HP 3400CL-24G - Manual

HP 3400CL-24G

HP 3400CL-24G – Manual, read for free online in PDF format. We hope this helps you resolve any issues you may have. If you have further questions, please contact us through the contact form.

1 Page 1
2 Page 2
3 Page 3
4 Page 4
5 Page 5
6 Page 6
7 Page 7
8 Page 8
9 Page 9
10 Page 10
11 Page 11
12 Page 12
13 Page 13
14 Page 14
15 Page 15
16 Page 16
17 Page 17
18 Page 18
19 Page 19
20 Page 20
21 Page 21
22 Page 22
23 Page 23
24 Page 24
25 Page 25
26 Page 26
27 Page 27
28 Page 28
29 Page 29
30 Page 30
31 Page 31
32 Page 32
33 Page 33
34 Page 34
35 Page 35
36 Page 36
37 Page 37
38 Page 38
39 Page 39
40 Page 40
41 Page 41
42 Page 42
43 Page 43
44 Page 44
45 Page 45
46 Page 46
47 Page 47
48 Page 48
49 Page 49
50 Page 50
51 Page 51
52 Page 52
53 Page 53
54 Page 54
55 Page 55
56 Page 56
57 Page 57
58 Page 58
59 Page 59
60 Page 60
61 Page 61
62 Page 62
63 Page 63
64 Page 64
65 Page 65
66 Page 66
67 Page 67
68 Page 68
69 Page 69
70 Page 70
71 Page 71
72 Page 72
73 Page 73
74 Page 74
75 Page 75
76 Page 76
77 Page 77
78 Page 78
79 Page 79
80 Page 80
81 Page 81
82 Page 82
83 Page 83
84 Page 84
85 Page 85
86 Page 86
87 Page 87
88 Page 88
89 Page 89
90 Page 90
91 Page 91
92 Page 92
93 Page 93
94 Page 94
95 Page 95
96 Page 96
97 Page 97
98 Page 98
99 Page 99
100 Page 100
101 Page 101
102 Page 102
103 Page 103
104 Page 104
105 Page 105
106 Page 106
107 Page 107
108 Page 108
109 Page 109
110 Page 110
111 Page 111
112 Page 112
113 Page 113
114 Page 114
115 Page 115
116 Page 116
117 Page 117
118 Page 118
119 Page 119
120 Page 120
121 Page 121
122 Page 122
123 Page 123
124 Page 124
125 Page 125
126 Page 126
127 Page 127
128 Page 128
129 Page 129
130 Page 130
131 Page 131
132 Page 132
133 Page 133
134 Page 134
135 Page 135
136 Page 136
137 Page 137
138 Page 138
139 Page 139
140 Page 140
141 Page 141
142 Page 142
143 Page 143
144 Page 144
145 Page 145
146 Page 146
147 Page 147
148 Page 148
149 Page 149
150 Page 150
151 Page 151
152 Page 152
153 Page 153
154 Page 154
155 Page 155
156 Page 156
157 Page 157
158 Page 158
159 Page 159
160 Page 160
161 Page 161
162 Page 162
163 Page 163
164 Page 164
165 Page 165
166 Page 166
167 Page 167
168 Page 168
169 Page 169
170 Page 170
171 Page 171
172 Page 172
173 Page 173
174 Page 174
175 Page 175
176 Page 176
177 Page 177
178 Page 178
179 Page 179
180 Page 180
181 Page 181
182 Page 182
183 Page 183
184 Page 184
185 Page 185
186 Page 186
187 Page 187
188 Page 188
189 Page 189
190 Page 190
191 Page 191
192 Page 192
193 Page 193
194 Page 194
195 Page 195
196 Page 196
197 Page 197
Page: / 197

Table of Contents:

  • Page 3 – iii; Contents
  • Page 4 – iv
  • Page 7 – vii
  • Page 8 – viii
  • Page 9 – ix
  • Page 11 – Software Updates; Software Updates; View or Download the Software Manual Set
  • Page 12 – N o t e; Downloading Software to the Switch; copy xmodem; N o t e; Management and
  • Page 13 – TFTP Download from a Server; Figure 1; Logon Default; Xmodem Download From a PC or Unix Workstation
  • Page 14 – Transfer; Send
  • Page 15 – Saving Configurations While Using the CLI; The switch operates with two configuration files:; write memory; When exiting from the CLI to the Main Menu, press
  • Page 16 – Install Recommendations for I.08.12 Boot ROM Update; Rebooting the System
  • Page 17 – ProCurve Switch, Routing Switch, and Router Software Keys; ProCurve Access Point 530
  • Page 18 – Software
  • Page 19 – Minimum Software Versions for Series 3400cl Switch Features; For Software Features.; minimum software version each feature requires:; Minimum Software Version Required by Feature; ProCurve Device; J8435A ProCurve 10-GbE Media Flex Module; Operating System
  • Page 20 – Switch Management Access Security; Switch Management Access Security; Default Settings Affecting Security; Telnet
  • Page 21 – Local Manager Password; password manager; Inbound Telnet Access and Web Browser Access; Advanced Traffic; Secure File Transfers; Management and Configuration Guide
  • Page 22 – SNMP Access; General SNMP Access to the Switch.; configuring for access authentication and privacy; SNMP Access to the Switch’s Authentication Configuration MIB .; A management station; snmp-server mib hpswitchauthmib excluded
  • Page 23 – Disable SNMP version 2c on the switch.; Physical Access to the Switch; Physical access to the switch allows the following:
  • Page 24 – Other Provisions for Management Access Security; Authorized IP Managers.; Access Security Guide; Secure Management VLAN.; Advanced Traffic Management Guide; RADIUS Authentication.; Access Security Guide; Access Control Lists (ACLs) for Management Access Protection.
  • Page 25 – Network Access Security; Web and MAC Authentication
  • Page 26 – switch SSH and user password authentication:; Traffic/Security Filters
  • Page 27 – Inbound traffic from a designated, physical source-port will be
  • Page 28 – Access; switch operation as a supplicant
  • Page 29 – Connection-Rate Filtering Based On Virus-Throttling Technology; Products and Solutions
  • Page 30 – Operating Notes for Jumbo Traffic-Handling; Operating Notes for Jumbo Traffic-Handling; Table 1 lists updates to the manual set dated January, 2005.; Table 1. Publication Updates for Manual Set Dated January, 2005; Edition; The; show lldp info stats; is an invalid command.; show lldp stats
  • Page 31 – IGMP Command Update; Using Delayed Group Flush.; Syntax
  • Page 32 – setmib; IGMP Operating Notes.; General Switch Traffic Security Guideline
  • Page 33 – Port security; The Management VLAN IP Address
  • Page 34 – Known Issues; This switch needs replacement during next scheduled downtime ?
  • Page 35 – Enhancements; “Release
  • Page 36 – Using Fastboot To Reduce Boot Time; in a faster boot time.; CLI Port Rate Display; show interface port-utilization; to display; fastboot; show fastboot
  • Page 37 – Figure 2. Example rate display output for ports; Operating Notes; As in previous software versions, the; show interfaces; Software fixes only no new enhancements.
  • Page 38 – DNS Resolver; ping; Terminology; Domain Suffix —
  • Page 39 – Basic Operation; must
  • Page 41 – Configuring a DNS Entry; Figure 5
  • Page 42 – DNS Server IP Address; DNS Server; Switch IP Address
  • Page 43 – As mentioned under; and; traceroute; . For example, using the document server in; Viewing the Current DNS Configuration; show ip; ProCurve# ping docservr
  • Page 44 – Figure 9. Example of Viewing the Current DNS Configuration; or; requests is also limited.; command output shows only IP addresses.
  • Page 45 – Event Log Messages; Using SNMP To View and Configure Switch Authentication Features; including; Message; DNS server address not configured
  • Page 46 – S e c u r i t y N o t e s; “Enforcing Switch Security” on page 10; command to disable this access, as; Changing and Viewing the SNMP Access Configuration; included
  • Page 47 – show
  • Page 48 – MSTP Default Path Cost Controls; Running configuration:
  • Page 49 – QoS Pass-Through Mode; Table 2; All queues are the same size.; optimized; Most traffic is not prioritized.
  • Page 50 – Configuring QoS Pass-Through Mode Through the CLI.; The following example changes the; Qos passthrough mode : balanced
  • Page 51 – The following example changes the QoS Pass-Through Mode to; command verifies; Displaying the Current QoS Pass-Through Mode on the Switch; typical
  • Page 52 – balanced; mode matches the QoS Pass-through mode on the ProCurve Series 2800
  • Page 53 – Example; Table 3; mac
  • Page 54 – Table 3. DHCP Operation for the Topology in Figure; If the Management VLAN IP address configuration changes after; UDP Broadcast Forwarding; A only
  • Page 56 – Table 4
  • Page 57 – Table 4. Contrasting Dynamic and Static ACLs
  • Page 58 – permit; Destination IP Address; deny in ip from any to any
  • Page 59 – permit in ip from any to any; from the authenticated source; ACL Mask; Caution Regarding the Use of Source Routing; route; General Operation; How a RADIUS Server Applies a RADIUS-Based ACL to a Switch Port.
  • Page 60 – (“deny any any”) ACE that denies IP traffic not specifically; N o t e s; On any ACL assigned to a port, there is an implicit; The Packet-filtering Process; Sequential Comparison and Action.; When an ACL filters a packet from an authenticated client,
  • Page 61 – Figure 3. Example of Sequential Comparison; Because of this; Compares the packet to this ACE first.; Deny in tcp from any to any 23
  • Page 62 – Figure 4. The Packet-Filtering Process in an ACL with
  • Page 63 – Figure 5. Example of How a RADIUS-Based ACL Filters Packets; RADIUS-based ACLs include an implicit “deny IP; (“permit any any”) as the last explicit; implicit deny in ip any to any
  • Page 64 – General Steps; Plan ACLs to execute traffic policies:; Determining Traffic Policies; permit in ip from; What traffic can be blocked simply by relying on the implicit; that is
  • Page 65 – cnt; (counter) feature in ACEs where you want to know this; C a u t i o n; Planning the ACLs Needed To Enforce Traffic Policies; Guidelines for Structuring a RADIUS-Based ACL.; RADIUS-based ACLs filter only the inbound IP traffic from an
  • Page 66 – Explicitly Denying Any IP Traffic:; Operating Rules for RADIUS-Based ACLs; Port Trunks Excluded:; “Configuring an ACL in a RADIUS Server” on page 58; Multiple Clients Using the Same Username/Password Pair:
  • Page 67 – Table 5. Limits Affecting RADIUS-Based ACL Applications; Item; Limit Notes; Up to
  • Page 68 – Configuring an ACL in a RADIUS Server; Elements in a RADIUS-Based ACL Configuration.
  • Page 69 – “Guidelines for; users; “Format Details for ACEs Configured in a
  • Page 70 – Format Details for ACEs Configured in a RADIUS-Based ACL.; Has one of the following destination types:
  • Page 71 – mask; tcp
  • Page 72 – Configuring the Switch To Support RADIUS-Based ACLs; the chapter titled “RADIUS Authentication and; networking accounting is configured on the switch.
  • Page 73 – MAC Authentication Option; Web Authentication Option
  • Page 74 – Displaying the Current RADIUS-Based ACL Activity on the Switch; (counter) is included in an ACE, then the output includes the current; Packet Hit Counter : 0
  • Page 75 – Open; = active connection with an external device; Closed; = no active connection with an external device
  • Page 76 – Port Access Authenticator Status
  • Page 77 – Appears in response to the CLI; show access-list radius; command when there is not currently a RADIUS
  • Page 78 – SFlow Show Commands; sFlow —; Viewing SFlow Configuration; show sflow agent
  • Page 79 – Figure 13. Viewing sFlow Agent Information; show sflow destination; Note the following details:; Destination Address; remains blank unless it has been configured on the switch via SNMP.; Datagrams Sent; ment station since the switch agent was last enabled.; Timeout; show sflow sampling-polling
  • Page 80 – show sflow all; sFlow status information for all the ports on the switch.; Instrumentation Monitor; Parameter Name
  • Page 81 – “Configuring Instrumentation Monitor” on page 73
  • Page 82 – K n o w n L i m i t a t i o n s
  • Page 83 – Configuring Instrumentation Monitor; instrumentation monitor; you wish to modify, and revise the threshold limits as needed.; enabled
  • Page 84 – Examples; show instrumentation monitor configuration
  • Page 85 – Figure 18. Viewing the Instrumentation Monitor Configuration; TCP/UDP Port Closure; The following ports and services are affected by this change:; TFTP; ProCurve# show instrumentation monitor configuration
  • Page 86 – Enabling/Disabling TFTP; snmp-server enable traps; Enabling/Disabling RIP; Enables or disables the TFTP client.; tftp; command can be used to enable
  • Page 87 – router rip; must be enabled in order to open the port on the switch.; Enabling/Disabling Stacking; stack; Spanning Tree Show Commands; show spanning-tree detail
  • Page 88 – Figure 19. Example of Show Spanning-Tree Detail; TC Detected; counter shows the number of TC notifications sent out of the port.
  • Page 91 – Figure 20. UDLD Example
  • Page 92 – Configuration Considerations; Configuring UDLD; The following commands allow you to configure UDLD via the CLI.
  • Page 93 – Changing the Keepalive Interval.; By default, ports enabled for UDLD send a link health-check; Changing the Keepalive Retries.; By default, a port waits five seconds to receive a health-check; Configuring UDLD for Tagged Ports.; The default implementation of UDLD sends the UDLD
  • Page 94 – Viewing UDLD Information; show link-keepalive
  • Page 95 – Displaying Summary UDLD Information.; To display summary information on all UDLD-enabled
  • Page 96 – Displaying Detailed UDLDP Status Information.; To display detailed UDLD information for; show link-keepalive statistics; To clear UDLD statistics, enter the following command:; show link
  • Page 97 – Configuration Warnings and Event Log Messages; possible causes, when UDLD is configured for tagged ports.; Table 7. UDLD Event Log Messages; warning messages will also be logged in the switch’s event log.
  • Page 98 – Spanning Tree Per-Port BPDU Filtering; Here are some sample scenarios in which this feature may be used:; for details). BPDU protection will take; Configuring STP BPDU Filters
  • Page 99 – Viewing Status of BPDU Filtering; detail; command has been extended to show per-port BPDU filter
  • Page 100 – Viewing Configuration of BPDU Filtering; configuration; command displays the BPDU’s filter state.; Multiple Spanning Tree (MST) Information
  • Page 101 – RSTP/MSTP BPDU Protection; . When this feature is enabled on a port, the switch will; Spanning Tree BPDU Protection
  • Page 102 – Figure 27. Example of BPDU Protection Enabled at the Network Edge; BPDU —; transmitting BPDU frames on a specific port.; BPDU Protection —
  • Page 103 – STP —; Multiple Instance Spanning-Tree Operation; Configuring STP BPDU Protection; For example, to configure BPDU protection on ports 1 to 10, enter:; Enables/disables the BPDU protection feature on a port
  • Page 104 – Viewing BPDU Protection Status
  • Page 105 – Configuring Loop Protection; “Spanning Tree BPDU
  • Page 106 – Figure 28. Example of Show Loop Protect Display; Status and Counters - Loop Protection Information
  • Page 108 – both
  • Page 109 – controlled-direction both; controlled-directions in
  • Page 110 – Password Command; password; manager
  • Page 111 – plaintext; Scheduled Reload; dd
  • Page 112 – How RADIUS-Based Authentication Affects VLAN Operation; VLAN Assignment on a ProCurve Port
  • Page 113 – If the port is assigned as a member of an untagged
  • Page 115 – Example of an Active VLAN Configuration; Figure 8; show vlan; Figure 9
  • Page 117 – interface
  • Page 118 – Concurrent TACAS+ and SFTP; aaa authentication login privilege-mode; aaa authentication
  • Page 119 – Dynamic ARP Protection; Introduction; Multicast and Routing Guide
  • Page 120 – Enabling Dynamic ARP Protection; command at the global configuration level.; arp protect; command is shown here:
  • Page 121 – Configuring Trusted Ports; The switch intercepts all ARP requests and responses on the port.; Figure 12. Configuring Trusted Ports for Dynamic ARP Protection
  • Page 122 – Adding an IP-to-MAC Binding to the DHCP Database
  • Page 124 – Verifying the Configuration of Dynamic ARP Protection; show arp protect; Displaying ARP Packet Statistics; show arp protect statistics; ARP Protection Information
  • Page 125 – Monitoring Dynamic ARP Protection; debug arp protect; Software fixes only, no new enhancements.
  • Page 126 – Configuring MSTP Port Connectivity Parameters; option has been removed. This section describes selected; show spanning-tree config; Yes
  • Page 127 – global
  • Page 128 – True; spanning-tree B2 priority 3
  • Page 129 – Send SNMP v2c Informs; Enabling and Configuring SNMP Informs; Maximum number of informs waiting for acknowledgement at any one
  • Page 130 – Figure 11. Example Showing SNMP Informs Option Enabled; includes the following enhancement:
  • Page 131 – RADIUS Server Unavailable; Overview; radius
  • Page 133 – Specifying the MAC Address Format; — specifies an aabbccddeeff format.
  • Page 134 – ARP Age Timer Increase; To view the value of Arp Age timer, enter the; IP Routing : Disabled
  • Page 135 – Menu > Switch Configuration
  • Page 136 – clear arp; command to remove all non-permanent entries in the ARP cache.; Dynamic IP Lockdown; Allows removal of any dynamic entry in the ARP cache.
  • Page 137 – Protection Against IP Source Address Spoofing; Switch
  • Page 138 – Prerequisite: DHCP Snooping
  • Page 139 – Note that the; statement is applied only to all other VLANs.; permit any
  • Page 140 – Enabling Dynamic IP Lockdown; no dhcp-snooping trust
  • Page 141 – Adding an IP-to-MAC Binding to the DHCP Binding Database; Dynamic IP lockdown supports; Potential Issues with Bindings
  • Page 142 – Adding a Static Binding; ip; command at the global configuration level. Use the; no; form of the command to remove; Verifying the Dynamic IP Lockdown Configuration
  • Page 143 – show ip source-lockdown status; command output is shown in Figure 20. Note that; Example of show ip source-lockdown status Command Output; An example of the; show ip source-lockdown bindings; command output is shown in; Global State: Enabled
  • Page 144 – Example of show ip source-lockdown bindings Command Output; In the; command output, the “Not in HW” column specifies whether; Debugging Dynamic IP Lockdown; To send command output to the active CLI session, enter the; debug destination session; Counters for denied packets are displayed in the
  • Page 145 – Example of debug dynamic-ip-lockdown Command Output
  • Page 146 – MSTP VLAN Configuration Enhancement; where; The default behavior of the; spanning-tree instance vlan; command changes so that, before a static VLAN
  • Page 147 – Enabling MSTP on the Switch; Enter the command to enable MSTP:; PreConfiguring VLANs in an MST Instance; Region revision number (
  • Page 148 – command to map VLANs; Configuring MSTP Instances with the VLAN Range Option; If you use the; spanning-tree instance; command with the VLAN range option, even if the range includes
  • Page 149 – MST Configuration Identifier Information
  • Page 150 – Configure Logging via SNMP
  • Page 151 – Adding a Description for a Syslog Server; Entering the; no logging; Adding a Priority Description; form of the command to remove the; severity; system module; white space, use quotes around the string. Use the
  • Page 152 – CLI logging commands:; logging severity; following SNMP objects:
  • Page 153 – LACP and Link Traps Global Disable; no int all lacp; The new SNMP OIDs are:
  • Page 154 – show tech transceivers; command has been enhanced to be consistent with other platforms.
  • Page 155 – LLDP refresh interval
  • Page 156 – show CDP; show QOS resources
  • Page 157 – null; Rcvd a pkt with version number 2, expected 1; mSnmpCtrl
  • Page 158 – vid
  • Page 160 – Duplicate access control entry.
  • Page 161 – System reboot due to power failure.; Boot ROM
  • Page 164 – RSTP
  • Page 168 – Note
  • Page 172 – show int config
  • Page 173 – show lldp
  • Page 182 – IP Connectivi; ty
  • Page 185 – show ip ssh
  • Page 186 – Fatal error: Server unexpectedly closed connection.; show flash
  • Page 187 – file; erase start
  • Page 189 – show name
  • Page 191 – port
  • Page 193 – interface all
  • Page 194 – radius authorized
  • Page 195 – aaa port-access authenticator; aaa; Existing configurations will be altered by this fix
Loading the manual

i

Release Notes:

Version M.10.72 Software

for the

HP

ProCurve Series 3400cl Switches

"M” software versions are supported on these switches:

Release M.10.41

supports the ProCurve Switch 3400cl-24G (J4905A), and 3400cl-48G (J4906A).

These release notes include information on the following:

■

Downloading switch software and documentation from the Web (

page 1

)

■

Clarification of operating details for certain software features (

page 20

)

■

A listing of software enhancements in recent releases (

page 25

)

■

A listing of software fixes included in releases M.08.51 through M.10.72 (

page 145

)

I M P O R TA N T:

3400cl switches MUST be running ROM version I.08.12 prior to loading M.10.20 or newer software. If your
switch is using a software version earlier than M.10.10, you need to install and boot the M.10.10 software
(included in the M.10.41 software package) to load the I.08.12 ROM version, before installing M.10.20 or
newer.

S e c u r i t y N o t e :

Downloading and booting software release M.08.89 or greater for the first time automatically enables
SNMP access to the hpSwitchAuth MIB objects. If this is not desirable for your network, ProCurve
recommends that you disable it after downloading and rebooting with the latest switch software. For more
information, refer to “Enforcing Switch Security” on page

10

and “Using SNMP To View and Configure

Switch Authentication Features” on page

35

.

Configuration Compatibility Caution:

Configuration files created or saved using version M.10.65 or higher are NOT backward-compatible with
previous software versions. The user is advised to save a copy of the pre-M.10.65 startup-config file

BEFORE UPDATING

to M.10.68 or greater, in case there is ever a need to revert back to an earlier version

of software.

ProCurve Switch

M.08.51 through

M.08.95

M.08.99.x

and newer

M.08.96, M.08.97,

M.10.01

and newer

ProCurve Switch 3400cl-24G (J4905A)
ProCurve Switch 3400cl-48G (J4906A)

✔

✔

✔

✔

ProCurve Switch 6400cl-6XG 10-GbE CX4(J8433A)
ProCurve Switch 6410cl-6XG 10-GbE X2(J8474A)

✔

✔

✔

✔

"Loading the manual" means you need to wait until the file loads and becomes available for online reading. Some manuals are very large, and the time they take to appear depends on your internet speed.

Summary

Page 3 - iii; Contents

iii Contents Software Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Software Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Download Switch Docume...

Page 4 - iv

iv Connection-Rate Filtering Based On Virus-Throttling Technology . . . . . . . . . . . . . . . . . . . . . . . 19 Identity-Driven Management (IDM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Clarifications and Updates . . . . . . . . . . . . ...

Page 7 - vii

vii Release M.10.65 Enhancements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 MSTP VLAN Configuration Enhancement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Release M...

Other HP Models

All HP Other