Allied TelesisメーカーAT-S63の使用説明書/サービス説明書
ページ先へ移動 of 514
613-000801 Rev. A Management Software AT-S63 ◆ Features Guide AT-S63 Version 2.2.0 for t he AT-9400 Layer 2+ Switches AT-S63 Version 3.0.0 for the AT-9400 Basic Layer 3 Switches.
Copyright © 2007 Allied Telesis, Inc. All rights reserved. No part o f this pub lication may be repro duced without prior wr itten permission from Al lied Telesis, Inc. Microsoft and Internet Explorer are register ed trademarks of Microsoft Corporation.
3 Preface ........ ............. ................ ............. ............. ................ ............. ................ ............. ...... ....................... ...... 17 How This Guide is Organized .............. ................ ..........
Contents 4 Chapter 2: Enhanced Stacking ................. ............. ............. ................ ............. ................ ............. ................ 55 Supported Platform s ..... ................ ............. ............. ...........
AT-S63 Management Software Features Guide 5 Chapter 10: Classifiers .............. ............. ................ ............. ................. ............ ................. ............ ............. . 109 Supported Platform s ............ .......
Contents 6 Section III: Snooping Prot ocols ............ .............................................. .................... 173 Chapter 15: IGMP Sn ooping ............................ ............ ................. ............. ............ ........
AT-S63 Management Software Features Guide 7 Chapter 21: Multiple Sp anning Tree Protocol ................ ................ ............. ................ ................ ............. . 225 Supported Platform s ............ ................ .........
Contents 8 Chapter 26: MAC Address-ba sed VLANs ............. ............. ................ ............. ............. ................ ............. . 285 Supported Platform s ..... ................ ............. ............. ................ ....
AT-S63 Management Software Features Guide 9 Interface Monitoring ... ............. ................ ................ ................ ............. ................ .............. ......... ................ .... 342 Port Monitoring ....... ...........
Contents 10 Chapter 34: PKI Certific ates and SSL ................ ................ ............. ............. ................ ............. ................ . 397 Supported Platform s ..... ................ ............. ............. .............
AT-S63 Management Software Features Guide 11 IGMP Snooping ............ ................ ............. ................ ............. ................. ............ ............... ........... ................ . 452 Internet Protocol Version 4 Pack et Rout ing .
Contents 12 Appendix D: MIB Objects ....... ................ ............. ............. ................ ............. ................ ............. ................ . 489 Access Control Lists ........ ............. ................ ................
13 Figure 1: Static Port Trunk Example ................... ........... .............. .............. .............. ........... ......... ... ........... ........... .............. .. 77 Figure 2: Example of Multiple Aggregators fo r Multiple A ggregate Trunks .
Figures 14.
15 Table 1: AT-9400 Switch Featur es ....................... .............. ......................... .............. .................. ..................... ................... 31 Table 2: Management Interfaces and Feat ures ............... .........
Tables 16 Table 50: Port Configuration and Status (AtiStackSwitc h MIB) ...................... ......................... .................. .......................503 Table 51: Spanning Tree (AtiStackSwi tch MIB) ........... ........ ........... .....
17 Pr eface This guide describes the feature s of the AT-9400 Layer 2+ and Basic Layer 3 Gigabit Ethernet Switches and the AT-S63 Management Software. This preface contains the f ollowing sections: .
Preface 18 How This Guide is Organized This guide has the followi ng sections and chapters: Section I: Basic Operations Chapter 1, “Overview” on p age 29 Chapter 2, “Enhanced S t acking” o.
AT-S63 Management Software Features Guide 19 Section V : S panning T ree Protocols Chapter 20, “S p anning T ree and Rapid S panning T ree Protocols” on page 213 Chapter 21, “Multiple S p an.
Preface 20 Product Documentation For overview information on the feat ures of the AT-9400 Switch and the AT-S63 Management Sof tware, refer to: A T -S63 Management Software Fea tures Guide (PN 613.
AT-S63 Management Software Features Guide 21 Where to Go First Allied Telesis recommends that you rea d Chapter 1, “Overview” on page 29 in this guide before you begin to manage the switch for the first time.
Preface 22 Starting a Management Session For instructions on how to start a local or remote management session o n the AT-9400 Switch, refer to the Starting an AT-S63 Manag ement Session Guide .
AT-S63 Management Software Features Guide 23 Document Conventions This document uses the following convention s: Note Notes provide additional information. Caution Cautions inform you that perfo rmi ng or omitting a specific action may result in equipment damage or loss of data.
Preface 24 Where to Find Web-based Guides The installation and user guides for all Allied Telesis products a re available in portable document format ( PDF) on our web site at www.alliedtelesis.com . You can view the documents online or download them onto a local workstation or server.
AT-S63 Management Software Features Guide 25 Contacting Allied Telesis This section provides Allied Telesis contact information for technica l support as well as sales and corporate information. Online Support You can request technical support onli ne by accessing the Allied Telesis Knowledge Base: http://kb.
Preface 26.
Section I: Basic Operations 27 Section I Basic Operations The chapters in this section contain backg round information on basic switch features. The chapters include: Chapter 1, “Overview” on .
28 Section I: Basic Op erations.
29 Chapter 1 Overview This chapter has the following sections: “Layer 2+ and Basic Layer 3 Switches” on p age 30 “A T-S63 Management Software” on p age 35 “Management Interfaces .
Chapter 1: Ove rview 30 Layer 2+ and Basic Layer 3 Switches The switches in the AT-9400 Gigabit Ethernet Series a re divided into two groups: Layer 2+ Switches – AT-9408LC/SP – AT-9424T/GB –.
AT-S63 Management Software Features Guide 31 T able 1. A T-9400 Switch Features Layer 2+ Switches (V ersion 2.2. 0) Basic Layer 3 Switches (V ersion 3.
Chapter 1: Ove rview 32 Q u a l i t y o f S e r v i c e YYYYYYYY D e n i a l o f s e r v i c e d e f e n s e s YYYYYYYY Snooping Protocols Internet Group Management Protocol (IGMP) snooping YYYYYYYY M.
AT-S63 Management Software Features Guide 33 802.1Q-compliant and non-802.1Q-compliant multiple VLAN modes YYYYYYYY GARP VLAN Registration Protocol YYYYYYYY P r o t e c t e d p o r t s V L A N s YYYYY.
Chapter 1: Ove rview 34 Remote Secure Shell management YYYYYYYY T ACACS+ and RAD IUS authentication YYYYYYYY Management access control list YYYYYYYY 1. Basic Layer 3 switches using version 3.0.0 of the management software and the A T-S tackXG S tacking Module.
AT-S63 Management Software Features Guide 35 AT-S63 Management Software The AT-9400 Switch is managed with the AT-S63 Management Software. The software comes preinstalled on the unit with default settings for all the operating parameters of the switch.
Chapter 1: Ove rview 36 Management Interfaces and Features The AT-S63 Management Software has t hree management interfaces: Menus interface Command line interface Web browser interface You.
AT-S63 Management Software Features Guide 37 Enhanced st acking Y Y Y SNMPv1 and SNMPv2 community strings YYY Port parameters Y Y Y Port statistics Y Y Y MAC address table Y Y Y S tatic MAC addresses .
Chapter 1: Ove rview 38 Snooping Protocols Internet Group Management Protocol (IGMP) snooping YYY Multicast Listener Discovery (MLD) snooping YY Router Redundancy Protocol (RRP) snooping YY Ethernet P.
AT-S63 Management Software Features Guide 39 Internet Protocol Routing Routing interfaces Y Y S tatic routes Y Routing Information Protocol (RIP) Y Address Resolution Protocol (ARP) table Y BOOTP and DHCP clients Y Y BOOTP relay agent Y Virtual Ro uter Redundancy Protocol Y Port Security MAC address-based port security Y Y Y 802.
Chapter 1: Ove rview 40 2. Y ou cannot upload or download files to a compact flas h card with the web browser interface. Also, the inter- face does not support sw itch-to-switch uploads. 3. Y ou cannot modify the event log full action from the web brow ser interface.
AT-S63 Management Software Features Guide 41 Management Access Methods You can access the AT-S63 Manageme nt Software on the switch several ways: Local session Remote T elnet session Remot.
Chapter 1: Ove rview 42 Remote SNMP Management You can also remotely configure the switch using a Simple Network Management Protocol (SNMP) application, such as AT-View. This management method requires an understand ing of management information base (MIB) objects.
AT-S63 Management Software Features Guide 43 Manager Access Levels The AT-S63 Management Software has two manager access levels of manager and operator. The manager access level lets you view and configure the operating parame ters, while the operator access level only lets you only view the parameters setting s.
Chapter 1: Ove rview 44 Installation and Management Configurations The AT-9400 Switches can be installed in three con figurations. Stand-alone Switch All the A T-9400 Switches can be in st alled and operated as managed or unmanaged, stan d-alone Gigabit Ether net switches.
AT-S63 Management Software Features Guide 45 Here are the main points of stacking: The A T-9400 Gigabit Ethernet Switches operate as a sin gle, logical unit where functions such as port trunks and port mirrors, ca n span all of the devices in the st ack.
Chapter 1: Ove rview 46 IP Configuration Do you intend to remotely manag e the switch with a Telnet or Secure Shell client, or a web browser? Or, will the man agement software be accessing application.
AT-S63 Management Software Features Guide 47 Redundant Twisted Pair Ports Several AT-9400 Switches have twisted pair ports and GBIC or SFP slots that are paired together. The twisted pair ports are identified with the letter “R” for “Redundant” as part of their n umber on the front faceplate of the unit.
Chapter 1: Ove rview 48 Note These guidelines do not apply to the SFP slots on the AT-9408LC/SP switch and the XFP slots o n the A T-9424T s/XP and AT-9448Ts/XP switches.
AT-S63 Management Software Features Guide 49 History of New Features The following sections contain the history of n ew features in the AT-S63 Management Software. Version 3.0.0 Table 4 lists the new features in version 3.0.0 of the AT-S63 Manag ement Software.
Chapter 1: Ove rview 50 Version 2.1.0 Table 5 lists the new features in version 2.1.0. Version 2.0.0 Table 6 lists the new feature in version 2.0.0 of the AT-S63 Management Software.
AT-S63 Management Software Features Guide 51 Version 1.3.0 Table 7 lists the new features in version 1.3.0 of the AT-S63 Manag ement Software. T able 7. New Features in A T -S63 V ersion 1.3.0 Feature Change 802.1x Port-based Network Access Control Added the following new features: Guest VLAN.
Chapter 1: Ove rview 52 Version 1.2.0 Table 8 lists the new features in version 1.2.0. T able 8. New Features in A T-S63 V ersion 1.2.0 Feature Change MAC Address T able Added the following new parame.
AT-S63 Management Software Features Guide 53 802.1x Port-based Network Access Control Added a new parameter t o authenticator ports: Supplicant Mode for supporting multiple supplicant accounts on an authenticator port. For background information, see “Authenticator Ports with Single and Multiple Supplicants” on p age 363.
Chapter 1: Ove rview 54.
Section I: Basic Operations 55 Chapter 2 Enhanced S tacking This chapter contains the following sections: “Supported Platforms” on p age 56 “Overview” on page 57 “Master and Slav.
Chapter 2: En hanced Stacking 56 Section I: Basic Op erations Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408LC/SP – AT-9424T/GB –.
AT-S63 Management Software Features Guide Section I: Basic Operat ions 57 Overview Having to manage a large numb er of network devices typically involves starting a separate management session o n each devic e. This usually means having to end one management session in order to start a new session on another unit.
Chapter 2: En hanced Stacking 58 Section I: Basic Op erations Master and Slave Switches An enhanced stack must have at least one master switch. This switch is your management access point to the switches of a stack.
AT-S63 Management Software Features Guide Section I: Basic Operat ions 59 Common VLAN A master switch searches for the oth er switches in an enhanced stack by sending out a broadcast packet out a local subnet. (The designation of this subnet is explained in “Master Switch and t he Local Interface,” next.
Chapter 2: En hanced Stacking 60 Section I: Basic Op erations Master Switch and the Local Interface Before a switch can function a s the master switch of an en hanced stack, it needs to know which subnet is acti ng as the common subnet among the switches in the stack.
AT-S63 Management Software Features Guide Section I: Basic Operat ions 61 Slave Switches The slave switches of an enhanced stac k must be connected to the master switch through a common VLAN.
Chapter 2: En hanced Stacking 62 Section I: Basic Op erations Enhanced Stacking Compatibility This version of enhanced stacking is compatible with earlier AT-S63 versions and the enhanced stacking feature in the AT-8000 Series, AT-8400 Series, and AT-8500 Series Switches.
AT-S63 Management Software Features Guide Section I: Basic Operat ions 63 Enhanced Stacking Guidelines Here are the guidelines to using the enhanced stacking featu re: There can be up to 24 switches in an enhanced stack. The switches in an enhanced sta ck must be connected with a common port-based or t agged VLAN.
Chapter 2: En hanced Stacking 64 Section I: Basic Op erations General Steps Here are the basic steps to imp lementing the enhanced stacking feature on the AT-9400 Switches in your network: 1. Select a switch to act as the master switch of the enhanced stack.
Section I: Basic Operations 65 Chapter 3 SNMPv1 and SNMPv2c This chapter describes SNMPv1 and SNMPv2c community strings for SNMP management of the switch.
Chapter 3: SNMPv1 a nd SNMPv2c 66 Section I: Basic Op erations Supported Platforms This feature is supported on all AT-9400 Switch es: Layer 2+ Models – AT-9408LC/SP – AT-9424T/GB – AT-9424T.
AT-S63 Management Software Features Guide Section I: Basic Operat ions 67 Overview You can manage a switch by viewing and chan ging the management information base (MIB) ob jects on the device with the Simple Network Management Program (SNMP). The AT-S63 Man agement Software supports SNMPv1, SNMPv2c, and SNMPv3.
Chapter 3: SNMPv1 a nd SNMPv2c 68 Section I: Basic Op erations Community String Attributes A community string has attributes fo r controlling who can use the string and what the string will allow a network management to do on the switch.
AT-S63 Management Software Features Guide Section I: Basic Operat ions 69 the community strings. Each community string can have up to eight trap IP addresses.
Chapter 3: SNMPv1 a nd SNMPv2c 70 Section I: Basic Op erations Default SNMP Community Strings The AT-S63 Management Software prov ides two defau lt community strings: public and private. The public string h as an access mode of just Read and the private string ha s an access mode of Read/Write.
Section I: Basic Operations 71 Chapter 4 MAC Addr ess T able This chapter contains background in formation about the MAC a ddress table.This chapter contains the following section: “Overview” .
Chapter 4: MAC Address Table 72 Section I: Basic Op erations Overview The AT-9400 Switch has a MAC address table with a st orage capacity of 16,000 entries. The table stores the MAC addresses of the network nodes connected to its ports and the p ort number where each address was learned.
AT-S63 Management Software Features Guide Section I: Basic Operat ions 73 MAC address table from becoming fill ed with addresses of no des that are no longer active. The period of time that the switch waits b efore purging an inactive dynamic MAC address is called the a ging time .
Chapter 4: MAC Address Table 74 Section I: Basic Op erations.
Section I: Basic Operations 75 Chapter 5 S tatic Port T runks This chapter describes static port trunk s. Sections in the chapter include: “Supported Platforms” on p age 76 “Overview” .
Chapter 5: St atic Port Trunks 76 Section I: Basic Op erations Supported Platforms This feature is supported on all AT-9400 Switch es: Layer 2+ Models – AT-9408LC/SP – AT-9424T/GB – AT-9424T.
AT-S63 Management Software Features Guide Section I: Basic Operat ions 77 Overview A static port trunk is a group of two to e ight ports that function as a single virtual link between the switch and anot her device.
Chapter 5: St atic Port Trunks 78 Section I: Basic Op erations Load Distribution Methods This section discusses load distributio n methods and applies to both static and LACP port trunks.
AT-S63 Management Software Features Guide Section I: Basic Operat ions 79 A similar method is used for the two load distribution methods that employ both the source and destination addresses.
Chapter 5: St atic Port Trunks 80 Section I: Basic Op erations Guidelines The following guidelines appl y to static trunks: Allied T elesis recommends limiting static port trunks to Allied T elesis network devices to ensure comp atibility . A static trunk ca n have up to eight ports.
Section I: Basic Operations 81 Chapter 6 LACP Port T runks This chapter explains Link Aggregati on Control Protocol (LACP) port trunks. Sections in the chapter include: “Supported Platforms” o.
Chapter 6: LACP Port Trunks 82 Section I: Basic Op erations Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408LC/SP – AT-9424T/GB – A.
AT-S63 Management Software Features Guide Section I: Basic Operat ions 83 Overview LACP (Link Aggregation Control Protocol) port trunks p erform the same function as static trunks. They increase the bandwidth between netwo rk devices by distributing the traffic lo ad over multiple physical links.
Chapter 6: LACP Port Trunks 84 Section I: Basic Op erations If there will be more than one aggregate trun k on a switch, each trunk might require a separate ag gregator or it might be possible to combine them into a common aggregator. The de termining factor will be whether the trunks are going to the same device or different devices.
AT-S63 Management Software Features Guide Section I: Basic Operat ions 85 Here is how the example looks in a table format. Caution The example cited here illustra tes a loop in a network.
Chapter 6: LACP Port Trunks 86 Section I: Basic Op erations Here is how this exampl e looks in table format. You could, if you wanted , create separate aggregators for the different aggregate trunks in the example abo ve.
AT-S63 Management Software Features Guide Section I: Basic Operat ions 87 LACP System Priority It is possible for two devices interconnected by an aggregate trunk to encounter a conflict when they form the trunk.
Chapter 6: LACP Port Trunks 88 Section I: Basic Op erations Adminkey Parameter The adminkey is a hexadecimal value from 1 to FFFF that identifies an aggregator. Each aggregator on a switch must have a uniqu e adminkey. The adminkey is restricted to a switch.
AT-S63 Management Software Features Guide Section I: Basic Operat ions 89 Load Distribution Methods The load distribution method dete rmines the manner in which the switch distributes the traffic across the acti ve ports of an aggre gate trunk. The method is assigned to an aggreg ator and applies to all aggregate trunks within it.
Chapter 6: LACP Port Trunks 90 Section I: Basic Op erations Guidelines The following guidelines apply to creating aggregators: LACP must be activated on both the switch and the othe r device. The other device must be 802.3ad-co mpliant. An aggregator can consist of any number of port s.
AT-S63 Management Software Features Guide Section I: Basic Operat ions 91 When creating a new aggregator , you can specify either a name for the aggregator or an adminkey , but not both. If yo u specify a name, the adminkey is based on the operator key of the lowest numbered port in the aggregator .
Chapter 6: LACP Port Trunks 92 Section I: Basic Op erations.
Section I: Basic Operations 93 Chapter 7 Port Mirr or This chapter explains the port mirror f eature. Sections in the chapter include: “Supported Platforms” on p age 94 “Overview” on p.
Chapter 7: Po rt Mirror 94 Section I: Basic Op erations Supported Platforms This feature is supported on all AT-9400 Switch es: Layer 2+ Models – AT-9408LC/SP – AT-9424T/GB – AT-9424T/SP .
AT-S63 Management Software Features Guide Section I: Basic Operat ions 95 Overview The port mirror feature allows for th e unobtrusive monitoring of ingress or egress traffic on one or more ports on a switch, without impacting network performance or speed.
Chapter 7: Po rt Mirror 96 Section I: Basic Op erations.
Section II: Advanced Operations 97 Section II Advanced Operations This section contains t he following chapters: Chapter 8, ”File System” on pag e 99 Chapter 9, ”Event Logs and the Syslo.
98 Section II: Advanced Operati ons.
Section II: Advanced Operations 99 Chapter 8 File System The chapter explains the switch’s file system and contains the following sections: “Overview” on page 100 “Boot Configuration F.
Chapter 8: File System 100 Section II: Advanced Operations Overview The AT-9400 Switch has a file system in flash memory for storing system files. You can view a list of the files a s well as copy, rename, and delete files.
AT-S63 Management Software Features Guide Section II: Advance d Operations 101 Boot Configuration Files A boot configuration file contain s the series of commands that recreate the current or a specific configuration o f the switch when the unit is power cycled or reset.
Chapter 8: File System 102 Section II: Advanced Operations File Naming Conventions The flash memory file system is a fla t file system—directories are not supported. However, directories are supported on compact flash cards. In both types of storage, files are uniquely identified by a file na me in the following format: filename.
AT-S63 Management Software Features Guide Section II: Advance d Operations 103 Using Wildcards to Speci fy Groups of Files You can use the asterisk character (*) as a wildcard chara c ter in some fields to identify groups of files. In addition , a wildcard can be combined with other characters.
Chapter 8: File System 104 Section II: Advanced Operations.
Section II: Advanced Operations 105 Chapter 9 Event Logs and the Syslog Client This chapter describes how to mo nitor t he activity of a switch by viewing the event messages in the event logs and sending the messages to a syslog server.
Chapter 9: Event Logs and the Sy slog Client 106 Section II: Advanced Operations Supported Platforms This feature is supported on all AT-9400 Switch es: Layer 2+ Models – AT-9408LC/SP – AT-942.
AT-S63 Management Software Features Guide Section II: Advance d Operations 107 Overview A managed switch is a complex piece of computer equipment that includes both hardware and software. Multiple software feat ures operate simultaneously, interoperating with e ach other and processing large amounts of network traffic.
Chapter 9: Event Logs and the Sy slog Client 108 Section II: Advanced Operations Syslog Client The management software features a syslog client for sending event messages to a syslog server on your network. A syslog server can function as a central repository fo r events from many different net work devices.
Section II: Advanced Operations 109 Chapter 10 Classifiers This chapter explains classifiers for access control lists and Quality of Service policies. The sections in this chapter include : “Sup.
Chapter 10: Cl assifiers 110 Section II: Advanced Operations Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408LC/SP – AT-9424T/GB – .
AT-S63 Management Software Features Guide Section II: Advance d Operations 111 Overview A classifier defines a traffic flow . A traffic flow consists of packets that share one or more characteristics. A traffic flow can range from being very broad to very specific.
Chapter 10: Cl assifiers 112 Section II: Advanced Operations is dictated by the QoS p olicy, as explained in Chapter 13, “Quality of Service” on page 139.
AT-S63 Management Software Features Guide Section II: Advance d Operations 113 Classifier Criteria The components of a classifier are defin ed in the following subsections. Destination MAC Address (Layer 2) Source MAC Address (Layer 2) You can identify a traffic flow by s pecifying a source and/or destin ation MAC address.
Chapter 10: Cl assifiers 114 Section II: Advanced Operations Figure 4. User Priority and VLAN Fields within an Etherne t Frame You can identify a traf fic flow of tagged packets using the user priority value. A classifier for such a traffic flow would instruct a port to watch for tagged packets containing the specif ied user priority level.
AT-S63 Management Software Features Guide Section II: Advance d Operations 115 Observe the following guidelines when using this variable: When selecting a Layer 3 or Layer 4 variable, this variable must be lef t blank or set to IP . If you choose to specify a protocol by its number , you can enter the value in decimal or hexadecimal format.
Chapter 10: Cl assifiers 116 Section II: Advanced Operations Observe these guidelines when using this criterion: The Protocol variable must be lef t blank or set to IP . Y ou cannot specify both an IP T oS value and an IP DSCP value in the same classifier .
AT-S63 Management Software Features Guide Section II: Advance d Operations 117 Observe this guideline wh en using these criteria: The Protocol variable must be lef t blank or set to IP .
Chapter 10: Cl assifiers 118 Section II: Advanced Operations Guidelines Follow these guidelines wh en creating a classifier: Each classifier represent s a separate traffic flow .
Section II: Advanced Operations 119 Chapter 11 Access Contr ol Lists This chapter describes access cont rol lists (ACL) and how they can improve network security and performan ce.
Chapter 11: Access Control Lists 120 Section II: Advanced Operations Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Switches – AT-9408LC/SP – AT-942.
AT-S63 Management Software Features Guide Section II: Advance d Operations 121 Overview An access control list is a filte r that controls the ingress traffic on a port. It defines a category of traffic and the action of the p o rt when it receives packets of the category.
Chapter 11: Access Control Lists 122 Section II: Advanced Operations 4. Finally, if a packet does not meet the criteria of any ACLs on a port, it is accepted by the port.
AT-S63 Management Software Features Guide Section II: Advance d Operations 123 Parts of an ACL An ACL must have the following informat ion: Name - An ACL must have a name. The name of an ACL should indicate the type of traf fic flow being filtered and, perhap s, also the action.
Chapter 11: Access Control Lists 124 Section II: Advanced Operations Guidelines Here are the rules to creating ACLs: A port can have multiple permit and deny ACLs. An ACL must have at least one classifier . An ACL can be assigned to more than one switch port.
AT-S63 Management Software Features Guide Section II: Advance d Operations 125 Examples This section contains seve ral examples of ACLs. In this example, port 4 has been assigne d one ACL, a deny ACL for the subnet 149.11.11.0. This ACL preve nts the port from accepting any traffic originating from that subnet.
Chapter 11: Access Control Lists 126 Section II: Advanced Operations To deny traffic from several subne ts on the same port, you can create multiple classifiers and apply them to the same ACL , as illustrated in the next example. Three subnets a re denied access to port 4.
AT-S63 Management Software Features Guide Section II: Advance d Operations 127 The same result can be achieved by assigning t he classifiers to different ACLs and assigning the ACLs to the sa me port, as in this example, a gain for port 4. Figure 8. ACL Example 3 Create Access Control Lists (A CL) 1 - A CL ID .
Chapter 11: Access Control Lists 128 Section II: Advanced Operations In this example, the traffic on ports 14 a nd 15 is restricted to packets from the source subnet 149.44.44.0. All other IP traffic is denied. Classifier ID 11, which specifies the traffic flow to be permitted by the ports, is assigned to an ACL with an action of permit.
AT-S63 Management Software Features Guide Section II: Advance d Operations 129 The next example limits the ingress tr affic on p ort 17 to IP packets from the subnet 149.22.11.0 an d a Type of Service setting of 6, destined to the end node with the IP address 149.
Chapter 11: Access Control Lists 130 Section II: Advanced Operations.
Section II: Advanced Operations 131 Chapter 12 Class of Service This chapter describes the Class of Se rv ice (CoS) feature. Sections in the chapter include: “Supported Platforms” on p age 132.
Chapter 12: Class of Service 132 Section II: Advanced Operations Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408LC/SP – AT-9424T/GB .
AT-S63 Management Software Features Guide Section II: Advance d Operations 133 Overview When a port on an Ethernet switch becomes oversubscribe d —its egress queues contain more packets than the por.
Chapter 12: Class of Service 134 Section II: Advanced Operations For example, when a tagged packe t with a priority level of 3 enters a por t on the switch, the packet is stored in Q3 queue on the egre ss port.
AT-S63 Management Software Features Guide Section II: Advance d Operations 135 Note that because all ports must use the same priority-to-eg ress queue mappings, these mappings are app lied at the switch level.
Chapter 12: Class of Service 136 Section II: Advanced Operations Scheduling A switch port needs a mecha nism for knowing the order in which it should handle the packets in its eight egress queues.
AT-S63 Management Software Features Guide Section II: Advance d Operations 137 Table 12 shows an example. In this example, the port transmits a maximum n umber of 15 packets from Q7 before moving to Q6, from where it transmits up to 10 packets, and so forth.
Chapter 12: Class of Service 138 Section II: Advanced Operations Q6 15 Q7 0 T able 13. Example of a Weig ht of Zero for Priority Queue 7 (Continu ed) Port Egress Queue Maximum Number of Packet s.
Section II: Advanced Operations 139 Chapter 13 Quality of Service This chapter describes Quality of Serv ice ( QoS). Sections in the chapter include: “Supported Platforms” on p age 140 “.
Chapter 13: Quali ty of Service 140 Section II: Advanced Operations Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408LC/SP – AT-9424T/.
AT-S63 Management Software Features Guide Section II: Advance d Operations 141 Overview Quality of Service allows you to prioritize traffic and/o r limit the bandwidth available to it. The concept of QoS is a departure from the original networking protocols, which tre ated all traffic on the Internet or within a LAN in the same manner.
Chapter 13: Quali ty of Service 142 Section II: Advanced Operations The QoS functionality described in this chapter sorts packets in to various flows, according to the QoS policy that applies to the port the traffic is received on. The switch then allocates resources to direct this traffic according to bandwidth or priority settings in the policy.
AT-S63 Management Software Features Guide Section II: Advance d Operations 143 Classifiers Classifiers identify a particular traffic flow, and rang e from general to specific.
Chapter 13: Quali ty of Service 144 Section II: Advanced Operations Flow Groups Flow groups group similar traffic flows together, a nd allow more specific QoS controls to be used, in preference to those specified by the traffic class. Flow groups consist of a sma ll set of QoS parameters and a group of classifiers.
AT-S63 Management Software Features Guide Section II: Advance d Operations 145 Traffic Classes Traffic classes are the central component of the QoS solution. They provide most of the QoS controls that allow a QoS solution to be deployed. A traffic class can be a ssigned to only one policy.
Chapter 13: Quali ty of Service 146 Section II: Advanced Operations Policies QoS policies consist of a collection of user defined traffic classes. A policy can be assigned to more than o ne port, but a port may only have one policy.
AT-S63 Management Software Features Guide Section II: Advance d Operations 147 QoS Policy Guidelines Following is a list of QoS policy guidelines: A classifier may be assigned to many flow groups. However , assigning a classifier more than once within the same policy may lead t o undesirable result s.
Chapter 13: Quali ty of Service 148 Section II: Advanced Operations Packet Processing You can use the switch’s QoS to ols to perform any combination of the following functions on a packet flow: .
AT-S63 Management Software Features Guide Section II: Advance d Operations 149 Both the VLAN tag User Priority and th e traffic class / flow group priority setting allow eight different priorit y values (0-7). These eight priorities are mapped to the switch’s eight CoS queue s.
Chapter 13: Quali ty of Service 150 Section II: Advanced Operations Replacing Priorities The traffic class or flow group priority (if set) determines the egress que ue a packet is sent to when it egresse s the switch, but by d efault has no effect on how the rest of the network processes the pa cket.
AT-S63 Management Software Features Guide Section II: Advance d Operations 151 DiffServ Domains Differentiated Services (DiffServ) is a metho d of dividing IP traffic into classes of service, without requiring that every router in a network remember detailed information abo ut traf fic flows.
Chapter 13: Quali ty of Service 152 Section II: Advanced Operations To use the QoS tool set to configure a DiffServ doma in: 1. As packets come into the domai n at edge swit ches, replace their DSCP value, if required. Classify the packets according to the required characteristics.
AT-S63 Management Software Features Guide Section II: Advance d Operations 153 Examples The following examples demonstrate how to implement QoS in three situations: “V oice Applications,” n ex.
Chapter 13: Quali ty of Service 154 Section II: Advanced Operations Figure 13. QoS Voice Application Example The parts of the policies are: Classifier - Defines the traf fic flow by specifying the IP address of the node with the voice application.
AT-S63 Management Software Features Guide Section II: Advance d Operations 155 T raffic Class - No action is taken by the traffic class, other tha n to specify the flow group. T raffic class has a priority setting you can use to override the priority level of p ackets, just as in a flow group.
Chapter 13: Quali ty of Service 156 Section II: Advanced Operations Figure 14. QoS Video Application Example The parts of the policies are: Classifier - S pecifies the IP address of the n ode with a video application.
AT-S63 Management Software Features Guide Section II: Advance d Operations 157 packet s so they leave containing the new leve l, you would change option 5, Remark Priority , to Y es. T raffic Class - Th e packet stream is assigned a maximum bandwidth of 5 Mbps.
Chapter 13: Quali ty of Service 158 Section II: Advanced Operations Policy Component Hierarchy The purpose of this example is to illustrate the hierarchy of the components of a QoS policy and how that hierarchy needs to be taken into account when assigning new priority a nd DSCP values.
AT-S63 Management Software Features Guide Section II: Advance d Operations 159 Figure 16. Policy Component Hierarchy Example Create Classifier 01 - Classifier ID: ..... 1 . 14 - Dst IP Addr ..... 149.11.11.0 15 - Dst IP Mask ..... 255.255.255.0 Create Flow Group 1 - Flow Group ID .
Chapter 13: Quali ty of Service 160 Section II: Advanced Operations.
Section II: Advanced Operations 161 Chapter 14 Denial of Service Defenses This chapter explains the defen se mechanisms in the management software that can protect your netwo rk against denial of service (DoS) attacks.
Chapter 14: Denia l of Service Defens es 162 Section II: Advanced Operations Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408LC/SP – .
AT-S63 Management Software Features Guide Section II: Advance d Operations 163 Overview The AT-S63 Management Software can help protect your netwo rk against the following types of denial of service attacks.
Chapter 14: Denia l of Service Defens es 164 Section II: Advanced Operations SYN Flood Attack In this type of attack, an attacker sends a large number of TCP connection requests (TCP SYN packets) with bogus source a ddresses to the victim.
AT-S63 Management Software Features Guide Section II: Advance d Operations 165 Smurf Attack This DoS attack is instigated by an at tacker se nding a ICMP Echo (Ping) request that has the network’s I P broadcast address as the dest ination address and the address of the victim as the source of th e ICMP Echo (Ping) request.
Chapter 14: Denia l of Service Defens es 166 Section II: Advanced Operations Land Attack In this attack, an attacker sends a bogus IP pa cket where the source and destination IP addresses are the same. This leaves th e victim thinking that it is sending a message to itself.
AT-S63 Management Software Features Guide Section II: Advance d Operations 167 2. If the source IP address is no t local to the network, it discards the packet because it assumes that a packe t with an IP address that is not local to the network should not be a ppearing on a port that is not an uplink port.
Chapter 14: Denia l of Service Defens es 168 Section II: Advanced Operations Teardrop Attack An attacker sends an IP packet in se veral fragments with a bogus offset value, used to reconstruct the packet, in one of the fragments to a victim.
AT-S63 Management Software Features Guide Section II: Advance d Operations 169 Ping of Death Attack The attacker sends an oversized, fragmented ICMP Echo (Pin g) request (greater than 65,535 bits) to the victim, which, if lacking a policy for handling oversized packets, may freeze.
Chapter 14: Denia l of Service Defens es 170 Section II: Advanced Operations IP Options Attack In the basic scenario of an IP attack, an attacker sends packets containing bad IP options. There are several types of IP option attacks and the AT-S63 Management Sof tware does not distingu ish between them.
AT-S63 Management Software Features Guide Section II: Advance d Operations 171 Mirroring Traffic The Land, Teardrop, Ping of Death, and IP Options defense mechanisms allow you to copy the examined traffi c to a mirror port for furthe r analysis with a data sniffer or analyzer.
Chapter 14: Denia l of Service Defens es 172 Section II: Advanced Operations Denial of Service Defense Guidelines Below are guidelines to observe when using this feature: A switch port can support more than one DoS defense at a time. The T eardrop and the Ping of Death defenses are CPU intensive.
Section III: Snooping Protocols 173 Section III Snooping Pr otocols The chapters in this section contai n overview informat ion on the snooping protocols.
174 Section III: Snooping Protocols.
Section III: Snooping Protocols 175 Chapter 15 IGMP Snooping This chapter explains Internet Group Management Protocol (IGMP) snooping feature in the following sections: “Supported Platforms” o.
Chapter 15: IGMP Snoopin g 176 Section III: Snooping Protocols Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408LC/SP – AT-9424T/GB .
AT-S63 Management Software Features Guide Section III: Snoopin g Protocols 177 Overview IPv4 routers use IGMP to create lists of nodes tha t are members of multicast groups. (A multicast group is a group of end node s that want to receive multicast packets from a mult icast application.
Chapter 15: IGMP Snoopin g 178 Section III: Snooping Protocols Without IGMP snooping a switch would have to flood multicast packets ou t all of its ports, except the port on which it received the packet. Such flooding of packets can negative ly impact network performance.
Section III: Snooping Protocols 179 Chapter 16 MLD Snooping This chapter explains Multicast Li stener Discover y (MLD) snooping: “Supported Platforms” on p age 180 “Overview” on page 1.
Chapter 16: MLD Snoopi ng 180 Section III: Snooping Protocols Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408LC/SP – AT-9424T/GB –.
AT-S63 Management Software Features Guide Section III: Snoopin g Protocols 181 Overview MLD snooping performs the same fun ction as IGMP snooping. The switch uses the feature to build multicast membership lists. It uses the lists to forward multicast packets only to switch ports where there are host nodes that are members of the multicast groups.
Chapter 16: MLD Snoopi ng 182 Section III: Snooping Protocols.
Section III: Snooping Protocols 183 Chapter 17 RRP Snooping This chapter explains RRP snooping and contains the following sections: “Supported Platforms” on p age 184 “Overview” on pag.
Chapter 17: RRP Snoopi ng 184 Section III: Snooping Protocols Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408LC/SP – AT-9424T/GB –.
AT-S63 Management Software Features Guide Section III: Snoopin g Protocols 185 Overview The Router Redundancy Protocol (RRP) a llows multiple routers to share the same virtual IP address and MAC address.
Chapter 17: RRP Snoopi ng 186 Section III: Snooping Protocols Guidelines The following guidelines apply to the RRP snooping feature: The default setting for this feature is disable d. Activating the feature flushes all dynamic MAC addresses from the MAC address table.
Section III: Snooping Protocols 187 Chapter 18 Ethernet Pr otection Switching Ring Snooping This chapter has the following sections: “Supported Platforms” on p age 188 “Overview” on pa.
Chapter 18: Ethern et Protection Swit ching Ring Snoopin g 188 Section III: Snooping Protocols Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models Not supported.
AT-S63 Management Software Features Guide Section III: Snoopin g Protocols 189 Overview Ethernet Protection Switching Ring is a feature fou nd on selected Allied Telesis products, such as the AT-8948 Series Giga bit Layer 3 Switches.
Chapter 18: Ethern et Protection Swit ching Ring Snoopin g 190 Section III: Snooping Protocols After creating the VLANs, you activa te EPSR snooping by specifyin g the control VLAN with the ENABLE EPSRSNOOPING command.
AT-S63 Management Software Features Guide Section III: Snoopin g Protocols 191 Restrictions EPSR snooping has three important restrictions. All the restrictions are related to control EPSR messages and the fact that EPSR snooping can not generate these messages.
Chapter 18: Ethern et Protection Swit ching Ring Snoopin g 192 Section III: Snooping Protocols Figure 17. Double Fault C ondition in EPSR Snooping Now assume the lin k is reestablished between the switch and transit node.
AT-S63 Management Software Features Guide Section III: Snoopin g Protocols 193 Guidelines The guidelines to EPSR snooping are: The A T-9400 Switch can support up to sixteen control VLANs and so up to sixteen EPSR instances. The A T-9400 Switch can not be the master node of a ring.
Chapter 18: Ethern et Protection Swit ching Ring Snoopin g 194 Section III: Snooping Protocols.
Section IV: SNMPv3 195 Section IV SNMPv3 The chapter in this section con tains overview information on SNMPv3. The chapter is: Chapter 19, ”SNMPv3” on pa ge 197.
196 Section IV: SNMPv3.
Section IV: SNMPv3 197 Chapter 19 SNMPv3 This chapter provides a description of the AT-S63 implemen tation of the SNMPv3 protocol. The following sections are provided: “Supported Platforms” on.
Chapter 19: SNMP v3 198 Section IV: SNMPv3 Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408LC/SP – AT-9424T/GB – AT-9424T/SP Ba.
AT-S63 Management Software Features Guide Section IV: SNMPv3 199 Overview The SNMPv3 protocol builds on the exist ing SNMPv1 and SNMPv2c protocol implementation which is de scribed in Cha pter 3, “SNMPv1 and SNMPv2c” on page 65.
Chapter 19: SNMP v3 200 Section IV: SNMPv3 SNMPv3 Authentication Protocols The SNMPv3 protocol supports two authe ntication protocols—HMAC- MD5-96 (MD5) and HMAC-SHA-96 (SHA). Bo th MD5 and SHA use an algorithm to generate a message digest. Each authentication protocol authenticates a user by checking the message digest.
AT-S63 Management Software Features Guide Section IV: SNMPv3 201 SNMPv3 Privacy Protocol After you have configured an authentic ation protocol, you have the option of assigning a privacy protocol if yo u have the encrypted version of the AT-S63 software.
Chapter 19: SNMP v3 202 Section IV: SNMPv3 SNMPv3 MIB Views The SNMPv3 protocol allows you to configure MIB views for users and groups. The MIB tree is defined by RFC 1155 (Structure of Management Information). See Figure 18. Figure 18. MIB Tree The AT-S63 software supports the MIB tree, startin g with the Internet MIBs, as defined by 1.
AT-S63 Management Software Features Guide Section IV: SNMPv3 203 After you specify a MIB subtree view you have the option of further restricting a view by defining a subtree ma sk. The relationship between a MIB subtree view and a subtree mask is analogous to th e relationship between an IP address a nd a subnet mask.
Chapter 19: SNMP v3 204 Section IV: SNMPv3 SNMPv3 Storage Types Each SNMPv3 table entry has its own storag e type. You can choose between nonvolatile storage which allows you to save the table entry or volatile storage which does not allow you to save an e ntry.
AT-S63 Management Software Features Guide Section IV: SNMPv3 205 SNMPv3 Message Notification When you generate an SNMPv3 message from the switch, there are three basic pieces of information included i.
Chapter 19: SNMP v3 206 Section IV: SNMPv3 SNMPv3 Tables The SNMPv3 configuration is neatly divided into configuring SNMPv3 user information and configuring the messag e notificatio n. You must configure all seven tables to successfully configure the SNMPv3 protocol.
AT-S63 Management Software Features Guide Section IV: SNMPv3 207 Configure SNMPv3 Notify T able Configure SNMPv3 T arget Address T able Configure SNMPv3 T arget Parameters T able You start the message notification configu ration by defining the type of message you want to send with the SNMPv3 Notify Table.
Chapter 19: SNMP v3 208 Section IV: SNMPv3 “SNMPv3 T arget Parameters T able” on page 209 “SNMPv3 Community T able” on page 209 SNMPv3 User Table The Configure SNMPv3 User Table menu allows you to crea te an SNMPv3 user and provides the options o f configuring authentication and privacy protocols.
AT-S63 Management Software Features Guide Section IV: SNMPv3 209 SNMPv3 Notify Table The Configure SNMPv3 Notify Table menu allows you to define the type of message that is sent from the switch to the SNMP host. In addition, you have the option of def ining the message type as either an Inform o r a Trap message.
Chapter 19: SNMP v3 210 Section IV: SNMPv3 SNMPv3 Configuration Example You may want to have two classes of SNMPv3 users—Managers and Operators. In this scenario, you would configure on e group, called Managers, with full access privileges. Then you would configure a second group, called Operators, with monitoring privilege s only.
Section V: Spanning Tree Protocols 211 Section V Spanning T r ee Pr otocols The section has the following chapters: Chapter 20, “S p anning T ree and Rapid S panning T ree Protocols” on page 2.
212 Section V: Spanning Tree Pro tocols.
Section V: Spanning Tree Protocols 213 Chapter 20 Spanning T r ee and Rapid Spanning T r ee Pr otocols This chapter provides background information on the Spanning Tree Protocol (STP) and Rapid Spanning Tree Protocol (RSTP).
Chapter 20: Spannin g Tree and Rapid Span ning Tree Protocols 214 Section V: Spanning Tree Pro tocols Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Mod.
AT-S63 Management Software Features Guide Section V: Spanning Tree Protocols 215 Overview The performance of a Ethernet network can be neg atively impacted by the formation of a data loop in the netwo rk topology. A data loop exists when two or more nodes on a network can transmit data to each other over more than one data path.
Chapter 20: Spannin g Tree and Rapid Span ning Tree Protocols 216 Section V: Spanning Tree Pro tocols Bridge Priority and the Root Bridge The first task that bridges perform when a sp anning tree protocol is activated on a network is the selection of a ro ot bridge .
AT-S63 Management Software Features Guide Section V: Spanning Tree Protocols 217 Path Costs and Port Costs After the root bridge has been selecte d, the bridges determine if the network contains redundant path s and, if one is found, select a pref erred path while placing the redunda nt paths in a backup or blocking state .
Chapter 20: Spannin g Tree and Rapid Span ning Tree Protocols 218 Section V: Spanning Tree Pro tocols Table 16 lists the STP port costs with Au to-Detect when a port is part of a port trunk. Table 17 lists the RSTP port costs with Auto-Det ect. Table 18 lists the RSTP port costs with Auto-Det ect when the port is part of a port trunk.
AT-S63 Management Software Features Guide Section V: Spanning Tree Protocols 219 T able 19. Port Priority V alue Increment s Increment Bridge Priority Increment Bridge Priority 0081 2 8 1 16 9 144 2 3.
Chapter 20: Spannin g Tree and Rapid Span ning Tree Protocols 220 Section V: Spanning Tree Pro tocols Forwarding Delay and Topology Changes If there is a change in the network topology due to a failure, removal, or addition of any active components, the active topology also changes.
AT-S63 Management Software Features Guide Section V: Spanning Tree Protocols 221 seconds and the default is two second s. Consequently, if the AT-9400 Switch is selected as the root bridge of a spa nning tree domain, it transmits a BPDU every two seconds.
Chapter 20: Spannin g Tree and Rapid Span ning Tree Protocols 222 Section V: Spanning Tree Pro tocols Figure 22. Edge Port A port can be both a point-to-point and an edge port at the same time. It operates in full-duplex and has no ST P or RSTP devices connected to it.
AT-S63 Management Software Features Guide Section V: Spanning Tree Protocols 223 Mixed STP and RSTP Networks RSTP IEEE 802.1w is fully compliant with STP IEEE 802.1d. Your network can consist of bridges running both protocols. STP and RSTP in the same network can operate together t o create a single spanning tree domain.
Chapter 20: Spannin g Tree and Rapid Span ning Tree Protocols 224 Section V: Spanning Tree Pro tocols Spanning Tree and VLANs The spanning tree implementation in the AT-S63 Mana gement Software is a single-instance spanning tree. The switch supports just one spanning tree.
Section V: Spanning Tree Protocols 225 Chapter 21 Multiple Spanning T r ee Pr otocol This chapter provides background information on the Multiple Spanning Tree Protocol (MSTP).
Chapter 21: Multipl e Spanning Tree Protocol 226 Section V: Spanning Tree Pro tocols Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408LC.
AT-S63 Management Software Features Guide Section V: Spanning Tree Protocols 227 Overview As mentioned in Chapter 20, ”Spanning Tree and Rapid Spanning Tree Protocols” on page 213, STP and RSTP are referred to as single-instance spanning trees that search for physi cal loops across all VLANs in a bridged network.
Chapter 21: Multipl e Spanning Tree Protocol 228 Section V: Spanning Tree Pro tocols Multiple Spanning Tree Instance (MSTI) The individual spanning trees in MSTP are referred to as Multiple Spanning Tree Instances (MST Is). A MSTI can span any number of AT-9400 Switches.
AT-S63 Management Software Features Guide Section V: Spanning Tree Protocols 229 Figure 25. VLAN Fragmentatio n with STP or RSTP Blocke d Port FAULT RPS MASTER POWER CLASS 1 LASER PRODUCT STA TUS TERM.
Chapter 21: Multipl e Spanning Tree Protocol 230 Section V: Spanning Tree Pro tocols Figure 26 illustrates the same two AT-9400 Switches and the same two virtual LANs. But in this example, the two switches are running MSTP and the two VLANs have been assigned different spann ing tree instances.
AT-S63 Management Software Features Guide Section V: Spanning Tree Protocols 231 A MSTI can contain more than one VLAN. This is illustrated in Figure 27 where there are two AT-9400 Switches wit h four VLANs. There are two MSTIs, each containing two VLANs.
Chapter 21: Multipl e Spanning Tree Protocol 232 Section V: Spanning Tree Pro tocols MSTI Guidelines Following are several guidelines to keep in mind about MSTIs: The AT-9400 Switch can support up to 16 spanning tree instances, including the CIST .
AT-S63 Management Software Features Guide Section V: Spanning Tree Protocols 233 VLAN and MSTI Associations Part of the task to configu ring MSTP involves assigning VLANs to spanning tree instances. The mapping of VLANs to MSTIs is ca lled associations .
Chapter 21: Multipl e Spanning Tree Protocol 234 Section V: Spanning Tree Pro tocols Ports in Multiple MSTIs A port can be a member of mo re than one MSTI at a time if it is a tagged member of one or more VLANs assign ed to different MSTI’s.
AT-S63 Management Software Features Guide Section V: Spanning Tree Protocols 235 Multiple Spanning Tree Regions Another important concept of MSTP is re gions . A MSTP region is defin ed as a group of bridges that sha re exactly the same MSTI characteristics.
Chapter 21: Multipl e Spanning Tree Protocol 236 Section V: Spanning Tree Pro tocols Figure 28 illustrates the concept of regions. It shows one MSTP region consisting of two AT-9400 Switches. Each switch in the region has the same configuration name and revisio n level.
AT-S63 Management Software Features Guide Section V: Spanning Tree Protocols 237 The same is true for any ports connected to bridge s running the single- instance spanning tree ST P or RSTP. Th ose ports are also considered as part of another region. Each MSTI functions as an independ ent spanning tree within a region.
Chapter 21: Multipl e Spanning Tree Protocol 238 Section V: Spanning Tree Pro tocols Common and Internal Spanning Tree (CIST) MSTP has a default spanning tree insta nce called the Common and Internal Spanning Tree (CIST). This insta nce has an MSTI ID of 0.
AT-S63 Management Software Features Guide Section V: Spanning Tree Protocols 239 Summary of Guidelines Careful planning is essential for the successful implementation of MSTP.
Chapter 21: Multipl e Spanning Tree Protocol 240 Section V: Spanning Tree Pro tocols Note The AT-S63 MSTP implementation comp lies fully with the new IEEE 802.1s standard. Any other vendor’s fully compliant 802.1s implementation is interoperable with the AT-S63 implementation.
AT-S63 Management Software Features Guide Section V: Spanning Tree Protocols 241 Associating VLANs to MSTIs Allied Telesis recommends that you assign all VLANs on a switch to an MSTI. You should not leave a VLAN as signed to just the CIST, including the Default_VLAN.
Chapter 21: Multipl e Spanning Tree Protocol 242 Section V: Spanning Tree Pro tocols Figure 30. CIST and VLAN Guideline - Example 2 When port 4 on switch B receives a BPDU, the swit ch notes the port sending the packet belongs only to CIST. Therefore, switch B uses CIST in determining whether a loop exists.
AT-S63 Management Software Features Guide Section V: Spanning Tree Protocols 243 Connecting VLANs Acro ss Different Regions Special consideration needs to be taken into account when you connect different MSTP regions or an MSTP region and a single-instance STP or RSTP region.
Chapter 21: Multipl e Spanning Tree Protocol 244 Section V: Spanning Tree Pro tocols Another approach is to group those VLANs that need to span regions into the same MSTI. Those VLANs that d o not span regions can be assigned to other MSTIs. Here is an example.
Section VI: Virtual LANs 245 Section VI V irtual LANs The chapters in this section d i scuss the various types of virtual LANs supported by the AT-9400 Switch.
246 Section VI: Virtual LANs.
Section VI: Virtual LANs 247 Chapter 22 Port-based and T agged VLANs This chapter contains overview information about port-base d and tagged virtual LANs (VLANs).
Chapter 22: Port-based and Tagged VLANs 248 Section VI: Virtual LANs Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408LC/SP – AT-9424T.
AT-S63 Management Software Features Guide Section VI: Virtual LANs 249 Overview A VLAN is a group of ports on an Ethernet switch that form a logical Ethernet segment. The ports of a VLAN form an indep endent traffic domain where the traffic generated by the nodes of a VLAN remains within the VLAN.
Chapter 22: Port-based and Tagged VLANs 250 Section VI: Virtual LANs Management Sof tware. Y ou can change the VLAN membership s through the management sof tware without moving the workstations physically , or changing group memberships by moving cables from one switch port to another .
AT-S63 Management Software Features Guide Section VI: Virtual LANs 251 Port-based VLAN Overview As explained in “Overview” on page 249 , a VLAN consists of a group of ports on one or more Et hernet switches that form an independent traffic domain.
Chapter 22: Port-based and Tagged VLANs 252 Section VI: Virtual LANs three AT-9400 Switches, you would assign the Ma rketing VLAN on each switch the same VID. You can assign this number manually or allow the AT-S63 Management Software to do it automatically.
AT-S63 Management Software Features Guide Section VI: Virtual LANs 253 Guidelines to Creating a Port- based VLAN Below are the guidelin es to creating a port-based VLAN.
Chapter 22: Port-based and Tagged VLANs 254 Section VI: Virtual LANs Port-based Example 1 Figure 32 illustrates an example of one AT-9424T/SP Gigabit Ethernet Switch with three port-based VLANs. (For p urposes of the following examples, the Default_VLAN is not shown.
AT-S63 Management Software Features Guide Section VI: Virtual LANs 255 In the example, each VLAN has one port connected to the router. The router interconnects the various VLANs and functions as a gateway to the WAN. Port-based Example 2 Figure 33 illustrates more port-based VL ANs.
Chapter 22: Port-based and Tagged VLANs 256 Section VI: Virtual LANs The table below lists t he port assignments fo r the Sales, Engineering, and Production VLANs on the switches: Sales VLAN - This VLAN sp ans both switches.
AT-S63 Management Software Features Guide Section VI: Virtual LANs 257 Tagged VLAN Overview The second type of VLAN supported b y the AT-S63 Management Software is the tagged VLAN . VLAN membership in a tagged VLAN is determined by information within the frames that are received on a port.
Chapter 22: Port-based and Tagged VLANs 258 Section VI: Virtual LANs Port VLAN Identifier Note For explanations of VLAN n ame and VLAN identifier, refer back to “VLAN Name” on page 251 and “VLAN Identifier” on page 251. Tagged and Untagged Ports You need to specify which ports will be members of the VLAN.
AT-S63 Management Software Features Guide Section VI: Virtual LANs 259 Tagged VLAN Example Figure 34 illustrates how tagged ports ca n be used to interconnect IEEE 802.
Chapter 22: Port-based and Tagged VLANs 260 Section VI: Virtual LANs The port assignments for the VLANs ar e as follows: This example is nearly identical to the “Port-based Example 2” on page 255. Tagged ports have been added to simplify network implementation and management.
Section VI: Virtual LANs 261 Chapter 23 GARP VLAN Registration Pr otocol This chapter describes the GARP VLAN Registration Protocol (GVRP) and contains the following sections: “Supported Platfor.
Chapter 23: GARP VLAN Registrat ion Protocol 262 Section VI: Virtual LANs Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408LC/SP – AT-.
AT-S63 Management Software Features Guide Section VI: Virtual LANs 263 Overview The GARP VLAN Registration Protocol (GVRP) allows network devices to share VLAN information. The main purpose of GVRP is to allow switches to automatically discover some of the VLAN information that would otherwise need to be manua lly configured in each switch.
Chapter 23: GARP VLAN Registrat ion Protocol 264 Section VI: Virtual LANs Figure 35 provides an exa mple of how GVRP works. Figure 35. GVRP Example Switches #1 and #3 contain t he Sales VLAN, but switch #2 does not. Consequently, the end nodes of the two parts of the Sales VLANs are unable to communicate with each other.
AT-S63 Management Software Features Guide Section VI: Virtual LANs 265 as an tagged dynamic GVRP port. If t he port is already a me mber of the VLAN, then no change is made.
Chapter 23: GARP VLAN Registrat ion Protocol 266 Section VI: Virtual LANs Guidelines Following are guidelines to obser ve when using this feature: GVRP is supported with STP and RSTP , or wit hout spanning tree.
AT-S63 Management Software Features Guide Section VI: Virtual LANs 267 GVRP and Network Security GVRP should be used with caution b e ca use it can expose your network to unauthorized access.
Chapter 23: GARP VLAN Registrat ion Protocol 268 Section VI: Virtual LANs GVRP-inactive Intermediate Switches If two GVRP-active devices are separat ed by a GVRP-inactive switch, the GVRP-active devices may not be able to share VL AN information. There are two issues involved.
AT-S63 Management Software Features Guide Section VI: Virtual LANs 269 Generic Attribute Registration Protocol (GARP) Overview The following is a technical overview of GARP.
Chapter 23: GARP VLAN Registrat ion Protocol 270 Section VI: Virtual LANs GARP architecture is shown in Figure 36. Figure 36. GARP Architecture The GARP application component of the GARP participa nt .
AT-S63 Management Software Features Guide Section VI: Virtual LANs 271 Figure 37. GID Architecture GARP registers and deregisters attribute values through GARP messages sent at the GID level. A GARP participant that wishes to make a declaration (an applicant registering an attribute value) sends a JoinIn or JoinEmpty message.
Chapter 23: GARP VLAN Registrat ion Protocol 272 Section VI: Virtual LANs To control the applicant state machine, an applicant admin i strative control parameter is provided. This parameter dete rmines whether or not the applicant state machine participates in GARP protocol exchanges.
Section VI: Virtual LANs 273 Chapter 24 Multiple VLAN Modes This chapter describes the multiple VLAN mo des. This chapter contains the following sections: “Supported Platforms” on p age 274 “Overview” on page 275 “802.1Q- Compliant Multiple VLAN Mode” on p age 276 “Non-802.
Chapter 24: Multipl e VLAN Modes 274 Section VI: Virtual LANs Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408LC/SP – AT-9424T/GB –.
AT-S63 Management Software Features Guide Section VI: Virtual LANs 275 Overview The multiple VLAN modes are designed to simplify the task of configuring the switch in network environments that require a high deg ree of network segmentation.
Chapter 24: Multipl e VLAN Modes 276 Section VI: Virtual LANs 802.1Q- Compliant Multiple VLAN Mode In this mode, each port is placed into a sep a rate VLAN as an untagged port.
AT-S63 Management Software Features Guide Section VI: Virtual LANs 277 This highly segmented confi guration is useful in situations where traffic generated by each end no de or network segment connected to a port on the switch needs to be kept separate from all other n etwork traffic, while still allowing access to an uplink to a WAN.
Chapter 24: Multipl e VLAN Modes 278 Section VI: Virtual LANs Non-802.1Q Compliant Multiple VLAN Mode Unlike the 802.1Q-compliant VL AN mode, which isolates port traffic by placing each port in a separate VLAN, this mode forms o ne VLAN with a VID of 1 that encompasses all po rts.
Section VI: Virtual LANs 279 Chapter 25 Pr otected Ports VLANs This chapter explains protecte d ports VLANs. It contains the following sections: “Supported Platforms” on p age 280 “Overv.
Chapter 25: Protected Ports VLANs 280 Section VI: Virtual LANs Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408LC/SP – AT-9424T/GB .
AT-S63 Management Software Features Guide Section VI: Virtual LANs 281 Overview The purpose of a protected ports VL AN is to allow multiple ports on the switch to share the same uplink port but not share traffic with each other.
Chapter 25: Protected Ports VLANs 282 Section VI: Virtual LANs To create a protected ports VLAN, you perform many of the same steps that you do when you create a new port-b ased or tagged VLAN. You give it a name and a unique VID, and you indicate which of the ports will be tagged and untagged.
AT-S63 Management Software Features Guide Section VI: Virtual LANs 283 Guidelines Following are the guidelines for im plementing p rotected ports VLANS: A protected port s VLAN should contain a minimum of two group s. A protected port s VLAN of only one group can be replaced with a p o rt- based or tagged VLAN instea d.
Chapter 25: Protected Ports VLANs 284 Section VI: Virtual LANs.
Section VI: Virtual LANs 285 Chapter 26 MAC Addr ess-based VLANs This chapter contains overview information about MAC address-based VLANs. Sections in the chapter includ e: “Supported Platforms.
Chapter 26: MAC Address-b ased VLANs 286 Section VI: Virtual LANs Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models Not supported.
AT-S63 Management Software Features Guide Section VI: Virtual LANs 287 Overview As explained in “Overview” on page 249, VLANs are a means for creating independent LAN segments within a network and are typically employed to improve network performance a nd security.
Chapter 26: MAC Address-b ased VLANs 288 Section VI: Virtual LANs Egress Ports Implementing a MAC address-based VLAN involves more than entering the MAC addresses of the end nodes that are members of the VLAN. You must also designate the egress ports o n the switch for the packets from the nodes.
AT-S63 Management Software Features Guide Section VI: Virtual LANs 289 The community characteristic of egress po rts relieves you from having to map each address to its corresponding egress port. You only need to be sure that all egress ports in a MAC address-based VLAN are represented at least once by being assig ned to at least on e address.
Chapter 26: MAC Address-b ased VLANs 290 Section VI: Virtual LANs If security is a major concern for your network, yo u might not want to assign a port as an egress port to more tha n one VLAN when pla nning your MAC address-based VLANs.
AT-S63 Management Software Features Guide Section VI: Virtual LANs 291 VLANs That Span Switches To create a MAC address-based VLAN that spa n s switches, you must replicate the MAC addresses of the VLAN nodes on all the switches where the VLAN exists.
Chapter 26: MAC Address-b ased VLANs 292 Section VI: Virtual LANs T able 23. Example of a MAC Address-based VLAN S p anning Switches Switch A Switch B VLAN Name: Sales VLAN Name: Sales MAC Address Egr.
AT-S63 Management Software Features Guide Section VI: Virtual LANs 293 VLAN Hierarchy The switch’s management software employs a VLAN hierarchy when handling untagged packets that arrive on a port that is an egress port of a MAC address-based VLAN as well as an untagged port of a port-based VLAN.
Chapter 26: MAC Address-b ased VLANs 294 Section VI: Virtual LANs Steps to Creating a MAC Address-based VLAN Here are the three main steps to creating a MAC address-based VLAN: 1. Assign the VLAN a name and a VID. You must also set the VLAN type to MAC Based.
AT-S63 Management Software Features Guide Section VI: Virtual LANs 295 Guidelines Follow these guidelines when imp l ementing a MAC address-based VLAN: MAC address-based VLANs are not supported on the A T-9408LC/SP, A T-9424T/GB and A T-9424T/SP switches.
Chapter 26: MAC Address-b ased VLANs 296 Section VI: Virtual LANs Egress ports canno t be part o f a static or LACP trunk. Since this type of VLAN does not sup port tagge d packet s, it is not suitable in environment s where a network device, such as a network server , needs to be shared between multiple VLANs.
Section VII: Internet Proto col Routing 297 Section VII Routing This section has the following chapters: Chapter 27, “Internet Protoco l V ersion 4 Packet Routing” on page 299 Chapter 28, .
298 Section VII: Internet Pro tocol Routing.
299 Chapter 27 Internet Pr otocol V ersion 4 Packet Routing This chapter describes Internet Protocol version 4 (IPv4) packet routing on the AT-9400 Basic Layer 3 Switc hes. The chapt er covers routing interfaces, static routes, and the Routing Information Protocol (RIP) versions 1 and 2.
Chapter 27: Internet Protocol Version 4 Packet Routing 300 Section VII: Routing Supported Platforms This feature is supported on the following switches: Layer 2+ Models – Not supported Basic.
AT-S63 Management Software Features Guide Section VII: Routin g 301 Overview This section contains an overview of the IPv4 routing feature on the AT-9400 Switch.
Chapter 27: Internet Protocol Version 4 Packet Routing 302 Section VII: Routing At the end of this overview are two examples that illustrate the sequence of commands to implementing the featu res described in this chapter. You can refer there to see how the commands are used in practice.
AT-S63 Management Software Features Guide Section VII: Routin g 303 Routing Interfaces The IPv4 packet routing feature o n the switch is built on the foundation of the routing interface.
Chapter 27: Internet Protocol Version 4 Packet Routing 304 Section VII: Routing Note Routing interfaces can be configured from either the command line interface or the menus interface.
AT-S63 Management Software Features Guide Section VII: Routin g 305 the other interfaces in the same VLAN must be assig ned manually. For example, if there are four interfaces and each of their respective subnets resided in a separate VLAN, the n each interface can obtain its IP addre ss and subnet mask from a DHCP or BOOTP server.
Chapter 27: Internet Protocol Version 4 Packet Routing 306 Section VII: Routing Interface Names Many of the IPv4 routing commands have a parameter for an interface name. An interface name consists of a VLAN and an interface nu mber, separated by a dash.
AT-S63 Management Software Features Guide Section VII: Routin g 307 Static Routes In order for the switch to route an IPv4 packet to a remote network or subnet, there must be a route to the de stination in the routing table of the switch.
Chapter 27: Internet Protocol Version 4 Packet Routing 308 Section VII: Routing destination. The range for the prefere nce parameter is 0 to 65535. The lower the value, the higher the prefere nce. The default value for a static route is 60. The commands for managing static routes are ADD IP ROUTE, DELETE IP ROUTE, and SET IP ROUTE.
AT-S63 Management Software Features Guide Section VII: Routin g 309 Routing Information Protocol (RIP) A switch can automatically learn routes to remo te destinations by sharing the contents of its routing table with its neighboring routers in the network with the Routing Information Protocol (RIP) version s 1 and 2.
Chapter 27: Internet Protocol Version 4 Packet Routing 310 Section VII: Routing their tables. Note A RIP version 2 password is sent in plaintext. The AT -S63 Management Software does not support encr ypted RIP passwords. The switch broadcasts its routing t able every thirty seconds from those interfaces that have RIP.
AT-S63 Management Software Features Guide Section VII: Routin g 311 Default Routes A default route is used when the switch cann ot find a route in its routing table for a packet that needs to be forwarded to a remote destination. Rather than discard the packet, the switch sends it to the next hop specified in the default route.
Chapter 27: Internet Protocol Version 4 Packet Routing 312 Section VII: Routing Equal-cost Multi-path (ECMP) Routing The routing table uses ECMP to store multiple routes to a remote destination so that the switch can dist ribute the traffic load over several routes.
AT-S63 Management Software Features Guide Section VII: Routin g 313 ECMP also applies to default routes. This enab les the switch to store up to 32 default routes with up to eight of the routes active at one time. The ECMP feature can be enable d and disabled on the switch.
Chapter 27: Internet Protocol Version 4 Packet Routing 314 Section VII: Routing Routing Table The switch maintains its routing information in a table of routes that tells the switch how to find a local or remote destinatio n. Each route is uniquely identified in the table by its IP add ress, network mask, next hop, p rotocol, and routing interface.
AT-S63 Management Software Features Guide Section VII: Routin g 315 Address Resolution Protocol (ARP) Table The switch maintains an ARP table of IP addresses and the ma tching Ethernet MAC addresses.
Chapter 27: Internet Protocol Version 4 Packet Routing 316 Section VII: Routing Internet Control Message Protocol (ICMP) ICMP allows routers to send error and control messa ges to other routers or hosts. It provides the comm unication between IP software on one system and IP software on another.
AT-S63 Management Software Features Guide Section VII: Routin g 317 T ime to Live Exceeded (1 1) If the TTL fie ld in a packet falls to zero the switch wil l send a “T ime to live exceeded” packet. This could occur if a route was excessively long or if too many hop s were in the path.
Chapter 27: Internet Protocol Version 4 Packet Routing 318 Section VII: Routing Routing Interfaces and Management Features Routing interfaces are primary intende d for the IPv4 packet routing feature. There are, however, a number of management functions that rely on the presence of at least one routing inte rface on the switch to operate properly.
AT-S63 Management Software Features Guide Section VII: Routin g 319 As an example, assume you decided not to implement t he IPv4 routing feature on a switch that had four local su bnets, but you wanted the switch to send its events to a syslog se rver and have access to a RADIUS authentication server.
Chapter 27: Internet Protocol Version 4 Packet Routing 320 Section VII: Routing Pinging a Remote Device This function is used to valid ate the existence of an active path between the switch and another network node. T he switch can ping a device if there is a routing interface on th e local subnet from where it reaches the device.
AT-S63 Management Software Features Guide Section VII: Routin g 321 Local Interface The local interface is used with the enhanced stacking feature . It is also used with remote management of a switch with a Telnet or SSH client, or a web browser.
Chapter 27: Internet Protocol Version 4 Packet Routing 322 Section VII: Routing AT-9408LC/SP AT-9424T/GB, and AT-9424T/SP Switches The AT-9408LC/SP, AT-9424T/GB, and AT-9424T/SP Switches d o not support the IPv4 packet routing fe ature. T hey do, however, support a limited version of some of the fe atures.
AT-S63 Management Software Features Guide Section VII: Routin g 323 Note The AT-9408LC/SP, AT-9424T/GB, and AT-9424T/SP Switches do not use the ARP table to move packets through the switching matrix. They refer to the table only when they perform a management function requiring them to communicate with ano ther network node.
Chapter 27: Internet Protocol Version 4 Packet Routing 324 Section VII: Routing Routing Command Example This section contains an example of the IPv4 routing feature.
AT-S63 Management Software Features Guide Section VII: Routin g 325 Creating the VLANs The first step is to create the VLANs for the lo cal subnets on the switch.
Chapter 27: Internet Protocol Version 4 Packet Routing 326 Section VII: Routing command. Adding a Static Route and Default Route Building on our example, assume you d ecided to manually enter a route to a remote subnet as a static route. The command for creating a static route is ADD IP ROUTE.
AT-S63 Management Software Features Guide Section VII: Routin g 327 Adding RIP Rather than adding the static routes to remo te destinations, or perhaps to augment them, you decide that the switch should learn routes by exchanging its route table with its rou ting neighbors using RIP.
Chapter 27: Internet Protocol Version 4 Packet Routing 328 Section VII: Routing Non-routing Command Example This example illustrates how to assign an IP address to a switch by creating just one interface.
AT-S63 Management Software Features Guide Section VII: Routin g 329 The following command creates a defau lt route for the example and specifies the next hop as 149.
Chapter 27: Internet Protocol Version 4 Packet Routing 330 Section VII: Routing Upgrading from AT-S63 Version 1.3.0 or Earlier When the AT-9400 Switch running AT-S63 version 1.
331 Chapter 28 BOOTP Relay Agent This chapter has the following sections: “Supported Platforms” on p age 332 “Overview” on page 333 “Guidelines” on p age 335.
Chapter 28: BOOTP Relay Age nt 332 Section VII: Routing Supported Platforms This feature is supported on the following switches: Layer 2+ Models – Not supported Basic Layer 3 Models – AT-9.
AT-S63 Management Software Features Guide Section VII: Routin g 333 Overview The AT-S63 Management Software comes with a BOOTP relay age nt for relaying BOOTP messages between clients and DHCP or BOOTP servers.
Chapter 28: BOOTP Relay Age nt 334 Section VII: Routing A routing interface that receives a BOOTP reply from a server inspects the broadcast flag field in the packet to det ermine whether the client, in its original request to the server, set this flag to signal that the re sponse must be sent as a broadcast datagram.
AT-S63 Management Software Features Guide Section VII: Routin g 335 Guidelines These guidelines apply to the BOOTP relay agent: A routing interface functions as th e BOOTP relay agent for the local clients in it s subnet. Y ou can specify up to eight DHCP or BOOTP servers.
Chapter 28: BOOTP Relay Age nt 336 Section VII: Routing.
337 Chapter 29 V irtual Router Redundancy Pr otocol The chapter has the following sections: “Supported Platforms” on p age 338 “Overview” on page 339 “Master Switch” on page 34.
Chapter 29: Virtual Rout er Redundancy Protocol 338 Section VII: Routing Supported Platforms This feature is supported on the following switches: Layer 2+ Models – Not supported Basic Layer .
AT-S63 Management Software Features Guide Section VII: Routin g 339 Overview This chapter describes the Virtual Router Redundancy Protocol (VRRP) support provided by the switch. One of the functions performed by swit ches is to act as a gateway to the WAN for hosts on a LAN.
Chapter 29: Virtual Rout er Redundancy Protocol 340 Section VII: Routing Master Switch The virtual router has a virtual MAC address known by all th e switches participating in the virtual router. T he virtual MAC address is derived from the virtual router identifie r, which is a user-defined value from 1 to 255.
AT-S63 Management Software Features Guide Section VII: Routin g 341 Backup Switches All the other switches participating in the virtua l router are designated as backup switches. A switch can be part of several diffe rent virtual routers on one LAN, provided that all the virtual routers have different virtual router identifiers.
Chapter 29: Virtual Rout er Redundancy Protocol 342 Section VII: Routing Interface Monitoring The virtual router can monitor certain inte rfaces to change the priority o f switches if the master switch loses its connection to th e outside world. This is known as interface monitoring .
AT-S63 Management Software Features Guide Section VII: Routin g 343 Port Monitoring Port monitoring is the process of detecting the failure of ports that are part of a VLAN that a virtual rou ter is running over.
Chapter 29: Virtual Rout er Redundancy Protocol 344 Section VII: Routing VRRP on the Switch VRRP is disabled by default. When a virtual router is crea ted on the switch, it is enabled by default, but the VRRP mo dule must be enabled before it is operational.
AT-S63 Management Software Features Guide Section VII: Routin g 345 prevents a switch from inadvertently backing up another switch. The authentication type and, in the case of pla intext authentication, the password, must be the same for all switches in the virtual router.
Chapter 29: Virtual Rout er Redundancy Protocol 346 Section VII: Routing.
Section VIII: Port Secu rity 347 Section VIII Port Security The chapters in this section contai n overview information on the port security features of the AT-9400 Switch. The chapter s include: Chapter 30, “MAC Address-based Port Security” on page 349 Chapter 31, “802.
348 Section VIII: Port Security.
Section VIII: Port Secu rity 349 Chapter 30 MAC Addr ess-based Port Security The sections in this chapter include: “Supported Platforms” on p age 350 “Overview” on page 351 “Inva.
Chapter 30: MAC Address-b ased Port Security 350 Section VIII: Port Security Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408LC/SP – .
AT-S63 Management Software Features Guide Section VIII: Port Security 351 Overview You can use this feature to enha nce the security of your network by controlling which end nodes can forwar d frames through the switch, and so prevent unauthorized individuals from accessing your network.
Chapter 30: MAC Address-b ased Port Security 352 Section VIII: Port Security Secured This security level uses only static MAC addresses assigned to a port to forward frames. Consequently, only those end nodes whose MAC addresses are entered as static addresses are able to fo rward frames through a port.
AT-S63 Management Software Features Guide Section VIII: Port Security 353 Invalid Frames and Intrusion Actions When a port receives an invalid frame, it has to select an in trusion action , which defines the port’s response to the packet. But before defining the intrusion actions, it helps to understand wh at constitutes an invalid frame.
Chapter 30: MAC Address-b ased Port Security 354 Section VIII: Port Security Guidelines The following guidelines apply to MAC address-based port security: The filtering of a packet occurs on th e ingress port, not on the egress port. Y ou cannot use MAC address port security and 802.
Section VIII: Port Secu rity 355 Chapter 31 802.1x Port-based Network Access Contr ol The sections in this chapter a re: “Supported Platforms” on p age 356 “Overview” on page 357 .
Chapter 31: 802.1x Port-based Network Access Con trol 356 Section VIII: Port Security Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408L.
AT-S63 Management Software Features Guide Section VIII: Port Security 357 Overview The AT-S63 Management Software has several different metho ds for protecting your network and its reso urces from unauthorized access.
Chapter 31: 802.1x Port-based Network Access Con trol 358 Section VIII: Port Security Authentication server - The authentication server is the network device that has the RADIUS server sof tware. This is the device that does the actual authenticating of the supplicant s.
AT-S63 Management Software Features Guide Section VIII: Port Security 359 Authentication Process Below is a brief overvie w of the authenticat ion process that occurs between a supplicant, authenticator, and authentication server. For further details, refer to the IEEE 802.
Chapter 31: 802.1x Port-based Network Access Con trol 360 Section VIII: Port Security Port Roles Part of the task of implementing this feat ure is specifying the roles of the ports on the switch.
AT-S63 Management Software Features Guide Section VIII: Port Security 361 Assigning unique username and password combinations to your network users and requiring the users to provide the information w.
Chapter 31: 802.1x Port-based Network Access Con trol 362 Section VIII: Port Security Note A supplicant connected to an authenticat or port set to force- authorized must have 802.
AT-S63 Management Software Features Guide Section VIII: Port Security 363 Authenticator Ports with Single and Multiple Supplicants An authenticator port has two operating modes.
Chapter 31: 802.1x Port-based Network Access Con trol 364 Section VIII: Port Security Figure 40. Authenticator Port in Single Operating Mode with a Single Client The example in Figure 41 on page 365 illustrates a configu ration that uses the piggy-back mode.
AT-S63 Management Software Features Guide Section VIII: Port Security 365 Figure 41. Single Operating Mode with Multiple Clients Using the Piggy- back Feature - Example 1 Because the piggy-back mode is activated on the authenticat or port, only one client needs to be authenticated in orde r for all the clients to forward traffic through the port.
Chapter 31: 802.1x Port-based Network Access Con trol 366 Section VIII: Port Security If the clients are connected to an 80 2.1x-compliant device, such a s another AT-9400 Switch, you can automate the initial log on and reauthentications by configuring one of the switch ports as a supplicant.
AT-S63 Management Software Features Guide Section VIII: Port Security 367 Figure 43. Single Operating Mode with Multiple Clients Using the Piggy- back Feature - Example 3 Multiple Operating Mode The second type of operating mode for an authenticator port is the Multiple mode.
Chapter 31: 802.1x Port-based Network Access Con trol 368 Section VIII: Port Security An example of this authenticator operating mode is illustrated in Figure 44. The clients are connected to a hub o r non-802.1x-compliant switch which is connected to an authen ticator port on the AT-9400 Switch.
AT-S63 Management Software Features Guide Section VIII: Port Security 369 none, port 6 on switch A will discard the packe ts because switch B would not be logged on to the port. Also notice that the ports where the clients are connected on switch B are set to the none role.
Chapter 31: 802.1x Port-based Network Access Con trol 370 Section VIII: Port Security Supplicant and VLAN Associations One of the challenges to man aging a network is accommodating end users that roam. These are individual s whose work requires that they access the network resources from differe nt points at different times.
AT-S63 Management Software Features Guide Section VIII: Port Security 371 Single Operating Mode Here are the operating characteristics for the switch when an authen ticator port is set to the Single o.
Chapter 31: 802.1x Port-based Network Access Con trol 372 Section VIII: Port Security Guest VLAN An authenticator port in the una uthorized state typically accepts and transmits only 802.
AT-S63 Management Software Features Guide Section VIII: Port Security 373 RADIUS Accounting The AT-S63 Management Software supports RADIUS accounting for switch ports set to the Authenticator ro le. This feature sends informatio n to the RADIUS server about the sta tus of its supplicants.
Chapter 31: 802.1x Port-based Network Access Con trol 374 Section VIII: Port Security General Steps Here are the general steps to implementing 802.1x Port-based Network Access Control and RADIUS a c counting on the switch: 1. You must install a RADIUS se rver on one or more of your network servers or management stations.
AT-S63 Management Software Features Guide Section VIII: Port Security 375 Guidelines The following are general guide lines to using this feature: Ports operating und er port-based access control do not support dynamic MAC address learning.
Chapter 31: 802.1x Port-based Network Access Con trol 376 Section VIII: Port Security An authenticator port cannot be part of a static port t runk, LACP port trunk, or port mirror .
AT-S63 Management Software Features Guide Section VIII: Port Security 377 Here are guidelines for adding VLAN assignments to su pplicant accounts on a RADIUS server: The VLAN can be either port-base d or tagged. The VLAN must already exist on the switch.
Chapter 31: 802.1x Port-based Network Access Con trol 378 Section VIII: Port Security.
Section IX: Manageme nt Security 379 Section IX Management Security The chapters in this section descr ibe the management security features of the AT-9400 Switch.
380 Section IX: Management Security.
Section IX: Manageme nt Security 381 Chapter 32 W eb Server The sections in this chapter a re: “Supported Platforms” on p age 382 “Overview” on page 383 “Configuring the W eb Ser.
Chapter 32: Web Server 382 Section IX: Management Security Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408LC/SP – AT-9424T/GB – AT.
AT-S63 Management Software Features Guide Section IX: Management Securi ty 383 Overview The AT-S63 Management Software has a web server and a specia l web browser interface that provide the ability to remotely manage the switch from a management workstation on your netwo rk using a web browser.
Chapter 32: Web Server 384 Section IX: Management Security Configuring the Web Server for HTTP The following steps configure the w eb serve r for non-secure HTTP operation. The steps re ference only the command line commands, but the web server can be configure d from the menus interface, too.
AT-S63 Management Software Features Guide Section IX: Management Securi ty 385 Configuring the Web Server for HTTPS The following sections outline the steps for configuring t he web server on the switch for HTTPS operation with a self-signed or CA certificate.
Chapter 32: Web Server 386 Section IX: Management Security 6. After receiving the certificates from the CA, down load them into the switch’s file syste m using t he LOAD METHOD=TFTP or LOAD METHOD=XMODEM command. 7. Add the certificates to the certificate data base with the ADD PKI CERTIFICATE command.
Section IX: Manageme nt Security 387 Chapter 33 Encryption Keys The sections in this chapter a re: “Supported Platforms” on p age 388 “Overview” on page 389 “Encryption Key Lengt.
Chapter 33: Encrypti on Keys 388 Section IX: Management Security Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408LC/SP – AT-9424T/GB .
AT-S63 Management Software Features Guide Section IX: Management Securi ty 389 Overview Protecting your managed switches from u nauthorized management access is an important role for a netwo rk manager.
Chapter 33: Encrypti on Keys 390 Section IX: Management Security Encryption Key Length When you create a key pair, you have to specify its length in bits. The range is 512, the default, to 1,536 bits, in increments of 256 bits. The longer the key, the more difficult it is for someone to decipher.
AT-S63 Management Software Features Guide Section IX: Management Securi ty 391 Encryption Key Guidelines Observe the following guidelines when creating an encryption key pair: Web browser encrypt ion requires only one key pair . SSH encryption requires two key p a irs.
Chapter 33: Encrypti on Keys 392 Section IX: Management Security Technical Overview The encryption feature provides the follo wing data security services: Data encryptio n Data authen tication.
AT-S63 Management Software Features Guide Section IX: Management Securi ty 393 algorithm and key . For a given input block of plaintext ECB always produces the same block of ciphertext. Cipher Block Chaining (CBC) is the most popular form of DES encryption.
Chapter 33: Encrypti on Keys 394 Section IX: Management Security secret. Only the decryption, or private key, needs to be kept secret. The other name for this type of algorithm is public key e ncryption. The public and private key pair cannot be randomly assigned, but must be generated together.
AT-S63 Management Software Features Guide Section IX: Management Securi ty 395 It is very hard to find another messag e and key which give the same hash The two most commonly used one-way hash a lgorithms are MD5 (Message Digest 5, defined in RFC 1321) and SHA-1 (Secure Hash Algorithm, defined in FIPS-180-1).
Chapter 33: Encrypti on Keys 396 Section IX: Management Security A Diffie-Hellman algorithm requires more processing overhead than RSA- based key exchange schemes, but it does not need the initial exchange of public keys. Instead, it uses publish ed and well t ested public key values.
Section IX: Manageme nt Security 397 Chapter 34 PKI Certificates and SSL The sections in this chapter a re: “Supported Platforms” on p age 398 “Overview” on page 399 “T ypes of C.
Chapter 34: PKI Certificat es and SSL 398 Section IX: Management Security Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408LC/SP – AT-.
AT-S63 Management Software Features Guide Section IX: Management Securi ty 399 Overview This chapter describes the second part of the encryption feature of the AT-S63 Management Software—PKI certificates. The first part is explained in Chapter 33, “Encryption Ke ys” on page 387.
Chapter 34: PKI Certificat es and SSL 400 Section IX: Management Security network equipment. With private CAs, companies can keep tra ck of the certificates and control access to various network devices.
AT-S63 Management Software Features Guide Section IX: Management Securi ty 401 Distinguished Names Part of the task to creating a self-signed certificate or enrollment request is selecting a distinguished name . A distingu ished name is integrated into a certificate along with the key an d can have up to five parts.
Chapter 34: PKI Certificat es and SSL 402 Section IX: Management Security If your network has a Domain Name System and you mapped a name to the IP address of a switch, you can specify the swit ch’s name instead of the IP address as the distinguished name.
AT-S63 Management Software Features Guide Section IX: Management Securi ty 403 SSL and Enhanced Stacking Secure Sockets Layer (SSL) is supported in an enhanced stack, but only when all switches in the sta ck are using the feature. When a switch’s web server is operating in HTTP, management packets are transmitted in plaintext.
Chapter 34: PKI Certificat es and SSL 404 Section IX: Management Security Guidelines The guidelines for creating certificates are: A certificate can have only one key . A switch can use only those certificates th at contain a key that was generated on the switch.
AT-S63 Management Software Features Guide Section IX: Management Securi ty 405 Technical Overview This section describes the Secure Sockets Layer (SSL) feature , a security protocol that provides a secure and private TCP connection between a client and server.
Chapter 34: PKI Certificat es and SSL 406 Section IX: Management Security SSL uses asymmetrical (Public Key) encryption to establish a conne ction between client and server, and symmetrical (Secret Key) encryption for the data transfer phase. User Verification An SSL connection h as two phases: handsh ake and data transfer .
AT-S63 Management Software Features Guide Section IX: Management Securi ty 407 To verify the authenticity of a server, the serve r has a public and private key. The public key is given to the user. SSL uses certificates for authentication. A certificate binds a public key to a server name.
Chapter 34: PKI Certificat es and SSL 408 Section IX: Management Security this, and other attacks, PKI provides a means for secure transfer of public keys by linking an identity and that ide ntity’s public key in a secure certificate.
AT-S63 Management Software Features Guide Section IX: Management Securi ty 409 Elements of a Public Key Infrastructure A public key infrastructure is a set of applicatio ns which manage the creation, retrieval, validation and storage of certificates.
Chapter 34: PKI Certificat es and SSL 410 Section IX: Management Security Certificate Validation To validate a certificate, the end en tity verifies the signature in the certificate, using the public key of the CA who issued the certificate.
AT-S63 Management Software Features Guide Section IX: Management Securi ty 411 PKI Implementation The following sections discuss the implement ation of PKI on the AT-9400 Switch.
Chapter 34: PKI Certificat es and SSL 412 Section IX: Management Security.
Section IX: Manageme nt Security 413 Chapter 35 Secur e Shell (SSH) The sections in this chapter a re: “Supported Platforms” on p age 414 “Overview” on page 415 “Support for SSH.
Chapter 35: Secure She ll (SSH) 414 Section IX: Management Security Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408LC/SP – AT-9424T/.
AT-S63 Management Software Features Guide Section IX: Management Securi ty 415 Overview Secure management is increasingly important in modern networks, as the ability to easily and effectively manage switches and the requ irement for security are two universal requireme nts.
Chapter 35: Secure She ll (SSH) 416 Section IX: Management Security Support for SSH The AT-S63 implementation of the SSH protocol is complia nt with the SSH protocol versions 1 .3, 1.5, and 2.0. In addition, the following SSH opt ions and features are supported: Inbound SSH connections (server mo de) is supported.
AT-S63 Management Software Features Guide Section IX: Management Securi ty 417 SSH Server When the SSH server is enabled, connections from SSH clients are accepted. When the SSH server is di sabled, connect ions from SSH clients are rejected by the switch.
Chapter 35: Secure She ll (SSH) 418 Section IX: Management Security SSH Clients The SSH protocol provides a secure connection be tween the switch and SSH clients. After you have configured th e SSH server, you need to install SSH client software on your manageme nt PC.
AT-S63 Management Software Features Guide Section IX: Management Securi ty 419 SSH and Enhanced Stacking The AT-S63 Management Software allows for encrypted SSH management sessions between a management station and a master switch of an enhanced stack, but not with sla v e switches, as explained in this section.
Chapter 35: Secure She ll (SSH) 420 Section IX: Management Security Because enhanced stacking does not allow for SSH encrypted management sessions between a management station and a slave switch, you configure SSH only on the ma ster switch of a stack.
AT-S63 Management Software Features Guide Section IX: Management Securi ty 421 SSH Configuration Guidelines Here are the guidelines to configuring SSH: SSH requires two encryption key p airs. One key pair functions as the host key and the other as the server key .
Chapter 35: Secure She ll (SSH) 422 Section IX: Management Security General Steps to Configuring SSH Configuring the SSH server involves the fo llowing procedures: 1. Create two encryption key pairs on the switch . One pair will function as the host key and the other the se rver key.
Section IX: Manageme nt Security 423 Chapter 36 T ACACS+ and RADIUS Pr otocols This chapter describes the two aut h entication protocols TACACS+ and RADIUS.
Chapter 36: TACACS+ and RADIUS Prot ocols 424 Section IX: Management Security Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408LC/SP –.
AT-S63 Management Software Features Guide Section IX: Management Securi ty 425 Overview TACACS+ and RADIUS are authentication protocols that can e nhance the security of your network. In general terms, these authentication pro tocols transfer the task of authenticating network access from a network device to an authentication protocol server.
Chapter 36: TACACS+ and RADIUS Prot ocols 426 Section IX: Management Security When a network manager logs in to a swit ch to manage the device, the switch passes the username and password entered by the manager to the authentication protocol server. The server checks to see if the username and password are valid.
AT-S63 Management Software Features Guide Section IX: Management Securi ty 427 Guidelines Here are the main steps to using the TACACS+ or RADIUS client on the switch. 1. Install a TACACS+ or RADIUS server on one or more of your network servers or management stations.
Chapter 36: TACACS+ and RADIUS Prot ocols 428 Section IX: Management Security maximum length for a password is 16 alphanumeric characters and spaces. – To create an account for a supplicant connecte.
AT-S63 Management Software Features Guide Section IX: Management Securi ty 429 Note If no authentication server re sponds or if no servers have been defined, the AT-S63 Management So ftware defaults to the standard manager and operator accounts. Note For more information on TACACS+, refer to the RFC 1492 standard.
Chapter 36: TACACS+ and RADIUS Prot ocols 430 Section IX: Management Security.
Section IX: Manageme nt Security 431 Chapter 37 Management Access Contr ol List This chapter explains how to restri ct Telnet and web browser managemen t access to the switch with the ma n agement access control list (ACL).
Chapter 37: Manage ment Access Control Li st 432 Section IX: Management Security Supported Platforms This feature is supported on the following AT-9 400 Switches: Layer 2+ Models – AT-9408LC/SP .
AT-S63 Management Software Features Guide Section IX: Management Securi ty 433 Overview This chapter explains how t o restrict remote management access of a switch by creating a management ac cess control list (management ACL).
Chapter 37: Manage ment Access Control Li st 434 Section IX: Management Security Parts of a Management ACE An ACE has the following three p arts: IP address Subnet mask Application IP Address You can specify the IP address of a specific man agement station or a subnet.
AT-S63 Management Software Features Guide Section IX: Management Securi ty 435 Guidelines Below are guidelines for the management ACL: The default setting for this feature is disab led. A switch can have only one management ACL. A management ACL can have up to 256 ACEs.
Chapter 37: Manage ment Access Control Li st 436 Section IX: Management Security Examples Following are several examples of ACEs. This ACE allows the management sta tion with the IP address 149.11.11.11 to remotely manage the switch using either the Telnet application protocol or a web browser, and to ping the device: IP Address: 149.
AT-S63 Management Software Features Guide Section IX: Management Securi ty 437 The two ACEs in this management ACL permit remote management from the management station with the IP addr ess 149.11.11.11 and all management stations in the subnet 14 9.22.
Chapter 37: Manage ment Access Control Li st 438 Section IX: Management Security.
439 Appendix A A T-S63 Management Softwar e Default Settings This appendix lists the factory default settings for the AT-S63 Management Software. It contains the following sections in alphabetical ord.
Appendix A: AT-S63 Manage ment Software Default Settings 440 “T elnet Server” on page 471 “Virtual Route r Redundancy Protocol” on page 472 “VLANs” on page 473 “Web Se rv.
AT-S63 Management Software Features Guide 441 Address Resolution Protocol Cache The following table lists the ARP cache default setting. ARP Cache Setting Default ARP Cache T imeout 150 seconds.
Appendix A: AT-S63 Manage ment Software Default Settings 442 Boot Configuration File The following table lists the names of the default configuration files. Boot Configuration File Default S tand-alone Switch boot.cfg S tack of A T-9400 Basic Layer 3 Switche s and the A T-S tackXG S t acking Module stack.
AT-S63 Management Software Features Guide 443 BOOTP Relay Agent The following table lists the defaul t setting for the BOOT P relay agent. BOOTP Relay Agent Setting Default S tatus Disabled Hop Count 1 1.
Appendix A: AT-S63 Manage ment Software Default Settings 444 Class of Service The following table lists the default mappings of IEEE 80 2.1p priority levels to egress port priority queues.
AT-S63 Management Software Features Guide 445 Denial of Service Defenses The following table lists the default se ttings for the Denial of Service prevention feature.
Appendix A: AT-S63 Manage ment Software Default Settings 446 802.1x Port-Based Network Access Control The following table describes the 802.1x Port-based Netwo rk Access Control default settings. The following table lists the defa u lt settings for RADIUS accounting.
AT-S63 Management Software Features Guide 447 The following table lists the defaul t settings for a supp licant port. VLAN Assignment Enabled Secure VLAN On Control Direction Both Piggyback Mode Disab.
Appendix A: AT-S63 Manage ment Software Default Settings 448 Enhanced Stacking The following table lists the enhanced stacking default settin g. Enhanced St acking Setting Default Switch S tate Slave.
AT-S63 Management Software Features Guide 449 Ethernet Protection Switch ing Ring (EPSR) Snooping The following table lists the EPSR default setting. EPSR Setting Default EPSR S tate Disabled.
Appendix A: AT-S63 Manage ment Software Default Settings 450 Event Logs The following table lists the defa ult settings for both the permanent and temporary event logs.
AT-S63 Management Software Features Guide 451 GVRP This section provides the default settings f or GVRP. GVRP Setting Default S tatus Disabled GIP S tatus Enabled Join T imer 20 centiseconds Leave T i.
Appendix A: AT-S63 Manage ment Software Default Settings 452 IGMP Snooping The following table lists the IG MP Snooping default settings. IGMP Snooping Setting Default IGMP Snooping S tatus Disabled M.
AT-S63 Management Software Features Guide 453 Internet Protocol Version 4 Packet Routing The following table lists the IPv4 packet routing default settings. Note The update and invalid timers ar e not adjustable. The switch does not support the IPv4 routing holddown and flush timers.
Appendix A: AT-S63 Manage ment Software Default Settings 454 MAC Address-based Port Security The following table lists the MAC addr ess-based port security default settings.
AT-S63 Management Software Features Guide 455 MAC Address Table The following table lists the defaul t setting for the MAC address t able. MAC Address T able Setting Default MAC Address Aging T ime 30.
Appendix A: AT-S63 Manage ment Software Default Settings 456 Management Access Control List The following table lists the defa u lt setting for the management access control list.
AT-S63 Management Software Features Guide 457 Manager and Operator Account The following table lists the ma nager and operator account default settings.
Appendix A: AT-S63 Manage ment Software Default Settings 458 Multicast Listener Discovery Snooping The following table lists the ML D Snooping default settings.
AT-S63 Management Software Features Guide 459 Public Key Infrastructure The following table lists the PKI defa u lt settings, including the generate enrollment request settings.
Appendix A: AT-S63 Manage ment Software Default Settings 460 Port Settings The following table lists the port configuratio n default settings . Port Configuration Setting Default S tatus Enabled 10/10.
AT-S63 Management Software Features Guide 461 RJ-45 Serial Terminal Port The following table lists the RJ-45 serial terminal port default settings. The baud rate is the only adjustable p arameter on the port.
Appendix A: AT-S63 Manage ment Software Default Settings 462 Router Redundancy Protocol Snooping The following table lists the RRP Sn ooping default setting.
AT-S63 Management Software Features Guide 463 Server-based Authentication (RADIUS and TACACS+) This section describes the serve r-based authentication, RADIUS, and TACACS+ client default settings. Server-based Authentication The following table describes the server-based authentication default settings.
Appendix A: AT-S63 Manage ment Software Default Settings 464 Simple Network Management Protocol The following table describes t he SNMP default settings.
AT-S63 Management Software Features Guide 465 Simple Network Time Protocol The following table lists the SNTP defau lt settings. SNTP Setting Default System T ime 00:00:00 on January 1, 1980 SNTP S tatus Disabled SNTP Server 0.
Appendix A: AT-S63 Manage ment Software Default Settings 466 Spanning Tree Protocols (STP, RSTP, and MSTP) This section provides the spanning tree, STP RSTP, and MSTP, de fault settings. Spanning Tree Switch Settings The following table describes the Spanning Tree Proto col default settings for the switch.
AT-S63 Management Software Features Guide 467 Multiple Spanning Tree Protocol The following table lists the MSTP d e fault settings. MSTP Setting Default S tatus Disabled Force V ersion MSTP Bridge He.
Appendix A: AT-S63 Manage ment Software Default Settings 468 Secure Shell Server The following table lists the SSH default settings. The SSH port number is not adjustable.
AT-S63 Management Software Features Guide 469 Secure Sockets Layer The following table lists the SSL defa u lt settings. SSL Setting Default Maximum Number of Sessions 50 Session Cache T imeout 300 se.
Appendix A: AT-S63 Manage ment Software Default Settings 470 System Name, A dministrato r, and Comments Settings The following table describes the IP default settings .
AT-S63 Management Software Features Guide 471 Telnet Server The following table lists the Telnet server default settings. The Telnet port number is not a djustable.
Appendix A: AT-S63 Manage ment Software Default Settings 472 Virtual Router Redundancy Protocol The following table lists the VRRP d efault setting. VRRP Setting Default S tatus Disabled.
AT-S63 Management Software Features Guide 473 VLANs This section provides the VLAN default settin gs. VLAN Setting Default Default VLAN Name Default_VLAN (all ports) Management VLAN ID 1 (Default_VLAN.
Appendix A: AT-S63 Manage ment Software Default Settings 474 Web Server The following table lists the we b server default settings. Web Server Configuration Setting Default S tatus Enabled Operati ng .
475 Appendix B SNMPv3 Configuration Examples This appendix provides two example s of SNMPv3 configuration using the SNMPv3 Table menus and a worksheet to use as an aid when configuring the SNMPv3 protocol.
Appendix B: SNMPv3 Configura tion Examples 476 SNMPv3 Configuration Examples This appendix provides SNMPv3 configuration e xamples for the following types of users: Manager Operator In addition an SNMPv3 Configuration Table is provid ed to record your SNMPv3 configuration.
AT-S63 Management Software Features Guide 477 Configure SNMPv3 SecurityToGroup Table User Name:s ystemadmi n24 Security Mode l:v3 Group Name: Man agers Storage Typ e: NonVol atile Configure SNMPv3 Not.
Appendix B: SNMPv3 Configura tion Examples 478 Configure SNMPv3 View Table Menu View Name : internet View Subtr ee OID: 1 .3.6.1 (or internet) Subtree Mas k: View Type : Included Storage Ty pe: NonVo .
AT-S63 Management Software Features Guide 479 Security Model Security Level Read View Name Wri te Vi ew N am e Notify View Name S torage T ype SNMPv3 SecurityT oGroup T able User Name Security Model G.
Appendix B: SNMPv3 Configura tion Examples 480 Security Model Security Level S torage T ype SNMPv3 Parameters (Continued).
481 Appendix C Featur es and S tandards This appendix lists the features an d standards of the AT-9400 Switch. Section include: ”10/100/1000Base-T T wisted Pair Port s” on page 482 ”Deni.
Appendix C: Features an d Standards 482 10/100/1000Base-T Twisted Pair Ports IEEE 802.1d Bridging IEEE 802.3 10Base -T IEEE 802.3u 100Base-TX IEEE 802.3ab 1000Base-T IEEE 802.3u Auto-Negotiation IEEE 802.3x 10/100 Mbps Flow Control / Backpressure IEEE 802.
AT-S63 Management Software Features Guide 483 Fiber Optic Ports (AT-9408LC/SP Switch) IEEE 802.1d Bridging IEEE 802.3z 1000Base-SX — Head of Line Blocking — Eight Egress Queues Per Port File Syste.
Appendix C: Features an d Standards 484 RFC 826 Address Resolution Protocol — Equal Cost Multi-path — Split Horizon and Split Horizon with Poison Reverse — Autosummarization of Routes RFC 1542 B.
AT-S63 Management Software Features Guide 485 Management Access Methods Enhanced Stacking ™ Out-of-band management (serial port) In-band management (over the network) using Telne t, SSH, web browser.
Appendix C: Features an d Standards 486 Port Security IEEE 802.1x Port-based Netw ork Access Control: Supports multiple supplicants per port and th e following authentication methods: EAP-MD5 EAP-TLS EAP-TTLS PEAP RFC 2865 RADIUS Client RFC 2866 RADIUS Accounting — MAC Address-based security Port Trunking and Mirroring IEEE 802.
AT-S63 Management Software Features Guide 487 RFC 1757 RMON Groups 1, 2, 3, and 9 Traffic Control RFC 2386 Quality of Service featuring: — Layer 2, 3, and 4 criteria — Flow Groups, Traffic Classes, and Policies — DSCP Replacement — 802.1q Priority Replaceme nt — Type of Service Replacement — Type of Service to 802.
Appendix C: Features an d Standards 488 — MAC Address-based VLANs (Not supported on the AT-9408LC/SP, AT-9424T/GB, and AT-9424T/SP switches.) IEEE 802.
489 Appendix D MIB Objects This appendix lists the SNMP MIB objects in the p rivate Allied Telesis MIBs that apply to the AT-S63 Management Software a nd the AT-9400 Switch.
Appendix D: MIB Objects 490 Access Control Li sts T able 31. Access Control Lists (AtiStackSwitch MIB) Object Name OID atiStkSwACLConfigTable 1.3.6.1.4.1.2 07.8.17.9.1 atiStkSwACLConfigEntry 1.3.6.1.4.1.207.8.17.9.1.1 atiStkSwACLModuleId 1.3.6.1.4.1.207.
AT-S63 Management Software Features Guide 491 Class of Service T able 32. CoS Scheduling (AtiStackSwitch MIB) Object Name OID atiSwQoSGroup 1.3.6.1.4.1.207.8.17.7 atiS tkSwQoSGroupNumberOfQueues 1.3.6.1.4.1.207.8.17.7.1 atiS tkSwQoSGroupSched ulingMode 1.
Appendix D: MIB Objects 492 Date, Time, and SNTP Client T able 36. Date, Time, and SNTP Client (AtiStackSwitch MIB) Object Name OID atiStkSysSystemTimeConfig 1.3.6.1.4.1.2 07.8.17.1.5 atiStkSwSysCurrentTime 1.3.6.1.4.1.207.8.17.1.5.1 atiStkSwSysCurrentDate 1.
AT-S63 Management Software Features Guide 493 Denial of Service Defenses T able 37. LAN Address and Subnet Mask (AtiStackSwitch MIB) Object Name OID atiStkDOSConfig 1.3.6.1.4.1.207.8.17.2.6 atiStkDOSConfigLANIpAddress 1.3.6.1.4.1.207.8 .17.2.6.1 atiStkDOSConfigLANSubnetMask 1.
Appendix D: MIB Objects 494 Enhanced Stacking T able 39. Switch Mode and Discovery (AtiStackInfo MIB) Object Name OID atiswitchEnhancedStackingInfo 1.3.6.1.4.1.207.8.16.1 atiswitchEnhStackMode 1.3.6.1.4.1.207.8.16.1.1 atiswitchEnhStackDiscover 1.3.6 .
AT-S63 Management Software Features Guide 495 GVRP T able 41. GVFP Switch Configuration (AtiStackSwitch MIB) Object Name OID atiStkSwGVRPConfig 1.3.6.1.4.1.207.8.17.3.6 atiStkSwGVRPStatus 1.3.6.1.4.1.207.8.17.3.6.1 atiStkSwGVRPGIPStatus 1.3.6.1.4.1.207.
Appendix D: MIB Objects 496 atiStkSwGVRPCountersPortNotListening 1.3.6.1.4.1.207.8.1 7 .3.8.1.8 atiStkSwGVRPCountersInvalidPort 1.3.6.1.4.1.207.8.17.3.8.1 .9 atiStkSwGVRPCountersInvalidProtocol 1.3.6.1.4.1.207.8.17.3.8.1 .10 atiStkSwGVRPCountersInvalidFormat 1.
AT-S63 Management Software Features Guide 497 MAC Address Table T able 44. MAC Address T able (AtiStackSwitch MIB) Object Name OID atiStkSwMacAddr2VlanTable 1.3.6.1.4.1.207.8 .17.3.3 atiStkSwMacAddr2VlanEntry 1.3.6.1.4.1.207.8.17.3.3.1 atiStkSwMacAddress 1.
Appendix D: MIB Objects 498 Management Access Control List T able 46. Management Access Control List S tatus (AtiStackSwitch MIB) Object Name OID atiStkSwSysMgmtACLGroup 1.3.6.1.4.1.207.8.17.1.7 atiStkSwSysMgmtACLStatus 1.3.6.1.4.1.207.8.17.1.7.1 T able 47.
AT-S63 Management Software Features Guide 499 Miscellaneous T able 48. System Reset (AtiStackSwitch MIB) Object Name OID atiStkSwSysGroup 1.3.6.1.4.1.207.8.17.1 atiStkSwSysConfig 1.3.6.1.4.1.207.8.17.1.1 atiStkSwSysReset 1.3.6.1.4.1.207.8.17.1.1 .1 T able 49.
Appendix D: MIB Objects 500 Port Mirroring T able 51. Port Mirroring (AtiStackSwitch MIB) Object Name OID atiStkSwPortMirroringConfig 1.3.6.1.4.1.2 07.8.17.2.2 atiStkSwPortMirroringState 1.3.6 .1.4.1.207.8.17.2.2.1 atiStkSwPortMirroringDestination ModuleId 1.
AT-S63 Management Software Features Guide 501 Quality of Service T able 52. Flow Groups (AtiS t ackSwitch MIB) Object Name OID atiStkSwQosFlowGrpTable 1.3.6.1.4.1.207.8 .17.7.5 atiStkSwQosFlowGrpEntry 1.3.6.1.4.1.207.8.17.7.5 .1 atiStkSwQosFlowGrpModuleId 1.
Appendix D: MIB Objects 502 atiStkSwQosTrafficClassClassPriority 1.3.6.1.4.1.2 07.8.17.7.6.1.9 atiStkSwQosTrafficClassRemarkPriority 1.3.6.1.4.1.207.8.1 7.7.6.1.10 atiStkSwQosTrafficClassToS 1.3.6.1.4.1.2 07.8.17.7.6.1.1 1 atiStkSwQosTrafficClassMoveToSToPriority 1.
AT-S63 Management Software Features Guide 503 Port Configuration and Status T able 55. Port Configuration and S ta tus (AtiStackSwitch MIB) Object Name OID atiStkSwPortConfigTable 1.3.6.1.4.1.207.8.17.2.1 atiStkPortConfigEntry 1.3. 6.1.4.1.207.8.17.2.
Appendix D: MIB Objects 504 Spanning Tree T able 56. S panning T ree (AtiStackSwitch MIB) Object Name OID atiStkSwSysConfig 1.3.6.1.4.1.207.8.1 7.1.1 atiStkSwSysSpanningTreeStatus 1.3.6.1.4.1.2 07.8.17.1.1.9 atiStkSwSysSpanningTreeVersion 1.3.6.1.4.1.
AT-S63 Management Software Features Guide 505 Static Port Trunk T able 57. S tatic Port T runks (AtiStackSwitch MIB) Object Name OID atiStkSwStaticTrunkTable 1.3.6.1.4.1.207.8.17.8.1 atiStkSwStaticTrunkEntry 1.3.6.1.4.1.207.8 .17.8.1.1 atiStkSwStaticTrunkModuleId 1.
Appendix D: MIB Objects 506 VLANs The objects in Table 58 display the specifications o f the Default_VLAN. The objects in Table 59 display the names and VIDs of all the VLANs on a switch, but not the VLAN ports. T able 58. VLAN T able (AtiStackSwitch MIB) Object Name OID atiStkSwVlanConfigTable 1.
AT-S63 Management Software Features Guide 507 T able 61. PVID T able (AtiStackSwitch MIB) Object Name OID atiStkSwPort2VlanTable 1.3.6.1.4.1.207.8.17.3.2 atiStkSwPort2VlanEntry 1.3.6.1.4.1.207.8.17.3.2 .1 atiStkSwPortVlanId 1.3.6.1.4.1.207.8.17.3.2.1.
Appendix D: MIB Objects 508.
509 Index Numerics 802.1p priority level in classifiers 113 802.1Q-compliant VLAN mode 276 802.1x Port-based Network Access Control authentication process 359 authenticator port role 357 default setti.
Index 510 TCP source and destination ports 117 UDP source and destination ports 117 VLAN ID 114 Common and Internal Spanning Tree (CIST) defined 23 8 priority 238 common VLAN 59 community names SNMPv1 and SNMPv2c 68 configuration files.
AT-S63 Management Software Features Guide 511 interface monitoring 342 Internet Group Manage ment Protocol (IGMP) snooping default settings 452 described 177 supported platforms 176 Internet Protocol .
Index 512 O operator accounts, default settings 457 P password, default 43 path cost 217 permit access control lists 121 ping of death attack 169 PKI. See Public Key Infrastructure (PKI) Platforms 180.
AT-S63 Management Software Features Guide 513 encryption keys 416 management sessions 41 server 41, 417 supported platforms 414 Secure Sockets Layer (SSL) See also certificates, encryption key and enh.
Index 514 Triple DES (3DES) encryption algorithms 393 U UDP destination po rts 117 UDP destination ports in classifie rs 117 UDP source ports 117 UDP source ports in classifiers 117 untagged ports 252 User-based Security Model (USM) authentication 199 username, default 43 V Virtual LAN.
デバイスAllied Telesis AT-S63の購入後に（又は購入する前であっても）重要なポイントは、説明書をよく読むことです。その単純な理由はいくつかあります：
Allied Telesis AT-S63をまだ購入していないなら、この製品の基本情報を理解する良い機会です。まずは上にある説明書の最初のページをご覧ください。そこにはAllied Telesis AT-S63の技術情報の概要が記載されているはずです。デバイスがあなたのニーズを満たすかどうかは、ここで確認しましょう。Allied Telesis AT-S63の取扱説明書の次のページをよく読むことにより、製品の全機能やその取り扱いに関する情報を知ることができます。Allied Telesis AT-S63で得られた情報は、きっとあなたの購入の決断を手助けしてくれることでしょう。
Allied Telesis AT-S63を既にお持ちだが、まだ読んでいない場合は、上記の理由によりそれを行うべきです。そうすることにより機能を適切に使用しているか、又はAllied Telesis AT-S63の不適切な取り扱いによりその寿命を短くする危険を犯していないかどうかを知ることができます。
ですが、ユーザガイドが果たす重要な役割の一つは、Allied Telesis AT-S63に関する問題の解決を支援することです。そこにはほとんどの場合、トラブルシューティング、すなわちAllied Telesis AT-S63デバイスで最もよく起こりうる故障・不良とそれらの対処法についてのアドバイスを見つけることができるはずです。たとえ問題を解決できなかった場合でも、説明書にはカスタマー・サービスセンター又は最寄りのサービスセンターへの問い合わせ先等、次の対処法についての指示があるはずです。
