Page 3 - Contents; About this Document
3 Contents 1 About this Document . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Additional Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 2 System Configuration . . . . . . . . ....
Page 4 - Switching Configuration
4 3 Switching Configuration . . . . . . . . . . . . . . . . . . . . . . . . . 25 Virtual LANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 VLAN Configuration Example . . . . . . . . . . . . . . . . . . . . . . . . 26 CLI Examples . . . . . . . . . . . . . . . . . . . . . ...
Page 9 - About this Document; Organization; This document is organized as follows:
About this Document 9 1 About this Document This configuration guide provides examples of how to use the following switches in a typical network: • Dell™ PowerConnect™ M6220• Dell PowerConnect M6348• Dell PowerConnect M8024 It describes the advantages of specific functions the PowerConnect M6220/M63...
Page 10 - Additional Documentation; CLI Command Reference; • The; User’s Guide; initial system setup and configuration instructions.; Getting Started Guide; software packages, including issues and workarounds.
10 About this Document Additional Documentation The following documentation provides additional information about PowerConnect M6220/M6348/M8024 software: • The CLI Command Reference for your Dell PowerConnect switch describes the commands available from the command-line interface (CLI) for managing...
Page 11 - System Configuration; Getting Started; Traceroute; destination through the network.
System Configuration 11 2 System Configuration This section provides configuration scenarios for the following features: • "Traceroute" on page 11• "Configuration Scripting" on page 13• "Outbound Telnet" on page 16• "Simple Network Time Protocol (SNTP)" on page 17• ...
Page 12 - CLI Example; The following shows an example of using the traceroute
12 System Configuration CLI Example The following shows an example of using the traceroute command to determine how many hops there are to the destination. The command output shows each IP address the packet passes through and how long it takes to get there. In this example, the packet takes 16 hops...
Page 13 - Configuration Scripting; Overview; Configuration scripting:; Considerations; commands and the script fails, the script stops at five.; CLI Examples
System Configuration 13 Configuration Scripting Configuration scripting allows you to generate a text-formatted script file that shows the current system configuration. You can generate multiple scripts and upload and apply them to more than one switch. Overview Configuration scripting: • Provides s...
Page 14 - Example #2: Viewing and Deleting Existing Scripts
14 System Configuration Example #2: Viewing and Deleting Existing Scripts console#script list Configuration Script Name Size(Bytes) -------------------------------- ----------- abc.scr 360 running-config 360 startup-config 796 test.scr 360 4 configuration script(s) found. 2046 Kbytes free. console#s...
Page 15 - Example #5: Uploading a Configuration Script to the TFTP Server
System Configuration 15 Example #5: Uploading a Configuration Script to the TFTP Server Use this command to upload a configuration script to the TFTP server. console#copy script abc.scr tftp://10.27.64.141/abc.scr Mode........................................... TFTP Set TFTP Server IP..................
Page 16 - Outbound Telnet; and terminal handling conventions.; Example #1: Connecting to Another System by Using Telnet
16 System Configuration Example #7: Validating a Script console#script validate abc.scr ip address dhcp username "admin" password 16d7a4fca7442dda3ad93c9a726597e4 level 15 encrypted exit Configuration script 'abc.scr' validated. console#script apply abc.scr Are you sure you want to apply the...
Page 17 - The SNTP implementation has the following features:
System Configuration 17 IP Address..................................... 10.27.65.89 Subnet Mask.................................... 255.255.254.0 Default Gateway................................ 10.27.64.1 Burned In MAC Address.......................... 00FF.F2A3.6688 Network Configuration Protocol C...
Page 19 - Syslog; Interpreting Log Files
System Configuration 19 Syslog Overview Syslog: • Allows you to store system messages and/or errors.• Can store to local files on the switch or a remote server running a syslog daemon.• Provides a method of collecting message logs from many systems. Interpreting Log Files Figure 2-1 describes the in...
Page 21 - Port Description; SNMP network management.; Use the commands shown below for the Port Description feature.; Storm Control
System Configuration 21 error Error conditions info Informational messages notice Normal but significant conditions warning Warning conditions console(Config-logging)#level critical Port Description The Port Description feature lets you specify an alphanumeric interface identifier that can be used f...
Page 22 - Example #1: Set Broadcast Storm Control for an Interface; Example #2: Set Multicast Storm Control for an Interface
22 System Configuration Configuring a storm-control level also enables that form of storm-control. Disabling a storm-control level (using the “no” version of the command) sets the storm-control level back to default value and disables that form of storm-control. Using the “no” version of the “storm-...
Page 23 - Example #1: Limit the Set of Autonegotiation Options
System Configuration 23 10GBASE-T Plug-in Module Configuration NOTE: This feature is applicable to the PowerConnect M6220 and M8024 switches only. The PowerConnect M6220 and M8024 switches provide two 10-Gigabit module slots that support plug- in modules: • The M6220 supports CX-4, SFP+, XFP, and 10...
Page 25 - Switching Configuration; Virtual LANs; a particular packet belongs to a particular VLAN:
Switching Configuration 25 3 Switching Configuration This section provides configuration scenarios for the following features: • "Virtual LANs" on page 25• "IGMP Snooping" on page 32• "IGMP Snooping Querier" on page 33• "Link Aggregation/Port Channels" on page 35• ...
Page 26 - VLAN Configuration Example; Figure 3-1. VLAN Example Network Diagram; default VLAN to a port.
26 Switching Configuration • The IP-subnet Based VLAN feature lets you map IP addresses to VLANs by specifying a source IP address, network mask, and the desired VLAN ID. • The MAC-based VLAN feature let packets originating from end stations become part of a VLAN according to source MAC address. To ...
Page 28 - Example #4: Assign VLAN3 as the Default VLAN
28 Switching Configuration Example #4: Assign VLAN3 as the Default VLAN This example shows how to assign VLAN 3 as the default VLAN for port 1/g18. console(config)#interface ethernet 1/g18 console(config-if-1/g18)#switchport general pvid 3 Example #5: Assign IP Addresses to VLAN 2 In order for the V...
Page 29 - Web Interface; . To create VLANs and specify port participation.; IP Subnet and MAC-Based VLANs; Example #1: Associate an IP Subnet with a VLAN
Switching Configuration 29 Web Interface Use the following screens to perform the same configuration using the Web Interface: • Switching > VLAN > Membership . To create VLANs and specify port participation. • Switching > VLAN > Port Settings. To specify the PVID and mode for the port. I...
Page 30 - Example #4: Viewing IP Subnet and MAC-Based VLAN Associations
30 Switching Configuration Example #4: Viewing IP Subnet and MAC-Based VLAN Associations console#show vlan association mac MAC Address VLAN ID ----------------- ------- 00FF.F2A3.8886 10 console#show vlan association subnet IP Subnet IP Mask VLAN ID ---------------- ---------------- ------- 192.168....
Page 31 - Private Edge VLANs; even if they are on the same VLAN.
Switching Configuration 31 Private Edge VLANs Use the Private Edge VLAN feature to prevent ports on the switch from forwarding traffic to each other even if they are on the same VLAN. • Protected ports cannot forward traffic to other protected ports in the same group, even if they have the same VLAN...
Page 32 - IGMP Snooping; request multicast traffic.; Example #1: Enable IGMP Snooping on an Interface; Example #2: Show IGMP Snooping Information for the Switch
32 Switching Configuration IGMP Snooping This section describes the Internet Group Management Protocol (IGMP) Snooping feature. IGMP Snooping enables the switch to monitor IGMP transactions between hosts and routers. It can help conserve bandwidth by allowing the switch to forward IP multicast traff...
Page 33 - Example #3: Show IGMP Snooping Information for an Interface; IGMP Snooping Querier; functions on the VLAN.; Example #1: Enable IGMP Snooping Querier on the Switch
Switching Configuration 33 Example #3: Show IGMP Snooping Information for an Interface console#show ip igmp snooping interface ethernet 1/g17 Slot/Port...................................... 1/g17 Global IGMP Snooping Admin Mode................ Enabled IGMP Snooping Admin Mode....................... ...
Page 34 - Example #3: Show IGMP Snooping Querier Information; Example #4: Enable IGMP Snooping Querier on a VLAN
34 Switching Configuration console(config)#ip igmp snooping querier query-interval 100 console(config)#ip igmp snooping querier timer expiry 100 Example #3: Show IGMP Snooping Querier Information console#show ip igmp snooping querier Global IGMP Snooping querier status ------------------------------...
Page 35 - Example #5: Show IGMP Snooping Querier Information for VLAN 10; Link Aggregation/Port Channels
Switching Configuration 35 Example #5: Show IGMP Snooping Querier Information for VLAN 10 console#show ip igmp snooping querier vlan 10 Vlan 10 : IGMP Snooping querier status ---------------------------------------------- IGMP Snooping Querier Vlan Mode................ Enable Querier Election Partic...
Page 36 - Example 1: Create Names for Two Port-Channels
36 Switching Configuration Figure 3-2. LAG/Port-channel Example Network Diagram Example 1: Create Names for Two Port-Channels console#configure console(config)#interface port-channel 1 console(config-if-ch1)#description lag_1 console(config-if-ch1)#exit console(config)#interface port-channel 2 conso...
Page 37 - Example 3: Show the Port Channels
Switching Configuration 37 console(config)#interface ethernet 1/g18 console(config-if-1/g18)#channel-group 1 mode auto console(config-if-1/g18)#exit console(config)#interface ethernet 1/g19 console(config-if-1/g19)#channel-group 2 mode auto console(config-if-1/g19)#exit console(config)#interface eth...
Page 38 - Aggregation > LAG Membership; in the navigation tree.; Port Mirroring; means of fending off attacks.; mirrored to the destination port.; Example #1: Set up a Port Mirroring Session; Example #2: Show the Port Mirroring Session
38 Switching Configuration Web Interface Configuration: LAGs/Port-channels To perform the same configuration using the Graphical User Interface, click Switching > Link Aggregation > LAG Membership in the navigation tree. Port Mirroring This section describes the Port Mirroring feature, which c...
Page 39 - Port Security; This section describes the Port Security feature.; with a MAC address matching the MAC address in the static list.; Example #1: Enable Port Security on an Interface
Switching Configuration 39 Port Security This section describes the Port Security feature. Overview Port Security: • Allows for limiting the number of MAC addresses on a given port.• Packets that have a matching MAC address (secure packets) are forwarded; all other packets (unsecure packets) are res...
Page 40 - Link Layer Discovery Protocol
40 Switching Configuration discard Discard frames with unlearned source addresses. max Configure the maximum addresses that can be learned on the port. trap Sends SNMP Traps, and specifies the minimum time between consecutive traps. console(config-if-1/g18)#port security Example #2: Show Port Securi...
Page 41 - Example #2: Set Interface LLDP Parameters
Switching Configuration 41 <interval-seconds> Range <5 - 3600> seconds. console(config)#lldp notification-interval 1000 console(config)#lldp timers ? hold The interval multiplier to set local LLDP data TTL. interval The interval in seconds to transmit local LLDP data. reinit The delay be...
Page 42 - Example #4 Show Interface LLDP Parameters; Denial of Service Attack Protection
42 Switching Configuration Example #4 Show Interface LLDP Parameters console#show lldp interface 1/g10 LLDP Interface Configuration Interface Link Transmit Receive Notify TLVs Mgmt --------- ------ -------- -------- -------- ------- ---- 1/g10 Down Enabled Enabled Disabled Y TLV Codes: 0- Port Descr...
Page 43 - The following table describes the; Example #2: Viewing the DoS Configuration Information
Switching Configuration 43 The following table describes the dos-control keywords. Table 3-1. DoS Control CLI Examples The commands shown below show how to enable DoS protection and view its status. Example #1: Enabling all DOS Controls console#configure console(config)#dos-control sipdip console(co...
Page 44 - DHCP Snooping; messages between a DHCP client and DHCP server to:; no ip dhcp snooping
44 Switching Configuration DHCP Snooping Dynamic Host Configuration Protocol (DHCP) Snooping is a security feature that monitors DHCP messages between a DHCP client and DHCP server to: • Filter harmful DHCP messages• Build a bindings database of (MAC address, IP address, VLAN ID, port) authorized tu...
Page 45 - binding will go to the tentative binding.; bindin; REQUEST
Switching Configuration 45 snooping removes bindings in response to DECLINE, RELEASE, and NACK messages. DHCP Snooping application ignores the ACK messages as reply to the DHCP Inform messages received on trusted ports. The administrator can also enter static bindings into the binding database.The D...
Page 46 - Example #1 Enable DHCP snooping for the switch
46 Switching Configuration DHCP snooping can be configured on switching VLANs and routing VLANs. When a DHCP packet is received on a routing VLAN, the DHCP snooping application applies its filtering rules and updates the bindings database. If a client message passes filtering rules, the message is p...
Page 47 - Example #7 Configure an interface as DHCP snooping trusted
Switching Configuration 47 Example #7 Configure an interface as DHCP snooping trusted console(config-if-1/g1)#ip dhcp snooping trust console(config-if-1/g1)#exit Example #8 Configure rate limiting on an interface console(config-if-1/g1)#ip dhcp snooping limit rate 50 burst interval 1 console(config-...
Page 48 - Example #12 Show DHCP Snooping database configurations
48 Switching Configuration 1/g17 No No 1/g18 No No 1/g19 No No 1/g20 No No 1/g21 No No 1/g22 No No 1/g23 No No 1/g24 No No 1/xg3 No No 1/xg4 No No ch1 No No ch2 No No ch3 No No ch4 No No ch5 No No ch6 No No --More-- or (q)uit console# Example #12 Show DHCP Snooping database configurations console#sh...
Page 50 - Example #15 Show DHCP Snooping Per Port Statistics
50 Switching Configuration Example #15 Show DHCP Snooping Per Port Statistics console#show ip dhcp snooping statistics Interface MAC Verify Client Ifc DHCP Server Failures Mismatch Msgs Rec'd ----------- ---------- ---------- ----------- 1/g2 0 0 0 1/g3 0 0 0 1/g4 0 0 0 1/g5 0 0 0 1/g6 0 0 0 1/g7 0 ...
Page 51 - Port Aggregator
Switching Configuration 51 ch16 0 0 0 ch17 0 0 0 --More-- or (q)uit Port Aggregator The Port Aggregator feature minimizes the administration required for managing the blade-centric switch blades. This feature provides administrators the ability to map internal ports to external ports without having ...
Page 52 - The default Port Aggregator Group mapping is shown in Table 3-2.
52 Switching Configuration Figure 3-4. Default Aggregator Groups on Standalone Switch (Blade) The default Port Aggregator Group mapping is shown in Table 3-2. Table 3-2. Default Port Aggregator Group Mapping A standalone switch in Simple Mode supports up to 8 Aggregator Groups.The number of internal...
Page 53 - Simple Mode Operation; the command; roup id; in Global Configuration mode. When Simple Mode
Switching Configuration 53 To prevent traffic from different groups being seen by other groups, a VLAN is reserved for each Aggregator Group by default. This VLAN reservation per group is not configurable; however you can configure each group to participate in more than one user-created (unreserved)...
Page 54 - show port-aggregator port summary; mode simple
54 Switching Configuration • Operational mode is set to Normal mode on resetting the configuration to Factory defaults from the software boot menu. The switch will boot up in this mode unless you select a different mode from the setup wizard. • The switch can be changed between Normal and Simple Mod...
Page 55 - GroupId; Example #3: Add Member Ethernet Ports to the Aggregator Group; mtu disable; Example #5: Set Group LACP Mode to Static; lacp static
Switching Configuration 55 console(config)#mode simple Switching modes will immediately clear the configuration. Are you sure you want to continue? (y/n) To select Normal mode as the operational mode, use the no form of mode simple command. console(config)#no mode simple Example #2: Enter Port Aggre...
Page 56 - Example #6: Set Group LACP Mode to Dynamic; lacp auto; Example #9: Show Group MAC Address Table
56 Switching Configuration Example #6: Set Group LACP Mode to Dynamic Use the lacp auto command to set the LACP (Link Aggregation) mode to dynamic for that Aggregator Group. This means that when more than one uplink port is in the Group, those uplink ports will be enabled automatically with LACP. co...
Page 57 - Use the
Switching Configuration 57 Example #10: Show Group VLAN Table Use the show vlan [port-aggregator group < GroupId >] command to show the VLAN table for a particular aggregator group. [port-aggregator group <Group Id> is an optional parameter in the command and, if not specified, shows all...
Page 58 - Example #11: Show Group Configuration Summary
58 Switching Configuration Example #11: Show Group Configuration Summary Use the show port-aggregator group summary [< GroupId >] command to show the parameters configured on the aggregator group. <Group Id> is an optional parameter in the command and, if not specified, the command shows...
Page 59 - Simple Switch Mode Supported CLI Commands; These are existing commands that are documented in the; for your
Switching Configuration 59 Simple Switch Mode Supported CLI Commands Commands that were available in Interface mode of Normal switch mode are now available in Simple mode and can execute on a Port Aggregator group. For example, to apply any of the following commands on an aggregator group 1, enter t...
Page 60 - • Dot1x feature commands:
60 Switching Configuration • Dot1x feature commands: aaa authentication dot1x aaa authorization network default radius dot1x max-req dot1x port-control dot1x re-authenticate dot1x re-authentication dot1x system-auth-control dot1x timeout quiet-period dot1x timeout re-authperiod dot1x timeout server-...
Page 61 - • Port Channel Commands:
Switching Configuration 61 • Port Channel Commands: show interfaces port-channel show statistics port-channel • Radius commands: auth-port deadtime key priority radius-server deadtime radius-server host radius-server key radius-server retransmit radius-server source-ip radius-server timeout retransm...
Page 62 - • System Management Commands:
62 Switching Configuration user-key • System Management Commands: asset-tag hostname member movemanagement ping reload set description show sessions show supported switchtype show switch show system show system id show system power show users show version switch priority switch renumber telnet trace...
Page 63 - sFlow; the sFlow Collector for analysis.; sFlow Collector/Analyzer
Switching Configuration 63 ip https port ip https server key-generate location organization-unit show crypto certificate mycertificate show ip http show ip https state sFlow This section describes the sFlow feature. sFlow is the industry standard for monitoring high-speed switched and routed network...
Page 64 - sFlow Agents; sFlow Agents use two forms of sampling:
64 Switching Configuration • sFlow collector can receive data from multiple switches, providing a real-time synchronized view of the whole network. • The Collector can analyze traffic patterns based on protocols found in the headers (e.g., TCP/IP, IPX, Ethernet, AppleTalk…). This alleviates the need...
Page 65 - Counter Sampling; The following are examples of the commands used for sFlow.
Switching Configuration 65 Counter Sampling The primary objective of Counter Sampling is to efficiently, periodically export counters associated with Data Sources. A maximum Sampling Interval is assigned to each sFlow instance associated with a Data Source.Counter Sampling is accomplished as follows...
Page 66 - Example #5: Show sFlow sampling for receiver index 1
66 Switching Configuration Example #5: Show sFlow sampling for receiver index 1 console#show sflow 1 sampling Sampler Receiver Packet Max Header Data Source Index Sampling Rate Size ----------- ------- ------------- ---------- 1/g1 1 1500 50 1/g2 1 1500 50 1/g3 1 1500 50 1/g4 1 1500 50 1/g5 1 1500 5...
Page 67 - Routing Configuration; VLAN Routing; software to support VLAN routing.; provide the VLAN routing support shown in the diagram.
Routing Configuration 67 4 Routing Configuration This section describes configuration scenarios and instructions for the following routing features: • "VLAN Routing" on page 67• "Virtual Router Redundancy Protocol" on page 70• "Proxy Address Resolution Protocol (ARP)" on page...
Page 68 - Figure 4-1. VLAN Routing Example Network Diagram
68 Routing Configuration Figure 4-1. VLAN Routing Example Network Diagram Example 1: Create Two VLANs The following code sequence shows an example of creating two VLANs with egress frame tagging enabled. console#configure console(config)#vlan database console(config-vlan)#vlan 10 console(config-vlan...
Page 69 - Example 3: Set Up VLAN Routing for the VLANs and Assign an IP Address
Routing Configuration 69 console(config-if-1/g2)#exit console#configure console(config)#interface ethernet 1/g3 console(config-if-1/g3)#switchport mode general console(config-if-1/g3)#switchport general allowed vlan add 20 console(config-if-1/g3)#switchport general pvid 20 console(config-if-1/g3)#ex...
Page 70 - Using the Web Interface to Configure VLAN Routing; Virtual Router Redundancy Protocol
70 Routing Configuration Using the Web Interface to Configure VLAN Routing Use the following screens to perform the same configuration using the Web Interface: • Switching > VLAN > VLAN Membership . To create the VLANs and specify port participation. • Switching > VLAN > Port Settings . ...
Page 71 - Figure 4-2. VRRP Example Network Configuration
Routing Configuration 71 Figure 4-2. VRRP Example Network Configuration Example 1: Configuring VRRP on the Switch as a Master Router Enable routing for the switch. IP forwarding is then enabled by default. console#config console(config)#ip routing Configure the IP addresses and subnet masks for the ...
Page 72 - Enable VRRP on the port:
72 Routing Configuration Assign virtual router IDs to the port that will participate in the protocol: console(config)#interface vlan 50 console(config-if-vlan50)#ip vrrp 20 Specify the IP address that the virtual router function will recognize. The priority default is 255. console(config-if-vlan50)#...
Page 73 - Using the Web Interface to Configure VRRP; Example #2 Viewing the Interface Information
Routing Configuration 73 Enable VRRP on the port. console(config-if-vlan60)#ip vrrp 20 mode console(config-if-vlan60)#exit Using the Web Interface to Configure VRRP Use the following screens to perform the same configuration using the Graphical User Interface: • Routing > IP > Configuration. T...
Page 74 - OSPF; OSPF Concepts and Terms; Areas and Topology; areas
74 Routing Configuration Primary IP Address............................. 192.150.2.1/255.255.255.0 Routing Mode................................... Enable Administrative Mode............................ Enable Forward Net Directed Broadcasts................ Disable Proxy ARP.............................
Page 75 - OSPF Routers and LSAs
Routing Configuration 75 as 0.0.1.0). The area identified as 0.0.0.0 is referred to as Area 0 and is considered the OSPF backbone . All other OSPF areas in the network must connect to Area 0 directly or through a virtual link. The backbone area is responsible for distributing routing information bet...
Page 76 - • Enable routing for the switch:
76 Routing Configuration External routes are those imported into OSPF from other routing protocol or processes. OSPF computes the path cost differently for external type 1 and external type 2 routes. The cost of an external type 1 route is the cost advertised in the external LSA plus the path cost f...
Page 77 - Enable routing and assign IP for VLANs 70, 80 and 90.
Routing Configuration 77 Enable routing and assign IP for VLANs 70, 80 and 90. config interface vlan 70 routing ip address 192.150.2.2 255.255.255.0 exit interface vlan 80 routing ip address 192.130.3.1 255.255.255.0 exit interface vlan 90 routing ip address 192.64.4.1 255.255.255.0 exit exit config...
Page 78 - Example 2: Configuring Stub and NSSA Areas
78 Routing Configuration Example 2: Configuring Stub and NSSA Areas In this example, Area 0 connects directly to two other areas: Area 1 is defined as a stub area and Area 2 is defined as an NSSA area. NOTE: OSPFv2 and OSPFv3 can operate concurrently on a network and on the same interfaces (although...
Page 79 - Figure 4-4. OSPF Configuration—Stub Area and NSSA Area; Configure Router A; traffic outside the AS.
Routing Configuration 79 Figure 4-4. OSPF Configuration—Stub Area and NSSA Area Configure Router A : Router A is a backbone router. It links to an ASBR (not defined here) that routes traffic outside the AS. • Globally enable IPv6 and IPv4 routing: (console) #configure ipv6 unicast-routing ip routing...
Page 80 - • Define an OSPF router:
80 Routing Configuration ipv6 address 3000:3:100::/64 eui64 ip ospf area 0.0.0.0 ipv6 ospf exit • Define an OSPF router: ipv6 router ospf router-id 3.3.3.3 exit router ospf router-id 3.3.3.3 exit exit Configure Router B: Router B is a ABR that connects Area 0 to Areas 1 and 2. • Configure IPv6 and I...
Page 81 - routes when they are redistributed via OSPF:
Routing Configuration 81 ipv6 address 3000:2:4::/64 eui64 ipv6 ospf ipv6 ospf areaid 2 exit • For IPv4: Define an OSPF router. Define Area 1 as a stub. Enable OSPF for IPv4 on VLANs 10, 5, and 17 by globally defining the range of IP addresses associated with each interface, and then associating thos...
Page 82 - Figure 4-5. OSPF Configuration—Virtual Link; in the previous example.
82 Routing Configuration Figure 4-5. OSPF Configuration—Virtual Link Configure Router A : Router A is a backbone router. Configuration steps are similar to those for Router A in the previous example. (console)#configure ipv6 unicast-routing ip routing exit ipv6 router ospf router-id 3.3.3.3 exit int...
Page 84 - Routing Information Protocol; RIP Configuration; Routes are specified by IP destination network and hop count
84 Routing Configuration ipv6 ospf ipv6 ospf areaid 1 exit interface vlan 11 routing ip address 10.1.101.1 255.255.255.0 ipv6 address 3000:1:101::/64 eui64 ipv6 ospf ipv6 ospf areaid 2 exit ipv6 router ospf router-id 5.5.5.5 area 0.0.0.1 virtual-link 4.4.4.4 exit router ospf router-id 5.5.5.5 area 0...
Page 85 - address; shown in the network illustrated in Figure 4-6.
Routing Configuration 85 The PowerConnect M6220/M6348/M8024 switches support both versions of RIP. You may configure a given port: • To receive packets in either or both formats • To transmit packets formatted for RIP-1 or RIP-2 or to send RIP-2 packets to the RIP-1 broadcast address • To prevent an...
Page 86 - Example #4. Enable RIP for the VLAN Routing Interfaces
86 Routing Configuration Example #2: Enable Routing for Ports The following command sequence enables routing and assigns IP addresses for VLAN 2 and VLAN 3. console#config interface vlan 2 routing ip address 192.150.2.2 255.255.255.0 exit interface vlan 3 routing ip address 192.130.3.1 255.255.255.0...
Page 87 - Using the Web Interface to Configure RIP; Route Preferences; Assigning Administrative Preferences to Routing Protocols
Routing Configuration 87 Using the Web Interface to Configure RIP Use the following screens to perform the same configuration using the Graphical User Interface: • Routing > IP > Configuration> To enable routing for the switch. • Routing > IP > Interface Configuration > To configur...
Page 88 - Example 1: Configure Administrative Preferences
88 Routing Configuration Example 1: Configure Administrative Preferences The following commands configure the administrative preference for the RIP and OSPF: console#Config router rip distance rip 130 exit For OSPF, an additional parameter identifies the type of OSPF route that the preference value ...
Page 89 - Using Equal Cost Multipath; cause Link A to be overloaded while Link B is not used at all.
Routing Configuration 89 Using Equal Cost Multipath The equal cost multipath (ECMP) feature allows a router to use more than one next hop to forward packets to a given destination prefix. It can be used to promote a more optimal use of network resources and bandwidth.A router that does not use ECMP ...
Page 90 - not; Example 1: Configuring an ECMP Route; when the first two are unreachable:; Loopback Interfaces
90 Routing Configuration Routing protocols can also be configured to compute ECMP routes. For example, referring to Figure 4-8, if OSPF were configured in on both links connecting Router A and Router B, and if Router B advertised its connection to 20.0.0.0/8, then Router A could compute an OSPF rout...
Page 91 - Next, you assign an IPv4 or IPv6 address to the interface:
Routing Configuration 91 Loopbacks are typically used for device management purposes. A client can use the loopback interface to communicate with the router through various services such as telnet and SSH. The address on a loopback behaves identically to any of the local addresses of the router in t...
Page 92 - IP Helper; Table 4-1. Default Ports - UDP Port Numbers Implied By Wildcard; Protocol
92 Routing Configuration IP Helper The IP Helper feature provides the ability for a router to forward configured UDP broadcast packets to a particular IP address. This allows applications to reach servers on non-local subnets. This is possible even when the application is designed to assume a server...
Page 93 - addresses. Otherwise the packet is not relayed.; broadcast address for the receive interface.
Routing Configuration 93 Certain pre-existing configurable DHCP relay options do not apply to relay of other protocols. These options are unchanged. The user may optionally set a maximum hop count or minimum wait time using the bootpdhcprelay maxhopcount and bootpdhcprelay minwaittime commands.The r...
Page 94 - the following commands:
94 Routing Configuration Example 2: Configure IP Helper Globally (DHCP) To relay DHCP packets received on any interface to two DHCP servers (10.1.1.1 and 10.1.2.1), use the following commands: console (config)#ip helper-address 10.1.1.1 dhcp console (config)#ip helper-address 10.1.2.1 dhcp Example 3...
Page 95 - Example 7: Show IP Helper Configurations
Routing Configuration 95 Example 7: Show IP Helper Configurations The following command shows IP Helper configurations: console#show ip helper-address IP helper is enabled Interface UDP Port Discard Hit Count Server Address --------------- ----------- -------- ---------- --------------- vlan 100 dhc...
Page 97 - Device Security; x Network Access Control; credentials of the supplicant on behalf of the Authenticator.
Device Security 97 5 Device Security This section describes configuration scenarios for the following features: • "802.1x Network Access Control" on page 97• "802.1X Authentication and VLANs" on page 100• "802.1x MAC Authentication Bypass (MAB)" on page 103• "Authenticati...
Page 98 - x Network Access Control Examples; Example #1: Configure RADIUS Server for Authentication; secret; resources are located.
98 Device Security Completion of an authentication exchange requires all three roles. The PowerConnect M6220/M6348/M8024 switches support the authenticator role only, in which the PAE is responsible for communicating with the supplicant. The authenticator PAE is also responsible for submitting infor...
Page 99 - devices that can authenticate on that port to 3. The
Device Security 99 IP address Type Port TimeOut Retran. DeadTime Source IP Prio. Usage ------------- ----- ----- ------- ------- -------- ------------- ----- ----- 10.27.5.157 Auth 1812 Global Global Global 10.27.65.13 0 all Global values Configured Authentication Servers : 1 Configured Accounting S...
Page 100 - X Authentication and VLANs; selected VLAN as part of the authentication.; Authenticated and Unauthenticated VLANs; limited network access.
100 Device Security Administrative Mode............... Enabled Port Admin Oper Reauth Reauth Mode Mode Control Period ------- ------------------ ------------ -------- ---------- 1/g8 mac-based Unauthorized FALSE 3600 Quiet Period................................... 60 Transmit Period....................
Page 101 - VLANID is 12-bits and has a value between 1 and 4093.; Guest VLAN; authorized and assigned Guest VLAN IDs.
Device Security 101 Much of the configuration to assign hosts to a particular VLAN takes place on the RADIUS server or 802.1X authenticator. If you use an external RADIUS server to manage VLANs, you configure the server to use Tunnel attributes in Access-Accept messages in order to inform the switch...
Page 103 - Operation in the Network
Device Security 103 802.1x MAC Authentication Bypass (MAB) MAB is a supplemental authentication mechanism that allows 802.1x unaware clients, such as printers and fax machines, to authenticate to the network using the client MAC address as an identifier. The known and allowable MAC address and corre...
Page 105 - Example 2: Show MAB Configuration; Authentication Server Filter Assignment; the following command in Interface Config mode:
Device Security 105 Example 2: Show MAB Configuration To show the MAB configuration for interface 1/5, use the following command: console#show dot1x ethernet 1/g5 Administrative Mode............... Enabled Port Admin Oper Reauth Reauth Mode Mode Control Period ------- ------------------ ------------...
Page 106 - This section describes the Access Control Lists (ACLs) feature.; ACLs operate on Layers 3 and 4.
106 Device Security Filter-id = “internet_access” 3 The DiffServ policy specified in the attribute must already be configured on the switch, and the policy names must be identical.For information about configuring a DiffServ policy, see "Differentiated Services" on page 137. The section, ...
Page 107 - Limitations; MAC ACLs
Device Security 107 Limitations The following limitations apply to ingress and egress ACLs. • Maximum of 100 ACLs.• Maximum rules per ACL is 127.• You can configure mirror or redirect attributes for a given ACL rule, but not both.• The PowerConnect M6220/M6348/M8024 switches support a limited number...
Page 108 - IP ACLs
108 Device Security IP ACLs IP ACLs classify for Layers 3 and 4.Each ACL is a set of up to ten rules applied to inbound traffic. Each rule specifies whether the contents of a given field should be used to permit or deny access to the network, and may apply to one or more of the following fields with...
Page 109 - Figure 5-3. IP ACL Example Network Diagram
Device Security 109 Figure 5-3. IP ACL Example Network Diagram Example #1: Create an ACL and Define an ACL Rule This command creates an ACL named list1 and configures a rule for the ACL. After the mask has been applied, it permits packets carrying TCP traffic that matches the specified Source IP add...
Page 110 - Example #2: Define the Second Rule for ACL 179; MAC ACL CLI Examples
110 Device Security Example #2: Define the Second Rule for ACL 179 Define the rule to set similar conditions for UDP traffic as for TCP traffic. console(config)#access-list list1 permit udp 192.168.77.0 0.0.0.255 192.168.77.3 0.0.0.255 console(config)#exit Example #3: Apply the Rule to Outbound (Egr...
Page 111 - Example #6 Configure MAC Access Group
Device Security 111 log Configure logging for this access list rule. mirror Configure the packet mirroring attribute. redirect Configure the packet redirection attribute. vlan Configure a match condition based on a VLAN ID. <0x0600-0xffff> Enter a four-digit hexadecimal number in the range of ...
Page 112 - Example #7: Setup an ACL with Permit Action
112 Device Security Example #7: Setup an ACL with Permit Action console# Config console(config)#mac access-list extended mac2 console(config-mac-access-list)#permit ? any Configure a match condition for all the source MAC addresses in the Source MAC Address field. <srcmac> Enter a MAC Address....
Page 113 - RADIUS; RADIUS Configuration Examples
Device Security 113 MAC ACL Name: mac1 Rule Number: 1 Action......................................... deny Destination MAC Address........................ 00:11:22:33:44:55 Destination MAC Mask........................... 00:00:00:00:FF:FF Log............................................ TRUE RADIUS M...
Page 114 - Example #1: Basic RADIUS Server Configuration; secret1; and; secret2; respectively. The server at
114 Device Security Example #1: Basic RADIUS Server Configuration This example configures two RADIUS servers at 10.10.10.10 and 11.11.11.11. Each server has a unique shared secret key. The shared secrets are configured to be secret1 and secret2 respectively. The server at 10.10.10.10 is configured a...
Page 115 - Identifier must be present in an Access-Request packet.; network it is used only to encrypt the data.
Device Security 115 console(config)#aaa authentication dot1x default radius Example #2: Set the NAS-IP Address for the RADIUS Server The NAS-IP address attribute identifies the IP Address of the network authentication server (NAS) that is requesting authentication of the user. The address should be ...
Page 116 - TACACS+ Configuration Example
116 Device Security TACACS+ Configuration Example This example configures two TACACS+ servers at 10.10.10.10 and 11.11.11.11. Each server has a unique shared secret key. The server at 10.10.10.10 has a default priority of 0, the highest priority, while the other server has a priority of 2. The proce...
Page 117 - Captive Portal; components as required.; Functional Description
Device Security 117 console(config)#priority 2 console(config)#exit console(config)#aaa authentication login tacacsList tacacs local Captive Portal Overview Captive Portal feature is a software implementation that allows client access only on user verification. Verification can be configured to allo...
Page 118 - emerging from the client will be forwarded through the switch.; Captive Portal Configuration, Status and Statistics; Captive Portal Configuration; Client Access, Authentication, and Control
118 Device Security There are three states for clients connecting to the Captive Portal interface: • Unknown State• Unauthenticated State• Authenticated State In the unknown state, the CP doesn't redirect HTTP/S traffic to the switch, but queries the switch to determine whether the client is authent...
Page 120 - Client Authentication Logout Request; Javascript is enabled and popup windows are allowed.; Web Page Customization; The following is an example that shows Unicode input.
120 Device Security Client Authentication Logout Request The administrator can configure and enable 'user logout'. This feature allows the authenticated client to deauthenticate from the network. In response to the request, the authenticated user is removed from the connection status tables. If the ...
Page 121 - Captive Portal Configuration Management; Captive Portal Status; Captive Portal status is available primarily through 3 tables:
Device Security 121 Captive Portal Configuration Management In order to provide text-based compatibility, Captive Portal converts the binary image data to text (and vice versa) through special CLI commands that are only issued for script files. Although the data is shown in ASCII, it not for the end...
Page 122 - a trap is sent for every rejected client.; Captive Portal Statistics; Example 1: Enter Captive Portal configuration mode
122 Device Security The size of the table has a limit of 1024 entries. If the list becomes full, new table entries are rejected and a trap is sent for every rejected client. Captive Portal Statistics Client session statistics are available for both guest and authenticated users.Client statistics are...
Page 123 - Example 5: Show Captive Portal
Device Security 123 Example 5: Show Captive Portal To show the status of Captive Portal, use the following command: console#show captive-portal Administrative Mode....................... Enabled Operational Status........................ Enabled Disable Reason............................ Administrat...
Page 124 - To create a local user, use the following command:
124 Device Security Max Input Octets (bytes)....................... 0 Max Output Octets (bytes)...................... 0 Max Total Octets (bytes)....................... 0 To create a local user, use the following command: console(Config-CP)#user 1 name user1 console(config-CP)#user 1 password Enter p...
Page 125 - This command shows a statistics for the above client
Device Security 125 CP ID.......................................... 1 CP Name........................................ Default Client Client MAC Address IP Address Interface Interface Description ----------------- --------------- --------- -------------------------- 00:12:79:BF:94:7A 192.168.1.10 1/g...
Page 127 - This section includes the following subsections:; and parallel to that provided for IPv4.; Interface Configuration; configured interface IDs.
IPv6 127 6 IPv6 This section includes the following subsections: • "Overview" on page 127• "Interface Configuration" on page 127• "DHCPv6" on page 130 Overview There are many conceptual similarities between IPv4 and IPv6 network operation. Addresses still have a network prefi...
Page 128 - Device 1
128 IPv6 While optional in IPv4, router advertisement is mandatory in IPv6. Router advertisements specify the network prefix(es) on a link which can be used by receiving hosts, in conjunction with an EUI64 identifier, to auto configure a host’s address. Routers have their network prefixes configured...
Page 129 - Device 2
IPv6 129 ipv6 router ospf router-id 1.1.1.1 exit interface vlan 15 routing ip address 20.20.20.1 255.255.255.0 ip ospf area 0.0.0.0 exit interface vlan 2 routing ipv6 enable ipv6 address 2020:1::1/64 ipv6 ospf ipv6 ospf network point-to-point exit interface tunnel 0 ipv6 address 2001::1/64 tunnel mo...
Page 131 - Figure 6-2. DHCPv6 Prefix Delegation Scenario
IPv6 131 causes DHCPv6 clients to send the DHCPv6 “Information Request” message in response. A DHCPv6 server then responds by providing only networking definitions such as DNS domain name and server definitions, NTP server definitions, and/or SIP definitions.RFC 3315 also describes DHCPv6 Relay Agen...
Page 132 - DHCPv6 pool configuration:
132 IPv6 DHCPv6 pool configuration: console# config ipv6 dhcp pool testpool domain-name dell.com dns-server 2001::1 exit exit Per-interface DHCPv6 configuration: console#config interface vlan 15 ipv6 dhcp server testpool preference 10 exit exit
Page 133 - Quality of Service; Class of Service Queuing; forwarded according to this default.; Ingress Port Configuration; Trusted and Untrusted Ports/CoS Mapping Table
Quality of Service 133 7 Quality of Service This section includes the following subsections: • "Class of Service Queuing" on page 133• "Differentiated Services" on page 137 Class of Service Queuing The Class of Service (CoS) feature lets you give preferential treatment to certain typ...
Page 134 - CoS Mapping Table for Trusted Ports; Egress Port Configuration—Traffic Shaping; limit of the transmission bandwidth used.; Queue configuration; to a full queue is dropped regardless of its importance.; default port priority (2) to direct packet C to egress queue 1.
134 Quality of Service CoS Mapping Table for Trusted Ports Mapping is from the designated field values on trusted ports’ incoming packets to a traffic class priority (actually a CoS traffic queue). The trusted port field-to-traffic class configuration entries form the Mapping Table the switch uses t...
Page 135 - Figure 7-1. CoS Mapping and Queue Configuration
Quality of Service 135 Figure 7-1. CoS Mapping and Queue Configuration Continuing this example, you configured the egress Port 1/g8 for strict priority on queue 6, and a set a weighted scheduling scheme for queues 5-0. Assuming queue 5 has a higher weighting than queue 1 (relative weight values show...
Page 137 - Differentiated Services; depending on the role of the switch in your network:; Edge device; services using the appropriate queue management algorithms.; Class; type
Quality of Service 137 Differentiated Services Differentiated Services (DiffServ) is one technique for implementing Quality of Service (QoS) policies. Using DiffServ in your network allows you to directly configure the relevant parameters on the switches and routers rather than using a resource rese...
Page 138 - Service –; Assigns a policy to an interface for inbound traffic.; Figure 7-3. DiffServ Internet Access Example Network Diagram; criteria—Source IP address—for the new classes.
138 Quality of Service • Service – Assigns a policy to an interface for inbound traffic. CLI Example This example shows how a network administrator can provide equal access to the Internet (or other external network) to different departments within a company. Each of four departments has its own Cla...
Page 139 - CoS queue settings established below.
Quality of Service 139 exit class-map match-all marketing_dept match srcip 172.16.20.0 255.255.255.0 exit class-map match-all test_dept match srcip 172.16.30.0 255.255.255.0 exit class-map match-all development_dept match srcip 172.16.40.0 255.255.255.0 exit Create a DiffServ policy for inbound traf...
Page 140 - DiffServ for VoIP Configuration Example
140 Quality of Service exit Set the CoS queue configuration for the (presumed) egress interface 1/g5 such that each of queues 1, 2, 3 and 4 get a minimum guaranteed bandwidth of 25%. All queues for this interface use weighted round robin scheduling by default. The DiffServ inbound policy designates ...
Page 141 - Figure 7-4. DiffServ VoIP Example Network Diagram
Quality of Service 141 Figure 7-4. DiffServ VoIP Example Network Diagram
Page 142 - Example #2: Configuring DiffServ VoIP Support
142 Quality of Service Example #2: Configuring DiffServ VoIP Support Enter Global Config mode. Set queue 6 on all ports to use strict priority mode. This queue shall be used for all VoIP packets. Activate DiffServ for the switch. console#config cos-queue strict 6 diffserv Create a DiffServ classifie...
Page 143 - Multicast
Multicast 143 8 Multicast Overview IP Multicasting enables a network host (or multiple hosts) to send an IP datagram to multiple destinations simultaneously. The initiating host sends each multicast datagram only once to a destination multicast group address, and multicast routers forward the datagr...
Page 144 - IGMP Configuration; IGMP Proxy; protocol on its downstream interfaces.
144 Multicast IGMP Configuration The Internet Group Management Protocol (IGMP) is used by IPv4 hosts to send requests to join (or leave) multicast groups so that they receive (or discontinue receiving) packets sent to those groups. In IPv4 multicast networks, multicast routers are configured with IG...
Page 145 - Example #1: Configuring IGMP Proxy on the Router
Multicast 145 The IGMP proxy offers a mechanism for multicast forwarding based only on IGMP membership information. The router must decide about forwarding packets on each of its interfaces based on the IGMP membership information. The proxy creates the forwarding entries based on the membership inf...
Page 146 - DVMRP; Prune messages; to
146 Multicast • Use the following command to display interface parameters when IGMP Proxy is enabled: console#show ip igmp-proxy interface • Use this command to display information about multicast groups that IGMP proxy reported. It displays a table of entries with the following as the fields of eac...
Page 147 - router
Multicast 147 CLI Example The following example configures two DVMRP interfaces. First, this example configures an OSPF router 1 and globally enables IP routing and IP multicast. IGMP is globally enabled so that this router can manage group membership information for its directly-connected hosts (IG...
Page 148 - PIM
148 Multicast PIM Protocol Independent Multicast (PIM) is a standard multicast routing protocol that provides scalable inter-domain multicast routing across the Internet, independent of the mechanisms provided by any particular unicast routing protocol. PIM has two types: • PIM-Dense Mode (PIM-DM)• ...
Page 149 - NOTE
Multicast 149 Example: PIM-SM The following example configures PIM-SM for IPv4 on a router.First, configure an OSPF 1 router and globally enable IP routing, multicast, IGMP, and PIM-SM. Next, configure a PIM-SM rendezvous point with an IP address and group range. The IP address will serve as an RP f...
Page 151 - Utility; This section describes the Auto Config commands.; Auto Config; Assignment (configuration) of an IP address for the device; IP Address Assignment
Utility 151 9 Utility This section describes the Auto Config commands. Auto Config Overview Auto Config is a software feature that automatically configures a switch when the device is initialized and no configuration file is found on the switch. Auto Config is accomplished in three phases: 1 Assignm...
Page 152 - response to the; hostname; Assignment of TFTP Server
152 Utility After an IP address is assigned to the switch, if a hostname is not already assigned, Auto Config issues a DNS request for the corresponding hostname. This hostname is also displayed as the CLI prompt (as in response to the hostname command). Assignment of TFTP Server The following infor...
Page 153 - command; ip host; >. If the default network configuration file does not contain; Table 9-1. Configuration File Possibilities
Utility 153 The default network configuration file should have IP address to hostname mappings using the command ip host < hostname > < address >. If the default network configuration file does not contain the switch's IP address, the switch uses DNS to attempt to resolve its hostname.A ...
Page 154 - Monitoring and Completing the Auto Config Process; Saving a Configuration; TFTP Server Address Available Host-specific Router Config
154 Utility Table 9-2. TFTP Request Types Monitoring and Completing the Auto Config Process When a switch begins bootup and there is no saved configuration, a message appears on the console informing the user that the Auto Config procedure is starting. A message also appears when Auto Config complet...
Page 155 - Restarting the Auto Config Process; Specifying a Default Router; server response contains only the hostname for the TFTP server.
Utility 155 A file is not automatically deleted after it is downloaded. The file does not take effect upon a reboot unless an administrator opts to save config (the saved configuration takes effect upon reboot). If the user does not opt to save config, the Auto Config process occurs again on a subse...
Page 156 - Other Functions; CLI Scripting; files, query Auto Config status, and to stop or restart the feature.; Logging; A message is logged for each of the following events:; SIM; message type is sent to request Auto Config boot options.
156 Utility Other Functions CLI Scripting CLI scripting can apply config files. It can be used to manage (view, validate, delete) downloaded config files, query Auto Config status, and to stop or restart the feature. Logging A message is logged for each of the following events: • Auto Config compone...
Page 157 - Stacking; configuration, the config file is distributed across a stack.; Example 1: Show Auto Config Process
Utility 157 Stacking The downloaded configuration file is not distributed across a stack. When an administrator saves configuration, the config file is distributed across a stack. CLI Examples Example 1: Show Auto Config Process To display the current status of the Auto Config process, use the follo...
Page 158 - Example 2: Enable Auto Config
158 Utility Example 2: Enable Auto Config To start or stop Auto Config on the switch, use the following commands: console#boot host dhcp console#no boot host dhcp