Smart III Switch Functions and Features WebUI Config Guide 1 1 ©Copyright 2007. By D-Link HQ TSD...
-
Upload
sybil-cole -
Category
Documents
-
view
221 -
download
3
Transcript of Smart III Switch Functions and Features WebUI Config Guide 1 1 ©Copyright 2007. By D-Link HQ TSD...
Smart III Switch
Functions and Features
WebUI Config Guide
1 1
©Copyright 2007. By D-Link HQ TSD James Chu
Smart Wizard
Before entering the Web-based Management Utility, you can see the Smart Wizard first, it will guide you to quick configure some functions as below. If you don’t plan to change anything, click Exit to exit the Wizard and enter the Web Interface:
- Password Setting
- SNMP Setting
- System Setting
Function Tree OverviewSystem• System Settings• Trap Settings• Port Settings• SNMP Settings• Password Access Control• System Log Settings
Configuration• Jumbo Frame• 802.1Q VLAN• 802.1Q Management VLAN• Voice VLAN• Link Aggregation• IGMP Snooping• Port Mirroring• Power Saving• Loopback Detection• SNTP Settings• Spanning Tree
QoS• Storm Control• Bandwidth Control• 802.1P/DSCP Priority Settings
Security• Trusted Host• Safeguard Engine• Port Security• 802.1x• MAC Address Table
• ACL● ACL Configuration Wizard● Access Profile List● ACL Finder
• Monitoring● Statistics● Cable Diagnostics● System Log
System Contents
System• System Settings
• Trap Settings
• Port Settings
• SNMP Settings
• Password Access Control
• System Log Settings
System>> Contents
System SettingsIP Information• Static: When using static mode, the IP Address, Subnet Mask and Gateway can be manually
configured
• DHCP: When using DHCP mode, the Switch will first look for a DHCP server to provide it with an IP address, network mask, and default gateway before using the default or previously entered settings
System Information• System Name: For easier recognized when manage.
• System Location: For easier recognized when manage.
• Login Timeout (3-30 minutes): For controls the idle time-out for security purposes.
• Group Internal (120-1225 seconds): For routinely send report packets to the SmartConsole Utility in order to maintain the correct data shown. Setting zero (0) means disable Group Interval.
System>> System Settings
Trap SettingsTrap is a message which is initiated by switch, when some abnormal conditions happen (Ex: link change, device bootup), switch will send out the announcement to notify the managed stations.
Trap Settings for Smart Console Utility:• It allows Smart Console Utility to monitor specified events on Smart Switch, the default is disabled.
• The Destination IP for the managed station that will receive trap information.
• After enabled, when the specified events happen (ex: Link change), Smart switch will send out the UDP packets which contain the events information to Smart Console Utility for the log.
System>> Trap Settings
Port SettingsPort Settings:
• By selecting a range of ports, setting the Speed to be “Auto mode, forced mode, or Disabled”, the Flow Control to be enabled or disabled, and lastly MDI/MDIX to
“Auto, MDI or MDIX”.
System>> Port Settings
SNMP SettingsSNMP Setting:• SNMP, Simple Network Management Protocol, developing to manage the devices, by using the OID and
SNMP commands to read or modify it.
Community Setting:• Community Strings are like passwords between switch and managed PC.
Trap Setting:• Traps are messages that alert some events occur on the Switch, and send SNMP Trap Packets to the
managed PC for the notify.
System>> SNMP Settings
SNMP Settings TestTopology:
After configure the SNMP Setting as last slide, we can use the following 2 method for getting the information from smart switch (DGS-1210 in this example):• SNMP: (use “commTrapIpAddress” for the example: the IP Address of this SNMP Trap Community Entry)
#snmpwalk -v2c -c private 192.168.0.1 1.3.6.1.4.1.171.10.76.5.1.3.1.3
• Trap:
>> SNMP Settings Test
DGS-1210Managed PC192.168.0.5
System
Test Client forlink up/down
Password Access Control
Password Access Control
>> Password Access Control
System
System Logs Settings• System Log Configuration
– System Logs record and manage events, as well as report errors and informational messages. Message severity determines a set of event messages that will be sent. Click Enable so you can start to configure the related settings of the remote system log server, then press Apply for the changes to take effect.
>> System Logs Settings
System
Configuration ContentsConfiguration• Jumbo Frame
• 802.1Q VLAN
• 802.1Q Management VLAN
• Voice VLAN
• Voice VLAN Settings• Voice VLAN OUI Settings
• Link Aggregation
• Port Trunkings• LACP Port Settings
• IGMP Snooping
• Port Mirroring
• Power Saving
• Loopback Detection
• SNTP Settings
• Time Settings• TimeZone Settings
• Spanning Tree
• STP Global Settings
• STP Port Settings
Configuration>> Contents
Jumbo Frame (only for DGS series)
Jumbo Frame Configuration• Jumbo frames mean larger than the Ethernet frame size of 1500 bytes, and D-Link Gigabit Smart
Switches support jumbo frame up to 10000 bytes (around 10KB). Default is disabled.
Configuration>> Jumbo Frame
802.1Q VLANExample for edit a VLAN:
Configuration>> 802.1Q VLAN
802.1Q VLAN
Example for create an new VLAN:
Configuration>> 802.1Q VLAN
802.1Q VLANExample for the Asymmetric VLAN:• Asymmetric VLAN allows devices in different VLANs to communicate with the servers, firewalls
or other shared resources in the shared VLAN.
• As the diagram below, VLAN 2 and VLAN 3 cannot communicate each other, but both of them can access to VLAN 1 by Asymmetric VLAN.
VLAN 1 (Shared VLAN)
VLAN 2 (Access VLAN)
VLAN 3 (Access VLAN)
Configuration>> 802.1Q VLAN
802.1Q VLANAsymmetric VLAN Test Topology:
Settings:
Configuration>> 802.1Q VLAN
PC1 (VID 2)
PC2 (VID 3)
PC3 (VID 4)
Servers (VID 1)
Firewall (VID 1)
5 6 7 15-18 20
802.1Q Management VLAN
By default, all VLANs are the Management VLAN in smart switch. So 802.1Q Management VLAN setting allows you to transfer the authority to one specific VLAN. Default is disabled.
For example, we can set the VLAN 2 to be the only one Management VLAN in smart switch, so the client who connected to VLAN 2 can access to DGS-1224T:• First, there are 3 VLANs in DGS-1224T:
• Change the “VID 2” to be Management VLAN only:
>> 802.1Q Management VLAN
Configuration
Voice VLAN • Voice VLAN Settings
– Voice VLAN is a feature that allows you to automatically place the voice traffic from IP phone to an assigned VLAN to enhance the VoIP service. With a higher priority and individual VLAN, the quality and the security of VoIP traffic are guaranteed. Switch will add ports to the voice VLAN automatically if it detects the device OUI matches the Telephony OUI configured in the Voice VLAN OUI Setting page.
>>Voice VLAN
Configuration
Voice VLAN• Voice VLAN OUI Settings
– This window allows the user to configure the user-defined voice traffic’s OUI. An Organizationally Unique Identifier (OUI) is the first three bytes of the MAC address. This identifier uniquely identifies a vendor, manufacturer, or other organization.
>>Voice VLAN
Configuration
Link Aggregation Port Trunking• The Trunking function enables the cascading of two or more ports for a combined larger bandwidth. Up
to eight Trunk groups may be created, each supporting up to 8 ports.
Configuration>> Trunk
Link Aggregation• LACP port settings
– The LACP Port Settings is used to create port trunking groups on the Switch. The user may set which ports will be active and passive in processing and sending LACP control frames and Port priority. In order to utilize the ability to change an aggregated port group, that is, to add or subtract ports from the group, at least one of the participating devices must designate LACP ports as active. Lastly the administrative LACP timeout.
>>Link Aggregation
Configuration
IGMP Snooping
IGMP Snooping Configuration: With IGMP Snooping, the Smart Switch can make intelligent multicast forwarding decisions by examining the contents of each frame’s Layer 2 MAC header.
• IGMP Global Settings.
• VLAN Setting of IGMP Snooping: After enable IGMP Snooping, you can edit each VLAN Settings of IGMP Snooping.
Configuration>> IGMP Snooping
Port MirroringPort Mirroring• Port Mirroring is a method of monitoring network traffic that forwards a copy of each incoming and/or
outgoing packet from one port of the Switch to another port where the packet can be studied.
• Target Port: Select a target port which will monitor.
• Source Port: Select a source port which will be monitored, and the sniffer mode as TX, RX, or Both.
Configuration>> Port Mirroring
Power Saving (only for DGS series)Power Saving:• The Power Saving mode feature reduces power consumption automatically when the port link
down or the connected devices are turned off. By default, the Power Saving mode is enabled.
• For example, the following is the Power Consumption Table in 110V AC (Unit: W) on DGS-1210:Test Items Enable PS Disable PS Old revision
All port Link Down Test 8.4 W 10.8 W 13.4 W
1/2 port Link Up w/o traffic 18.0 W 18.7 W 26.8 W
1/2 port Link Up w 100% traffic
18.5 W 19.0 W 27.7 W
All port Link Up w/o traffic 29.8 W 29.8 W 44.1 W
All port Link Up w 100% traffic 30.4 W 30.4 W 45.2 W
PowerSavingTestResult_DGS-12XX.zip
Configuration>> Power Saving
Loopback DetectionLoopback Detection Settings• The Loopback Detection function is used to detect the loop created by a specific port while
Spanning Tree Protocol (STP) is not enabled in the network. The Switch will automatically shutdown the port and sends a log to the administrator.
• Loopback Detection Global Settings: Set the Loop detection interval and the Loopback Detection port will be unlocked when the Loopback Detection Recover Time times out and .
>>Loopback Detection
Configuration
SNTP SettingsTime Settings• Simple Network Time Protocol is used by the Switch to synchronize the clock of the computer.
• SNTP Server Configuration: Specify the IP address of the primary and Secondary SNTP server from which the system time is retrieved or Set time from a PC.
>>SNTP Settings
Configuration
SNTP SettingsTimeZone Settings• The TimeZone Setting Page is used to configure time zones and Daylight Savings time settings for
SNTP
• DST Annual Settings: Using annual mode will enable DST seasonal time adjustment
>>SNTP Settings
Configuration
Spanning TreeSTP Global Settings• Enabled, the Switch will listen for BPDU packets and its accompanying Hello packet. BPDU
packets are sent even if a BPDU packet was not received. Therefore, each link between bridges is sensitive to the status of the link results in faster detection of failed links, and thus faster topology adjustment.
>>Spanning Tree
Configuration
Spanning TreeSTP Port Settings• STP can be set up on a port per port basis. In addition to setting Spanning Tree parameters for
use on the switch level, the Switch allows for the configuration of the groups of ports, each port-group of which will have its own spanning tree, and will require some of its own configuration settings.
• Setting for External Cost define a metric that indicates the relative cost of forwarding packets , Migrate parameter as “Yes” will set the ports to send out BPDU packets to other bridges, requesting information on their STP setting and Edge selected the port as an edge port that cannot create loops.
>>Spanning Tree
Configuration
PoE Contents
PoE:• PoE Port Settings
• PoE System Settings
PoE (Power Over Ethernet)PoE, means Power Over Ethernet, is a technology that allows to supply electricity over standard Ethernet cables, as well as providing the data, which is defined by the IEEE 802.3af specification.
PoE consists of 2 components :• PSE: means Power Sourcing Equipment, the devices which provide the power to PD.
• PD: means Powered Device, the devices which receive the power from PSE, it could be IP telephones, wireless AP, network cameras, and other appliances.
IEEE 802.3af defined that the PSE provides power according to the following classification:
Class Usage Max power used by PD
0 Default 15.4W
1 Optional 4.0W
2 Optional 7.0W
3 Optional 15.4W
4 Reserved 15.4W
PoE>> PoE
PoE (Power Over Ethernet)
DGS-1210-10P supports PoE:• Supply power to PD device up to 15.4W per port. • The Power Budget of all switch is 180W.
• When port current is over 350mA, switch will auto disable the ports.
PoE System settings:• Power Threshold: When the ratio of the system power supply is larger than or smaller than the
System Power Threshold Setting, the Switch will send trap events to the Management Station.
>> PoE
PoE
PoE (Power Over Ethernet)PoE Port Settings:• Power Limit: This function allows you to manually set the port power current limitation to be given to
the PD. Select from "Class 1 (4.0W )", "Class 2 (7.0W ) ", "Class 3 (15.4.W ) " and "Auto" for the power limit.
• PoE Port Status: we also provide the auto discovery feature, automatically recognize the connection of PD device. 5 diagnostics status in this section: “Normal”, “Power management cause fail”, “Over current”, “Short circuit”, and “Power ON”.
>> PoE
PoE
PoE (Power Over Ethernet) TestTopology:
Setting:• Enable PoE function on port 1-5, and select power limit to “Auto”.
• Connected DWL-8200AP to DGS-1210-10P, then AP start working by the power provided from PoE switch.
• Check the Table, after Auto check, the PD is class 3 with 4.41W / 49.53V / 89.06mA, and status is “Power ON”, means work well.
>> PoE Test
PoE
DGS-1210-
10P
PSE:DGS-1210-10P
3
PD:DWL-8200AP
LAN1 (PoE)
. ...
QoS Contents
QoS• Storm Control
• Bandwidth Control
• 802.1P/DSCP Priority Settings
QoS>> Contents
Storm ControlQoS>> Storm Control
• Storm Control– The Storm Control feature provides the ability to control the receive rate of broadcast,
multicast, and unknown unicast packets.
Bandwidth ControlQoS>>Bandwidth Control
• Bandwidth Control– The Bandwidth Control page allows network managers to define the bandwidth settings for a specified
port’s transmitting and receiving data rates.
– By setting Disabled in No Limit, the selected port will have no bandwidth limit. If enable, the Rate field allows you to enter the data rate, in Kbits per second, will be the limit for the selected port.
802.1p/DSCP Priority SettingsQoS:• QoS can provide different priority to different users or data flows, or guarantee a certain level of
performance to a data flow in accordance with requests from the application program or the internet service provider policy.
Qos mode:• 802.1p
• DSCP
Queue Mechanism: • Strict Priority
• WRR (Weighted Round-Robin)
QoS>> 802.1p/DSCP Priority Settings
802.1p/DSCP Priority- Qos mode802.1p:
• 802.1p priority in the VLAN tag, for layer 2 packets.
• For ingress tagged packets, D-Link Smart Switches will refer to their 802.1p information and prioritize them with 4 different priority queues (Highest, High, Medium, Low).
• For ingress untagged packets, the per port "Default Priority" settings will be applied to packets of each port to provide port-based traffic prioritization.
• For our smart switch, 802.1p support 4 queues of the priority:Switch Priority Queues 802.1p Priority Class of Traffic
Highest 6, 7 3
High 4, 5 2
Medium 0, 3 1
Low 1, 2 0
Tagged frame
Untagged frame
Tagged frame
Tagged frame
VIDPri. VIDPri.
PVIDPri.
Ingress Rule
QoS>> 802.1p/DSCP Priority-QoS Mode
802.1p/DSCP Priority- Qos modeDSCP:
• Differentiated Services Code Point (DSCP), is a field in the IP header of layer 3 that enables different levels of service to be assigned to network traffic. This is achieved by marking each packet on the network with a DSCP code and appropriating to it the corresponding level of service.
• For our smart switch, we’ll check the DSCP value from the incoming packets, and decide the priority of handling by mapping the value to our DSCP Priority Table in switch.
• Also we have 4 queues for mapping DSCP Value into different level of priority: Highest, High, Medium, and Low.
QoS>> 802.1p/DSCP Priority-QoS Mode
76543210
DSCP
Offset FCSProtoTTLIDLENToSVersion SA_IP DA_IP DataL3 IPV4
Unused Bits
802.1p/DSCP Priority- Queue MechanismStrict Priority: to process the packets with the highest priority.
Highest Priority Queue
45 1
4
2
5
6
3
High Priority Queue
Medium Priority Queue
Low Priority Queue
1
3
26
QoS>> 802.1p/DSCP Priority-Queue Mechanism
802.1p/DSCP Priority- Queue MechanismWRR (Weighted Round-Robin): to process packets according to the weight of each priority within our
smart switch.
x
x
x
x
xx
x
x
x
x
x
x
1718
25
17
18
25
9101112
1920
2628 27
QoS>> 802.1p/DSCP Priority-Queue Mechanism
9
10
11
12
1234
5678
13141516
21222324
293032 31
1
2
3
4
5
6
7
8
Medium Priority Queue (20%)
High Priority Queue (40%)
Highest Priority Queue (80%)
Low Priority Queue (10%)
Security Contents
Security• Trusted Host
• Safeguard Engine
• Port Security
• 802.1x
• 802.1x Setting• MAC Address Table
• Static MAC• Dynamic Forwarding Table
Security>> Contents
Trusted Host
Trusted Host• Use Trusted Host function to manage the switch from a remote station, you can create 3 designated
management stations by defining the IP address/Mask.
Security>> Trusted Host
1
2
3
Safeguard Engine
If there are malicious hosts attacking the Switch, the CPU receiving high packet rate and CPU utilization may be very high. During this period, normal management services will be impacted. (i.e. ARP packet storm)
So the solution is Safeguard Engine. This function is designed to reduce the CPU utilization, and protects D-Link Switches from malicious viruses or worm attacks.
Safeguard Engine is enabled by default in Smart Switches and disabled by default in Managed Switches.
Security>> Safeguard Engine
* This feature are supported in both D-Link Smart and Managed Switches.
Port Security
Port Security• Port Security is a security feature that prevents unauthorized computers (with source MAC addresses) unknown to the
Switch prior to stopping auto-learning processing from gaining access to the network by stopping such that the current source MAC addresses entered into the MAC address forwarding table can not be changed once the port lock is enabled.
Security>> Port Security
802.1x802.1x define a client/server-based access control and authentication protocol that restricts unauthorized devices from connecting to a LAN through publicly accessible ports. The Authentication Server authenticates each client connecting to a switch port before making any services offered by the switch or LAN available.
802.1X Authentication Mechanism consists of three components• Authentication Server (RADIUS Server) : The Authentication Server validates the identity of
the client and notifies the Authenticator.
• Authenticator (Switch) : The Authenticator requests information from the client, verifies that information with the Authentication Server and relays a response to the client.
• Client : The client requests access to the LAN and switch services and responds to the requests from the switch. The Workstation must run 802.1X-Compliant Client Software (eg. Windows XP has embedded 802.1X suppliant).
Security>> 802.1x
RADIUS Server(Authentication Server)
Switch(Authenticator)
Client
Authentication Server
802.1x Client802.1x Client
802.1x Client
Unauthorized Device
802.1x
802.1x setting interface on smart switch:• Radius Server IP: assign the IP Address of Radius Server.
• Authentication Port: sets primary port for security monitoring. Default is 1812.
• Key: Masked password matching the Radius Server Key.
• ReAuthEnabled: This enables or disables the periodic ReAuthentication control. When the 802.1X function is enabled, the ReAuthEnabled function is by default also enabled.
• ReAuthPeriod: This command affects the behavior of the switch only if periodic re-authentication is enabled. Default is 3600.
1
23
Security>> 802.1x
802.1x TestTopology:
Test Result:
Authentication Username/password test/test
DGS-1210 802.1x enabled port 1-8
Radius Server Secret key dlink
DGS-1210
Radius Server192.168.0.10
802.1x Client192.168.0.5
315
DGS-1210192.168.0.1
MAC Address TableStatic MAC• Disable Auto Learning Excluding Uplink Port:
• When turn on it (means disable auto learning), switch will not learn any MAC address to MAC Address Table except for the uplink port you check in the port list, and switch should follow the static MAC table for the security.
• For example, after turn on this feature and select the port 1 to be uplink port, then only the devices under port 1 can be learned by switch.
• Static MAC Address Lists: displays the static Mac address list, as well as the VID.
Security>> MAC Address Table
1
2
3
MAC Address Table
Dynamic Forwarding Table: • For each port, this table displays the Mac address of each packet passing through the Switch, and you
can add the Mac address into static Mac Address list by the following steps:
Security>> MAC Address Table
1
2
3
ACL ContentsACL• ACL Configuration Wizard
• Access Profile List
• ACL Finder
ACL>> Contents
ACL Configuration Wizard
ACL Configuration Wizard• Access Control List (ACL) allows you to establish criteria to determine whether or not the Switch will
forward packets based on the information contained in each packet's header. This criteria can be specified on a basis of the MAC address, or IP address and on which ports to allow or deny the packets.
ACL>>ACL Configuration Wizard
Access Profile List
Access Profile List• The ACL Profile List provides information for configuring ACL Profiles manually. ACL profiles are attached
to interfaces, and define how packets are forwarded if they match the ACL criteria.
ACL>>Access Profile List
Access Profile List• Access Profile List
– To manually add a profile, click Add ACL Profile:
ACL>>Access Profile List
ACL Finder• ACL Finder
– This page is used to help find a previously configured ACL entry. To search for an entry, enter the profile ID from the drop-down menu, select a port that you wish to view, define the state and click Find. The table on the lower half of the screen will display the entries. To delete an entry click the corresponding Delete button or edit the profile by selecting the Access ID.
ACL>>ACL Finder
Monitoring Contents
Monitoring• Statistics
• Cable Diagnostics
• System Log
Monitoring>> Contents
Statistics
Statistics: • Displays the status of each port packet count.
Monitoring>> Statistics
Cable DiagnosticsCable Diagnostics: • The Cable Diagnostics for examine the cable healthy status, and can rapidly determines the type
of cable errors occurred in the cable, and detect the cable length.
• For D-Link Smart Switch, this function:
• only applied for Gigabit copper port when the link speed is 1000M. • For detect the cable length and the Cable errors of Open or Short.
CableDiagnosticTest.zip
Monitoring>> Cable Diagnostics
System LogSwitch History Log• The System Log page provides information about system logs, including information when the
device was booted, how the ports are operating, when users logged in, when sessions timed out, as well as other system information.
Monitoring>> System Log
Q&A