 VLANs in this screen.

The Switch drops any IGMP control messages which do not belong to these 16 VLANs.

Apply Cancel

You must also enable IGMP snooping in the Multic a st > IPv4 Multic a st > IG MP Sno o ping screen first.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
278

Table 105 Advanced Application > Multicast > IPv4 Multicast > IGMP Snooping > IGMP Snooping VLAN

LA BEL

DESC RIPTIO N

VLAN

Use this section of the screen to add VLANs upon which the Switch is to perform IGMP snooping.

Name

Enter the descriptive name of the VLAN for identification purposes.

VID

Enter the ID of a static VLAN; the valid range is between 1 and 4094.

Add
Cancel Clear Index Name VID
Delete Cancel

Note: You cannot configure the same VLAN ID as in the MVR screen.
Click this to create a new entry or to update an existing one.
This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Click C a nc e l to reset the fields to your previous configuration. Click C le a r to reset the fields to the factory defaults. This is the index number of the IGMP snooping VLAN entry in the table. Click on an index number to view more details or change the settings. This field displays the descriptive name for this VLAN group. This field displays the ID number of the VLAN group. Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries. Check the entries that you want to remove, then click the De le te button. Click C a nc e l to clear the check boxes.

25.3.3 IG MP Filte ring Pro file
An IGMP filtering profile specifies a range of multicast groups that clients connected to the Switch are able to join. A profile contains a range of multicast IP addresses which you want clients to be able to join. Profiles are assigned to ports (in the IG MP Sno o ping screen). Clients connected to those ports are then able to join the multicast groups specified in the profile. Each port can be assigned a single profile. A profile can be assigned to multiple ports.
Click Adva nc e d Applic a tio n > Multic a st > IPv4 Multic a st in the navigation panel. Click the IG MP Sno o ping link and then the IG MP Filte ring Pro file link to display the screen as shown.
Fig ure 207 Advanced Application > Multicast > IPv4 Multicast > IGMP Snooping > IGMP Filtering Profile

XS3800-28 User's Guide
279

Chapter 25 Multicast

The following table describes the labels in this screen.

Table 106 Advanced Application > Multicast > IPv4 Multicast > IGMP Snooping > IGMP Filtering Profile

LA BEL

DESC RIPTIO N

Profile Name

Enter a descriptive name for the profile for identification purposes.

Start Address End Address

To configure additional rules for a profile that you have already added, enter the profile name and specify a different IP multicast address range.
Type the starting multicast IP address for a range of multicast IP addresses that you want to belong to the IGMP filter profile.
Type the ending multicast IP address for a range of IP addresses that you want to belong to the IGMP filter profile.

Add

If you want to add a single multicast IP address, enter it in both the Sta rt Addre ss and End Addre ss fields.
Click this to create a new entry.

Clear Profile Name Start Address End Address Delete Profile
Delete Rule Delete

Cancel

To delete a rules from a profile, select the rules that you want to remove in the De le te Rule column, then click the De le te button.
Click C a nc e l to clear the De le te Pro file or De le te Rule check boxes.

25.4 IPv6 Multic a st Sta tus
Click Adva nc e d Applic a tio n > Multic a st > IPv6 Multic a st to display the screen as shown. This screen shows the IPv6 multicast group information. See Section 25.1 on page 269 for more information on multicasting.
Fig ure 208 Advanced Application > Multicast > IPv6 Multicast

The following table describes the fields in the above screen.

Table 107 Advanced Application > Multicast > IPv6 Multicast

LA BEL

DESC RIPTIO N

Index

This is the index number of the entry.

VID

This field displays the multicast VLAN ID.

XS3800-28 User's Guide
280

Chapter 25 Multicast

Table 107 Advanced Application > Multicast > IPv6 Multicast (continued)

LA BEL

DESC RIPTIO N

Port

This field displays the port number that belongs to the multicast group. In stacking mode,

the first number represents the slot and the second is the port number.

Multicast Group

This field displays IP multicast group addresses.

Group Timeout

This field displays the time (in seconds) that elapses before the Switch removes a MLD group membership entry if it does not receive report messages from the port.

25.4.1 MLD Sno o ping - pro xy
Click the MLD Sno o ping - pro xy link in the Adva nc e d Applic a tio n > Multic a st > IPv6 Multic a st screen to display the screen as shown. See Section 25.1 on page 269 for more information on multicasting.
Fig ure 209 Advanced Application > Multicast > IPv6Multicast > MLD Snooping-proxy

The following table describes the fields in the above screen.

Table 108 Advanced Application > Multicast > IPv6 Multicast > MLD Snooping-proxy

LA BEL

DESC RIPTIO N

MLD Snooping-proxy Use these settings to configure MLD snooping-proxy.

Active

Select Ac tive to enable MLD snooping-proxy on the Switch to minimize MLD control messages and allow better network performance.

802.1p Priority

Select a priority level (0 7) to which the Switch changes the priority in outgoing MLD messages.

Apply

Cancel

Click C a nc e l to begin configuring this screen afresh.

25.4.2 MLD Sno o ping - pro xy VLAN
Click the VLAN link in the Adva nc e d Applic a tio n > Multic a st > IPv6 Multic a st > MLD Sno o ping - pro xy screen to display the screen as shown. See Section 25.1 on page 269 for more information on multicasting.

XS3800-28 User's Guide
281

Chapter 25 Multicast Fig ure 210 Advanced Application > Multicast > IPv6 Multicast > MLD Snooping-proxy > VLAN

The following table describes the fields in the above screen.

Table 109 Advanced Application > Multicast > IPv6 Multicast > MLD Snooping-proxy > VLAN

LA BEL

DESC RIPTIO N

VID
Upstream Query Interval

Enter the ID number of the VLAN on which you want to enable MLD snooping-proxy and configure related settings.
Enter the amount of time (in miliseconds) between general query messages sent by the router connected to the upstream port. This value should be exactly the same as what is configured in the connected multicast router.

This value is used to calculate the amount of time an MLD snooping membership entry (learned only on the upstream port) can remain in the forwarding table.

Maximum Response Delay

When an MLD Report message is received, the Switch sets the timeout period of the entry to be T = (QI*RV) + MRD, where T = Timeout, QI = Query Interval, RV = Robustness Variable, and MRD = Maximum Response Delay.
Enter the amount of time (in miliseconds) the router connected to the upstream port waits for a response to an MLD general query message. This value should be exactly the same as what is configured in the connected multicast router.

This value is used to calculate the amount of time an MLD snooping membership entry (learned only on the upstream port) can remain in the forwarding table.

Robustness Variable

When an MLD Done message is received, the Switch sets the entry's lifetime to be the product of La st Me m b e r Q ue ry Inte rva l and Ro b ustne ss Va ria b le .
Enter the number of queries. A multicast address entry (learned only on an upstream port by snooping) is removed from the forwarding table when there is no response to the configured number of queries sent by the router connected to the upstream port. This value should be exactly the same as what's configured in the connected multicast router.

This value is used to calculate the amount of time an MLD snooping membership entry (learned only on the upstream port) can remain in the forwarding table.

XS3800-28 User's Guide
282

Chapter 25 Multicast

Table 109 Advanced Application > Multicast > IPv6 Multicast > MLD Snooping-proxy > VLAN

LA BEL
Last Member Query Interval

DESC RIPTIO N
Enter the amount of time (in miliseconds) between the MLD group-specific queries sent by an upstream port when an MLD Done message is received. This value should be exactly the same as what's configured in the connected multicast router.

This value is used to calculate the amount of time an MLD snooping membership entry (learned only on the upstream port) can remain in the forwarding table after a Done message is received.

Downstream Query Interval
Maximum Response Delay Add

When an MLD Done message is received, the Switch sets the entry's lifetime to be the product of La st Me m b e r Q ue ry Inte rva l and Ro b ustne ss Va ria b le .
Enter the amount of time (in miliseconds) between general query messages sent by the downstream port. Enter the maximum time (in miliseconds) that the Switch waits for a response to a general query message sent by the downstream port. Click this to create a new entry or to update an existing one.

Cancel Clear Index VID
Delete Cancel

25.4.3 MLD Sno o ping - pro xy VLAN Po rt Ro le Se tting
Click the Po rt Ro le Se tting link in the Adva nc e d Applic a tio n > Multic a st > IPv6 Multic a st > MLD Sno o ping pro xy > VLAN screen to display the screen as shown. See Section 25.1 on page 269 for more information on multicasting.

XS3800-28 User's Guide
283

Chapter 25 Multicast Fig ure 211 Advanced Application > Multicast > IPv6 Multicast > MLD Snooping-proxy > VLAN > Port Role
Setting (Standalone Mode)
Fig ure 212 Advanced Application > Multicast > IPv6 Multicast > MLD Snooping-proxy > VLAN > Port Role Setting (Stacking Mode)
XS3800-28 User's Guide
284

Chapter 25 Multicast

The following table describes the fields in the above screen.

Table 110 Advanced Application > Multicast > IPv6 Multicast > MLD Snooping-proxy > VLAN > Port Role Setting

LA BEL

DESC RIPTIO N

MLD Snooping-proxy VLAN ID

Select the VLAN ID for which you want to configure a port's MLD snooping-proxy settings.

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This field displays the port number. In stacking mode, the first number represents the slot

ID and the second is the port number. Please note that the default stacking ports (the

last four ports of your Switch) cannot be configured. They are reserved for stacking only.

Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Port Role

Changes in this row are copied to all the ports as soon as you make them.
A port on the Switch can be either a Do wnstre a m port or Upstre a m port in MLD. A downstream port connects to MLD hosts and acts as a multicast router to send MLD queries and listen to the MLD host's Report and Done messages. An upstream port connects to a multicast router and works as a host to send Report or Done messages when receiving queries from a multicast router.

Leave Mode

Otherwise, select No ne if the port is not joining a multicast group or does not belong to this VLAN.
Select the leave mode for the specified downstream ports in this VLAN.

Leave Timeout

This specifies whether the Switch removes an MLD snooping membership entry (learned on a downstream port) immediately (Im m e dia te ) or wait for an MLD report before the leave timeout (No rm a l) or fast leave timeout (Fa st) when an MLD leave message is received on this port from a host.
Enter the MLD snooping normal leave timeout (in milliseconds) the Switch uses to update the forwarding table for the specified downstream ports.

Fast Leave Timeout

Apply Cancel

This defines how many seconds the Switch waits for an MLD report before removing an MLD snooping membership entry (learned on a downstream port) when an MLD Done message is received on this port from a host.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to reset the fields to your previous configuration.

25.4.4 MLD Sno o ping - pro xy Filte ring
Use this screen to configure the Switch's MLD filtering settings. Click the Filte ring link in the Adva nc e d Applic a tio n > Multic a st > IPv6 Multic a st > MLD Sno o ping - pro xy screen to display the screen as shown.

XS3800-28 User's Guide
285

Chapter 25 Multicast Fig ure 213 Advanced Application > Multicast > IPv6 Multicast > MLD Snooping-proxy > Filtering
(Standalone Mode)
Fig ure 214 Advanced Application > Multicast > IPv6 Multicast > MLD Snooping-proxy > Filtering (Stacking Mode)
XS3800-28 User's Guide
286

Chapter 25 Multicast

The following table describes the fields in the above screen.

Table 111 Advanced Application > Multicast > IPv6 Multicast > MLD Snooping-proxy > Filtering

LA BEL

DESC RIPTIO N

Active

Select this option to enable MLD filtering on the Switch.

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This field displays the port number. In stacking mode, the first number represents the slot ID

and the second is the port number. Please note that the default stacking ports (the last four

ports of your Switch) cannot be configured. They are reserved for stacking only.

Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Group Limit Max Group Num.
Filtering Profile

Changes in this row are copied to all the ports as soon as you make them.
Select this option to limit the number of multicast groups this port is allowed to join.
Enter the number of multicast groups this port is allowed to join. Once a port is registered in the specified number of multicast groups, any new MLD Report message is dropped on this port.
Select the name of the MLD filtering profile to use for this port. Otherwise, select De fa ult to prohibit the port from joining any multicast group.

Apply Cancel

You can create MLD filtering profiles in the Multic a st > IPv6 Multic a st > MLD Sno o ping - pro xy > Filte ring > Filte ring Pro file screen.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to reset the fields to your previous configuration.

25.4.5 MLD Sno o ping - pro xy Filte ring Pro file
Use this screen to create an MLD filtering profile and set the range of the multicast addresses. Click the Filte ring Pro file link in the Adva nc e d Applic a tio n > Multic a st > IPv6 Multic a st > MLD Sno o ping - pro xy > Filte ring screen to display the screen as shown.
Fig ure 215 Advanced Application > Multicast > IPv6 Multicast > MLD Snooping-proxy > Filtering > Filtering Profile

XS3800-28 User's Guide
287

Chapter 25 Multicast

The following table describes the fields in the above screen.

Table 112 Advanced Application > Multicast > IPv6 Multicast > MLD Snooping-proxy > Filtering > Filtering Profile

LA BEL

DESC RIPTIO N

Profile Name

Enter a descriptive name for the profile for identification purposes.

Start Address End Address

To configure additional rules for a profile that you have already added, enter the profile name and specify a different IP multicast address range.
Type the starting multicast IPv6 address for a range of multicast IPv6 addresses that you want to belong to the MLD filtering profile.
Type the ending multicast IPv6 address for a range of IPv6 addresses that you want to belong to the MLD filtering profile.

Add

If you want to add a single multicast IPv6 address, enter it in both the Sta rt Addre ss and End Addre ss fields.
Click this to create a new entry.

Clear Profile Name Start Address End Address

Delete Cancel

To delete a rules from a profile, select the rules that you want to remove, then click the De le te button.
Click De le te button to permanently delete the entries you selected.
Click C a nc e l to clear the check boxes.

25.5 G e ne ra l MVR C o nfig ura tio n
Use the MVR screen to create multicast VLANs and select the receiver ports and a source port for each multicast VLAN. Click Adva nc e d Applic a tio n > Multic a st > MVR to display the screen as shown next.
Note: You can create up to five multicast VLANs and up to 256 multicast rules on the Switch.
Note: Your Switch automatically creates a static VLAN (with the same VID) when you create a multicast VLAN in this screen.

XS3800-28 User's Guide
288

Chapter 25 Multicast Fig ure 216 Advanced Application > Multicast > MVR (Standalone Mode)
XS3800-28 User's Guide
289

Chapter 25 Multicast Fig ure 217 Advanced Application > Multicast > MVR (Stacking Mode)

The following table describes the related labels in this screen.

Table 113 Advanced Application > Multicast > MVR

LA BEL

DESC RIPTIO N

Active
Group Name Multicast VLAN ID 802.1p Priority
Mode

Select this check box to enable MVR to allow one single multicast VLAN to be shared among different subscriber VLANs on the network.
Enter a descriptive name (up to 32 printable ASCII characters) for identification purposes.
Enter the VLAN ID (1 to 4094) of the multicast VLAN.
Select a priority level (0 7) with which the Switch replaces the priority in outgoing IGMP or MLD control packets (belonging to this multicast VLAN).
Specify the MVR mode on the Switch. Choices are Dyna m ic and C o m pa tib le .

Select Dyna m ic to send IGMP reports or MLD messages to all MVR source ports in the multicast VLAN.

SLOT Port

Select C o m pa tib le to set the Switch not to send IGMP reports or MLD messages.
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.
This field displays the port number. In stacking mode, the first number represents the slot ID and the second is the port number. Please note that the default stacking ports (the last four ports of your Switch) cannot be configured. They are reserved for stacking only.

XS3800-28 User's Guide
290

Chapter 25 Multicast

Table 113 Advanced Application > Multicast > MVR (continued)

LA BEL

DESC RIPTIO N

Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Source Port Receiver Port None Tagging Add

Changes in this row are copied to all the ports as soon as you make them.
Select this option to set this port as the MVR source port that sends and receives multicast traffic. All source ports must belong to a single multicast VLAN.
Select this option to set this port as a receiver port that only receives multicast traffic.
Select this option to set the port not to participate in MVR. No MVR multicast traffic is sent or received on this port.
Select this check box if you want the port to tag the VLAN ID in all outgoing frames transmitted.
Click this to create a new entry or to update an existing one.

Cancel VLAN Active Name Mode Source Port Receiver Port 802.1p
Delete
Cancel

This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Click C a nc e l to begin configuring this screen afresh. This field displays the multicast VLAN ID. Click on an index number to change the settings.
This field displays whether the multicast group is enabled or not. This field displays the descriptive name for this setting. This field displays the MVR mode. This field displays the source port numbers. This field displays the receiver port numbers. This field displays the priority level. Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries. To delete a multicast VLANs, select the rules that you want to remove, then click the De le te button. Click C a nc e l to clear the check boxes.

25.5.1 MVR G ro up C o nfig ura tio n
All source ports and receiver ports belonging to a multicast group can receive multicast data sent to this multicast group.
Use this screen to configure MVR IP multicast group addresses. Click the G ro up C o nfig ura tio n link in the MVR screen.
Note: A port can belong to more than one multicast VLAN. However, IP multicast group addresses in different multicast VLANs cannot overlap.

XS3800-28 User's Guide
291

Chapter 25 Multicast Fig ure 218 Advanced Application > Multicast > MVR > Group Configuration

The following table describes the labels in this screen.

Table 114 Advanced Application > Multicast > MVR > Group Configuration

LA BEL

DESC RIPTIO N

Multicast VLAN ID Select a multicast VLAN ID (that you configured in the MVR screen) from the drop-down list box.

Group Name

Enter a descriptive name for identification purposes.

Start Address

Enter the starting IP multicast address of the multicast group in dotted decimal notation.

End Address

Enter the ending IP multicast address of the multicast group in dotted decimal notation.

Add

Enter the same IP address as the Sta rt Addre ss field if you want to configure only one IP address for a multicast group.
Click this to create a new entry.

Cancel MVLAN Group Name Start Address End Address

Delete

To delete rules from a profile, select the rules that you want to remove, then click the De le te button.
Select the entries that you want to remove, then click the De le te button to remove the selected entries from the table.

Cancel

If you delete a multicast VLAN, all multicast groups in this VLAN will also be removed. Select C a nc e l to clear the check boxes in the table.

XS3800-28 User's Guide
292

Chapter 25 Multicast
25.5.2 MVR C o nfig ura tio n Exa m ple
The following figure shows a network example where ports 1, 2 and 3 on the Switch belong to VLAN 1. In addition, port 7 belongs to the multicast group with VID 200 to receive multicast traffic (the Ne ws and Mo vie channels) from the remote streaming media server, S. Computers A, B and C in VLAN 1 are able to receive the traffic. Fig ure 219 MVR Configuration Example
To configure the MVR settings on the Switch, create a multicast VLAN in the MVR screen and set the receiver and source ports. Fig ure 220 MVR Configuration Example
EXAMPLE
To set the Switch to forward the multicast group traffic to the subscribers, configure multicast group settings in the G ro up C o nfig ura tio n screen. The following figure shows an example where two IPv4 multicast groups (Ne ws and Mo vie ) are configured for the multicast VLAN 200.
XS3800-28 User's Guide
293

Chapter 25 Multicast Fig ure 221 MVR Group Configuration Example-1
EXAMPLE
Fig ure 222 MVR Group Configuration Example-2
EXAMPLE
XS3800-28 User's Guide
294

C HA PTER 2 6 AAA
26.1 Authe ntic a tio n, Autho riza tio n a nd Ac c o unting (AAA)
This chapter describes how to configure authentication, authorization and accounting settings on the Switch. The external servers that perform authentication, authorization and accounting functions are known as AAA servers. The Switch supports RADIUS (Remote Authentication Dial-In User Service) as the external authentication, authorization, and accounting server. Fig ure 223 AAA Server
26.1.1 Wha t Yo u C a n Do
· Use the AAA screen (Section 26.2 on page 296) to display the links to the screens where you can enable authentication and authorization or both of them on the Switch.
· use the RADIUS Se rve r Se tup screen (Section 26.3 on page 296) to configure your RADIUS server settings.
· Use the TAC AC S+ Se rve r Se tup screen (Section 26.4 on page 298) to configure your TACACS+ authentication settings.
· Use the AAA Se tup screen (Section 26.5 on page 300) to configure authentication, authorization and accounting settings, such as the methods used to authenticate users accessing the Switch and which database the Switch should use first.
26.1.2 Wha t Yo u Ne e d to Kno w
Authentication is the process of determining who a user is and validating access to the Switch. The Switch can authenticate users who try to log in based on user accounts configured on the Switch itself. The Switch can also use an external authentication server to authenticate a large number of users. Authorization is the process of determining what a user is allowed to do. Different user accounts may have higher or lower privilege levels associated with them. For example, user A may have the right to create new login accounts on the Switch but user B cannot. The Switch can authorize users based on user accounts configured on the Switch itself or it can use an external server to authorize a large number of users. Accounting is the process of recording what a user is doing. The Switch can use an external server to track when users log in, log out, execute commands and so on. Accounting can also record system
XS3800-28 User's Guide
295

Chapter 26 AAA

related actions such as boot up and shut down times of the Switch.

Lo c a l Use r Ac c o unts
By storing user profiles locally on the Switch, your Switch is able to authenticate and authorize users without interacting with a network AAA server. However, there is a limit on the number of users you may authenticate in this way.

RADIUS a nd TAC AC S+

RADIUS and TACACS+ are security protocols used to authenticate users by means of an external server instead of (or in addition to) an internal device user database that is limited to the memory capacity of the device. In essence, RADIUS and TACACS+ authentication both allow you to validate an unlimited number of users from a central location.

The following table describes some key differences between RADIUS and TACACS+.

Table 115 RADIUS vs. TACACS+

RA DIUS

Transport Protocol

UDP (User Datagram Protocol)

Encryption

Encrypts the password sent for authentication.

TAC AC S+ TCP (Transmission Control Protocol)
All communication between the client (the Switch) and the TACACS server is encrypted.

26.2 AAA Sc re e ns
The AAA screens allow you to enable authentication and authorization or both of them on the Switch. First, configure your authentication server settings (RADIUS, TACACS+ or both) and then set up the authentication priority, activate authorization.
Click Adva nc e d Applic a tio n > AAA in the navigation panel to display the screen as shown.
Fig ure 224 Advanced Application > AAA

26.3 RADIUS Se rve r Se tup
Use this screen to configure your RADIUS server settings. Click the RADIUS Se rve r Se tup link in the AAA screen to view the screen as shown.
XS3800-28 User's Guide
296

Chapter 26 AAA Fig ure 225 Advanced Application > AAA > RADIUS Server Setup

The following table describes the labels in this screen.

Table 116 Advanced Application > AAA > RADIUS Server Setup

LA BEL

DESC RIPTIO N

Authentication Server

Use this section to configure your RADIUS authentication settings.

Mode

This field is only valid if you configure multiple RADIUS servers.

Select inde x- prio rity and the Switch tries to authenticate with the first configured RADIUS server, if the RADIUS server does not respond then the Switch tries to authenticate with the second RADIUS server.

Timeout

Select ro und- ro b in to alternate between the RADIUS servers that it sends authentication requests to.
Specify the amount of time in seconds that the Switch waits for an authentication request response from the RADIUS server.

Index IP Address UDP Port

If you are using inde x- prio rity for your authentication and you are using two RADIUS servers then the timeout value is divided between the two RADIUS servers. For example, if you set the timeout value to 30 seconds, then the Switch waits for a response from the first RADIUS server for 15 seconds and then tries the second RADIUS server.
This is a read-only number representing a RADIUS server entry.
Enter the IP address of an external RADIUS server in dotted decimal notation.
The default port of a RADIUS server for authentication is 1812. You need not change this value unless your network administrator instructs you to do so.

XS3800-28 User's Guide
297

Chapter 26 AAA

Table 116 Advanced Application > AAA > RADIUS Server Setup (continued)

LA BEL

DESC RIPTIO N

Shared Secret

Specify a password (up to 32 alphanumeric characters) as the key to be shared between the external RADIUS server and the Switch. This key is not sent over the network. This key must be the same on the external RADIUS server and the Switch.

Delete

Check this box if you want to remove an existing RADIUS server entry from the Switch. This entry is deleted when you click Apply.

Accounting Server

Use this section to configure your RADIUS accounting server settings.

Timeout

Specify the amount of time in seconds that the Switch waits for an accounting request response from the RADIUS accounting server.

Index

This is a read-only number representing a RADIUS accounting server entry.

IP Address

Enter the IP address of an external RADIUS accounting server in dotted decimal notation.

UDP Port

The default port of a RADIUS accounting server for accounting is 1813. You need not change this value unless your network administrator instructs you to do so.

Shared Secret

Specify a password (up to 32 alphanumeric characters) as the key to be shared between the external RADIUS accounting server and the Switch. This key is not sent over the network. This key must be the same on the external RADIUS accounting server and the Switch.

Delete

Check this box if you want to remove an existing RADIUS accounting server entry from the Switch. This entry is deleted when you click Apply.

Attribute

Use this section to define the RADIUS server attribute for its account.

NAS-IP-Address Enter the IP address of the NAS (Network Access Server).

Apply

Cancel

Click C a nc e l to begin configuring this screen afresh.

26.4 TAC AC S+ Se rve r Se tup
Use this screen to configure your TACACS+ server settings. Click on the TAC AC S+ Se rve r Se tup link in the AAA screen to view the screen as shown.

XS3800-28 User's Guide
298

Chapter 26 AAA Fig ure 226 Advanced Application > AAA > TACACS+ Server Setup

The following table describes the labels in this screen.

Table 117 Advanced Application > AAA > TACACS+ Server Setup

LA BEL

DESC RIPTIO N

Authentication Server

Use this section to configure your TACACS+ authentication settings.

Mode

This field is only valid if you configure multiple TACACS+ servers.

Select inde x- prio rity and the Switch tries to authenticate with the first configured TACACS+ server, if the TACACS+ server does not respond then the Switch tries to authenticate with the second TACACS+ server.

Timeout

Select ro und- ro b in to alternate between the TACACS+ servers that it sends authentication requests to.
Specify the amount of time in seconds that the Switch waits for an authentication request response from the TACACS+ server.

Index IP Address TCP Port
Shared Secret

If you are using inde x- prio rity for your authentication and you are using two TACACS+ servers then the timeout value is divided between the two TACACS+ servers. For example, if you set the timeout value to 30 seconds, then the Switch waits for a response from the first TACACS+ server for 15 seconds and then tries the second TACACS+ server.
This is a read-only number representing a TACACS+ server entry.
Enter the IP address of an external TACACS+ server in dotted decimal notation.
The default port of a TACACS+ server for authentication is 49. You need not change this value unless your network administrator instructs you to do so.
Specify a password (up to 32 alphanumeric characters) as the key to be shared between the external TACACS+ server and the Switch. This key is not sent over the network. This key must be the same on the external TACACS+ server and the Switch.

XS3800-28 User's Guide
299

Chapter 26 AAA

Table 117 Advanced Application > AAA > TACACS+ Server Setup (continued)

LA BEL

DESC RIPTIO N

Delete

Check this box if you want to remove an existing TACACS+ server entry from the Switch. This entry is deleted when you click Apply.

Accounting Server

Use this section to configure your TACACS+ accounting settings.

Timeout

Specify the amount of time in seconds that the Switch waits for an accounting request response from the TACACS+ server.

Index

This is a read-only number representing a TACACS+ accounting server entry.

IP Address

Enter the IP address of an external TACACS+ accounting server in dotted decimal notation.

TCP Port

The default port of a TACACS+ accounting server is 49. You need not change this value unless your network administrator instructs you to do so.

Shared Secret

Specify a password (up to 32 alphanumeric characters) as the key to be shared between the external TACACS+ accounting server and the Switch. This key is not sent over the network. This key must be the same on the external TACACS+ accounting server and the Switch.

Delete

Check this box if you want to remove an existing TACACS+ accounting server entry from the Switch. This entry is deleted when you click Apply.

Apply

Cancel

Click C a nc e l to begin configuring this screen afresh.

26.5 AAA Se tup
Use this screen to configure authentication, authorization and accounting settings on the Switch. Click on the AAA Se tup link in the AAA screen to view the screen as shown.
Fig ure 227 Advanced Application > AAA > AAA Setup

XS3800-28 User's Guide
300

Chapter 26 AAA

The following table describes the labels in this screen.

Table 118 Advanced Application > AAA > AAA Setup

LA BEL

DESC RIPTIO N

Authentication Use this section to specify the methods used to authenticate users accessing the Switch.

Privilege Enable

These fields specify which database the Switch should use (first, second and third) to authenticate access privilege level for administrator accounts (users for Switch management).

Configure the access privilege of accounts via commands (see the Ethernet Switch CLI Reference Guide) for lo c a l authentication. The TAC AC S+ and RADIUS are external servers. Before you specify the priority, make sure you have set up the corresponding database correctly first.

You can specify up to three methods for the Switch to authenticate the access privilege level of administrators. The Switch checks the methods in the order you configure them (first Me tho d 1, then Me tho d 2 and finally Me tho d 3). You must configure the settings in the Me tho d 1 field. If you want the Switch to check other sources for access privilege level specify them in Me tho d 2 and Me tho d 3 fields.

Select lo c a l to have the Switch check the access privilege configured for local authentication.

Select ra dius or ta c a c s+ to have the Switch check the access privilege via the external servers.
These fields specify which database the Switch should use (first, second and third) to authenticate administrator accounts (users for Switch management).

Configure the local user accounts in the Ac c e ss C o ntro l > Lo g ins screen. The TACACS+ and RADIUS are external servers. Before you specify the priority, make sure you have set up the corresponding database correctly first.

You can specify up to three methods for the Switch to authenticate administrator accounts. The Switch checks the methods in the order you configure them (first Me tho d 1, then Me tho d 2 and finally Me tho d 3). You must configure the settings in the Me tho d 1 field. If you want the Switch to check other sources for administrator accounts, specify them in Me tho d 2 and Me tho d 3 fields.

Select lo c a l to have the Switch check the administrator accounts configured in the Ac c e ss C o ntro l > Lo g ins screen.

Select ra dius to have the Switch check the administrator accounts configured via the RADIUS Server.

Authorization Type

Select ta c a c s+ to have the Switch check the administrator accounts configured via the TACACS+ Server.
Use this section to configure authorization settings on the Switch.
Set whether the Switch provides the following services to a user.

Active Console
Method

· Exe c : Allow an administrator which logs into the Switch through Telnet or SSH to have a different access privilege level assigned via the external server.
· Do t1x: Allow an IEEE 802.1x client to have different bandwidth limit or VLAN ID assigned via the external server.
Select this to activate authorization for a specified event types.
Select this to allow an administrator which logs in the Switch through the console port to have different access privilege level assigned via the external server.
Select whether you want to use RADIUS or TACACS+ for authorization of specific types of events.

Accounting Update Period

RADIUS is the only method for IEEE 802.1x authorization.
Use this section to configure accounting settings on the Switch.
This is the amount of time in minutes before the Switch sends an update to the accounting server. This is only valid if you select the sta rt- sto p option for the Exe c or Do t1x entries.

XS3800-28 User's Guide
301

Chapter 26 AAA

Table 118 Advanced Application > AAA > AAA Setup (continued)

LA BEL

DESC RIPTIO N

Type

The Switch supports the following types of events to be sent to the accounting servers:

Active Broadcast

· Syste m Configure the Switch to send information when the following system events occur: system boots up, system shuts down, system accounting is enabled, system accounting is disabled.
· Exe c Configure the Switch to send information when an administrator logs in and logs out via the console port, telnet or SSH.
· Do t1x Configure the Switch to send information when an IEEE 802.1x client begins a session (authenticates via the Switch), ends a session as well as interim updates of a session.
· C o m m a nds Configure the Switch to send information when commands of specified privilege level and higher are executed on the Switch.
Select this to activate accounting for a specified event types.
Select this to have the Switch send accounting information to all configured accounting servers at the same time.

Mode

If you do not select this and you have two accounting servers set up, then the Switch sends information to the first accounting server and if it does not get a response from the accounting server then it tries the second accounting server.
The Switch supports two modes of recording login events. Select:

· sta rt- sto p to have the Switch send information to the accounting server when a user begins a session, during a user's session (if it lasts past the Upda te Pe rio d), and when a user ends a session.

Method

· sto p- o nly to have the Switch send information to the accounting server only when a user ends a session.
Select whether you want to use RADIUS or TACACS+ for accounting of specific types of events.

Privilege Apply Cancel

TACACS+ is the only method for recording C o m m a nds type of event.
This field is only configurable for C o m m a nds type of event. Select the threshold command privilege level for which the Switch should send accounting information. The Switch will send accounting information when commands at the level you specify and higher are executed on the Switch.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

26.6 Te c hnic a l Re fe re nc e
This section provides technical background information on the topics discussed in this chapter.
26.6.1 Ve ndo r Spe c ific Attrib ute
RFC 2865 standard specifies a method for sending vendor-specific information between a RADIUS server and a network access device (for example, the Switch). A company can create Vendor Specific Attributes (VSAs) to expand the functionality of a RADIUS server.
The Switch supports VSAs that allow you to perform the following actions based on user authentication:
· Limit bandwidth on incoming or outgoing traffic for the port the user connects to. · Assign account privilege levels (See the CLI Reference Guide for more information on account
privilege levels) for the authenticated user. XS3800-28 User's Guide
302

Chapter 26 AAA
The VSAs are composed of the following:
· Ve ndo r- ID: An identification number assigned to the company by the IANA (Internet Assigned Numbers Authority). Zyxel's vendor ID is 890.
· Ve ndo r- Type : A vendor specified attribute, identifying the setting you want to modify. · Ve ndo r- da ta : A value you want to assign to the setting.
Note: Refer to the documentation that comes with your RADIUS server on how to configure VSAs for users authenticating via the RADIUS server.
The following table describes the VSAs supported on the Switch. Note that these attributes only work when you enable authorization (see Section 26.5 on page 300).

Table 119 Supported VSAs

FUNC TIO N Ingress Bandwidth Assignment
Egress Bandwidth Assignment
Privilege Assignment

A TTRIBUTE
Vendor-Id = 890 Vendor-Type = 1 Vendor-data = ingress rate (Kbps in decimal format)
Vendor-Id = 890 Vendor-Type = 2 Vendor-data = egress rate (Kbps in decimal format)
Vendor-ID = 890 Vendor-Type = 3 Vendor-Data = "shell:priv-lvl=N"
or
Vendor-ID = 9 (CISCO) Vendor-Type = 1 (CISCO-AVPAIR) Vendor-Data = "shell:priv-lvl=N"
where N is a privilege level (from 0 to 14).
Note: If you set the privilege level of a login account differently on the RADIUS servers and the Switch, the user is assigned a privilege level from the database (RADIUS or local) the Switch uses first for user authentication.

26.6.1.1 Tunne l Pro to c o l Attrib ute
You can configure tunnel protocol attributes on the RADIUS server (refer to your RADIUS server documentation) to assign a port on the Switch to a VLAN based on IEEE 802.1x authentication. The port VLAN settings are fixed and untagged. This will also set the port's VID. The following table describes the values you need to configure. Note that these attributes only work when you enable authorization (see Section 26.5 on page 300).

XS3800-28 User's Guide
303

Chapter 26 AAA

Table 120 Supported Tunnel Protocol Attribute

FUNC TIO N VLAN Assignment

A TTRIBUTE
Tunnel-Type = VLAN(13) Tunnel-Medium-Type = 802(6) Tunnel-Private-Group-ID = VLAN ID
Note: You must also create a VLAN with the specified VID on the Switch.

Note: The bolded values in this table are fixed values as defined in RFC 3580.

26.6.2 Suppo rte d RADIUS Attrib ute s
Remote Authentication Dial-In User Service (RADIUS) attributes are data used to define specific authentication elements in a user profile, which is stored on the RADIUS server. This section lists the RADIUS attributes supported by the Switch.
Refer to RFC 2865 for more information about RADIUS attributes used for authentication.
Refer to RFC 2866 and RFC 2869 for RADIUS attributes used for accounting.
This section lists the attributes used by authentication functions on the Switch. In cases where the attribute has a specific format associated with it, the format is specified.
26.6.3 Attrib ute s Use d fo r Authe ntic a tio n
The following sections list the attributes sent from the Switch to the RADIUS server when performing authentication.
26.6.3.1 Attrib ute s Use d fo r Authe ntic a ting Privile g e Ac c e ss
User-Name The format of the User-Name attribute is $e na b#$, where # is the privilege level (1 14).
User-Password NAS-Identifier NAS-IP-Address
26.6.3.2 Attrib ute s Use d to Lo g in Use rs
User-Name User-Password NAS-Identifier NAS-IP-Address

XS3800-28 User's Guide
304

Chapter 26 AAA

26.6.3.3 Attrib ute s Use d b y the IEEE 802.1x Authe ntic a tio n
User-Name NAS-Identifier NAS-IP-Address NAS-Port NAS-Port-Type
This value is set to Ethe rne t(15) on the Switch. Calling-Station-Id Frame-MTU EAP-Message State Message-Authenticator

26.6.4 Attrib ute s Use d fo r Ac c o unting

The following sections list the attributes sent from the Switch to the RADIUS server when performing authentication.

26.6.4.1 Attrib ute s Use d fo r Ac c o unting Syste m Eve nts
NAS-IP-Address NAS-Identifier Acct-Status-Type Acct-Session-ID
The format of Acct-Session-Id is da te +tim e +8- dig it se q ue ntia l num b e r, for example, 2007041917210300000001. (date: 2007/04/19, time: 17:21:03, serial number: 00000001) Acct-Delay-Time

26.6.4.2 Attrib ute s Use d fo r Ac c o unting Exe c Eve nts

The attributes are listed in the following table along with the time that they are sent (the difference between Console and Telnet/SSH Exec events is that the Telnet/SSH events utilize the Calling-Station-Id attribute):

Table 121 RADIUS Attributes Exec Events via Console

A TTRIBUTE

STA RT

INTERIM- UPDATE

User-Name

NAS-Identifier

NAS-IP-Address

Service-Type

Acct-Status-Type

Acct-Delay-Time

Acct-Session-Id

Acct-Authentic

STO P

XS3800-28 User's Guide
305

Chapter 26 AAA

Table 121 RADIUS Attributes Exec Events via Console (continued)

A TTRIBUTE

STA RT

INTERIM- UPDATE

Acct-Session-Time

Acct-Terminate-Cause

Table 122 RADIUS Attributes Exec Events via Telnet/SSH

A TTRIBUTE

STA RT

INTERIM- UPDATE

User-Name

NAS-Identifier

NAS-IP-Address

Service-Type

Calling-Station-Id

Acct-Status-Type

Acct-Delay-Time

Acct-Session-Id

Acct-Authentic

Acct-Session-Time

Acct-Terminate-Cause

STO P

26.6.4.3 Attrib ute s Use d fo r Ac c o unting IEEE 802.1x Eve nts

The attributes are listed in the following table along with the time of the session they are sent:

Table 123 RADIUS Attributes Exec Events via Console

A TTRIBUTE

STA RT

INTERIM- UPDATE

User-Name

NAS-IP-Address

NAS-Port

Class

Called-Station-Id

Calling-Station-Id

NAS-Identifier

NAS-Port-Type

Acct-Status-Type

Acct-Delay-Time

Acct-Session-Id

Acct-Authentic

Acct-Input-Octets

Acct-Output-Octets

Acct-Session-Time

Acct-Input-Packets

STO P

XS3800-28 User's Guide
306

Chapter 26 AAA

Table 123 RADIUS Attributes Exec Events via Console (continued)

A TTRIBUTE

STA RT

INTERIM- UPDATE

Acct-Output-Packets

Acct-Terminate-Cause

Acct-Input-Gigawords

Acct-Output-Gigawords

STO P

XS3800-28 User's Guide
307

Chapter 27 IP Source Guard
C HA PTER 2 7 IP So urc e G ua rd
27.1 IP So urc e G ua rd O ve rvie w
IP source guard uses a binding table to distinguish between authorized and unauthorized DHCP and ARP packets in your network. A binding contains these key attributes: · MAC address · VLAN ID · IP address · Port number When the Switch receives a DHCP or ARP packet, it looks up the appropriate MAC address, VLAN ID, IP address, and port number in the binding table. If there is a binding, the Switch forwards the packet. If there is not a binding, the Switch discards the packet. The Switch builds the binding table by snooping DHCP packets (dynamic bindings) and from information provided manually by administrators (static bindings). IP source guard consists of the following features: · Static bindings. Use this to create static bindings in the binding table. · DHCP snooping. Use this to filter unauthorized DHCP packets on the network and to build the binding
table dynamically. · ARP inspection. Use this to filter unauthorized ARP packets on the network. If you want to use dynamic bindings to filter unauthorized ARP packets (typical implementation), you have to enable DHCP snooping before you enable ARP inspection.
27.1.1 Wha t Yo u C a n Do
· Use the IP So urc e G ua rd screen (Section 27.3 on page 310) to look at the current bindings for DHCP snooping and ARP inspection.
· Use the IP So urc e G ua rd Sta tic Binding screen (Section 27.4 on page 310) to manage static bindings for DHCP snooping and ARP inspection.
27.1.2 Wha t Yo u Ne e d to Kno w
The Switch builds the binding table by snooping DHCP packets (dynamic bindings) and from information provided manually by administrators (static bindings). IP source guard consists of the following features:
XS3800-28 User's Guide
308

· Static bindings. Use this to create static bindings in the binding table. · DHCP snooping. Use this to filter unauthorized DHCP packets on the network and to build the binding
table dynamically. · ARP inspection. Use this to filter unauthorized ARP packets on the network.
If you want to use dynamic bindings to filter unauthorized ARP packets (typical implementation), you have to enable DHCP snooping before you enable ARP inspection.
27.2 IP So urc e G ua rd
Use this screen to look at the current bindings for DHCP snooping and ARP inspection. Bindings are used by DHCP snooping and ARP inspection to distinguish between authorized and unauthorized packets in the network. The Switch learns the bindings by snooping DHCP packets (dynamic bindings) and from information provided manually by administrators (static bindings). To open this screen, click Adva nc e d Applic a tio n > IP So urc e G ua rd.
Fig ure 228 Advanced Application > IP Source Guard

The following table describes the labels in this screen.

Table 124 Advanced Application > IP Source Guard

LA BEL

DESC RIPTIO N

IPv4 Source Guard Setup

Click the link to open screens where you can view and manage static bindings, configure DHCP snooping or ARP inspection and look at various statistics.

IPv6 Source Binding Status

Click the link to open a screen where you can view the current IPv6 dynamic and static bindings or remove dynamic bindings based on IPv6 address and/or IPv6 prefix.

IPv6 Static Binding Setup

Click the link to open a screen where you can manually create IPv6 source guard static binding entries.

IPv6 Source Guard Policy Setup

Click the link to open a screen where you can define policies to have IPv6 source guard forward valid addresses and/or prefixes and allow or block data traffic from all link-local addresses.

IPv6 Source Guard Port Setup

Click the link to open a screen where you can apply the configured IPv6 source guard policy to a port.

IPv6 Snooping Policy Click the link to open a screen where you can set up DHCPv6 snooping policies for the

Setup

binding table.

IPv6 Snooping VLAN Setup

Click the link to open a screen where you can enable a DHCPv6 snooping policy on a specific VLAN interface.

IPv6 DHCP Trust Setup Click the link to open a screen where you can specify which ports are trusted for DHCPv6 snooping.

XS3800-28 User's Guide
309

Chapter 27 IP Source Guard
27.3 IPv4 So urc e G ua rd Se tup
Use this screen to look at the current bindings for DHCP snooping and ARP inspection. Bindings are used by DHCP snooping and ARP inspection to distinguish between authorized and unauthorized packets in the network. The Switch learns the bindings by snooping DHCP packets (dynamic bindings) and from information provided manually by administrators (static bindings). To open this screen, click Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv4 So urc e G ua rd Se tup.
Fig ure 229 Advanced Application > IP Source Guard > IPv4 Source Guard Setup

The following table describes the labels in this screen.

Table 125 Advanced Application > IP Source Guard > IPv4 Source Guard Setup

LA BEL

DESC RIPTIO N

Index IP Address VLAN MAC Address Port
Lease
Type

This field displays a sequential number for each binding.
This field displays the IP address assigned to the MAC address in the binding.
This field displays the source VLAN ID in the binding.
This field displays the source MAC address in the binding.
This field displays the port number in the binding. If this field is blank, the binding applies to all ports.
This field displays how many days, hours, minutes, and seconds the binding is valid; for example, 2d3h4m 5s means the binding is still valid for 2 days, 3 hours, 4 minutes, and 5 seconds. This field displays infinity if the binding is always valid (for example, a static binding).
This field displays how the Switch learned the binding.

sta tic : This binding was learned from information provided manually by an administrator.

dhc p- sno o ping : This binding was learned by snooping DHCP packets.

27.4 IPv4 So urc e G ua rd Sta tic Binding
Use this screen to manage static bindings for DHCP snooping and ARP inspection. Static bindings are uniquely identified by the MAC address and VLAN ID. Each MAC address and VLAN ID can only be in one static binding. If you try to create a static binding with the same MAC address and VLAN ID as an existing static binding, the new static binding replaces the original one. To open this screen, click Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv4 So urc e G ua rd Se tup > Sta tic Binding .

XS3800-28 User's Guide
310

Fig ure 230 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > Static Binding (Standalone Mode)
Fig ure 231 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > Static Binding (Stacking Mode)
XS3800-28 User's Guide
311

Chapter 27 IP Source Guard

The following table describes the labels in this screen.

Table 126 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > Static Binding

LA BEL

DESC RIPTIO N

ARP Freeze

ARP Freeze allows you to automatically create static bindings from the current ARP entries (either dynamically learned or static ARP entries) until the Switch's binding table is full.

Condition
Static Binding IP Address VLAN MAC Address Port
Add
Cancel Clear Index IP Address VLAN MAC Address Port Lease Type
Delete Cancel

Note: The ARP learning mode should be set to ARP- Re que st in the IP Applic a tio n > ARP Se tup > ARP Le a rning screen before you use the ARP Freeze feature.
All Select this and click ARP Fre e ze to have the Switch automatically add all the current ARP entries to the static bindings table.
Po rt List Select this and enter the number of the ports (separated by a comma).
ARP entries learned on the specified ports are added to the static bindings table after you click ARP Fre e ze .
VLAN List Select this and enter the ID number of the VLANs (separated by a comma). ARP entries for the specified VLANs are added to the static bindings table after you click ARP Fre e ze .
Enter the IP address assigned to the MAC address in the binding. Enter the source VLAN ID in the binding. Enter the source MAC address in the binding. If this binding applies to all MAC addresses, select Any. Specify the ports in the binding. If this binding has one port, select the first radio button and enter the port number in the field to the right. In stacking mode, the first field is the slot ID and the second field is the port number. If this binding applies to all ports, select Any. Click this to create a new entry or to update an existing one.
This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Click this to reset the values above based on the last selected static binding or, if not applicable, to clear the fields above. Click C le a r to reset the fields to the factory defaults. This field displays a sequential number for each binding. Click on an index number to view more details or change the settings. This field displays the IP address assigned to the MAC address in the binding. This field displays the source VLAN ID in the binding. This field displays the source MAC address in the binding. This field displays the port number. In stacking mode, the first number represents the slot ID and the second is the port number. This field displays how long the binding is valid. This field displays how the Switch learned the binding.
sta tic : This binding was learned from information provided manually by an administrator. Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries. Select the entries that you want to remove, then click the De le te button to remove the selected entries from the table. Click this to clear the check boxes above.

XS3800-28 User's Guide
312

Chapter 28 DHCP Snooping
C HA PTER 2 8 DHC P Sno o ping
28.1 DHC P Sno o ping O ve rvie w
With DHCP snooping, the Switch can build the binding table dynamically by snooping DHCP packets (dynamic bindings) and filter unauthorized DHCP packets in your network.
The Switch uses a binding table to distinguish between authorized and unauthorized DHCP packets in your network. A binding contains these key attributes:
· MAC address · VLAN ID · IP address · Port number When the Switch receives a DHCP packet, it looks up the appropriate MAC address, VLAN ID, IP address, and port number in the binding table. If there is a binding, the Switch forwards the packet. If there is not a binding, the Switch discards the packet.
28.1.1 Wha t Yo u C a n Do
· Use the DHC P Sno o ping screen (Section 28.2 on page 313) to look at various statistics about the DHCP snooping database.
· Use this DHC P Sno o ping C o nfig ure screen (Section 28.3 on page 316) to enable DHCP snooping on the Switch (not on specific VLAN), specify the VLAN where the default DHCP server is located, and configure the DHCP snooping database.
· Use the DHC P Sno o ping Po rt C o nfig ure screen (Section 28.3.1 on page 317) to specify whether ports are trusted or untrusted ports for DHCP snooping.
· Use the DHC P Sno o ping VLAN C o nfig ure screen (Section 28.3.2 on page 319) to enable DHCP snooping on each VLAN and to specify whether or not the Switch adds DHCP relay agent option 82 information to DHCP requests that the Switch relays to a DHCP server for each VLAN.
· Use the DHC P Sno o ping VLAN Po rt C o nfig ure screen (Section 28.3.3 on page 320) to apply a different DHCP option 82 profile to certain ports in a VLAN.
28.2 DHC P Sno o ping
Use this screen to look at various statistics about the DHCP snooping database.
To open this screen, click Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv4 So urc e G ua rd Se tup > DHC P Sno o ping .
XS3800-28 User's Guide
313

Chapter 28 DHCP Snooping Fig ure 232 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > DHCP Snooping

The following table describes the labels in this screen.

Table 127 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > DHCP Snooping

LA BEL

DESC RIPTIO N

Database Status

This section displays the current settings for the DHCP snooping database. You can configure them in the DHC P Sno o ping C o nfig ure screen.

Agent URL

This field displays the location of the DHCP snooping database.

Write delay timer

This field displays how long (in seconds) the Switch tries to complete a specific update in the DHCP snooping database before it gives up.

Abort timer

This field displays how long (in seconds) the Switch waits to update the DHCP snooping database after the current bindings change.

This section displays information about the current update and the next update of the DHCP snooping database.

XS3800-28 User's Guide
314

Table 127 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > DHCP Snooping

LA BEL Agent running

DESC RIPTIO N
This field displays the status of the current update or access of the DHCP snooping database.

no ne : The Switch is not accessing the DHCP snooping database.

re a d: The Switch is loading dynamic bindings from the DHCP snooping database.

Delay timer expiry
Abort timer expiry
Last succeeded time Last failed time Last failed reason
Total attempts Startup failures
Successful transfers Failed transfers Successful reads Failed reads Successful writes Failed writes Database detail First successful access Last ignored bindings counters Binding collisions Invalid interfaces Parse failures

write : The Switch is updating the DHCP snooping database.
This field displays how much longer (in seconds) the Switch tries to complete the current update before it gives up. It displays No t Running if the Switch is not updating the DHCP snooping database right now.
This field displays when (in seconds) the Switch is going to update the DHCP snooping database again. It displays No t Running if the current bindings have not changed since the last update.
This section displays information about the last time the Switch updated the DHCP snooping database.
This field displays the last time the Switch updated the DHCP snooping database successfully.
This field displays the last time the Switch updated the DHCP snooping database unsuccessfully.
This field displays the reason the Switch updated the DHCP snooping database unsuccessfully.
This section displays historical information about the number of times the Switch successfully or unsuccessfully read or updated the DHCP snooping database.
This field displays the number of times the Switch has tried to access the DHCP snooping database for any reason.
This field displays the number of times the Switch could not create or read the DHCP snooping database when the Switch started up or a new URL is configured for the DHCP snooping database.
This field displays the number of times the Switch read bindings from or updated the bindings in the DHCP snooping database successfully.
This field displays the number of times the Switch was unable to read bindings from or update the bindings in the DHCP snooping database.
This field displays the number of times the Switch read bindings from the DHCP snooping database successfully.
This field displays the number of times the Switch was unable to read bindings from the DHCP snooping database.
This field displays the number of times the Switch updated the bindings in the DHCP snooping database successfully.
This field displays the number of times the Switch was unable to update the bindings in the DHCP snooping database.
This field displays the first time the Switch accessed the DHCP snooping database for any reason.
This section displays the number of times and the reasons the Switch ignored bindings the last time it read bindings from the DHCP binding database. You can clear these counters by restarting the Switch or using CLI commands. See the Ethernet Switch CLI Reference Guide.
This field displays the number of bindings the Switch ignored because the Switch already had a binding with the same MAC address and VLAN ID.
This field displays the number of bindings the Switch ignored because the port number was a trusted interface or does not exist anymore.
This field displays the number of bindings the Switch ignored because the Switch was unable to understand the binding in the DHCP binding database.

XS3800-28 User's Guide
315

Chapter 28 DHCP Snooping

Table 127 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > DHCP Snooping

LA BEL

DESC RIPTIO N

Expired leases

This field displays the number of bindings the Switch ignored because the lease time had already expired.

Unsupported vlans

This field displays the number of bindings the Switch ignored because the VLAN ID does not exist anymore.

Last ignored time

This field displays the last time the Switch ignored any bindings for any reason from the DHCP binding database.

Total ignored bindings counters

This section displays the reasons the Switch has ignored bindings any time it read bindings from the DHCP binding database. You can clear these counters by restarting the Switch or using CLI commands. See the Ethernet Switch CLI Reference Guide.

Binding collisions

This field displays the number of bindings the Switch has ignored because the Switch already had a binding with the same MAC address and VLAN ID.

Invalid interfaces

This field displays the number of bindings the Switch has ignored because the port number was a trusted interface or does not exist anymore.

Parse failures

This field displays the number of bindings the Switch has ignored because the Switch was unable to understand the binding in the DHCP binding database.

Expired leases

This field displays the number of bindings the Switch has ignored because the lease time had already expired.

Unsupported vlans

This field displays the number of bindings the Switch has ignored because the VLAN ID does not exist anymore.

28.3 DHC P Sno o ping C o nfig ure
Use this screen to enable DHCP snooping on the Switch (not on specific VLAN), specify the VLAN where the default DHCP server is located, and configure the DHCP snooping database. The DHCP snooping database stores the current bindings on a secure, external TFTP server so that they are still available after a restart.
To open this screen, click Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv4 So urc e G ua rd Se tup > DHC P Sno o ping > C o nfig ure .
Fig ure 233 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > DHCP Snooping > Configure

XS3800-28 User's Guide
316

The following table describes the labels in this screen.

Table 128 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > DHCP Snooping > Configure

LA BEL

DESC RIPTIO N

Active

Select this to enable DHCP snooping on the Switch. You still have to enable DHCP snooping on specific VLAN and specify trusted ports.

DHCP Vlan

Note: The Switch will drop all DHCP requests if you enable DHCP snooping and there are no trusted ports.
Select a VLAN ID if you want the Switch to forward DHCP packets to DHCP servers on a specific VLAN.

Note: You have to enable DHCP snooping on the DHCP VLAN too.

Database Agent URL Timeout interval Write delay interval Renew DHCP Snooping URL
Apply Cancel

You can select an option 82 profile in the DHC P Sno o ping VLAN C o nfig ure screen to help the DHCP servers distinguish between DHCP requests from different VLAN.
Select Disa b le if you do not want the Switch to forward DHCP packets to a specific VLAN.
If Tim e o ut inte rva l is greater than Write de la y inte rva l, it is possible that the next update is scheduled to occur before the current update has finished successfully or timed out. In this case, the Switch waits to start the next update until it completes the current one.
Enter the location of the DHCP snooping database. The location should be expressed like this: tftp:/ / {do m a in na m e o r IP a ddre ss}/ dire c to ry, if a pplic a b le / file na m e ; for example,
tftp:/ / 192.168.10.1/ da ta b a se .txt.
Enter how long (10 65535 seconds) the Switch tries to complete a specific update in the DHCP snooping database before it gives up.
Enter how long (10 65535 seconds) the Switch waits to update the DHCP snooping database the first time the current bindings change after an update. Once the next update is scheduled, additional changes in current bindings are automatically included in the next update.
Enter the location of a DHCP snooping database, and click Re ne w if you want the Switch to load it. You can use this to load dynamic bindings from a different DHCP snooping database than the one specified in Ag e nt URL.
When the Switch loads dynamic bindings from a DHCP snooping database, it does not discard the current dynamic bindings first. If there is a conflict, the Switch keeps the dynamic binding in volatile memory and updates the Binding c o llisio ns counter in the DHC P Sno o ping screen.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click this to reset the values in this screen to their last-saved values.

28.3.1 DHC P Sno o ping Po rt C o nfig ure
Use this screen to specify whether ports are trusted or untrusted ports for DHCP snooping.
Note: The Switch will drop all DHCP requests if you enable DHCP snooping and there are no trusted ports.
You can also specify the maximum number for DHCP packets that each port (trusted or untrusted) can receive each second.
To open this screen, click Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv4 So urc e G ua rd Se tup > DHC P Sno o ping > C o nfig ure > Po rt.

XS3800-28 User's Guide
317

Chapter 28 DHCP Snooping Fig ure 234 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > DHCP Snooping >
Configure > Port (Standalone Mode)
Fig ure 235 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > DHCP Snooping > Configure > Port (Stacking Mode)

The following table describes the labels in this screen.

Table 129 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > DHCP Snooping > Configure > Port

LA BEL

DESC RIPTIO N

SLOT Port

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.
This field displays the port number. In stacking mode, the first number represents the slot ID and the second is the port number. Please note that the default stacking ports (the last four ports of your Switch) cannot be configured. They are reserved for stacking only.

Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Note: Changes in this row are copied to all the ports as soon as you make them.

XS3800-28 User's Guide
318

Chapter 28 DHCP Snooping

Table 129 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > DHCP Snooping > Configure > Port (continued)

LA BEL Server Trusted state

DESC RIPTIO N Select whether this port is a trusted port (Truste d) or an untrusted port (Untruste d).

Trusted ports are connected to DHCP servers or other switches, and the Switch discards DHCP packets from trusted ports only if the rate at which DHCP packets arrive is too high.

Untrusted ports are connected to subscribers, and the Switch discards DHCP packets from untrusted ports in the following situations:

Rate (pps) Apply Cancel

· The packet is a DHCP server packet (for example, OFFER, ACK, or NACK). · The source MAC address and source IP address in the packet do not match any of the
current bindings. · The packet is a RELEASE or DECLINE packet, and the source MAC address and source
port do not match any of the current bindings. · The rate at which DHCP packets arrive is too high.
Specify the maximum number for DHCP packets (1 2048) that the Switch receives from each port each second. The Switch discards any additional DHCP packets. Enter 0 to disable this limit, which is recommended for trusted ports.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click this to reset the values in this screen to their last-saved values.

28.3.2 DHC P Sno o ping VLAN C o nfig ure
Use this screen to enable DHCP snooping on each VLAN and to specify whether or not the Switch adds DHCP relay agent option 82 information to DHCP requests that the Switch relays to a DHCP server for each VLAN.
To open this screen, click Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv4 So urc e G ua rd Se tup > DHC P Sno o ping > C o nfig ure > VLAN.
Fig ure 236 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > DHCP Snooping > Configure > VLAN

XS3800-28 User's Guide
319

Chapter 28 DHCP Snooping

The following table describes the labels in this screen.

Table 130 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > DHCP Snooping > Configure > VLAN

LA BEL

DESC RIPTIO N

VLAN Search by VID Enter the VLAN ID you want to manage. Use a comma (,) to separate individual VLANs or a dash () to indicates a range of VLANs. For example, "3,4" or "39".

Click this to display the specified range of VLANs in the section below.

VID

This field displays the VLAN ID of each VLAN in the range specified above. If you configure

the * VLAN, the settings are applied to all VLANs.

Enabled

Select Ye s to enable DHCP snooping on the VLAN. You still have to enable DHCP snooping on the Switch and specify trusted ports.

Option 82 Profile
Apply Cancel Change Pages

Note: The Switch will drop all DHCP requests if you enable DHCP snooping and there are no trusted ports.
Select a pre-defined DHCP option 82 profile that the Switch applies to all ports in the specified VLANs. The Switch adds the information (such as slot number, port number, VLAN ID and/or system name) specified in the profile to DHCP requests that it broadcasts to the DHCP VLAN, if specified, or VLAN. You can specify the DHCP VLAN in the DHC P Sno o ping C o nfig ure screen.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click this to reset the values in this screen to their last-saved values.
Click Pre vio us or Ne xt to show the previous/next screen if all status information cannot be seen in one screen.

28.3.3 DHC P Sno o ping VLAN Po rt C o nfig ure
Use this screen to apply a different DHCP option 82 profile to certain ports in a VLAN.
To open this screen, click Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv4 So urc e G ua rd Se tup > DHC P Sno o ping > C o nfig ure > VLAN > Po rt.
Fig ure 237 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > DHCP Snooping > Configure > VLAN > Port

XS3800-28 User's Guide
320

Chapter 28 DHCP Snooping

The following table describes the labels in this screen.

Table 131 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > DHCP Snooping > Configure > VLAN > Port

LA BEL

DESC RIPTIO N

VID

Enter the ID number of the VLAN you want to configure here.

Port

Enter the number of ports to which you want to apply the specified DHCP option 82 profile.

You can enter multiple ports separated by (no space) comma (,) or hyphen () for a range. For example, enter "35" for ports 3, 4, and 5. Enter "3,5,7" for ports 3, 5, and 7.

Option 82 Profile

In stacking mode, the first number represents the slot and the second the port number. Enter 1/11/24,2/23 for ports 1 to 24 for the Switch in slot 1 and port 23 for the Switch in slot 2, for example.
Select a pre-defined DHCP option 82 profile that the Switch applies to the specified ports in this VLAN. The Switch adds the information (such as slot number, port number, VLAN ID and/ or system name) specified in the profile to DHCP requests that it broadcasts to the DHCP VLAN, if specified, or VLAN. You can specify the DHCP VLAN in the DHC P Sno o ping C o nfig ure screen.

Add
Cancel Clear Index VID Port Profile Name Delete Cancel

Note: The profile you select here has priority over the one you select in the DHC P Sno o ping > C o nfig ure > VLAN screen.
Click this to create a new entry or to update an existing one.
This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click this to reset the values above based on the last selected entry or, if not applicable, to clear the fields above.
Click C le a r to reset the fields to the factory defaults.
This field displays a sequential number for each entry. Click an index number to change the settings.
This field displays the VLAN to which the ports belongs.
This field displays the ports to which the Switch applies the settings. In stacking mode, the first number represents the slot and the second the port number.
This field displays the DHCP option 82 profilethat the Switch applies to the ports.
Select the entries that you want to remove in the De le te column, and then click the De le te button to remove the selected entries from the table.
Click this to clear the De le te check boxes above.

28.4 Te c hnic a l Re fe re nc e
This section provides technical background information on the topics discussed in this chapter.
28.4.1 DHC P Sno o ping O ve rvie w
Use DHCP snooping to filter unauthorized DHCP packets on the network and to build the binding table dynamically. This can prevent clients from getting IP addresses from unauthorized DHCP servers.

XS3800-28 User's Guide
321

Chapter 28 DHCP Snooping
28.4.1.1 Truste d vs. Untruste d Po rts
Every port is either a trusted port or an untrusted port for DHCP snooping. This setting is independent of the trusted or untrusted setting for ARP inspection. You can also specify the maximum number for DHCP packets that each port (trusted or untrusted) can receive each second.
Trusted ports are connected to DHCP servers or other switches. The Switch discards DHCP packets from trusted ports only if the rate at which DHCP packets arrive is too high. The Switch learns dynamic bindings from trusted ports.
Note: If DHCP is enabled and there are no trusted ports, DHCP requests will not succeed.
Untrusted ports are connected to subscribers. The Switch discards DHCP packets from untrusted ports in the following situations:
· The packet is a DHCP server packet (for example, OFFER, ACK, or NACK). · The source MAC address and source IP address in the packet do not match any of the current
bindings. · The packet is a RELEASE or DECLINE packet, and the source MAC address and source port do not
match any of the current bindings. · The rate at which DHCP packets arrive is too high.
28.4.1.2 DHC P Sno o ping Da ta b a se
The Switch stores the binding table in volatile memory. If the Switch restarts, it loads static bindings from permanent memory but loses the dynamic bindings, in which case the devices in the network have to send DHCP requests again. As a result, it is recommended you configure the DHCP snooping database.
The DHCP snooping database maintains the dynamic bindings for DHCP snooping and ARP inspection in a file on an external TFTP server. If you set up the DHCP snooping database, the Switch can reload the dynamic bindings from the DHCP snooping database after the Switch restarts.
You can configure the name and location of the file on the external TFTP server. The file has the following format:
Fig ure 238 DHCP Snooping Database File Format <initial-checksum> TYPE DHCP-SNOOPING VERSION 1 BEGIN <binding-1> <checksum-1> <binding-2> <checksum-1-2> ... ... <binding-n> <checksum-1-2-..-n> END
The <initial-checksum> helps distinguish between the bindings in the latest update and the bindings from previous updates. Each binding consists of 72 bytes, a space, and another checksum that is used to validate the binding when it is read. If the calculated checksum is not equal to the checksum in the file, that binding and all others after it are ignored.
XS3800-28 User's Guide
322

28.4.1.3 DHC P Re la y O ptio n 82 Info rm a tio n
The Switch can add information to DHCP requests that it does not discard. This provides the DHCP server more information about the source of the requests. The Switch can add the following information: · Slot ID (1 byte), port ID (1 byte), and source VLAN ID (2 bytes) · System name (up to 32 bytes) This information is stored in an Agent Information field in the option 82 field of the DHCP headers of client DHCP request frames. When the DHCP server responds, the Switch removes the information in the Agent Information field before forwarding the response to the original source. You can configure this setting for each source VLAN. This setting is independent of the DHCP relay settings.
28.4.1.4 C o nfig uring DHC P Sno o ping
Follow these steps to configure DHCP snooping on the Switch. 1 Enable DHCP snooping on the Switch. 2 Enable DHCP snooping on each VLAN, and configure DHCP relay option 82. 3 Configure trusted and untrusted ports, and specify the maximum number of DHCP packets that each
port can receive per second. 4 Configure static bindings.
XS3800-28 User's Guide
323

Chapter 29 ARP Inspection
C HA PTER 2 9 ARP Inspe c tio n
29.1 ARP Inspe c tio n Sta tus
Use this screen to look at the current list of MAC address filters that were created because the Switch identified an unauthorized ARP packet. When the Switch identifies an unauthorized ARP packet, it automatically creates a MAC address filter to block traffic from the source MAC address and source VLAN ID of the unauthorized ARP packet. To open this screen, click Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv4 So urc e G ua rd Se tup > ARP Inspe c tio n. Fig ure 239 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > ARP Inspection
Status

The following table describes the labels in this screen.

Table 132 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > ARP Inspection Status

LA BEL

DESC RIPTIO N

Total number of filters

This field displays the current number of MAC address filters that were created because the Switch identified unauthorized ARP packets.

Index

This field displays a sequential number for each MAC address filter.

MAC Address

This field displays the source MAC address in the MAC address filter.

VID

This field displays the source VLAN ID in the MAC address filter.

Port

This field displays the source port of the discarded ARP packet. In stacking mode, the first

number represents the slot and the second the port number.

Expiry (sec)

This field displays how long (in seconds) the MAC address filter remains in the Switch. You can also delete the record manually (De le te ).

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Click this to remove the selected entries.

Cancel

Click this to clear the De le te check boxes above.

Change Pages

Click Pre vio us Pa g e or Ne xt Pa g e to show the previous or next screen if all status information cannot be seen in one screen.

XS3800-28 User's Guide
324

29.1.1 ARP Inspe c tio n VLAN Sta tus
Use this screen to look at various statistics about ARP packets in each VLAN. To open this screen, click Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv4 So urc e G ua rd Se tup > ARP Inspe c tio n > VLAN Sta tus.
Fig ure 240 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > ARP Inspection > VLAN Status

The following table describes the labels in this screen.

Table 133 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > ARP Inspection > VLAN Status

LA BEL

DESC RIPTIO N

VLAN Search by VID Specify the VLANs you want to view in the section below. Use a comma (,) to separate individual VLANs or a dash () to indicates a range of VLANs. For example, "3,4" or "39".

Click this to display the specified range of VLANs in the section below.

The Number of VLAN This is the number of VLANs that match the searching criteria and display in the list below.

VID Received Request Reply Forwarded Dropped Change Pages

This field displays only when you use the Se a rc h button to look for certain VLANs.
This field displays the VLAN ID of each VLAN in the range specified above.
This field displays the total number of ARP packets received from the VLAN since the Switch last restarted.
This field displays the total number of ARP Request packets received from the VLAN since the Switch last restarted.
This field displays the total number of ARP Reply packets received from the VLAN since the Switch last restarted.
This field displays the total number of ARP packets the Switch forwarded for the VLAN since the Switch last restarted.
This field displays the total number of ARP packets the Switch discarded for the VLAN since the Switch last restarted.
Click Pre vio us or Ne xt to show the previous/next screen if all status information cannot be seen in one screen.

29.1.2 ARP Inspe c tio n Lo g Sta tus
Use this screen to look at log messages that were generated by ARP packets and that have not been sent to the syslog server yet. To open this screen, click Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv4 So urc e G ua rd Se tup > ARP Inspe c tio n > Lo g Sta tus.

XS3800-28 User's Guide
325

Chapter 29 ARP Inspection
Fig ure 241 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > ARP Inspection > Log Status

The following table describes the labels in this screen.

Table 134 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > ARP Inspection > Log Status

LA BEL Clearing log status table Total number of logs
Index Port VID Sender MAC Sender IP Num Pkts
Reason

DESC RIPTIO N
Click Apply to remove all the log messages that were generated by ARP packets and that have not been sent to the syslog server yet.
This field displays the number of log messages that were generated by ARP packets and that have not been sent to the syslog server yet. If one or more log messages are dropped due to unavailable buffer, there is an entry called o ve rflo w with the current number of dropped log messages.
This field displays a sequential number for each log message.
This field displays the source port of the ARP packet. In stacking mode, the first number represents the slot and the second the port number.
This field displays the source VLAN ID of the ARP packet.
This field displays the source MAC address of the ARP packet.
This field displays the source IP address of the ARP packet.
This field displays the number of ARP packets that were consolidated into this log message. The Switch consolidates identical log messages generated by ARP packets in the log consolidation interval into one log message. You can configure this interval in the ARP Inspe c tio n C o nfig ure screen.
This field displays the reason the log message was generated.

dhc p de ny: An ARP packet was discarded because it violated a dynamic binding with the same MAC address and VLAN ID.

sta tic de ny: An ARP packet was discarded because it violated a static binding with the same MAC address and VLAN ID.

de ny: An ARP packet was discarded because there were no bindings with the same MAC address and VLAN ID.

dhc p pe rm it: An ARP packet was forwarded because it matched a dynamic binding.

sta tic pe rm it: An ARP packet was forwarded because it matched a static binding.

Time

In the ARP Inspe c tio n VLAN C o nfig ure screen, you can configure the Switch to generate log messages when ARP packets are discarded or forwarded based on the VLAN ID of the ARP packet.
This field displays when the log message was generated.

29.2 ARP Inspe c tio n C o nfig ure
Use this screen to enable ARP inspection on the Switch. You can also configure the length of time the Switch stores records of discarded ARP packets and global settings for the ARP inspection log. To open this screen, click Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv4 So urc e G ua rd Se tup > ARP Inspe c tio n >
XS3800-28 User's Guide
326

Chapter 29 ARP Inspection
C o nfig ure . Fig ure 242 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > ARP Inspection >
Configure

The following table describes the labels in this screen.

Table 135 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > ARP Inspection > Configure

LA BEL

DESC RIPTIO N

Active

Select this to enable ARP inspection on the Switch. You still have to enable ARP inspection on specific VLAN and specify trusted ports.

Filter Aging Time

Filter aging time This setting has no effect on existing MAC address filters.

Log Profile Log buffer size

Enter how long (1 2147483647 seconds) the MAC address filter remains in the Switch after the Switch identifies an unauthorized ARP packet. The Switch automatically deletes the MAC address filter afterwards. Type 0 if you want the MAC address filter to be permanent.
Enter the maximum number (1 1024) of log messages that were generated by ARP packets and have not been sent to the syslog server yet. Make sure this number is appropriate for the specified Syslo g ra te and Lo g inte rva l.

Syslog rate

If the number of log messages in the Switch exceeds this number, the Switch stops recording log messages and simply starts counting the number of entries that were dropped due to unavailable buffer. Click C le a ring lo g sta tus ta ble in the ARP Inspe c tio n Lo g Sta tus screen to clear the log and reset this counter.
Type the maximum number of syslog messages the Switch can send to the syslog server in one batch. This number is expressed as a rate because the batch frequency is determined by the Lo g Inte rva l. You must configure the syslog server to use this. Enter 0 if you do not want the Switch to send log messages generated by ARP packets to the syslog server.

The relationship between Syslo g ra te and Lo g inte rva l is illustrated in the following examples:

Log interval

· Four invalid ARP packets per second, Syslo g ra te is 5, Lo g inte rva l is 1: the Switch sends 4 syslog messages every second.
· Six invalid ARP packets per second, Syslo g ra te is 5, Lo g inte rva l is 2: the Switch sends 5 syslog messages every 2 seconds.
Type how often (1 86400 seconds) the Switch sends a batch of syslog messages to the syslog server. Enter 0 if you want the Switch to send syslog messages immediately. See Syslo g ra te for an example of the relationship between Syslo g ra te and Lo g inte rva l.

XS3800-28 User's Guide
327

Chapter 29 ARP Inspection

Table 135 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > ARP Inspection > Configure (continued)

LA BEL

DESC RIPTIO N

Apply

Cancel

Click this to reset the values in this screen to their last-saved values.

29.2.1 ARP Inspe c tio n Po rt C o nfig ure
Use this screen to specify whether ports are trusted or untrusted ports for ARP inspection. You can also specify the maximum rate at which the Switch receives ARP packets on each untrusted port. To open this screen, click Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv4 So urc e G ua rd Se tup > ARP Inspe c tio n > C o nfig ure > Po rt.
Fig ure 243 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > ARP Inspection > Configure > Port (Standalone Mode)

Fig ure 244 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > ARP Inspection > Configure > Port (Stacking Mode)

XS3800-28 User's Guide
328

Chapter 29 ARP Inspection

The following table describes the labels in this screen.

Table 136 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > ARP Inspection > Configure > Port

LA BEL

DESC RIPTIO N

SLOT Port *

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Note: Changes in this row are copied to all the ports as soon as you make them.

Trusted State

Select whether this port is a trusted port (Truste d) or an untrusted port (Untruste d).

The Switch does not discard ARP packets on trusted ports for any reason.

The Switch discards ARP packets on untrusted ports in the following situations:

Limit Rate (pps)
Burst interval (seconds)

· The sender's information in the ARP packet does not match any of the current bindings.
· The rate at which ARP packets arrive is too high. You can specify the maximum rate at which ARP packets can arrive on untrusted ports.
Rate and Burst Interval settings have no effect on trusted ports.
Specify the maximum rate (1 2048 packets per second) at which the Switch receives ARP packets from each port. The Switch discards any additional ARP packets. Enter 0 to disable this limit.
The burst interval is the length of time over which the rate of ARP packets is monitored for each port. For example, if the Rate is 15 pps and the burst interval is 1 second, then the Switch accepts a maximum of 15 ARP packets in every one-second interval. If the burst interval is 5 seconds, then the Switch accepts a maximum of 75 ARP packets in every fivesecond interval.

Apply Cancel

Enter the length (1 15 seconds) of the burst interval.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click this to reset the values in this screen to their last-saved values.

29.2.2 ARP Inspe c tio n VLAN C o nfig ure
Use this screen to enable ARP inspection on each VLAN and to specify when the Switch generates log messages for receiving ARP packets from each VLAN. To open this screen, click Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv4 So urc e G ua rd Se tup > ARP Inspe c tio n > C o nfig ure > VLAN.

XS3800-28 User's Guide
329

Chapter 29 ARP Inspection
Fig ure 245 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > ARP Inspection > Configure > VLAN

The following table describes the labels in this screen.

Table 137 Advanced Application > IP Source Guard > IPv4 Source Guard Setup > ARP Inspection > Configure > VLAN

LA BEL

DESC RIPTIO N

VLAN Search by VID

Specify the VLANs you want to manage in the section below. Use a comma (,) to separate individual VLANs or a dash () to indicates a range of VLANs. For example, "3,4" or "39".

Click this to display the specified range of VLANs in the section below.

VID

This field displays the VLAN ID of each VLAN in the range specified above. If you configure the

* VLAN, the settings are applied to all VLANs.

Enabled

Select Ye s to enable ARP inspection on the VLAN. Select No to disable ARP inspection on the VLAN.

Log

Specify when the Switch generates log messages for receiving ARP packets from the VLAN.

No ne : The Switch does not generate any log messages when it receives an ARP packet from the VLAN.

De ny: The Switch generates log messages when it discards an ARP packet from the VLAN.

Pe rm it: The Switch generates log messages when it forwards an ARP packet from the VLAN.

Apply
Cancel Change Pages

All: The Switch generates log messages every time it receives an ARP packet from the VLAN.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click this to reset the values in this screen to their last-saved values.
Click Pre vio us or Ne xt to show the previous or next screen if all status information cannot be seen in one screen.

29.3 IPv6 So urc e G ua rd O ve rvie w
The purpose of IPv6 source guard is to distinguish between authorized and unauthorized users by using a binding table that validates the source of IPv6 traffic. The binding table can be manually created or be learned through Dynamic Host Configuration Protocol version 6 snooping (DHCPv6 snooping). IPv6 source guard can deny IPv6 traffic from an unknown source. The IPv6 source guard binding table includes:
XS3800-28 User's Guide
330

Chapter 29 ARP Inspection
· IPv6 address · IPv6 prefix · VLAN ID · Port number · MAC address
Enable IPv6 source guard on a port for the Switch to check incoming IPv6 packets on that port. A packet is allowed when it matches any entry in the IPSG binding table. If a user tries to send IPv6 packets to the Switch that do not match an entry in the IPSG binding table, the Switch will drop these packets. The Switch forwards matching traffic normally. The IPv6 source guard related screens are available in standalone mode.
29.4 IPv6 So urc e Binding Sta tus
Use this screen to look at the current IPv6 dynamic and static bindings and to remove dynamic bindings based on IPv6 address and/or IPv6 prefix. Bindings are used to distinguish between authorized and unauthorized packets in the network. The Switch learns the bindings by snooping DHCP packets (dynamic bindings) and from information provided manually by administrators (static bindings). To open this screen, click Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv6 So urc e Binding Sta tus.
Fig ure 246 Advanced Application > IP Source Guard > IPv6 Source Binding Status

The following table describes the labels in this screen.

Table 138 Advanced Application > IP Source Guard > IPv6 Source Binding Status

LA BEL

DESC RIPTIO N

Clear Dynamic Source Binding

Specify how you want the Switch to remove dynamic IPv6 source binding entries when you click Flush.

· Select All to remove all of the dynamic entries from the IPv6 source binding table. · Select IPv6 Addre ss and enter an IPv6 address to remove the dynamic entries snooped
with the specified IPv6 address. · Select IPv6 Pre fix and enter a Prefix address to remove the dynamic entries snooped with
the specified Prefix address.

Flush

Click this to remove dynamic IPv6 source binding entries according to your selections.

Cancel Index

Click this to reset the values above based or if not applicable, to clear the fields above. This field displays a sequential number for each binding.

Source Address

This field displays the source IP address in the binding. If the entry is blank, this field will not be checked in the binding.

MAC Address

This field displays the source MAC address in the binding. If the entry is blank, this field will not be checked in the binding.

XS3800-28 User's Guide
331

Chapter 29 ARP Inspection

Table 138 Advanced Application > IP Source Guard > IPv6 Source Binding Status (continued)

LA BEL VLAN Port Lease
Type

DESC RIPTIO N
This field displays the source VLAN ID in the binding. If the entry is blank, this field will not be checked in the binding.
This field displays the port number in the binding. If this field is blank, the binding applies to all ports.
This field displays how many days, hours, minutes, and seconds the binding is valid; for example, 2d3h4m 5s means the binding is still valid for 2 days, 3 hours, 4 minutes, and 5 seconds. This field displays infinity if the binding is always valid (for example, a static binding).
This field displays how the Switch learned the binding.

S: This static binding was learned from information provided manually by an administrator.

DH: This dhcp-snooping binding was learned by snooping DHCP packets.

29.5 IPv6 Sta tic Binding Se tup
Use this screen to manually create an IPv6 source guard binding table entry and manage IPv6 static bindings. Static bindings are uniquely identified by the source IPv6 address / prefix. Each source IPv6 address / prefix can only be in one static binding. If you try to create a static binding with the same source IPv6 address / prefix as an existing static binding, the new static binding replaces the original one. To open this screen, click Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv6 Sta tic Binding Se tup.
Fig ure 247 Advanced Application > IP Source Guard > IPv6 Static Binding Setup (Standalone Mode)

XS3800-28 User's Guide
332

Chapter 29 ARP Inspection Fig ure 248 Advanced Application > IP Source Guard > IPv6 Static Binding Setup (Stacking Mode)

The following table describes the labels in this screen.

Table 139 Advanced Application > IP Source Guard > IPv6 Static Binding Setup

LA BEL

DESC RIPTIO N

IPv6 Static Binding

Source Address

Enter the IPv6 address or IPv6 prefix and prefix length in the binding.

MAC Address

Enter the source MAC address in the binding. If this binding does not check this field, select A ny .

VLAN Port
Add Cancel Clear Index Source Address MAC Address VLAN Port
Delete Cancel

Note: You cannot choose Any for all three of MAC Addre ss, VLAN and Po rt. You must fill in at least one.
Enter the source VLAN ID in the binding. If this binding does not check this field, select Any.
Specify the ports in the binding. If this binding has one port, select the first radio button and enter the port number in the field to the right. In stacking mode, the first field is the slot ID and the second field is the port number. If this binding applies to all ports, select Any.
Click this to create the specified static binding or to update an existing one.
Click this to reset the values above based or if not applicable, to clear the fields above.
Click this to clear the fields above.
This field displays a sequential number for each binding.
This field displays the IPv6 address or IPv6 prefix and prefix length in the binding.
This field displays the source MAC address in the binding. If the entry is blank, this field will not be checked in the binding.
This field displays the source VLAN ID in the binding. If the entry is blank, this field will not be checked in the binding.
This field displays the port number in the binding. If this field is blank, the binding applies to all ports. In stacking mode, the first number represents the slot and the second the port number
Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.
Select an entry check box and click De le te to remove the specified entry.
Click this to clear the De le te check boxes above.

XS3800-28 User's Guide
333

Chapter 29 ARP Inspection
29.6 IPv6 So urc e G ua rd Po lic y Se tup
Use this screen to have IPv6 source guard forward valid IPv6 addresses and/or IPv6 prefixes that are stored in the binding table and allow or block data traffic from all link-local addresses. To open this screen, click Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv6 So urc e G ua rd Po lic y Se tup.
· If you select Va lida te Addre ss and not Va lida te Pre fix, traffic for a binding entry that matches a IPv6 address and VLAN ID, port number, and MAC address will be forwarded. If this binding entry is a IPv6 prefix, the traffic will be denied.
· If you select Va lida te Pre fix and not Va lida te Addre ss, traffic for a binding entry that matches a IPv6 prefix and VLAN ID, port number, and MAC address will be forwarded. If this binding entry is a IPv6 address, the traffic will be denied.
· If you select both Va lida te Pre fix and Va lida te Addre ss then traffic matching either IPv6 address or prefix will be forwarded.
Fig ure 249 Advanced Application > IP Source Guard > IPv6 Source Guard Policy Setup

The following table describes the labels in this screen.

Table 140 Advanced Application > IP Source Guard > IPv6 Source Guard Policy Setup

LA BEL

DESC RIPTIO N

Name

Enter a descriptive name for identification purposes for this IPv6 source guard policy.

Validate Address

Select Va lida te Addre ss to have IPv6 source guard forward valid addresses that are stored in the binding table.

Validate Prefix

Select Va lida te Pre fix to have IPv6 source guard forward valid prefixes that are stored in the binding table.

Link Local

Select Pe rm it to allow data traffic from all link-local addresses; otherwise leave the setting at De ny. A link-local address is an IPv6 unicast address that can be automatically configured on any interface using the link-local prefix FE80::/10 and the interface identifier in the modified EUI-64 format.

Add

Click this to create the IPv6 source guard policy or to update an existing one.

Cancel

Click this to reset the values above or if not applicable, to clear the fields above.

Clear

Click this to clear the fields above.

Index

This field displays a sequential number for each policy.

Name

This field displays the descriptive name for identification purposes for this IPv6 source guard policy.

Validate Address This field displays the Va lida te Addre ss status for this IPv6 source guard policy.

Validate Prefix

This field displays the Va lida te Pre fix status for this IPv6 source guard policy.

Link Local

This field displays the Link Lo c a l traffic status for this IPv6 source guard policy.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

XS3800-28 User's Guide
334

Chapter 29 ARP Inspection

Table 140 Advanced Application > IP Source Guard > IPv6 Source Guard Policy Setup (continued)

LA BEL

DESC RIPTIO N

Delete

Select an entry check box and click De le te to remove the specified entry.

Cancel

Click this to clear the De le te check boxes above.

29.7 IPv6 So urc e G ua rd Po rt Se tup
Use this screen to apply configured IPv6 source guard policies to ports you specify. Use port * to apply a policy to all ports. To open this screen, click Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv6 So urc e G ua rd Po rt Se tup.
Fig ure 250 Advanced Application > IP Source Guard > IPv6 Source Guard Port Setup (Standalone Mode)

XS3800-28 User's Guide
335

Chapter 29 ARP Inspection Fig ure 251 Advanced Application > IP Source Guard > IPv6 Source Guard Port Setup (Stacking Mode)

The following table describes the labels in this screen.

Table 141 Advanced Application > IP Source Guard > IPv6 Source Guard Port Setup

LA BEL

DESC RIPTIO N

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This field displays the port number. In stacking mode, the first number represents the slot ID and

the second is the port number. Please note that the default stacking ports (the last four ports

of your Switch) cannot be configured. They are reserved for stacking only.

Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Policy Name Apply
Cancel

Note: Changes in this row are copied to all the ports as soon as you make them.
Select an IPv6 source guard policy that the Switch will apply to this port.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click this to reset the values in this screen to their last-saved values.

29.8 IPv6 Sno o ping Po lic y Se tup
Use this screen to dynamically create an IPv6 source guard binding table using a DHCPv6 snooping policy. A DHCPv6 snooping policy lets the Switch sniff DHCPv6 packets sent from a DHCPv6 server to a DHCPv6 client when it is assigning an IPv6 address. When a DHCPv6 client successfully gets a valid IPv6 address, DHCPv6 snooping builds the binding table dynamically. To open this screen, click Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv6 Sno o ping Po lic y Se tup.
Note: If you do not select Pro to c o l and Pre fix G le a n, then the Switch cannot perform DHCPv6 snooping.
XS3800-28 User's Guide
336

Chapter 29 ARP Inspection Fig ure 252 Advanced Application > IP Source Guard > IPv6 Snooping Policy Setup

The following table describes the labels in this screen.

Table 142 Advanced Application > IP Source Guard > IPv6 Snooping Policy Setup

LA BEL

DESC RIPTIO N

Name

Enter a descriptive name for identification purposes for this IPv6 snooping policy.

Protocol

Select DHC P to let the Switch sniff DHCPv6 packets sent from a DHCPv6 server to a DHCPv6 client.

Prefix Glean

Select this to learn the IPv6 prefix and length from DHCPv6 sniffed packets.

Limit Address Count

This is the number of IPv6 addresses and prefixes learned using the IPv6 snooping policy.
Note: The maximum limit address count is the maximum size of the IPv6 source guard binding table. See the product data sheet for the latest specifications.

Add

Click this to create the IPv6 source guard policy or to update an existing one.

Cancel

Click this to reset the values above or if not applicable, to clear the fields above.

Clear

Click this to clear the fields above.

Index

This field displays a sequential number for each IPv6 snooping policy.

Name

This field displays the descriptive name for identification purposes for this IPv6 source guard policy.

Protocol

This field displays the protocols learned from DHCPv6 sniffed packets.

Prefix Glean

This field displays the IPv6 prefixes learned from DHCPv6 sniffed packets.

Limit Address Count

This field displays the number of IPv6 addresses and prefixes learned using the IPv6 snooping policy.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Select an entry check box and click De le te to remove the specified entry.

Cancel

Click this to clear the De le te check boxes above.

29.9 IPv6 Sno o ping VLAN Se tup
Use this screen to enable a DHCPv6 snooping policy on a specific VLAN interface. To open this screen, click Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv6 Sno o ping VLAN Se tup.

XS3800-28 User's Guide
337

Chapter 29 ARP Inspection Fig ure 253 Advanced Application > IP Source Guard > IPv6 Snooping VLAN Setup

The following table describes the labels in this screen.

Table 143 Advanced Application > IP Source Guard > IPv6 Snooping VLAN Setup

LA BEL

DESC RIPTIO N

Interface

Select the VLAN interface to apply the selected DHCPv6 snooping policy.

Policy

Select the IPv6 snooping policy to apply to this VLAN interface.

Add

Click this to create the IPv6 source guard policy or to update an existing one.

Cancel

Click this to reset the values above or if not applicable, to clear the fields above.

Clear

Click this to clear the fields above.

Index

This field displays a sequential number for each binding.

Interface

This field displays the VLAN interface.

Policy

This field displays the DHCPv6 snooping policy.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Select an entry check box and click De le te to remove the specified entry.

Cancel

Click this to clear the De le te check boxes above.

29.10 IPv6 DHC P Trust Se tup
Use this screen to specify which ports are trusted for DHCPv6 snooping. To open this screen, click Adva nc e d Applic a tio n > IP So urc e G ua rd > IPv6 DHC P Trust Se tup.
Note: DHCPv6 solicit packets are sent from a DHCPv6 client to a DHCPv6 server. Reply packets from a DHCPv6 server connected to an untrusted port are discarded.
Use port * to have all ports be Untruste d or Truste d.

XS3800-28 User's Guide
338

Chapter 29 ARP Inspection Fig ure 254 Advanced Application > IP Source Guard > IPv6 DHCP Trust Setup (Standalone Mode)
Fig ure 255 Advanced Application > IP Source Guard > IPv6 DHCP Trust Setup (Stacking Mode)

The following table describes the labels in this screen.

Table 144 Advanced Application > IP Source Guard > IPv6 DHCP Trust Setup

LA BEL

DESC RIPTIO N

Trust Setting

Active

Select this to specify whether ports are trusted or untrusted ports for DHCP snooping. If you do not select this then IPv6 DHC P Trust is not used and all ports are automatically trusted.

Port Setting

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This field displays the port number. In stacking mode, the first number represents the slot ID and

the second is the port number. Please note that the default stacking ports (the last four ports

of your Switch) cannot be configured. They are reserved for stacking only.

XS3800-28 User's Guide
339

Chapter 29 ARP Inspection

Table 144 Advanced Application > IP Source Guard > IPv6 DHCP Trust Setup (continued)

LA BEL *

DESC RIPTIO N Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Trusted State
Apply Cancel

Note: Changes in this row are copied to all the ports as soon as you make them.
Select whether this port is a trusted port (Truste d) or an untrusted port (Untruste d).
Trusted ports are connected to DHCPv6 servers or other switches.
Untrusted ports are connected to subscribers, and the Switch discards DHCPv6 packets from untrusted ports in the following situations:
· The packet is a DHCPv6 server packet (for example, ADVERTISE, REPLY, or RELAY-REPLY). · The source MAC address and source IP address in the packet do not match any of the
current bindings. Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Click this to reset the values in this screen to their last-saved values.

29.11 Te c hnic a l Re fe re nc e
This section provides technical background information on the topics discussed in this chapter.
29.11.1 ARP Inspe c tio n O ve rvie w
Use ARP inspection to filter unauthorized ARP packets on the network. This can prevent many kinds of man-in-the-middle attacks, such as the one in the following example. Fig ure 256 Example: Man-in-the-middle Attack

In this example, computer B tries to establish a connection with computer A. Computer X is in the same broadcast domain as computer A and intercepts the ARP request for computer A. Then, computer X does the following things: · It pretends to be computer A and responds to computer B. · It pretends to be computer B and sends a message to computer A.
XS3800-28 User's Guide
340

Chapter 29 ARP Inspection
As a result, all the communication between computer A and computer B passes through computer X. Computer X can read and alter the information passed between them.
29.11.1.1 ARP Inspe c tio n a nd MAC Addre ss Filte rs
When the Switch identifies an unauthorized ARP packet, it automatically creates a MAC address filter to block traffic from the source MAC address and source VLAN ID of the unauthorized ARP packet. You can configure how long the MAC address filter remains in the Switch. These MAC address filters are different than regular MAC address filters. · They are stored only in volatile memory. · They do not use the same space in memory that regular MAC address filters use. · They appear only in the ARP Inspe c tio n screens and commands, not in the MAC Addre ss Filte rscreens
and commands.
29.11.1.2 Truste d vs. Untruste d Po rts
Every port is either a trusted port or an untrusted port for ARP inspection. This setting is independent of the trusted or untrusted setting for DHCP snooping. You can also specify the maximum rate at which the Switch receives ARP packets on untrusted ports. The Switch does not discard ARP packets on trusted ports for any reason. The Switch discards ARP packets on untrusted ports in the following situations: · The sender's information in the ARP packet does not match any of the current bindings. · The rate at which ARP packets arrive is too high.
29.11.1.3 Syslo g
The Switch can send syslog messages to the specified syslog server when it forwards or discards ARP packets. The Switch can consolidate log messages and send log messages in batches to make this mechanism more efficient.
29.11.1.4 C o nfig uring ARP Inspe c tio n
Follow these steps to configure ARP inspection on the Switch.
1 Configure DHCP snooping. Note: It is recommended you enable DHCP snooping at least one day before you enable ARP inspection so that the Switch has enough time to build the binding table.
2 Enable ARP inspection on each VLAN. 3 Configure trusted and untrusted ports, and specify the maximum number of ARP packets that each port
can receive per second.
XS3800-28 User's Guide
341

C HA PTER 3 0 Lo o p G ua rd
30.1 Lo o p G ua rd O ve rvie w
This chapter shows you how to configure the Switch to guard against loops on the edge of your network. Loop guard allows you to configure the Switch to shut down a port if it detects that packets sent out on that port loop back to the Switch. While you can use Spanning Tree Protocol (STP) to prevent loops in the core of your network. STP cannot prevent loops that occur on the edge of your network. Fig ure 257 Loop Guard vs. STP
Refer to Section 30.1.2 on page 342 for more information.
30.1.1 Wha t Yo u C a n Do
Use the Lo o p G ua rd screen (Section 30.2 on page 344) to enable loop guard on the Switch and in specific ports.
30.1.2 Wha t Yo u Ne e d to Kno w
Loop guard is designed to handle loop problems on the edge of your network. This can occur when a port is connected to a Switch that is in a loop state. Loop state occurs as a result of human error. It happens when two ports on a switch are connected with the same cable. When a switch in loop state sends out broadcast messages the messages loop back to the switch and are re-broadcast again and again causing a broadcast storm. If a switch (not in loop state) connects to a switch in loop state, then it will be affected by the switch in loop state in the following way: · The switch (not in loop state) will receive broadcast messages sent out from the switch in loop state. · The switch (not in loop state) will receive its own broadcast messages that it sends out as they loop
back. It will then re-broadcast those messages again. The following figure shows port N on switch A connected to switch B. Switch B has two ports, x and y, mistakenly connected to each other. It forms a loop. When broadcast or multicast packets leave port N
XS3800-28 User's Guide
342

Chapter 30 Loop Guard and reach switch B, they are sent back to port N on A as they are rebroadcast from B. Fig ure 258 Switch in Loop State
The loop guard feature checks to see if a loop guard enabled port is connected to a Switch in loop state. This is accomplished by periodically sending a probe packet and seeing if the packet returns on the same port. If this is the case, the Switch will shut down the port connected to the switch in loop state. Loop guard can be enabled on both Ethernet ports. The following figure shows a loop guard enabled port N on switch A sending a probe packet P to switch B. Since switch B is in loop state, the probe packet P returns to port N on A . The Switch then shuts down port N to ensure that the rest of the network is not affected by the switch in loop state. Fig ure 259 Loop Guard Probe Packet
The Switch also shuts down port N if the probe packet returns to switch A on any other port. In other words loop guard also protects against standard network loops. The following figure illustrates three switches forming a loop. A sample path of the loop guard probe packet is also shown. In this example, the probe packet is sent from port N and returns on another port. As long as loop guard is enabled on port N. The Switch will shut down port N if it detects that the probe packet has returned to the Switch. Fig ure 260 Loop Guard Network Loop
Note: After resolving the loop problem on your network you can re-activate the disabled port via the Web Configurator (see Section 8.7 on page 104) or via commands (See the CLI Reference Guide).
XS3800-28 User's Guide
343

Chapter 30 Loop Guard
30.2 Lo o p G ua rd Se tup
Click Adva nc e d Applic a tio n > Lo o p G ua rd in the navigation panel to display the screen as shown. Note: The loop guard feature cannot be enabled on the ports that have Spanning Tree
Protocol (RSTP, MRSTP or MSTP) enabled. Fig ure 261 Advanced Application > Loop Guard (Standalone Mode)
Fig ure 262 Advanced Application > Loop Guard (Stacking Mode)
XS3800-28 User's Guide
344

Chapter 30 Loop Guard

The following table describes the labels in this screen.

Table 145 Advanced Application > Loop Guard

LA BEL Active

DESC RIPTIO N Select this option to enable loop guard on the Switch.

SLOT Port *

The Switch generates syslog, internal log messages as well as SNMP traps when it shuts down a port via the loop guard feature.
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.
This field displays the port number. In stacking mode, the first number represents the slot ID and the second is the port number. Please note that the default stacking ports (the last four ports of your Switch) cannot be configured. They are reserved for stacking only.
Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Active Apply Cancel

Note: Changes in this row are copied to all the ports as soon as you make them.
Select this check box to enable the loop guard feature on this port. The Switch sends broadcast and multicast probe packets from this port to check if the switch it is connected to is in loop state. If the switch that this port is connected is in loop state the Switch will shut down this port.
Clear this check box to disable the loop guard feature.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
345

Chapter 31 VLAN Mapping
C HA PTER 3 1 VLAN Ma pping
This chapter shows you how to configure VLAN mapping on the Switch.
31.1 VLAN Ma pping O ve rvie w
With VLAN mapping enabled, the Switch can map the VLAN ID and priority level of packets received from a private network to those used in the service provider's network. The Switch checks incoming traffic from the switch ports (non-management ports) against the VLAN mapping table first, the MAC learning table and then the VLAN table before forwarding them through the Gigabit uplink port. When VLAN mapping is enabled, the Switch discards the tagged packets that do not match an entry in the VLAN mapping table. If the incoming packets are untagged, the Switch adds a PVID based on the VLAN setting. Note: You cannot enable VLAN mapping and VLAN stacking at the same time.
31.1.1 VLAN Ma pping Exa m ple
In the following example figure, packets that carry VLAN ID 12 and are received on port 3 match a preconfigured VLAN mapping rule. The Switch translates the VLAN ID from 12 into 123 before forwarding the packets. Any packets carrying a VLAN tag other than 12 (such as 10) and received on port 3 will be dropped. Fig ure 263 VLAN Mapping Example
XS3800-28 User's Guide
346

Chapter 31 VLAN Mapping
31.1.2 Wha t Yo u C a n Do
· Use the VLAN Ma pping screen (Section 31.2 on page 347) to enable VLAN mapping on the Switch and
ports.
· Use the VLAN Ma pping C o nfig ure screen (Section 31.2.1 on page 348) to enable and edit the VLAN mapping rules.
31.2 Ena b le VLAN Ma pping
Click Adva nc e d Applic a tio n and then VLAN Ma pping in the navigation panel to display the screen as shown. Fig ure 264 Advanced Application > VLAN Mapping (Standalone Mode)
Fig ure 265 Advanced Application > VLAN Mapping (Stacking Mode)
XS3800-28 User's Guide
347

Chapter 31 VLAN Mapping

The following table describes the labels in this screen.

Table 146 Advanced Application > VLAN Mapping

LA BEL Active SLOT Port
*

DESC RIPTIO N
Select this option to enable VLAN mapping on the Switch.
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.
This field displays the port number. In stacking mode, the first number represents the slot ID and the second is the port number. Please note that the default stacking ports (the last four ports of your Switch) cannot be configured. They are reserved for stacking only.
Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Active Apply Cancel

Note: Changes in this row are copied to all the ports as soon as you make them.
Select this check box to enable the VLAN mapping feature on this port. Clear this check box to disable the VLAN mapping feature.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

31.2.1 VLAN Ma pping C o nfig ure
Click the VLAN Ma pping C o nfig ure link in the VLAN Ma pping screen to display the screen as shown. Use this screen to enable and edit the VLAN mapping rules.
Fig ure 266 Advanced Application > VLAN Mapping > VLAN Mapping Configuration (Standalone Mode)

XS3800-28 User's Guide
348

Chapter 31 VLAN Mapping Fig ure 267 Advanced Application > VLAN Mapping > VLAN Mapping Configuration (Stacking Mode)

The following table describes the labels in this screen.

Table 147 Advanced Application > VLAN Mapping > VLAN Mapping Configuration

LA BEL Active Name Port
VID
Translated VID
Priority
Add

DESC RIPTIO N
Check this box to activate this rule.
Enter a descriptive name (up to 32 printable ASCII characters) for identification purposes.
Type a port to be included in this rule. In stacking mode, the first field is the slot ID and the second field is the port number.
Enter a VLAN ID from 1 to 4094. This is the VLAN tag carried in the packets and will be translated into the VID you specified in the Tra nsla te d VID field.
Enter a VLAN ID (from 1 to 4094) into which the customer VID carried in the packets will be translated.
Select a priority level (from 0 to 7). This is the priority level that replaces the customer priority level in the tagged packets or adds to the untagged packets.
Click this to create a new entry or to update an existing one.

Cancel Index
Active Name Port VID Translated VID Priority
Delete
Cancel

This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to reset the fields to your previous configuration.
This is the number of the VLAN mapping entry in the table. Click on an index number to change the settings.
This shows whether this entry is activated or not.
This is the descriptive name for this rule.
This is the port number to which this rule is applied.
This is the customer VLAN ID in the incoming packets.
This is the VLAN ID that replaces the customer VLAN ID in the tagged packets.
This is the priority level that replaces the customer priority level in the tagged packets.
Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.
Check the rules that you want to remove in the De le te column and then click the De le te button.
Click C a nc e l to clear the De le te check boxes.

XS3800-28 User's Guide
349

Chapter 32 Layer 2 Protocol Tunneling
C HA PTER 3 2 La ye r 2 Pro to c o l Tunne ling
32.1 La ye r 2 Pro to c o l Tunne ling O ve rvie w
This chapter shows you how to configure layer 2 protocol tunneling on the Switch.
32.1.1 Wha t Yo u C a n Do
Use the La ye r 2 Pro to c o l Tunne l screen (Section 32.2 on page 351) to enable layer 2 protocol tunneling on the Switch and specify a MAC address with which the Switch uses to encapsulate the layer 2 protocol packets by replacing the destination MAC address in the packets.
32.1.2 Wha t Yo u Ne e d to Kno w
Layer 2 protocol tunneling (L2PT) is used on the service provider's edge devices. L2PT allows edge switches (1 and 2 in the following figure) to tunnel layer 2 STP (Spanning Tree Protocol), CDP (Cisco Discovery Protocol) and VTP (VLAN Trunking Protocol) packets between customer switches (A, B and C in the following figure) connected through the service provider's network. The edge switch encapsulates layer 2 protocol packets with a specific MAC address before sending them across the service provider's network to other edge switches. Fig ure 268 Layer 2 Protocol Tunneling Network Scenario
In the following example, if you enable L2PT for STP, you can have switches A, B, C and D in the same XS3800-28 User's Guide
350

Chapter 32 Layer 2 Protocol Tunneling spanning tree, even though switch A is not directly connected to switches B, C and D. Topology change information can be propagated throughout the service provider's network. To emulate a point-to-point topology between two customer switches at different sites, such as A and B, you can enable protocol tunneling on edge switches 1 and 2 for PAgP (Port Aggregation Protocol), LACP or UDLD (Uni-Directional Link Detection). Fig ure 269 L2PT Network Example
32.1.2.1 La ye r 2 Pro to c o l Tunne ling Mo de
Each port can have two layer 2 protocol tunneling modes, Ac c e ss and Tunne l. · The Ac c e ss port is an ingress port on the service provider's edge device (1 or 2 in Figure 269 on page
351) and connected to a customer switch (A or B). Incoming layer 2 protocol packets received on an access port are encapsulated and forwarded to the tunnel ports. · The Tunne l port is an egress port at the edge of the service provider's network and connected to another service provider's switch. Incoming encapsulated layer 2 protocol packets received on a tunnel port are decapsulated and sent to an access port.
32.2 C o nfig uring La ye r 2 Pro to c o l Tunne ling
Click Adva nc e d Applic a tio n > La ye r 2 Pro to c o l Tunne ling in the navigation panel to display the screen as shown.
XS3800-28 User's Guide
351

Chapter 32 Layer 2 Protocol Tunneling Fig ure 270 Advanced Application > Layer 2 Protocol Tunneling (Standalone Mode)
Fig ure 271 Advanced Application > Layer 2 Protocol Tunneling (Stacking Mode)
XS3800-28 User's Guide
352

Chapter 32 Layer 2 Protocol Tunneling

The following table describes the labels in this screen.

Table 148 Advanced Application > Layer 2 Protocol Tunneling

LA BEL

DESC RIPTIO N

Active

Select this to enable layer 2 protocol tunneling on the Switch.

Destination MAC Address

Specify a MAC address with which the Switch uses to encapsulate the layer 2 protocol packets by replacing the destination MAC address in the packets.

Note: The MAC address can be either a unicast MAC address or multicast MAC address. If you use a unicast MAC address, make sure the MAC address does not exist in the address table of a switch on the service provider's network.

SLOT Port *

Note: All the edge switches in the service provider's network should be set to use the same MAC address for encapsulation.
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.
This field displays the port number. In stacking mode, the first number represents the slot ID and the second is the port number. Please note that the default stacking ports (the last four ports of your Switch) cannot be configured. They are reserved for stacking only.
Use this row to make the setting the same for all ports. Use this row first and then make adjustments on a port-by-port basis.

CDP STP VTP Point to Point
PAGP LACP UDLD Mode

Note: Changes in this row are copied to all the ports as soon as you make them.
Select this option to have the Switch tunnel CDP (Cisco Discovery Protocol) packets so that other Cisco devices can be discovered through the service provider's network.
Select this option to have the Switch tunnel STP (Spanning Tree Protocol) packets so that STP can run properly across the service provider's network and spanning trees can be set up based on bridge information from all (local and remote) networks.
Select this option to have the Switch tunnel VTP (VLAN Trunking Protocol) packets so that all customer switches can use consistent VLAN configuration through the service provider's network.
The Switch supports PAgP (Port Aggregation Protocol), LACP (Link Aggregation Control Protocol) and UDLD (UniDirectional Link Detection) tunneling for a point-to-point topology.
Both PAgP and UDLD are Cisco's proprietary data link layer protocols. PAgP is similar to LACP and used to set up a logical aggregation of Ethernet ports automatically. UDLD is to determine the link's physical status and detect a unidirectional link.
Select this option to have the Switch send PAgP packets to a peer to automatically negotiate and build a logical port aggregation.
Select this option to have the Switch send LACP packets to a peer to dynamically creates and manages trunk groups.
Select this option to have the Switch send UDLD packets to a peer's port it connected to monitor the physical status of a link.
Select Ac c e ss to have the Switch encapsulate the incoming layer 2 protocol packets and forward them to the tunnel ports. Select Ac c e ss for ingress ports at the edge of the service provider's network.

Note: You can enable L2PT services for STP, LACP, VTP, CDP, UDLD, and PAGP on the access ports only.

Select Tunne l for egress ports at the edge of the service provider's network. The Switch decapsulates the encapsulated layer 2 protocol packets received on a tunnel port by changing the destination MAC address to the original one, and then forward them to an access port. If the services is not enabled on an access port, the protocol packets are dropped.

XS3800-28 User's Guide
353

Chapter 32 Layer 2 Protocol Tunneling

Table 148 Advanced Application > Layer 2 Protocol Tunneling (continued)

LA BEL

DESC RIPTIO N

Apply

Cancel

Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
354

Chapter 33 sFlow
C HA PTER 3 3 sFlo w
This chapter shows you how to configure sFlow to have the Switch monitor traffic in a network and send information to an sFlow collector for analysis.
33.1 sFlo w O ve rvie w
sFlow (RFC 3176) is a standard technology for monitoring switched networks. An sFlow agent embedded on a switch or router gets sample data and packet statistics from traffic forwarded through its ports. The sFlow agent then creates sFlow data and sends it to an sFlow collector. The sFlow collector is a server that collects and analyzes sFlow datagram. An sFlow datagram includes packet header, input and output interface, sampling process parameters and forwarding information. sFlow minimizes impact on CPU load of the Switch as it analyzes sample data only. sFlow can continuously monitor network traffic and create reports for network performance analysis and troubleshooting. For example, you can use it to know which IP address or which type of traffic caused network congestion. Fig ure 272 sFlow Application
33.2 sFlo w Po rt C o nfig ura tio n
Click Adva nc e d Applic a tio n > sFlo w in the navigation panel to display the screen as shown.
XS3800-28 User's Guide
355

Fig ure 273 Advanced Application > sFlow (Standalone Mode)

Fig ure 274 Advanced Application > sFlow (Stacking Mode)

The following table describes the labels in this screen.

Table 149 Advanced Application > sFlow

LA BEL

DESC RIPTIO N

Active

Select this to enable the sFlow agent on the Switch.

Apply

Cancel

Click C a nc e l to begin configuring this screen afresh.

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

XS3800-28 User's Guide
356

Chapter 33 sFlow

Table 149 Advanced Application > sFlow (continued)

LA BEL

DESC RIPTIO N

Port

This field displays the port number. In stacking mode, the first number represents the slot ID and

the second is the port number. Please note that the default stacking ports (the last four ports of

your Switch) cannot be configured. They are reserved for stacking only.

Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Active
Sample-rate
poll-interval
Collector Address

Note: Changes in this row are copied to all the ports as soon as you make them.
Select this to allow the Switch to monitor traffic on this port and generate and send sFlow datagram to the specified collector.
Enter a number (N) from 256 to 65535. The Switch captures every one out of N packets for this port and creates sFlow datagram.
Specify a time interval (from 20 to 120 in seconds) the Switch waits before sending the sFlow datagram and packet counters for this port to the collector.
Enter the IP address of the sFlow collector.
Note: You must have the sFlow collector already configured in the sFlo w > C o lle c to r screen. The sFlow collector does not need to be in the same subnet as the Switch, but it must be accessible from the Switch.

Apply Cancel

Note: Configure UDP port 6343 (the default) on a NAT router to allow port forwarding if the collector is behind a NAT router. Configure a firewall rule for UDP port 6343 (the default) to allow incoming traffic if the collector is behind a firewall.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

33.2.1 sFlo w C o lle c to r C o nfig ura tio n
Click the C o lle c to r link in the sFlo w screen to display the screen as shown. You can configure up to four sFlow collectors in this screen. You may want to configure more than one collector if the traffic load to be monitored is more than one collector can manage.
Fig ure 275 Advanced Application > sFlow > Collector

XS3800-28 User's Guide
357

Chapter 33 sFlow

The following table describes the labels in this screen.

Table 150 Advanced Application > sFlow > Collector

LA BEL

DESC RIPTIO N

Collector Address

Enter the IP address of the sFlow collector.

UDP Port

Enter a UDP port number the Switch uses to send sFlow datagram to the collector. If you change the port here, make sure you change it on the collector, too. The default port is 6343.

Add

Click this to create a new entry or to update an existing one.

Cancel Clear Index
Collector Address UDP Port
Delete Cancel

This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Click C a nc e l to reset the fields to your previous configuration. Click C le a r to reset the fields to the factory defaults. This field displays the index number of this entry. Click on an index number to change the settings. This field displays IP address of the sFlow collector.
This field displays port number the Switch uses to send sFlow datagram to the collector. Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries. Check the rules that you want to remove in the De le te column and then click the De le te button. Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
358

Chapter 34 PPPoE
C HA PTER 3 4 PPPo E
34.1 PPPo E Inte rm e dia te Ag e nt O ve rvie w
This chapter describes how the Switch gives a PPPoE termination server additional information that the server can use to identify and authenticate a PPPoE client. A PPPoE Intermediate Agent (PPPoE IA) is deployed between a PPPoE server and PPPoE clients. It helps the PPPoE server identify and authenticate clients by adding subscriber line specific information to PPPoE discovery packets from clients on a per-port or per-port-per-VLAN basis before forwarding them to the PPPoE server.
34.1.1 Wha t Yo u C a n Do
· Use the PPPo E screen (Section 34.2 on page 361) to display the main PPPoE screen. · Use the Inte rm e dia te Ag e nt screen (Section 34.3 on page 362) to enable the PPPoE Intermediate
Agent on the Switch. · Use the PPPo E IA Pe r- Po rt screen (Section 34.3.1 on page 363) to set the port state and configure
PPPoE intermediate agent sub-options on a per-port basis. · Use the PPPo E IA Pe r- Po rt Pe r- VLAN screen (Section 34.3.2 on page 365) to configure PPPoE IA settings
that apply to a specific VLAN on a port. · Use the PPPo E IA fo r VLAN (Section 34.3.3 on page 366) to enable the PPPoE Intermediate Agent on a
VLAN.
34.1.2 Wha t Yo u Ne e d to Kno w
Read on for concepts on ARP that can help you configure the screen in this chapter.
34.1.2.1 PPPo E Inte rm e dia te Ag e nt Ta g Fo rm a t
If the PPPoE Intermediate Agent is enabled, the Switch adds a vendor-specific tag to PADI (PPPoE Active Discovery Initialization) and PADR (PPPoE Active Discovery Request) packets from PPPoE clients.
XS3800-28 User's Guide
359

Chapter 34 PPPoE

This tag is defined in RFC 2516 and has the following format for this feature.

Table 151 PPPoE Intermediate Agent Vendor-specific Tag Format

Tag_Type

Tag_Len

Value

(0x0105)

The Tag_Type is 0x0105 for vendor-specific tags, as defined in RFC 2516. The Tag_Len indicates the length of Value, i1 and i2. The Value is the 32-bit number 0x00000DE9, which stands for the "ADSL Forum" IANA entry. i1 and i2 are PPPoE intermediate agent sub-options, which contain additional information about the PPPoE client.

34.1.2.2 Sub - O ptio n Fo rm a t

There are two types of sub-option: "Agent Circuit ID Sub-option" and "Agent Remote ID Sub-option". They have the following formats.

Table 152 PPPoE IA Circuit ID Sub-option Format: User-defined String

SubOpt Length

Value

0x01

String

(1 byte) (1 byte) (63 bytes)

Table 153 PPPoE IA Remote ID Sub-option Format
SubOpt Length

0x02

MAC Address or String

(1 byte) (1 byte) (63 bytes)

Value

The 1 in the first field identifies this as an Agent Circuit ID sub-option and 2 identifies this as an Agent Remote ID sub-option. The next field specifies the length of the field. The Switch takes the Circuit ID string you manually configure for a VLAN on a port as the highest priority and the Circuit ID string for a port as the second priority. In addition, the Switch puts the PPPoE client's MAC address into the Agent Remote ID Sub-option if you do not specify any user-defined string.

Fle xib le C irc uit ID Synta x with Ide ntifie r String a nd Va ria b le s

If you do not configure a Circuit ID string for a VLAN on a specific port or for a specific port, the Switch adds the user-defined identifier string and variables into the Agent Circuit ID Sub-option. The variables can be the slot ID of the PPPoE client, the port number of the PPPoE client and/or the VLAN ID on the PPPoE packet.

The identifier-string, slot ID, port number and VLAN ID are separated from each other by a pound key (#), semi-colon (;), period (.), comma (,), forward slash (/) or space. An Agent Circuit ID Sub-option example is "Switch/07/0123" and indicates the PPPoE packets come from a PPPoE client which is connected to the Switch's port 7 and belong to VLAN 123.

Table 154 PPPoE IA Circuit ID Sub-option Format: Using Identifier String and Variables

SubOpt Length

Value

0x01 (1 byte)

N (1 byte)

Identifier String
(53 byte)

delimiter (1 byte)

Slot ID delimiter (1 byte) (1 byte)

Port No (2 byte)

delimiter (1 byte)

VLAN ID
(4 bytes)

XS3800-28 User's Guide
360

Chapter 34 PPPoE

WT- 101 De fa ult C irc uit ID Synta x

If you do not configure a Circuit ID string for a specific VLAN on a port or for a specific port, and disable the flexible Circuit ID syntax in the PPPo E > Inte rm e dia te Ag e nt screen, the Switch automatically generates a Circuit ID string according to the default Circuit ID syntax which is defined in the DSL Forum Working Text (WT)-101. The default access node identifier is the host name of the PPPoE intermediate agent and the eth indicates "Ethernet".

Table 155 PPPoE IA Circuit ID Sub-option Format: Defined in WT-101

SubOpt Length

Value

0x01 (1 byte)

Access

Node (1 byte) Identifier

(20 byte)

Space
(1 byte)

eth
(3 byte)

Space
(1 byte)

Slot ID /

byte) byte)

Port No :

VLAN ID

(2 byte) (1

byte) bytes)

34.1.2.3 Po rt Sta te
Every port is either a trusted port or an untrusted port for the PPPoE intermediate agent. This setting is independent of the trusted or untrusted setting for DHCP snooping or ARP inspection. You can also specify the agent sub-options (circuit ID and remote ID) that the Switch adds to PADI and PADR packets from PPPoE clients.
Trusted ports are connected to PPPoE servers.
· If a PADO (PPPoE Active Discovery Offer), PADS (PPPoE Active Discovery Session-confirmation), or PADT (PPPoE Active Discovery Terminate) packet is sent from a PPPoE server and received on a trusted port, the Switch forwards it to all other ports.
· If a PADI or PADR packet is sent from a PPPoE client but received on a trusted port, the Switch forwards it to other trusted ports.
Note: The Switch will drop all PPPoE discovery packets if you enable the PPPoE intermediate agent and there are no trusted ports.

Untrusted ports are connected to subscribers.

· If a PADI, PADR, or PADT packet is sent from a PPPoE client and received on an untrusted port, the Switch adds a vendor-specific tag to the packet and then forwards it to the trusted ports.
· The Switch discards PADO and PADS packets which are sent from a PPPoE server but received on an untrusted port.

34.2 PPPo E
Use this screen to configure the PPPoE Intermediate Agent on the Switch. Click Adva nc e d Applic a tio n > PPPo E in the navigation panel to display the screen as shown. Click C lic k He re to go to the Inte rm e dia te Ag e nt screen. Fig ure 276 Advanced Application > PPPoE > Intermediate Agent

XS3800-28 User's Guide
361

Chapter 34 PPPoE
34.3 PPPo E Inte rm e dia te Ag e nt
Use this screen to configure the Switch to give a PPPoE termination server additional subscriber information that the server can use to identify and authenticate a PPPoE client. Click Adva nc e d Applic a tio n > PPPo E > Inte rm e dia te Ag e nt in the navigation panel to display the screen as shown. Fig ure 277 Advanced Application > PPPoE > Intermediate Agent

The following table describes the labels in this screen.

Table 156 Advanced Application > PPPoE > Intermediate Agent

LA BEL

DESC RIPTIO N

Active

Select this option to enable the PPPoE intermediate agent globally on the Switch.

access-nodeidentifier

Enter up to 20 ASCII characters to identify the PPPoE intermediate agent. Hyphens () and spaces are also allowed. The default is the Switch's host name.

circuit-id

Use this section to configure the Circuit ID field in the PADI and PADR packets.

The Circuit ID you configure for a specific port or for a specific VLAN on a port has priority over this.

Active

The Circuit ID you configure for a specific port (in the Adva nc e d Applic a tio n > PPPo E > Inte rm e dia te Ag e nt > Po rt screen) or for a specific VLAN on a port (in the Adva nc e d Applic a tio n > PPPo E > Inte rm e dia te Ag e nt > Po rt > VLAN screen) has priority over this. That means, if you also want to configure PPPoE IA Per-Port or Per-Port Per-VLAN setting, leave the fields here empty and configure circuit-id and remote-id in the Per-Port or Per-Port Per-VLAN screen.
Select this option to have the Switch add the user-defined identifier string and variables (specified in the o ptio n field) to PADI or PADR packets from PPPoE clients.

identifierstring option
delimiter

If you leave this option unselected and do not configure any Circuit ID string (using CLI commands) on the Switch, the Switch will use the string specified in the a c c e ss- no de - ide ntifie r field.
Specify a string that the Switch adds in the Agent Circuit ID sub-option. You can enter up to 53 ASCII characters. Spaces are allowed.
Select the variables that you want the Switch to generate and add in the Agent Circuit ID suboption. The variable options include sp, sv, pv and spv which indicate combinations of slot-port, slot-VLAN, port-VLAN and slot-port-VLAN respectively. The Switch enters a zero into the PADI and PADR packets for the slot value.
Select a delimiter to separate the identifier-string, slot ID, port number and/or VLAN ID from each other. You can use a pound key (# ), semi-colon (;), period (.), comma (,), forward slash (/ ) or space.

XS3800-28 User's Guide
362

Chapter 34 PPPoE

Table 156 Advanced Application > PPPoE > Intermediate Agent (continued)

LA BEL

DESC RIPTIO N

Apply

Cancel

Click C a nc e l to begin configuring this screen afresh.

34.3.1 PPPo E IA Pe r- Po rt
Use this screen to specify whether individual ports are trusted or untrusted ports and have the Switch add extra information to PPPoE discovery packets from PPPoE clients on a per-port basis.
Note: The Switch will drop all PPPoE packets if you enable the PPPoE Intermediate Agent on the Switch and there are no trusted ports.
Click the Po rt link in the Inte rm e dia te Ag e nt screen to display the screen as shown.
Fig ure 278 Advanced Application > PPPoE > Intermediate Agent > Port (Standalone Mode)

XS3800-28 User's Guide
363

Chapter 34 PPPoE Fig ure 279 Advanced Application > PPPoE > Intermediate Agent > Port (Stacking Mode)

The following table describes the labels in this screen.

Table 157 Advanced Application > PPPoE > Intermediate Agent > Port

LA BEL

DESC RIPTIO N

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This field displays the port number. In stacking mode, the first number represents the slot ID and

the second is the port number. Please note that the default stacking ports (the last four ports of

your Switch) cannot be configured. They are reserved for stacking only.

Use this row to make the setting the same for all ports. Use this row first and then make

adjustments on a port-by-port basis.

Server Trusted State

Changes in this row are copied to all the ports as soon as you make them. Select whether this port is a trusted port (Truste d) or an untrusted port (Untruste d). Trusted ports are uplink ports connected to PPPoE servers.

If a PADO (PPPoE Active Discovery Offer), PADS (PPPoE Active Discovery Session-confirmation), or PADT (PPPoE Active Discovery Terminate) packet is sent from a PPPoE server and received on a trusted port, the Switch forwards it to all other ports.

If a PADI or PADR packet is sent from a PPPoE client but received on a trusted port, the Switch forwards it to other trusted ports.

Untrusted ports are downlink ports connected to subscribers.

If a PADI, PADR, or PADT packet is sent from a PPPoE client and received on an untrusted port, the Switch adds a vendor-specific tag to the packet and then forwards it to the trusted ports.

Circuit-id

The Switch discards PADO and PADS packets which are sent from a PPPoE server but received on an untrusted port.
Enter a string of up to 63 ASCII characters that the Switch adds into the Agent Circuit ID suboption for PPPoE discovery packets received on this port. Spaces are allowed.

The Circuit ID you configure for a specific VLAN on a port (in the Adva nc e d Applic a tio n > PPPo E > Inte rm e dia te Ag e nt > Po rt > VLAN screen) has the highest priority.

XS3800-28 User's Guide
364

Chapter 34 PPPoE

Table 157 Advanced Application > PPPoE > Intermediate Agent > Port (continued)

LA BEL Remote-id

DESC RIPTIO N
Enter a string of up to 63 ASCII characters that the Switch adds into the Agent Remote ID suboption for PPPoE discovery packets received on this port. Spaces are allowed.

If you do not specify a string here or in the Re m o te - id field for a VLAN on a port, the Switch automatically uses the PPPoE client's MAC address.

Apply Cancel

The Remote ID you configure for a specific VLAN on a port (in the Adva nc e d Applic a tio n > PPPo E > Inte rm e dia te Ag e nt > Po rt > VLAN screen) has the highest priority.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

34.3.2 PPPo E IA Pe r- Po rt Pe r- VLAN
Use this screen to configure PPPoE IA settings that apply to a specific VLAN on a port. Click the VLAN link in the Inte rm e dia te Ag e nt > Po rt screen to display the screen as shown. Fig ure 280 Advanced Application > PPPoE > Intermediate Agent > Port > VLAN (Standalone Mode)

Fig ure 281 Advanced Application > PPPoE > Intermediate Agent > Port > VLAN (Stacking Mode)

The following table describes the labels in this screen.

Table 158 Advanced Application > PPPoE > Intermediate Agent > Port > VLAN

LA BEL Show Port

DESC RIPTIO N
Enter a port number to show the PPPoE Intermediate Agent settings for the specified VLANs on the port.

Show VLAN

In stacking mode, the first field is the slot ID and the second field is the port number. Use this section to specify the VLANs you want to configure in the section below.

XS3800-28 User's Guide
365

Chapter 34 PPPoE

Table 158 Advanced Application > PPPoE > Intermediate Agent > Port > VLAN (continued)

LA BEL

DESC RIPTIO N

Start VID

Enter the lowest VLAN ID you want to configure in the section below.

End VID

Enter the highest VLAN ID you want to configure in the section below.

Apply

Click Apply to display the specified range of VLANs in the section below.

Port

This field displays the port number specified above.

Slot / Port VID
*

In stacking mode, it displays the slot ID and port number specified above.
This field displays the VLAN ID of each VLAN in the range specified above. If you configure the * VLAN, the settings are applied to all VLANs.
Use this row to make the setting the same for all VLANs. Use this row first and then make adjustments on a VLAN-by-VLAN basis.

Circuit-id

Changes in this row are copied to all the VLANs as soon as you make them.
Enter a string of up to 63 ASCII characters that the Switch adds into the Agent Circuit ID suboption for this VLAN on the specified port. Spaces are allowed.

Remote-id

The Circuit ID you configure here has the highest priority.
Enter a string of up to 63 ASCII characters that the Switch adds into the Agent Remote ID suboption for this VLAN on the specified port. Spaces are allowed.

If you do not specify a string here or in the Re m o te - id field for a specific port, the Switch automatically uses the PPPoE client's MAC address.

Apply Cancel

The Remote ID you configure here has the highest priority.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

34.3.3 PPPo E IA fo r VLAN
Use this screen to set whether the PPPoE Intermediate Agent is enabled on a VLAN and whether the Switch appends the Circuit ID and/or Remote ID to PPPoE discovery packets from a specific VLAN. Click the VLAN link in the Inte rm e dia te Ag e nt screen to display the screen as shown. Fig ure 282 Advanced Application > PPPoE > Intermediate Agent > VLAN

XS3800-28 User's Guide
366

Chapter 34 PPPoE

The following table describes the labels in this screen.

Table 159 Advanced Application > PPPoE > Intermediate Agent > VLAN

LA BEL

DESC RIPTIO N

Show VLAN

Use this section to specify the VLANs you want to configure in the section below.

Start VID

Enter the lowest VLAN ID you want to configure in the section below.

End VID

Enter the highest VLAN ID you want to configure in the section below.

Apply

Click Apply to display the specified range of VLANs in the section below.

VID

This field displays the VLAN ID of each VLAN in the range specified above. If you configure the *

VLAN, the settings are applied to all VLANs.

Use this row to make the setting the same for all VLANs. Use this row first and then make

adjustments on a VLAN-by-VLAN basis.

Enabled Circuit-id Remote-id Apply
Cancel

Changes in this row are copied to all the VLANs as soon as you make them.
Select this option to turn on the PPPoE Intermediate Agent on a VLAN.
Select this option to make the Circuit ID settings for a specific VLAN take effect.
Select this option to make the Remote ID settings for a specific VLAN take effect.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
367

C HA PTER 3 5
Erro r Disa b le
35.1 Erro r Disa b le O ve rvie w
This chapter shows you how to configure the rate limit for control packets on a port, and set the Switch to take an action (such as to shut down a port or stop sending packets) on a port when the Switch detects a pre-configured error. It also shows you how to configure the Switch to automatically undo the action after the error is gone.
35.1.1 C PU Pro te c tio n O ve rvie w
Switches exchange protocol control packets in a network to get the latest networking information. If a switch receives large numbers of control packets, such as ARP, BPDU or IGMP packets, which are to be processed by the CPU, the CPU may become overloaded and be unable to handle regular tasks properly.
The CPU protection feature allows you to limit the rate of ARP, BPDU and IGMP packets to be delivered to the CPU on a port. This enhances the CPU efficiency and protects against potential DoS attacks or errors from other networks. You then can choose to drop control packets that exceed the specified rate limit or disable a port on which the packets are received.
35.1.2 Erro r- Disa b le Re c o ve ry O ve rvie w
Some features, such as loop guard or CPU protection, allow the Switch to shut down a port or discard specific packets on a port when an error is detected on the port. For example, if the Switch detects that packets sent out the ports loop back to the Switch, the Switch can shut down the ports automatically. After that, you need to enable the ports or allow the packets on a port manually via the Web Configurator or the commands. With error-disable recovery, you can set the disabled ports to become active or start receiving the packets again after the time interval you specify.
35.1.3 Wha t Yo u C a n Do
· Use the Errdisa b le Sta tus screen (Section 35.3 on page 369) to view whether the Switch detected that control packets exceeded the rate limit configured for a port or a port is disabled according to the feature requirements and what action you configure, and related information.
· Use the C PU Pro te c tio n screen (Section 35.4 on page 371) to limit the maximum number of control packets (ARP, BPDU and/or IGMP) that the Switch can receive or transmit on a port.
· Use the Errdisa b le De te c t screen (Section 35.5 on page 373) to have the Switch detect whether the control packets exceed the rate limit configured for a port and configure the action to take once the limit is exceeded.
· Use the Errdisa b le Re c o ve ry screen (Section 35.6 on page 374) to set the Switch to automatically undo an action after the error is gone.
XS3800-28 User's Guide
368

Chapter 35 Error Disable
35.2 Erro r Disa b le Se tting s
Use this screen to go to the screens where you can configure error disable related settings. Click Adva nc e d Applic a tio n > Errdisa b le in the navigation panel to open the following screen. Fig ure 283 Advanced Application > Errdisable

The following table describes the labels in this screen.

Table 160 Advanced Application > Errdisable

LA BEL

DESC RIPTIO N

Errdisable Status

Click this link to view whether the Switch detected that control packets exceeded the rate limit configured for a port or a port is disabled according to the feature requirements and what action you configure, and related information.

CPU protection

Click this link to limit the maximum number of control packets (ARP, BPDU and/or IGMP) that the Switch can receive or transmit on a port.

Errdisable Detect

Click this link to have the Switch detect whether the control packets exceed the rate limit configured for a port and configure the action to take once the limit is exceeded.

Errdisable Recovery Click this link to set the Switch to automatically undo an action after the error is gone.

35.3 Erro r- Disa b le Sta tus
Use this screen to view whether the Switch detected that control packets exceeded the rate limit configured for a port or a port is disabled according to the feature requirements and what action you configure, and related information. Click the C lic k he re link next to Errdisa b le Sta tus in the Adva nc e d Applic a tio n > Errdisa b le screen to display the screen as shown.

XS3800-28 User's Guide
369

Chapter 35 Error Disable Fig ure 284 Advanced Application > Errdisable > Errdisable Status (Standalone Mode)
Fig ure 285 Advanced Application > Errdisable > Errdisable Status (Stacking Mode)
XS3800-28 User's Guide
370

Chapter 35 Error Disable

The following table describes the labels in this screen.

Table 161 Advanced Application > Errdisable > Errdisable Status

LA BEL

DESC RIPTIO N

Inactive-reason mode reset

Port List

Enter the number of the ports (separated by a comma) on which you want to reset inactivereason status. In stacking mode, the first number represents the slot and the second the port number. Enter 1/11/24,2/23 for ports 1 to 24 for the Switch in slot 1 and port 23 for the Switch in slot 2, for example.

Cause

Select the cause of inactive-reason mode you want to reset here.

Reset

Press to reset the specified ports to handle ARP, BPDU or IGMP packets instead of ignoring them, if the ports is in inactive-reason mode.

Errdisable Status

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This field displays the port number. In stacking mode, the first number represents the slot ID and

the second is the port number. Please note that the default stacking ports (the last four ports of

your Switch) cannot be configured. They are reserved for stacking only.

Cause

This displays the type of the control packet received on the port or the feature enabled on the port and causing the Switch to take the specified action.

Active

This field displays whether the control packets (ARP, BPDU, and/or IGMP) on the port is being detected or not. It also shows whether loop guard, anti-arp scanning, BPDU guard or ZULD is enabled on the port.

Mode

This field shows the action that the Switch takes for the cause.

Rate Status

· ina c tive - po rt The Switch disables the port. · ina c tive - re a so n The Switch drops all the specified control packets (such as BPDU) on the
port. · ra te - lim ita tio n The Switch drops the additional control packets the ports has to handle in
every one second.
This field displays how many control packets this port can receive or transmit per second. It can be adjusted in C PU Pro te c tio n. 0 means no rate limit.
This field displays the errdisable status

Recovery Time Left (secs) Total Dropped

· Fo rwa rding : The Switch is forwarding packets. Rate-limitation mode is always in Fo rwa rding status.
· Err- disa b le : The Switch disables the port on which the control packets are received (ina c tive - po rt) or drops specified control packets on the port (ina c tive - re a so n).
This field displays the time (seconds) left before the ports becomes active of Errdisable Recovery.
This field displays the total packet number dropped by this port where the packet rate exceeds the rate of mode rate-limitation.

35.4 C PU Pro te c tio n C o nfig ura tio n
Use this screen to limit the maximum number of control packets (ARP, BPDU and/or IGMP) that the Switch can receive or transmit on a port. Click the C lic k He re link next to C PU pro te c tio n in the Adva nc e d Applic a tio n > Errdisa b le screen to display the screen as shown.

XS3800-28 User's Guide
371

Chapter 35 Error Disable Note: After you configure this screen, make sure you also enable error detection for the
specific control packets in the Adva nc e d Applic a tio n > Errdisa b le > Errdisa b le De te c t screen. Fig ure 286 Advanced Application > Errdisable > CPU protection (Standalone Mode)
Fig ure 287 Advanced Application > Errdisable > CPU protection (Stacking Mode)

The following table describes the labels in this screen.

Table 162 Advanced Application > Errdisable > CPU protection

LA BEL

DESC RIPTIO N

Reason

Select the type of control packet you want to configure here.

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

XS3800-28 User's Guide
372

Chapter 35 Error Disable

Table 162 Advanced Application > Errdisable > CPU protection (continued)

LA BEL

DESC RIPTIO N

Port

This field displays the port number. In stacking mode, the first number represents the slot ID and

the second is the port number. Please note that the default stacking ports (the last four ports of

your Switch) cannot be configured. They are reserved for stacking only.

Use this row to make the setting the same for all ports. Use this row first and then make

adjustments to each port if necessary.

Changes in this row are copied to all the ports as soon as you make them.
Rate Limit (pkt/s) Enter a number from 0 to 256 to specify how many control packets this port can receive or transmit per second.

0 means no rate limit.

Apply Cancel

You can configure the action that the Switch takes when the limit is exceeded.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

35.5 Erro r- Disa b le De te c t C o nfig ura tio n
Use this screen to have the Switch detect whether the control packets exceed the rate limit configured for a port and configure the action to take once the limit is exceeded. Click the C lic k He re link next to Errdisa b le De te c t link in the Adva nc e d Applic a tio n > Errdisa b le screen to display the screen as shown.
Fig ure 288 Advanced Application > Errdisable > Errdisable Detect

The following table describes the labels in this screen.

Table 163 Advanced Application > Errdisable > Errdisable Detect

LA BEL

DESC RIPTIO N

Cause *

This field displays the types of control packet that may cause CPU overload.
Use this row to make the setting the same for all entries. Use this row first and then make adjustments to each entry if necessary.

Changes in this row are copied to all the entries as soon as you make them.

Active

Select this option to have the Switch detect if the configured rate limit for a specific control packet is exceeded and take the action selected below.

XS3800-28 User's Guide
373

Chapter 35 Error Disable

Table 163 Advanced Application > Errdisable > Errdisable Detect (continued)

LA BEL Mode

DESC RIPTIO N
Select the action that the Switch takes when the number of control packets exceed the rate limit on a port, set in the Adva nc e d Applic a tio n > Errdisa b le > C PU pro te c tio n screen.

Apply Cancel

· ina c tive - po rt The Switch disables the port on which the control packets are received. · ina c tive - re a so n The Switch drops all the specified control packets (such as BPDU) on the
port. · ra te - lim ita tio n The Switch drops the additional control packets the ports has to handle in
every one second.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

35.6 Erro r- Disa b le Re c o ve ry C o nfig ura tio n
Use this screen to configure the Switch to automatically undo an action after the error is gone. Click the C lic k He re link next to Errdisa b le Re c o ve ry in the Adva nc e d Applic a tio n > Errdisa b le screen to display the screen as shown.
Fig ure 289 Advanced Application > Errdisable > Errdisable Recovery

The following table describes the labels in this screen.

Table 164 Advanced Application > Errdisable > Errdisable Recovery

LA BEL Active Reason
*

DESC RIPTIO N
Select this option to turn on the error-disable recovery function on the Switch.
This field displays the supported features that allow the Switch to shut down a port or discard packets on a port according to the feature requirements and what action you configure.
Use this row to make the setting the same for all entries. Use this row first and then make adjustments to each entry if necessary.

Changes in this row are copied to all the entries as soon as you make them.

XS3800-28 User's Guide
374

Chapter 35 Error Disable

Table 164 Advanced Application > Errdisable > Errdisable Recovery (continued)

LA BEL

DESC RIPTIO N

Timer Status

Select this check box to allow the Switch to wait for the specified time interval to activate a port or allow specific packets on a port, after the error was gone. Clear the check box to turn off this rule.

Interval

Enter the number of seconds (from 30 to 2592000) for the time interval.

Apply

Cancel

Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
375

Chapter 36 VLAN Isolation
C HA PTER 3 6 VLAN Iso la tio n
This chapter shows you how to configure the Switch to prevent communications between ports in a VLAN.
36.1 VLAN Iso la tio n O ve rvie w
Vlan Isolation allows you to do port isolation within a VLAN in a simple way. You specify which ports in a VLAN is not isolated by adding it to the promiscuous port list. The Switch automatically adds other ports in this VLAN to the isolated port list and blocks traffic between the isolated ports. A promiscuous port can communicate with any port in the same VLAN. An isolated port can communicate with the promiscuous ports only. Note: You can have up to one VLAN Isolation rule for each VLAN. Fig ure 290 VLAN Isolation Example
Note: Make sure you keep at least one port in the promiscuous port list for a VLAN with VLAN Isolation enabled. Otherwise, this VLAN is blocked from the whole network.
36.2 C o nfig uring VLAN Iso la tio n
Click Adva nc e d Applic a tio n > Vla n Iso la tio n in the navigation panel to display the screen as shown.
XS3800-28 User's Guide
376

Chapter 36 VLAN Isolation Fig ure 291 Advanced Application > VLAN Isolation

The following table describes the labels in this screen.

Table 165 Advanced Application > VLAN Isolation

LA BEL

DESC RIPTIO N

Active

Check this box to enable VLAN Isolation in a VLAN.

Name

Enter a descriptive name (up to 32 printable ASCII characters) for identification purposes.

VLAN ID

Enter a VLAN ID from 1 to 4094. This is the VLAN to which this rule applies.

Promiscuous Ports

Enter the number of the ports that can communicate with any ports in the same VLAN. Other ports belonging to this VLAN will be added to the isolation list and can only send and receive traffic from the ports you specify here.

Add

Click Add to insert the entry in the summary table below and save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.

Cancel

Click C a nc e l to reset the fields to your previous configuration.

Clear

Click C le a r to clear the fields to the factory defaults.

Index

This is the index number of the rule.

Active

This shows whether this rule is activated or not.

Name

This is the descriptive name for this rule.

VLAN

This is the VLAN to which this rule is applied.

Promiscuous Ports This shows the ports that can communicate with any ports in the same VLAN.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Check the rules that you want to remove and then click the De le te button.

Cancel

Click C a nc e l to clear the check boxes.

XS3800-28 User's Guide
377

Chapter 37 MAC Pinning
C HA PTER 3 7 MAC Pinning
This chapter shows you how to configure MAC pinning on the Switch.
37.1 MAC Pinning O ve rvie w
When the Switch obtains a connected device's MAC address, it adds an entry in the MAC address forwarding table and uses the table to determine how to forward frames. In addition to the source MAC address of a received frame, the Switch also learns the VLAN to which the device belongs and the port on which the frame is received. If the Switch learns the same MAC address and same VLAN ID on another port, it updates the MAC address table immediately. MAC pinning allows you to set a port or multiple ports to have priority over other ports in MAC address learning. That means when a MAC address (and VLAN ID) is learned on a MAC-pinning-enabled port, the MAC address will not be learned on any other port until the aging time for the dynamically learned MAC address in the table expires. This helps enhance security. For example, when an attacker (A) sends packets to all connected clients by spoofing the source MAC address of a server (B) connected to one of the Switch's ports, on which MAC pinning is enabled, the responses from clients will still be forwarded to the server according to the Switch's MAC forwarding table.
37.2 MAC Pinning C o nfig ura tio n
Use this screen to enable MAC pinning on the Switch and on specific ports. Click Adva nc e d Applic a tio n > MAC Pinning in the navigation panel to open the following screen.
XS3800-28 User's Guide
378

Chapter 37 MAC Pinning Fig ure 292 Advanced Application > MAC Pinning (Standalone Mode)

Fig ure 293 Advanced Application > MAC Pinning (Stacking Mode)

The following table describes the labels in this screen.

Table 166 Advanced Application > MAC Pinning

LA BEL

DESC RIPTIO N

Active

Select this option to turn on the MAC pinning function on the Switch.

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This field displays the port number. In stacking mode, the first number represents the slot ID and

the second is the port number. Please note that the default stacking ports (the last four ports of

your Switch) cannot be configured. They are reserved for stacking only.

XS3800-28 User's Guide
379

Chapter 37 MAC Pinning

Table 166 Advanced Application > MAC Pinning (continued)

LA BEL *

DESC RIPTIO N Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Active Apply Cancel

Note: Changes in this row are copied to all the ports as soon as you make them.
Select this check box to enable MAC pinning on this port. The port then has priority over other ports in MAC address learning.
Clear this check box to disable MAC pinning.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
380

Chapter 38 Private VLAN
C HA PTER 3 8 Priva te VLAN
38.1 Priva te VLAN O ve rvie w
Use private VLAN if you want you to block traffic between ports in the same VLAN. C o m m unity and Iso la te d VLANs are secondary private VLANs that must be associated with a Prim a ry private VLAN.
· Prim a ry: Ports in a Prim a ry VLAN are promiscuous and they can communicate with all promiscuous ports in the same primary VLAN, and all ports in associated community and isolated VLANs. They cannot communicate with ports in different primary VLANs.
· C o m m unity: Ports in a C o m m unity VLAN can communicate with promiscuous ports in an associated Prim a ry VLAN and other community ports in the same C o m m unity VLAN. They cannot communicate with ports in Iso la te d VLANs, non-associated Prim a ry VLAN promiscuous ports nor community ports in different C o m m unity VLANs.
· Iso la te d: Ports in an Iso la te d VLAN can communicate with promiscuous ports in an associated Prim a ry VLAN only. They cannot communicate with other isolated ports in the same Iso la te d VLAN, nonassociated Prim a ry VLAN promiscuous ports nor any community ports.

Table 167 PVLAN Graphic Key

LA BEL

DESC RIPTIO N

P-VLAN 100

Primary private VLAN

C-VLAN 101

Community private VLAN

I-VLAN 102

Isolated private VLAN

Tagged Private VLANs can span switches but trunking ports must be VLAN-trunking ports see

XS3800-28 User's Guide
381

Adva nc e d > VLAN > VLAN Po rt Se tting .

Table 168 Spanning PVLAN Graphic Key

LA BEL

DESC RIPTIO N

Uplink promiscuous port

VLAN-trunking ports

S1, S2

Switch 1, Switch 2

P-VLAN 100

Primary private VLAN with VLAN ID tag of 100

C-VLAN 101

Community private VLAN with VLAN ID tag of 101

I-VLAN 102

Isolated private VLAN with VLAN ID tag of 102

This is the communication process if primary VLAN P- VLAN 100 is associated with community VLAN C VLAN 101 and isolated VLAN I- VLAN 102.

· Promiscuous ports in P- VLAN 100 can communicate with all ports in P- VLAN 100 including community ports in C - VLAN 101 and isolated ports in I- VLAN 102.
· Community ports in C - VLAN 101 can communicate with promiscuous ports in P- VLAN 100 and other community ports in C - VLAN 101. They cannot communicate with isolated ports in I- VLAN 102.
· Isolated ports can communicate with promiscuous ports in P- VLAN 100. They cannot communicate with other isolated ports in I- VLAN 102 nor community ports in C - VLAN 101.

Note: Iso la tio n in VLAN > VLAN Po rt Se tting has a higher priority than private VLAN settings, so promiscuous ports with Iso la tio n in VLAN > VLAN Po rt Se tting enabled will not be able to communicate with each other.

38.1.1 C o nfig ura tio n
You must go to the Sta tic VLAN screen first to create VLAN IDs for Prim a ry, Iso la te d or C o m m unity VLANs. Click Adva nc e d Applic a tio n > Priva te VLAN to display the following screen.

XS3800-28 User's Guide
382

Chapter 38 Private VLAN Fig ure 294 Advanced Application > Private VLAN (Standalone Mode)

Fig ure 295 Advanced Application > Private VLAN (Stacking Mode)

The following table describes the labels in this screen.

Table 169 Advanced Application > Private VLAN

LA BEL

DESC RIPTIO N

SLOT Port *

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Note: Changes in this row are copied to all the ports as soon as you make them.

XS3800-28 User's Guide
383

Table 169 Advanced Application > Private VLAN (continued)

LA BEL

DESC RIPTIO N

Mode

This is the type of VLAN mapped to this port.

Associated VLAN

· No rm a l: These are ports in a static VLAN. This is not a private VLAN. · Pro m isc uo us: Ports in a Prim a ry VLAN are Pro m isc uo us. They can communicate with all
ports in the Prim a ry VLAN and associated C o m m unity and Iso la te d VLANs. They cannot communicate with Pro m isc uo us ports in different primary VLANs. · C o m m unity: Ports in a C o m m unity VLAN can communicate with Pro m isc uo us ports in an associated Primary VLAN and other community ports in the same C o m m unity VLAN. They cannot communicate with ports in an Iso la te d VLAN, non-associated Prim a ry VLAN Pro m isc uo us ports nor C o m m unity ports in different C o m m unity VLANs. · Iso la te d: Ports in an Iso la te d VLAN can communicate with Pro m isc uo us ports in an associated Prim a ry VLAN only. They cannot communicate with other Iso la te d ports in the same Iso la te d VLAN, non-associated Prim a ry VLAN Pro m isc uo us ports nor any C o m m unity ports.
Enter the VLAN ID of a previously created VLAN here.

Tagged
Apply Cancel

Note: The VLAN ID and Mo de selected here must be the same as the VLAN ID and VLAN Type created in Adva nc e d Applic a tio n > VLAN > Sta tic VLAN.
A VLAN ID tag identifies VLAN membership of a frame across switches.
Select this if the VLAN includes ports on multiple switches. The Switch forwards tagged frames through this port; it adds the PVID to untagged frames before sending them out.
Clear this if the VLAN includes ports on this Switch only. The Switch forwards untagged frames through this port; it removes the VLAN ID from tagged frames before sending them out.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
384

Chapter 39 Green Ethernet
C HA PTER 3 9 G re e n Ethe rne t
This chapter shows you how to configure the Switch to reduce the power consumed by switch ports.
39.1 G re e n Ethe rne t O ve rvie w
Green Ethernet reduces switch port power consumption in the following ways.
IEEE 802.3a z Ene rg y Effic ie nt Ethe rne t (EEE)
If EEE is enabled, both sides of a link support EEE and there is no traffic, the port enters Low Power Idle (LPI) mode. LPI mode turns off some functions of the physical layer (becomes quiet) to save power. Periodically the port transmits a REFRESH signal to allow the link partner to keep the link alive. When there is traffic to be sent, a WAKE signal is sent to the link partner to return the link to active mode.
Auto Po we r Do wn
Auto Po we r Do wn turns off almost all functions of the port's physical layer functions when the link is down, so the port only uses power to check for a link up pulse from the link partner. After the link up pulse is detected, the port wakes up from Auto Po we r Do wn and operates normally.
Sho rt Re a c h
Traditional Ethernet transmits all data with enough power to reach the maximum cable length. Shorter cables lose less power, so Sho rt Re a c h saves power by adjusting the transmit power of each port according to the length of cable attached to that port.
39.2 C o nfig uring G re e n Ethe rne t
Click Adva nc e d Applic a tio n > G re e n Ethe rne t in the navigation panel to display the screen as shown. Note: EEE, Auto Power Down and Short Reach are NOT supported on an uplink port.
XS3800-28 User's Guide
385

Chapter 39 Green Ethernet Fig ure 296 Advanced Application > Green Ethernet (Standalone Mode)
XS3800-28 User's Guide
386

Chapter 39 Green Ethernet Fig ure 297 Advanced Application > Green Ethernet (Stacking Mode)

The following table describes the labels in this screen.

Table 170 Advanced Application > Green Ethernet

LA BEL

DESC RIPTIO N

EEE Auto Power Down Short Reach SLOT
Port
*

Select this to activate Energy Efficient Ethernet globally. Select this to activate Auto Power Down globally.
Select this to activate Short Reach globally. This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack. This field displays the port number. In stacking mode, the first number represents the slot ID and the second is the port number. Please note that the default stacking ports (the last four ports of your Switch) cannot be configured. They are reserved for stacking only. Use this row to make the setting the same for all ports. Use this row first and then make adjustments to each port if necessary.

EEE Auto Power Down Short Reach Apply
Cancel

Changes in this row are copied to all the ports as soon as you make them. Select this to activate Energy Efficient Ethernet on this port. Select this to activate Auto Power Down on this port.
Select this to activate Short Reach on this port. Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
387

C HA PTER 4 0 Link La ye r Disc o ve ry Pro to c o l
(LLDP)
40.1 LLDP O ve rvie w
The LLDP (Link Layer Discovery Protocol) is a layer 2 protocol. It allows a network device to advertise its identity and capabilities on the local network. It also allows the device to maintain and store information from adjacent devices which are directly connected to the network device. This helps an administrator discover network changes and perform necessary network reconfiguration and management. The device information is encapsulated in the LLDPDUs (LLDP data units) in the form of TLV (Type, Length, Value). Device information carried in the received LLDPDUs is stored in the standard MIB.
The Switch supports these basic management TLVs.
· End of LLDPDU (mandatory) · Chassis ID (mandatory) · Port ID (mandatory) · Time to Live (mandatory) · Port Description (optional) · System Name (optional) · System Description (optional) · System Capabilities (optional) · Management Address (optional) The Switch also supports the IEEE 802.1 and IEEE 802.3 organizationally-specific TLVs.
IEEE 802.1 specific TLVs:
· Port VLAN ID TLV (optional) · Port and Protocol VLAN ID TLV (optional) IEEE 802.3 specific TLVs:
· MAC/PHY Configuration/Status TLV (optional) · Link Aggregation TLV (optional) · Maximum Frame Size TLV (optional) The optional TLVs are inserted between the Time To Live TLV and the End of LLDPDU TLV.
The next figure demonstrates that the network devices Switches and Routers (S and R) transmit and receive device information via LLDPDU and the network manager can query the information using
XS3800-28 User's Guide
388

Chapter 40 Link Layer Discovery Protocol (LLDP) Simple Network Management Protocol (SNMP). Fig ure 298 LLDP Overview
40.2 LLDP- MED O ve rvie w
LLDP-MED (Link Layer Discovery Protocol for Media Endpoint Devices) is an extension to the standard LLDP developed by the Telecommunications Industry Association (TIA) TR-41.4 subcommittee which defines the enhanced discovery capabilities, such as VoIP applications, to enable network administrators manage their network topology application more efficiently. Unlike the traditional LLDP, which has some limitations when handling multiple application devices, the LLDP-MED offers display of accurate physical topology, interoperability of devices, and easy trouble shooting for mis-configured IP addresses. There are three classes of endpoint devices that the LLDP-MED supports: Class I: IP Communications Controllers or other communication related servers Class II: Voice Gateways, Conference Bridges or Media Servers Class III: IP-Phones, PC-based Softphones, End user Communication Appliances supporting IP Media The following figure shows that with the LLDP-MED, network connectivity devices (NCD) like Switches and Routers will transmit LLDP TLV to endpoint device (ED) like IP Phone first (1), to get its device type and capabilities information, then it will receive that information in LLDP-MED TLV back from endpoint devices (2), after that the network connectivity devices will transmit LLDP-MED TLV (3) to provision the endpoint device to such that the endpoint device's network policy and location identification information is updated. Since LLDPDU updates status and configuration information periodically, network managers may check the result of provision via remote status. The remote status is updated by receiving LLDP-MED TLVs from endpoint devices.
XS3800-28 User's Guide
389

Fig ure 299 LLDP-MED Overview

40.3 LLDP Se tting s
Click Adva nc e d Applic a tio n > LLDP in the navigation panel to display the screen as shown next. Fig ure 300 Advanced Application > LLDP

The following table describes the labels in this screen.

Table 171 Advanced Application > LLDP

LA BEL

DESC RIPTIO N

LLDP

LLDP Local Status

Click here to show a screen with the Switch's LLDP information.

LLDP Remote Status

Click here to show a screen with LLDP information from the neighboring devices.

LLDP Configuration

Click here to show a screen to configure LLDP parameters.

LLDP-MED

XS3800-28 User's Guide
390

Chapter 40 Link Layer Discovery Protocol (LLDP)

Table 171 Advanced Application > LLDP (continued)

LA BEL

DESC RIPTIO N

LLDP-MED Configuration

Click here to show a screen to configure LLDP-MED (Link Layer Discovery Protocol for Media Endpoint Devices) parameters.

LLDP-MED

Click here to show a screen to configure LLDP-MED (Link Layer Discovery Protocol for Media

Network Policy Endpoint Devices) network policy parameters.

LLDP-MED Location

Click here to show a screen to configure LLDP-MED (Link Layer Discovery Protocol for Media Endpoint Devices) location parameters.

40.4 LLDP Lo c a l Sta tus
This screen displays a summary of LLDP status on this Switch. Click Adva nc e d Applic a tio n > LLDP > LLDP Lo c a l Sta tus to display the screen as shown next.
Fig ure 301 Advanced Application > LLDP > LLDP Local Status (Standalone Mode)

XS3800-28 User's Guide
391

Chapter 40 Link Layer Discovery Protocol (LLDP) Fig ure 302 Advanced Application > LLDP > LLDP Local Status (Stacking Mode)

The following table describes the labels in this screen.

Table 172 Advanced Application > LLDP > LLDP Local Status

LA BEL

DESC RIPTIO N

Basic TLV

Chassis ID TLV

This displays the chassis ID of the local Switch, that is the Switch you are configuring. The chassis ID is identified by the chassis ID subtype.

C ha ssis ID Sub type this displays how the chassis of the Switch is identified.

System Name TLV System Description TLV System Capabilities TLV

C ha ssis ID This displays the chassis ID of the local Switch. This shows the host name of the Switch.
This shows the firmware version of the Switch.
This shows the System Capabilities enabled and supported on the local Switch. · Syste m C a pa b ilitie s Suppo rte d Bridge · Syste m C a pa b ilitie s Ena b le d Bridge

XS3800-28 User's Guide
392

Chapter 40 Link Layer Discovery Protocol (LLDP)

Table 172 Advanced Application > LLDP > LLDP Local Status (continued)

LA BEL Management Address TLV

DESC RIPTIO N
The Management Address TLV identifies an address associated with the local LLDP agent that may be used to reach higher layer entities to assist discovery by network management. The TLV may also include the system interface number and an object identifier (OID) that are associated with this management address.

This field displays the Management Address settings on the specified ports.

LLDP Port Information SLOT
Local Port

· Ma na g e m e nt Addre ss Sub type ipv4 or all-802 · Inte rfa c e Num b e r Sub type unknown · Inte rfa c e Num b e r 0 (not supported) · O b je c t Ide ntifie r 0 (not supported)
This displays the local port information.
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.
This displays the number of the Switch port which receives the LLDPDU from the remote device. Click a port number to view the detailed LLDP status on this port at LLDP Lo c a l Po rt Sta tus De ta il screen.

Port ID Subtype Port ID
Port Description

In stacking mode, the first number represents the slot ID and the second is the port number. Please note that the default stacking ports (the last four ports of your Switch) cannot be configured. They are reserved for stacking only.
This indicates how the port ID field is identified.
This is an alpha-numeric string that contains the specific identifier for the port from which this LLDPDU was transmitted.
This shows the port description that the Switch will advertise from this port.

40.4.1 LLDP Lo c a l Po rt Sta tus De ta il
This screen displays detailed LLDP status for each port on this Switch. Click Adva nc e d Applic a tio n > LLDP > LLDP Lo c a l Sta tus and then, click a port number, for example 1 in the local port column to display the screen as shown next.

XS3800-28 User's Guide
393

Chapter 40 Link Layer Discovery Protocol (LLDP) Fig ure 303 Advanced Application > LLDP > LLDP Local Status > LLDP Local Port Status Detail (Basic TLV)
Fig ure 304 Advanced Application > LLDP > LLDP Local Status > LLDP Local Port Status Detail (MED TLV)
XS3800-28 User's Guide
394

Chapter 40 Link Layer Discovery Protocol (LLDP)

The following table describes the labels in this screen.

Table 173 Advanced Application > LLDP > LLDP Local Status > LLDP Local Port Status Detail

LA BEL

DESC RIPTIO N

Local Port

This displays the number of the Switch's port.

Basic TLV

These are the Basic TLV flags

Port ID TLV

The port ID TLV identifies the specific port that transmitted the LLDP frame.

· Po rt ID Sub type : This shows how the port is identified. · Po rt ID: This is the ID of the port. In stacking mode, the first number represents the slot and
the second the port number.

Port Description This displays the local port description.
TLV

Dot1 TLV

Port VLAN ID TLV

This displays the VLAN ID sent by the IEEE 802.1 Port VLAN ID TLV.

Port Protocol VLAN ID TLV

This displays the IEEE 802.1 Port Protocol VLAN ID TLVs, which indicates whether the VLAN is enabled and supported.

Dot3 TLV

MAC PHY Configuration & Status TLV

The MAC/PHY Configuration/Status TLV advertises the bit-rate and duplex capability of the sending 802.3 node. It also advertises the current duplex and bit-rating of the sending node. Lastly, it advertises whether these setting were the result of auto-negotiation during link initiation or manual override.

Link Aggregation TLV

· AN Suppo rte d Displays if the port supports or does not support auto-negotiation. · AN Ena b le d The current auto-negotiation status of the port. · AN Adve rtise d C a pa b ility The auto-negotiation capabilities of the port. · O pe r MAU Type The current Medium Attachment Unit (MAU) type of the port.
The Link Aggregation TLV indicates whether the link is capable of being aggregated, whether the link is currently in an aggregation, and if in an aggregation, the port identification of the aggregation.

Max Frame Size This displays the maximum supported frame size in octets. TLV

MED TLV

LLDP Media Endpoint Discovery (MED) is an extension of LLDP that provides additional capabilities to support media endpoint devices. MED enables advertisement and discovery of network policies, device location discovery to allow creation of location databases, and information for troubleshooting.

Capabilities TLV This field displays which LLDP-MED TLV are capable to transmit on the Switch.

Device Type TLV

· Ne two rk Po lic y · Lo c a tio n · Exte nd Po we r via MDI PSE · Exte nd Po we r via MDI PD · Inve nto ry Ma na g e m e nt
This is the LLDP-MED device class. The Zyxel Switch device type is:
· Network Connectivity

XS3800-28 User's Guide
395

Table 173 Advanced Application > LLDP > LLDP Local Status > LLDP Local Port Status Detail (continued)

LA BEL Network Policy TLV
Location Identification TLV

DESC RIPTIO N
This displays a network policy for the specified application.
· Vo ic e · Vo ic e - Sig na ling · G ue st- Vo ic e · G ue st- Vo ic e - Sig na ling · So ftpho ne - Vo ic e · Vide o - C o nfe re nc ing · Stre a m ing - Vide o · Vide o - Sig na ling
This shows the location information of a caller by its ELIN (Emergency Location Identifier Number) or the IETF Geopriv Civic Address based Location Configuration Information (Civic Address LCI).

· C o o rdina te - b a se d LC I latitude, longitude and altitude coordinates of the location Configuration Information (LCI)
· C ivic LC I IETF Geopriv Civic Address based Location Configuration Information · ELIN (Emergency Location Identifier Number)

40.5 LLDP Re m o te Sta tus
This screen displays a summary of LLDP status for each LLDP connection to a neighboring Switch. Click Adva nc e d Applic a tio n > LLDP > LLDP Re m o te Sta tus (C lic k He re ) to display the screen as shown next.
Fig ure 305 Advanced Application > LLDP > LLDP Remote Status (Standalone Mode)

Fig ure 306 Advanced Application > LLDP > LLDP Remote Status (Stacking Mode)

The following table describes the labels in this screen.

Table 174 Advanced Application > LLDP > LLDP Remote Status

LA BEL

DESC RIPTIO N

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Index

The index number shows the number of remote devices that are connected to the Switch. Click on an index number to view the detailed LLDP status for this remote device in the LLDP Re m o te Po rt Sta tus De ta il screen.

Local Port

This is the number of the Switch's port that received LLDPDU from the remote device. In stacking mode, the first number represents the slot and the second the port number.

XS3800-28 User's Guide
396

Chapter 40 Link Layer Discovery Protocol (LLDP)

Table 174 Advanced Application > LLDP > LLDP Remote Status (continued)

LA BEL

DESC RIPTIO N

Chassis ID

This displays the chassis ID of the remote device associated with the transmitting LLDP agent. The chassis ID is identified by the chassis ID subtype. For example, the MAC address of the remote device.

Port ID

This is an alpha-numeric string that contains the specific identifier for the port from which this LLDPDU was transmitted. The port ID is identified by the port ID subtype.

Port Description

This displays a description for the port from which this LLDPDU was transmitted.

System Name

This displays the system name of the remote device.

Management Address

This displays the management address of the remote device. It could be the MAC address or IP address.

40.5.1 LLDP Re m o te Po rt Sta tus De ta il
This screen displays detailed LLDP status of the remote device connected to the Switch. Click Adva nc e d Applic a tio n > LLDP > LLDP Re m o te Sta tus (C lic k He re ) and then click an index number, for example 1, in the Inde x column in the LLDP Re m o te Sta tus screen to display the screen as shown next.
Fig ure 307 Advanced Application > LLDP > LLDP Remote Status > LLDP Remote Port Status Detail (Basic TLV)

XS3800-28 User's Guide
397

The following table describes the labels in Basic TLV part of the screen.

Table 175 Advanced Application > LLDP > LLDP Remote Status > LLDP Remote Port Status Detail (Basic TLV)

LA BEL

DESC RIPTIO N

Local Port

This displays the number of the Switch's port to which the remote device is connected. In stacking mode, the first number represents the slot and the second the port number.

Basic TLV

Chassis ID TLV

· C ha ssis ID Sub type this displays how the chassis of the remote device is identified. · C ha ssis ID this displays the chassis ID of the remote device. The chassis ID is identified by
the chassis ID subtype.

Port ID TLV

· Po rt ID Sub type this displays how the port of the remote device is identified. · Po rt ID this displays the port ID of the remote device. The port ID is identified by the port
ID subtype.

Time To Live TLV This displays the time-to-live (TTL) multiplier of LLDP frames. The device information on the neighboring devices ages out and is discarded when its corresponding TTL expires. The TTL value is to multiply the TTL multiplier by the LLDP frames transmitting interval.

Port Description This displays the remote port description. TLV

System Name TLV

This displays the system name of the remote device.

System

This displays the system description of the remote device.

Description TLV

System

This displays whether the system capabilities are enabled and supported on the remote

Capabilities TLV device.

Management Address TLV

· Syste m C a pa b ilitie s Suppo rte d · Syste m C a pa b ilitie s Ena b le d
This displays the management address of the remote device.
· Ma na g e m e nt Addre ss Sub type · Ma na g e m e nt Addre ss · Inte rfa c e Num b e r Sub type · Inte rfa c e Num b e r · O b je c t Ide ntifie r

XS3800-28 User's Guide
398

Chapter 40 Link Layer Discovery Protocol (LLDP)
Fig ure 308 Advanced Application > LLDP > LLDP Remote Status > LLDP Remote Port Status Detail (Dot 1 and Dot3 TLV)

The following table describes the labels in the Dot1 and Dot3 parts of the screen.

Table 176 Advanced Application > LLDP > LLDP Remote Status > LLDP Remote Port Status Detail (Dot1 and Dot3 TLV)

LA BEL

DESC RIPTIO N

Dot1 TLV

Port VLAN ID TLV

This displays the VLAN ID of this port on the remote device.

Port-Protocol VLAN ID TLV

This displays the IEEE 802.1 Port Protocol VLAN ID TLV, which indicates whether the VLAN ID and whether it is enabled and supported on the port of remote Switch which sent the LLDPDU.

· Po rt- Pro to c o l VLAN ID · Po rt- Pro to c o l VLAN ID Suppo rte d · Po rt- Pro to c o l VLAN ID Ena b le d

XS3800-28 User's Guide
399

Table 176 Advanced Application > LLDP > LLDP Remote Status > LLDP Remote Port Status Detail (Dot1 and Dot3 TLV) (continued)

LA BEL

DESC RIPTIO N

Vlan Name TLV This shows the VLAN ID and name for remote device port.

· VLAN ID · VLAN Na m e

Protocol Identity TLV

The Protocol Identity TLV allows the Switch to advertise the particular protocols that are accessible through its port.

Dot3 TLV

MAC PHY Configuration & Status TLV

Link Aggregation TLV

Power Via MDI TLV

· Ag g re g a tio n C a pa b ility The current aggregation capability of the port. · Ag g re g a tio n Sta tus The current aggregation status of the port. · Ag g re g a tio n Po rt ID The aggregation ID of the current port.
The Power Via MDI TLV allows network management to advertise and discover the MDI power support capabilities of the sending port on the remote device.

Max Frame Size TLV

· Po rt C la ss · MDI Suppo rte d · MDI Ena b le d · Pa ir C o ntro lla b le · PSE Po we r Pa irs · Po we r C la ss
This displays the maximum supported frame size in octets.

XS3800-28 User's Guide
400

Chapter 40 Link Layer Discovery Protocol (LLDP) Fig ure 309 Advanced Application > LLDP > LLDP Remote Status > LLDP Remote Port Status Detail (MED
TLV)
XS3800-28 User's Guide
401

The following table describes the labels in the MED TLV part of the screen.

Table 177 Advanced Application > LLDP > LLDP Remote Status > LLDP Remote Port Status Detail (MED TLV)

LA BEL

DESC RIPTIO N

MED TLV

Capabilities TLV This displays the MED capabilities the remote port supports.

Device Type TLV Network Policy TLV
Location Identification TLV Inventory TLV

· Ne two rk Po lic y · Lo c a tio n · Exte nd Po we r via MDI PSE · Exte nd Po we r via MDI PD · Inve nto ry Ma na g e m e nt
LLDP-MED endpoint device classes:
· Endpoint Class I · Endpoint Class II · Endpoint Class III · Network Connectivity
This displays a network policy for the specified application.
· Vo ic e · Vo ic e - Sig na ling · G ue st- Vo ic e · G ue st- Vo ic e - Sig na ling · So ftpho ne - Vo ic e · Vide o - C o nfe re nc ing · Stre a m ing - Vide o · Vide o - Sig na ling
This shows the location information of a caller by its:
· C o o rdina te - b a se LC I latitude and longitude coordinates of the Location Configuration Information (LCI)
· C ivic LC I IETF Geopriv Civic Address based Location Configuration Information · ELIN (Emergency Location Identifier Number)
The majority of IP Phones lack support of management protocols such as SNMP, so LLDP-MED inventory TLVs are used to provide their inventory information to the Network Connectivity Devices such as the Switch. The Inventory TLV may contain the following information.

Extended Power via MDI TLV

· Ha rdwa re Re visio n · So ftwa re Re visio n · Firm wa re Re visio n · Mo de l Na m e · Ma nufa c ture r · Se ria l Num b e r · Asse t ID
Extended Power Via MDI Discovery enables detailed power information to be advertised by Media Endpoints, such as IP phones and Network Connectivity Devices such as the Switch.
· Po we r Type whether it is currently operating from primary power or is on backup power (backup power may indicate to the Endpoint Device that it should move to a power conservation mode).
· Po we r So urc e whether or not the Endpoint is currently operating from an external power source.
· Po we r Prio rity the Endpoint Device's power priority (which the Network Connectivity Device may use to prioritize which devices will remain in service during power shortages).
· Po we r Va lue power requirement, in fractions of Watts, in current configuration.

XS3800-28 User's Guide
402

Chapter 40 Link Layer Discovery Protocol (LLDP)
40.6 LLDP C o nfig ura tio n
Use this screen to configure global LLDP settings on the Switch. Click Adva nc e d Applic a tio n > LLDP > LLDP C o nfig ura tio n (C lic k He re ) to display the screen as shown next. Fig ure 310 Advanced Application > LLDP > LLDP Configuration (Standalone Mode)
XS3800-28 User's Guide
403

Chapter 40 Link Layer Discovery Protocol (LLDP) Fig ure 311 Advanced Application > LLDP > LLDP Configuration (Stacking Mode)

The following table describes the labels in this screen.

Table 178 Advanced Application > LLDP > LLDP Configuration

LA BEL Active Transmit Interval Transmit Hold
Transmit Delay Reinitialize Delay
Apply
Cancel SLOT Port
*

DESC RIPTIO N
Select to enable LLDP on the Switch. It is enabled by default.
Enter how many seconds the Switch waits before sending LLDP packets.
Enter the time-to-live (TTL) multiplier of LLDP frames. The device information on the neighboring devices ages out and is discarded when its corresponding TTL expires. The TTL value is to multiply the TTL multiplier by the LLDP packets transmitting interval.
Enter the delay (in seconds) between successive LLDPDU transmissions initiated by value or status changes in the Switch MIB.
Enter the number of seconds for LLDP to wait before initializing on a port.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.
This field displays the port number. In stacking mode, the first number represents the slot ID and the second is the port number. Please note that the default stacking ports (the last four ports of your Switch) cannot be configured. They are reserved for stacking only.
Use this row to make the setting the same for all ports. Use this row first and then make adjustments to each port if necessary.

Changes in this row are copied to all the ports as soon as you make them.

XS3800-28 User's Guide
404

Chapter 40 Link Layer Discovery Protocol (LLDP)

Table 178 Advanced Application > LLDP > LLDP Configuration (continued)

LA BEL

DESC RIPTIO N

Admin Status

Select whether LLDP transmission and/or reception is allowed on this port.

Notification Apply
Cancel

· Disa b le not allowed · Tx- O nly transmit only · Rx- O nly receive only · Tx- Rx transmit and receive
Select whether LLDP notification is enabled on this port.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

40.6.1 LLDP C o nfig ura tio n Ba sic TLV Se tting
Use this screen to configure Basic TLV settings. Click Adva nc e d Applic a tio n > LLDP > LLDP C o nfig ura tio n (C lic k He re ) > Ba sic TLV Se tting to display the screen as shown next.
Fig ure 312 Advanced Application > LLDP > LLDP Configuration> Basic TLV Setting (Standalone Mode)

XS3800-28 User's Guide
405

Chapter 40 Link Layer Discovery Protocol (LLDP) Fig ure 313 Advanced Application > LLDP > LLDP Configuration> Basic TLV Setting (Stacking Mode)

The following table describes the labels in this screen.

Table 179 Advanced Application > LLDP > LLDP Configuration > Basic TLV Setting

LA BEL

DESC RIPTIO N

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This field displays the port number. In stacking mode, the first number represents the slot ID

and the second is the port number. Please note that the default stacking ports (the last four

ports of your Switch) cannot be configured. They are reserved for stacking only.

Use this row to make the setting the same for all ports. Use this row first and then make

adjustments to each port if necessary.

Management Address Port Description System Capabilities
System Description
System Name
Apply
Cancel

Changes in this row are copied to all the ports as soon as you make them.
Select the check boxes to enable or disable the sending of Management Address TLVs on the ports.
Select the check boxes to enable or disable the sending of Port Description TLVs on the ports.
Select the check boxes to enable or to disable the sending of System Capabilities TLVs on the ports.
Select the check boxes to enable or to disable the sending of System Description TLVs on the ports.
Select the check boxes to enable or to disable the sending of System Name TLVs on the ports.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

40.6.2 LLDP C o nfig ura tio n O rg - spe c ific TLV Se tting
Use this screen to configure organization-specific TLV settings. Click Adva nc e d Applic a tio n > LLDP > LLDP C o nfig ura tio n (C lic k He re ) > O rg - spe c ific TLV Se tting to display the screen as shown next.

XS3800-28 User's Guide
406

Chapter 40 Link Layer Discovery Protocol (LLDP) Fig ure 314 Advanced Application > LLDP > LLDP Configuration> Org-specific TLV Setting (Standalone
Mode)
Fig ure 315 Advanced Application > LLDP > LLDP Configuration> Org-specific TLV Setting (Stacking Mode)

The following table describes the labels in this screen.

Table 180 Advanced Application > LLDP > LLDP Configuration > Org-specific TLV Setting

LA BEL SLOT Port
*

DESC RIPTIO N
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.
This field displays the port number. In stacking mode, the first number represents the slot ID and the second is the port number. Please note that the default stacking ports (the last four ports of your Switch) cannot be configured. They are reserved for stacking only.
Use this row to make the setting the same for all ports. Use this row first and then make adjustments to each port if necessary.

Dot1 TLV Port-Protocol VLAN ID Port VLAN ID

Changes in this row are copied to all the ports as soon as you make them.
Select the check boxes to enable or disable the sending of IEEE 802.1 Port and Protocol VLAN ID TLVs on the ports. Select the check boxes to enable or disable the sending of IEEE 802.1 Port VLAN ID TLVs on the ports. All check boxes in this column are enabled by default.

XS3800-28 User's Guide
407

Chapter 40 Link Layer Discovery Protocol (LLDP)

Table 180 Advanced Application > LLDP > LLDP Configuration > Org-specific TLV Setting (continued)

LA BEL

DESC RIPTIO N

Dot3 TLV

Link Aggregation

Select the check boxes to enable or disable the sending of IEEE 802.3 Link Aggregation TLVs on the ports.

MAC/PHY

Select the check boxes to enable or disable the sending of IEEE 802.3 MAC/PHY Configuration/Status TLVs on the ports. All check boxes in this column are enabled by default.

Max Frame Size Select the check boxes to enable or disable the sending of IEEE 802.3 Max Frame Size TLVs on the ports.

Power Via MDI Note: For PoE models only.

Apply Cancel

The Power Via MDI TLV allows network management to advertise and discover the MDI power support capabilities of the sending port on the remote device.
· Port Class · MDI Supported · MDI Enabled · Pair Controllable · PSE Power Pairs · Power Class
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

40.7 LLDP- MED C o nfig ura tio n
Click Adva nc e d Applic a tio n > LLDP > LLDP- MED C o nfig ura tio n to display the screen as shown next. Fig ure 316 Advanced Application > LLDP > LLDP-MED Configuration (Standalone Mode)

XS3800-28 User's Guide
408

Chapter 40 Link Layer Discovery Protocol (LLDP) Fig ure 317 Advanced Application > LLDP > LLDP-MED Configuration (Stacking Mode)

The following table describes the labels in this screen.

Table 181 Advanced Application > LLDP > LLDP-MED Configuration

LA BEL

DESC RIPTIO N

SLOT Port *

Notification Topology Change
MED TLV Setting Location Network Policy
Apply
Cancel

Changes in this row are copied to all the ports as soon as you make them.
Select to enable LLDP-MED topology change traps on this port.
Select to enable transmitting LLDP-MED location TLV. Select to enable transmitting LLDP-MED Network Policy TLV. Click Apply to save the changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Save link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Click C a nc e l to begin configuring this screen afresh.

40.8 LLDP- MED Ne two rk Po lic y
Click Adva nc e d Applic a tio n > LLDP > LLDP- MED Ne two rk Po lic y (C lic k He re ) to display the screen as shown next.
XS3800-28 User's Guide
409

Chapter 40 Link Layer Discovery Protocol (LLDP) Fig ure 318 Advanced Application > LLDP > LLDP-MED Network Policy (Standalone Mode)
Fig ure 319 Advanced Application > LLDP > LLDP-MED Network Policy (Stacking Mode)

The following table describes the labels in this screen.

Table 182 Advanced Application > LLDP > LLDP-MED Network Policy

LA BEL

DESC RIPTIO N

Port

Enter the port number to set up the LLDP-MED network policy. You can enter multiple ports

separated by (no space) comma (,) or hyphen for a range. For example, enter "35" for

ports 3, 4, and 5. Enter "3,5,7" for ports 3, 5, and 7.

In stacking mode, the first number represents the slot and the second the port number. Enter 1/11/24,2/23 for ports 1 to 24 for the Switch in slot 1 and port 23 for the Switch in slot 2, for example.

Application Type Select the type of application used in the network policy.

Tag VLAN

· vo ic e · vo ic e - sig na ling · g ue st- vo ic e · g ue st- vo ic e - sig na ling · so ftpho ne - vo ic e · vide o - c o nfe re nc ing · stre a m ing - vide o · vide o - sig na ling
Select to tag or untag in the network policy.
· tagged · untagged
Enter the VLAN ID number. It should be from 1 to 4094. For priority tagged frames, enter "0".

XS3800-28 User's Guide
410

Chapter 40 Link Layer Discovery Protocol (LLDP)

Table 182 Advanced Application > LLDP > LLDP-MED Network Policy (continued)

LA BEL

DESC RIPTIO N

DSCP

Enter the DSCP value of the network policy. The value is defined from 0 through 63 with the 0 representing use of the default DSCP value.

Priority

Enter the priority value for the network policy.

Add

Click Add after finish entering the network policy information. A summary table will list all the Switch you have added.

Cancel

Click C a nc e l to begin entering the information afresh.

Index

This field displays the of index number of the network policy. Click an index number to edit the rule.

Port

This field displays the port number of the network policy. In stacking mode, the first number

represents the slot and the second the port number.

Application Type This field displays the application type of the network policy.

Tag

This field displays the Tag Status of the network policy.

VLAN

This field displays the VLAN ID of the network policy.

Priority

This field displays the priority value of the network policy.

DSCP

This field displays the DSCP value of the network policy.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Check the rules that you want to remove, then click the De le te button.

Cancel

Click C a nc e l to clear the selected check boxes.

40.9 LLDP- MED Lo c a tio n
Click Adva nc e d Applic a tio n > LLDP > LLDP- MED Lo c a tio n (C lic k He re ) to display the screen as shown next.

XS3800-28 User's Guide
411

Chapter 40 Link Layer Discovery Protocol (LLDP) Fig ure 320 Advanced Application > LLDP > LLDP-MED Location (Standalone Mode)
XS3800-28 User's Guide
412

Chapter 40 Link Layer Discovery Protocol (LLDP) Fig ure 321 Advanced Application > LLDP > LLDP-MED Location (Stacking Mode)

The following table describes the labels in this screen.

Table 183 Advanced Application > LLDP > LLDP-MED Location

LA BEL

DESC RIPTIO N

Port

Enter the port number you want to set up the location within the LLDP-MED network. In

stacking mode, the first field is the slot ID and the second field is the port number.

Location Coordinates

The LLDP-MED uses geographical coordinates and Civic Address to set the location information of the remote device. Geographical based coordinates includes latitude, longitude, altitude and datum. Civic Address includes Country, State, County, City, Street and other related information.

Latitude

Enter the latitude information. The value should be from 0º to 90º.

Longitude

· no rth · so uth
Enter the longitude information. The value should be from 0º to 180º.

· we st · e a st

XS3800-28 User's Guide
413

Chapter 40 Link Layer Discovery Protocol (LLDP)

Table 183 Advanced Application > LLDP > LLDP-MED Location (continued)

LA BEL

DESC RIPTIO N

Altitude

Enter the altitude information. The value should be from 2097151 to 2097151 in meters or in floors.

Datum

· m e te rs · flo o r
Select the appropriate geodetic datum used by GPS.

Civic Address

· WG S84 · NAD83- NAVD88 · NAD83- MLLW
Enter the Civic Address by providing information such as Country, State, County, City, Street, Number, ZIP code and other additional information. Enter at least 2 fields in this configuration including the Country. The valid length of the Country field is 2 characters and all other fields are up to 32 characters.

ELIN Number
Add Cancel Index
Port
Location Coordinates Civic Address

· C o untry · Sta te · C o unty · C ity · Divisio n · Ne ig hb o r · Stre e t
· Le a ding - Stre e t- Dire c tio n
· Stre e t- Suffix · Tra iling - Stre e t- Suffix · Ho use - Num b e r · Ho use - Num b e r- Suffix · La ndm a rk
· Additio na l- Lo c a tio n
· Na m e · Zip- C o de · Building · Unit · Flo o r · Ro o m - Num b e r · Pla c e - Type · Po sta l- C o m m unity- Na m e · Po st- O ffic e - Bo x · Additio na l- C o de
Enter a numerical digit string, corresponding to the ELIN identifier which is used during emergency call setup to a traditional CAMA or ISDN trunk-based PSAP. The valid length is from 10 to 25 characters.
Click Add after finish entering the location information.
Click C a nc e l to begin entering the location information afresh.
This lists the index number of the location configuration. Click an index number to view or edit the location.
This lists the port number of the location configuration. In stacking mode, the first number represents the slot and the second the port number.
This field displays the location configuration information based on geographical coordinates that includes longitude, latitude, altitude and datum.
This field displays the Civic Address for the remote device using information such as Country, State, County, City, Street, Number, ZIP code and additional information.

XS3800-28 User's Guide
414

Chapter 40 Link Layer Discovery Protocol (LLDP)

Table 183 Advanced Application > LLDP > LLDP-MED Location (continued)

LA BEL

DESC RIPTIO N

ELIN Number

This field shows the Emergency Location Identification Number (ELIN), which is used to identify endpoint devices when they issue emergency call services. The valid length is form 10 to 25 characters.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Check the locations that you want to remove, then click the De le te button.

Cancel

Click C a nc e l to clear the selected check boxes.

XS3800-28 User's Guide
415

Chapter 41 Anti-Arpscan
C HA PTER 4 1
Anti- Arpsc a n
41.1 Anti- Arpsc a n O ve rvie w
Address Resolution Protocol (ARP), RFC 826, is a protocol used to convert a network-layer IP address to a link-layer MAC address. ARP scan is used to scan the network of a certain interface for alive hosts. It shows the IP address and MAC addresses of all hosts found. Hackers could use ARP scan to find targets in your network. Anti- a rpsc a n is used to detect unusual ARP scan activity and block suspicious hosts or ports.
Unusual ARP scan activity is determined by port and host thresholds that you set. A port threshold is determined by the number of packets received per second on the port. If the received packet rate is over the threshold, then the port is put into an Err- Disa ble state. You can recover the normal state of the port manually if this happens and after you identify the cause of the problem.
A host threshold is determined by the number of ARP-request packets received per second. There is a global threshold rate for all hosts. If the rate of a host is over the threshold, then that host is blocked by using a MAC address filter. A blocked host is released automatically after the MAC aging time expires.
Note: A port-based threshold must be larger than the host-based threshold or the host-based threshold will not work.
41.1.1 Wha t Yo u C a n Do
· Use the Anti- Arpsc a n Sta tus screen (Section 41.2 on page 417) to see what ports are trusted and are forwarding traffic or are disabled.
· Use the Anti- Arpsc a n Ho st Sta tus screen (Section 41.3 on page 418) to view blocked hosts and clear selected ones.
· Use the Anti- Arpsc a n Trust Ho st screen (Section 41.4 on page 419) to create or remove trusted hosts identified by IP address and subnet mask. Anti- a rpsc a n is not performed on trusted hosts.
· Use this Anti- Arpsc a n C o nfig ure screen (Section 41.5 on page 419) to enable anti-arpscan, set port and host thresholds as well as configure ports to be trusted or untrusted.
41.1.2 Wha t Yo u Ne e d to Kno w
· You should set an uplink port as a trusted port before enabling Anti- a rpsc a n so as to prevent the port from being shutdown due to receiving too many ARP messages.
· When a port is configured as a trusted port, Anti- a rpsc a n is not performed on the port. Both host and port thresholds are ignored for trusted ports. If the received ARP packet rate on a port or the received ARP-requests from a host exceed the thresholds, the trusted port will not be closed.
· If a port on the Switch is closed by Anti- a rpsc a n, and you want to recover it, then do one of the following:
XS3800-28 User's Guide
416

Chapter 41 Anti-Arpscan · Go to Ba sic Se tting > Po rt Se tup. Clear Ac tive and click Apply. Then select Ac tive and click Apply
again. · Go to Applic a tio n > Errdisa b le > Errdisa ble Re c o ve ry and set the interval for Anti- a rpsc a n. After the
interval expires, the closed ports will become active and start receiving packets again. · Use the command port no inactive. · Refer to the port logs to see when a port was closed.
41.2 Anti- Arpsc a n Sta tus
Use this screen to see what ports are trusted and are forwarding traffic or are disabled. To open this screen, click Adva nc e d Applic a tio n > Anti- Arpsc a n. Fig ure 322 Advanced Application > Anti-Arpscan Status (Standalone Mode)
Fig ure 323 Advanced Application > Anti-Arpscan Status (Stacking Mode)

The following table describes the fields in the above screen.

Table 184 Advanced Application > Anti-Arpscan Status

LA BEL

DESC RIPTIO N

Anti-Arpscan is....

This shows whether Anti- a rpsc a n is enabled or disabled on the Switch.

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

XS3800-28 User's Guide
417

Chapter 41 Anti-Arpscan

Table 184 Advanced Application > Anti-Arpscan Status (continued)

LA BEL

DESC RIPTIO N

Port

This field displays the port number of the Switch. In stacking mode, the first number

represents the slot ID and the second is the port number. Please note that the default

stacking ports (the last four ports of your Switch) cannot be configured. They are reserved

for stacking only.

Trusted

This field displays whether the port is trusted or untrusted. Anti- a rpsc a n is not performed on a trusted port.

State

This field displays whether the port can forward traffic normally (Fo rwa rding ) or is disabled (Err- Disa b le ).

41.3 Anti- Arpsc a n Ho st Sta tus
Use this screen to view blocked hosts and unblock ones connected to certain ports. To open this screen, click Adva nc e d Applic a tio n > Anti- Arpsc a n > Ho st Sta tus.
Fig ure 324 Advanced Application > Anti-Arpscan > Host Status

The following table describes the fields in the above screen.

Table 185 Advanced Application > Anti-Arpscan > Host Status

LA BEL

DESC RIPTIO N

Clear Filtered host

A filtered host is a blocked IP address.

Port List

Type a port number or a series of port numbers separated by commas and spaces, and then click C le a r to unblock all hosts connected to these ports.

Filtered host

This table lists information on blocked hosts.

Index

This displays the index number of an IP address (a host) that has been blocked.

Host IP

This displays the IP address of the blocked host.

MAC

This displays the MAC address of the blocked host.

VLAN

This displays the VLAN ID that shows which VLAN the blocked host is in.

Port

This displays the port number to which the blocked host is connected.

State

This shows Err- Disa b le if the ARP-request rate from this host is over the threshold. Forwarding hosts are not displayed.

XS3800-28 User's Guide
418

Chapter 41 Anti-Arpscan
41.4 Anti- Arpsc a n Trust Ho st
Use this screen to create or remove trusted hosts identified by IP address and subnet mask. Anti- a rpsc a n is not performed on trusted hosts. To open this screen, click Adva nc e d Applic a tio n > Anti- Arpsc a n > Trust Ho st. Fig ure 325 Advanced Application > Anti-Arpscan > Trust Host

The following table describes the fields in the above screen.

Table 186 Advanced Application > Anti-Arpscan > Trust Host

LA BEL

DESC RIPTIO N

Name

Type a descriptive name of up to 32 printable ASCII characters to identify this host.

Host IP

Type the IP address of the host.

Mask

A trusted host may consist of a subnet of IP addresses. Type a subnet mask to create a single host or a subnet of hosts.

Add

Click this to create the trusted host.

Cancel

Click this to reset the values above based or, if not applicable, to clear the fields above.

Clear

Click this to clear the fields above.

Index

This field displays a sequential number for each trusted host.

Name

This field displays the name of the trusted host.

Host IP

This field displays the IP address of the trusted host.

Mask

This field displays the subnet mask of the trusted host.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Select an entry check box and click De le te to remove the specified entry.

Cancel

Click this to clear the check boxes above.

41.5 Anti- Arpsc a n C o nfig ure
Use this screen to enable Anti- Arpsc a n, set port and host thresholds as well as configure ports to be trusted or untrusted. To open this screen, click Adva nc e d Applic a tio n > Anti- Arpsc a n > C o nfig ure .

XS3800-28 User's Guide
419

Chapter 41 Anti-Arpscan Fig ure 326 Advanced Application > Anti-Arpscan > Configure (Standalone Mode)
Fig ure 327 Advanced Application > Anti-Arpscan > Configure (Stacking Mode)
XS3800-28 User's Guide
420

Chapter 41 Anti-Arpscan

The following table describes the fields in the above screen.

Table 187 Advanced Application > Anti-Arpscan > Configure

LA BEL

DESC RIPTIO N

Active

Select this to enable Anti- a rpsc a n on the Switch.

Port Threshold

A port threshold is determined by the number of packets received per second on the port. If the received packet rate is over the threshold, then the port is put into an Err- Disa b le state. Type the maximum number of packets per second allowed on the port before it is blocked.

Host Threshold

Note: The allowed range is 2 to 255 packets received per second.
A host threshold is determined by the number of ARP-request packets received per second. This is the global threshold rate for all hosts. If the rate of a host is over the threshold, then that host is blocked by using a MAC address filter. A blocked host is released automatically after the MAC aging time expires.
Type the maximum number of ARP-request packets allowed by a host before it is blocked.

Note: The allowed range is 2 to 100 ARP-request packets per second.

SLOT Port *

Note: The port-based threshold must be larger than the host-based threshold or the host-based threshold will not be applied.
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.
This field displays the port number. In stacking mode, the first number represents the slot ID and the second is the port number. Please note that the default stacking ports (the last four ports of your Switch) cannot be configured. They are reserved for stacking only.
Settings in this row apply to all ports.
Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Trusted State Apply Cancel

Note: Changes in this row are copied to all the ports as soon as you make them.
Select Untruste d or Truste d for the associated port. Anti- a rpsc a n is not performed on trusted hosts.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click this to reset the values in this screen to their last-saved values.

XS3800-28 User's Guide
421

Chapter 42 BPDU Guard
C HA PTER 4 2 BPDU G ua rd
42.1 BPDU G ua rd O ve rvie w
A BPDU (Bridge Protocol Data Units) is a data frame that contains information about STP. STP-aware switches exchange BPDUs periodically. The BPDU guard feature allows you to prevent any new STP-aware switch from connecting to an existing network and causing STP topology changes in the network. If there is any BPDU detected on the ports on which BPDU guard is enabled, the Switch disables the ports automatically. You can then enable the ports manually in the Ba sic Se tting > Po rt Se tup screen, or use the Errdisa b le Re c o ve ry screen (see Section 35.6 on page 374) to have the ports become active after a certain time interval.
42.1.1 Wha t Yo u C a n Do
· Use the BPDU G ua rd Sta tus screen (Section 42.2 on page 422) to view the BPDU guard status. · Use the BPDU G ua rd C o nfig ura tio n screen (Section 42.3 on page 423) to enable BPDU guard on the
Switch.
42.2 BPDU G ua rd Sta tus
Use this screen to view whether BPDU guard is enabled on the Switch and the port status. Click Adva nc e d Applic a tio n > BPDU G ua rd in the navigation panel. Fig ure 328 Advanced Application > BPDU Guard Status (Standalone Mode)
XS3800-28 User's Guide
422

Chapter 42 BPDU Guard Fig ure 329 Advanced Application > BPDU Guard Status (Stacking Mode)

The following table describes the fields in the above screen.

Table 188 Advanced Application > BPDU Guard Status

LA BEL

DESC RIPTIO N

BPDU guard globally This field displays whether BPDU guard is activated on the Switch. configuration

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This field displays the port number. In stacking mode, the first number represents the slot ID

and the second is the port number. Please note that the default stacking ports (the last

four ports of your Switch) cannot be configured. They are reserved for stacking only.

Active

This shows whether BPDU guard is activated on the port.

Status

This shows whether the port is shut down (Err- disa b le ) or able to transmit packets (Fo rwa rding ).

42.3 BPDU G ua rd C o nfig ura tio n
Use this screen to turn on the BPDU guard feature on the Switch and ports. In the BPDU G ua rd Sta tus screen, click C o nfig ura tio n to display the configuration screen as shown.

XS3800-28 User's Guide
423

Chapter 42 BPDU Guard Fig ure 330 Advanced Application > BPDU Guard > BPDU Guard Configuration (Standalone Mode)

Fig ure 331 Advanced Application > BPDU Guard > BPDU Guard Configuration (Stacking Mode)

The following table describes the fields in the above screen.

Table 189 Advanced Application > BPDU Guard > BPDU Guard Configuration

LA BEL

DESC RIPTIO N

Active

Select this option to enable BPDU guard on the Switch.

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This field displays the port number. In stacking mode, the first number represents the slot ID and

the second is the port number. Please note that the default stacking ports (the last four ports of

your Switch) cannot be configured. They are reserved for stacking only.

XS3800-28 User's Guide
424

Chapter 42 BPDU Guard

Table 189 Advanced Application > BPDU Guard > BPDU Guard Configuration (continued)

LA BEL *

DESC RIPTIO N Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Active Apply Cancel

Note: Changes in this row are copied to all the ports as soon as you make them.
Select this check box to enable the BPDU guard feature on this port. The Switch shuts down this port if there is any BPDU received on the port.
Clear this check box to disable the BPDU guard feature.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
425

Chapter 43 OAM
C HA PTER 4 3 OAM
43.1 O AM O ve rvie w
Link layer Ethernet OAM (Operations, Administration and Maintenance) as described in IEEE 802.3ah is a link monitoring protocol. It utilizes OAM Protocol Data Units or OAM PDUs to transmit link status information between directly connected Ethernet devices. Both devices must support IEEE 802.3ah. Because link layer Ethernet OAM operates at layer two of the OSI (Open Systems Interconnection Basic Reference) model, neither IP or SNMP are necessary to monitor or troubleshoot network connection problems. The Switch supports the following IEEE 802.3ah features: · Discovery this identifies the devices on each end of the Ethernet link and their OAM configuration. · Remote Loopback this can initiate a loopback test between Ethernet devices.
43.1.1 Wha t Yo u C a n Do
· Use the O AM Sta tus screen (Section 43.2 on page 426) to view the configuration of ports on which Ethernet OAM is enabled.
· Use the O AM C o nfig ura tio n screen (Section 43.3 on page 431) to enable Ethernet OAM on the Switch. · Use the O AM Re m o te Lo o pb a c k screen (Section 43.4 on page 433) to perform remote-loopback tests.
43.2 O AM Sta tus
Use this screen to view the configuration of ports on which Ethernet OAM is enabled. Click Adva nc e d Applic a tio n > O AM in the navigation panel.
XS3800-28 User's Guide
426

Chapter 43 OAM Fig ure 332 Advanced Application > OAM Status (Standalone Mode)
Fig ure 333 Advanced Application > OAM Status (Stacking Mode)

The following table describes the fields in the above screen.

Table 190 Advanced Application > OAM Status

LA BEL

DESC RIPTIO N

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Local

This section displays information about the ports on the Switch.

Port

This field displays the port number. In stacking mode, the first number represents the slot ID

and the second is the port number. Please note that the default stacking ports (the last

four ports of your Switch) cannot be configured. They are reserved for stacking only.

XS3800-28 User's Guide
427

Chapter 43 OAM

Table 190 Advanced Application > OAM Status (continued)

LA BEL

DESC RIPTIO N

Mode

This field displays the operational state of the port when OAM is enabled on the port.

Ac tive Allows the port to issue and respond to Ethernet OAM commands.

Remote

Pa ssive Allows the port to respond to Ethernet OAM commands.

This section displays information about the remote device.

Mac Address

This field displays the MAC address of the remote device.

OUI

This field displays the OUI (first 3 bytes of the MAC address) of the remote device.

Mode

This field displays the operational state of the port when OAM is enabled on the port.

Ac tive Allows the port to issue and respond to Ethernet OAM commands.

Config

Pa ssive Allows the port to respond to Ethernet OAM commands. This field displays the capabilities of the Switch and remote device.

43.2.1 O AM De ta ils
Use this screen to view OAM configuration details and operational status of a specific port. Click a number in the Po rt column in the O AM Sta tus screen to display the screen as shown next.

XS3800-28 User's Guide
428

Chapter 43 OAM Fig ure 334 Advanced Application > OAM Status > OAM Details

The following table describes the fields in the above screen.

Table 191 Advanced Application > OAM Status > OAM Details

LA BEL

DESC RIPTIO N

Discovery

This section displays OAM configuration details and operational status of the port on the Switch and/or the remote device.

Local Client/Remote Client

OAM configurations Mode

This field displays the OAM mode. The device in active mode (typically the service provider's device) controls the device in passive mode (typically the subscriber's device).

Ac tive : The port initiates OAM discovery; sends information PDUs; and may send event notification PDUs, variable request/response PDUs, or loopback control PDUs.

Pa ssive : The port waits for the remote device to initiate OAM discovery; sends information PDUs; may send event notification PDUs; and may respond to variable request PDUs or loopback control PDUs.

The Switch might not support some types of PDUs, as indicated in the fields below.

XS3800-28 User's Guide
429

Chapter 43 OAM

Table 191 Advanced Application > OAM Status > OAM Details (continued)

LA BEL

DESC RIPTIO N

Unidirectional

This field indicates whether or not the port can send information PDUs to transmit fault information when the receive path is non-operational.

Remote loopback This field indicates whether or not the port can use loopback control PDUs to put the remote device into loopback mode.

Link events

This field indicates whether or not the port can interpret link events, such as link fault and dying gasp. Link events are sent in event notification PDUs and indicate when the number of errors in a given interval (time, number of frames, number of symbols, or number of error frame seconds) exceeds a specified threshold. Organizations may create organizationspecific link event TLVs as well.

Variable retrieval This field indicates whether or not the port can respond to requests for more information, such as requests for Ethernet counters and statistics, about link events.

Max. OAMPDU size

This field displays the maximum size of PDU for receipt and delivery.

Local Client/Remote Client

Operational status Link status Info. revision
Parser state

This field indicates that the link between the Switch port and a connected IEEE 802.3ahenabled remote Ethernet device is up or down.
This field displays the current version of local state and configuration. This two-octet value starts at zero and increments every time the local state or configuration changes.
This field indicates the current state of the parser.

Fo rwa rd: The port is forwarding packets normally.

Lo o pb a c k: The port is in loopback mode.

Discovery state

Disc a rd: The port is discarding non-OAM PDUs because it is trying to or has put the remote device into loopback mode.
This field indicates the state in the OAM discovery process. OAM-enabled devices use this process to detect each other and to exchange information about their OAM configuration and capabilities. OAM discovery is a handshake protocol.

Fa ult: One of the devices is transmitting OAM PDUs with link fault information, or the interface is not operational.

Ac tive Se nd Lo c a l: The port is in active mode and is trying to see if the remote device supports OAM.

Pa ssive Wa it: The port is in passive mode and is waiting for the remote device to begin OAM discovery.

Se nd Lo c a l Re m o te : This state occurs in the following circumstances.

· The port has discovered the remote device but has not accepted or rejected the connection yet.
· The port has discovered the remote device and rejected the connection.
Se nd Lo c a l Re m o te O K: The port has discovered the remote device and has accepted the connection. In addition, the remote device has not accepted or rejected the connection yet, or the remote device has rejected the connected.

Remote Client MAC Address
Vendor(oui)

Se nd Any: The port and the remote device have accepted the connection. This is the operating state for OAM links that are fully operational.
This field displays the MAC address of the IEEE 802.3ah-enabled remote Ethernet device that is connected to the Switch. This field displays the Organizationally Unique Identifiers (OUI) representing the vendor of the IEEE 802.3ah-enabled remote Ethernet device that is connected to the Switch.

XS3800-28 User's Guide
430

Chapter 43 OAM

Table 191 Advanced Application > OAM Status > OAM Details (continued)

LA BEL Statistics

DESC RIPTIO N

This section displays the number of OAM packets transferred on the port of the Switch.

Information OAMPDU This field displays the number of OAM PDUs sent on the port. Tx

Information OAMPDU This field displays the number of OAM PDUs received on the port. Rx

Event Notification OAMPDU Tx

This field displays the number of unique or duplicate OAM event notification PDUs sent on the port.

Event Notification OAMPDU Rx

This field displays the number of unique or duplicate OAM event notification PDUs received on the port.

Loopback Control OAMPDU Tx

This field displays the number of loopback control OAM PDUs sent on the port.

Loopback Control OAMPDU Rx

This field displays the number of loopback control OAM PDUs received on the port.

Variable Request OAMPDU Tx

This field displays the number of OAM PDUs sent to request MIB objects on the remote device.

Variable Request OAMPDU Rx

This field displays the number of OAM PDUs received requesting MIB objects on the Switch.

Variable Response OAMPDU Tx

This field displays the number of OAM PDUs sent by the Switch in response to requests.

Variable Response OAMPDU Rx

This field displays the number of OAM PDUs sent by the remote device in response to requests.

Unsupported OAMPDU Tx

This field displays the number of unsupported OAM PDUs sent on the port.

Unsupported OAMPDU Rx

This field displays the number of unsupported OAM PDUs received on the port.

43.3 O AM C o nfig ura tio n
Use this screen to turn on Ethernet OAM on the Switch and ports and configure the related settings. In the O AM Sta tus screen click C o nfig ura tio n to display the configuration screen as shown.

XS3800-28 User's Guide
431

Chapter 43 OAM Fig ure 335 Advanced Application > OAM > OAM Configuration (Standalone Mode)
Fig ure 336 Advanced Application > OAM > OAM Configuration (Stacking Mode)

The following table describes the fields in the above screen.

Table 192 Advanced Application > OAM > OAM Configuration

LA BEL

DESC RIPTIO N

Active

Select this option to enable Ethernet OAM on the Switch.

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

XS3800-28 User's Guide
432

Chapter 43 OAM

Table 192 Advanced Application > OAM > OAM Configuration (continued)

LA BEL

DESC RIPTIO N

Port

This field displays the port number. In stacking mode, the first number represents the slot ID

and the second is the port number. Please note that the default stacking ports (the last

four ports of your Switch) cannot be configured. They are reserved for stacking only.

Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Active
Mode
Remote Loopback Supported Remote Loopback Ignore-Rx Apply
Cancel

Note: Changes in this row are copied to all the ports as soon as you make them.
Select this check box to enable Ethernet OAM on this port.
Clear this check box to disable Ethernet OAM on the port.
Specify the OAM mode on the port.
Select Ac tive to allow the port to issue and respond to Ethernet OAM commands.
Select Pa ssive to allow the port to respond to Ethernet OAM commands.
Select this check box to enable the remote loopback feature on the port. Otherwise, clear the check box to disable it.
Select this check box to set the Switch to process loopback commands received on the port. Otherwise, clear the check box to have the Switch ignore loopback commands received on the port.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

43.4 O AM Re m o te Lo o pb a c k
Use this screen to perform a remote loopback test. In the O AM Sta tus screen click Re m o te Lo o pba c k to display the screen as shown.
Fig ure 337 Advanced Application > OAM > OAM Remote Loopback (Standalone Mode)

XS3800-28 User's Guide
433

Chapter 43 OAM Fig ure 338 Advanced Application > OAM > OAM Remote Loopback (Stacking Mode)

The following table describes the fields in the above screen.

Table 193 Advanced Application > OAM > OAM Remote Loopback

LA BEL

DESC RIPTIO N

Remote Loopback Test

Port

Enter the number of the port from which the Switch performs a remote-loopback test.

In stacking mode, the first field is the slot ID and the second field is the port number.

Number of Packet Define the allowable packet number of the loopback test frames.

Packet Size

Define the allowable packet size of the loopback test frames.

Test

Click Te st to begin the test.

Remote Loopback Mode

Port

Enter the number of the port from which the Switch sends loopback control PDUs to initiate

or terminate a remote-loopback test.

Start Stop

In stacking mode, the first field is the slot ID and the second field is the port number.
Click Sta rt to initiate a remote-loopback test from the specified port by sending Enable Loopback Control PDUs to the remote device.
Click Sto p to terminate a remote-loopback test from the specified port by sending Disable Loopback Control PDUs to the remote device.

XS3800-28 User's Guide
434

Chapter 44 ZULD
C HA PTER 4 4 ZULD
44.1 ZULD O ve rvie w
A unidirectional link is a connection where the link is up on both ends, but only one end can receive packets. This may happen if OAM was initially enabled but then disabled, there are mis-configured transmitting or receiving lines or the hardware is malfunctioning. Zyxel Unidirectional Link Detection (ZULD) is a layer-2 protocol that can detect and disable these physical one-way links before they cause loops or communication malfunction. In the figure below, S1A is a bidirectional link as both ends can send packets to each other. S1B is unidirectional as B cannot send packets to S1 (although the S1B link is up). Similarly, S2S1 is unidirectional as S1 cannot send packets to S2 (although the S1S2 link is up). Fig ure 339 ZULD Overview
44.1.1 Wha t Yo u C a n Do
· Use the ZULD Sta tus screen (Section 44.2 on page 436) to see details on ZULD. · Use the ZULD C o nfig ura tio n screen (Section 44.3 on page 438) to enable ZULD on a port, configure a
mode and set the probe time.
44.1.2 Wha t Yo u Ne e d to Kno w
· ZULD must be enabled on the Switch and the ports in order to detect unidirectional links by monitoring OAMPDUs.
XS3800-28 User's Guide
435

Chapter 44 ZULD · Ports advertise their unidirectional link detection capability using OAMPDUs, so all connected devices
must support O AM as well as ZULD. You need to enable OAM on the Switch by going to Adva nc e d Applic a tio n > O AM > C o nfig ura tio n and selecting Ac tive . OAM must be enabled on other connected devices too. If OAM is not enabled initially, ZULD will not work. · If OAM is enabled initially and later disabled on one end of a link, the link will be unidirectional as that end cannot send OAMPDUs. · OAM discovery, the sending of OAMPDUs to other ports, is initiated by an active port. · When ZULD detects a unidirectional link, it sends a syslog and SNMP trap and may shut down the affected port (Ag g re ssive Mo de ). · If a port on the Switch is shut down by ZULD, and you want to recover it, then do one of the following: · Go to Ba sic Se tting > Po rt Se tup. Clear Ac tive and click Apply. Then select Ac tive and click Apply
again. · Go to Adva nc e d Applic a tio n > Errdisa b le > Errdisa b le Re c o ve ry and set the interval for ZULD. After
the interval expires, the closed ports will become active and start receiving packets again. · Use the command port no inactive. · Refer to the ZULD logs to see when a unidirectional link is detected and when it is recovered to a bidirectional link.
44.2 ZULD Sta tus
Use this screen to see details of unidirectional and bidirectional links discovered by ZULD. To open this screen, click Adva nc e d Applic a tio n > ZULD. Fig ure 340 Advanced Application > ZULD Status (Standalone Mode)
XS3800-28 User's Guide
436

Chapter 44 ZULD Fig ure 341 Advanced Application > ZULD Status (Stacking Mode)

The following table describes the fields in the above screen.

Table 194 Advanced Application > ZULD Status

LA BEL

DESC RIPTIO N

ZULD is....

This shows whether ZULD is enabled or disabled on the Switch.

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This field displays the port number. In stacking mode, the first number represents the slot ID

and the second is the port number. Please note that the default stacking ports (the last

four ports of your Switch) cannot be configured. They are reserved for stacking only.

Active

This field displays whether ZULD is enabled on the port or not. ZULD must be enabled to detect an unidirectional link by monitoring OAMPDUs.

Mode

This field indicates what ZULD will do when a unidirectional link is detected. In No rm a l mode, ZULD only sends a syslog and trap when it detects a unidirectional link. In Ag g re ssive mode, ZULD shuts down the port (puts it into an ErrDisa b le state) as well as sends a syslog and trap when it detects a unidirectional link.

Probe Time

Probe time is the length of time that ZULD waits before declaring that a link is unidirectional. When the probe time expires, and one port (either on the Switch or the connected device) still has not received an OAMPDU, then ZULD declares that the link is unidirectional.

Link State

This field shows the following link states:

Remote Operation

· Linkdo wn: This is an initialization state, where the port is not yet up. · Pro b e : This indicates that ZULD is discovering the connected device on this link. · Bidire c tio na l: Traffic sent by the Switch is received by the connected device on this
link, and traffic from the connected device on this link is received by the Switch. · Unidire c tio na l: The state of the link between the port and its connected port cannot
be determined either because no ZULD message was received, or one port is not capable of sending traffic. · Shutdo wn: The port has been shut down because its link with the connected device is unidirectional and ZULD is in Ag g re ssive mode.
This field displays whether ZULD is enabled or disabled on the connected device on this link. ZULD must be enabled on the connected device and on the port that is connecting to the Switch.

XS3800-28 User's Guide
437

Chapter 44 ZULD

Table 194 Advanced Application > ZULD Status (continued)

LA BEL

DESC RIPTIO N

Remote MAC Addr

This is the MAC address of the port on the connected device to which the port of the Switch is connected.

Remote Port

This is the port number of the port on the connected device to which the port of the Switch is connected.

44.3 ZULD C o nfig ura tio n
Use this screen to enable ZULD on a port, configure a mode and set the probe time. To open this screen, click Adva nc e d Applic a tio n > ZULD > C o nfig ura tio n.
Fig ure 342 Advanced Application > ZULD > Configuration (Standalone Mode)

XS3800-28 User's Guide
438

Chapter 44 ZULD Fig ure 343 Advanced Application > ZULD > Configuration (Stacking Mode)

The following table describes the fields in the above screen.

Table 195 Advanced Application > ZULD > Configuration

LA BEL

DESC RIPTIO N

Active

Select this to enable ZULD on the Switch.

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This field displays the port number. In stacking mode, the first number represents the slot ID

and the second is the port number. Please note that the default stacking ports (the last

four ports of your Switch) cannot be configured. They are reserved for stacking only.

Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Active Mode Probe Time

Note: Changes in this row are copied to all the ports as soon as you make them.
Select this to enable ZULD on the port. ZULD must be enabled to detect an unidirectional link by monitoring OAMPDUs.
Select No rm a l or Ag g re ssive . In No rm a l mode, ZULD only sends a syslog and trap when it detects a unidirectional link. In Ag g re ssive mode, ZULD shuts down the port (puts it into an ErrDisa b le state) as well as sends a syslog and trap when it detects a unidirectional link.
Type the length of time that ZULD waits before declaring that a link is unidirectional. When the probe time expires, and one port (either on the Switch or the connected device) still has not received an OAMPDU, then ZULD declares that the link is unidirectional.
The allowed time range is from 5 65535 seconds.

XS3800-28 User's Guide
439

Chapter 44 ZULD

Table 195 Advanced Application > ZULD > Configuration (continued)

LA BEL

DESC RIPTIO N

Apply

Cancel

Click this to reset the values in this screen to their last-saved values.

XS3800-28 User's Guide
440

Chapter 45 NLB
C HA PTER 4 5 NLB
45.1 NLB O ve rvie w
The Switch supports NLB (Network Load Balancing) traffic distribution. The Switch will copy and forward the incoming traffic to a cluster. Each server in a cluster tackles a separate copy of traffic. Fig ure 344 NLB Traffic Distribution
The Switch only supports up to two clusters for NLB traffic distribution. Note: NLB settings are configured on the servers. See Section 45.1.2 on page 442 for more information about NLB.
45.1.1 Wha t Yo u C a n Do
· Use the MAC Fo rwa rding screen (Section 45.2 on page 442) to configure to which MAC addresses and ports the Switch should forward the incoming NLB traffic.
· Use the IP C o nfig ura tio n screen (Section 45.3 on page 444) to map the IP address to the MAC address of a cluster for layer-3 forwarding.
XS3800-28 User's Guide
441

Chapter 45 NLB
45.1.2 Wha t Yo u Ne e d to Kno w
NLB
Network Load Balancing (NLB) is a feature developed by Microsoft. NLB enhances the performance reliability for critical applications by sharing traffic with multiple servers in a cluster using TCP/IP protocol. Each server of a cluster tackles a copy of a traffic. You can create a cluster by grouping up to 32 servers together. If a server in a cluster fails, traffic will be redistributed to the other operating servers. When the server is back in service, it will join the cluster automatically and share the traffic.
Unic a st Mo de
NLB replaces the real MAC addresses of the servers in a cluster with a unicast MAC address. Each server uses the same unicast MAC address, and a switch cannot map the unicast MAC address to a port. This forces a switch to flood traffic meant for the cluster to all ports of the switch to make sure the traffic is forwarded to the right destination. The servers in a cluster cannot communicate with each other, because they use the same unicast MAC address.
Multic a st Mo de
NLB assigns a multicast MAC address to the servers in a cluster. Therefore, each server has two MAC addresses, the real MAC address and the multicast MAC address. Create static ARP entries on a switch for the servers, so the switch will only forward traffic to the servers of the cluster. The servers in a cluster can communicate with each other, because they keep their real MAC address and already have their own IP addresses.
45.2 MAC Fo rwa rding
Use this screen to configure to which MAC addresses and ports the Switch should forward the incoming NLB traffic. Click Adva nc e d Applic a tio n > NLB in the navigation panel to display the screen as shown. Note: The following screens cannot have duplicate settings as the Adva nc e d Applic a tio n >
NLB screen. · Adva nc e d Applic a tio n > Sta tic MAC Fo rwa rding · Adva nc e d Applic a tio n > Sta tic Multic a st Fo rwa rding · Adva nc e d Applic a tio n > Filte ring
XS3800-28 User's Guide
442

Chapter 45 NLB Fig ure 345 Advanced Application > NLB

The following table describes the labels in this screen.

Table 196 Advanced Application > NLB

LA BEL

DESC RIPTIO N

MAC forwarding

Name

Enter a descriptive name for identification purposes for this rule.

MAC Address

Enter a multicast or unicast MAC address of a cluster.

The last binary bit of the first octet pair in a multicast MAC address must be 1. For example, the first octet pair 00000001 is 01 and 00000011 is 03 in hexadecimal, so 01:00:5e:00:00:0A and 03:00:5e:00:00:27 are valid multicast MAC addresses.

VID

Enter the VLAN identification number. If you do not have a specific target VLAN, enter 1.

The Switch will forward traffic to ports in this VLAN group.

Port

Enter the ports to which you want the Switch to forward the incoming NLB traffic.

You can enter multiple ports separated by (no space) comma (,) or hyphen (). For example, enter "35" for ports 3, 4, and 5. Enter "3,5,7" for ports 3, 5, and 7.

Add
Cancel Clear Index Name MAC Address VID Port

In stacking mode, the first number represents the slot and the second the port number. Enter 1/ 1-1/24,2/23 for ports 1 to 24 for the Switch in slot 1 and port 23 for the Switch in slot 2, for example.
Click Add to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click Cancel to begin configuring this screen afresh.
Click C le a r to reset the fields to the factory defaults.
This field displays the index number of the rule.
This field displays the descriptive name of the rule.
This field displays the multicast or unicast MAC address of this rule.
This field displays the VLAN group identification number.
This field displays the ports to which the Switch will forward the incoming NLB traffic.

XS3800-28 User's Guide
443

Chapter 45 NLB

Table 196 Advanced Application > NLB (continued)

LA BEL

DESC RIPTIO N

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Click De le te to remove the selected entry from the summary table.

Cancel

Click C a nc e l to clear the check boxes.

45.3 IP C o nfig ura tio n
Use this screen to map the IP address to the MAC address of a cluster for layer-3 forwarding. Use the MAC address added in the Adva nc e d Applic a tio n > NLB screen.
Click Adva nc e d Applic a tio n > NLB > IP c o nfig ura tio n in the navigation panel to display the screen as shown.
Note: The settings configured in the Adva nc e d Applic a tio n > NLB > IP c o nfig ura tio n and IP Applic a tio n > ARP Se tup > Sta tic ARP screens cannot duplicate.
Fig ure 346 Advanced Application > NLB > IP Configuration

The following table describes the labels in this screen.

Table 197 Advanced Application > NLB > IP Configuration

LA BEL

DESC RIPTIO N

IP Configuration

Name

Enter a descriptive name for identification purposes for this rule.

IP Address

Enter an IPv4 or IPv6 address for a cluster.

MAC Address

Enter a multicast or unicast MAC address added in the Adva nc e d Applic a tio n > NLB screen.

Add

The last binary bit of the first octet pair in a unicast MAC address must be 0. For example, the first octet pair 00000000 is 00 and 00000010 is 02 in hexadecimal, so 00:00:5e:00:00:0A and 02:00:5e:00:00:27 are valid unicast MAC addresses.
Click Add to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.

XS3800-28 User's Guide
444

Chapter 45 NLB

Table 197 Advanced Application > NLB > IP Configuration (continued)

LA BEL

DESC RIPTIO N

Cancel

Click Cancel to begin configuring this screen afresh.

Clear

Click C le a r to reset the fields to the factory defaults.

Index

This field displays the index number of the rule.

Name

This field displays the descriptive name of the rule.

IP Address

This field displays the IP address of the cluster.

MAC Address

This field displays the multicast or unicast MAC address of this rule.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Click De le te to remove the selected entry from the summary table.

Cancel

Click C a nc e l to clear the check boxes.

XS3800-28 User's Guide
445

Chapter 46 Wol Relay
C HA PTER 4 6 Wo l Re la y
46.1 Wo l Re la y O ve rvie w
Wake On LAN is a feature to remotely turn on a device on the LAN network. A device is turned on by receiving a magic packet. To use this feature the remote hardware (for example the network adapter on a computer) must support Wake On LAN using the "Magic Packet" method. A magic packet is a UDP broadcast packet. The device that you want to turn on is off, so it cannot respond to a TCP packet. Therefore, It has to be a UDP broadcast packet to turn on a device. Broadcast packets are generally not routed. A magic packet cannot be routed. This prevents DDoS attacks, but also prohibits you from sending magic packets to other devices in different subnets. The Switch's Wake On LAN relay feature allows you to send magic packets to devices across different subnets.
46.2 Wo l Re la y
Use this screen to configure settings on Wake On LAN relay. Click Adva nc e d Applic a tio n > Wo l Re la y to open the following screen. Fig ure 347 Advanced Application > Wol Relay
XS3800-28 User's Guide
446

Chapter 46 Wol Relay

The following table describes the labels in this screen.

Table 198 Advanced Application > Wol Relay

LA BEL

DESC RIPTIO N

Wol Relay

UDP

Enter a UDP port number that magic packets are sent through.

Source VLAN Destination VLAN Add
Cancel Clear Index UDP Source VLAN Destination VLAN
Delete Cancel

The most common port for transmission is UDP port 9. Enter the source VLAN ID where the magic packet originates from. Enter the destination VLAN ID where the magic packet will be sent to. Click Add to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Click Cancel to begin configuring this screen afresh. Click C le a r to reset the fields to the factory defaults. This field displays the index number of the rule. This field displays the UDP port of the rule. This field displays the source VLAN ID of the rule. This field displays the destination VLAN ID of the rule. Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries. Click De le te to remove the selected entry from the summary table. Click C a nc e l to clear the check boxes.

XS3800-28 User's Guide
447

C HA PTER 4 7 Sta tic Ro ute
47.1 Sta tic Ro uting O ve rvie w
This chapter shows you how to configure static routes. The Switch uses IP for communication with management computers, for example using HTTP, Telnet, SSH, or SNMP. Use IP static routes to have the Switch respond to remote management stations that are not reachable through the default gateway. The Switch can also use static routes to send data to a server or device that is not reachable through the default gateway, for example when sending SNMP traps or using ping to test IP connectivity. The Switch usually uses the default gateway to route outbound traffic from computers on the LAN to the Internet. To have the Switch send data to devices not reachable through the default gateway, use static routes. For example, the next figure shows a computer (A) connected to the Switch. The Switch routes most traffic from A to the Internet through the Switch's default gateway (R1). You create one static route to connect to services offered by your ISP behind router R2. You create another static route to communicate with a separate network behind a router R3 connected to the Switch. Fig ure 348 Example of Static Routing Topology
N1
47.1.1 Wha t Yo u C a n Do
· Use the Sta tic Ro uting screen (Section 47.2 on page 449) to display the link to the IPv4 Sta tic Ro ute screen.
· Use the IPv4 Sta tic Ro ute screen (Section 47.3 on page 449) to configure and enable an IPv4 static route.
· Use the IPv6 Sta tic Ro ute screen (Section 47.4 on page 450) to configure and enable an IPv6 static route. XS3800-28 User's Guide
448

Chapter 47 Static Route
47.2 Sta tic Ro uting
Click IP Applic a tio n > Sta tic Ro uting in the navigation panel to display the screen as shown. Click the link next to IPv4 Sta tic Ro ute to open a screen where you can create IPv4 static routing rules. Click the link next to IPv6 Sta tic Ro ute to open a screen where you can create IPv6 static routing rules. Fig ure 349 IP Application > Static Routing
47.3 IPv4 Sta tic Ro ute
Click the link next to IPv4 Sta tic Ro ute in the IP Applic a tio n > Sta tic Ro uting screen to display the screen as shown. Fig ure 350 IP Application > Static Routing > IPv4 Static Route

The following table describes the related labels you use to create a static route.

Table 199 IP Application > Static Routing > IPv4 Static Route

LA BEL

DESC RIPTIO N

Active

This field allows you to activate or deactivate this static route.

Name

Enter a descriptive name (up to 10 printable ASCII characters) for identification purposes.

Destination IP Address

This parameter specifies the IP network address of the final destination.

IP Subnet Mask

Enter the subnet mask for this destination. Routing is always based on network number. If you need to specify a route to a single host, use a subnet mask of 255.255.255.255 in the subnet mask field to force the network number to be identical to the host ID.

Gateway IP Address

Enter the IP address of the gateway. The gateway is an immediate neighbor of your Switch that will forward the packet to the destination. The gateway must be a router on the same segment as your Switch.

XS3800-28 User's Guide
449

Chapter 47 Static Route

Table 199 IP Application > Static Routing > IPv4 Static Route (continued)

LA BEL

DESC RIPTIO N

Metric

The metric represents the "cost" of transmission for routing purposes. IP routing uses hop count as the measurement of cost, with a minimum of 1 for directly connected networks. Enter a number that approximates the cost for this link. The number need not be precise, but it must be between 1 and 15. In practice, 2 or 3 is usually a good number.

Add

Click Add to insert a new static route to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.

Cancel

Click C a nc e l to reset the above fields to your previous configuration.

Clear

Click C le a r to set the above fields back to the factory defaults.

Index

This field displays the index number of the route. Click a number to edit the static route entry.

Active

This field displays Ye s when the static route is activated and NO when it is deactivated.

Name

This field displays the descriptive name for this route. This is for identification purposes only.

Destination Address

This field displays the IP network address of the final destination.

Subnet Mask

This field displays the subnet mask for this destination.

Gateway Address Metric
Delete Cancel

This field displays the IP address of the gateway. The gateway is an immediate neighbor of your Switch that will forward the packet to the destination.
This field displays the cost of transmission for routing purposes.
Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.
Click De le te to remove the selected entry from the summary table.
Click C a nc e l to clear the check boxes.

47.4 IPv6 Sta tic Ro ute
Click the link next to IPv6 Sta tic Ro ute in the IP Applic a tio n > Sta tic Ro uting screen to display the screen as shown.
Fig ure 351 IP Application > Static Routing > IPv6 Static Route

XS3800-28 User's Guide
450

Chapter 47 Static Route

The following table describes the related labels you use to create a static route.

Table 200 IP Application > Static Routing > IPv6 Static Route

LA BEL

DESC RIPTIO N

Route Destination

Enter the IPv6 address of the final destination.

Prefix Length

Enter the prefix length number of up to 64 for this destination.

Next Hop Interface Type

Enter the IPv6 address of the next-hop router. Select the type of the IPv6 interface through which the IPv6 packets are forwarded.

The Switch supports only the VLAN interface type at the time of writing.

Interface ID

Enter the ID number of the IPv6 interface through which the IPv6 packets are forwarded.

Add

Cancel

Click C a nc e l to begin configuring this screen afresh.

Index

This field displays the index number of the route. Click a number to edit the static route entry.

Interface

This field displays the descriptive name of the interface that is used to forward the packets to the destination.

Route

This field displays the IPv6 subnet prefix and prefix length of the final destination.

Destination/Prefix

Length

Next Hop

This field displays the IPv6 address of the gateway that helps forward the packet to the destination.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Click De le te to remove the selected entry from the summary table.

Cancel

Click C a nc e l to clear the check boxes.

XS3800-28 User's Guide
451

C HA PTER 4 8 Po lic y Ro uting
This chapter shows you how to configure policy routing rules.
48.1 Po lic y Ro ute O ve rvie w
Traditionally, routing is based on the destination address only and the Switch takes the shortest path to forward a packet. Policy routing provides a mechanism to override the default routing behavior and alter the packet forwarding based on the policy defined by the network administrator. Policy-based routing is applied to incoming packets prior to the normal routing. Individual routing policies are used as part of the overall policy routing process. A routing policy defines the action to take when a packet meets the criteria in a specified classifier. The action is taken only when all the criteria are met.
48.1.1 Be ne fits
· Source-Based Routing Network administrators can use policy-based routing to direct traffic from different users through different connections.
· Cost Savings Policy routing allows organizations to distribute interactive traffic on high-bandwidth, high-cost paths while using low-cost paths for batch traffic.
· Load Sharing Network administrators can use policy routing to distribute traffic among multiple paths.
48.2 C o nfig uring Po lic y Ro uting Pro file
Click IP Applic a tio n > Po lic y Ro uting in the navigation panel to display the screen as shown. Use this screen to configure a policy routing profile, which can consist of multiple policy routing rules. Fig ure 352 IP Application > Policy Routing
XS3800-28 User's Guide
452

Chapter 48 Policy Routing

The following table describes the labels in this screen.

Table 201 IP Application > Policy Routing

LA BEL

DESC RIPTIO N

Active

This field allows you to activate or deactivate this policy routing profile and rules in the profile.

Profile Name

Enter a descriptive name (up to 32 printable ASCII characters) for identification purposes. Spaces are allowed.

Add

Click this to create a new entry or to update an existing one.

Cancel Clear Index
Active Profile Name
Delete Cancel

This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to reset the fields to your previous configuration.
Click C le a r to set the above fields back to the factory defaults.
This field displays the index number of the policy routing profile. Click a number to edit the policy routing profile entry.
This field displays Ye s when the policy routing profile is activated and No when it is deactivated.
This field displays the descriptive name for this profile. This is for identification purposes only.
Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.
Click De le te to remove the selected entry from the summary table.
Click C a nc e l to clear the check boxes.

48.2.1 Po lic y Ro uting Rule C o nfig ura tio n
You must first configure a layer-3 classifier in the C la ssifie r screen and a policy routing profile in the Po lic y Ro uting screen.
Use this screen to configure a policy route to override the default (shortest path) routing behavior and forward packets based on the classifier and action you specify. A policy route rule defines the matching classifier and the action to take when a packet meets the criteria in the classifier. The action is taken only when all the criteria are met. Policy-based routing is applied to incoming packets on a per interface basis before normal routing. The Switch does not perform normal routing on packets that match any of the policy routes.
Click Rule C o nfig ura tio n in the IP Applic a tio n > Po lic y Ro uting screen to display the screen as shown.

XS3800-28 User's Guide
453

Chapter 48 Policy Routing Fig ure 353 IP Application > Policy Routing > Rule Configuration

The following table describes the labels in this screen.

Table 202 IP Application > Policy Routing > Rule Configuration

LA BEL

DESC RIPTIO N

Profile Name

This field displays the policy routing profiles you configure in the IP Applic a tio n > Po lic y Ro uting screen.

Sequence

Select a profile for which you want to configure a policy routing rule.
Enter the rule number from 1 to 64. The ordering of your rules is important as rules are applied in turn.

Statement

You can not specify a number already in use by another rule. Select Pe rm it to forward traffic that matches this rule to the gateway specified in the rule.

Classifier

Select De ny to disable the rule action and forward traffic that matches this rule according to the routing table on the Switch.
This field displays the available active classifiers you configure in the C la ssifie r screen, which are not used by any policy rule or policy routing rule.

Action Add

Select a classifier to which this policy routing rule applies.
Enter the IP address of the gateway. The gateway is an immediate neighbor of your Switch that will forward the packet to the destination.
Click this to create a new entry or to update an existing one.

Cancel Clear Active Profile Name Seq
State

XS3800-28 User's Guide
454

Chapter 48 Policy Routing

Table 202 IP Application > Policy Routing > Rule Configuration (continued)

LA BEL

DESC RIPTIO N

Classifier

This field displays the name of the classifier to which this policy applies.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Click De le te to remove the selected entries from the summary table.

Cancel

Click C a nc e l to clear the check boxes.

XS3800-28 User's Guide
455

Chapter 49 RIP
C HA PTER 4 9 RIP

This chapter shows you how to configure RIP (Routing Information Protocol).

49.1 RIP O ve rvie w
RIP (Routing Information Protocol) allows a routing device to exchange routing information with other routers. The Dire c tio n field controls the sending and receiving of RIP packets. When set to:
· Bo th the Switch will broadcast its routing table periodically and incorporate the RIP information that it receives.
· Inc o m ing the Switch will not send any RIP packets but will accept all RIP packets received. · O utg o ing the Switch will send out RIP packets but will not accept any RIP packets received. · No ne the Switch will not send any RIP packets and will ignore any RIP packets received.
The Ve rsio n field controls the format and the broadcasting method of the RIP packets that the Switch sends (it recognizes both formats when receiving). RIP- 1 is universally supported; but RIP-2 carries more information. RIP- 1 is probably adequate for most networks, unless you have an unusual network topology.
Both RIP- 2B and RIP- 2M send the routing data in RIP-2 format; the difference being that RIP- 2B uses subnet broadcasting while RIP- 2M uses multicasting.
RIPv2 uses UDP port 520 and the multicast address 224.0.0.9.

49.1.1 Adm inistra tive Dista nc e
When two or more than two different routing protocols, such as RIP and OSPF provide multiple routes to the same destination, the Switch can use the administrative distance of the route to determine which routing protocol to use and add the route to the routing table.
The lower the administrative distance value is, the more preferable the routing protocol is. If two routes have the same administrative distance value, the Switch uses the route that has the lowest metric value. The following table lists the default administrative distance value of the route sources supported on the Switch.

Table 203 Default Distance Value

RO UTE SO URC E

ADMINISTRATIVE DISTANC E

Local

Static

XS3800-28 User's Guide
456

Chapter 49 RIP

Table 203 Default Distance Value (continued)

RO UTE SO URC E

ADMINISTRATIVE DISTANC E

OSPF

110

RIP

120

49.2 RIP C o nfig ura tio n
Click IP Applic a tio n > RIP in the navigation panel to display the screen as shown. Click the link next to IPv4 RIP to open a screen where you can enable RIP for IPv4 and configure the RIP version and direction for an IP interface. Fig ure 354 IP Application > RIP

49.3 C o nfig uring IPv4 RIP
Click IP Applic a tio n > RIP > IPv4 RIP in the navigation panel to display the screen as shown. You cannot manually configure a new entry. Each entry in the table is automatically created when you configure a new IP domain in the IP Se tup screen.
Fig ure 355 IP Application > RIP > IPv4 RIP

The following table describes the labels in this screen.

Table 204 IP Application > RIP > IPv4 RIP

LA BEL Active Distance

DESC RIPTIO N
Select this check box to enable IPv4 RIP on the Switch.
Enter a number from 10 to 255 to specify the administrative distance that is assigned to routes learned by RIP.

The lower the administrative distance value is, the more preferable the routing protocol is.

Index

Note: You cannot set two routing protocols to have the same administrative distance.
This field displays the index number of an IP interface.

XS3800-28 User's Guide
457

Chapter 49 RIP

Table 204 IP Application > RIP > IPv4 RIP (continued)

LA BEL *

DESC RIPTIO N Settings in this row apply to all entries.

Use this row only if you want to make some settings the same for all entries. Use this row first to set the common settings and then make adjustments on a per entry basis.

Network
Direction Version Apply
Cancel

Note: Changes in this row are copied to all the entries as soon as you make them.
This field displays the IP interface configured on the Switch.
Refer to the section on IP Setup for more information on configuring IP domains.
Select the RIP direction from the drop-down list box. Choices are O utg o ing , Inc o m ing , Bo th and No ne .
Select the RIP version from the drop-down list box. Choices are RIP- 1, RIP- 2B and RIP- 2M.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
458

Chapter 50 OSPF
C HA PTER 5 0 O SPF

This chapter describes the OSPF (Open Shortest Path First) routing protocol and shows you how to configure OSPF.

50.1 O SPF O ve rvie w

OSPF (Open Shortest Path First) is a link-state protocol designed to distribute routing information within an autonomous system (AS). An autonomous system is a collection of networks using a common routing protocol to exchange routing information.

OSPF offers some advantages over traditional vector-space routing protocols (such as RIP). The following table summarizes some of the major differences between OSPF and RIP.

Table 205 OSPF vs. RIP

O SPF

Network Size Large

Metrics

Bandwidth, hop count, throughput, round trip time and reliability.

Convergence Fast

RIP Small (with up to 15 routers) Hop count
Slow

The Switch uses OSPFv2 for IPv4. OSPFv2 uses plain text or MD5 authentication.

50.1.1 O SPF Auto no m o us Syste m s a nd Are a s

An OSPF autonomous system (AS) can be divided into logical areas. Each area represents a group of adjacent networks. All areas are connected to a backbone (also known as area 0). The backbone is the transit area to route packets between two areas. A stub area, at the edge of an AS is not a transit area since there is only one connection to the stub area.

The following table describes the four classes of OSPF routers.

Table 206 OSPF: Router Types

TYPE

DESC RIPTIO N

Internal Router (IR)

An Internal or intra-area router is a router in an area.

Area Border Router (ABR)

An Area Border Router connects two or more areas.

Backbone Router (BR)

A backbone router has an interface to the backbone.

AS Boundary Router

An AS boundary router exchanges routing information with routers in other ASs.

The following figure depicts an OSPF network example. The backbone is area 0 with a backbone router.

XS3800-28 User's Guide
459

Chapter 50 OSPF
The internal routers are in area 1 and 2. The area border routers connect area 1 and 2 to the backbone. Fig ure 356 OSPF Network Example
50.1.2 Ho w O SPF Wo rks
Layer-3 devices exchange routing information to build a synchronized link state database within the same AS or area. The link state database contains records of router IDs, their associated links and path costs. Each device can then use the link state database and Dijkstra algorithm to compute the least cost paths to network destinations. Layer-3 devices build a synchronized link state database by exchanging Hello messages to confirm which neighbor (layer-3) devices exist and then they exchange database descriptions (DDs) to create the link state database. The link state database is constantly updated through LSAs (Link State Advertisements).
50.1.3 Inte rfa c e s a nd Virtua l Links
An OSPF interface is a link between a layer-3 device and an OSPF network. An interface has state information, an IP address and subnet mask associated with it. When you configure an OSPF interface, you first set an interface to transmit OSPF traffic and add the interface to an area. You can configure a virtual link to establish/maintain connectivity between a non-backbone area and the backbone. The virtual link must be configured on both layer-3 devices in the non-backbone area and the backbone.
50.1.4 O SPF a nd Ro ute r Ele c tio ns
The OSPF protocol provides for automatic election of Designated Router (DR) and Backup Designated Router (BDR) on network segments. The DR and BDR keep track of link state updates in their area and make sure LSAs are sent to the rest of the network. In most cases the default DR/BDR election is fine, but in some situations it must be controlled. In the following figure only router A has direct connectivity with all the other routers on the network segment. Routers B and C do not have a direct connection with each other. Therefore they should not be allowed
XS3800-28 User's Guide
460

Chapter 50 OSPF to become DR or BDR. Only router A should become the DR. Fig ure 357 OSPF Router Election Example
You can assign a priority to an interface which determines whether this router will be elected to be a DR or BDR. The router with the highest priority becomes the DR, while a router with a priority of 0 does not participate in router elections. In Figure 357 on page 461 you can assign a priority of 0 to routers B and C , thereby ensuring they do not become DR or BDR and assign a priority of 1 to router A to make sure that it does become the DR.
50.1.5 C o nfig uring O SPF
To configure OSPF on the Switch, do the following tasks: 1 Enable OSPF. 2 Create OSPF areas. 3 Create and associate interfaces to an area. 4 Create virtual links to maintain backbone connectivity.
50.2 O SPF Sc re e n
Click IP Applic a tio n > O SPF in the navigation panel to display the screen as shown. Click the link next to IPv4 O SPF to open screens where you can view IPv4 OSPF status and configure OSPF for IPv4. Fig ure 358 IP Application > OSPF
XS3800-28 User's Guide
461

Chapter 50 OSPF
50.3 IPv4 O SPF Sta tus
Use this screen to view current IPv4 OSPF status. Click IP Applic a tio n > O SPF > IPv4 O SPF the navigation panel to display the screen as shown next. See Section 50.1 on page 459 for more information on OSPF. Fig ure 359 IP Application > OSPF > IPv4 OSPF > OSPF Status

The following table describes the labels in this screen.

Table 207 IP Application > OSPF > IPv4 OSPF > OSPF Status

LA BEL

DESC RIPTIO N

OSPF

This field displays whether OSPF is activated (Running ) or not (Do wn).

Interface

The text box displays the OSPF status of the interfaces on the Switch.

Neighbor

The text box displays the status of the neighboring router participating in the OSPF network.

Link State Database

The text box displays information in the link state database which contains data in the LSAs.

Poll Interval(s)

The text box displays how often (in seconds) this screen refreshes. You may change the refresh interval by typing a new number in the text box and then clicking Se t Inte rva l.

Stop

Click Sto p to end OSPF status polling.

XS3800-28 User's Guide
462

Chapter 50 OSPF

The following table describes some common output fields.

Table 208 IP Application > IPv4 OSPF > OSPF Status: Common Output Fields

FIELD

DESC RIPTIO N

Interface

Internet Address

This field displays the IP address and subnet bits of an IP routing domain.

Area

This field displays the area ID.

Router ID

This field displays the unique ID of the Switch.

Transmit Delay

This field displays the transmission delay in seconds.

State

This field displays the state of the Switch (b a c kup or DR (designated router)).

Priority

This field displays the priority of the Switch. This number is used in the designated router election.

Designated Router This field displays the router ID of the designated router.

Backup Designated This field displays the router ID of a backup designated router. Router

Time Intervals Configured

This field displays the time intervals (in seconds) configured.

Neighbor Count

This field displays the number of neighbor routers.

Adjacent Neighbor This field displays the number of neighbor routers that is adjacent to the Switch. Count

Neighbor

Neighbor ID

This field displays the router ID of the neighbor.

Pri

This field displays the priority of the neighbor. This number is used in the designated router

election.

State

This field displays the state of the neighbor (b a c kup or DR (designated router)).

Dead Time

This field displays the dead time in seconds.

Address

This field displays the IP address of a neighbor.

Interface

This field displays the MAC address of a device.

Link State Database

Link ID

This field displays the ID of a router or subnet.

ADV Router

This field displays the IP address of the layer-3 device that sends the LSAs.

Age

This field displays the time (in seconds) since the last LSA was sent.

Seq #

This field displays the link sequence number of the LSA.

Checksum

This field displays the checksum value of the LSA.

Link Count

This field displays the number of links in the LSA.

XS3800-28 User's Guide
463

50.4 IPv4 O SPF C o nfig ura tio n
Use this screen to activate OSPF for IPv4 and set general settings. Click IP Applic a tio n > O SPF > IPv4 O SPF > C o nfig ura tio n to display the IPv4 O SPF C o nfig ura tio n screen. See Section 50.1 on page 459 for more information on OSPF.
Fig ure 360 IP Application > IPv4 OSPF > Configuration

The follow table describes the related labels in this screen.

Table 209 IP Application > IPv4 OSPF > Configuration

LA BEL

DESC RIPTIO N

Active Router ID
Distance

OSPF for IPv4 is disabled by default. Select this option to enable it.
Router ID uniquely identifies the Switch in an OSPF. Enter a unique ID (that uses the format of an IP address in dotted decimal notation) for the Switch.
Enter a number from 10 to 255 to specify the administrative distance that is assigned to routes learned by OSPF.

The lower the administrative distance value is, the more preferable the routing protocol is.

Defaultinformation Originate
Always
Metric

Note: You cannot set two routing protocols to have the same administrative distance.
Select Ac tive to advertise a default route in your OSPF network if there is one in the routing table. When no matching route is found in the routing table, the default route will be used to forward traffic.
Select the check box to have the Switch advertise a default route to neighboring OSPF routers even if the Switch does not have one in its routing table.
Enter a route cost (between 0 and 16777215) for the default route.

XS3800-28 User's Guide
464

Chapter 50 OSPF

Table 209 IP Application > IPv4 OSPF > Configuration (continued)

LA BEL Metric Type

DESC RIPTIO N
Select 1 to configure the default route as type 1, which has a default cost (metric) of 20 and adds up the cost toward the destination. Its external metrics are directly comparable to the internal OSPF cost. When selecting a path, the internal OSPF cost is added to the AB boundary router to the external metrics.

Apply Cancel

Select 2 to configure the default route as type 2. The route has a default cost of 20 and the metric will never change along a traffic path. Its external metrics are not comparable to the OSPF cost. In this case, the external cost of the AB boundary router is used in path decision to a destination.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

50.5 C o nfig ure IPv4 O SPF Are a s
To ensure that the Switch receives only routing information from a trusted layer-3 devices, activate authentication. The OSPF supports three levels of authentication:
· No ne no authentication is used. · Simple authenticate link state updates using an 8 printable ASCII character password. · MD5 authenticate link state updates using a 16 printable ASCII character password.

XS3800-28 User's Guide
465

Chapter 50 OSPF
To configure an area, set the related fields in the IPv4 O SPF C o nfig ura tio n screen. Fig ure 361 IP Application > OSPF > IPv4 OSPF > Configuration: Area Setup

The following table describes the related labels in this screen.

Table 210 IP Application > OSPF > IPv4 OSPF > Configuration: Area Setup

LA BEL

DESC RIPTIO N

Name

Enter a descriptive name (up to 32 printable ASCII characters) for identification purposes.

Area ID

Enter a 32-bit ID (that uses the format of an IP address in dotted decimal notation) that uniquely identifies an area.

Authentication

A value of 0.0.0.0 indicates that this is a backbone (also known as Area 0). You can create only one backbone area on the Switch.
Select an authentication method (Sim ple or MD5) to activate authentication. Select No ne (default) to disable authentication.

Stub / NSSA

Usually interfaces and virtual interfaces should use the same authentication method as the associated area. If interfaces and virtual interfaces use different authentication methods than the associated area, the authentication methods are based on the interfaces and virtual interfaces settings.
Select this option to set the area as a stub area or a not-so-stubby area.

If you enter 0.0.0.0 in the Are a ID field, the settings in the stub area fields are ignored.

No Summary Select this option to set the Switch to not send or receive LSAs.

Default route cost

Specify a cost (between 0 and 16777215) used to add a default route into a stub area for routes which are external to an OSPF domain. If you do not set a route cost, no default route is added.

XS3800-28 User's Guide
466

Chapter 50 OSPF

Table 210 IP Application > OSPF > IPv4 OSPF > Configuration: Area Setup (continued)

LA BEL

DESC RIPTIO N

Add

Click Add to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.

Cancel

Click C a nc e l to begin configuring this screen afresh.

Clear

Click C le a r to reset the fields to default settings.

50.5.1 Vie w O SPF Are a Info rm a tio n Ta b le
The bottom of the IPv4 O SPF C o nfig ura tio n screen displays a summary table of all the OSPF areas you have configured.
Fig ure 362 IP Application > OSPF > IPv4 OSPF > Configuration: Summary Table

The following table describes the related labels in this screen.

Table 211 IP Application > OSPF > IPv4 OSPF > Configuration: Summary Table

LA BEL

DESC RIPTIO N

Index Name Area ID

This field displays the index number of an area.
This field displays the descriptive name of an area.
This field displays the area ID (that uses the format of an IP address in dotted decimal notation) that uniquely identifies an area.

Authentication Stub / NSSA
Delete Cancel

An area ID of 0.0.0.0 indicates the backbone. This field displays the authentication method used (No ne , Sim ple or MD5). This field displays the area defined (Stub , NSSA or No ne ). Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries. Click De le te to remove the selected entry from the summary table. Click C a nc e l to clear the check boxes.

50.6 C o nfig uring IPv4 O SPF Re distrib utio n
Use this screen to configure route redistribution and summary addresses. Route redistribution is used when other routers which use RIP routing protocol and/or static routes need to exchange routing information with the Switch using OSPF routing protocol. A summary address is used to cover more than one routing entries in order to reduce the routing table size.

XS3800-28 User's Guide
467

Chapter 50 OSPF
In the IPv4 O SPF C o nfig ura tio n screen, click Re distrib ute to display the O SPF Re distrib utio n screen. Fig ure 363 IP Application > OSPF > IPv4 OSPF > Configuration > Redistribute

The following table describes the labels in this screen.

Table 212 IP Application > OSPF > IPv4 OSPF > Configuration > Redistribute

LA BEL

DESC RIPTIO N

Redistribute Route

Route redistribution allows your Switch to import and translate external routes learned through RIP routing protocol or configured manually (Sta tic ) into the OSPF network transparently.

Active

Select this option to activate route redistribution for routes learned through the selected protocol.

Type

Select 1 for routing protocols (such as RIP) whose external metrics are directly comparable to the internal OSPF cost. When selecting a path, the internal OSPF cost is added to the AB boundary router to the external metrics.

Metric Value Apply
Cancel Summary address

Select 2 for routing protocols whose external metrics are not comparable to the OSPF cost. In this case, the external cost of the AB boundary router is used in path decision to a destination.
Enter a route cost (between 0 and 16777215). The default metric value is 15.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.
Enter a network IP address which can cover more than one network in order to reduce the routing table size. For example, you can use 192.168.8.0/22 instead of using 192.168.8.0/24, 192.168.9.0/24, 192.168.10.0/24, and 192.168.11.0/24.

Subnet mask Add
Cancel

The third octet of these four network IP addresses is 00001000, 00001001, 00001010, 00001011 respectively. The first 6 digits (000010) are the common part among these IP addresses. So 192.168.8.0/22 can represent all of these networks.
Enter the subnet mask for this summary IP address which can cover multiple networks.
Click Add to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
468

Chapter 50 OSPF

Table 212 IP Application > OSPF > IPv4 OSPF > Configuration > Redistribute (continued)

LA BEL

DESC RIPTIO N

Index

This field displays the index number of the summary address.

Summary address

This field displays the summary IP address.

Subnet mask

This field displays the subnet mask for the summary IP address.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Check the rules that you want to remove and then click the De le te button.

Cancel

Click C a nc e l to clear the check boxes.

50.7 C o nfig uring IPv4 O SPF Inte rfa c e s
To configure an OSPF interface, first create an IP routing domain in the IP Se tup screen. Once you create an IP routing domain, an OSPF interface entry is automatically created. See Section 50.1 on page 459 for more information on OSPF.
In the IPv4 O SPF C o nfig ura tio n screen, click Inte rfa c e to display the O SPF Inte rfa c e screen.
Fig ure 364 IP Application > OSPF > IPv4 OSPF > Configuration > Interface

The following table describes the labels in this screen.

Table 213 IP Application > OSPF > IPv4 OSPF > Configuration > Interface

LA BEL

DESC RIPTIO N

Network

Select an IP interface.

Area ID

Select the area ID (in an IP address format with dotted decimal notation) of an area to associate the interface to that area.

XS3800-28 User's Guide
469

Chapter 50 OSPF

Table 213 IP Application > OSPF > IPv4 OSPF > Configuration > Interface (continued)

LA BEL

DESC RIPTIO N

Authentication

Note: OSPF Interfaces must use the same authentication method within the same area.

Select an authentication method. The choices are Sa m e - a s- Are a , No ne (default), Sim ple and MD5.
To participate in an OSPF network, you must make the authentication method and/or password settings the same as the associated area.
Select Sa m e - a s- Are a to use the same authentication method within the area and set the related fields when necessary.
Select No ne to disable authentication. This is the default setting.
Select Sim ple and set the Ke y field to authenticate OSPF packets transmitted through this interface using simple password authentication.
Select MD5 and set the Ke y ID and Ke y fields to authenticate OSPF packets transmitted through this interface using MD5 authentication.

Key ID Key
Cost Priority
Retransmit Interval
Transmit Delay
Hello Interval
Dead Interval
Add
Cancel Clear Index Network Area ID Authentication

When you select MD5 in the Authe ntic a tio n field, specify the identification number of the authentication you want to use.
When you select Sim ple in the Authe ntic a tio n field, enter a password eight-character long. Characters after the eighth character will be ignored.
When you select MD5 in the Authe ntic a tio n field, enter a password 16-character long.
The interface cost is used for calculating the routing table. Enter a number between 1 and 65535. The default interface cost is 15.
The priority you assign to the interface is used in router elections to decide which router is going to be the Designated Router (DR) or the Backup Designated Router (BDR). You can assign a number between 0 and 255. A priority of 0 means that the router will not participate in router elections.
Specify how long (in seconds) the Switch should wait for an acknowledgment packet from the interface's neighbor device before retransmitting link-state advertisements (LSAs) on the interface. The valid range for retransmitting is between 1 and 65535. The default value is 5 seconds.
Set the estimated time (in seconds) that is required to transmit a link-state update packet on the interface. The valid range for transmitting delay is between 1 and 65535. The default value is 1 second.
Specify how often (in seconds) the Switch sends hello packets on the interface to check if the interface's neighbor devices still exist. The valid range for hello interval is between 1 and 65535. The default value is 10 seconds.
Specify how long (in seconds) the Switch should wait for a hello packet from the interface's neighbor device before declaring that the neighbor device is not available. The valid range for dead interval is between 1 and 65535. The default value is 40 seconds.
Click Add to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.
Click C le a r to set the above fields back to the factory defaults.
This field displays the index number for an interface.
This field displays the IP interface information.
This field displays the area ID (in an IP address format with dotted decimal notation) of an area to associate the interface to that area.
This field displays the authentication method used (Sa m e - a s- Are a , No ne , Sim ple or MD5).

XS3800-28 User's Guide
470

Chapter 50 OSPF

Table 213 IP Application > OSPF > IPv4 OSPF > Configuration > Interface (continued)

LA BEL

DESC RIPTIO N

Key ID

When the Authe ntic a tio n field displays MD5, this field displays the identification number of the key used.

Cost

This field displays the interface cost used for calculating the routing table.

Priority

This field displays the priority for this OSPF interface.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Click De le te to remove the selected entry from the summary table.

Cancel

Click C a nc e l to begin configuring this screen afresh.

50.8 IPv4 O SPF Virtua l- Links
Configure and view virtual link settings in this screen. See Section 50.1 on page 459 for more information on OSPF. In the IPv4 O SPF C o nfig ura tio n screen, click Virtua l- Link to display the screen as shown next. Fig ure 365 IP Application > OSPF > IPv4 OSPF > Configuration > Virtual-Link

The following table describes the related labels in this screen.

Table 214 IP Application > OSPF > IPv4 OSPF > Configuration > Virtual-Link

LA BEL

DESC RIPTIO N

Name

Enter a descriptive name (up to 32 printable ASCII characters) for identification purposes.

Area ID

Select the area ID (in an IP address format with dotted decimal notation) of an area to associate the interface to that area.

Peer Router ID

Enter the ID of a peer border router.

XS3800-28 User's Guide
471

Chapter 50 OSPF

Table 214 IP Application > OSPF > IPv4 OSPF > Configuration > Virtual-Link (continued)

LA BEL

DESC RIPTIO N

Authentication

Note: Virtual interfaces must use the same authentication method within the same area.

Key ID Key
Retransmit Interval
Transmit Delay
Hello Interval
Dead Interval
Add
Cancel Clear Index Name Peer Router ID Authentication Key ID
Delete Cancel

Select an authentication method. The choices are Sa m e - a s- Are a , No ne (default), Sim ple and MD5.
To exchange OSPF packets with a peer border router, you must make the authentication method and/or password settings the same as the peer border router.
Select Sa m e - a s- Are a to use the same authentication method within the area and set the related fields when necessary.
Select No ne to disable authentication. This is the default setting.
Select Sim ple to authenticate OSPF packets transmitted through this interface using a simple password.
Select MD5 to authenticate OSPF packets transmitted through this interface using MD5 authentication.
When you select MD5 in the Authe ntic a tio n field, specify the identification number of the authentication you want to use.
When you select Sim ple in the Authe ntic a tio n field, enter a password eight-character long.
When you select MD5 in the Authe ntic a tio n field, enter a password 16-character long.
Specify how long (in seconds) the Switch should wait for an acknowledgment packet from the interface's neighbor device before retransmitting link-state advertisements (LSAs) on the interface. The valid range for retransmitting is between 1 and 65535. The default value is 5 seconds.
Set the estimated time (in seconds) that is required to transmit a link-state update packet on the interface. The valid range for transmitting delay is between 1 and 65535. The default value is 1 second.
Specify how often (in seconds) the Switch sends hello packets on the interface to check if the interface's neighbor devices still exist. The valid range for hello interval is between 1 and 65535. The default value is 10 seconds.
Specify how long (in seconds) the Switch should wait for a hello packet from the interface's neighbor device before declaring that the neighbor device is not available. The valid range for dead interval is between 1 and 65535. The default value is 40 seconds.
Click Add to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.
Click C le a r to set the above fields back to the factory defaults.
This field displays an index number of an entry.
This field displays a descriptive name of a virtual link.
This field displays the ID (that uses the format of an IP address in dotted decimal notation) of a peer border router.
This field displays the authentication method used (Sa m e - a s- Are a , No ne , Sim ple or MD5).
When the Authe ntic a tio n field displays MD5, this field displays the identification number of the key used.
Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.
Click De le te to remove the selected entry from the summary table.
Click C a nc e l to clear the De le te check boxes.

XS3800-28 User's Guide
472

Chapter 50 OSPF

The following table describes some common output fields.

Table 215 IP Application > IPv6 OSPF > OSPF Status: Common Output Fields

FIELD

DESC RIPTIO N

Interface

Interface ID

This field displays the ID number of the IPv6 interface.

Internet Address

This field displays the IPv6 link-local/global addresses and prefix length for the IPv6 interface.

Neighbor

Neighbor ID

This field displays the router ID of the neighbor.

Pri

This field displays the priority of the neighbor. This number is used in the designated router

election.

Dead Time

This field displays the dead time in seconds the Switch waits for a hello packet from the interface's neighbor device before declaring that the neighbor device is not available. The default value is 40 seconds.

State/IfState

This field displays the state of the neighbor (Init, ExSta rt, Exc ha ng e or Full) and whether the neighbor interface is acting as a DR (designated router), BDR (backup designated router) or DRo the r.

Duration

This field displays how long a relationship between the neighbor and the Switch IPv6 interface has been established to exchange routing information.

I/F [State]

This field displays the name of the Switch IPv6 interface and whether it is a (DR (designated router), BDR (backup designated router) or DRo the r).

Link State Database

Type

This field displays the type of the LSA.

LSId Adv Router Age Seq Num Checksum Link Count Payload

· Type 1: Router LSA · Type 2: Network LSA · Type 3: Inter-Area Prefix LSA · Type 4: Inter-Area Router LSA · Type 5: AS-External LSA · Type 6: Group Membership LSA · Type 7: NSSA LSA · Type 8: Link LSA · Type 9: Intra-area Prefix LSA
This field displays the link state ID to identify what is advertised by the LSA.
This field displays the router ID of the layer-3 device that sends the LSAs.
This field displays the time (in seconds) since the last LSA was sent.
This field displays the link sequence number of the LSA.
This field displays the checksum value of the LSA.
This field displays the number of links in the LSA.
This field displays the router ID for LSA type 1 or 2, the next-hop router address for LSA type 8, and the IPv6 prefix of the route entry for other LSA types.

XS3800-28 User's Guide
473

Chapter 51 IGMP
C HA PTER 5 1 IG MP
This chapter shows you how to configure the Switch as a multicast router.
51.1 IG MP O ve rvie w
IP multicast is an IETF standard for distributing data to multiple recipients. The following figure shows a multicast session and the relationship between a multicast server, multicast routers and multicast hosts. A multicast server transmits multicast packets and multicast routers forward multicast packets to multicast hosts. Fig ure 366 IP Multicast
A host can decide to join or leave a multicast group at any time. A host can also be a member of more than one multicast group. Multicast groups are identified by IP addresses in the Class D range (224.0.0.0 to 239.255.255.255). A multicast server sends packets addressed to a particular multicast group (multicast IP address). IGMP (Internet Group Management Protocol) is used by multicast hosts to indicate their multicast group membership to multicast routers. Multicast routers can also use IGMP to periodically check if multicast hosts still want to receive transmission from a multicast server. In other words, multicast routers check if any hosts on their network are still members of a specific multicast group.
XS3800-28 User's Guide
474

Chapter 51 IGMP
The Switch supports IGMP version 1 (IG MP- v1), version 2 (IG MP- v2) and IGMP version 3 (IG MP- v3). Refer to RFC 1112, RFC 2236 and RFC 3376 for information on IGMP versions 1, 2 and 3 respectively. At start up, the Switch queries all directly connected networks to gather group membership. After that, the Switch periodically updates this information.
51.1.1 Ho w IG MP Wo rks
This section describes how IGMP works and the changes it has gone through from version 1 to version 3. IGMP version 1 defines how a multicast router checks to see if any multicast hosts are part of a multicast group. It checks for group membership by sending out an IGMP Query packet. Hosts that are members of a multicast group reply with an IGMP Report packet. This is also referred to as a join group request. The multicast router then keeps a list of all networks that have members of this multicast group and forwards multicast traffic to that network. Fig ure 367 IGMP Version 1 Example
The main difference in IGMP version 2 is that it provides a mechanism for a multicast group member to notify a multicast router that it is leaving a multicast group. The multicast router then sends a groupspecific IGMP query to check if there are any members remaining in that group. If the multicast router does not receive an IGMP report from any members, it stops sending multicast traffic to that group. This change helps shorten the leave convergence time, in other words, the amount of time that a multicast router believes that there are group members on a particular network. This in turn helps reduce the amount of multicast traffic going through the multicast router. Fig ure 368 IGMP Version 2 Example
IGMP version 3 allows a multicast host to join a multicast group and specify from which source (multicast server) it wants to receive multicast packets. Alternatively, a multicast host can specify from which multicast servers it does not want to receive multicast packets. In the following figure multicast server X (IP address 10.1.1.1) and multicast server Z (IP address 13.2.2.2) both send multicast traffic to the same multicast group identified by the multicast IP address 225.1.1.1. In IGMP version 3 multicast host A can
XS3800-28 User's Guide
475

Chapter 51 IGMP join multicast group 225.1.1.1 and specify that it only wants to receive multicast packets from server X. Fig ure 369 IGMP Version 3 Example
51.2 Po rt- b a se d IG MP
The Switch sends IGMP Query packets to all ports. The Switch then listens for IGMP Report packets, and it records which port the messages came from. It then delivers multicast traffic to only those ports from which it received a request to join a multicast group.
51.3 C o nfig uring IG MP
Click IP Applic a tio n > IG MP in the navigation panel to display the screen as shown next. Each entry in the table is automatically created when you configure a new IP domain in the IP Se tup screen. Fig ure 370 IP Application > IGMP
XS3800-28 User's Guide
476

Chapter 51 IGMP

The following table describes the labels in this screen.

Table 216 IP Application > IGMP

LA BEL

DESC RIPTIO N

Active

Select this check box to enable IGMP on the Switch.

Unknown Multicast Frame Index Network Version
Apply
Cancel

Note: You cannot enable both IGMP snooping and IGMP at the same time.
Specify the action to perform when the Switch receives an unknown multicast frame. Unknown multicast frames are addressed to multicast groups for which the Switch has not recorded any group members. Select Dro p to discard the frames. Select Flo o ding to send the frames to all ports.
This field displays an index number of an entry.
This field displays the IP domain configured on the Switch.
Select an IGMP version from the drop-down list box. The choices are IG MP- v1, IG MP- v2, IG MP- v3 and No ne .
Generally, if you want to enable IGMP on the Switch, you should choose IG MP- v3 as it is compatible with older versions. Choose an earlier version of IGMP (IG MP- v2 or IG MP- v1) if the multicast hosts on your network can not recognize IGMP version 3 or version 2 Query messages.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
477

Chapter 52 DVMRP
C HA PTER 5 2 DVMRP
This chapter introduces DVMRP and tells you how to configure it.
52.1 DVMRP O ve rvie w
DVMRP (Distance Vector Multicast Routing Protocol) is a protocol used for routing multicast data within an autonomous system (AS). This DVMRP implementation is based on draft-ietf-idmr-dvmrp-v3-10. DVMRP provides multicast forwarding capability to a layer-3 switch that runs both the IPv4 protocol (with IP Multicast support) and the IGMP protocol. The DVMRP metric is a hop count of 32. IGMP is a protocol used for joining or leaving a multicast group. You must have IGMP enabled when you enable DVMRP; otherwise you see the screen as in Figure 373 on page 480.
52.2 Ho w DVMRP Wo rks
DVMRP uses the Reverse Path Multicasting (RPM) algorithm to generate an IP Multicast delivery tree. Multicast packets are forwarded along these multicast tree branches. DVMRP dynamically learns host membership information using Internet Group Management Protocol (IGMP). The trees are updated dynamically to track the membership of individual groups. 1 Initially an advertisement multicast packet is broadcast ("B" in the following figure). 2 DVMRP-enabled Layer-3 devices that do not have any hosts in their networks that belong to this multicast group send back a prune message ("P"). 3 If hosts later join the multicast group, a graft message ("G ") to undo the prune is sent to the parent.
XS3800-28 User's Guide
478

Chapter 52 DVMRP 4 The final multicast ("M") after pruning and grafting is shown in the next figure.
Fig ure 371 How DVMRP Works
52.2.1 DVMRP Te rm ino lo g y
DVMRP probes are used to discover other DVMRP Neighbors on a network. DVMRP reports are used to exchange DVMRP source routing information. These packets are used to build the DVMRP multicast routing table that is used to build source trees and also perform Reverse Path Forwarding (RPF) checks on incoming multicast packets. RPF checks prevent duplicate packets being filtered when loops exist in the network topology. DVMRP prunes trim the multicast delivery trees. DVMRP grafts attach a branch back onto the multicast delivery tree.
52.3 C o nfig uring DVMRP
Configure DVMRP on the Switch when you wish it to act as a multicast router ("mrouter"). Click IP Applic a tio n > DVMRP in the navigation panel to display the screen as shown. Fig ure 372 IP Application > DVMRP
XS3800-28 User's Guide
479

Chapter 52 DVMRP

The following table describes the labels in this screen.

Table 217 IP Application > DVMRP

LA BEL

DESC RIPTIO N

Active

Select Ac tive to enable DVMRP on the Switch. You should do this if you want the Switch to act as a multicast router.

Threshold

Threshold is the maximum time to live (TTL) value. TTL is used to limit the scope of multicasting. You should reduce this value if you do not wish to flood Layer-3 devices many hops away with multicast traffic. This applies only to multicast traffic this Switch sends out.

Index

Index is the DVMRP configuration for the IP routing domain defined under Ne two rk. The maximum number of DVMRP configurations allowed is the maximum number of IP routing domains allowed on the Switch.

Network

This is the IP routing domain IP address and subnet mask you set up in IP Se tup.

VID

DVMRP cannot be enabled on the same VLAN group across different IP routing domains, that is, you

cannot have duplicate VIDs for different DVMRP configurations.

Active

Select Ac tive to enable DVMRP on this IP routing domain.

Apply

Cancel

Click C a nc e l to begin configuring this screen afresh.

52.3.1 DVMRP C o nfig ura tio n Erro r Me ssa g e s
You must have IGMP enabled when you enable DVMRP; otherwise you see the screen as in the next figure.
Fig ure 373 DVMRP: IGMP Not Set Error

When you disable IGMP, but DVMRP is still active you also see another warning screen. Fig ure 374 DVMRP: Unable to Disable IGMP Error

Each IP routing domain DVMRP configuration must be in a different VLAN group; otherwise you see the

XS3800-28 User's Guide
480

Chapter 52 DVMRP
following screen. Fig ure 375 DVMRP: Duplicate VID Error Message

52.4 De fa ult DVMRP Tim e r Va lue s

The following are some default DVMRP timer values.

Table 218 DVMRP: Default Timer Values

DVMRP FIELD

DEFA ULT V A LUE

Probe interval

10 sec

Report interval

35 sec

Route expiration time

140 sec

Prune lifetime

Variable (less than two hours)

Prune retransmission time

3 sec with exponential back off

Graft retransmission time

5 sec with exponential back off

XS3800-28 User's Guide
481

Chapter 53 Differentiated Services
C HA PTER 5 3 Diffe re ntia te d Se rvic e s

53.1 DiffSe rv O ve rvie w
This chapter shows you how to configure Differentiated Services (DiffServ) on the Switch.
Quality of Service (QoS) is used to prioritize source-to-destination traffic flows. All packets in the flow are given the same priority. You can use CoS (class of service) to give different priorities to different packet types.
DiffServ is a class of service (CoS) model that marks packets so that they receive specific per-hop treatment at DiffServ-compliant network devices along the route based on the application types and traffic flow. Packets are marked with DiffServ Code Points (DSCPs) indicating the level of service desired. This allows the intermediary DiffServ-compliant network devices to handle the packets differently depending on the code points without the need to negotiate paths or remember state information for every flow. In addition, applications do not have to request a particular service or give advanced notice of where the traffic is going.

53.1.1 Wha t Yo u C a n Do
· Use the DiffSe rv screen (Section 53.2 on page 483) to activate DiffServ to apply marking rules or IEEE 802.1p priority mapping on the Switch.
· Use the DSC P Se tting screen (Section 53.3.1 on page 485) to change the DSCP-IEEE 802.1p mapping.

53.1.2 Wha t Yo u Ne e d to Kno w
Read on for concepts on Differentiated Services that can help you configure the screens in this chapter.

DSC P a nd Pe r- Ho p Be ha vio r

DiffServ defines a new DS (Differentiated Services) field to replace the Type of Service (ToS) field in the IP header. The DS field contains a 6-bit DSCP field which can define up to 64 service levels and the remaining 2 bits are defined as currently unused (CU). The following figure illustrates the DS field.

Fig ure 376 DiffServ: Differentiated Service Field

DSCP (6 bits)

CU (2 bits)

DSCP is backward compatible with the three precedence bits in the ToS octet so that non-DiffServ compliant, ToS-enabled network device will not conflict with the DSCP mapping.
The DSCP value determines the PHB (Per-Hop Behavior), that each packet gets as it is forwarded across the DiffServ network. Based on the marking rule different kinds of traffic can be marked for different
XS3800-28 User's Guide
482

Chapter 53 Differentiated Services priorities of forwarding. Resources can then be allocated according to the DSCP values and the configured policies.
DiffSe rv Ne two rk Exa m ple
The following figure depicts a DiffServ network consisting of a group of directly connected DiffServcompliant network devices. The boundary node (A in Figure 377) in a DiffServ network classifies (marks with a DSCP value) the incoming packets into different traffic flows (Pla tinum , G o ld, Silve r, Bro nze ) based on the configured marking rules. A network administrator can then apply various traffic policies to the traffic flows. An example traffic policy, is to give higher drop precedence to one traffic flow over others. In our example, packets in the Bro nze traffic flow are more likely to be dropped when congestion occurs than the packets in the Pla tinum traffic flow as they move across the DiffServ network. Fig ure 377 DiffServ Network
53.2 Ac tiva ting DiffSe rv
Activate DiffServ to apply marking rules or IEEE 802.1p priority mapping on the selected ports. Click IP Applic a tio n > DiffSe rv in the navigation panel to display the screen as shown.
XS3800-28 User's Guide
483

Chapter 53 Differentiated Services Fig ure 378 IP Application > DiffServ (Standalone Mode)
Fig ure 379 IP Application > DiffServ (Stacking Mode)

The following table describes the labels in this screen.

Table 219 IP Application > DiffServ

LA BEL

DESC RIPTIO N

Active Slot Port
*

Select this option to enable DiffServ on the Switch.
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.
This field displays the index number of a port on the Switch. In stacking mode, the first number represents the slot and the second the port number. * means all ports (on the same Switch).
Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Changes in this row are copied to all the ports as soon as you make them.

XS3800-28 User's Guide
484

Chapter 53 Differentiated Services

Table 219 IP Application > DiffServ (continued)

LA BEL

DESC RIPTIO N

Active

Select Ac tive to enable Diffserv on the port.

Apply

Cancel

Click C a nc e l to begin configuring this screen afresh.

53.3 DSC P- to - IEEE 802.1p Prio rity Se tting s

You can configure the DSCP to IEEE 802.1p mapping to allow the Switch to prioritize all traffic based on the incoming DSCP value according to the DiffServ to IEEE 802.1p mapping table.

The following table shows the default DSCP-to-IEEE802.1p mapping.

Table 220 Default DSCP-IEEE 802.1p Mapping

DSCP VALUE 0 7

8 15

16 23 24 31

IEEE 802.1p

32 39 4

40 47 5

48 55 6

56 63 7

53.3.1 C o nfig uring DSC P Se tting s
To change the DSCP-IEEE 802.1p mapping click the DSC P Se tting link in the DiffSe rv screen to display the screen as shown next.
Fig ure 380 IP Application > DiffServ > DSCP Setting

The following table describes the labels in this screen. Table 221 IP Application > DiffServ > DSCP Setting
LABEL DESC RIPTIO N 0 ... 63 This is the DSCP classification identification number.
To set the IEEE 802.1p priority mapping, select the priority level from the drop-down list box.
XS3800-28 User's Guide
485

Chapter 53 Differentiated Services

Table 221 IP Application > DiffServ > DSCP Setting (continued)

LABEL DESC RIPTIO N

Apply

Cancel Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
486

Chapter 54 DHCP
C HA PTER 5 4
DHC P
54.1 DHC P O ve rvie w
This chapter shows you how to configure the DHCP feature.
DHCP (Dynamic Host Configuration Protocol RFC 2131 and RFC 2132) allows individual computers to obtain TCP/IP configuration at start-up from a server. You can configure the Switch as a DHCP server or a DHCP relay agent. When configured as a server, the Switch provides the TCP/IP configuration for the clients. If you configure the Switch as a relay agent, then the Switch forwards DHCP requests to DHCP server on your network. If you do not configure the Switch as a DHCP server or relay agent then you must have a DHCP server in the broadcast domain of the client computers or else the client computers must be configured manually.
54.1.1 Wha t Yo u C a n Do
· Use the DHC Pv4 Sta tus screen (Section 54.3 on page 488) to display the server status and relay mode. · Use the DHC Pv4 Se rve r Sta tus De ta il screen (Section 54.3.1 on page 489) to view details regarding
DHCP server settings configured on the Switch. · Use the DHC Pv4 O ptio n 82 Pro file screen (Section 54.4.2 on page 491) to create DHCPv4 option 82
profiles. · Use the DHC Pv4 G lo b a l Re la y screen (Section 54.4.3 on page 493) to configure global DHCPv4 relay. · Use the DHC Pv4 G lo b a l Re la y Po rt screen (Section 54.4.4 on page 494) to apply a different DHCP
option 82 profile to certain ports on the Switch. · Use the VLAN Se tting screen (Section 54.4.6 on page 496) to configure your DHCPv4 settings based on
the VLAN domain of the DHCPv4 clients. · Use the DHC Pv4 VLAN Po rt screen (Section 54.4.7 on page 498) to apply a different DHCP option 82
profile to certain ports in a VLAN. · Use the DHC Pv6 Sta tus screen (Section 54.5 on page 500) to see information on the DHCPv6 server. · Use the DHC Pv6 Info rm a tio n screen (Section 54.6 on page 501) to configure DHCPv6 and DNS server
settings on the Switch. · Use the DHC Pv6 Pre fix De le g a tio n screen (Section 54.7 on page 502) to configure DHCPv6 client and
IPv6 prefix settings for a specific VLAN on the Switch. · Use the DHC Pv6 Re la y screen (Section 54.8 on page 503) to enable and configure DHCPv6 relay. · Use the DHC P Se rve r G ua rd screen (Section 54.9 on page 505) to specify whether ports are trusted or
untrusted ports for DHCP packets.
54.1.2 Wha t Yo u Ne e d to Kno w
Read on for concepts on DHCP that can help you configure the screens in this chapter.
XS3800-28 User's Guide
487

Chapter 54 DHCP
DHC P Mo de s
The Switch can be configured as a DHCP server or DHCP relay agent. · If you configure the Switch as a DHCP server, it will maintain the pool of IP addresses along with
subnet masks or prefixes, DNS server and default gateway information and distribute them to your LAN computers. · If there is already a DHCP server on your network, then you can configure the Switch as a DHCP relay agent. When the Switch receives a request from a computer on your network, it contacts the DHCP server for the necessary IP information, and then relays the assigned information back to the computer.
DHC Pv4 C o nfig ura tio n O ptio ns
The DHCPv4 configuration on the Switch is divided into G lo ba l and VLAN screens. The screen you should use for configuration depends on the DHCP services you want to offer the DHCP clients on your network. Choose the configuration screen based on the following criteria: · G lo ba l The Switch forwards all DHCP requests to the same DHCP server. · VLAN The Switch is configured on a VLAN by VLAN basis. The Switch can be configured as a DHCP
server for one VLAN and at the same time the Switch can be configured to relay DHCPv4 requests for clients in another VLAN.
54.2 DHC P C o nfig ura tio n
Click IP Applic a tio n > DHC P in the navigation panel to display the screen as shown. Click the link next to DHCPv4 to open screens where you can enable and configure DHCPv4 relay settings and create option 82 profiles. Click the link next to DHC Pv6 to open a screen where you can configure DHCPv6 relay settings. Click the link next to DHC P Se rve r G ua rd to open a screen where you can specify whether ports are trusted or untrusted ports for DHCP packets. Fig ure 381 IP Application > DHCP
54.3 DHC Pv4 Sta tus
Click IP Applic a tio n > DHC P > DHC Pv4 in the navigation panel. The DHC P Sta tus screen displays.
XS3800-28 User's Guide
488

Chapter 54 DHCP Fig ure 382 IP Application > DHCP > DHCPv4

The following table describes the labels in this screen.

Table 222 IP Application > DHCP > DHCPv4

LA BEL

DESC RIPTIO N

Server Status This section displays configuration settings related to the Switch's DHCP server mode.

Index

This is the index number. Click an index number to change the settings.

VID

This field displays the VLAN ID for which the Switch is a DHCP server.

Server Status This field displays the starting DHCP client IP address.

IP Pool Size This field displays the number of IP addresses that can be assigned to clients.

Relay Status This section displays configuration settings related to the Switch's DHCP relay mode.

Relay Mode This field displays:

No ne if the Switch is not configured as a DHCP relay agent.

G lo b a l if the Switch is configured as a DHCP relay agent only.

VID
Current Source Address

VLAN followed by a VLAN ID or multiple VLAN IDs if it is configured as a relay agent for specific VLANs.
This field displays the ID number of the VLAN for which the Switch acts as a DHCP relay agent.
This field displays the source IP address of the DHCP requests that the Switch forwards to a DHCP server.

54.3.1 DHC Pv4 Se rve r Sta tus De ta il
Click IP Applic a tio n > DHC P > DHC Pv4 in the navigation panel and then click an existing index number of a DHCP server configuration to view the screen as shown. Use this screen to view details regarding DHCP server settings configured on the Switch.
Fig ure 383 IP Application > DHCP > DHCPv4 > Server Status Detail

XS3800-28 User's Guide
489

Chapter 54 DHCP

The following table describes the labels in this screen.

Table 223 IP Application > DHCP > DHCPv4 > Server Status Detail

LA BEL

DESC RIPTIO N

Start IP Address

This field displays the starting IP address of the IP address pool configured for this DHCP server instance.

End IP Address

This field displays the last IP address of the IP address pool configured for this DHCP server instance.

Subnet Mask

This field displays the subnet mask value sent to clients from this DHCP server instance.

Default Gateway This field displays the default gateway value sent to clients from this DHCP server instance.

Primary DNS Server This field displays the primary DNS server value sent to clients from this DHCP server instance.

Secondary DNS Server

This field displays the secondary DNS server value sent to clients from this DHCP server instance.

Lease Time

This field displays the amount of time that the IP address is valid.

Address Leases

This section displays information about the IP addresses this DHCP server issued to clients.

Index

This field displays a sequential number for each DHCP request handled by the Switch.

IP Address

This is the IP address issued to a DHCP client.

Timer

This field displays the time remaining before the DHCP client has to renew its IP address.

Hardware Address This field displays the MAC address of the DHCP client.

Hostname

It may also display SELF O C C UPIED ADDRESS if the IP address cannot be used for DHCP because it is already assigned to the Switch itself.
This field displays the system name of the client.

54.4 DHC Pv4 Re la y
Configure DHCP relay on the Switch if the DHCP clients and the DHCP server are not in the same broadcast domain. During the initial IP address leasing, the Switch helps to relay network information (such as the IP address and subnet mask) between a DHCP client and a DHCP server. Once the DHCP client obtains an IP address and can connect to the network, network information renewal is done between the DHCP client and the DHCP server without the help of the Switch.
The Switch can be configured as a global DHCP relay. This means that the Switch forwards all DHCP requests from all domains to the same DHCP server. You can also configure the Switch to relay DHCP information based on the VLAN membership of the DHCP clients.
54.4.1 DHC Pv4 Re la y Ag e nt Info rm a tio n
The Switch can add information about the source of client DHCP requests that it relays to a DHCP server by adding Re la y Ag e nt Info rm a tio n. This helps provide authentication about the source of the requests. The DHCP server can then provide an IP address based on this information. Please refer to RFC 3046 for more details.
The DHCP Re la y Ag e nt Info rm a tio n feature adds an Agent Information field (also known as the O ptio n 82 field) to DHCP requests. The O ptio n 82 field is in the DHCP headers of client DHCP request frames that the Switch relays to a DHCP server.
Re la y Ag e nt Info rm a tio n can include the Syste m Na m e of the Switch if you select this option. You can change the Syste m Na m e in Ba sic Se tting > G e ne ra l Se tup.
XS3800-28 User's Guide
490

Chapter 54 DHCP

The following describes the DHCP relay agent information that the Switch sends to the DHCP server:

Table 224 Relay Agent Information

FIELD LABELS

DESC RIPTIO N

Slot ID

(1 byte) This value is always 0 for stand-alone switches.

Port ID

(1 byte) This is the port that the DHCP client is connected to.

VLAN ID

(2 bytes) This is the VLAN that the port belongs to.

Information

(up to 64 bytes) This optional, read-only field is set according to system name set in Ba sic Se tting > G e ne ra l Se tup.

54.4.1.1 DHC Pv4 Re la y Ag e nt Info rm a tio n Fo rm a t

A DHCP Relay Agent Information option has the following format.

Table 225 DHCP Relay Agent Information Option Format

Code

Length

(82)

(N)

...

i1, i2 and iN are DHCP relay agent sub-options, which contain additional information about the DHCP client. You need to define at least one sub-option.

54.4.1.2 Sub - O ptio n Fo rm a t

There are two types of sub-option: "Agent Circuit ID Sub-option" and "Agent Remote ID Sub-option". They have the following formats.

Table 226 DHCP Relay Agent Circuit ID Sub-option Format

SubOpt Code Length

Value

Slot ID, Port ID, VLAN ID, System Name or String

(1 byte)

Table 227 DHCP Relay Agent Remote ID Sub-option Format

SubOpt Code Length

Value

MAC Address or String

(1 byte)

The 1 in the first field identifies this as an Agent Circuit ID sub-option and two identifies this as an Agent Remote ID sub-option. The next field specifies the length of the field.

54.4.2 DHC Pv4 O ptio n 82 Pro file
Use this screen to create DHCPv4 option 82 profiles. Click IP Applic a tio n > DHC P > DHC Pv4 in the navigation panel and click the O ptio n 82 Pro file link to display the screen as shown.

XS3800-28 User's Guide
491

Chapter 54 DHCP Fig ure 384 IP Application > DHCP > DHCPv4 > Option 82 Profile

The following table describes the labels in this screen.

Table 228 IP Application > DHCP > DHCPv4 > Option 82 Profile

LA BEL

DESC RIPTIO N

Name Circuit-ID
Enable slot-port vlan hostname

Enter a descriptive name for the profile for identification purposes. You can use up to 32 ASCII characters. Spaces are allowed.
Use this section to configure the Circuit ID sub-option to include information that is specific to the relay agent (the Switch).
Select this option to have the Switch add the Circuit ID sub-option to client DHCP requests that it relays to a DHCP server.
Select this option to have the Switch add the number of port that the DHCP client is connected to.
Select this option to have the Switch add the ID of VLAN which the port belongs to.
This is the system name you configure in the Ba sic Se tting > G e ne ra l Se tup screen.

string Remote-ID
Enable mac string

Select this option for the Switch to add the system name to the client DHCP requests that it relays to a DHCP server.
Enter a string of up to 64 ASCII characters that the Switch adds into the client DHCP requests. Spaces are allowed.
Use this section to configure the Remote ID sub-option to include information that identifies the relay agent (the Switch).
Select this option to have the Switch append the Remote ID sub-option to the option 82 field of DHCP requests.
Select this option to have the Switch add its MAC address to the client DHCP requests that it relays to a DHCP server.
Enter a string of up to 64 ASCII characters for the remote ID information in this field. Spaces are allowed.

XS3800-28 User's Guide
492

Chapter 54 DHCP

Table 228 IP Application > DHCP > DHCPv4 > Option 82 Profile (continued)

LA BEL

DESC RIPTIO N

Add

Click this to create a new entry or to update an existing one.

Cancel Profile Name Circuit-ID
Enable Field Remote-ID
Enable Field
Delete Cancel

This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to reset the fields to their last saved values.
This field displays the descriptive name of the profile. Click the name to change the settings.
This section displays the Circuit ID sub-option including information that is specific to the relay agent (the Switch).
This field displays whether the Circuit ID sub-option is added to client DHCP requests.
This field displays the information that is included in the Circuit ID sub-option.
This section displays the Remote ID sub-option including information that identifies the relay agent (the Switch).
This field displays whether the Remote ID sub-option is added to client DHCP requests.
This field displays the information that is included in the Remote ID sub-option.
Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.
Check the entries that you want to remove and then click the De le te button.
Click C a nc e l to clear the selected check boxes.

54.4.3 C o nfig uring DHC Pv4 G lo b a l Re la y
Use this screen to configure global DHCPv4 relay. Click IP Applic a tio n > DHC P > DHC Pv4 in the navigation panel and click the G lo ba l link to display the screen as shown.
Fig ure 385 IP Application > DHCP > DHCPv4 > Global

The following table describes the labels in this screen.

Table 229 IP Application > DHCP > DHCPv4 > Global

LA BEL

DESC RIPTIO N

Active

Select this check box to enable DHCPv4 relay.

Remote DHCP Server 1 .. 3

Enter the IP address of a DHCPv4 server in dotted decimal notation.

Option 82 Profile Select a pre-defined DHCPv4 option 82 profile that the Switch applies to all ports. The Switch adds the Circuit ID sub-option and/or Remote ID sub-option specified in the profile to DHCP requests that it relays to a DHCP server.

XS3800-28 User's Guide
493

Chapter 54 DHCP

Table 229 IP Application > DHCP > DHCPv4 > Global (continued)

LA BEL

DESC RIPTIO N

Apply

Cancel

Click C a nc e l to begin configuring this screen afresh.

54.4.4 C o nfig ure DHC Pv4 G lo b a l Re la y Po rt
Use this screen to apply a different DHCP option 82 profile to certain ports on the Switch. To open this screen, click IP Applic a tio n > DHC P > DHC Pv4 > G lo b a l > Po rt.
Fig ure 386 IP Application > DHCP > DHCPv4 > Global > Port

The following table describes the labels in this screen.

Table 230 IP Application > DHCP > DHCPv4 > Global > Port

LA BEL

DESC RIPTIO N

Port

Enter the number of ports to which you want to apply the specified DHCP option 82 profile.

You can enter multiple ports separated by (no space) comma (,) or hyphen () for a range. For example, enter "35" for ports 3, 4, and 5. Enter "3,5,7" for ports 3, 5, and 7.

Option 82 Profile

In stacking mode, the first number represents the slot and the second the port number. Enter 1/ 11/24,2/28 for ports 1 to 24 for the Switch in slot 1 and port 28 for the Switch in slot 2, for example.
Select a pre-defined DHCP option 82 profile that the Switch applies to the specified ports. The Switch adds the Circuit ID sub-option and/or Remote ID sub-option specified in the profile to DHCP requests that it relays to a DHCP server.

Add

The profile you select here has priority over the one you select in the DHC P > DHC Pv4 > G lo b a l screen.
Click this to create a new entry or to update an existing one.

Cancel
Clear Index

XS3800-28 User's Guide
494

Chapter 54 DHCP

Table 230 IP Application > DHCP > DHCPv4 > Global > Port (continued)

LA BEL

DESC RIPTIO N

Port

This field displays the port(s) to which the Switch applies the settings. In stacking mode, the first

number represents the slot and the second the port number.

Profile Name

This field displays the DHCP option 82 profilethat the Switch applies to the ports.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Select the entries that you want to remove, then click the De le te button to remove the selected entries from the table.

Cancel

Click this to clear the check boxes above.

54.4.5 G lo b a l DHC P Re la y C o nfig ura tio n Exa m ple
The follow figure shows a network example where the Switch is used to relay DHCP requests for the VLAN1 and VLAN2 domains. There is only one DHCP server that services the DHCP clients in both domains.
Fig ure 387 Global DHCP Relay Network Example

Configure the DHC P Re la y screen as shown. Make sure you select a DHCP option 82 profile (de fa ult1 in this example) to set the Switch to send additional information (such as the VLAN ID) together with the DHCP requests to the DHCP server. This allows the DHCP server to assign the appropriate IP address according to the VLAN ID.
XS3800-28 User's Guide
495

Chapter 54 DHCP Fig ure 388 DHCP Relay Configuration Example
EXAMPLE
54.4.6 DHC Pv4 VLAN Se tting
Use this screen to configure your DHCP settings based on the VLAN domain of the DHCP clients. Click IP Applic a tio n > DHC P > DHC Pv4 in the navigation panel, then click the VLAN link In the DHC P Sta tus screen that displays. Note: You must set up a management IP address for each VLAN that you want to configure
DHCP settings for on the Switch. See Section 5.1.3 on page 66 for information on how to do this. Fig ure 389 IP Application > DHCP > DHCPv4 > VLAN
XS3800-28 User's Guide
496

Chapter 54 DHCP

The following table describes the labels in this screen.

Table 231 IP Application > DHCP > DHCPv4 > VLAN

LA BEL

DESC RIPTIO N

VID

Enter the ID number of the VLAN to which these DHCP settings apply.

DHCP Status

Select whether the Switch should function as a DHCP Se rve r or Re la y for the specified VID. If you select Se rve r then fields related to DHCP relay configuration are grayed out and vice versa.

Server

Use this section if you want to configure the Switch to function as a DHCP server for this VLAN.

Client IP Pool Specify the first of the contiguous addresses in the IP address pool. Starting Address

Size of Client Specify the size, or count of the IP address pool. The Switch can issue from 1 to 253 IP addresses

IP Pool

to DHCP clients.

IP Subnet Mask

Enter the subnet mask for the client IP pool.

Default Gateway

Enter the IP address of the default gateway device.

Primary/ Secondary DNS Server

Enter the IP addresses of the DNS servers. The DNS servers are passed to the DHCP clients along with the IP address and the subnet mask.

Lease Time

Select Infinite to have the binding always valid. Select the second radio button to set up the binding's valid days, hours and minutes.

Relay

Use this section if you want to configure the Switch to function as a DHCP relay for this VLAN.

Remote DHCP Server 1 .. 3

Enter the IP address of a DHCP server in dotted decimal notation.

Source Address

Enter the source IP address that the Switch adds to DHCP requests from clients on this VLAN before forwarding them. If you leave this field set to 0.0.0.0, the Switch automatically sets the source IP address of the DHCP requests to the IP address of the interface on which the packet is received.

Option 82 Profile Add

The source IP address helps DHCP clients obtain an appropriate IP address when you configure multiple routing domains on a VLAN.
Select a pre-defined DHCP option 82 profile that the Switch applies to all ports in this VLAN. The Switch adds the Circuit ID sub-option and/or Remote ID sub-option specified in the profile to DHCP requests that it relays to a DHCP server.
Click this to create a new entry or to update an existing one.

Cancel Clear VID Type DHCP Status

Source Address
Delete Cancel

For DHCP relay configuration, this field displays the first remote DHCP server IP address.
This field displays the source IP address you configured for DHCP requests from clients on this VLAN.
Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.
Select the configuration entries you want to remove and click De le te to remove them.
Click C a nc e l to clear the check boxes.

XS3800-28 User's Guide
497

Chapter 54 DHCP
54.4.7 C o nfig ure DHC Pv4 VLAN Po rt
Use this screen to apply a different DHCP option 82 profile to certain ports in a VLAN. To open this screen, click IP Applic a tio n > DHC P > DHC Pv4 > VLAN > Po rt. Fig ure 390 IP Application > DHCP > DHCPv4 > VLAN > Port

The following table describes the labels in this screen.

Table 232 IP Application > DHCP > DHCPv4 > VLAN > Port

LA BEL

DESC RIPTIO N

VID

Enter the ID number of the VLAN you want to configure here.

Port

Enter the number of ports to which you want to apply the specified DHCP option 82 profile.

You can enter multiple ports separated by (no space) comma (,) or hyphen () for a range. For example, enter "35" for ports 3, 4, and 5. Enter "3,5,7" for ports 3, 5, and 7.

Option 82 Profile

In stacking mode, the first number represents the slot and the second the port number. Enter 1/ 11/24,2/28 for ports 1 to 24 for the Switch in slot 1 and port 28 for the Switch in slot 2, for example.
Select a pre-defined DHCP option 82 profile that the Switch applies to the specified ports in this VLAN. The Switch adds the Circuit ID sub-option and/or Remote ID sub-option specified in the profile to DHCP requests that it relays to a DHCP server.

Add

The profile you select here has priority over the one you select in the DHC P > DHC Pv4 > VLAN screen.
Click this to create a new entry or to update an existing one.

Cancel
Clear Index
VID Port Profile Name

This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click this to reset the values above based on the last selected entry or, if not applicable, to clear the fields above.
Click C le a r to reset the fields to the factory defaults.
This field displays a sequential number for each entry. Click an index number to change the settings.
This field displays the VLAN to which the ports belongs.
This field displays the ports to which the Switch applies the settings.
This field displays the DHCP option 82 profilethat the Switch applies to the ports in this VLAN.
Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

XS3800-28 User's Guide
498

Chapter 54 DHCP

Table 232 IP Application > DHCP > DHCPv4 > VLAN > Port (continued)

LA BEL

DESC RIPTIO N

Delete

Select the entries that you want to remove, then click the De le te button to remove the selected entries from the table.

Cancel

Click this to clear the check boxes above.

54.4.8 Exa m ple : DHC P Re la y fo r Two VLANs
The following example displays two VLANs (VIDs 1 and 2) for a campus network. Two DHCP servers are installed to serve each VLAN. The system is set up to forward DHCP requests from the dormitory rooms (VLAN 1) to the DHCP server with an IP address of 192.168.1.100. Requests from the academic buildings (VLAN 2) are sent to the other DHCP server with an IP address of 172.16.10.100.
Fig ure 391 DHCP Relay for Two VLANs

VLAN 1 VLAN 2 For the example network, configure the VLAN Se tting screen as shown.

XS3800-28 User's Guide
499

Chapter 54 DHCP Fig ure 392 DHCP Relay for Two VLANs Configuration Example

EXAMPLE

54.5 DHC Pv6 Sta tus
Click IP Applic a tio n > DHC P > DHC Pv6 in the navigation panel to see information on the DHCPv6 server. The DHC Pv6 Sta tus screen displays.
Fig ure 393 IP Application > DHCP > DHCPv6

The following table describes the labels in this screen.

Table 233 IP Application > DHCP > DHCPv6

LA BEL

DESC RIPTIO N

Server Status

This section displays configuration settings related to the Switch's DHCP server mode.

Index

This is the index number of a DHCPv6 server information.

VID

This field displays the VLAN ID to which the DHCP server belongs.

DHCP Server

A DHCPv6 server can assign and pass IPv6 network addresses, prefixes and other configuration information to DHCP clients.

Information

This field displays Ye s when the entry supports display of the refresh time and DNS server; it shows No when it does not.

XS3800-28 User's Guide
500

Chapter 54 DHCP

Table 233 IP Application > DHCP > DHCPv6 (continued)

LA BEL

DESC RIPTIO N

Prefix Delegation

This field displays Ye s when the entry supports the prefix delegation; it shows No when it does not. The prefix delegation is used by an IPv6 device to generate its IP address.

DHCP Relay

A DHCPv6 relay agent is on the same network as the DHCPv6 clients and helps forward messages between the DHCPv6 server (that's in another network) and the DHCPv6 clients.

This field displays Ye s when the Switch supports DHCPv6 Relay and No when it does not. Ye s means the Switch forwards all DHCP requests to the same DHCP server. No means the Switch does not forward DHCP requests to a DHCP server.

54.6 DHC Pv6 Info rm a tio n
Use this screen to configure DHCPv6 and DNS server settings on the Switch. Click IP Applic a tio n > DHC P > DHC Pv6 > Info rm a tio n in the navigation panel to display the screen as shown.
Fig ure 394 IP Application > DHCP > DHCPv6 > Information

The following table describes the labels in this screen.

Table 234 IP Application > DHCP > DHCPv6 > Information

LA BEL

DESC RIPTIO N

Active VID Refresh Time
DNS Server

Select this check box to enable the entry. Enter the ID number of the VLAN to which the DHCPv6 server belongs here. Enter the number of seconds a DHCPv6 client should wait before refreshing information retrieved from a DHCPv6 server. The allowed range is 600 to 4294967295 seconds. Specify the IPv6 address of the DNS server for the DHCP clients to use here.

An 128-bit IPv6 address is written as eight 16-bit hexadecimal blocks separated by colons (:). This is an example IPv6 address `2001:0db8:1a2b:0015:0000:0000:1a2f:0000'.

IPv6 addresses can be abbreviated in two ways:

XS3800-28 User's Guide
501

Chapter 54 DHCP

Table 234 IP Application > DHCP > DHCPv6 > Information (continued)

LA BEL

DESC RIPTIO N

Add

Click this to create a new entry or to update an existing one.

Cancel Clear Index Active VID Refresh Time DNS Server
Delete Cancel

This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to reset the fields to their last saved values.
Click C le a r to reset the fields to the factory defaults.
This field displays a sequential number for each entry. Click an index number to change its settings.
This field displays whether the entry is activated or not.
This field displays the ID number of the VLAN to which the DHCPv6 server belongs.
This field displays the number of seconds a DHCPv6 client should wait before refreshing information retrieved from a DHCPv6 server. It displays disa b le if Re fre sh Tim e is not configured.
This field displays the IPv6 address of the DNS server that the DHCP clients will use. It displays disa b le when it is not configured.
Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.
Check the entries that you want to remove and then click the De le te button.
Click C a nc e l to clear the selected check boxes.

54.7 DHC Pv6 Pre fix De le g a tio n
Prefix delegation enables an IPv6 device to use the received IPv6 prefix (for example, `2001:db2::/48') to generate its IP address. The Switch passes the IPv6 prefix information to its connected hosts (according to VLAN) so that they can generate their IPv6 addresses.
Use this screen to configure DHCPv6 client and IPv6 prefix settings for a specific VLAN on the Switch. Click IP Applic a tio n > DHC P > DHC Pv6 > Pre fix De le g a tio n in the navigation panel to display the screen as shown.
Fig ure 395 IP Application > DHCP > DHCPv6 > Prefix Delegation

XS3800-28 User's Guide
502

Chapter 54 DHCP

The following table describes the labels in this screen.

Table 235 IP Application > DHCP > DHCPv6 > Prefix Delegation

LA BEL

DESC RIPTIO N

Client DUID

Each DHCP client and server has a unique DHCP Unique IDentifier (DUID), which is used for identification when they are exchanging DHCPv6 messages. The DUID is generated from the MAC address, time, vendor assigned ID and/or the vendor's private enterprise number registered with the IANA. Type the client DUID for the devices connected to the Switch in this field.

Client Name

Type a name to identify the DHCPv6 client in this field.

VID

Type the ID number of the VLAN to which the DHCPv6 client belongs here.

Prefix Address

IPv6 uses an address prefix to represent the network address. An IPv6 prefix length specifies how many most significant bits (start from the left) in the address compose the network address. The prefix length is written as "/x" where x is a number. For example, `2001:db8:1a2b:15::1a2f:0/32' is a prefix address with prefix length.

/32 means that the first 32 bits (`2001:db8') from the left is the network prefix.

Prefix Length Add

Type the prefix address in this field. For example, type `2001:db8:1a2b:15::1a2f:0' Type the prefix length in this field. For example, type 32. Click this to create a new entry or to update an existing one.

Cancel Clear Index
Client DUID Client Name VID
Delete Cancel

This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to reset the fields to their last saved values.
Click C le a r to reset the fields to the factory defaults.
This field displays a sequential number for each entry. Click an index number to change its settings.
This field displays the client DHCP Unique IDentifier (DUID) which uniquely identifies the client.
This field displays a name to identify the DHCPv6 client.
This field displays the ID number of the VLAN to which the DHCPv6 client belongs.
Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.
Check the entries that you want to remove and then click the De le te button.
Click C a nc e l to clear the selected check boxes.

54.8 DHC Pv6 Re la y
A DHCPv6 relay agent is on the same network as the DHCPv6 clients and helps forward messages between the DHCPv6 server (that is in another network) and the DHCPv6 clients.
The DHCPv6 relay agent can add the remote identification (remote-ID) option and the interface-ID option to the Relay-Forward DHCPv6 messages. The remote-ID option carries a user-defined string, such as the system name. The interface-ID option provides slot number, port information and the VLAN ID to the DHCPv6 server. The remote-ID option (if any) is stripped from the Relay-Reply messages before the relay agent sends the packets to the clients. The DHCPv6 server copies the interface-ID option from the Relay-Forward message into the Relay-Reply message and sends it to the relay agent. The interface-ID should not change even after the relay agent restarts.
Use this screen to configure DHCPv6 relay settings for a specific VLAN on the Switch. Click IP Applic a tio n > DHC P > DHC Pv6 > DHC Pv6 Re la y in the navigation panel to display the screen as shown.
XS3800-28 User's Guide
503

Chapter 54 DHCP Fig ure 396 IP Application > DHCP > DHCPv6 Relay

The following table describes the labels in this screen.

Table 236 IP Application > DHCP > DHCPv6 Relay

LA BEL VID
Helper Address

DESC RIPTIO N
Enter the ID number of the VLAN to which the DHCPv6 server that will assign IP information belongs here.
Enter the IPv6 address of the DHCPv6 server that will assign IP information here.

An 128-bit IPv6 address is written as eight 16-bit hexadecimal blocks separated by colons (:). This is an example IPv6 address `2001:0db8:1a2b:0015:0000:0000:1a2f:0000'.

IPv6 addresses can be abbreviated in two ways:

Options Interface ID Remote ID
Add

· Leading zeros in a block can be omitted. So `2001:0db8:1a2b:0015:0000:0000:1a2f:0000' can be written as `2001:db8:1a2b:15:0:0:1a2f:0'.
· Any number of consecutive blocks of zeros can be replaced by a double colon. A double colon can only appear once in an IPv6 address. So `2001:0db8:0000:0000:1a2f:0000:0000:0015' can be written as `2001:0db8::1a2f:0000:0000:0015', `2001:0db8:0000:0000:1a2f::0015', `2001:db8::1a2f:0:0:15' or `2001:db8:0:0:1a2f::15'.
Select this option to have the Switch add the interface-ID option in the DHCPv6 requests from the clients in the specified VLAN before the Switch forwards them to a DHCPv6 server. Enter a string of up to 64 printable characters to be carried in the remote-ID option. The Switch adds the remote-ID option in the DHCPv6 requests from the clients in the specified VLAN before the Switch forwards them to a DHCPv6 server. Click this to create a new entry or to update an existing one.

Cancel Clear VID Helper Address Interface ID
Remote ID

XS3800-28 User's Guide
504

Chapter 54 DHCP

Table 236 IP Application > DHCP > DHCPv6 Relay (continued)

LA BEL

DESC RIPTIO N

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Check the entries that you want to remove and then click the De le te button.

Cancel

Click C a nc e l to clear the selected check boxes.

54.9 DHC P Se rve r G ua rd
Use this screen to specify whether ports are trusted or untrusted ports for DHCP packets. Click IP Applic a tio n > DHC P > DHC P Se rve r G ua rd in the navigation panel to display the screen as shown.
Fig ure 397 IP Application > DHCP > DHCP Server Guard

The following table describes the labels in this screen.

Table 237 IP Application > DHCP > DHCP Server Guard

LA BEL Active Port Setting Port *

DESC RIPTIO N Select this option to enable DHCP Server Guard.
The port number identifies the port you are configuring. Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Trusted State

Note: Changes in this row are copied to all the ports as soon as you make them.
Select whether this port is a trusted port (Truste d) or an untrusted port (Untruste d). The Switch does not discard DHCP packets on trusted ports for any reason.
The Switch discards DHCP packets from untrusted ports when the packet is a DHCP server packet (for example, OFFER, ACK, or NACK).

XS3800-28 User's Guide
505

Chapter 54 DHCP

Table 237 IP Application > DHCP > DHCP Server Guard (continued)

LA BEL

DESC RIPTIO N

Apply

Cancel

Click C a nc e l to reset the fields to their last saved values.

XS3800-28 User's Guide
506

Chapter 55 VRRP
C HA PTER 5 5 VRRP
This chapter shows you how to configure and monitor the Virtual Router Redundancy Protocol (VRRP) on the Switch.
55.1 VRRP O ve rvie w
Each host on a network is configured to send packets to a statically configured default gateway (this Switch). The default gateway can become a single point of failure. Virtual Router Redundancy Protocol (VRRP), defined in RFC 2338, allows you to create redundant backup gateways to ensure that the default gateway of a host is always available. In VRRP, a virtual router (VR) represents a number of physical layer-3 devices. An IP address is associated with the virtual router. A layer-3 device having the same IP address is the preferred master router while the other Layer-3 devices are the backup routers. The master router forwards traffic for the virtual router. When the master router becomes unavailable, a backup router assumes the role of the master router until the master router comes back up and takes over. The following figure shows a VRRP network example with the switches (A and B) implementing one virtual router VR1 to ensure the link between the host X and the uplink gateway G . Host X is configured to use VR1 (192.168.1.20) as the default gateway. If switch A has a higher priority, it is the master router. Switch B, having a lower priority, is the backup router. Fig ure 398 Example 1
If switch A (the master router) is unavailable, switch B takes over. Traffic is then processed by switch B.
XS3800-28 User's Guide
507

Chapter 55 VRRP
55.2 VRRP Sta tus
Click IP Applic a tio n > VRRP in the navigation panel to display the VRRP Sta tus screen as shown next. Fig ure 399 IP Application > VRRP Status

The following table describes the labels in this screen.

Table 238 IP Application > VRRP Status

LA BEL

DESC RIPTIO N

Index

This field displays the index number of a rule.

Network

This field displays the IP address and the subnet mask bits of an IP routing domain that is associated to a virtual router.

VRID

This field displays the ID number of the virtual router.

VR Status

This field displays the status of the virtual router.

This field is Ma ste r indicating that this Switch functions as the master router.

This field is Ba c kup indicating that this Switch functions as a backup router.

Uplink Status

This field displays Init when this Switch is initiating the VRRP protocol or when the Uplink Sta tus field displays De a d.
This field displays the status of the link between this Switch and the uplink gateway.

This field is Alive indicating that the link between this Switch and the uplink gateway is up. Otherwise, this field is De a d.

Poll Interval(s) Stop

This field displays Pro be when this Switch is check for the link state.
The text box displays how often (in seconds) this screen refreshes. You may change the refresh interval by typing a new number in the text box and then clicking Se t Inte rva l.
Click Sto p to halt system statistic polling.

55.3 VRRP C o nfig ura tio n
The following sections describe the different parts of the VRRP C o nfig ura tio n screen.
55.3.1 IP Inte rfa c e Se tup
Before configuring VRRP, first create an IP interface (or routing domain) in the IP Se tup screen. Click IP Applic a tio n, VRRP and click the C o nfig ura tio n link to display the VRRP C o nfig ura tio n screen as shown next. Note: You can only configure VRRP on interfaces with unique VLAN IDs.
XS3800-28 User's Guide
508

Chapter 55 VRRP
Note: Routing domains with the same VLAN ID are not displayed in the table indicated. Fig ure 400 IP Application > VRRP Configuration: IP Interface

The following table describes the labels in this screen.

Table 239 IP Application > VRRP Configuration: IP Interface

LA BEL Index Network Authentication

DESC RIPTIO N This field displays the index number of an entry. This field displays the IP address and number of subnet mask bit of an IP domain. Select No ne to disable authentication. This is the default setting.

Key Apply Cancel

Select Sim ple to use a simple password to authenticate VRRP packet exchanges on this interface.
When you select Sim ple in the Authe ntic a tio n field, enter a password key (up to eight printable ASCII character long) in this field.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to discard all changes made in this table.

55.3.2 VRRP Pa ra m e te rs
This section describes the VRRP parameters.

XS3800-28 User's Guide
509

Chapter 55 VRRP
55.3.2.1 Adve rtise m e nt Inte rva l
The master router sends out Hello messages to let the other backup routers know that it is still up and running. The time interval between sending the Hello messages is the advertisement interval. By default, a Hello message is sent out every second.
If the backup routers do not receive a Hello message from the master router after this interval expires, it is assumed that the master router is down. Then the backup router with the highest priority becomes the master router.
Note: All routers participating in the virtual router must use the same advertisement interval.
55.3.2.2 Prio rity
Configure the priority level (1 to 254) to set which backup router to take over in case the master router goes down. The backup router with the highest priority will take over. The priority of the VRRP router that owns the IP address(es) associated with the virtual router is 255.
55.3.2.3 Pre e m pt Mo de
If the master router is unavailable, a backup router assumes the role of the master router. However, when another backup router with a higher priority joins the network, it will preempt the lower priority backup router that is the master. Disable preempt mode to prevent this from happening.
By default, a layer 3 device with the same IP address as the virtual router will become the master router regardless of the preempt mode.
55.3.3 C o nfig uring VRRP Pa ra m e te rs
After you set up an IP interface, configure the VRRP parameters in the VRRP C o nfig ura tio n screen.
Fig ure 401 IP Application > VRRP Configuration: VRRP Parameters

The following table describes the labels in this screen.

Table 240 IP Application > VRRP Configuration: VRRP Parameters

LA BEL

DESC RIPTIO N

Active

Select this option to enable this VRRP entry.

Name

Enter a descriptive name (up to 32 printable ASCII characters) for identification purposes.

Network

Select an IP domain to which this VRRP entry applies.

XS3800-28 User's Guide
510

Chapter 55 VRRP

Table 240 IP Application > VRRP Configuration: VRRP Parameters (continued)

LA BEL

DESC RIPTIO N

Virtual Router ID

Select a virtual router number (1 to 7) for which this VRRP entry is created.

You can configure up to seven virtual routers for one network.

Advertisement Interval Specify the number of seconds between Hello message transmissions. The default is 1.

Preempt Mode

Select this option to activate preempt mode.

Priority

Enter a number (between 1 and 254) to set the priority level. The bigger the number, the higher the priority.

Uplink Gateway

This field is 100 by default. Enter the IP address of the uplink gateway in dotted decimal notation.

Response Ping Primary Virtual IP Secondary Virtual IP
Add

The Switch checks the link to the uplink gateway. Select this option to have the Switch respond to a ping that is sent to the virtual IP address. Enter the IP address of the primary virtual router in dotted decimal notation. This field is optional. Enter the IP address of a secondary virtual router in dotted decimal notation. This field is ignored when you enter 0.0.0.0. Click this to create a new entry or to update an existing one.

Cancel Clear

55.3.4 Vie wing VRRP Sum m a ry
View the VRRP configuration summary at the bottom of the screen. Fig ure 402 IP Application > VRRP Configuration: Summary

The following table describes the labels in this screen.

Table 241 IP Application > VRRP Configuration: Summary

LA BEL

DESC RIPTIO N

Index

This field displays the index number of an entry. Click an index number to change the settings.

Active

This field shows whether a VRRP entry is enabled (Ye s) or disabled (No ).

Name

This field displays a descriptive name of an entry.

Network

This field displays the IP address and subnet mask of an interface.

VRID

This field displays the ID number of a virtual router.

Primary VIP

This field displays the IP address of the primary virtual router.

Uplink Gateway This field displays the IP address of the uplink gateway.

Priority

This field displays the priority level (1 to 255) of the entry.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

XS3800-28 User's Guide
511

Chapter 55 VRRP

Table 241 IP Application > VRRP Configuration: Summary (continued)

LA BEL

DESC RIPTIO N

Delete

Click De le te to remove the selected entry from the summary table.

Cancel

Click C a nc e l to clear the check boxes.

55.4 VRRP C o nfig ura tio n Exa m ple s
The following sections show two VRRP configuration examples on the Switch.
55.4.1 O ne Sub ne t Ne two rk Exa m ple
The figure below shows a simple VRRP network with only one virtual router VR1 (VRID =1) and two switches. The network is connected to the WAN via an uplink gateway G (172.16.1.100). The host computer X is set to use VR1 as the default gateway. Fig ure 403 VRRP Configuration Example: One Virtual Router Network

You want to set switch A as the master router. Configure the VRRP parameters in the VRRP C o nfig ura tio n screens on the switches as shown in the figures below. Fig ure 404 VRRP Example 1: VRRP Parameter Settings on Switch A
EXAMPLE
XS3800-28 User's Guide
512

Chapter 55 VRRP Fig ure 405 VRRP Example 1: VRRP Parameter Settings on Switch B

EXAMPLE

After configuring and saving the VRRP configuration, the VRRP Sta tus screens for both switches are shown next.
Fig ure 406 VRRP Example 1: VRRP Status on Switch A

Fig ure 407 VRRP Example 1: VRRP Status on Switch B

EXAMPLE

EXAMPLE
55.4.2 Two Sub ne ts Exa m ple
The following figure depicts an example in which two switches share the network traffic. Hosts in the two network groups use different default gateways. Each switch is configured to backup a virtual router using VRRP.
You wish to configure switch A as the master router for virtual router VR1 and as a backup for virtual router VR2. On the other hand, switch B is the master for VR2 and a backup for VR1.

XS3800-28 User's Guide
513

Chapter 55 VRRP Fig ure 408 VRRP Configuration Example: Two Virtual Router Network
You need to configure the VRRP C o nfig ura tio n screen for virtual router VR2 on each switch, while keeping the VRRP configuration in example 1 for virtual router VR1 (refer to Section 55.4.2 on page 513). Configure the VRRP parameters on the switches as shown in the figures below. Fig ure 409 VRRP Example 2: VRRP Parameter Settings for VR2 on Switch A
EXAMPLE
Fig ure 410 VRRP Example 2: VRRP Parameter Settings for VR2 on Switch B
EXAMPLE
After configuring and saving the VRRP configuration, the VRRP Sta tus screens for both switches are shown next.
XS3800-28 User's Guide
514

Chapter 55 VRRP Fig ure 411 VRRP Example 2: VRRP Status on Switch A

Fig ure 412 VRRP Example 2: VRRP Status on Switch B

EXAMPLE

XS3800-28 User's Guide
515

Chapter 56 Router Setup
C HA PTER 5 6 Ro ute r Se tup
56.1 Ro ute r Se tup O ve rvie w
The Switch learns the next-hops using ARP and determines routing paths for a destination. The Switch supports Equal-Cost MultiPath (ECMP) to forward packets destined to the same device (A for example) through different routing paths (1, 2 and 3) of equal path cost. This allows you to balance or share traffic loads between multiple routing paths when the Switch is connected to more than one next-hop. ECMP works with static routes or a routing protocol, such as OSPF. With ECMP, packets are routed through the paths of equal cost according to the hash algorithm output.
56.2 C o nfig uring Ro ute r Se tup
Click IP Applic a tio n > Ro ute r Se tup in the navigation panel to display the screen as shown next. Fig ure 413 IP Application > Router Setup
XS3800-28 User's Guide
516

Chapter 56 Router Setup

The following table describes the labels in this screen.

Table 242 IP Application > Router Setup

LA BEL

DESC RIPTIO N

Active

Select this option to enable Equal-Cost MultiPath (ECMP) routing on the Switch.

Criteria

Select the criteria the Switch uses to determine the routing path for a packet.

Select src - ip to have the Switch use a hash algorithm to convert a packet's source IP address into a hash value which acts as an index to a route path.

Aging Time Discover Time Maximum Paths

Select src - dst- ip to have the Switch use a hash algorithm to convert a packet's source and destination IP addresses into a hash value which acts as an index to a route path.
Specify the time interval (from 0 to 86400 in increments of 10) in seconds at which the Switch sends an ARP request to update a resolved next-hop's MAC address.
Specify the time interval (from 0 to 86400 in increments of 10) in seconds at which the Switch sends an ARP request to update an unresolved next-hop's MAC address.
Set the maximum number of paths for one ECMP (Equal-Cost MultiPath) route. The maximum number varies by Switch. A smaller number of maximum-paths means more ECMP routes are allowed and a larger number of maximum-paths means fewer ECMP routes are allowed.

The number of paths for a static route for ECMP cannot be bigger than the maximum-paths value configured here.

Apply Cancel

Throughput may be influenced while configuring ECMP maximum-paths.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
517

Chapter 57 ARP Setup
C HA PTER 5 7 ARP Se tup
57.1 ARP O ve rvie w
Address Resolution Protocol (ARP) is a protocol for mapping an Internet Protocol address (IP address) to a physical machine address, also known as a Media Access Control or MAC address, on the local area network. An IP (version 4) address is 32 bits long. In an Ethernet LAN, MAC addresses are 48 bits long. The ARP table maintains an association between each MAC address and its corresponding IP address.
57.1.1 Wha t Yo u C a n Do
Use the ARP Le a rning screen (Section 57.2.1 on page 520) to configure ARP learning mode on a per-port basis. Use the Sta tic ARP screen (Section 57.2.2 on page 522) to create static ARP entries that will display in the Ma na g e m e nt > ARP Ta ble screen and will not age out.
57.1.2 Wha t Yo u Ne e d to Kno w
Read on for concepts on ARP that can help you configure the screen in this chapter.
57.1.2.1 Ho w ARP Wo rks
When an incoming packet destined for a host device on a local area network arrives at the Switch, the Switch looks in the ARP Table and if it finds the address, it sends it to the device. If no entry is found for the IP address, ARP broadcasts the request to all the devices on the LAN. The Switch fills in its own MAC and IP address in the sender address fields, and puts the known IP address of the target in the target IP address field. In addition, the Switch puts all ones in the target MAC field (FF.FF.FF.FF.FF.FF is the Ethernet broadcast address). The replying device (which is either the IP address of the device being sought or the router that knows the way) replaces the broadcast address with the target's MAC address, swaps the sender and target pairs, and unicasts the answer directly back to the requesting machine. ARP updates the ARP Table for future reference and then sends the packet to the MAC address that replied.
57.1.2.2 ARP Le a rning Mo de
The Switch supports three ARP learning modes: ARP-Reply, Gratuitous-ARP, and ARP-Request.
XS3800-28 User's Guide
518

Chapter 57 ARP Setup
ARP- Re ply
The Switch in ARP-Reply learning mode updates the ARP table only with the ARP replies to the ARP requests sent by the Switch. This can help prevent ARP spoofing. In the following example, the Switch does not have IP address and MAC address mapping information for hosts A and B in its ARP table, and host A wants to ping host B. Host A sends an ARP request to the Switch and then sends an ICMP request after getting the ARP reply from the Switch. The Switch finds no matched entry for host B in the ARP table and broadcasts the ARP request to all the devices on the LAN. When the Switch receives the ARP reply from host B, it updates its ARP table and also forwards host A's ICMP request to host B. After the Switch gets the ICMP reply from host B, it sends out an ARP request to get host A's MAC address and updates the ARP table with host A's ARP reply. The Switch then can forward host B's ICMP reply to host A.
G ra tuito us- ARP
A gratuitous ARP is an ARP request in which both the source and destination IP address fields are set to the IP address of the device that sends this request and the destination MAC address field is set to the broadcast address. There will be no reply to a gratuitous ARP request. A device may send a gratuitous ARP packet to detect IP collisions. If a device restarts or its MAC address is changed, it can also use gratuitous ARP to inform other devices in the same network to update their ARP table with the new mapping information. In Gratuitous-ARP learning mode, the Switch updates its ARP table with either an ARP reply or a gratuitous ARP request.
XS3800-28 User's Guide
519

Chapter 57 ARP Setup
ARP- Re q ue st
When the Switch is in ARP-Request learning mode, it updates the ARP table with both ARP replies, gratuitous ARP requests and ARP requests. Therefore in the following example, the Switch can learn host A's MAC address from the ARP request sent by host A. The Switch then forwards host B's ICMP reply to host A right after getting host B's MAC address and ICMP reply.
57.2 ARP Se tup
Click the link next to ARP Le a rning to open a screen where you can set the ARP learning mode for each port. Click the link next to Sta tic ARP to open a screen where you can create static ARP entries on the Switch. Fig ure 414 IP Application > ARP Setup
57.2.1 ARP Le a rning
Use this screen to configure each port's ARP learning mode. Click the link next to ARP Le a rning in the IP Applic a tio n > ARP Se tup screen to display the screen as shown next.
XS3800-28 User's Guide
520

Chapter 57 ARP Setup Fig ure 415 IP Application > ARP Setup > ARP Learning (Standalone Mode)
Fig ure 416 IP Application > ARP Setup > ARP Learning (Stacking Mode)

The following table describes the labels in this screen.

Table 243 IP Application > ARP Setup > ARP Learning

LA BEL

DESC RIPTIO N

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This field displays the port number. In stacking mode, the first number represents the slot ID and

the second is the port number. Please note that the default stacking ports (the last four ports of

your Switch) cannot be configured. They are reserved for stacking only.

Settings in this row apply to all ports.

Use this row only if you want to make some settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Changes in this row are copied to all the ports as soon as you make them.

XS3800-28 User's Guide
521

Chapter 57 ARP Setup

Table 243 IP Application > ARP Setup > ARP Learning (continued)

LA BEL

DESC RIPTIO N

ARP Learning Mode

Select the ARP learning mode the Switch uses on the port.
Select ARP- Re ply to have the Switch update the ARP table only with the ARP replies to the ARP requests sent by the Switch.

Select G ra tuito us- ARP to have the Switch update its ARP table with either an ARP reply or a gratuitous ARP request.

Apply Cancel

Select ARP- Re q ue st to have the Switch update the ARP table with both ARP replies, gratuitous ARP requests and ARP requests.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

57.2.2 Sta tic ARP
Use this screen to create static ARP entries that will display in the Ma na g e m e nt > ARP Ta b le screen and will not age out. Click the link next to Sta tic ARP in the IP Applic a tio n > ARP Se tup screen to display the screen as shown.
Fig ure 417 IP Application > ARP Setup > Static ARP (Standalone Mode)

Fig ure 418 IP Application > ARP Setup > Static ARP (Stacking Mode)

XS3800-28 User's Guide
522

Chapter 57 ARP Setup

The following table describes the related labels in this screen.

Table 244 IP Application > ARP Setup > Static ARP

LA BEL Active
Name IP Address
MAC Address VID Port
Add

DESC RIPTIO N
Select this check box to activate your rule. You may temporarily deactivate a rule without deleting it by clearing this check box.
Enter a descriptive name (up to 32 printable ASCII characters) for identification purposes.
Enter the IP address of a device connected to a Switch port with the corresponding MAC address below.
Enter the MAC address of the device with the corresponding IP address above.
Enter the ID number of VLAN to which the device belongs.
Enter the number of port to which the device connects. In stacking mode, the first field is the slot ID and the second field is the port number.
Click this to create a new entry or to update an existing one.

Cancel Clear Index Active Name IP Address
MAC Address VID Port
Delete Cancel

This saves your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Click C a nc e l to begin configuring this screen afresh. Click C le a r to set the above fields back to the factory defaults. This field displays the index number of an entry. Click an index number to change the settings. This field displays Ye s when the entry is activated and NO when it is deactivated. This field displays the descriptive name for this entry. This is for identification purposes only. This is the IP address of a device connected to a Switch port with the corresponding MAC address below. This is the MAC address of the device with the corresponding IP address above. This field displays the VLAN to which the device belongs. This field displays the port to which the device connects. Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries. Click De le te to remove the selected entry from the summary table. Click C a nc e l to clear the check boxes.

XS3800-28 User's Guide
523

C HA PTER 5 8 Ma inte na nc e
58.1 O ve rvie w
This chapter explains how to configure the screens that let you maintain the firmware and configuration files.
58.1.1 Wha t Yo u C a n Do
· Use the Ma inte na nc e screen (Section 58.2 on page 524) to manage firmware and your configuration files.
· Use the Firm wa re Upg ra de screen (Section 58.3 on page 529) to upload the latest firmware. · Use the Re sto re C o nfig ura tio n screen (Section 58.4 on page 531) to upload a stored device
configuration file. · Use the Ba c kup C o nfig ura tio n screen (Section 58.5 on page 531) to save your configurations for later
use. · Use the Auto C o nfig ura tio n screen (Section 58.6 on page 532) to overwrite the running configuration
stored in the Switch's RAM. · Use the Era se Running - C o nfig ura tio n screen (Section 58.2.1 on page 526) to reset the configuration to
the Zyxel default configuration settings. · Use the Sa ve C o nfig ura tio n screen (Section 58.2.2 on page 526) to save the current configuration
settings to a specific configuration file on the Switch. · Use the Re bo o t Syste m screen (Section 58.2.3 on page 527) to restart the Switch without physically
turning the power off and load a specific configuration file. · Use the Te c h- Suppo rt screen (Section 58.7 on page 533) to create reports for customer support if
there are problems with the Switch. · Use the C e rtific a te s screen (Section 58.8 on page 535) to see the C e rtific a te screen and import the
Switch's CA-signed certificates.
58.2 Ma inte na nc e Se tting s
Use this screen to manage firmware and your configuration files. Click Ma na g e m e nt > Ma inte na nc e in the navigation panel to open the following screen.
XS3800-28 User's Guide
524

Chapter 58 Maintenance Fig ure 419 Management > Maintenance (Standalone Mode)

Fig ure 420 Management > Maintenance (Stacking Mode)

The following table describes the labels in this screen.

Table 245 Management > Maintenance

LA BEL

DESC RIPTIO N

Firmware Upgrade
Restore Configuration
Backup Configuration
Auto Configuration
Erase RunningConfiguration
Save Configuration

Click C lic k He re to go to the Firm wa re Upg ra de screen.
Click C lic k He re to go to the Re sto re C o nfig ura tio n screen.
Click C lic k He re to go to the Ba c kup C o nfig ura tio n screen.
Click C lic k He re to go to the Auto C o nfig ura tio n screen.
Click C lic k He re to reset the configuration to the Zyxel default configuration settings. Note that this will not reset the configuration to the factory default settings. Click C o nfig 1 to save the current configuration settings to C o nfig ura tio n 1 on the Switch. Click C o nfig 2 to save the current configuration settings to C o nfig ura tio n 2 on the Switch.

Click C usto m De fa ult to save the current configuration settings to a customized default file on the Switch. This file can be used instead of the Zyxel factory default configuration file.

XS3800-28 User's Guide
525

Chapter 58 Maintenance

Table 245 Management > Maintenance (continued)

LA BEL

DESC RIPTIO N

Reboot System

Click C o nfig 1 to reboot the system and load C o nfig ura tio n 1 on the Switch.

Click C o nfig 2 to reboot the system and load C o nfig ura tio n 2 on the Switch.

Click Sta c king De fa ult to reboot the system and load stacking configurations on the Switch.

Click Fa c to ry De fa ult to reboot the system and load the factory default configuration on the Switch.

Click C usto m De fa ult to reboot the system and load a saved C usto m De fa ult configuration file on the Switch. This will save the custom default configuration settings to both C o nfig ura tio n 1 and C o nfig ura tio n 2. If a C usto m De fa ult configuration file was not saved, clicking C usto m De fa ult loads the factory default configuration on the Switch.

Current Tech-Support Certificates

Note: Make sure to click the Sa ve button in any screen to save your settings to the current configuration on the Switch.
This field displays which configuration (C o nfig ura tio n 1 or C o nfig ura tio n 2) is currently operating on the Switch.
Click C lic k He re to see the Tech-Support screen. You can set CPU and memory thresholds for log reports and download related log reports for issue analysis. Log reports include CPU history and utilization, crash and memory.
Click C lic k He re to see the C e rtific a te screen and import the Switch's CA-signed certificates.

58.2.1 Era se Running - C o nfig ura tio n
Follow the steps below to clear current configuration on the Switch. Note that this will NOT reset the Switch back to its factory defaults. For example, if your Switch is set to stacking mode and you click erase running-configuration, after the Switch restarts, it will remain in stacking mode. If you want to change the Switch to its factory default mode, click the Fa c to ry De fa ult button in Re b o o t Syste m .
1 In the Ma inte na nc e screen, click the C lic k He re button next to Era se Running - C o nfig ura tio n to clear all Switch configuration information you configured and return to the Zyxel default configuration settings.
2 Click O K to reset all Switch configurations. Fig ure 421 Erase Running-Configuration: Confirmation

3 In the Web Configurator, click the Sa ve button in the top of the screen to make the changes take effect. If you want to access the Switch Web Configurator again, you may need to change the IP address of your computer to be in the same subnet as that of the default Switch IP address (192.168.1.1 or DHCP-assigned IP).
58.2.2 Sa ve C o nfig ura tio n
Click C o nfig 1 to save the current configuration settings permanently to C o nfig ura tio n 1 on the Switch. These configurations are set up according to your network environment.
XS3800-28 User's Guide
526

Chapter 58 Maintenance
Click C o nfig 2 to save the current configuration settings permanently to C o nfig ura tio n 2 on the Switch. These configurations are set up according to your network environment. Click C usto m De fa ult to save the current configuration settings permanently to a customized default file on the Switch. If configuration changes cause the Switch to behave abnormally, click C usto m De fa ult (next to Re b o o t Syste m ) to have the Switch automatically reboot and restore the saved C usto m De fa ult configuration file. Alternatively, click Sa ve on the top right-hand corner in any screen to save the configuration changes to the current configuration.
58.2.3 Re b o o t Syste m
Re bo o t Syste m allows you to restart the Switch without physically turning the power off. It also allows you to load configuration one (C o nfig 1), configuration two (C o nfig 2), a C usto m De fa ult or the Fa c to ry De fa ult configuration when you reboot. Follow the steps below to reboot the Switch.
1 In the Ma inte na nc e screen, click a configuration button next to Re b o o t Syste m to reboot and load that configuration file. The confirmation screen displays.
2 Click O K again and then wait for the Switch to restart. This takes up to 2 minutes. This does not affect the Switch's configuration. Click C o nfig 1 and follow steps 1 to 2 to reboot and load configuration one on the Switch. Click C o nfig 2 and follow steps 1 to 2 to reboot and load configuration two on the Switch. Click Sta c king De fa ult and follow steps 1 to 2 to reboot and load stacking default configuration settings on the Switch. Click Fa c to ry De fa ult and follow steps 1 to 2 to reboot and load Zyxel factory default configuration settings on the Switch. Click C usto m De fa ult and follow steps 1 to 2 to reboot and load a customized default file on the Switch. This will save the custom default configuration settings to both C o nfig ura tio n 1 and C o nfig ura tio n 2.
Note: If a customized default file was not saved, clicking C usto m De fa ult loads the factory default configuration on the Switch.
58.2.4 Sta c king De fa ult
Follow the steps below to reset the Switch back to the stacking defaults. The master Switch login information will not be reset.
1 Click the Sta c king De fa ult button to clear all Switch configuration information you configured and return to the stacking defaults.
2 Click O K to continue or C a nc e l to abort.
XS3800-28 User's Guide
527

Chapter 58 Maintenance Fig ure 422 Load Stacking Default: Start
3 If you want to access the Switch Web Configurator again, you may need to change the IP address of your computer to be in the same subnet as that of the default Switch IP address (192.168.1.1).
58.2.5 Fa c to ry De fa ult
Follow the steps below to reset the Switch back to the factory defaults. 1 Click the Fa c to ry De fa ult button. 2 Click O K to continue or C a nc e l to abort.
Fig ure 423 Load Factory Default: Confirmation
If you want to access the Switch Web Configurator again, you may need to change the IP address of your computer to be in the same subnet as that of the default Switch IP address (192.168.1.1 or DHCPassigned IP).
58.2.6 C usto m De fa ult
Follow the steps below to reset the Switch back to the C usto m De fa ult configuration file you created. This will save the custom default configuration settings to both C o nfig ura tio n 1 and C o nfig ura tio n 2. 1 Click the C usto m De fa ult button. 2 Click O K to continue or C a nc e l to abort. Note: If you did not save a C usto m De fa ult file in the Web Configurator or CLI using copy
running-config custom-default, then the factory default file is restored after you press click C usto m De fa ult (next to Re b o o t Syste m ) on the Switch. You will then have to make all your configurations again on the Switch.
XS3800-28 User's Guide
528

Chapter 58 Maintenance Fig ure 424 Load Custom Default: Confirmation
58.3 Firm wa re Upg ra de
Use the following screen to upgrade your Switch to the latest firmware. The Switch supports dual firmware images, Firm wa re 1 and Firm wa re 2. Use this screen to specify which image is updated when firmware is uploaded using the Web Configurator and to specify which image is loaded when the Switch starts up. SwitchMake sure you have downloaded (and unzipped) the correct model firmware and version to your computer before uploading to the device.
Be sure to uplo a d the c o rre c t m o de l firm wa re a s uplo a ding the wro ng m o de l firm wa re m a y da m a g e yo ur de vic e .
Click Ma na g e m e nt > Ma inte na nc e > Firm wa re Upg ra de to view the screen as shown next. Fig ure 425 Management > Maintenance > Firmware Upgrade (Standalone Mode)
XS3800-28 User's Guide
529

Chapter 58 Maintenance Fig ure 426 Management > Maintenance > Firmware Upgrade (Stacking Mode)

The top of firmware upgrade screen shows which firmware version is currently running on the Switch. Type the path and file name of the firmware file you wish to upload to the Switch in the File Pa th text box or click C ho o se File or Bro wse to locate it. Firmware upgrades are only applied after a reboot. Click Upg ra de to load the new firmware. Select the C o nfig Bo o t Im a g e drop-down list box if you want to reboot the Switch and click Apply to apply the new firmware immediately. Click Upg ra de to load the new firmware.

After the process is complete, see the Syste m Info screen to verify your current firmware version number.

Table 246 Management > Maintenance > Firmware Upgrade

LA BEL Slot

DESC RIPTIO N This field appears only in stacking mode.

Name Status

This is the slot index number. This is the name of the Switch that you are configuring. This field appears only in stacking mode.

Version

This field displays the current stacking status on the Switch. The Switch has 2 firmware sets, Firm wa re 1 and Firm wa re 2, residing in flash.

Current Boot Image

· Running shows the version number (and model code) and MM/DD/YYYY creation date of the firmware currently in use on the Switch (Firm wa re 1 or Firm wa re 2). The firmware information is also displayed at System Information in Basic Setting.
· Firm wa re 1 shows its version number (and model code) and MM/DD/YYYY creation date.
· Firm wa re 2 shows its version number (and model code) and MM/DD/YYYY creation date.
This displays which firmware is currently in use on the Switch (Firm wa re 1 or Firm wa re 2).

XS3800-28 User's Guide
530

Chapter 58 Maintenance

Table 246 Management > Maintenance > Firmware Upgrade (continued)

LA BEL Config Boot Image
Apply
Cancel

DESC RIPTIO N
Select which firmware (Firm wa re 1 or Firm wa re 2) should load, click Apply and reboot the Switch to see changes, you will also see changes in the C urre nt Bo o t Im a g e field above as well.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.
This field appears only in stacking mode.

Firmware File Path
Upgrade

Click the drop-down list to choose the slot number of the Switch in a stack to upgrade the firmware on this slot. Or select All to upgrade the firmware for all slots.
Choose to upload the new firmware to (Firmware) 1 or (Firmware) 2.
Type the path and file name of the firmware file you wish to upload to the Switch in the File Pa th text box or click C ho o se File or Bro wse to locate it.
Click Upg ra de to load the new firmware. s are only applied after a reboot. To reboot, go to Ma na g e m e nt > Ma inte na nc e > Re b o o t Syste m and click C o nfig 1, C o nfig 2 or Fa c to ry De fa ult (C o nfig 1, C o nfig 2 and Fa c to ry De fa ult are the configuration files you want the Switch to use when it restarts).

58.4 Re sto re C o nfig ura tio n
Use this screen to restore a previously saved configuration from your computer to the Switch. Fig ure 427 Management > Maintenance > Restore Configuration

Type the path and file name of the configuration file you wish to restore in the File Pa th text box or click C ho o se File or Bro wse to locate it. After you have specified the file, click Re sto re . "config" is the name of the configuration file on the Switch, so your backup configuration file is automatically renamed when you restore using this screen.
58.5 Ba c kup C o nfig ura tio n
Backing up your Switch configurations allows you to create various "snap shots" of your device from which you may restore at a later date. Back up your current Switch configuration to a computer using the Ba c kup C o nfig ura tio n screen.
XS3800-28 User's Guide
531

Chapter 58 Maintenance Fig ure 428 Management > Maintenance > Backup Configuration
Follow the steps below to back up the current Switch configuration to your computer in this screen. 1 Select which Switch configuration file you want to download to your computer. 2 Click Ba c kup. 3 If the current configuration file is open and/or downloaded to your computer automatically, you can
click File > Sa ve As to save the file to a specific place. If a dialog box pops up asking whether you want to open or save the file, click Sa ve or Sa ve File to download it to the default downloads folder on your computer. If a Sa ve As screen displays after you click Sa ve or Sa ve File , choose a location to save the file on your computer from the Sa ve in drop-down list box and type a descriptive name for it in the File na me list box. Click Sa ve to save the configuration file to your computer.
58.6 Auto C o nfig ura tio n
The Switch can download an pre-saved auto configuration file automatically when you reboot the Switch using the DHCP or HTTPS mode. This will overwrite the running configuration stored in the Switch's RAM instead of the startup configuration stored in the Switch's flash memory. Fig ure 429 Management > Maintenance > Auto Configuration
XS3800-28 User's Guide
532

Chapter 58 Maintenance

The following table describes the labels in this screen.

Table 247 Management > Maintenance > Auto Configuration

LA BEL

DESC RIPTIO N

Use this section to view the auto configuration status after you restarted the Switch.

Mode

This field shows the mode (DHC P or HTTPS) that is used for auto configuration after you enabled auto configuration and restarted the Switch.

State

It shows No ne if auto configuration was not enabled.
This field shows whether auto configuration was executed successfully the last time the Switch rebooted.

No ne Auto configuration was disabled and not executed.

Suc c e ss An auto configuration file was downloaded successfully to the Switch.

Filename

Un- suc c e ss An auto configuration file was not downloaded to the Switch.
This field displays the name of the auto configuration file that was downloaded the last time the Switch rebooted.

It shows No ne if auto configuration was not enabled or not executed successfully.

Use this section to enable auto configuration and select the mode that you want to use for auto configuration.

Active

Select the check box to enable auto configuration.

Mode

Select DHC P to have the Switch use the TFTP server IP address and auto configuration file name assigned by a DHCP server to download a pre-saved configuration file when the Switch reboots.

Note: The Switch should act as a DHCP client to send a DHCP request so that it can get the TFTP server address and configuration file name from the DHCP server.

DHCP VLAN ID HTTPS URL

Select HTTPS to have the Switch use the URL you specified in the HTTPS URLfield to access a web server and download the auto configuration file using HTTPS.
Enter the VLAN ID of the DHCP server that assigns the TFTP server IP address and auto configuration file name to the Switch.
Type the URL that can be used to access and download the auto configuration file from a web server using HTTPS. For example, https://webserverIPaddress/configfilename.cfg.

Apply Cancel

Note: You must fill in this field if you select HTTPS in the Mo de field. Otherwise, auto configuration will not work.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

58.7 Te c h- Suppo rt
The Tech-Support feature is a log enhancement tool that logs useful information such as CPU utilization history, memory and Mbuf (Memory Buffer) log and crash reports for issue analysis by customer support should you have difficulty with your Switch. The Tech Support menu eases your effort in obtaining reports and it is also available in CLI command by typing "Show tech-support" command. Click Ma na g e m e nt > Ma inte na nc e > Te c h- Suppo rt to see the following screen.
XS3800-28 User's Guide
533

Fig ure 430 Management > Maintenance > Tech-Support

You may need WordPad or similar software to see the log report correctly. The table below describes the fields in the above screen.

Table 248 Management > Maintenance > Tech-Support

LA BEL

DESC RIPTIO N

CPU

Type a number ranging from 50 to 100 in the CPU threshold box, and type another number ranging from 5 to 60 in the seconds box then click Apply.

For example, 80 for CPU threshold and 5 for seconds means a log will be created when CPU utilization reaches over 80% and lasts for 5 seconds.

The log report holds 7 days of CPU log data and is stored in volatile memory (RAM). The data is lost if the Switch is turned off or in event of power outage. After 7 days, the logs wrap around and new ones and replace the earliest ones.

Mbuf

The higher the CPU threshold number, the fewer logs will be created, and the less data technical support will have to analyze and vice versa.
Type a number ranging from 50 to 100 in the Mbuf (Memory Buffer) threshold box. The Mbuf log report is stored in flash (permanent) memory.

For example, Mbuf 50 means a log will be created when the Mbuf utilization is over 50%.

Apply
Cancel All
Crash CPU history
Memory Section Mbuf

The higher the Mbuf threshold number, the fewer logs will be created, and the less data technical support will have to analyze and vice versa.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.
Click Do wnlo a d to see all the log report and system status. This log report is stored in flash memory. If the All log report is too large, you can download the log reports separately below.
Click Do wnlo a d to see the crash log report. The log will include information of the last crash and is stored in flash memory.
Click Do wnlo a d to see the CPU history log report. The 7-days log is stored in RAM and you will need to save it, otherwise it will be lost when the Switch is shutdown or during power outage.
Click Do wnlo a d to see the memory section log report. This log report is stored in flash memory.
Click Do wnlo a d to see the Mbuf log report. The log includes Mbuf over threshold information. This log report is stored in flash memory.

XS3800-28 User's Guide
534

Chapter 58 Maintenance

Table 248 Management > Maintenance > Tech-Support (continued)

LA BEL

DESC RIPTIO N

ROM

Click Do wnlo a d to see the Read Only Memory (ROM) log report. This report is stored in flash memory.

Click Do wnlo a d to see the layer-3 Switch log report. The log only applies to the layer-3

Switch models. This report is stored in flash memory.

58.7.1 Te c h- Suppo rt Do wnlo a d
When you click Do wnlo a d to save your current Switch configuration to a computer, the following screen appears. When the log report has downloaded successfully, click Ba c k to return to the previous screen.
Fig ure 431 Management > Maintenance > Tech-Support: Download

58.8 C e rtific a te s
The Switch can use HTTPS certificates that are verified by a third party to create secure HTTPS connections between your computer and the Switch. This way, you may securely access the Switch using the Web Configurator. See Section 59.7.3 on page 560 for more information about HTTPS.
Certificates are based on public-private key pairs. A certificate contains the certificate owner's identity and public key. Certificates provide a way to exchange public keys for use in authentication.
Click Ma na g e m e nt > Ma inte na nc e > C e rtific a te s to open the following screen. Use this screen to import the Switch's CA-signed certificates.

XS3800-28 User's Guide
535

Chapter 58 Maintenance Fig ure 432 Management > Maintenance > Certificates

The following table describes the labels in this screen.

Table 249 Management > Maintenance > Certificates

LA BEL File Path Password
Import
Synchronize Certificate Active

DESC RIPTIO N
Click C ho o se File or Bro wse to find the certificate file you want to upload.
Enter the certificate file's password that was created when the PKCS #12 file was exported. The password consists of up to 32 ASCII characters.
Click this button to save the certificate that you have enrolled from a certification authority from your computer to the Switch.
Note: This part only appears in stacking mode.
Enable this option to allow the master Switch in stacking mode to synchronize CA-signed certificates to all stacking members and save it to their non-volatile memory. Or, delete the stacking members' CA-signed certificate if a CA-signed certificate does not exist in the master Switch.

Apply
Cancel Service Subject
Issuer
Valid From Valid To

Otherwise, disable this option.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.
This field displays the service type that this certificate is for.
This field displays identifying information about the certificate's owner, such as CN (Common Name), OU (Organizational Unit or department), O (Organization or company) and C (Country). It is recommended that each certificate have unique subject information.
This field displays identifying information about the certificate's issuing certification authority, such as a common name, organizational unit or department, organization or company and country.
This field displays the date that the certificate becomes applicable.
This field displays the date that the certificate expires.

XS3800-28 User's Guide
536

Chapter 58 Maintenance

Table 249 Management > Maintenance > Certificates (continued)

LA BEL

DESC RIPTIO N

Select an entry's check box to select a specific entry.

Delete

Click this button to delete the certificate (or certification request). You cannot delete a certificate that one or more features is configured to use.

58.8.1 HTTPS C e rtific a te s
Use this screen to view the HTTPS certificate details. Click a hyperlink in the Se rvic e column in the Ma na g e m e nt > Ma inte na nc e > C e rtific a te s screen to open the following screen.
Fig ure 433 Management > Maintenance > Certificates > HTTPS

XS3800-28 User's Guide
537

Chapter 58 Maintenance

58.9 Te c hnic a l Re fe re nc e
This section provides technical background information on the topics discussed in this chapter.

58.9.1 FTP C o m m a nd Line
This section shows some examples of uploading to or downloading files from the Switch using FTP commands. First, understand the filename conventions.

58.9.2 File na m e C o nve ntio ns

The configuration file (also known as the romfile or ROM) contains the Zyxel factory default configuration settings in the screens such as password, Switch setup, IP Setup, and so on. Once you have customized the Switch's settings, they can be saved back to your computer under a filename of your choosing.

ZyNOS (Zyxel Network Operating System sometimes referred to as the "ras" file) is the system firmware and has a "bin" filename extension.

Table 250 Filename Conventions

FILE TYPE

INTERNAL NAME

Configuration File config

EXTERNAL NAME *.cfg

Firmware

ras-0 ras-1

*.bin

DESC RIPTIO N
This is the configuration filename on the Switch. Uploading the config file replaces the specified configuration file system, including your Switch configurations, system-related data (including the default password), the error log and the trace log.
This is the generic name for the ZyNOS firmware on the Switch. ras-0 is image 1; ras-1 is image 2.

You can store up to two images, or firmware files of the same device model, on the Switch. Only one image is used at a time.
· Run the boot image <1|2> command to specify which image is updated when firmware is loaded using the Web Configurator and to specify which image is loaded when the Switch starts up.
· You can also use FTP commands to upload firmware to any image.
The Switch supports dual firmware images, ras-0 and ras-1. You can switch from one to the other by using the boot image <index> command, where <index> is 1 (ras-0) or 2 (ras-1). See the CLI Reference Guide for more information about using commands. The system does not reboot after it switches from one image to the other.

58.9.2.1 Exa m ple FTP C o m m a nds
ftp> put firmware.bin ras This is a sample FTP session showing the transfer of the computer file "firmware.bin" to the Switch.

ftp> get config config.cfg
This is a sample FTP session saving the current configuration to a file called "config.cfg" on your computer.

XS3800-28 User's Guide
538

Chapter 58 Maintenance

If your (T)FTP client does not allow you to have a destination filename different than the source, you will need to rename them as the Switch only recognizes "config" and "ras". Be sure you keep unaltered copies of both files for later use.
Be sure to uplo a d the c o rre c t m o de l firm wa re a s uplo a ding the wro ng m o de l firm wa re m a y da m a g e yo ur de vic e .

58.9.3 FTP C o m m a nd Line Pro c e dure

1 Launch the FTP client on your computer.
2 Enter open, followed by a space and the IP address of your Switch.
3 Press [ENTER] when prompted for a username.
4 Enter your password as requested (the default is "1234").
5 Enter bin to set transfer mode to binary.
6 Use put to transfer files from the computer to the Switch, for example, put firmware.bin ras transfers the firmware on your computer (firmware.bin) to the Switch and renames it to "ras". Similarly, put config.cfg config transfers the configuration file on your computer (config.cfg) to the Switch and renames it to "config". Likewise get config config.cfg transfers the configuration file on the Switch to your computer and renames it to "config.cfg". See Table 250 on page 538 for more information on filename conventions.
7 Enter quit to exit the ftp prompt.

58.9.4 G UI- b a se d FTP C lie nts

The following table describes some of the commands that you may see in GUI-based FTP clients.

Table 251 General Commands for GUI-based FTP Clients

C O MMAND Host Address Login Type

DESC RIPTIO N Enter the address of the host server. Anonymous.

This is when a user I.D. and password is automatically supplied to the server for anonymous access. Anonymous logins will work only if your ISP or service administrator has enabled this option.

Normal.

Transfer Type
Initial Remote Directory Initial Local Directory

The server requires a unique User ID and Password to login. Transfer files in either ASCII (plain text format) or in binary mode. Configuration and firmware files should be transferred in binary mode. Specify the default remote directory (path). Specify the default local directory (path).

58.9.5 FTP Re stric tio ns
FTP will not work when:

XS3800-28 User's Guide
539

Chapter 58 Maintenance · FTP service is disabled in the Se rvic e Ac c e ss C o ntro l screen. · The IP addresses in the Re m o te Ma na g e m e nt screen does not match the client IP address. If it does
not match, the Switch will disconnect the FTP session immediately.
XS3800-28 User's Guide
540

Chapter 59 Access Control
C HA PTER 5 9 Ac c e ss C o ntro l

59.1 Ac c e ss C o ntro l O ve rvie w

This chapter describes how to control access to the Switch.

A console port and FTP are allowed one session each, Telnet and SSH share nine sessions, up to five web sessions (five different user names and passwords) and/or limitless SNMP access control sessions are allowed.

Table 252 Access Control Overview

Console Port

SSH

Telnet

One session

Share up to 9 sessions

FTP One session

Web Up to 5 accounts

SNMP No limit

A console port access control session and Telnet access control session cannot coexist when multi-login is disabled. See the CLI Reference Guide for more information on disabling multi-login.

59.1.1 Wha t Yo u C a n Do
· Use the Ac c e ss C o ntro l screen (Section 59.2 on page 541) to display the main screen.
· Use the SNMP screen (Section 59.3 on page 542) to configure your SNMP settings.
· Use the Tra p G ro up screen (Section 59.3.1 on page 543) to specify the types of SNMP traps that should be sent to each SNMP manager.
· Use the Use r Info rm a tio n screen (Section 59.3.3 on page 546) to create SNMP users for authentication with managers using SNMP v3 and associate them to SNMP groups.
· Use the Lo g ins screens (Section 59.4 on page 548) to assign which users can access the Switch via Web Configurator at any one time.
· Use the Se rvic e Ac c e ss C o ntro l screen (Section 59.5 on page 549) to decide what services you may use to access the Switch.
· Use the Re m o te Ma na g e m e nt screen (Section 59.6 on page 550) to specify a group of one or more "trusted computers" from which an administrator may use a service to manage the Switch.

59.2 Ac c e ss C o ntro l Ma in Se tting s
Use this screen to display the main screen. Click Ma na g e m e nt > Ac c e ss C o ntro l in the navigation panel to display the main screen as shown.

XS3800-28 User's Guide
541

Chapter 59 Access Control Fig ure 434 Management > Access Control

The following table describes the labels in this screen.

Table 253 Management > Access Control

LA BEL

DESC RIPTIO N

SNMP

Click this link to configure your SNMP settings.

Logins

Click this link to assign which users can access the Switch via Web Configurator at any one time.

Service Access Control

Click this link to decide what services you may use to access the Switch.

Remote Management

Click this link to specify a group of one or more "trusted computers" from which an administrator may use a service to manage the Switch.

59.3 C o nfig ure SNMP
Use this screen to configure your SNMP settings. Click Ma na g e m e nt > Ac c e ss C o ntro l > SNMP to view the screen as shown. Fig ure 435 Management > Access Control > SNMP

XS3800-28 User's Guide
542

Chapter 59 Access Control

The following table describes the labels in this screen.

Table 254 Management > Access Control > SNMP

LA BEL

DESC RIPTIO N

General Setting

Use this section to specify the SNMP version and community (password) values.

Version

Select the SNMP version for the Switch. The SNMP version on the Switch must match the version on the SNMP manager. Choose SNMP version 2c (v2c ), SNMP version 3 (v3) or both (v3v2c ).

Get Community

SNMP version 2c is backwards compatible with SNMP version 1.
Enter the G e t C o m m unity string, which is the password for the incoming Get- and GetNextrequests from the management station.

Set Community

The G e t C o m m unity string is only used by SNMP managers using SNMP version 2c or lower.
Enter the Se t C o m m unity, which is the password for incoming Set- requests from the management station.

Trap Community

The Se t C o m m unity string is only used by SNMP managers using SNMP version 2c or lower.
Enter the Tra p C o m m unity string, which is the password sent with each trap to the SNMP manager.

Trap Destination Version IP Port Username

The Tra p C o m m unity string is only used by SNMP managers using SNMP version 2c or lower. Use this section to configure where to send SNMP traps from the Switch. Specify the version of the SNMP trap messages. Enter the IP addresses of up to four managers to send your SNMP traps to. Enter the port number upon which the manager listens for SNMP traps. Enter the username to be sent to the SNMP manager along with the SNMP v3 trap.

Apply Cancel

This username must match an existing account on the Switch (configured in the Ma na g e m e nt > Ac c e ss C o ntro l > SNMP > Use r screen).
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

59.3.1 C o nfig ure SNMP Tra p G ro up
From the SNMP screen, click Tra p G ro up to view the screen as shown. Use the Tra p G ro up screen to specify the types of SNMP traps that should be sent to each SNMP manager.

XS3800-28 User's Guide
543

Chapter 59 Access Control Fig ure 436 Management > Access Control > SNMP > Trap Group

The following table describes the labels in this screen.

Table 255 Management > Access Control > SNMP > Trap Group

LA BEL Trap Destination IP

DESC RIPTIO N
Select one of your configured trap destination IP addresses. These are the IP addresses of the SNMP managers. You must first configure a trap destination IP address in the SNMP Se tting screen.

Type Options

Use the rest of the screen to select which traps the Switch sends to that SNMP manager. Select the categories of SNMP traps that the Switch is to send to the SNMP manager. Select the individual SNMP traps that the Switch is to send to the SNMP station.

Apply Cancel

The traps are grouped by category. Selecting a category automatically selects all of the category's traps. Clear the check boxes for individual traps that you do not want the Switch to send to the SNMP station. Clearing a category's check box automatically clears all of the category's trap check boxes (the Switch only sends traps from selected categories).
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

59.3.2 Ena b le o r Disa b le Se nding o f SNMP Tra ps o n a Po rt
From the SNMP > Tra p G ro up screen, click Po rt to view the screen as shown. Use this screen to set whether a trap received on the ports would be sent to the SNMP manager.

XS3800-28 User's Guide
544

Chapter 59 Access Control Fig ure 437 Management > Access Control > SNMP > Trap Group > Port (Standalone Mode)
Fig ure 438 Management > Access Control > SNMP > Trap Group > Port (Stacking Mode)

The following table describes the labels in this screen.

Table 256 Management > Access Control > SNMP > Trap Group > Port

LA BEL Option SLOT Port
*

DESC RIPTIO N
Select the trap type you want to configure here.
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.
This field displays the port number. In stacking mode, the first number represents the slot ID and the second is the port number. Please note that the default stacking ports (the last four ports of your Switch) cannot be configured. They are reserved for stacking only.
Settings in this row apply to all ports.

Use this row only if you want to make some of the settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Changes in this row are copied to all the ports as soon as you make them.

XS3800-28 User's Guide
545

Chapter 59 Access Control

Table 256 Management > Access Control > SNMP > Trap Group > Port (continued)

LA BEL

DESC RIPTIO N

1/*

Settings in this row apply to all ports for the Switch represented by the slot ID (in stacking

mode).

Use this row only if you want to make some of the settings the same for all ports. Use this row first to set the common settings and then make adjustments on a port-by-port basis.

Active Apply Cancel

Note: Changes in this row are copied to all the ports as soon as you make them.
Select this check box to enable the trap type of SNMP traps on this port. The Switch sends the related traps received on this port to the SNMP manager.
Clear this check box to disable the sending of SNMP traps on this port.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

59.3.3 C o nfig ure SNMP Use r
From the SNMP screen, click Use r to view the screen as shown. Use the Use r screen to create SNMP users for authentication with managers using SNMP v3 and associate them to SNMP groups. An SNMP user is an SNMP manager.
Fig ure 439 Management > Access Control > SNMP > User

The following table describes the labels in this screen.

Table 257 Management > Access Control > SNMP > User

LA BEL

DESC RIPTIO N

User Information

Note: Use the username and password of the login accounts you specify in this screen to create accounts on the SNMP v3 manager.

Username

Specify the username of a login account on the Switch.

XS3800-28 User's Guide
546

Chapter 59 Access Control

Table 257 Management > Access Control > SNMP > User (continued)

LA BEL Security Level

DESC RIPTIO N
Select whether you want to implement authentication and/or encryption for SNMP communication from this user. Choose:

· no a uth to use the username as the password string to send to the SNMP manager. This is equivalent to the Get, Set and Trap Community in SNMP v2c. This is the lowest security level.
· a uth to implement an authentication algorithm for SNMP messages sent by this user. · priv to implement authentication and encryption for SNMP messages sent by this user.
This is the highest security level.

Authentication
Password Privacy

Note: The settings on the SNMP manager must be set at the same security level or higher than the security level settings on the Switch.
Select an authentication algorithm. MD5 (Message Digest 5) and SHA (Secure Hash Algorithm) are hash algorithms used to authenticate SNMP data. SHA authentication is generally considered stronger than MD5, but is slower.
Enter the password of up to 32 ASCII characters for SNMP user authentication.
Specify the encryption method for SNMP communication from this user. You can choose one of the following:

Password Group

· DES Data Encryption Standard is a widely used (but breakable) method of data encryption. It applies a 56-bit key to each 64-bit block of data.
· AES Advanced Encryption Standard is another method for data encryption that also uses a secret key. AES applies a 128-bit key to 128-bit blocks of data.
Enter the password of up to 32 ASCII characters for encrypting SNMP packets.
SNMP v3 adopts the concept of View-based Access Control Model (VACM) group. SNMP managers in one group are assigned common access rights to MIBs. Specify in which SNMP group this user is.

a dm in Members of this group can perform all types of system configuration, including the management of administrator accounts.

re a dwrite Members of this group have read and write rights, meaning that the user can create and edit the MIBs on the Switch, except the user account and AAA configuration.

Add

re a do nly Members of this group have read rights only, meaning the user can collect information from the Switch.
Click this to create a new entry or to update an existing one.

Cancel

Click C a nc e l to reset the fields to your previous configuration.

Clear

Click C le a r to reset the fields to the factory defaults.

Index

This is a read-only number identifying a login account on the Switch. Click on an index number to view more details and edit an existing account.

Username

This field displays the username of a login account on the Switch.

Security Level This field displays whether you want to implement authentication and/or encryption for SNMP communication with this user.

Authentication This field displays the authentication algorithm used for SNMP communication with this user.

Privacy

This field displays the encryption method used for SNMP communication with this user.

Group

This field displays the SNMP group to which this user belongs.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Click De le te to remove the selected entry from the summary table.

Cancel

Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
547

Chapter 59 Access Control
59.4 Se t Up Lo g in Ac c o unts
Up to five people (one administrator and four non-administrators) may access the Switch via Web Configurator at any one time. · An administrator is someone who can both view and configure Switch changes. The username for the
Administrator is always a dm in. The default administrator password is 1234. Note: It is highly recommended that you change the default administrator password (1234). · A non-administrator (username is something other than a dm in) is someone who can view and/or
configure Switch settings. The configuration right varies depending on the user's privilege level. Click Ma na g e m e nt > Ac c e ss C o ntro l > Lo g ins to view the screen as shown. Fig ure 440 Management > Access Control > Logins

The following table describes the labels in this screen.

Table 258 Management > Access Control > Logins

LA BEL Administrator

DESC RIPTIO N

This is the default administrator account with the "admin" user name. You cannot change the default administrator user name.

Old Password Type the existing system password (1234 is the default password when shipped).

New Password Enter your new system password.

Retype to confirm

Retype your new system password for confirmation.

Edit Logins

You may configure passwords for up to four users. These users can have read-only or read/write access. You can give users higher privileges via the Web Configurator or the CLI. For more information on assigning privileges via the CLI see the Ethernet Switch CLI Reference Guide.

User Name

Set a user name (up to 32 ASCII characters long).

XS3800-28 User's Guide
548

Chapter 59 Access Control

Table 258 Management > Access Control > Logins (continued)

LA BEL Password Retype to confirm Privilege

DESC RIPTIO N Enter your new system password. Retype your new system password for confirmation.
Type the privilege level for this user. At the time of writing, users may have a privilege level of 0, 3, 13, or 14 representing different configuration rights as shown below.

Apply Cancel

· 0 Display basic system information. · 3 Display configuration or status. · 13 Configure features except for login accounts, SNMP user accounts, the
authentication method sequence and authorization settings, multiple logins, administrator and enable passwords, and configuration information display. · 14 Configure login accounts, SNMP user accounts, the authentication method sequence and authorization settings, multiple logins, and administrator and enable passwords, and display configuration information.
Users can run command lines if the session's privilege level is greater than or equal to the command's privilege level. The session privilege initially comes from the privilege of the login account. For example, if the user has a privilege of 5, he or she can run commands that requires privilege level of 5 or less but not more.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

59.5 Se rvic e Ac c e ss C o ntro l
Service Access Control allows you to decide what services you may use to access the Switch. You may also change the default service port and configure "trusted computers" for each service in the Re m o te Ma na g e m e nt screen (discussed later). Click Ac c e ss C o ntro l to go back to the main Ac c e ss C o ntro l screen.
Fig ure 441 Management > Access Control > Service Access Control

The following table describes the fields in this screen.

Table 259 Management > Access Control > Service Access Control

LA BEL

DESC RIPTIO N

Services

Services you may use to access the Switch are listed here.

Active

Select this option for the corresponding services that you want to allow to access the Switch.

XS3800-28 User's Guide
549

Chapter 59 Access Control

Table 259 Management > Access Control > Service Access Control (continued)

LA BEL Service Port
Timeout Login Timeout

DESC RIPTIO N
For Telnet, SSH, FTP, HTTP or HTTPS services, you may change the default service port by typing the new port number in the Se rvic e Po rt field. If you change the default port number then you will have to let people (who wish to use the service) know the new port number for that service.
Enter how many minutes (from 1 to 255) a management session can be left idle before the session times out. After it times out you have to log in with your password again. Very long idle timeouts may have security risks.
The Telnet or SSH server do not allow multiple user logins at the same time. Enter how many seconds (from 30 to 300 seconds) a login session times out. After it times out you have to start the login session again. Very long login session timeouts may have security risks.

Apply Cancel

For example, if User A attempts to connect to the Switch (via SSH), but during the login stage, do not enter the user name and/or password, User B cannot connect to the Switch (via SSH) before the Lo g in Tim e o ut for User A expires (default 150 seconds).
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

59.6 Re m o te Ma na g e m e nt
Use this screen to specify a group of one or more "trusted computers" from which an administrator may use a service to manage the Switch. Click Ma na g e m e nt > Ac c e ss C o ntro l > Re m o te Ma na g e m e nt to view the screen as shown next. Click Ac c e ss C o ntro l to return to the Ac c e ss C o ntro l screen.

XS3800-28 User's Guide
550

Chapter 59 Access Control Fig ure 442 Management > Access Control > Remote Management

The following table describes the labels in this screen.

Table 260 Management > Access Control > Remote Management

LA BEL

DESC RIPTIO N

Entry

This is the client set index number. A "client set" is a group of one or more "trusted computers" from which an administrator may use a service to manage the Switch.

Active

Select this check box to activate this secured client set. Clear the check box if you wish to temporarily disable the set without deleting it.

Start Address Configure the IP address range of trusted computers from which you can manage this Switch.

End Address
Telnet/FTP/ HTTP/ICMP/ SNMP/SSH/ HTTPS Apply
Cancel

The Switch checks if the client IP address of a computer requesting a service or protocol matches the range set here. The Switch immediately disconnects the session if it does not match. Select services that may be used for managing the Switch from the specified trusted computers.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring. Click C a nc e l to begin configuring this screen afresh.

59.7 Te c hnic a l Re fe re nc e
This section provides technical background information on the topics discussed in this chapter.
XS3800-28 User's Guide
551

Chapter 59 Access Control
59.7.1 Ab o ut SNMP
Simple Network Management Protocol (SNMP) is an application layer protocol used to manage and monitor TCP/IP-based devices. SNMP is used to exchange management information between the network management system (NMS) and a network element (NE). A manager station can manage and monitor the Switch through the network via SNMP version 1 (SNMPv1), SNMP version 2c or SNMP version 3. The next figure illustrates an SNMP management operation. SNMP is only available if TCP/IP is configured.
Fig ure 443 SNMP Management Model

An SNMP managed network consists of two main components: agents and a manager.

An agent is a management software module that resides in a managed Switch (the Switch). An agent translates the local management information from the managed Switch into a form compatible with SNMP. The manager is the console through which network administrators perform network management functions. It executes applications that control and monitor managed devices.

The managed devices contain object variables or managed objects that define each piece of information to be collected about a Switch. Examples of variables include number of packets received, node port status and so on. A Management Information Base (MIB) is a collection of managed objects. SNMP allows a manager and agents to communicate for the purpose of accessing these objects.

SNMP itself is a simple request or response protocol based on the manager or agent model. The manager issues a request and the agent returns responses using the following protocol operations:

Table 261 SNMP Commands

LA BEL

DESC RIPTIO N

Get

Allows the manager to retrieve an object variable from the agent.

GetNext

Allows the manager to retrieve the next object variable from a table or list within an agent. In SNMPv1, when a manager wants to retrieve all elements of a table from an agent, it initiates a Get operation, followed by a series of GetNext operations.

Set

Allows the manager to set values for object variables within an agent.

Trap

Used by the agent to inform the manager of some events.

SNMP v3 a nd Se c urity
SNMP v3 enhances security for SNMP management. SNMP managers can be required to authenticate with agents before conducting SNMP management sessions. Security can be further enhanced by encrypting the SNMP messages sent from the managers.
XS3800-28 User's Guide
552

Chapter 59 Access Control

Encryption protects the contents of the SNMP messages. When the contents of the SNMP messages are encrypted, only the intended recipients can read them.

Suppo rte d MIBs
MIBs let administrators collect statistics and monitor status and performance.
The Switch supports the following MIBs:
· SNMP MIB II (RFC 1213) · RFC 1157 SNMP v1 · RFC 1493 Bridge MIBs · RFC 1643 Ethernet MIBs · RFC 1155 SMI · RFC 2674 SNMPv2, SNMPv2c · RFC 1757 RMON · SNMPv2, SNMPv2c or later version, compliant with RFC 2011 SNMPv2 MIB for IP, RFC 2012 SNMPv2 MIB
for TCP, RFC 2013 SNMPv2 MIB for UDP

SNMP Tra ps

The Switch sends traps to an SNMP manager when an event occurs. The following tables outline the SNMP traps by category.

An OID (Object ID) that begins with "1.3.6.1.4.1.890.1.15" is defined in private MIBs. Otherwise, it is a standard MIB OID.

Table 262 SNMP System Traps

O PTIO N coldstart

O BJEC TLABEL coldStart

O BJEC TID 1.3.6.1.6.3.1.1.5.1

warmstart fanspeed

warmStart

1.3.6.1.6.3.1.1.5.2

zyHwMonitorFanSpeedOutO 1.3.6.1.4.1.890.1.15.3.26.2.1 fRange

zyHwMonitorFANSpeedOut 1.3.6.1.4.1.890.1.15.3.26.2.6 OfRangeRecovered

temperature

zyHwMonitorTemperatureOu 1.3.6.1.4.1.890.1.15.3.26.2.2 tOfRange

zyHwMonitorTemperatureOu 1.3.6.1.4.1.890.1.15.3.26.2.7 tOfRangeRecovered

voltage

zyHwMonitorPowerSupplyVo 1.3.6.1.4.1.890.1.15.3.26.2.3 ltageOutOfRange

DESC RIPTIO N
This trap is sent when the Switch is turned on.
This trap is sent when the Switch restarts.
This trap is sent when the fan speed goes above or below the normal operating range.
This trap is sent when the fan speed is recovered from the out of range to normal operating range.
This trap is sent when the temperature goes above or below the normal operating range.
This trap is sent when the temperature is recovered from the out of range to normal operating range.
This trap is sent when the voltage goes above or below the normal operating range.

XS3800-28 User's Guide
553

Chapter 59 Access Control

Table 262 SNMP System Traps (continued)

O PTIO N reset

O BJEC TLABEL

O BJEC TID

zySysMgmtUncontrolledSyste 1.3.6.1.4.1.890.1.15.3.49.2.1 mReset

zySysMgmtControlledSystem 1.3.6.1.4.1.890.1.15.3.49.2.2 Reset

zySysMgmtBootImageIncons 1.3.6.1.4.1.890.1.15.3.49.2.3 istence

RebootEvent

1.3.6.1.4.1.890.1.5.1.1.2

timesync

zyDateTimeTrapTimeServerN 1.3.6.1.4.1.890.1.15.3.82.3.1 otReachable

intrusionlock

zyDateTimeTrapTimeServerN 1.3.6.1.4.1.890.1.15.3.82.3.2 otReachableRecovered

zyPortIntrusionLock

1.3.6.1.4.1.890.1.15.3.61.3.2

loopguard

zyLoopGuardLoopDetect 1.3.6.1.4.1.890.1.15.3.45.2.1

errdisable

zyErrdisableDetect

1.3.6.1.4.1.890.1.15.3.24.4.1

zyErrdisableRecovery

1.3.6.1.4.1.890.1.15.3.24.4.2

poe

zyPoePowerPortOverload 1.3.6.1.4.1.890.1.15.3.59.4.1

(For PoE models

only)

zyPoePowerPortShortCircuit 1.3.6.1.4.1.890.1.15.3.59.4.2

zyPoePowerPortOverSystem 1.3.6.1.4.1.890.1.15.3.59.4.3 Budget

loginrecord

zyPoePowerPortOverloadRe 1.3.6.1.4.1.890.1.15.3.59.4.5 covered
zyPoePowerPortShortCircuitR 1.3.6.1.4.1.890.1.15.3.59.4.6 ecovered
zyPoePowerPortOverSystem 1.3.6.1.4.1.890.1.15.3.59.4.7 BudgetRecovered
zyAccessControlLoginRecor 1.3.6.1.4.1.890.1.15.3.9.4.1 d
zyAccessControlLogoutRec 1.3.6.1.4.1.890.1.15.3.9.4.2 ord
zyAccessControlLoginFail 1.3.6.1.4.1.890.1.15.3.9.4.3

DESC RIPTIO N
This trap is sent when the Switch automatically resets.
This trap is sent when the Switch resets by an administrator through a management interface.
This trap is sent when the index number of image which is loaded when the Switch starts up is different from what is specified via the CLI.
This trap is sent when the Switch reboots by an administrator through a management interface.
This trap is sent when the Switch's date and time is not manually entered or the specified time server is not reachable.
This trap is sent when the Switch's real time clock is up to date.
This trap is sent when intrusion lock occurs on a port.
This trap is sent when loopguard shuts down a port.
This trap is sent when an error is detected on a port, such as a loop occurs or the rate limit for specific control packets is exceeded.
This trap is sent when the Switch ceases the action taken on a port, such as shutting down the port or discarding packets on the port, after the specified recovery interval.
This trap is sent when the port is turned off to supply power due to overloading.
This trap is sent when the port is turned off to supply power due to short circuit.
This trap is sent when the port is turned off to supply power because the requested power exceeds the total PoE power budget on the Switch.
This trap is sent when the port is turned on to recover from an overloaded state.
This trap is sent when the port is turned on to recover from a short circuit.
This trap is sent when the port is turned on to recover from an over system budget.
This trap is sent when users log in.
This trap is sent when users log out.
This trap is sent when users fail in login.

XS3800-28 User's Guide
554

Chapter 59 Access Control

Table 263 SNMP Stacking Traps

O PTIO N

OBJECT LABEL

OBJECT ID

DESCRIPTION

Channel

zyStackingChannelUp

1.3.6.1.4.1.890.1.15.3.97.4.1 Stacking channel up.

zyStackingChannelDown

1.3.6.1.4.1.890.1.15.3.97.4.2 Stacking channel down.

Slot

zyStackingSlotAttach

1.3.6.1.4.1.890.1.15.3.97.4.3 Stacking slot attached success.

zyStackingSlotDetach

1.3.6.1.4.1.890.1.15.3.97.4.4 Stacking slot detached.

Master

zyStackingNewMaster

1.3.6.1.4.1.890.1.15.3.97.4.5 Backup takeover as master.

Upgrade Firmware

zyStackingUpgradeFirmwareFail 1.3.6.1.4.1.890.1.15.3.97.4.6 Upgrade Firmware fail with correspond slot ID.

Backup

zyStackingNewBackup

1.3.6.1.4.1.890.1.15.3.97.4.7 New Backup with correspond slot ID.

zyStackingBackupTakeover

1.3.6.1.4.1.890.1.15.3.97.4.8 Replaced master with correspond slot ID.

Master

zyStackingNewMasterFromTakeo 1.3.6.1.4.1.890.1.15.3.97.4.9 New master from taking over with correspond slot

ver

ID.

Fail

zyStackingSyncConfFail

1.3.6.1.4.1.890.1.15.3.97.4.10 Sync. configuration fail with correspond slot ID.

zyStackingSysRestoreConfFail

1.3.6.1.4.1.890.1.15.3.97.4.11 Stacking backup takeover restore configuration fail.

zyStackingSlotInitFail

1.3.6.1.4.1.890.1.15.3.97.4.12 Stacking Slot init fail.

Change

zyStackingSlotChangeIndex

1.3.6.1.4.1.890.1.15.3.97.4.13 Stacking change slot index.

zyStackingPriorityChange

1.3.6.1.4.1.890.1.15.3.97.4.14 Staking priority change.

zyStackingTopologyChange

1.3.6.1.4.1.890.1.15.3.97.4.15 Staking topology change.

Table 264 SNMP Interface Traps

O PTIO N linkup

O BJEC TLABEL linkUp

linkdown

linkDown

autonegotiation zyPortAutonegotiationFailed

O BJEC TID 1.3.6.1.6.3.1.1.5.4 1.3.6.1.6.3.1.1.5.3 1.3.6.1.4.1.890.1.15.3.61.3.1

lldp

lldpRemTablesChange

1.0.8802.1.1.2.0.0.1

DESC RIPTIO N
This trap is sent when the Ethernet link is up.
This trap is sent when the Ethernet link is down.
This trap is sent when an Ethernet interface fails to auto-negotiate with the peer Ethernet interface.
The trap is sent when entries in the remote database have any updates.
Link Layer Discovery Protocol (LLDP), defined as IEEE 802.1ab, enables LAN devices that support LLDP to exchange their configured settings. This helps eliminate configuration mismatch issues.

XS3800-28 User's Guide
555

Chapter 59 Access Control

Table 264 SNMP Interface Traps (continued)

O PTIO N transceiver-ddm

O BJEC TLABEL
zyTransceiverDdmiTemperature OutOfRange

O BJEC TID 1.3.6.1.4.1.890.1.15.3.84.3.1

zyTransceiverDdmiTxPowerOutO 1.3.6.1.4.1.890.1.15.3.84.3.2 fRange

zyTransceiverDdmiRxPowerOutO 1.3.6.1.4.1.890.1.15.3.84.3.3 fRange

zyTransceiverDdmiVoltageOutO 1.3.6.1.4.1.890.1.15.3.84.3.4 fRange

zyTransceiverDdmiTxBiasOutOfR 1.3.6.1.4.1.890.1.15.3.84.3.5 ange

zyTransceiverDdmiTemperature 1.3.6.1.4.1.890.1.15.3.84.3.6 OutOfRangeRecovered

zyTransceiverDdmiTxPowerOutO 1.3.6.1.4.1.890.1.15.3.84.3.7 fRangeRecovered

zyTransceiverDdmiRxPowerOutO 1.3.6.1.4.1.890.1.15.3.84.3.8 fRangeRecovered

zyTransceiverDdmiVoltageOutO 1.3.6.1.4.1.890.1.15.3.84.3.9 fRangeRecovered

zyTransceiverDdmiTxBiasOutOfR 1.3.6.1.4.1.890.1.15.3.84.3.10 angeRecovered

Storm-control

zyPortStormControlTrap

1.3.6.1.4.1.890.1.15.3.78.2.1

zuld

zyZuldUnidirectionalDetected 1.3.6.1.4.1.890.1.15.3.110.3.1

zyZuldBidirectionalRecovered 1.3.6.1.4.1.890.1.15.3.110.3.2

DESC RIPTIO N
This trap is sent when the transceiver temperature is above or below the normal operating range.
This trap is sent when the transmitted optical power is above or below the normal operating range.
This trap is sent when the received optical power is above or below the normal operating range.
This trap is sent when the transceiver supply voltage is above or below the normal operating range.
This trap is sent when the transmitter laser bias current is above or below the normal operating range.
This trap is sent when the transceiver temperature is recovered from the out of normal operating range.
This trap is sent when the transmitted optical power is recovered from the out of normal operating range.
This trap is sent when the received optical power is recovered from the out of normal operating range.
This trap is sent when the transceiver supply voltage is recovered from the out of normal operating range.
This trap is sent when the transmitter laser bias current is recovered from the out of normal operating range.
This trap is sent when storm control is detected on a specific port. A packet filter action has been applied on the interface.
This trap is sent when a unidirectional link is detected.
This trap is sent when the port which is shut down by ZULD becomes active again.

XS3800-28 User's Guide
556

Chapter 59 Access Control

Table 265 SNMP AAA Traps

O PTIO N

O BJEC TLABEL

authentication authenticationFailure

O BJEC TID 1.3.6.1.6.3.1.1.5.5

zyAaaAuthenticationFailure

1.3.6.1.4.1.890.1.15.3.8.3.1

zyRadiusServerAuthenticationSer 1.3.6.1.4.1.890.1.15.3.71.2.1 verNotReachable
zyRadiusServerAuthenticationSer 1.3.6.1.4.1.890.1.15.3.71.2.3 verNotReachableRecovered

authorization zyAaaAuthorizationFailure

1.3.6.1.4.1.890.1.15.3.8.3.2

accounting

zyRadiusServerAccountingServer 1.3.6.1.4.1.890.1.15.3.71.2.2 NotReachable

zyRadiusServerAccountingServer 1.3.6.1.4.1.890.1.15.3.71.2.4 NotReachableRecovered

DESC RIPTIO N
This trap is sent when authentication fails due to incorrect user name and/or password.
This trap is sent when authentication fails due to incorrect user name and/or password.
This trap is sent when there is no response message from the RADIUS authentication server.
This trap is sent when there is a response message from the previously unreachable RADIUS authentication server.
This trap is sent when management connection authorization failed.
This trap is sent when there is no response message from the RADIUS accounting server.
This trap is sent when there is a response message from the previously unreachable RADIUS accounting server.

Table 266 SNMP IP Traps

O PTIO N ping

O BJEC TLABEL pingProbeFailed pingTestFailed

traceroute

pingTestCompleted traceRouteTestFailed traceRouteTestCompleted

O BJEC TID 1.3.6.1.2.1.80.0.1 1.3.6.1.2.1.80.0.2
1.3.6.1.2.1.80.0.3 1.3.6.1.2.1.81.0.2 1.3.6.1.2.1.81.0.3

DESC RIPTIO N This trap is sent when a single ping probe fails. This trap is sent when a ping test (consisting of a series of ping probes) fails. This trap is sent when a ping test is completed. This trap is sent when a traceroute test fails. This trap is sent when a traceroute test is completed.

XS3800-28 User's Guide
557

Table 267 SNMP Switch Traps

O PTIO N stp
mactable rmon classifier rip ospf

O BJEC TLABEL

O BJEC TID

DESC RIPTIO N

STPNewRoot

1.3.6.1.2.1.17.0.1

This trap is sent when the STP root switch changes.

zyMrstpNewRoot

1.3.6.1.4.1.890.1.15.3.5 This trap is sent when the MRSTP root switch changes. 2.3.1

zyMstpNewRoot

1.3.6.1.4.1.890.1.15.3.5 This trap is sent when the MSTP root switch changes. 3.3.1

STPTopologyChange

1.3.6.1.2.1.17.0.2

This trap is sent when the STP topology changes.

zyMrstpTopologyChange

1.3.6.1.4.1.890.1.15.3.5 This trap is sent when the MRSTP topology changes. 2.3.2

zyMstpTopologyChange

1.3.6.1.4.1.890.1.15.3.5 This trap is sent when the MSTP root switch changes. 3.3.2

zyMacForwardingTableFull

1.3.6.1.4.1.890.1.15.3.4 This trap is sent when more than 99% of the MAC table is

8.2.1

used.

zyMacForwardingTableFullReco 1.3.6.1.4.1.890.1.15.3.4 This trap is sent when the MAC address switching table

vered

8.2.2

has become normal from full.

RmonRisingAlarm

1.3.6.1.2.1.16.0.1

This trap is sent when a variable goes over the RMON "rising" threshold.

RmonFallingAlarm

1.3.6.1.2.1.16.0.2

This trap is sent when the variable falls below the RMON "falling" threshold.

zyAclV2ClassifierLogNotification 1.3.6.1.4.1.890.1.15.3.1 This trap is sent when the Switch detects classifier log

05.4.1

information.

zyRipExceedMaxDynamicRoute 1.3.6.1.4.1.890.1.15.3.7 This trap is sent when the maximum allowed number of

4.2.1

dynamic routes learned through RIP has been

exceeded.

zyOspfExceedMaxDynamicRout 1.3.6.1.4.1.890.1.15.3.5 This trap is sent when the maximum allowed number of

ePath

7.3.1

dynamic routes learned through OSPF has been

exceeded.

59.7.2 SSH O ve rvie w
Unlike Telnet or FTP, which transmit data in clear text, SSH (Secure Shell) is a secure communication protocol that combines authentication and data encryption to provide secure encrypted communication between two hosts over an unsecured network.
Fig ure 444 SSH Communication Example

59.7.2.1 Ho w SSH Wo rks
The following table summarizes how a secure connection is established between two remote hosts.

XS3800-28 User's Guide
558

Chapter 59 Access Control Fig ure 445 How SSH Works
1 Host Identification The SSH client sends a connection request to the SSH server. The server identifies itself with a host key. The client encrypts a randomly generated session key with the host key and server key and sends the result back to the server. The client automatically saves any new server public keys. In subsequent connections, the server public key is checked against the saved version on the client computer.
2 Encryption Method Once the identification is verified, both the client and server must agree on the type of encryption method to use.
3 Authentication and Data Transmission After the identification is verified and data encryption activated, a secure tunnel is established between the client and the server. The client then sends its authentication information (user name and password) to the server to log in to the server.
59.7.2.2 SSH Im ple m e nta tio n o n the Switc h
Your Switch supports SSH version 2 using RSA authentication and three encryption methods (DES, 3DES and Blowfish). The SSH server is implemented on the Switch for remote management and file transfer on port 22. Only one SSH connection is allowed at a time.
XS3800-28 User's Guide
559

Chapter 59 Access Control
59.7.2.3 Re q uire m e nts fo r Using SSH
You must install an SSH client program on a client computer (Windows or Linux operating system) that is used to connect to the Switch over SSH.
59.7.3 Intro duc tio n to HTTPS
HTTPS (HyperText Transfer Protocol over Secure Socket Layer, or HTTP over SSL) is a web protocol that encrypts and decrypts web pages. Secure Socket Layer (SSL) is an application-level protocol that enables secure transactions of data by ensuring confidentiality (an unauthorized party cannot read the transferred data), authentication (one party can identify the other party) and data integrity (you know if data has been changed). It relies upon certificates, public keys, and private keys. HTTPS on the Switch is used so that you may securely access the Switch using the Web Configurator. The SSL protocol specifies that the SSL server (the Switch) must always authenticate itself to the SSL client (the computer which requests the HTTPS connection with the Switch), whereas the SSL client only should authenticate itself when the SSL server requires it to do so. Authenticating client certificates is optional and if selected means the SSL-client must send the Switch a certificate. You must apply for a certificate for the browser from a Certificate Authority (CA) that is a trusted CA on the Switch. Please refer to the following figure.
1 HTTPS connection requests from an SSL-aware web browser go to port 443 (by default) on the Switch's WS (web server).
2 HTTP connection requests from a web browser go to port 80 (by default) on the Switch's WS (web server). Fig ure 446 HTTPS Implementation
Note: If you disable HTTP in the Service Access Control screen, then the Switch blocks all HTTP connection attempts.
59.7.3.1 HTTPS Exa m ple
If you have not changed the default HTTPS port on the Switch, then in your browser enter "https://Switch IP Address/" as the web site address where "Switch IP Address" is the IP address or domain name of the Switch you wish to access.
XS3800-28 User's Guide
560

Inte rne t Explo re r Wa rning Me ssa g e s
Inte rne t Explo re r 6
When you attempt to access the Switch HTTPS server, a Windows dialog box pops up asking if you trust the server certificate. You see the following Se c urity Ale rt screen in Internet Explorer. Select Ye s to proceed to the Web Configurator login screen; if you select No , then Web Configurator access is blocked. Fig ure 447 Security Alert Dialog Box (Internet Explorer 6)
Inte rne t Explo re r 7 la te r ve rsio n
When you attempt to access the Switch HTTPS server, a screen with the message "There is a problem with this website's security certificate." may display. If that is the case, click C o ntinue to this we b site (no t re c o m m e nde d) to proceed to the Web Configurator login screen. Fig ure 448 Security Certificate Warning (Internet Explorer 11)
After you log in, you will see the red address bar with the message C e rtific a te Erro r. Click on C e rtific a te Erro r next to the address bar and click Vie w c e rtific a te s.
XS3800-28 User's Guide
561

Chapter 59 Access Control Fig ure 449 Certificate Error (Internet Explorer 11)
EXAMPLE
Click Insta ll C e rtific a te ... and follow the on-screen instructions to install the certificate in your browser. Fig ure 450 Certificate (Internet Explorer 11)
EXAMPLE
Mo zilla Fire fo x Wa rning Me ssa g e s
When you attempt to access the Switch HTTPS server, a Yo ur c o nne c tio n is no t se c ure screen may display. If that is the case, click I Unde rsta nd the Risks and then the Add Exc e ptio n... button.
XS3800-28 User's Guide
562

Fig ure 451 Security Alert (Mozilla Firefox)
Confirm the HTTPS server URL matches. Click C o nfirm Se c urity Exc e ptio n to proceed to the Web Configurator login screen. Fig ure 452 Security Alert (Mozilla Firefox)
EXAMPLE
XS3800-28 User's Guide
563

Chapter 59 Access Control
59.7.4 G o o g le C hro m e Wa rning Me ssa g e s
When you attempt to access the Switch HTTPS server, a Yo ur c o nne c tio n is no t priva te screen may display. If that is the case, click Adva nc e d and then Pro c e e d to x.x.x.x (unsa fe ) to proceed to the Web Configurator login screen. Fig ure 453 Security Alert (Google Chrome 58.0.3029.110)
59.7.4.1 Ma in Se tting s
After you accept the certificate and enter the login username and password, the Switch main screen appears. The lock displayed in the bottom right of the browser status bar or next to the website address denotes a secure connection.
XS3800-28 User's Guide
564

Chapter 59 Access Control Fig ure 454 Example: Lock Denoting a Secure Connection
EXAMPLE
XS3800-28 User's Guide
565

C HA PTER 6 0 Dia g no stic
60.1 O ve rvie w
This chapter explains the Dia g no stic screen. You can use this screen to help you identify problems.
60.2 Dia g no stic
Click Ma na g e m e nt > Dia g no stic in the navigation panel to open this screen. Use this screen to ping IP addresses, run a traceroute, perform port tests or show the Switch's location between devices. Fig ure 455 Management > Diagnostic (Standalone Mode)
XS3800-28 User's Guide
566

Chapter 60 Diagnostic Fig ure 456 Management > Diagnostic (Stacking Mode)

The following table describes the labels in this screen.

Table 268 Management > Diagnostic

LA BEL

DESC RIPTIO N

Ping Test

IPv4

Select this option if you want to ping an IPv4 address, and select which traffic flow (in- b a nd

or o ut- o f- b a nd) the Switch is to send ping frames.

If you select in- b a nd, the Switch sends the frames to all ports except the management port (labeled MG MT).

If you select o ut- o f- b a nd, the Switch sends the frames to the management port (labeled MG MT).

IPv6 IP Address/Host Name

Otherwise, select to send ping requests to all VLANs on the Switch.
Select this option if you want to ping an IPv6 address. You can also select vla n and specify the ID number of the VLAN to which the Switch is to send ping requests. Otherwise, select to send ping requests to all VLANs on the Switch.
Type the IP address or host name of a device that you want to ping in order to test a connection.

Source IP Address Count

Click Ping to have the Switch ping the IP address. Type the source IP address that you want to ping in order to test a connection. Click Ping to have the Switch ping the IP address. Enter the number of ICMP Echo Request (ping) messages the Switch continuously sends.

XS3800-28 User's Guide
567

Chapter 60 Diagnostic

Table 268 Management > Diagnostic (continued)

LA BEL Trace Route Test
IPv4
IPv6 IP Address/Host Name
TTL
Wait Time Queries Ethernet Port Test
Port Cable Diagnostics

DESC RIPTIO N
Select this option if you want to trace the route packets take to a device with an IPv4 address, and select in- b a nd or o ut- o f- b a nd on which the Switch traces the path. Otherwise, select to trace the path on any VLAN.
Select this option if you want to trace the route packets take to a device with an IPv6 address.
Enter the IP address or host name of a device to which you want to perform a traceroute.
Click Tra c e Ro ute to have the Switch perform the traceroute function. This determines the path a packet takes to the specified device.
Enter the Time To Live (TTL) value for the ICMP Echo Request packets. This is to set the maximum number of the hops (routers) a packet can travel through. Each router along the path will decrement the TTL value by one and forward the packets. When the TTL value becomes zero and the destination is not found, the router drops the packets and informs the sender.
Specify how many seconds the Switch waits for a response to a probe before running another traceroute.
Specify how many times the Switch performs the traceroute function.
The slot field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack. Enter a port number and click Po rt Te st to perform an internal loopback test.
This is the number of the physical Ethernet port on the Switch.
The slot field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack. Enter an Ethernet port number and click Dia g no se to perform a physical wire-pair test of the Ethernet connections on the specified ports. The following fields display when you diagnose a port.

Port Channel

This field is available only on the Switch that has one or more copper Ethernet ports (except the MG MTport).
This is the number of the physical Ethernet port on the Switch.
An Ethernet cable usually has four pairs of wires. A 10BASE-T or 100BASE-TX port only use and test two pairs, while a 1000BASE-T port requires all four pairs.

Pair status

This displays the descriptive name of the wire-pair in the cable. O k: The physical connection between the wire-pair is okay.

O pe n: There is no physical connection (an open circuit detected) between the wire-pair.

Sho rt: There is an short circuit detected between the wire-pair.

Unkno wn: The Switch failed to run cable diagnostics on the cable connected this port.

Cable length

Unsuppo rte d: The port is a fiber port or it is not active.
This displays the total length of the Ethernet cable that is connected to the port when the Pa ir sta tus is O k and the Switch chipset supports this feature.

This shows N/ A if the Pa ir sta tus is O pe n or Sho rt. Check the Dista nc e to fa ult.

This shows Unsuppo rte d if the Switch chipset does not support to show the cable length.

XS3800-28 User's Guide
568

Chapter 60 Diagnostic

Table 268 Management > Diagnostic (continued)

LA BEL

DESC RIPTIO N

Distance to fault

This displays the distance between the port and the location where the cable is open or shorted.

This shows N/ A if the Pa ir sta tus is O k.

Locator LED

This shows Unsuppo rte d if the Switch chipset does not support to show the distance.
Enter a time interval (in minutes) and click Blink to show the actual location of the Switch between several devices in a rack.

The default time interval is 30 minutes.

Click Sto p to have the Switch terminate the blinking locater LED.

XS3800-28 User's Guide
569

Chapter 61 System Log
C HA PTER 6 1 Syste m Lo g
61.1 O ve rvie w
A log message stores the information for viewing.
61.2 Syste m Lo g
Click Ma na g e m e nt > Syste m Lo g in the navigation panel to open this screen. Use this screen to check current system logs. Note: When a log reaches the maximum number of log messages, new log messages
automatically overwrite existing log messages, starting with the oldest existing log message first. Fig ure 457 Management > System Log
The summary table shows the time the log message was recorded and the reason the log message was generated. Click Re fre sh to update this screen. Click C le a r to clear the whole log, regardless of what is currently displayed on the screen. Click Do wnlo a d to save the log to your computer.
XS3800-28 User's Guide
570

Chapter 62 Syslog Setup
C HA PTER 6 2 Syslo g Se tup

62.1 Syslo g O ve rvie w

This chapter explains the syslog screens.

The syslog protocol allows devices to send event notification messages across an IP network to syslog servers that collect the event messages. A syslog-enabled device can generate a syslog message and send it to a syslog server.

Syslog is defined in RFC 3164. The RFC defines the packet format, content and system log related information of syslog messages. Each syslog message has a facility and severity level. The syslog facility identifies a file in the syslog server. Refer to the documentation of your syslog program for details. The following table describes the syslog severity levels.

Table 269 Syslog Severity Levels

C O DE

SEVERITY

Emergency: The system is unusable.

Alert: Action must be taken immediately.

Critical: The system condition is critical.

Error: There is an error condition on the system.

Warning: There is a warning condition on the system.

Notice: There is a normal but significant condition on the system.

Informational: The syslog contains an informational message.

Debug: The message is intended for debug-level purposes.

62.1.1 Wha t Yo u C a n Do
Use the Syslo g Se tup screen (Section 62.2 on page 571) to configure the device's system logging settings and configure a list of external syslog servers.

62.2 Syslo g Se tup
The syslog feature sends logs to an external syslog server. Use this screen to configure the device's system logging settings and configure a list of external syslog servers.
Click Ma na g e m e nt > Syslo g Se tup in the navigation panel to display this screen.

XS3800-28 User's Guide
571

Fig ure 458 Management > Syslog Setup

The following table describes the labels in this screen.

Table 270 Management > Syslog Setup

LA BEL

DESC RIPTIO N

Syslog

Select Ac tive to turn on syslog (system logging) and then configure the syslog setting.

Logging Type

This column displays the names of the categories of logs that the device can generate.

Active

Select this option to set the device to generate logs for the corresponding category.

Facility

The log facility allows you to send logs to different files in the syslog server. Refer to the documentation of your syslog program for more details.

Apply

Cancel

Click C a nc e l to begin configuring this screen afresh.

Syslog Server Setup

Active

Select this check box to have the device send logs to this syslog server. Clear the check box if you want to create a syslog server entry but not have the device send logs to it (you can edit the entry later).

Server Address

Enter the IPv4 or IPv6 address of the syslog server.

UDP Port

The default syslog server port is 514. If your syslog server uses a different port, configure the one it uses here.

Log Level

Select the severity levels of the logs that you want the device to send to this syslog server. The lower the number, the more critical the logs are.

XS3800-28 User's Guide
572

Chapter 62 Syslog Setup

Table 270 Management > Syslog Setup (continued)

LA BEL

DESC RIPTIO N

Add

Cancel

Click C a nc e l to begin configuring this screen afresh.

Clear

Click C le a r to return the fields to the factory defaults.

Index

This is the index number of a syslog server entry. Click this number to edit the entry.

Active

This field displays Ye s if the device is to send logs to the syslog server. No displays if the device is not to send logs to the syslog server.

IP Address

This field displays the IP address of the syslog server.

UDP Port

This field displays the port of the syslog server.

Log Level

This field displays the severity level of the logs that the device is to send to this syslog server.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Delete

Click De le te to remove the selected entries.

Cancel

Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
573

Chapter 63 Cluster Management
C HA PTER 6 3 C luste r Ma na g e m e nt

63.1 C luste r Ma na g e m e nt O ve rvie w

This chapter introduces cluster management.

Cluster Management allows you to manage switches through one Switch, called the cluster manager. The switches must be directly connected and be in the same VLAN group so as to be able to communicate with one another.

Table 271 Zyxel Clustering Management Specifications
Maximum number of cluster members 24

Cluster Member Models

Must be compatible with Zyxel cluster management implementation.

Cluster Manager

The Switch through which you manage the cluster member switches.

Cluster Members

The switches being managed by the cluster manager Switch.

In the following example, switch A in the basement is the cluster manager and the other switches on the upper floors of the building are cluster members.
Fig ure 459 Clustering Application Example

XS3800-28 User's Guide
574

63.1.1 Wha t Yo u C a n Do
· Use the C luste r Ma na g e m e nt Sta tus screen (Section 63.2 on page 575) to view the role of the Switch within the cluster and to access a cluster member Switch's Web Configurator.
· Use the C luste ring Ma na g e m e nt C o nfig ura tio n screen (Section 63.3 on page 576) to configure clustering management.
63.2 C luste r Ma na g e m e nt Sta tus
Use this screen to view the role of the Switch within the cluster and to access a cluster member Switch's Web Configurator. Click Ma na g e m e nt > C luste r Ma na g e m e nt in the navigation panel to display the following screen. Note: A cluster can only have one manager. Fig ure 460 Management > Cluster Management Status

The following table describes the labels in this screen.

Table 272 Management > Cluster Management Status

LA BEL

DESC RIPTIO N

Status

This field displays the role of this Switch within the cluster.

Ma na g e r

Me m b e r (you see this if you access this screen in the cluster member Switch directly and not via the cluster manager)

Manager The Number of Member Index
MacAddr Name

No ne (neither a manager nor a member of a cluster)
This field displays the cluster manager Switch's hardware MAC address.
This field displays the number of switches that make up this cluster. The following fields describe the cluster member switches.
You can manage cluster member switches via the cluster manager Switch. Each number in the Inde x column is a hyperlink leading to the cluster member Switch's Web Configurator.
This is the cluster member Switch's hardware MAC address.
This is the cluster member Switch's Syste m Na m e .

XS3800-28 User's Guide
575

Chapter 63 Cluster Management

Table 272 Management > Cluster Management Status (continued)

LA BEL

DESC RIPTIO N

Model

This field displays the model name.

Status

This field displays:

O nline (the cluster member Switch is accessible)

Erro r (for example the cluster member Switch password was changed or the Switch was set as the manager and so left the member list, and so on)

O ffline (the Switch is disconnected O ffline shows approximately 1.5 minutes after the link between cluster member and manager goes down)

63.3 C luste ring Ma na g e m e nt C o nfig ura tio n
Use this screen to configure clustering management. Click Ma na g e m e nt > C luste r Ma na g e m e nt > C o nfig ura tio n to display the next screen.
Fig ure 461 Management > Cluster Management > Configuration

XS3800-28 User's Guide
576

The following table describes the labels in this screen.

Table 273 Management > Cluster Management > Configuration

LA BEL Clustering Manager
Active
Name VID
Apply
Cancel Clustering Candidate
List
Password

DESC RIPTIO N
The following fields relate to configuring the cluster manager.
Select Ac tive to have this Switch become the cluster manager switch. A cluster can only have one manager. Other (directly connected) switches that are set to be cluster managers will not be visible in the C luste ring C a ndida te s list. If a switch that was previously a cluster member is later set to become a cluster manager, then its Sta tus is displayed as Erro r in the C luste r Ma na g e m e nt Sta tus screen and a warning icon ( ) appears in the member summary list below.
Type a name to identify the C luste ring Ma na g e r. You may use up to 32 printable characters (spaces are allowed).
This is the VLAN ID and is only applicable if the Switch is set to 802.1Q VLAN. All switches must be directly connected and in the same VLAN group to belong to the same cluster. Switches that are not in the same VLAN group are not visible in the C luste ring C a ndida te s list. This field is ignored if the C luste ring Ma na g e r is using Po rt- b a se d VLAN.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.
The following fields relate to the switches that are potential cluster members.
A list of suitable candidates found by auto-discovery is shown here. The switches must be directly connected. Directly connected switches that are set to be cluster managers will not be visible in the C luste ring C a ndida te list. Switches that are not in the same management VLAN group will not be visible in the C luste ring C a ndida te list.
Each cluster member's password is its Web Configurator password. Select a member in the C luste ring C a ndida te list and then enter its Web Configurator password. If that switch administrator changes the Web Configurator password afterwards, then it cannot be managed from the C luste r Ma na g e r. Its Sta tus is displayed as Erro r in the C luste r Ma na g e m e nt Sta tus screen.

If multiple devices have the same password then hold [SHIFT] and click those switches to select them. Then enter their common Web Configurator password.

Add

Cancel

Click C a nc e l to begin configuring this screen afresh.

Refresh

Click Re fre sh to perform auto-discovery again to list potential cluster members.

The next summary table shows the information for the clustering members configured.

Index

This is the index number of a cluster member switch.

MacAddr

This is the cluster member switch's hardware MAC address.

Name

This is the cluster member switch's Syste m Na m e .

Model

This is the cluster member switch's model name.

Select an entry's check box to select a specific entry. Otherwise, select the check box in the table heading row to select all entries.

Remove

Click the Re m o ve button to remove the selected cluster member switches from the cluster.

Cancel

Click C a nc e l to begin configuring this screen afresh.

63.4 Te c hnic a l Re fe re nc e
This section provides technical background information on the topics discussed in this chapter. XS3800-28 User's Guide
577

63.4.1 C luste r Me m b e r Switc h Ma na g e m e nt
Go to the C luste ring Ma na g e m e nt Sta tus screen of the cluster manager switch and then select an Inde x hyperlink from the list of members to go to that cluster member switch's Web Configurator home page. This cluster member Web Configurator home page and the home page that you would see if you accessed it directly are different. Fig ure 462 Cluster Management: Cluster Member Web Configurator Screen
example
63.4.1.1 Uplo a ding Firm wa re to a C luste r Me m b e r Switc h
You can use FTP to upload firmware to a cluster member switch through the cluster manager switch as shown in the following example.
XS3800-28 User's Guide
578

Chapter 63 Cluster Management

Fig ure 463 Example: Uploading Firmware to a Cluster Member Switch

C:\>ftp 192.168.1.1

Connected to 192.168.1.1.

220 Switch FTP version 1.0 ready at Thu Jan 1 00:58:46 1970

User (192.168.0.1:(none)): admin

331 Enter PASS command

Password:

230 Logged in

ftp> ls

200 Port command okay

150 Opening data connection for LIST

--w--w--w- 1 owner group

3042210 Jul 01 12:00 ras

-rw-rw-rw- 1 owner group

393216 Jul 01 12:00 config

--w--w--w- 1 owner group

0 Jul 01 12:00 fw-00-a0-c5-01-23-46

-rw-rw-rw- 1 owner group

0 Jul 01 12:00 config-00-a0-c5-01-23-46

226 File sent OK

ftp: 297 bytes received in 0.00Seconds 297000.00Kbytes/sec.

ftp> bin

200 Type I OK

ftp> put 460ABPI0.bin fw-00-a0-c5-01-23-46

200 Port command okay

150 Opening data connection for STOR fw-00-a0-c5-01-23-46

226 File received OK

ftp: 262144 bytes sent in 0.63Seconds 415.44Kbytes/sec.

ftp>

The following table explains some of the FTP parameters.

Table 274 FTP Upload to Cluster Member Example

FTP PARAMETER

DESC RIPTIO N

User

Enter "admin".

Password

The Web Configurator password default is 1234.

Enter this command to list the name of cluster member switch's firmware and

configuration file.

460ABPI0.bin

This is the name of the firmware file you want to upload to the cluster member switch.

fw-00-a0-c5-01-23-46

This is the cluster member switch's firmware name as seen in the cluster manager switch.

config-00-a0-c5-01-23-46 This is the cluster member switch's configuration file name as seen in the cluster
manager switch.

XS3800-28 User's Guide
579

C HA PTER 6 4 MAC Ta b le
64.1 MAC Ta b le O ve rvie w
This chapter introduces the MAC Ta b le screen. The MAC Ta ble screen (a MAC table is also known as a filtering database) shows how frames are forwarded or filtered across the Switch's ports. When a device (which may belong to a VLAN group) sends a packet which is forwarded to a port on the Switch, the MAC address of the device is shown on the Switch's MAC Ta ble . It also shows whether the MAC address is dynamic (learned by the Switch) or static (manually entered in the Sta tic MAC Fo rwa rding screen).
64.1.1 Wha t Yo u C a n Do
Use the MAC Ta ble screen (Section 64.2 on page 581) to check whether the MAC address is dynamic or static.
64.1.2 Wha t Yo u Ne e d to Kno w
The Switch uses the MAC Ta ble to determine how to forward frames. See the following figure. 1 The Switch examines a received frame and learns the port on which this source MAC address came. 2 The Switch checks to see if the frame's destination MAC address matches a source MAC address
already learned in the MAC Ta b le . · If the Switch has already learned the port for this MAC address, then it forwards the frame to that port. · If the Switch has not already learned the port for this MAC address, then the frame is flooded to all
ports. Too much port flooding leads to network congestion, then the Switch sends an ARP to request the MAC address. The Switch then learns the port that replies with the MAC address. · If the Switch has already learned the port for this MAC address, but the destination port is the same as the port it came in on, then it filters the frame.
XS3800-28 User's Guide
580

Chapter 64 MAC Table Fig ure 464 MAC Table Flowchart
64.2 Vie wing the MAC Ta b le
Use this screen to search specific MAC addresses. You can also directly add dynamic MAC addresses into the static MAC forwarding table or MAC filtering table from the MAC table using this screen. Click Ma na g e m e nt > MAC Ta b le in the navigation panel to display the following screen. Fig ure 465 Management > MAC Table
XS3800-28 User's Guide
581

Chapter 64 MAC Table

The following table describes the labels in this screen.

Table 275 Management > MAC Table

LA BEL

DESC RIPTIO N

Condition

Select one of the buttons and click Se a rc h to only display the data which matches the criteria you specified.

Select All to display any entry in the MAC table of the Switch.

Select Sta tic to display the MAC entries manually configured on the Switch.

Select MAC and enter a MAC address in the field provided to display a specified MAC entry.

Select VID and enter a VLAN ID in the field provided to display the MAC entries belonging to the specified VLAN.

Select Po rt and enter a port number in the field provided to display the MAC addresses which are forwarded on the specified port.

Sort by

Select Trunk and type the ID of a trunk group to display all MAC addresses learned from the ports in the trunk group.
Define how the Switch displays and arranges the data in the summary table below.

Select MAC to display and arrange the data according to MAC address.

Select VID to display and arrange the data according to VLAN group.

Transfer Type

Select PO RTto display and arrange the data according to port number.
Select Dyna m ic to MAC fo rwa rding and click the Tra nsfe r button to change all dynamically learned MAC address entries in the summary table below into static entries. They also display in the Sta tic MAC Fo rwa rding screen.

Search Transfer Cancel Index MAC Address VID Port
Type

Select Dyna m ic to MAC filte ring and click the Tra nsfe r button to change all dynamically learned MAC address entries in the summary table below into MAC filtering entries. These entries will then display only in the Filte ring screen and the default filtering action is Disc a rd so urc e .
Click this to search data in the MAC table according to your input criteria.
Click this to perform the MAC address transferring you selected in the Tra nsfe r Type field.
Click C a nc e l to change the fields back to their last saved values.
This is the incoming frame index number.
This is the MAC address of the device from which this incoming frame came.
This is the VLAN group to which this frame belongs.
This is the port from which the above MAC address was learned. In stacking mode, the first number represents the slot and the second the port number.
This shows whether the MAC address is dyna m ic (learned by the Switch) or sta tic (manually entered in the Sta tic MAC Fo rwa rding screen).

XS3800-28 User's Guide
582

Chapter 65 IP Table
C HA PTER 6 5 IP Ta b le
This chapter introduces the IP table.
65.1 IP Ta b le O ve rvie w
The IP Ta ble screen shows how packets are forwarded or filtered across the Switch's ports. When a device (which may belong to a VLAN group) sends a packet which is forwarded to a port on the Switch, the IP address of the device is shown on the Switch's IP Ta b le . The IP Ta b le also shows whether the IP address is dynamic (learned by the Switch) or static (belonging to the Switch). The Switch uses the IP Ta ble to determine how to forward packets. See the following figure. 1 The Switch examines a received packet and learns the port from which this source IP address came. 2 The Switch checks to see if the packet's destination IP address matches a source IP address already learned in the IP Ta b le .
· If the Switch has already learned the port for this IP address, then it forwards the packet to that port.
· If the Switch has not already learned the port for this IP address, then the packet is flooded to all ports. Too much port flooding leads to network congestion then the Switch sends an ARP to request the MAC address. The Switch then learns the port that replies with the MAC address.
· If the Switch has already learned the port for this IP address, but the destination port is the same as the port it came in on, then it filters the packet.
Fig ure 466 IP Table Flowchart
XS3800-28 User's Guide
583

Chapter 65 IP Table
65.2 Vie wing the IP Ta b le
Click Ma na g e m e nt > IP Ta ble in the navigation panel to display the following screen. Fig ure 467 Management > IP Table

The following table describes the labels in this screen.

Table 276 Management > IP Table

LA BEL

DESC RIPTIO N

Sort by

Click one of the following buttons to display and arrange the data according to that button type. The information is then displayed in the summary table below.

Click this button to display and arrange the data according to IP address.

VID

Click this button to display and arrange the data according to VLAN group.

Port

Click this button to display and arrange the data according to port number.

Index

This field displays the index number.

IP Address

This is the IP address of the device from which the incoming packets came.

VID

This is the VLAN group to which the packet belongs.

Port

This is the port from which the above IP address was learned. This field displays C PU to indicate the

IP address belongs to the Switch. In stacking mode, the first number represents the slot and the

second the port number.

Type

This shows whether the IP address is dyna m ic (learned by the Switch) or sta tic (belonging to the Switch).

XS3800-28 User's Guide
584

Chapter 66 ARP Table
C HA PTER 6 6 ARP Ta b le
66.1 O ve rvie w
This chapter introduces ARP Table. Address Resolution Protocol (ARP) is a protocol for mapping an Internet Protocol address (IP address) to a physical machine address, also known as a Media Access Control or MAC address, on the local area network. An IP (version 4) address is 32 bits long. In an Ethernet LAN, MAC addresses are 48 bits long. The ARP Table maintains an association between each MAC address and its corresponding IP address.
66.1.1 Wha t Yo u C a n Do
Use the ARP Ta ble screen (Section 66.2 on page 585) to view IP-to-MAC address mappings.
66.1.2 Wha t Yo u Ne e d to Kno w
When an incoming packet destined for a host device on a local area network arrives at the Switch, the Switch's ARP program looks in the ARP Table and if it finds the address, it sends it to the device. If no entry is found for the IP address, ARP broadcasts the request to all the devices on the LAN. The Switch fills in its own MAC and IP address in the sender address fields, and puts the known IP address of the target in the target IP address field. In addition, the Switch puts all ones in the target MAC field (FF.FF.FF.FF.FF.FF is the Ethernet broadcast address). The replying device (which is either the IP address of the device being sought or the router that knows the way) replaces the broadcast address with the target's MAC address, swaps the sender and target pairs, and unicasts the answer directly back to the requesting machine. ARP updates the ARP Table for future reference and then sends the packet to the MAC address that replied.
66.2 Vie wing the ARP Ta b le
Use the ARP table to view IP-to-MAC address mappings and remove specific dynamic ARP entries. Click Ma na g e m e nt > ARP Ta b le in the navigation panel to open the following screen.
XS3800-28 User's Guide
585

Chapter 66 ARP Table Fig ure 468 Management > ARP Table

The following table describes the labels in this screen.

Table 277 Management > ARP Table

LA BEL

DESC RIPTIO N

Condition

Specify how you want the Switch to remove ARP entries when you click Flush.

Select All to remove all of the dynamic entries from the ARP table.

Select IP Addre ss and enter an IP address to remove the dynamic entries learned with the specified IP address.

Flush Cancel Index IP Address
MAC Address VID Port
Age(s)
Type

Select Po rt and enter a port number to remove the dynamic entries learned on the specified port.
Click Flush to remove the ARP entries according to the condition you specified.
Click C a nc e l to return the fields to the factory defaults.
This is the ARP table entry number.
This is the IP address of a device connected to a Switch port with the corresponding MAC address below.
This is the MAC address of the device with the corresponding IP address above.
This field displays the VLAN to which the device belongs.
This field displays the port to which the device connects. C PU means this IP address is the Switch's management IP address. In stacking mode, the first number represents the slot and the second the port number.
This field displays how long (in seconds) an entry can still remain in the ARP table before it ages out and needs to be relearned. This shows 0 for a static entry.
This shows the IP address is dynamic (learned by the Switch).

XS3800-28 User's Guide
586

Chapter 67 Routing Table
C HA PTER 6 7 Ro uting Ta b le
This chapter introduces the routing table.
67.1 Ro uting Ta b le O ve rvie w
The routing table contains the route information to the networks that the Switch can reach.
67.2 The Ro uting Ta b le Ma in Sc re e n
Click Ma na g e m e nt > Ro uting Ta ble in the navigation panel to display the main screen as shown. Click the link next to IPv4 Ro uting Ta b le to open a screen where you can view the IPv4 routing table information. Click the link next to IPv6 Ro uting Ta ble to open a screen where you can view the IPv6 routing table information. Fig ure 469 Management > Routing Table
67.3 IPv4 Ro uting Ta b le
Use this screen to view IPv4 routing table information. Click Ma na g e m e nt > Ro uting Ta b le > IPv4 Ro uting Ta ble in the navigation panel to display the screen as shown. Fig ure 470 Management > Routing Table > IPv4 Routing Table
XS3800-28 User's Guide
587

Chapter 67 Routing Table

The following table describes the labels in this screen.

Table 278 Management > Routing Table > IPv4 Routing Table

LA BEL Index Destination Gateway Interface Metric Type

DESC RIPTIO N This field displays the index number. This field displays the destination IP routing domain. This field displays the IP address of the gateway device. This field displays the IP address of the IPv4 Interface. This field displays the cost of the route. This field displays the method used to learn the route.

STATIC added as a static entry.

Uptime

LO C AL added as a local interface entry.
This field displays how long the route has been running since the Switch learned the route and added an entry in the routing table.

67.4 IPv6 Ro uting Ta b le
Use this screen to view IPv6 routing table information. Click Ma na g e m e nt > Ro uting Ta b le > IPv6 Ro uting Ta ble in the navigation panel to display the screen as shown.
Fig ure 471 Management > Routing Table > IPv6 Routing Table

The following table describes the labels in this screen.

Table 279 Management > Routing Table > IPv6 Routing Table

LA BEL

DESC RIPTIO N

Index Route Destination/ Prefix Length Next Hop
Interface
Metric Type

This field displays the index number. This field displays the IPv6 subnet prefix and prefix length of the final destination.
This field displays the IPv6 address of the gateway that helps forward the packet to the destination. This field displays the descriptive name of the IPv6 interface that is used to forward the packets to the destination. This field displays the cost of the route. This field displays the method used to learn the route.

STATIC added as a static entry.

C o nne c t added as a local interface entry.

XS3800-28 User's Guide
588

Chapter 68 Path MTU Table
C HA PTER 6 8 Pa th MTU Ta b le
68.1 Pa th MTU O ve rvie w
This chapter introduces the IPv6 Path MTU table. The largest size (in bytes) of a packet that can be transferred over a data link is called the maximum transmission unit (MTU). The Switch uses Path MTU Discovery to discover Path MTU (PMTU), that is, the minimum link MTU of all the links in a path to the destination. If the Switch receives an ICMPv6 Packet Too Big error message after sending a packet, it fragments the next packet according to the suggested MTU in the error message.
68.2 Vie wing the Pa th MTU Ta b le
Use this screen to view IPv6 path MTU information on the Switch. Click Ma na g e m e nt > Pa th MTU Ta b le in the navigation panel to display the screen as shown. Fig ure 472 Management > Path MTU Table

The following table describes the labels in this screen.

Table 280 Management > Path MTU Table

LA BEL

DESC RIPTIO N

Path MTU aging time

This field displays how long an entry remains in the Path MTU table before it ages out and needs to be relearned.

Index

This field displays the index number of each entry in the table.

Destination Address

This field displays the destination IPv6 address of each path or entry.

MTU

This field displays the maximum transmission unit of the links in the path.

Expire

This field displays how long (in minutes) an entry can still remain in the Path MTU table before it ages out and needs to be relearned.

XS3800-28 User's Guide
589

Chapter 69 Configure Clone
C HA PTER 6 9 C o nfig ure C lo ne
69.1 O ve rvie w
This chapter shows you how you can copy the settings of one port onto other ports.
69.2 C o nfig ure C lo ne
Cloning allows you to copy the basic and advanced settings from a source port to a destination port or ports. Click Ma na g e m e nt > C o nfig ure C lo ne to open the following screen.
XS3800-28 User's Guide
590

Chapter 69 Configure Clone Fig ure 473 Management > Configure Clone (Standalone Mode)
XS3800-28 User's Guide
591

Chapter 69 Configure Clone Fig ure 474 Management > Configure Clone (Stacking Mode)
XS3800-28 User's Guide
592

Chapter 69 Configure Clone

The following table describes the labels in this screen.

Table 281 Management > Configure Clone

LA BEL
Source/ Destination

DESC RIPTIO N
In stacking mode, a port is defined by a slot ID representing the Switch in the stack and a port number.

Select the source port and slot (in stacking mode) under the So urc e label. This port's attributes are copied.

Enter the destination port or ports under the De stina tio n label. These are the ports which are going to have the same attributes as the source port. You can enter individual ports separated by a comma or a range of ports by using a hyphen. For example, 2, 4, 6 indicates that ports 2, 4 and 6 are the destination ports. 26 indicates that ports 2 through 6 are the destination ports.

Basic Setting

In stacking mode, you can select multiple destination slots.
Select * to apply all settings to the port. Use this first to select the common settings and then remove the settings you do not want copied.

Advanced Application Apply
Cancel

Select which port settings (you configured in the Ba sic Se tting menus) should be copied to the destination ports.
Select which port settings (you configured in the Adva nc e d Applic a tio n menus) should be copied to the destination ports.
Click Apply to save your changes to the Switch's run-time memory. The Switch loses these changes if it is turned off or loses power, so use the Sa ve link on the top navigation panel to save your changes to the non-volatile memory when you are done configuring.
Click C a nc e l to begin configuring this screen afresh.

XS3800-28 User's Guide
593

Chapter 70 IPv6 Neighbor Table
C HA PTER 7 0 IPv6 Ne ig hb o r Ta b le
70.1 IPv6 Ne ig hb o r Ta b le O ve rvie w
This chapter introduces the IPv6 neighbor table. An IPv6 host is required to have a neighbor table. If there is an address to be resolved or verified, the Switch sends out a neighbor solicitation message. When the Switch receives a neighbor advertisement in response, it stores the neighbor's link-layer address in the neighbor table. You can also manually create a static IPv6 neighbor entry using the Ba sic Se tting > IPv6 > IPv6 C o nfig ura tio n > IPv6 Ne ig hb o r Se tup screen. When the Switch needs to send a packet, it first consults other table to determine the next hop. Once the next hop IPv6 address is known, the Switch looks into the neighbor table to get the link-layer address and sends the packet when the neighbor is reachable. If the Switch cannot find an entry in the neighbor table or the state for the neighbor is not reachable, it starts the address resolution process. This helps reduce the number of IPv6 solicitation and advertisement messages.
70.2 Vie wing the IPv6 Ne ig hb o r Ta b le
Use this screen to view IPv6 neighbor information on the Switch. Click Ma na g e m e nt > IPv6 Ne ig hb o r Ta ble in the navigation panel to display the screen as shown. Fig ure 475 Management > IPv6 Neighbor Table

The following table describes the labels in this screen.

Table 282 Management > IPv6 Neighbor Table

LA BEL

DESC RIPTIO N

Sort by

Select this to display and arrange the data according to IPv6 address (Addre ss), MAC address (MAC ) or IPv6 interface (Inte rfa c e ). The information is then displayed in the summary table below.

Index

This field displays the index number of each entry in the table.

Address

This field displays the IPv6 address of the Switch or a neighboring device.

MAC

This field displays the MAC address of the IPv6 interface on which the IPv6 address is configured or the MAC address of the neighboring device.

XS3800-28 User's Guide
594

Chapter 70 IPv6 Neighbor Table

Table 282 Management > IPv6 Neighbor Table (continued)

LA BEL Status

DESC RIPTIO N
This field displays whether the neighbor IPv6 interface is reachable. In IPv6, "reachable" means an IPv6 packet can be correctly forwarded to a neighbor node (host or router) and the neighbor can successfully receive and handle the packet. The available options in this field are:

Type

· reachable (R): The interface of the neighboring device is reachable. (The Switch has received a response to the initial request.)
· stale (S): The last reachable time has expired and the Switch is waiting for a response to another initial request. The field displays this also when the Switch receives an unrequested response from the neighbor's interface.
· delay (D): The neighboring interface is no longer known to be reachable, and traffic has been sent to the neighbor recently. The Switch delays sending request packets for a short to give upper-layer protocols a chance to determine reachability.
· probe (P): The Switch is sending request packets and waiting for the neighbor's response. · invalid (IV): The neighbor address is with an invalid IPv6 address. · unknown (?): The status of the neighboring interface cannot be determined for some reason. · incomplete (I): Address resolution is in progress and the link-layer address of the neighbor has
not yet been determined. The interface of the neighboring device did not give a complete response.
This field displays the type of an address mapping to a neighbor interface. The available options in this field are:

Interface

· other (O): none of the following type. · local (L): A Switch interface is using the address. · dynamic (D): The IP address to MAC address can be successfully resolved using IPv6 Neighbor
Discovery protocol. Is it similar as IPv4 ARP (Address Resolution protocol). · static (S): The interface address is statically configured.
This field displays the ID number of the IPv6 interface on which the IPv6 address is created or through which the neighboring device can be reached.

XS3800-28 User's Guide
595

C HA PTER 7 1 Po rt Sta tus
71.1 O ve rvie w
This chapter introduces the port status screens.
71.2 Sta tus
This screen displays only when the Switch is in stacking mode and you click the Po rt Sta tus quick link from the Sta tus screen. Use this screen to view system status and click a number in the Slo t column to display each port statistical summary on the stacked Switch. Fig ure 476 Status > Port Status: Status (Stacking Mode)

The following table describes the labels in this screen.

Table 283 Status > Port Status: Status (Stacking Mode)

LA BEL

DESC RIPTIO N

System Up Time This field displays how long the stacked Switch has been running since it last restarted or was turned on.

Slot

This field displays the slot ID of the stacked Switch. You can click the ID number to go to the Po rt

Sta tus screen.

Name

This field displays the model name of the stacked Switch.

Status

This field displays whether the stacked Switch is active or inactive in a stack system.

Up Time

This field displays the time that the active Switch in a stack has been running.

71.3 Po rt Sta tus
This screen displays a port statistical summary with links to each port showing statistical details. To view the port statistics, click Sta tus in all Web Configurator screens and then the Po rt Sta tus link in the Q uic k Links section of the Sta tus screen to display the Po rt Sta tus screen as shown next. You can also click Ma na g e m e nt > Po rt Sta tus to see the following screen.
XS3800-28 User's Guide
596

Chapter 71 Port Status Fig ure 477 Management > Management > Port Status (Standalone Mode)
Fig ure 478 Management > Port Status (Stacking Mode)
XS3800-28 User's Guide
597

Chapter 71 Port Status

The following table describes the labels in this screen.

Table 284 Management > Port Status

LA BEL SLOT
Port

DESC RIPTIO N
This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.
This identifies the Ethernet port. In stacking mode, the first number represents the slot ID and the second is the port number. Please note that the default stacking ports (the last four ports of your Switch) cannot be configured. They are reserved for stacking only.

Name Link
State

Click a port number to display the Po rt De ta ils screen.
This is the name you assigned to this port in the Ba sic Se tting > Po rt Se tup screen.
This field displays the speed (either 100M for 100Mbps, 1G for 1 Gbps, 2.5G for 2.5 Gbps, 5G for 5 Gbps, or 10G for 10 Gbps) and the duplex (F for full duplex or H for half). It also shows the cable type (C o ppe r or Fib e r) for the combo ports. This field displays Do wn if the port is not connected to any device.
If STP (Spanning Tree Protocol) is enabled, this field displays the STP state of the port.

If STP is disabled, this field displays FO RWARDING if the link is up, otherwise, it displays STO P.

TxPkts RxPkts Errors Tx KB/s Rx KB/s Up Time Clear Counter

When LACP (Link Aggregation Control Protocol) and STP are in blocking state, it displays Blo c king . This field shows the number of transmitted frames on this port. This field shows the number of received frames on this port. This field shows the number of received errors on this port. This field shows the number of kilobytes per second transmitted on this port. This field shows the number of kilobytes per second received on this port. This field shows the total amount of time in hours, minutes and seconds the port has been up. Select Po rt, enter a port number and then click C le a r C o unte r to erase the recorded statistical information for that port, or select Any to clear statistics for all ports.

71.3.1 Po rt De ta ils
Click a number in the Po rt column in the Po rt Sta tus screen to display individual port statistics. Use this screen to check status and detailed performance data about an individual port on the Switch.

XS3800-28 User's Guide
598

Chapter 71 Port Status Fig ure 479 Management > Port Status > Port Details

The following table describes the labels in this screen.

Table 285 Management > Port Status > Port Details

LA BEL

DESC RIPTIO N

Port Info

Port NO.

This field displays the port number you are viewing. In stacking mode, the first number represents the slot and the second the port number.

Name

This field displays the name of the port.

Link

This field displays the speed (either 100M for 100Mbps, 1G for 1 Gbps, 2.5G for 2.5 Gbps, 5G for 5

Gbps, or 10G for 10 Gbps) and the duplex (F for full duplex or H for half). It also shows the cable

type (C o ppe r or Fib e r) for the combo ports. This field displays Do wn if the port is not connected to

any device.

State

If STP (Spanning Tree Protocol) is enabled, this field displays the STP state of the port.

If STP is disabled, this field displays FO RWARDING if the link is up, otherwise, it displays STO P.

LACP

When LACP (Link Aggregation Control Protocol), STP, and dot1x are in blocking state, it displays Blo c king .
This field shows if LACP is enabled on this port or not.

XS3800-28 User's Guide
599

Chapter 71 Port Status

Table 285 Management > Port Status > Port Details (continued)

LA BEL

DESC RIPTIO N

TxPkts

This field shows the number of transmitted frames on this port.

RxPkts

This field shows the number of received frames on this port.

Errors

This field shows the number of received errors on this port.

Tx kB/s

This field shows the number of kilobytes per second transmitted on this port.

This field shows the percentage of actual transmitted frames on this port as a percentage of the

Utilization% Link speed.

Rx kB/s

This field shows the number of kilobytes per second received on this port.

This field shows the percentage of actual received frames on this port as a percentage of the Link

Utilization% speed.

Up Time This field shows the total amount of time the connection has been up.

Tx Packet

The following fields display detailed information about packets transmitted.

Unicast

This field shows the number of good unicast packets transmitted.

Multicast This field shows the number of good multicast packets transmitted.

Broadcast This field shows the number of good broadcast packets transmitted.

Pause

This field shows the number of 802.3x pause packets transmitted.

Tagged

This field shows the number of packets with VLAN tags transmitted.

Rx Packet

The following fields display detailed information about packets received.

Unicast

This field shows the number of good unicast packets received.

Multicast This field shows the number of good multicast packets received.

Broadcast This field shows the number of good broadcast packets received.

Pause

This field shows the number of 802.3x pause packets received.

Control

This field shows the number of control packets received (including those with CRC error) but it does not include the 802.3x Pause packets.

TX Collision

The following fields display information on collisions while transmitting.

Single

This is a count of successfully transmitted packets for which transmission is inhibited by exactly one collision.

Multiple

This is a count of successfully transmitted packets for which transmission was inhibited by more than one collision.

Excessive This is a count of packets for which transmission failed due to excessive collisions. Excessive collision is defined as the number of maximum collisions before the retransmission count is reset.

Late

This is the number of times a late collision is detected, that is, after 512 bits of the packets have already been transmitted.

Error Packet The following fields display detailed information about packets received that were in error.

RX CRC

This field shows the number of packets received with CRC (Cyclic Redundant Check) errors.

Length

This field shows the number of packets received with a length that was out of range.

Runt

This field shows the number of packets received that were too short (shorter than 64 octets), including the ones with CRC errors.

Distribution

This field shows the number of packets (including bad packets) received that were 64 octets in

length.

XS3800-28 User's Guide
600

Chapter 71 Port Status

Table 285 Management > Port Status > Port Details (continued)

LA BEL 65 to 127
128 to 255
256 to 511
512 to 1023 1024 to 1518 Giant

DESC RIPTIO N
This field shows the number of packets (including bad packets) received that were between 65 and 127 octets in length.
This field shows the number of packets (including bad packets) received that were between 128 and 255 octets in length.
This field shows the number of packets (including bad packets) received that were between 256 and 511 octets in length.
This field shows the number of packets (including bad packets) received that were between 512 and 1023 octets in length.
This field shows the number of packets (including bad packets) received that were between 1024 and 1518 octets in length.
This field shows the number of packets (including bad packets) received that were between 1519 octets and the maximum frame size.

The maximum frame size varies depending on your switch model.

71.3.2 DDMI
The optical SFP transceiver's support for the Digital Diagnostics Monitoring Interface (DDMI) function lets you monitor the transceiver's parameters to perform component monitoring, fault isolation and failure prediction tasks. This allows proactive, preventative network maintenance to help ensure service continuity.
Use this screen to view the DDMI status of the Switch's SFP transceivers. Click Ma na g e m e nt > Po rt Sta tus > DDMI to see the following screen. Alternatively, click Sta tus from any Web Configurator screen and then the Po rt Sta tus link in the Q uic k Links section of the Sta tus screen to display the Po rt Sta tus screen and then click the DDMI link tab.
Fig ure 480 Management > Port Status > DDMI (Standalone Mode)

XS3800-28 User's Guide
601

Chapter 71 Port Status Fig ure 481 Management > Port Status > DDMI (Stacking Mode)

The following table describes the labels in this screen.

Table 286 Management > Port Status > DDMI

LA BEL

DESC RIPTIO N

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This identifies the SFP port. In stacking mode, the first number represents the slot ID and the

second is the port number. Please note that the default stacking ports (the last four ports of your

Switch) cannot be configured. They are reserved for stacking only.

Vendor

This displays the vendor name of the optical transceiver.

Part Number

This displays the part number of the optical transceiver.

Serial Number This displays the serial number of the optical transceiver.

Revision

This displays the revision number of the optical transceiver.

Date Code

This displays the date when the optical transceiver was manufactured.

Transceiver

This displays whether the connection to the optical network is up or down.

71.3.3 DDMI De ta ils
Use this screen to view the real-time SFP (Small Form Factor Pluggable) transceiver information and operating parameters on the SFP port. The parameters include, for example, transmitting and receiving power, and module temperature.
Click a number in the Po rt column in the DDMI screen to view current transceivers' status.

XS3800-28 User's Guide
602

Chapter 71 Port Status Fig ure 482 Management > Port Status > DDMI > DDMI Details

The following table describes the labels in this screen.

Table 287 Management > Port Status > DDMI > DDMI Details

LA BEL

DESC RIPTIO N

Transceiver Information

Port No

This identifies the SFP port. In stacking mode, the first number represents the slot and the second the port number.

Connector Type This displays the connector type of the optical transceiver.

Vendor

This displays the vendor name of the optical transceiver.

Part Number

This displays the part number of the optical transceiver.

Serial Number

This displays the serial number of the optical transceiver.

Revision

This displays the revision number of the optical transceiver.

Date Code

This displays the date when the optical transceiver was manufactured.

Transceiver

This displays details about the type of transceiver installed in the SFP slot.

Calibration

This field is available only when an SFP transceiver is inserted into the SFP slot.

DDMI Information Type
Temperature (C/F) Voltage (V) TX Bias (mA) TX Power (dbm) RX Power (dbm) Current

Inte rna l displays if the measurement values are calibrated by the transceiver. Exte rna l displays if the measurement values are raw data which the Switch calibrates.
This displays the DDMI parameter. This displays the temperature inside the SFP transceiver in degrees Celsius or Fahrenheit.
This displays the level of voltage being supplied to the SFP transceiver. This displays the milliamps (mA) being supplied to the SFP transceiver's Laser Diode Transmitter. This displays the amount of power the SFP transceiver is transmitting.
This displays the amount of power the SFP transceiver is receiving from the fiber cable.
This displays the current status for each monitored DDMI parameter.

XS3800-28 User's Guide
603

Chapter 71 Port Status

Table 287 Management > Port Status > DDMI > DDMI Details (continued)

LA BEL

DESC RIPTIO N

High Alarm Threshold

This displays the high value alarm threshold for each monitored DDMI parameter. An alarm signal is reported to the Switch if the monitored DDMI parameter reaches this value.

High Warn Threshold

This displays the high value warning threshold for each monitored DDMI parameter. A warning signal is reported to the Switch if the monitored DDMI parameter reaches this value.

Low Warn Threshold

This displays the low value warning threshold for each monitored DDMI parameter. A warning signal is reported to the Switch if the monitored DDMI parameter reaches this value.

Low Alarm Threshold

This displays the low value alarm threshold for each monitored DDMI parameter. An alarm signal is reported to the Switch if the monitored DDMI parameter reaches this value.

71.3.4 Po rt Utiliza tio n
This screen displays the percentage of actual transmitted or received frames on a port as a percentage of the Link speed. To view port utilization, click Ma na g e m e nt > Po rt Sta tus > Po rt Utiliza tio n to see the following screen. Alternatively, click Sta tus from any Web Configurator screen and then the Po rt Sta tus link in the Q uic k Links section of the Sta tus screen to display the Po rt Sta tus screen and then click the Utiliza tio n link tab.
Fig ure 483 Management > Port Status > Utilization (Standalone Mode)

XS3800-28 User's Guide
604

Chapter 71 Port Status Fig ure 484 Management > Port Status > Utilization (Stacking Mode)

The following table describes the labels in this screen.

Table 288 Management > Port Status > Utilization

LA BEL

DESC RIPTIO N

SLOT

This field appears only in stacking mode. Click the drop-down list to choose the slot number of the Switch in a stack.

Port

This identifies the Ethernet port. In stacking mode, the first number represents the slot ID and the

second is the port number. Please note that the default stacking ports (the last four ports of your

Switch) cannot be configured. They are reserved for stacking only.

Link

This field displays the speed (either 100M for 100Mbps, 1G for 1 Gbps, 2.5G for 2.5 Gbps, 5G for 5

Gbps, or 10G for 10 Gbps) and the duplex (F for full duplex or H for half). It also shows the cable

type (C o ppe r or Fib e r) for the combo ports. This field displays Do wn if the port is not connected to

any device.

Tx kB/s

This field shows the transmission speed of data sent on this port in kilobytes per second.

Tx Utilization% This field shows the percentage of actual transmitted frames on this port as a percentage of the Link speed.

Rx KB/s

This field shows the transmission speed of data received on this port in kilobytes per second.

Rx Utilization% This field shows the percentage of actual received frames on this port as a percentage of the Link speed.

XS3800-28 User's Guide
605

Chapter 72 Service Register
C HA PTER 7 2 Se rvic e Re g iste r
72.1 Se rvic e Re g iste r O ve rvie w
myZyxel is Zyxel's online services center where you can register your Switch and manage subscription services available for your Switch. At the time of writing, you can enable the Basic Routing service license for the Switch, which allows you to use basic L3 routing features, such as RIP, OSPF, DVMRP, IGMP and loopback interface. Without the service license, you can still configure the L3 routing features, but they will not work.
72.2 Se rvic e Re g iste r Sc re e n
Click Ma na g e m e nt > Se rvic e Re g iste r to display the screen as shown. Use this screen to display the status of your service registration. Go to myZyxel to activate or extend the subscription. Fig ure 485 Management > Service Register

The following table describes the labels in this screen.

Table 289 Management > Service Register

LA BEL

DESC RIPTIO N

Service

This lists the name of the service that is available on the Switch.

Status

This field displays whether the service license is enabled at myZyxel (Lic e nse d) or not (No t Lic e nse d).

Type

This field displays whether you applied for a trial application (Tria l) or registered a service (Sta nda rd) at myZyxel. It displays N/ A if the service license is not enabled.

XS3800-28 User's Guide
606

Chapter 72 Service Register

Table 289 Management > Service Register (continued)

LA BEL

DESC RIPTIO N

Expiration

This field displays the amount of time remaining before your trial license expires.

Update

Note: You can enable a standard license at myZyxel if the trial license expires.
Click this button to renew service license information (such as the registration status and expiration day).

Note: It is recommended you use this button after you register for a new service.

XS3800-28 User's Guide
607

PA RT III
Tro ub le sho o ting a nd Appe ndic e s
608

C HA PTER 7 3 Tro ub le sho o ting
This chapter offers some suggestions to solve problems you might encounter. The potential problems are divided into the following categories. · Power, Hardware Connections, and LEDs · Switch Access and Login · Switch Configuration
73.1 Po we r, Ha rdwa re C o nne c tio ns, a nd LEDs
The Switch does not turn on. None of the LEDs turn on.
1 Make sure the Switch is turned on. 2 Make sure you are using the power adapter or cord included with the Switch. 3 Make sure the power adapter or cord is connected to the Switch and plugged in to an appropriate
power source. Make sure the power source is turned on. 4 Turn the Switch off and on. 5 Disconnect and re-connect the power adapter or cord to the Switch. 6 If the problem continues, contact the vendor.
One of the LEDs does not behave as expected.
1 Make sure you understand the normal behavior of the LED. See Section 3.3 on page 45. 2 Check the hardware connections. See Section 3.1 on page 38. 3 Inspect your cables for damage. Contact the vendor to replace any damaged cables. 4 Turn the Switch off and on. 5 Disconnect and re-connect the power adapter or cord to the Switch. 6 If the problem continues, contact the vendor.
XS3800-28 User's Guide
609

Chapter 73 Troubleshooting
73.2 Switc h Ac c e ss a nd Lo g in
I forgot the IP address for the Switch.
1 The default in-band IP address in standalone mode is http:/ / DHC P- a ssig ne d IP (when connecting to a DHCP server) or 192.168.1.1.
2 Use the NCC (Nebula Control Center) or the ZON utility to find the IP address. 3 Use the console port to log in to the Switch. 4 Use the MG MTport to log in to the Switch, the default IP address of the MG MTport is 192.168.0.1. 5 If this does not work, you have to reset the device to its factory defaults. See Section 4.7 on page 62.
I forgot the user name and/or password.
1 The default user name is a dm in and the default password is 1234. 2 If this does not work, you have to reset the device to its factory defaults. See Section 4.7 on page 62.
I cannot see or access the Lo g in screen in the Web Configurator.
1 Make sure you are using the correct IP address. · The default in-band IP address in standalone mode is http://DHCP-assigned IP (when connecting to a DHCP server) or 192.168.1.1. The default in-band IP address in stacking mode is 192.168.1.1. · If you changed the IP address, use the new IP address. · If you changed the IP address and have forgotten it, see the troubleshooting suggestions for I forgot the IP address for the Switch.
2 Check the hardware connections, and make sure the LEDs are behaving as expected. See Section 3.3 on page 45.
3 Make sure your Internet browser does not block pop-up windows and has JavaScripts and Java enabled.
4 Make sure your computer is in the same subnet as the Switch. (If you know that there are routers between your computer and the Switch, skip this step.)
5 Reset the device to its factory defaults, and try to access the Switch with the default IP address. See Section 4.7 on page 62.
XS3800-28 User's Guide
610

Chapter 73 Troubleshooting
6 If the problem continues, contact the vendor, or try the advanced suggestion.
Adva nc e d Sug g e stio n
· Try to access the Switch using another service, such as Telnet. If you can access the Switch, check the remote management settings to find out why the Switch does not respond to HTTP.
I can see the Lo g in screen, but I cannot log in to the Switch.
1 Make sure you have entered the user name and password correctly. The default user name is a dm in, and the default password is 1234. These fields are case-sensitive, so make sure [Caps Lock] is not on.
2 You may have exceeded the maximum number of concurrent Telnet sessions. Close other Telnet sessions or try connecting again later. Check that you have enabled logins for HTTP or Telnet. If you have configured a secured client IP address, your computer's IP address must match it. Refer to the chapter on access control for details.
3 Disconnect and re-connect the cord to the Switch. 4 If this does not work, you have to reset the device to its factory defaults. See Section 4.7 on page 62.
Pop-up Windows, JavaScripts and Java Permissions
In order to use the Web Configurator you need to allow: · Web browser pop-up windows from your device. · JavaScripts (enabled by default). · Java permissions (enabled by default).
There is unauthorized access to my Switch via telnet, HTTP and SSH.
Click the Displa y button in the Syste m Lo g field in the Ma na g e m e nt > Dia g no stic screen to check for unauthorized access to your Switch. To avoid unauthorized access, configure the secured client setting in the Ma na g e m e nt > Ac c e ss C o ntro l > Re m o te Ma na g e m e nt screen for telnet, HTTP and SSH (see Section 59.6 on page 550). Computers not belonging to the secured client set cannot get permission to access the Switch.
XS3800-28 User's Guide
611

Chapter 73 Troubleshooting
73.3 Switc h C o nfig ura tio n
I lost my configuration settings after I restart the Switch. Make sure you save your configuration into the Switch's nonvolatile memory each time you make changes. Click Sa ve at the top right corner of the Web Configurator to save the configuration permanently. See also Section 58.2.2 on page 526 for more information about how to save your configuration.
I accidentally unplugged the Switch. I am not sure which configuration file will be loaded. If you plug the power cable back to the Switch, it will reboot and load the configuration file that was used the last time. For example, if C o nfig 1 was used on the Switch before you accidentally unplugged the Switch, C o nfig 1 will be loaded when rebooting.
XS3800-28 User's Guide
612

A PPEN DIX A
C usto m e r Suppo rt

In the event of problems that cannot be solved by using this manual, you should contact your vendor. If you cannot contact your vendor, then contact a Zyxel office for the region in which you bought the device.
See http s://www.zyxe l.c o m/ho me p a g e .shtml and also http s://www.zyxe l.c o m/a b o ut_zyxe l/zyxe l_wo rldwide .shtml for the latest information.
Please have the following information ready when you contact an office.
Re q uire d Info rm a tio n
· Product model and serial number. · Warranty Information. · Date that you received your device. · Brief description of the problem and the steps you took to solve it.

C o rpo ra te He a dq ua rte rs (Wo rldwide )
Ta iwa n
· Zyxel Communications Corporation · http://www.zyxel.com

A sia

C hina
· Zyxel Communications (Shanghai) Corp. Zyxel Communications (Beijing) Corp. Zyxel Communications (Tianjin) Corp.
· https://www.zyxel.com/cn/zh/
Ind ia
· Zyxel Technology India Pvt Ltd. · https://www.zyxel.com/in/en/
Ka za khsta n
· Zyxel Kazakhstan · https://www.zyxel.kz

XS3800-28 User's Guide
613

Appendix A Customer Support
Ko re a
· Zyxel Korea Corp. · http://www.zyxel.kr
Ma la ysia
· Zyxel Malaysia Sdn Bhd. · http://www.zyxel.com.my
Pa kista n
· Zyxel Pakistan (Pvt.) Ltd. · http://www.zyxel.com.pk
Philippine s
· Zyxel Philippines · http://www.zyxel.com.ph
Sing a po re
· Zyxel Singapore Pte Ltd. · http://www.zyxel.com.sg
Ta iwa n
· Zyxel Communications Corporation · https://www.zyxel.com/tw/zh/
Tha ila nd
· Zyxel Thailand Co., Ltd. · https://www.zyxel.com/th/th/
Vie tna m
· Zyxel Communications Corporation-Vietnam Office · https://www.zyxel.com/vn/vi
Euro pe
Be la rus
· Zyxel BY · https://www.zyxel.by
Be lg ium
· Zyxel Communications B.V. · https://www.zyxel.com/be/nl/
XS3800-28 User's Guide
614

Appendix A Customer Support
· https://www.zyxel.com/be/fr/
Bulg a ria
· Zyxel · https://www.zyxel.com/bg/bg/
C ze c h Re pub lic
· Zyxel Communications Czech s.r.o · https://www.zyxel.com/cz/cs/
De nm a rk
· Zyxel Communications A/S · https://www.zyxel.com/dk/da/
Esto nia
· Zyxel Estonia · https://www.zyxel.com/ee/et/
Finla nd
· Zyxel Communications · https://www.zyxel.com/fi/fi/
Fra nc e
· Zyxel France · https://www.zyxel.fr
G e rm a ny
· Zyxel Deutschland GmbH · https://www.zyxel.com/de/de/
Hung a ry
· Zyxel Hungary & SEE · https://www.zyxel.com/hu/hu/
Ita ly
· Zyxel Communications Italy · https://www.zyxel.com/it/it/
La tvia
· Zyxel Latvia · https://www.zyxel.com/lv/lv/
XS3800-28 User's Guide
615

Appendix A Customer Support
Lithua nia
· Zyxel Lithuania · https://www.zyxel.com/lt/lt/
Ne the rla nds
· Zyxel Benelux · https://www.zyxel.com/nl/nl/
No rwa y
· Zyxel Communications · https://www.zyxel.com/no/no/
Po la nd
· Zyxel Communications Poland · https://www.zyxel.com/pl/pl/
Ro m a nia
· Zyxel Romania · https://www.zyxel.com/ro/ro
Russia
· Zyxel Russia · https://www.zyxel.com/ru/ru/
Slo va kia
· Zyxel Communications Czech s.r.o. organizacna zlozka · https://www.zyxel.com/sk/sk/
Spa in
· Zyxel Communications ES Ltd. · https://www.zyxel.com/es/es/
Swe de n
· Zyxel Communications · https://www.zyxel.com/se/sv/
Switze rla nd
· Studerus AG · https://www.zyxel.ch/de · https://www.zyxel.ch/fr
XS3800-28 User's Guide
616

Appendix A Customer Support
Turke y
· Zyxel Turkey A.S. · https://www.zyxel.com/tr/tr/
UK
· Zyxel Communications UK Ltd. · https://www.zyxel.com/uk/en/
Ukra ine
· Zyxel Ukraine · http://www.ua.zyxel.com
So uth Am e ric a
Arg e ntina
· Zyxel Communications Corporation · https://www.zyxel.com/co/es/
Bra zil
· Zyxel Communications Brasil Ltda. · https://www.zyxel.com/br/pt/
C o lo m b ia
· Zyxel Communications Corporation · https://www.zyxel.com/co/es/
Ec ua do r
· Zyxel Communications Corporation · https://www.zyxel.com/co/es/
So uth Am e ric a
· Zyxel Communications Corporation · https://www.zyxel.com/co/es/
Middle Ea st
Isra e l
· Zyxel Communications Corporation · http://il.zyxel.com/
XS3800-28 User's Guide
617

Appendix A Customer Support
Middle Ea st
· Zyxel Communications Corporation · https://www.zyxel.com/me/en/
No rth Am e ric a USA
· Zyxel Communications, Inc. North America Headquarters · https://www.zyxel.com/us/en/
O c e a nia Austra lia
· Zyxel Communications Corporation · https://www.zyxel.com/au/en/
Afric a So uth Afric a
· Nology (Pty) Ltd. · https://www.zyxel.com/za/en/
XS3800-28 User's Guide
618

A PPEN DIX B
C o m m o n Se rvic e s

The following table lists some commonly-used services and their associated protocols and port numbers. For a comprehensive list of port numbers, ICMP type or code numbers and services, visit the IANA (Internet Assigned Number Authority) web site.

· Na me : This is a short, descriptive name for the service. You can use this one or create a different one, if you like.
· Pro to c o l: This is the type of IP protocol used by the service. If this is TC P/ UDP, then the service uses the same port number with TCP and UDP. If this is Use r- De fine d, the Po rt(s) is the IP protocol number, not the port number.
· Po rt(s): This value depends on the Pro to c o l. Please refer to RFC 1700 for further information about port numbers.
· If the Pro to c o l is TC P, UDP, or TC P/ UDP, this is the IP port number.
· If the Pro to c o l is USER, this is the IP protocol number.
· De sc riptio n: This is a brief explanation of the applications that use this service or the situations in which this service is used.

Table 290 Commonly Used Services

NA ME AH (IPSEC_TUNNEL)
AIM/New-ICQ
AUTH BGP BOOTP_CLIENT BOOTP_SERVER CU-SEEME
DNS

PRO TO C O L User-Defined
TCP
TCP TCP UDP UDP TCP UDP TCP/UDP

ESP (IPSEC_TUNNEL) FINGER

User-Defined TCP

FTP

TCP

H.323

TCP

HTTP

TCP

PO RT(S) 51
5190
113 179 68 67 7648 24032 53
50
79
20 21 1720 80

DESC RIPTIO N
The IPSEC AH (Authentication Header) tunneling protocol uses this service.
AOL's Internet Messenger service. It is also used as a listening port by ICQ.
Authentication protocol used by some servers.
Border Gateway Protocol.
DHCP Client.
DHCP Server.
A popular videoconferencing solution from White Pines Software.
Domain Name Server, a service that matches web names (for example www.zyxel.com) to IP numbers.
The IPSEC ESP (Encapsulation Security Protocol) tunneling protocol uses this service.
Finger is a UNIX or Internet related command that can be used to find out if a user is logged on.
File Transfer Program, a program to enable fast transfer of files, including large files that may not be possible by email.
NetMeeting uses this protocol.
Hyper Text Transfer Protocol a client or server protocol for the world wide web.

XS3800-28 User's Guide
619

Appendix B Common Services

Table 290 Commonly Used Services (continued)

NA ME HTTPS

PRO TO C O L TCP

PO RT(S) 443

ICMP

User-Defined

ICQ IGMP (MULTICAST)

UDP User-Defined

4000 2

IKE

UDP

500

IRC MSN Messenger

TCP/UDP TCP

6667 1863

NEW-ICQ NEWS NFS

TCP TCP UDP

5190 144 2049

NNTP PING

TCP

119

User-Defined

POP3

TCP

110

PPTP

TCP

1723

PPTP_TUNNEL (GRE)

User-Defined

RCMD REAL_AUDIO
REXEC RLOGIN RTELNET RTSP

TCP TCP
TCP TCP TCP TCP/UDP

512 7070
514 513 107 554

SFTP

TCP

115

SMTP

TCP

SNMP

TCP/UDP

161

SNMP-TRAPS

TCP/UDP

162

DESC RIPTIO N
HTTPS is a secured http session often used in ecommerce.
Internet Control Message Protocol is often used for diagnostic or routing purposes.
This is a popular Internet chat program.
Internet Group Multicast Protocol is used when sending packets to a specific group of hosts.
The Internet Key Exchange algorithm is used for key distribution and management.
This is another popular Internet chat program.
Microsoft Networks' messenger service uses this protocol.
An Internet chat program.
A protocol for news groups.
Network File System NFS is a client or server distributed file service that provides transparent file sharing for network environments.
Network News Transport Protocol is the delivery mechanism for the USENET newsgroup service.
Packet INternet Groper is a protocol that sends out ICMP echo requests to test whether or not a remote host is reachable.
Post Office Protocol version 3 lets a client computer get e-mail from a POP3 server through a temporary connection (TCP/IP or other).
Point-to-Point Tunneling Protocol enables secure transfer of data over public networks. This is the control channel.
PPTP (Point-to-Point Tunneling Protocol) enables secure transfer of data over public networks. This is the data channel.
Remote Command Service.
A streaming audio service that enables real time sound over the web.
Remote Execution Daemon.
Remote Login.
Remote Telnet.
The Real Time Streaming (media control) Protocol (RTSP) is a remote control for multimedia on the Internet.
Simple File Transfer Protocol.
Simple Mail Transfer Protocol is the messageexchange standard for the Internet. SMTP enables you to move messages from one email server to another.
Simple Network Management Program.
Traps for use with the SNMP (RFC:1215).

XS3800-28 User's Guide
620

Appendix B Common Services

Table 290 Commonly Used Services (continued)

NA ME SQL-NET

PRO TO C O L TCP

PO RT(S) 1521

SSH STRM WORKS SYSLOG
TACACS
TELNET

TCP/UDP UDP UDP
UDP
TCP

22 1558 514
49
23

TFTP VDOLIVE

UDP TCP

69 7000

DESC RIPTIO N
Structured Query Language is an interface to access data on many different types of database systems, including mainframes, midrange systems, UNIX systems and network servers.
Secure Shell Remote Login Program.
Stream Works Protocol.
Syslog allows you to send system logs to a UNIX server.
Login Host Protocol used for (Terminal Access Controller Access Control System).
Telnet is the login and terminal emulation protocol common on the Internet and in UNIX environments. It operates over TCP/IP networks. Its primary function is to allow users to log into remote host systems.
Trivial File Transfer Protocol is an Internet file transfer protocol similar to FTP, but uses the UDP (User Datagram Protocol) rather than TCP (Transmission Control Protocol).
Another videoconferencing solution.

XS3800-28 User's Guide
621

A PPEN DIX C
IPv6

O ve rvie w
IPv6 (Internet Protocol version 6), is designed to enhance IP address size and features. The increase in IPv6 address size to 128 bits (from the 32-bit IPv4 address) allows up to 3.4 x 1038 IP addresses.

IPv6 Addre ssing
The 128-bit IPv6 address is written as eight 16-bit hexadecimal blocks separated by colons (:). This is an example IPv6 address 2001:0db8:1a2b:0015:0000:0000:1a2f:0000.
IPv6 addresses can be abbreviated in two ways:
· Leading zeros in a block can be omitted. So 2001:0db8:1a2b:0015:0000:0000:1a2f:0000 can be written as 2001:db8:1a2b:15:0:0:1a2f:0.
· Any number of consecutive blocks of zeros can be replaced by a double colon. A double colon can only appear once in an IPv6 address. So 2001:0db8:0000:0000:1a2f:0000:0000:0015 can be written as 2001:0db8::1a2f:0000:0000:0015, 2001:0db8:0000:0000:1a2f::0015, 2001:db8::1a2f:0:0:15 or 2001:db8:0:0:1a2f::15.
Pre fix a nd Pre fix Le ng th
Similar to an IPv4 subnet mask, IPv6 uses an address prefix to represent the network address. An IPv6 prefix length specifies how many most significant bits (start from the left) in the address compose the network address. The prefix length is written as "/x" where x is a number. For example,
2001:db8:1a2b:15::1a2f:0/32
means that the first 32 bits (2001:db8) is the subnet prefix.
Link- lo c a l Addre ss
A link-local address uniquely identifies a device on the local network (the LAN). It is similar to a "private IP address" in IPv4. You can have the same link-local address on multiple interfaces on a device. A linklocal unicast address has a predefined prefix of fe80::/10. The link-local unicast address format is as follows.
Table 291 Link-local Unicast Address Format

1111 1110 10 10 bits

0 54 bits

Interface ID 64 bits

G lo b a l Addre ss
A global address uniquely identifies a device on the Internet. It is similar to a "public IP address" in IPv4. A global unicast address starts with a 2 or 3.
XS3800-28 User's Guide
622

Appendix C IPv6

Unspe c ifie d Addre ss
An unspecified address (0:0:0:0:0:0:0:0 or ::) is used as the source address when a device does not have its own address. It is similar to "0.0.0.0" in IPv4.

Lo o pb a c k Addre ss
A loopback address (0:0:0:0:0:0:0:1 or ::1) allows a host to send packets to itself. It is similar to "127.0.0.1" in IPv4.

Multic a st Addre ss

In IPv6, multicast addresses provide the same functionality as IPv4 broadcast addresses. Broadcasting is not supported in IPv6. A multicast address allows a host to send packets to all hosts in a multicast group.

Multicast scope allows you to determine the size of the multicast group. A multicast address has a predefined prefix of ff00::/8. The following table describes some of the predefined multicast addresses.

Table 292 Predefined Multicast Address

MULTIC ASTADDRESS

DESC RIPTIO N

FF01:0:0:0:0:0:0:1

All hosts on a local node.

FF01:0:0:0:0:0:0:2

All routers on a local node.

FF02:0:0:0:0:0:0:1

All hosts on a local connected link.

FF02:0:0:0:0:0:0:2

All routers on a local connected link.

FF05:0:0:0:0:0:0:2

All routers on a local site.

FF05:0:0:0:0:0:1:3

All DHCP severs on a local site.

The following table describes the multicast addresses which are reserved and cannot be assigned to a multicast group.
Table 293 Reserved Multicast Address
MULTIC ASTADDRESS FF00:0:0:0:0:0:0:0 FF01:0:0:0:0:0:0:0 FF02:0:0:0:0:0:0:0 FF03:0:0:0:0:0:0:0 FF04:0:0:0:0:0:0:0 FF05:0:0:0:0:0:0:0 FF06:0:0:0:0:0:0:0 FF07:0:0:0:0:0:0:0 FF08:0:0:0:0:0:0:0 FF09:0:0:0:0:0:0:0 FF0A:0:0:0:0:0:0:0 FF0B:0:0:0:0:0:0:0 FF0C:0:0:0:0:0:0:0 FF0D:0:0:0:0:0:0:0 FF0E:0:0:0:0:0:0:0 FF0F:0:0:0:0:0:0:0
XS3800-28 User's Guide
623

Appendix C IPv6

Sub ne t Ma sking
Both an IPv6 address and IPv6 subnet mask compose of 128-bit binary digits, which are divided into eight 16-bit blocks and written in hexadecimal notation. Hexadecimal uses 4 bits for each character (1 10, A F). Each block's 16 bits are then represented by 4 hexadecimal characters. For example, FFFF:FFFF:FFFF:FFFF:FC00:0000:0000:0000.

Inte rfa c e ID
In IPv6, an interface ID is a 64-bit identifier. It identifies a physical interface (for example, an Ethernet port) or a virtual interface (for example, the management IP address for a VLAN). One interface should have a unique interface ID.

EUI- 64

The EUI-64 (Extended Unique Identifier) defined by the IEEE (Institute of Electrical and Electronics Engineers) is an interface ID format designed to adapt with IPv6. It is derived from the 48-bit (6-byte) Ethernet MAC address as shown next. EUI-64 inserts the hex digits fffe between the third and fourth bytes of the MAC address and complements the seventh bit of the first byte of the MAC address. See the following example.

Table 294
MAC

00 : 13 : 49 : 12 : 34 : 56

Table 295
EUI- 64

02 : 13 : 49 : FF : FE : 12 : 34 : 56

DHC Pv6
The Dynamic Host Configuration Protocol for IPv6 (DHCPv6, RFC 3315) is a server-client protocol that allows a DHCP server to assign and pass IPv6 network addresses, prefixes and other configuration information to DHCP clients. DHCPv6 servers and clients exchange DHCP messages using UDP.
Each DHCP client and server has a unique DHCP Unique IDentifier (DUID), which is used for identification when they are exchanging DHCPv6 messages. The DUID is generated from the MAC address, time, vendor assigned ID and/or the vendor's private enterprise number registered with the IANA. It should not change over time even after you reboot the device.
Ide ntity Asso c ia tio n
An Identity Association (IA) is a collection of addresses assigned to a DHCP client, through which the server and client can manage a set of related IP addresses. Each IA must be associated with exactly one interface. The DHCP client uses the IA assigned to an interface to obtain configuration from a DHCP server for that interface. Each IA consists of a unique IAID and associated IP information. The IA type is the type of address in the IA. Each IA holds one type of address. IA_NA means an identity association for non-temporary addresses and IA_TA is an identity association for temporary addresses. An IA_NA option contains the T1 and T2 fields, but an IA_TA option does not. The DHCPv6 server uses T1 and T2 to control the time at which the client contacts with the server to extend the lifetimes on any addresses in the IA_NA before the lifetimes expire. After T1, the client sends the server (S1) (from which the addresses in the IA_NA were obtained) a Renew message. If the time T2 is reached and the server does not respond, the client sends a Rebind message to any available server (S2). For an IA_TA, the

XS3800-28 User's Guide
624

Appendix C IPv6

client may send a Renew or Rebind message at the client's discretion.
T2 T1

Renew to S1
Renew to S1

Rebind to S2
Rebind to S2

DHC P Re la y Ag e nt
A DHCP relay agent is on the same network as the DHCP clients and helps forward messages between the DHCP server and clients. When a client cannot use its link-local address and a well-known multicast address to locate a DHCP server on its network, it then needs a DHCP relay agent to send a message to a DHCP server that is not attached to the same network.
The DHCP relay agent can add the remote identification (remote-ID) option and the interface-ID option to the Relay-Forward DHCPv6 messages. The remote-ID option carries a user-defined string, such as the system name. The interface-ID option provides slot number, port information and the VLAN ID to the DHCPv6 server. The remote-ID option (if any) is stripped from the Relay-Reply messages before the relay agent sends the packets to the clients. The DHCP server copies the interface-ID option from the RelayForward message into the Relay-Reply message and sends it to the relay agent. The interface-ID should not change even after the relay agent restarts.
Pre fix De le g a tio n
Prefix delegation enables an IPv6 router to use the IPv6 prefix (network address) received from the ISP (or a connected uplink router) for its LAN. The Switch uses the received IPv6 prefix (for example, 2001:db2::/ 48) to generate its LAN IP address. Through sending Router Advertisements (RAs) regularly by multicast, the Switch passes the IPv6 prefix information to its LAN hosts. The hosts then can use the prefix to generate their IPv6 addresses.

IC MPv6
Internet Control Message Protocol for IPv6 (ICMPv6 or ICMP for IPv6) is defined in RFC 4443. ICMPv6 has a preceding Next Header value of 58, which is different from the value used to identify ICMP for IPv4. ICMPv6 is an integral part of IPv6. IPv6 nodes use ICMPv6 to report errors encountered in packet processing and perform other diagnostic functions, such as "ping".

Ne ig hb o r Disc o ve ry Pro to c o l (NDP)
The Neighbor Discovery Protocol (NDP) is a protocol used to discover other IPv6 devices and track neighbor's reachability in a network. An IPv6 device uses the following ICMPv6 messages types:
· Neighbor solicitation: A request from a host to determine a neighbor's link-layer address (MAC address) and detect if the neighbor is still reachable. A neighbor being "reachable" means it responds to a neighbor solicitation message (from the host) with a neighbor advertisement message.
· Neighbor advertisement: A response from a node to announce its link-layer address. · Router solicitation: A request from a host to locate a router that can act as the default router and
XS3800-28 User's Guide
625

Appendix C IPv6
forward packets. · Router advertisement: A response to a router solicitation or a periodical multicast advertisement from
a router to advertise its presence and other parameters.
IPv6 C a c he
An IPv6 host is required to have a neighbor cache, destination cache, prefix list and default router list. The Switch maintains and updates its IPv6 caches constantly using the information from response messages. In IPv6, the Switch configures a link-local address automatically, and then sends a neighbor solicitation message to check if the address is unique. If there is an address to be resolved or verified, the Switch also sends out a neighbor solicitation message. When the Switch receives a neighbor advertisement in response, it stores the neighbor's link-layer address in the neighbor cache. When the Switch uses a router solicitation message to query for a router and receives a router advertisement message, it adds the router's information to the neighbor cache, prefix list and destination cache. The Switch creates an entry in the default router list cache if the router can be used as a default router.
When the Switch needs to send a packet, it first consults the destination cache to determine the next hop. If there is no matching entry in the destination cache, the Switch uses the prefix list to determine whether the destination address is on-link and can be reached directly without passing through a router. If the address is onlink, the address is considered as the next hop. Otherwise, the Switch determines the next-hop from the default router list or routing table. Once the next hop IP address is known, the Switch looks into the neighbor cache to get the link-layer address and sends the packet when the neighbor is reachable. If the Switch cannot find an entry in the neighbor cache or the state for the neighbor is not reachable, it starts the address resolution process. This helps reduce the number of IPv6 solicitation and advertisement messages.
Multic a st Liste ne r Disc o ve ry
The Multicast Listener Discovery (MLD) protocol (defined in RFC 2710) is derived from IPv4's Internet Group Management Protocol version 2 (IGMPv2). MLD uses ICMPv6 message types, rather than IGMP message types. MLDv1 is equivalent to IGMPv2 and MLDv2 is equivalent to IGMPv3.
MLD allows an IPv6 switch or router to discover the presence of MLD listeners who wish to receive multicast packets and the IP addresses of multicast groups the hosts want to join on its network.
MLD snooping and MLD proxy are analogous to IGMP snooping and IGMP proxy in IPv4.
MLD filtering controls which multicast groups a port can join.
MLD Me ssa g e s
A multicast router or switch periodically sends general queries to MLD hosts to update the multicast forwarding table. When an MLD host wants to join a multicast group, it sends an MLD Report message for that address.
An MLD Done message is equivalent to an IGMP Leave message. When an MLD host wants to leave a multicast group, it can send a Done message to the router or switch. The router or switch then sends a group-specific query to the port on which the Done message is received to determine if other devices connected to this port should remain in the group.
XS3800-28 User's Guide
626

Appendix C IPv6
Exa m ple Ena b ling IPv6 o n Windo ws XP/ 2003/ Vista
By default, Windows XP and Windows 2003 support IPv6. This example shows you how to use the ipv6 install command on Windows XP or 2003 to enable IPv6. This also displays how to use the ipconfig command to see auto-generated IP addresses. C:\>ipv6 install Installing... Succeeded. C:\>ipconfig Windows IP Configuration
Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : IP Address. . . . . . . . . . . . : 10.1.1.46 Subnet Mask . . . . . . . . . . . : 255.255.255.0 IP Address. . . . . . . . . . . . : fe80::2d0:59ff:feb8:103c%4 Default Gateway . . . . . . . . . : 10.1.1.254
IPv6 is installed and enabled by default in Windows Vista. Use the ipconfig command to check your automatic configured IPv6 address as well. You should see at least one IPv6 address available for the interface on your computer.
Exa m ple Ena b ling DHC Pv6 o n Windo ws XP
Windows XP does not support DHCPv6. If your network uses DHCPv6 for IP address assignment, you have to additionally install a DHCPv6 client software on your Windows XP. (Note: If you use static IP addresses or Router Advertisement for IPv6 address assignment in your network, ignore this section.) This example uses Dibbler as the DHCPv6 client. To enable DHCPv6 client on your computer: 1 Install Dibbler and select the DHCPv6 client option on your computer. 2 After the installation is complete, select Sta rt > All Pro g ra m s > Dib b le r- DHC Pv6 > C lie nt Insta ll a s se rvic e . 3 Select Sta rt > C o ntro l Pa ne l > Adm inistra tive To o ls > Se rvic e s. 4 Double click Dib ble r a DHC Pv6 c lie nt.
XS3800-28 User's Guide
627

Appendix C IPv6
5 Click Sta rt and then O K.
6 Now your computer can obtain an IPv6 address from a DHCPv6 server.
Exa m ple Ena b ling IPv6 o n Windo ws 7
Windows 7 supports IPv6 by default. DHCPv6 is also enabled when you enable IPv6 on a Windows 7 computer. To enable IPv6 in Windows 7: 1 Select C o ntro l Pa ne l > Ne two rk a nd Sha ring C e nte r > Lo c a l Are a C o nne c tio n. 2 Select the Inte rne t Pro to c o l Ve rsio n 6 (TC P/ IPv6) check box to enable it. 3 Click O K to save the change.
XS3800-28 User's Guide
628

Appendix C IPv6
4 Click C lo se to exit the Lo c a l Are a C o nne c tio n Sta tus screen. 5 Select Sta rt > All Pro g ra m s > Ac c e sso rie s > C o m m a nd Pro m pt. 6 Use the ipconfig command to check your dynamic IPv6 address. This example shows a global address
(2001:b021:2d::1000) obtained from a DHCP server. C:\>ipconfig Windows IP Configuration Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . : IPv6 Address. . . . . . . . . . . : 2001:b021:2d::1000 Link-local IPv6 Address . . . . . : fe80::25d8:dcab:c80a:5189%11 IPv4 Address. . . . . . . . . . . : 172.16.100.61 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : fe80::213:49ff:feaa:7125%11
172.16.100.254
XS3800-28 User's Guide
629

A PPEN DIX D
Le g a l Info rm a tio n
C o pyrig ht
Copyright © 2020 by Zyxel Communications Corporation. The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of Zyxel Communications Corporation. Published by Zyxel Communications Corporation. All rights reserved.
Disc la im e r
Zyxel does not assume any liability arising out of the application or use of any products, or software described herein. Neither does it convey any license under its patent rights nor the patent rights of others. Zyxel further reserves the right to make changes in any products described herein without notice. This publication is subject to change without notice.
Re g ula to ry No tic e a nd Sta te m e nt United States of America

The following information applies if you use the product within USA area. US Importer: Zyxel Communications, Inc, 1130 North Miller Street Anaheim, CA92806-2001, https://www.zyxel.com/us/en/

Canada

Fe de ra l C o m m unic a tio ns C o m m issio n (FC C ) EMC Sta te m e nt
· This device complies with Part 15 of FCC rules. Operation is subject to the following two conditions: (1) This device may not cause harmful interference. (2) This device must accept any interference received, including interference that may cause undesired operations.
· Changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate the equipment.
· This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference in which case the user will be required to correct the interference at his own expense.
The following information applies if you use the product within Canada area.

Inno va tio n, Sc ie nc e a nd Ec o no m ic De ve lo pm e nt C a na da IC ES sta te m e nt
CAN ICES-3 (A)/NMB-3(A)
European Union

The following information applies if you use the product within the European Union.
C E EMC sta te m e nt
WARNING: This equipment is compliant with Class A of EN55032. In a residential environment this equipment may cause radio interference.

XS3800-28 User's Guide
630

Appendix D Legal Information

List o f Na tio na l C o de s

COUNTRY Austria Belgium Bulgaria Croatia Cyprus Czech Republic Denmark Estonia Finland France Germany Greece Hungary Iceland Ireland Italy Latvia

ISO 3166 2 LETTER CODE AT BE BG HR CY CR DK EE FI FR DE GR HU IS IE IT LV

COUNTRY Liechtenstein Lithuania Luxembourg Malta Netherlands Norway Poland Portugal Romania Serbia Slovakia Slovenia Spain Sweden Switzerland Turkey United Kingdom

ISO 3166 2 LETTER CODE LI LT LU MT NL NO PL PT RO RS SK SI ES SE CH TR GB

Sa fe ty Wa rning s
· To avoid possible eye injury, do NOT look into an operating fiber-optic module's connector. · Do NOT use this product near water, for example, in a wet basement or near a swimming pool. · Do NOT expose your device to dampness, dust or corrosive liquids. · Do NOT store things on the device. · Do NOT obstruct the device ventilation slots as insufficient airflow may harm your device. For example, do not place the device in an
enclosed space such as a box or on a very soft surface such as a bed or sofa. · Do NOT install, use, or service this device during a thunderstorm. There is a remote risk of electric shock from lightning. · Connect ONLY suitable accessories to the device. · Do NOT open the device or unit. Opening or removing covers can expose you to dangerous high voltage points or other risks. Only qualified
service personnel should service or disassemble this device. Please contact your vendor for further information. · Make sure to connect the cables to the correct ports. · Place connecting cables carefully so that no one will step on them or stumble over them. · Always disconnect all cables from this device before servicing or disassembling. · Do NOT remove the plug and connect it to a power outlet by itself; always attach the plug to the power adaptor first before connecting it to
a power outlet. · Do NOT allow anything to rest on the power adaptor or cord and do NOT place the product where anyone can walk on the power adaptor
or cord. · Please use the provided or designated connection cables/power cables/adaptors. Connect it to the right supply voltage (for example, 110V
AC in North America or 230V AC in Europe). If the power adaptor or cord is damaged, it might cause electrocution. Remove it from the device and the power source, repairing the power adapter or cord is prohibited. Contact your local vendor to order a new one. · Do NOT use the device outside, and make sure all the connections are indoors. There is a remote risk of electric shock from lightning. · CAUTION: RISK OF EXPLOSION IF BATTERY IS REPLACED BY AN INCORRECT TYPE, DISPOSE OF USED BATTERIES ACCORDING TO THE INSTRUCTION. Dispose them at the applicable collection point for the recycling of electrical and electronic device. For detailed information about recycling of this product, please contact your local city office, your household waste disposal service or the store where you purchased the product. · Use ONLY power wires of the appropriate wire gauge for your device. Connect it to a power supply of the correct voltage. · Fuse Warning! Replace a fuse only with a fuse of the same type and rating. · The POE (Power over Ethernet) devices that supply or receive power and their connected Ethernet cables must all be completely indoors. · The following warning statements apply, where the disconnect device is not incorporated in the device or where the plug on the power supply cord is intended to serve as the disconnect device,
For PERMANENTLY CONNECTED DEVICES, a readily accessible disconnect device shall be incorporated external to the device;
For PLUGGABLE DEVICES, the socket-outlet shall be installed near the device and shall be easily accessible.
· This device must be grounded by qualified service personnel. Never defeat the ground conductor or operate the device in the absence of a suitably installed ground conductor. Contact the appropriate electrical inspection authority or an electrician if you are uncertain that suitable grounding is available.
· If your device has an earthing screw (frame ground), connect the screw to a ground terminal using an appropriate AWG ground wire. Do this before you make other connections.
· If your device has no earthing screw, but has a 3-prong power plug, make sure to connect the plug to a 3-hole earthed socket. · When connecting or disconnecting power to hot-pluggable power supplies, if offered with your system, observe the following guidelines:
Install the power supply before connecting the power cable to the power supply.
Unplug the power cable before removing the power supply.
If the system has multiple sources of power, disconnect power from the system by unplugging all power cables from the power supply.
· CLASS 1 LASER PRODUCT (for products with mini-GBIC slots or laser products, such as fiber-optic transceiver and GPON products).

XS3800-28 User's Guide
631

Appendix D Legal Information

· PRODUCT COMPLIES WITH 21 CFR 1040.10 AND 1040.11. (for products with mini-GBIC slots or laser products, such as fiber-optic transceiver and GPON products)
· APPAREIL À LASER DE CLASS 1 (for products with mini-GBIC slots or laser products, such as fiber-optic transceiver and GPON products). · PRODUIT CONFORME SELON 21 CFR 1040.10 ET 1040.11. (for products with mini-GBIC slots or laser products, such as fiber-optic transceiver and
GPON products)
Im po rta nt Sa fe ty Instruc tio ns

1 Warning! Energy Hazard. Remove all metal jewelry, watches, and so on from your hands and wrists before serving this device.

2 Caution! The RJ-45 jacks are not used for telephone line connection.

Hazardous Moving Parts. Keep body parts away from fan blades.

Hot Surface. Do not touch.

1 Avertissement: Risque de choc électrique. Retirer tout bijoux en métal et votre montre de vos mains et poignets avant de manipuler cet appareil.

2 Attention: Les câbles RJ-45 ne doivent pas être utilisés pour les connections téléphoniques.

Mobilité des pièces détachées. S'assurer que les pièces détachées ne sont pas en contact avec

les pales du ventilateur.

Surface brûlante. Ne pas toucher.

Enviro nm e nt Sta te m e nt
Euro pe a n Unio n Dispo sa l a nd Re c yc ling Info rm a tio n
The symbol below means that according to local regulations your product and/or its battery shall be disposed of separately from domestic waste. If this product is end of life, take it to a recycling station designated by local authorities. At the time of disposal, the separate collection of your product and/or its battery will help save natural resources and ensure that the environment is sustainable development.
Die folgende Symbol bedeutet, dass Ihr Produkt und/oder seine Batterie gemäß den örtlichen Bestimmungen getrennt vom Hausmüll entsorgt werden muss. Wenden Sie sich an eine Recyclingstation, wenn dieses Produkt das Ende seiner Lebensdauer erreicht hat. Zum Zeitpunkt der Entsorgung wird die getrennte Sammlung von Produkt und/oder seiner Batterie dazu beitragen, natürliche Ressourcen zu sparen und die Umwelt und die menschliche Gesundheit zu schützen.
El símbolo de abajo indica que según las regulaciones locales, su producto y/o su batería deberán depositarse como basura separada de la doméstica. Cuando este producto alcance el final de su vida útil, llévelo a un punto limpio. Cuando llegue el momento de desechar el producto, la recogida por separado éste y/o su batería ayudará a salvar los recursos naturales y a proteger la salud humana y medioambiental.

Le symbole ci-dessous signifie que selon les réglementations locales votre produit et/ou sa batterie doivent être éliminés séparément des ordures ménagères. Lorsque ce produit atteint sa fin de vie, amenez-le à un centre de recyclage. Au moment de la mise au rebut, la collecte séparée de votre produit et/ou de sa batterie aidera à économiser les ressources naturelles et protéger l'environnement et la santé humaine.
Il simbolo sotto significa che secondo i regolamenti locali il vostro prodotto e/o batteria deve essere smaltito separatamente dai rifiuti domestici. Quando questo prodotto raggiunge la fine della vita di servizio portarlo a una stazione di riciclaggio. Al momento dello smaltimento, la raccolta separata del vostro prodotto e/o della sua batteria aiuta a risparmiare risorse naturali e a proteggere l'ambiente e la salute umana.
Symbolen innebär att enligt lokal lagstiftning ska produkten och/eller dess batteri kastas separat från hushållsavfallet. När den här produkten når slutet av sin livslängd ska du ta den till en återvinningsstation. Vid tiden för kasseringen bidrar du till en bättre miljö och mänsklig hälsa genom att göra dig av med den på ett återvinningsställe.

XS3800-28 User's Guide
632

Appendix D Legal Information

·
:
· ·
- - · · · · · · · · · ( : / 110V AC 230V AC) · · · · · · · · : · :
Ab o ut the Sym b o ls
Various symbols are used in this product to ensure correct usage, to prevent danger to the user and others, and to prevent property damage. The meaning of these symbols are described below. It is important that you read these descriptions thoroughly and fully understand the contents.
XS3800-28 User's Guide
633

Appendix D Legal Information

Expla na tio n o f the Sym b o ls

SYMBOL

EXPLANATION Alternating current (AC): AC is an electric current in which the flow of electric charge periodically reverses direction.

Direct current (DC): DC if the unidirectional flow or movement of electric charge carriers.
Earth; ground: A wiring terminal intended for connection of a Protective Earthing Conductor.

Class II equipment: The method of protection against electric shock in the case of class II equipment is either double insulation or reinforced insulation.
Vie wing C e rtific a tio ns
Go to http://www.zyxel.com to view this product's documentation and certifications.
Zyxe l Lim ite d Wa rra nty
Zyxel warrants to the original end user (purchaser) that this product is free from any defects in material or workmanship for a specific period (the Warranty Period) from the date of purchase. The Warranty Period varies by region. Check with your vendor and/or the authorized Zyxel local distributor for details about the Warranty Period of this product. During the warranty period, and upon proof of purchase, should the product have indications of failure due to faulty workmanship and/or materials, Zyxel will, at its discretion, repair or replace the defective products or components without charge for either parts or labor, and to whatever extent it shall deem necessary to restore the product or components to proper operating condition. Any replacement will consist of a new or re-manufactured functionally equivalent product of equal or higher value, and will be solely at the discretion of Zyxel. This warranty shall not apply if the product has been modified, misused, tampered with, damaged by an act of God, or subjected to abnormal working conditions.
No te
Repair or replacement, as provided under this warranty, is the exclusive remedy of the purchaser. This warranty is in lieu of all other warranties, express or implied, including any implied warranty of merchantability or fitness for a particular use or purpose. Zyxel shall in no event be held liable for indirect or consequential damages of any kind to the purchaser. To obtain the services of this warranty, contact your vendor. You may also refer to the warranty policy for the region in which you bought the device at http://www.zyxel.com/web/support_warranty_info.php.
Re g istra tio n
Register your product online at www.zyxel.com to receive email notices of firmware upgrades and related information.
Tra de m a rks
ZyNOS (Zyxel Network Operating System) and ZON (Zyxel One Network) are registered trademarks of Zyxel Communications, Inc. Other trademarks mentioned in this publication are used for identification purposes only and may be properties of their respective owners.

XS3800-28 User's Guide
634

Index
Inde x

Numbers
10 Gbps Ethernet port 25 10 Gigabit port
requirement for maximum performance 26 10 Gigabit SFP+ slot 25 802.1P priority 107
A
AAA 295 accounting 295 authentication 295 authorization 295 external server 295 RADIUS 295
AAA (Authentication, Authorization and Accounting) 295
AC power receptacle 42 access control
limitations 541 login account 548 overview 541 remote management 550 service port 549 SNMP 552 Access Control screen 541 accounting setup 300 Address Resolution Protocol (ARP) 518, 585, 590, 593 administrator password 50, 548 age 178 aging time 95 air circulation for cooling 34 All connected Setting Wizard 156 anti-arpscan 416 blocked hosts 418 host threshold 419

status 417 trusted hosts 419 applications bridging 30 IEEE 802.1Q VLAN 31 switched workgroup 30 Area Border Router (ABR) 459 area ID and OSPF 466 ARP how it works 518 learning mode 518 overview 518 ARP (Address Resolution Protocol) 585 ARP inspection 308, 340 and MAC filter 341 configuring 341 syslog messages 341 trusted ports 341 ARP Learning screen 520 ARP scan 416 ARP Setup screen 520 ARP Table screen 585 ARP-Reply 519 ARP-Request 520 AS Boundary Router 459 authentication 466 and OSPF 465 setup 300 authentication, authorization and accounting 295 authorization privilege levels 302 setup 300 authorized technician install the Switch 34 auto-crossover Ethernet port 39 automatic VLAN registration 132 auto-negotiating port 39 Autonomous System and OSPF 459 Autonomous System (AS) 459, 478

XS3800-28 User's Guide
635

Index

B
back up configuration file 531
Backbone Router (BR) 459 backbone, routing 459 Backup Configuration screen 531 Backup Designated Router (BDR), and OSPF 460 bandwidth control 193, 195
egress rate 195 setup 193 Bandwidth Control screen 193 Basic Routing service license 606 basic settings 87 basic setup tutorial 69 Basic TLV Setting screen 405 BDR (Backup Designated Router) 460 binding table 308 building 308, 313 BPDU 422 BPDU (Bridge Protocol Data Units) 422 BPDU guard 422 and Errdisable Recovery 422 port status 422 BPDUs 168 Bridge Protocol Data Units 422 Bridge Protocol Data Units (BPDUs) 168 bridging application 30 broadcast storm control 196
C
cable type bandwidth capacity 27 distance limitation 27 transmission speed 27
Cat 5 cable 26 Cat 5e cable 26 Cat 6 cable 26 Cat 6a cable 26 CDP 353 CE EMC statement 630 Certificates screen 535

certifications viewing 634
CFI (Canonical Format Indicator) 132
changing the password 60
Cisco Discovery Protocol, see CDP
CIST 191
Class of Service 482
classifier 243 and QoS 243 editing 248 example 250 logging 249 match order 249 overview 243 setup 244, 248 status 244 viewing 248
clearance Switch installation 34
cloning a port, see port cloning
cloud mode 28
cluster management 574 and switch passwords 577 cluster manager 574, 577 cluster member 574, 577 cluster member firmware upgrade 578 network example 574 setup 576 specification 574 status 575 switch models 574 VID 577 Web Configurator 578
Cluster Management Configuration screen 576
cluster manager 574
combo port 25, 42
Common and Internal Spanning Tree, see CIST 191
configuration 448 back up 33 change running config 527 saving 61
configuration file 62 backup 531 restore 62, 531 save 526
Configure Clone screen 590
console port

XS3800-28 User's Guide
636

Index

settings 42 contact information
customer support 613 copying port settings, see port cloning copyright 630 CoS 482 CPU management port 154 CPU protection 368 crossover Ethernet cable 39 current date 93 current time 93 customer support 613
D
DAC (Direct Attach Cables) 39 Database Description (DD) 460 date
current 93 daylight saving time 93 DDMI Details screen 602 DDMI screen 601 default gateway 497 default IP address
management port 42 Designated Router (DR), and OSPF 460 DHCP 487
client IP pool 497 configuration options 488 modes 488 relay agent 488 Relay Agent Information format 491 server 488 setup 488 DHCP (Dynamic Host Configuration Protocol) 487 DHCP Option 82 Profile screen 491 DHCP relay configure 76 tutorial 73 DHCP relay agent 625 DHCP relay option 82 323 DHCP Relay screen 493, 495 DHCP screen 488 DHCP snooping 69, 308, 321

configure 323 DHCP relay option 82 323 trusted ports 322 untrusted ports 322
DHCP snooping database 322
DHCP Snooping Port Configure screen 71
DHCP Status screen 488
DHCP Unique IDentifier 503
DHCP Unique IDentifier (DUID) 624
DHCP-assigned IP 610
DHCPv4 global relay 493 global relay example 495 Option 82 490 option 82 profiles 491 Relay Agent Information 490
DHCPv4 relay 490
DHCPv6 DHCP Unique IDentifier 503 enable in Windows XP 627
DHCPv6 client 32
DHCPv6 Client Setup screen 121
DHCPv6 relay 32 interface-ID 503 remote-ID 503
DHCPv6 Relay screen 503
diagnostics 566 Ethernet port test 568 ping 567
Differentiated Service (DiffServ) 482
DiffServ 482 activate 483 DS field 482 DSCP 482 network example 483 PHB 482 service level 482
DiffServ Code Points 482
Digital Diagnostics Monitoring Interface 601
disclaimer 630
disposal and recycling information EU 632
double-tagged frames 261
DR (Designated Router) 460
DS (Differentiated Services) 482
DSCP 482

XS3800-28 User's Guide
637

Index

what it does 482 dual AC power supply modules 25 dual firmware images 529 dual personality interface 42 DUID 503 dust plug 40 DVMRP
Autonomous System 478 default timer setting 481 error message 480 graft 479 how it works 478 implementation 478 probe 479 prune 479 report 479 setup 479 terminology 479 threshold 480 DVMRP (Distance Vector Multicast Routing Protocol) 478 Dynamic Host Configuration Protocol for IPv6 (DHCPv6) 624 dynamic link aggregation 210
E
egress port 156 egress rate 195 electrical inspection authority 44 electrician 44 electrostatic discharge (ESD) 40 Environment Statement 632 Errdisable Detect screen 373 Errdisable Recovery screen 374 Errdisable screen 369 errdisable status 371 error disable 368
control packets 371 CPU protection 371 detect 373 recovery 374 status 369 error-disable recovery 368 Ethernet broadcast address 518, 585

Ethernet MAC 89 Ethernet OAM 426 Ethernet port
auto-crossover 39 supported speeds 38 Ethernet port test 568 Ethernet settings default 39 example summary address 468 exchange RIP and OSPF information 467 external authentication server 296
F
fan speed 90, 91 FCC interference statement 630 fiber cable
connecting 41 removal 41 file transfer using FTP command example 538 filename convention, configuration file names 538 filtering 165 rules 165 filtering database, MAC table 580 Filtering screen 165 firmware upgrade 529, 578 ZyNOS 89 firmware trunk version 29 Firmware Upgrade screen 529 firmware version 29 flow control 107 back pressure 107 IEEE802.3x 107 forwarding delay 178 frames tagged 143 untagged 143 freestanding installation precautions 35

XS3800-28 User's Guide
638

Index

front panel 38 connections 38
FTP 538 file transfer procedure 539 restrictions over WAN 539
G
GARP (Generic Attribute Registration Protocol) 132 GARP timer 96, 132 general setup 92 General Setup screen 92 getting help 63 gigabit ports 39 GMT (Greenwich Mean Time) 93 gratuitous ARP 519 green Ethernet 385
and uplink port 385 auto power down 385 EEE 385 short reach 385 grounding for safety 43 GVRP (GARP VLAN Registration Protocol) 133
H
hardware installation 34 hardware monitor 89, 90, 91 hardware overview 38 hello time 177 hops 178 HTTPS 560
certificates 560 implementation 560 public keys, private keys 560 HTTPS Certificates screen 537 HTTPS example 560

I
IANA (Internet Assigned Number Authority) 619 Identity Association (IA) 624 IEEE 802.1x
activate 222 port authentication 220 re-authentication 225 IEEE 802.3az 385 IEEE 802.3bz 26 IGMP 478 how it works 475 overview 474 port based 476 setup 476 version 3 475 versions supported 475 IGMP (Internet Group Management Protocol) 474 IGMP filtering 270 profile 279 profiles 275 IGMP leave timeout fast 277 normal 277 IGMP snooping 270 MVR 271 IGMP snooping and VLANs 270 IGMP throttling 277 ingress port 156 initial setup 64 Innovation, Science and Economic Development Canada ICES statement 630 installation air circulation 34 desktop 34 freestanding 34 rack-mounting 35 transceiver 40 installation requirements wall mounting 35 interface 462 and OSPF 469 Interface Setup screen 108 interface, and OSPF 460 Internal Router (IR) 459 Internet Protocol version 6, see IPv6

XS3800-28 User's Guide
639

Index

IP configuration 99 interface 97, 508 routing domain 97 status 98
IP address 98 Switch management 66
IP multicast example 474
IP Setup screen 68, 96
IP source guard 308 ARP inspection 308, 340 DHCP snooping 308 static bindings 308
IP Status Detail screen 98
IP subnet mask 98
IP table 583 how it works 583
IPv4/IPv6 dual stack 32
IPv6 32, 622 addressing 622 enable in Windows 2003 627 enable in Windows 7 628 enable in Windows Vista 627 enable in Windows XP 627 EUI-64 624 global address 622 interface ID 624 link-local address 622 Neighbor Discovery Protocol 32, 622 neighbor table 594 ping 32, 622 prefix 622 prefix length 622 unspecified address 623
IPv6 address size 32
IPv6 cache 626
IPv6 Configuration screen 111
IPv6 Global Address Setup screen 115
IPv6 Global Setup screen 112
IPv6 interface DHCPv6 client 121 enable 113 global address 114 global unicast address 110 link-local address 114 link-local IP 110 neighbor discovery 116

neighbor table 119 status 109 IPv6 Interface Setup screen 113 IPv6 Interface Status screen 110 IPv6 Link-Local Address Setup screen 114 IPv6 multicast status 280 IPv6 Neighbor Setup screen 120 IPv6 Neighbor Table screen 594 IPv6 screen 109 IPv6 static route configuration 450
J
Java permission 48, 611 JavaScript 48, 611
L
L2PT 350 access port 351 CDP 350 configuration 351 encapsulation 350 example 350 LACP 351 MAC address 350, 353 mode 351 overview 350 PAgP 351 point to point 351 STP 350 tunnel port 351 UDLD 351 VTP 350
L3 routing basic features 606
LACP 210, 353 system priority 217 timeout 218
Layer 2 protocol tunneling, see L2PT layer-2 switching 25 layer-3 routing 25
XS3800-28 User's Guide
640

Index

LEDs 45
limit MAC address learning 239
link aggregation 210 dynamic 210 ID information 211 setup 213 traffic distribution algorithm 212 traffic distribution type 215 trunk group 210
Link Aggregation Control Protocol (LACP) 210
Link Layer Discovery Protocol 388
link state database 460, 462
LLDP 388 basic TLV 405 global settings 403 local port status 393 organization-specific TLV 406 status of remote device 397 TLV 388
LLDP (Link Layer Discovery Protocol) 388
LLDP screen 390
LLDP-MED 389 classes of endpoint devices 389 example 389
LLDP-MED Configuration screen 408
LLDP-MED Location screen 411
local port mirroring 199
lockout 61 Switch 61
log message 570
login 48 password 60 privilege level 549
login account administrator 548 non-administrator 548
login accounts 548 configuring via Web Configurator 548 multiple 548 number of 548
login password edit 548
Logins screen 548
loop guard 342 examples 343 port shut down 343 setup 344

vs. STP 342 LSA (Link State Advertisement) 460
M
MAC (Media Access Control) 89 MAC address 89, 585
maximum number per port 239 MAC address learning 95, 239
specify limit 239 MAC Based VLAN screen 151 MAC filter
and ARP inspection 341 MAC freeze 238 MAC table 580
display criteria 582 how it works 580 sorting criteria 582 transfer type 582 viewing 581 MAC-based VLAN 151 maintenance 524 configuration backup 531 current configuration 525 firmware 529 main screen 525 restore configuration 531 Maintenance screen 524 Management Information Base (MIB) 552 management IP address 66 management method 28 management mode 28 change 28 management port 42, 156 default IP address 42 managing the device using the command line interface, see command line
interface 32 managing the Switch
cluster management 32 good habits 32 NCC 32 using FTP, see FTP 32 using SNMP 32 Web Configurator 32

XS3800-28 User's Guide
641

Index

ZON Utility 32
man-in-the-middle attacks 340
max age 178 hops 178
maximum transmission unit 589
Maximum Transmission Unit (MTU) 110
Mbuf (Memory Buffer) 534
Media Access Control 89
Memory Buffer 534
metric 468
MGMT (management) port 42
MIB and SNMP 552 supported MIBs 553
MIB (Management Information Base) 552
mirroring ports 199
MLD filtering profile 287
MLD proxy 32
MLD snooping 32
MLD snooping-proxy 281 filtering 285 filtering profile 287 port role 283 VLAN ID 282
model code 29
monitor port 200, 202
mounting brackets attaching 36
MST Instance, see MSTI 191
MST region 190
MSTI 191
MSTP bridge ID 183 configuration 175 configuration digest 184 forwarding delay 178 Hello Time 183 hello time 177 Max Age 183 max age 178 max hops 178 path cost 179 port priority 179 revision level 178 status 181

MTU 589 MTU (Multi-Tenant Unit) 94 multicast
802.1 priority 275 IGMP throttling 277 IP addresses 270 setup 273, 275 multicast delivery tree 479 multicast group 279 multicast MAC address 161 Multi-Gigabit (IEEE 802.3bz) 26 Multi-Gigabit port 26 MultiSource Agreement (MSA) 39 Multi-Tenant Unit 94 MVR 271 configuration 288 network example 271 MVR (Multicast VLAN Registration) 271 myZyxel 606 myZyxel account 29
N
NCC registration 28 Nebula Control Center (NCC) 28 Nebula setup wizard
select site 29 Nebula Switch Registration screen 130 NebulaFlex for hybrid mode 28 Neighbor Detail screen 85 Neighbor Discovery Protocol (NDP) 625 Neighbor Management (Smart Connect) 29 Neighbor screen 83 network applications 30 network management system (NMS) 552 NTP (RFC-1305) 93
O
OAM 426 details 428 discovery 426

XS3800-28 User's Guide
642

Index

port configuration 426 remote loopback 426, 433 Operations, Administration and Maintenance 426 Option 82 490 Organizationally Unique Identifiers (OUI) 149 Org-specific TLV Setting screen 406 OSPF 459 advantages 459 area 459, 465 Area 0 459 area ID 466 authentication 465, 466 autonomous system 459 backbone 459 configuration steps 461 general settings 464 how it works 460 interface 460, 462, 469 link state database 460, 462 network example 460 priority 460 redistribute route 468 router elections 460 router ID 464 router types 459 status 462 stub area 459, 466 virtual link 460 virtual links 471 vs RIP 459 OSPF (Open Shortest Path First) 459 OSPF redistribution 467 overheating prevention 34
P
PAGP 353 password 60
administrator 50, 548 change 32 write down 32 password change via Password / SNMP link 49 Path MTU Discovery 589 Path MTU Table screen 589

Per-Hop Behavior 482
PHB 482
ping, test connection 567
policy 253, 447, 454 and classifier 253, 447, 454 and DiffServ 252 configuration 253, 447, 454 example 255 overview 252 rules 252, 253
policy routing benefits 452 cost savings 452 load sharing 452 overview 452
policy-based routing 452
port setup 104
Port Aggregation Protocol, see PAgP
port authentication 220 guest VLAN 228 IEEE802.1x 222 MAC authentication 225 method 222
port based IGMP 476
port based VLAN type 95
port cloning 590, 593 advanced settings 590, 593 basic settings 590, 593
port details 598
Port isolation Setting Wizard 156
port mirroring 199, 202 direction 205 egress 205 ingress 205
port redundancy 210
Port screen DHCPv4 Global Relay 494 DHCPv4 VLAN 498
port security 237 address learning 239 limit MAC address learning 239 setup 237
Port Setup screen 104
port status 596 port details 598

XS3800-28 User's Guide
643

port utilization 604 port utilization 604 Port VID (PVID) 65 port VLAN ID, see PVID 143 port VLAN trunking 133 port-based VLAN 154
all connected 156 configure 154 port isolation 156 settings wizard 156 ports diagnostics 569 mirroring 199 speed/duplex 107 standby 211 power voltage 90, 92 power connections 44 power connector 44 power module disconnecting 45 power slots 25 power status 90, 92 PPPoE IA 359 agent sub-options 361 configuration 361 drop PPPoE packets 363 port state 361 sub-option format 360 tag format 359 trusted ports 361 untrusted ports 361 VLAN 366 PPPoE Intermediate Agent 359 prefix delegation 625 priority level queue assignment 96 priority queue assignment 96 priority, and OSPF 461 product registration 634 protocol based VLAN example 148 PVID 132

Index
Q
QoS 482 and classifier 243
Quality of Service 482 queue weight 258 queuing 257, 258
SPQ 257 WRR 257 queuing method 257, 260
R
rack-mounting 35 installation requirements 35 precautions 35
RADIUS 296 advantages 296 setup 296
Rapid Spanning Tree Protocol (RSTP) 167 rear panel 42 reboot
load configuration 527 reboot system 527 redistribute route 468 reducing routing table size 467 reflector port 199 registration
product 634 Regulatory Notice and Statement 630 release number
Switch 29 remote management 32, 550
service 551 trusted computers 551 remote port mirroring 199, 203 resetting 62, 526, 527, 528 to custom default settings 528 to factory default settings 526, 528 to stacking default settings 527 restore configuration 33 restore configuration 531 restoring configuration 62
XS3800-28 User's Guide
644

Index

Reverse Path Forwarding (RPF) 479 Reverse Path Multicasting (RPM) 478 RFC 3164 571 RIP 468
configuration 457 direction 456 overview 456 version 456 vs OSPF 459 RIP (Routing Information Protocol) 456 RMirror 199 monitor port 203 reflector port 203 source 203 RMirror, see also remote port mirroring 203 Round Robin Scheduling 257 route cost 468 Router Advertisement (RA) 625 router ID 464 routing domain 97, 508 routing table 587 RSTP configuration 173 rubber feet attach 34
S
safety precautions using the Switch 34
safety warnings 631 save configuration 61, 526 Save link 61 schedule
type 242 Secure Shell, see SSH
service access control 549 service port 550
sFlow 355 configuration 355 datagram 355 overview 355 poll interval 357 sample rate 357 UDP port 358

sFlow agent 355 sFlow collector 355 SFP/SFP+ slot 39 Simple Network Management Protocol, see SNMP
Small Form-Factor Pluggable (SFP) 39 SNMP 552
agent 552 and MIB 552 authentication 547 communities 50, 543 management model 552 manager 552 MIB 553 network components 552 object variables 552 protocol operations 552 security 547 security level 547 setup 542 traps 543 users 546 version 3 and security 552 versions supported 552 SNMP traps 553 supported 553, 555, 558 source-based routing 452 SPQ (Strict Priority Queuing) 257 SSH encryption methods 559 how it works 558 implementation 559 SSH (Secure Shell) 558 SSL (Secure Socket Layer) 560 stacking mode 25, 27 default static IP address 27 standalone mode 28 standby ports 211 static address assignment 32 static bindings 308 static MAC address 158 static MAC forwarding 158 Static MAC Forwarding screen 158 static multicast forwarding 161 Static Multicast Forwarding screen 162 static route 448 enable 449
XS3800-28 User's Guide
645

metric 450 overview 448
static VLAN 138 control 141 tagging 141
status 55, 81 MSTP 181 port 596 power 90, 92 STP 171 VLAN 134 VRRP 508
Status screen 81
STP 353 bridge ID 171, 188 bridge priority 174, 186 designated bridge 168 edge port 175, 187 forwarding delay 174 Hello BPDU 168 Hello Time 171, 174, 186, 188 how it works 168 Max Age 172, 174, 186, 188 path cost 168, 175, 187 port priority 175, 187 port role 172, 189 port state 168, 172, 189 root port 168 status 170, 171 terminology 168 vs. loop guard 342
STP Path Cost 168
straight-through Ethernet cable 39
stub area 459, 466
stub area, see also OSPF 466
subnet based VLANs 143
subnet masking 624
subscription services manage 606
summary address 467, 468
Switch DHCP client 48 fanless-type usage precaution 34 fan-type usage precaution 34
switch lockout 61
Switch reset 62
Switch Setup screen 94

Index
Switch's QR code 29 syslog 341, 571
protocol 571 settings 571 setup 571 severity levels 571 Syslog Setup screen 571 System Info screen 87 system reboot 527
T
TACACS+ 296 advantages 296 setup 298
tag-based VLAN example 31
tagged VLAN 132 Tech-Support 533
log enhancement 533 Tech-Support screen 533 temperature indicator 89, 90, 91 terminal emulation software
parameters 42 time
current 93 daylight saving 93 format 93 Time (RFC-868) 93 time server 93 time service protocol 93 Time To Live (TTL) 480 ToS 482 trademarks 634 traffic distribution criteria 211 transceiver connection interface 40 connection speed 40 installation 40 removal 41 transceiver slot 39 translating RIP into OSPF 468 Trap Group screen 543 traps
XS3800-28 User's Guide
646

destination 543 troubleshooting 76 trunk group 210 trunking 210 trusted ports
ARP inspection 341 DHCP snooping 322 PPPoE IA 361 tutorial DHCP snooping 69 tutorials basic setup 69 Type of Service 482
U
UDLD 353 UniDirectional Link Detection, see UDLD untrusted ports
ARP inspection 341 DHCP snooping 322 PPPoE IA 361 uplink connection 42 super-fast 30 User Information screen SNMP 546 user name 49 default 49 user profiles 296 UTC (Universal Time Coordinated) 93
V
Vendor ID Based VLAN screen 152 Vendor Specific Attribute, see VSA 302 ventilation holes 34 VID 101, 102, 135, 136, 263
number of possible VIDs 132 priority frame 132 VID (VLAN Identifier) 132 virtual links 471 virtual links, and OSPF 460 Virtual Local Area Network 94

Index
Virtual Router status 508
Virtual Router (VR) 507 Virtual Router Redundancy Protocol (VRRP) 507 VLAN 94
acceptable frame type 143 and IGMP snooping 270 automatic registration 132 creation 64, 74 ID 132 ingress filtering 143 introduction 94, 132 number of VLANs 135 port number 136 port settings 141 port-based 156 port-based VLAN 154 port-based, isolation 156 port-based, wizard 156 PVID 143 static VLAN 138 status 134, 135, 136 subnet based 143 tagged 132 terminology 133 trunking 133, 143 type 95, 134 VLAN (Virtual Local Area Network) 94 VLAN ID 132 VLAN mapping 346 activating 347 configuration 348 example 346 priority level 346 tagged 346 traffic flow 346 untagged 346 VLAN ID 346 VLAN number 98, 101, 102 VLAN Setting screen 499 DHCPv4 496 VLAN stacking 261, 263 configuration 263 example 261 frame format 263 port roles 262, 265 port-based Q-in-Q 265 priority 263
XS3800-28 User's Guide
647

selective Q-in-Q 267 VLAN terminology 133 VLAN trunking 143 VLAN Trunking Protocol, see VTP
VLAN-unaware devices 65 voice VLAN 149 Voice VLAN Setup screen 149 VRID (Virtual Router ID) 508 VRRP 507
advertisement interval 510 authentication 509 backup router 507 configuration example 512 Hello message 510 how it works 507 interface setup 508 master router 507 network example 507, 512 parameters 509 preempt mode 510, 511 priority 510, 511 status 508 uplink gateway 511 uplink status 508 Virtual Router 507 Virtual Router ID 511 VRID 508 VSA 302 VTP 353
W
warranty 634 note 634
Web browser pop-up window 48, 611 Web Configurator
getting help 63 home 55 login 48 logout 63 navigating components 55 navigation panel 56, 57 online help 63 usage prerequisite 48 weight 258 Windows OS version

Index
check 51 WRR (Weighted Round Robin Scheduling) 257
Z
ZDP 51 ZON (Zyxel One Network) 634 ZON Utility 51
compatible OS 51 fields description 54 icon description 54 installation requirements 51 introduction 29 minimum hardware requirements 51 network adapter select 53 password prompt 54 run 51 supported firmware version 52 supported models 52 Switch IP address 48 ZON utility use for troubleshooting 610 ZULD example 435 probe time 438 status 436 ZULD (Zyxel Unidirectional Link Detection) 435 ZyNOS (Zyxel Network Operating System) 538, 634 Zyxel AP Configurator (ZAC) 54 Zyxel Discovery Protocol (ZDP) 51 Zyxel Nebula Mobile App register the Switch 29 Zyxel One Network (ZON) Utility 29 Zyxel online services center 606 Zyxel Unidirectional Link Detection (ZULD) 435
XS3800-28 User's Guide
648

Acrobat Distiller 11.0 (Windows)