Blade Network Technologies G8000 manual

2350 Mission College Blvd . Suite 600 Santa Clara, CA 95054 www.bladenetwork.net RackSwit ch G8000 A p plica tion Guide V ersion 1.0 TM P art Number: BMD00041, Nove mber 2008[...]

RackSwitch G8000 Application Guide 2 BMD00041, November 2008 Copyright © 2009 Blade Network T echnologies, Inc., 2350 Mission College Blv d., Suite 600, Santa Clara, California, 95054, USA. All rights reserved. Part Number: BMD00041. This document is protected by c opyright and distributed under licen se s restricting it s use, copying, distributi[...]

BMD00041, Nov ember 2008 3 Co n t e n t s Preface 11 Who Should Use This Guide 11 What You’ll Find in This Guide 12 Typographic Conventions 13 How to Get Help 14 Chapter 1: Accessing the Switch 15 Configuring an IP Interface 16 Using Telnet 17 Using the Browser-Based Interface 18 Configuring BBI access via HTTP 18 Configuring BBI access via HTTPS[...]

RackSwitch G8000 Application Guide 4 BMD00041, November 2008 Chapter 3: VLANs 4 7 Overview 48 VLANs and Port VLAN ID Numbers 49 VLAN numbers 49 PVID numbers 50 VLAN Tagging 51 VLAN Topologies and De sign Considerations 55 VLAN configuration rules 55 Multiple VLANs with Tagging Adapters 56 VLAN configuration example 58 Private VLANs 59 Private VLAN [...]

RackSwitch G8000 Application Guide 5 BMD00041, Nov ember 2008 Why do we need multiple Spanning Trees? 84 PVRST configuration guidelines 85 Configuring PVRST 85 Multiple Spanning Tree Protocol 86 MSTP Region 86 Common Internal Spanni ng Tree 86 MSTP configuration guidelines 87 Fast Uplink Converge nce 91 Configu ration Guidel ines 91 Configuring Fas[...]

RackSwitch G8000 Application Guide 6 BMD00041, November 2008 Chapter 8: Basic IP Routing 119 IP Routing Benefits 120 Routing Between IP Subnets 121 Example of Subnet Routing 123 Using VLANs to segregat e Broadcast Domains 124 Configuration example 124 Dynamic Host Conf iguration Protocol 127 Chapter 9: IGMP 129 IGMP Snooping 130 FastLeave 131 IGMPv[...]

BMD00041, Nov ember 2008 7 Fi g u r e s Figure 2-1:Authenticating a Port Using EAPoL 41 Figure 3-1:Default VLAN settings 52 Figure 3-2:Port-based VLAN assignment 53 Figure 3-3:802.1Q tagging (aft er port-based VLAN assignment) 53 Figure 3-4:802.1Q tag a ssignment 54 Figure 3-5:802.1Q tagging (a fter 802.1Q tag assignment) 54 Figure 3-6:Example 1: M[...]

RackSwitch G8000 Application Guide 8 BMD00041, November 2008[...]

BMD00041, Nov ember 2008 9 Ta b l e s Table 1-1: User Access Levels 29 Table 1-2: Blade OS-p roprieta ry Attributes for RADIUS 29 Table 1-3: Default TACACS+ Authorization Levels 31 Table 1-4: Alternate TACACS+ Authorization Levels 31 Table 4-1: Actor v s. Partner LACP configuration 70 Table 5-1: Ports, Trunk Groups, and VLANs 7 4 Table 6-1: Well-kn[...]

RackSwitch G8000 Application Guide 10 BMD00041, November 2008[...]

BMD00041, Nov ember 2008 11 Pref a ce The RackSwitch G8000 Application Guide describ es how to configure and use the software on the RackSwitch G8000 switch. For documentati on about installing the switch physically , see the Installation Guide for your sw itch . Who Should U se T his Guide This Application Guide is int ended for network installers[...]

RackSwitch G8000 Application Guide 12  Pref ace BMD00041, November 2008 What Y ou’ll Find i n Th is G ui de This guide will help yo u plan, implement, and admi nister RS G8000 software. Wh ere possible, each section provides feature overviews , usage examples, and configuration instructions.  Chapter 1, “Accessing the Switch,” describes[...]

RackSwitch G8000 Application Guide Preface  13 BMD00041, Nov ember 2008 T ypographic C onv entions The following table describe s th e typog raphic styles used in this book. T able 1 T ypographic Conventions Ty p e f a c e o r Sym b ol Meaning Example AaBbCc123 This type is used for names of commands, files, and dire ctor ie s used withi n the t[...]

RackSwitch G8000 Application Guide 14  Pref ace BMD00041, November 2008 How to Get Help If you need help, service, or technical as sistance, call Blade Network T echnologies T echnical Support: US toll free calls: 1-800 -414-5268 International calls: 1-408 -83 4-7871 Y ou also can visit our websit e at the following address: http://www.bladenetw[...]

BMD00041, Nov ember 2008 15 C HAPTER 1 A c c essing the S wit ch The Blade OS software provides means for acces sing, configuring, and viewing information and statistics about the RackSwitch G8000. Th is chapter discusses di fferent methods of access- ing the switch and ways to secu re the switch for remote administrators:  “Configuring an IP [...]

RackSwitch G8000 Application Guide 16  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 C onfiguring an IP Int er fac e T o man a ge the swit ch using T eln et, SNMP , or a W eb browser , you must configure an IP inter- face. Configure the follo wing IP parameters:  IP address  Subnet mask  Default gateway address 1. Log on to t[...]

RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch  17 BMD00041 , November 2008 Us i n g T e l n e t A T elnet connection offers th e convenience of accessing the swit ch from any workstation con- nected to the network. T elnet access provides the same options for user access and administra- tor access as those availabl e through[...]

RackSwitch G8000 Application Guide 18  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 Using the Br ow ser-Based Inter fac e The Browser -Based Interface (BBI) is a W eb- bas ed management interface for interactive switch access through your W eb browser . The BBI provides access to the common configurat ion, management and op eration f[...]

RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch  19 BMD00041 , November 2008 Accessing the BBI via HTTPS requires a SSL certi ficate to be used during the key exchange. A default certificate is created the first time HTTPS is enabled, but you can import a new cer- tificate that defines the informat ion you want to be used. Use[...]

RackSwitch G8000 Application Guide 20  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 U sing SNMP Blade OS provides SNMP v1.0 and SNMP v3.0 support for access through any network man- agement software, such as IB M Director or HP-OpenV iew . SNMP v1, v2 T o access th e SNMP agent on the G8000, the read and write community strings on th[...]

RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch  21 BMD00041 , November 2008 T o configure an SNMP user name , enter the followin g command: User configur ation: Users can be configured to use the authentication/privacy opti ons. The G8000 supp orts two authentication al gorithms: MD 5 and SHA, as specified in the follow ing c[...]

RackSwitch G8000 Application Guide 22  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 3. Assign the user to the user group. Use the gr oup table to link the user to a particular access group. RS G8000 (config)# snmp-server group 5 user-name adm in RS G8000 (config)# snmp-server group 5 group-name ad mingrp[...]

RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch  23 BMD00041 , November 2008 C onfiguring SNMP T rap Hosts SNMPv1 trap host 1. Configur e an entry in the not ify table. 2. Specify the IP address and other trap para meters in the targetAddr and targetParam tables. Use the following command to specify the user name used wi th th[...]

RackSwitch G8000 Application Guide 24  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 SNMPv3 trap host configuration T o configure a user for SNMPv3 tr aps, you can choose to send the traps with both privacy and authentication, wi th authentication only , or without privacy or authentication. This is configured in the access ta ble usi[...]

RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch  25 BMD00041 , November 2008 Securing Ac c ess to the S witch Secure switch ma nagement is needed for environm ents that perform significant management functions across the Internet. The following features are addressed in this section:  “RADIUS Authentication an d Authoriza[...]

RackSwitch G8000 Application Guide 26  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 RADIUS Authentica tion and A uthorization Blade OS supports the RADIUS (Remote Authentication Dial -in User Service) method to authenticate and authorize remo te administrators for managing the switch. This method is based on a client/server model. Th[...]

RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch  27 BMD00041 , November 2008 Configuring RADIUS Use the following procedure to configure RADIUS authentication on your switch. 1. Configur e the Primary and Second ary RADIUS servers, and enable RADIUS authentication. 2. Configur e the RADIUS secret and enable the feature. 3. If [...]

RackSwitch G8000 Application Guide 28  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 RADIUS authentication f eatur es in Blade OS Blade OS supports the follo win g RADIUS authentication features:  Supports RADIUS client on the swit ch, based on the protocol definitions in RFC 2138 and RFC 2866.  Allows RADIUS secret password up [...]

RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch  29 BMD00041 , November 2008 Switch User Acco unt s The user accounts listed in T abl e 1- 1 can be defined in the RADIUS server dictionary file. RADIUS Attributes f o r G8000 user privileges When the user logs in, the sw itch authenticates his/her level of access by sending the [...]

RackSwitch G8000 Application Guide 30  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 T ACA CS+ A uthentica tion Blade OS supports authentication and authorization w ith networks using th e Cisco Systems T ACACS+ protocol. The G8000 f unctions as the Network Access Server (NAS) by interacting with the remote client and initi ating auth[...]

RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch  31 BMD00041 , November 2008 T ACA CS+ authentication featur es in Blade OS Authentication is the action of determining the iden tity of a user , and is general ly do ne when the user first attempts to log in to a device or gain access to its serv ices. Blade OS s upports ASCII i[...]

RackSwitch G8000 Application Guide 32  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 If the remote user is successfully authenti cated by the authentication server , the switch verifies the privi leges of the remote user and authorizes the appropriate access. The adminis- trator has an option to allow secur e backdoor access via T eln[...]

RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch  33 BMD00041 , November 2008 When T ACACS+ Command Logging is enabled, Blade OS configuration commands are logged on the T ACACS+ server . Use the following command to enable T ACACS+ Command Logging: The following examples illustrat e the format of Blade OS co mmands sent t o th[...]

RackSwitch G8000 Application Guide 34  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 Secure Shell Secure Shell (SSH) use secure tunnels to en crypt and secure messages between a remote administrator an d the switch. T elnet does not p rov ide this level of security . The T elnet metho d of managing a G8000 does not provide a secure co[...]

RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch  35 BMD00041 , November 2008 Generating RSA Host and Se r ver Keys for SSH access T o support the SSH server feature, tw o sets of RSA keys (host and server keys) are required. The host key is 1024 bits and is used to identify the G8000 . The server key is 768 bits and is used to[...]

RackSwitch G8000 Application Guide 36  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 End User A cc ess C ontrol Blade OS allows an administrator to define e nd user accounts that permit end users to perform operation tasks via the switch CLI commands. Once end user accounts are configured and enabled, the switch requires us ername/pas[...]

RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch  37 BMD00041 , November 2008 Defining a User ’ s acc ess lev el The end user is by default assigned to the user access level (also known as class of service, or COS). COS for all user a ccounts have global access to all resources except for User COS, which has access to view on[...]

RackSwitch G8000 Application Guide 38  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008[...]

BMD00041, Nov ember 2008 39 C HAPTER 2 P or t-based Netw ork A c c ess C ontr ol Port-Based Network Access cont rol provides a means of authenticating and authorizing devices attached to a LAN port that has point-to-point connectio n characteristics. It prevents access to ports that fail authentica tion and authoriza tion. This feat ure provides se[...]

RackSwitch G8000 Application Guide 40  Chapter 2: Port-based Network Access Control BMD00041, Nov ember 2008 Extensible Authentica tion Prot oc ol ov er LAN The G8000 can provide user-level security for its ports using the IEEE 802.1X protoco l, which is a more secure alternative to other method s of port-based network access control. Any device[...]

RackSwitch G8000 Application Guide Chapter 2: Port-based Network Access Control  41 BMD00041, No vember 2008 802.1X authentication pr ocess The clients and authenticators communicate using Extensible Authen tication Protocol (EAP), which was originally designed to run over PPP , and for which the I EEE 802.1X Standar d has defined an encapsulati[...]

RackSwitch G8000 Application Guide 42  Chapter 2: Port-based Network Access Control BMD00041, Nov ember 2008 EAP oL message exchange During authentication, EAPOL messages are exchanged be tween the client and the G8000 authenticator , while R ADIUS-EAP messages ar e exchanged between th e G8000 authenticator and the RADIUS server . Authenticatio[...]

RackSwitch G8000 Application Guide Chapter 2: Port-based Network Access Control  43 BMD00041, No vember 2008 802.1X por t states The state of the port determines whether the client is granted access to the network, as follows:  Unauthorized While in this state the port discards all ingress and egress traf fic except EAP packets.  Authorize[...]

RackSwitch G8000 Application Guide 44  Chapter 2: Port-based Network Access Control BMD00041, Nov ember 2008 Suppor ted RA DIUS attributes The G8000 802.1X Authenticator rel ies on external RADIUS servers for authentication with EAP . Ta b l e 2 lists the RADIUS attributes that are supported as part of RADIUS-EAP authentication based on the guid[...]

RackSwitch G8000 Application Guide Chapter 2: Port-based Network Access Control  45 BMD00041, No vember 2008 C onfigurat ion guidelines When configuring EAPoL, consid er the following guidelines:  The 802.1X port-based authentication is currently supported only in point-to-point config- urations, that i s, with a single suppl icant connected [...]

RackSwitch G8000 Application Guide 46  Chapter 2: Port-based Network Access Control BMD00041, Nov ember 2008[...]

BMD00041, Nov ember 2008 47 C HAPTER 3 VLANs This chapter describes network design and topol o gy considerations for using V ir tu al L oc al A r ea Ne tw or ks ( VL A Ns ). VLANs commonly are used to split up groups of network users into man- ageable broadcast domains, to create logical segm entation of workgroups, and to enforce security policies[...]

RackSwitch G8000 Application Guide 48  Chapter 3: VLA Ns BMD00041, Nov ember 2008 Ov ervie w Setting up virt ual LANs (VLANs) i s a way to segment ne tworks to increase network flexibility without changing the physical network topology . W ith network segmentation, each switch port connects to a segment that is a single broadcast domain. When a [...]

RackSwitch G8000 Application Guide Chapter 3: VLANs  49 BMD00041, Nov ember 2008 VLANs and P or t VL AN ID Numb ers VLAN numbers The G8000 supports up to 1024 VLAN s per switch. Even though the maximum number of VLANs supported at any given time is 1024, each can be identified wi th any number between 1 and 4094. VLAN 1 is the default VLAN for a[...]

RackSwitch G8000 Application Guide 50  Chapter 3: VLA Ns BMD00041, Nov ember 2008 PVID nu mbers Each port in the switch has a configurable default VLAN number , known as its PV ID . By default, the PVID for all po rts is set to 1, which correlates to the default VLAN ID . The PVID for each port can be configured to any VLAN number betw een 1 and[...]

RackSwitch G8000 Application Guide Chapter 3: VLANs  51 BMD00041, Nov ember 2008 VLAN T aggi ng Blade OS software supports I EEE 802.1Q VLAN tagging, providing standard s-based VLAN support for Ethernet systems. T agging places the VLAN id entifier in the frame header of a packet, allowing each port to belong to multiple VLANs. When you add a po[...]

RackSwitch G8000 Application Guide 52  Chapter 3: VLA Ns BMD00041, Nov ember 2008 N OTE – If a 802.1Q tagged frame is received by a port that has VLAN-tagging d isabled and the port VLAN ID (PVID) is di fferent than the VLAN ID of the packet, then the frame is dropped at the ingress port. Figure 3-1 Default VLAN settings N OTE – The port num[...]

RackSwitch G8000 Application Guide Chapter 3: VLANs  53 BMD00041, Nov ember 2008 Figure 3-2 throu gh Figure 3-5 illustrate generic examples of VLAN taggi ng. In Fi gure 3-2 , untagged incoming packets are a ssigned directly to VLAN 2 (PVID = 2). Port 5 is configured as a tagged member of VLAN 2, and po rt 7 is configured as an untagged mem ber o[...]

RackSwitch G8000 Application Guide 54  Chapter 3: VLA Ns BMD00041, Nov ember 2008 In Figure 3-4 , tagged incoming packets are assigned di rectly to VLAN 2 because of the tag assignment in the packet. Po rt 5 is configured as a tagged member of VLAN 2, and port 7 is configured as an untagged member of VLAN 2. Figure 3-4 802.1Q tag assig nment As [...]

RackSwitch G8000 Application Guide Chapter 3: VLANs  55 BMD00041, Nov ember 2008 VLAN T opologies and Design C onsider ations  By default, the G8000 software is configured so that tagging is disabled on all po rts.  By default, the G8000 software is configured so that all ports are members of VLA N 1.  If you configure Spanning T ree, n[...]

RackSwitch G8000 Application Guide 56  Chapter 3: VLA Ns BMD00041, Nov ember 2008 Multiple VLANs with T agging Adapters Figure 3-6 Example 1: Multip le VLANs with VLAN-T agged Gigabit Adapters The features of th is V LA N are des cribed below: Component Description G8000 switch This switch is confi gured with three VLANs that represent three dif[...]

RackSwitch G8000 Application Guide Chapter 3: VLANs  57 BMD00041, Nov ember 2008 N OTE – VLAN tagging is required only on ports that are connect ed to other switches or on port s that connect to tag-capable end-stations, such as servers with VLAN-tagging adapters. Server 1 This server is a member of VLAN 1 and has presence in only one IP subne[...]

RackSwitch G8000 Application Guide 58  Chapter 3: VLA Ns BMD00041, Nov ember 2008 VLAN configura tion example Use the following procedure to conf igure the example network show n in Figure 3-6 . 1. Enable VLAN ta gging on server port s that support multiple VLANs. 2. Enable tagging on uplink ports that support multiple VLANs. 3. Configur e th e [...]

RackSwitch G8000 Application Guide Chapter 3: VLANs  59 BMD00041, Nov ember 2008 Pri vate VL A Ns Private VLANs provide Layer 2 isolat ion between the ports within the same broadcast domain. Private VLANs can contro l traffic within a VLAN domain, a nd provide port-based securi ty for host servers. Use Private VLANs to partition a VLAN domain in[...]

RackSwitch G8000 Application Guide 60  Chapter 3: VLA Ns BMD00041, Nov ember 2008  Community—A comm uni ty po rt is a host port that belongs to a community VLAN. Com- munity ports can communicate with other ports in t he same commun ity VLAN, and with promiscuous ports. These interf aces are isolated at layer 2 from all other interfaces in [...]

RackSwitch G8000 Application Guide Chapter 3: VLANs  61 BMD00041, Nov ember 2008 2. Configur e a secondary VLAN and map it to the primary VLAN. 3. V erify the configurat ion. RS G8000 (config)# vlan 110 RS G8000 (config-vlan)# enable RS G8000 (config-vlan)# member 3 RS G8000 (config-vlan)# member 4 RS G8000 (config-vlan)# private-vlan type isola[...]

RackSwitch G8000 Application Guide 62  Chapter 3: VLA Ns BMD00041, Nov ember 2008[...]

BMD00041, Nov ember 2008 63 C HAPTER 4 Po r t s a n d T r u n k i n g T runk groups can provide super-bandwidth, multi-link connectio ns between switches or other trunk-capable devices. A trunk group is a group of ports that act together , combining their bandwidth to create a single, la r ger virtual link. This c ha pt er provides configuration ba[...]

RackSwitch G8000 Application Guide 64  Chapter 4: Ports and Trunking BMD00041, Nov ember 2008 Ov ervie w When using port trunk groups betw een two switches, as shown in Fi gure 4-1 , you can create a virtual link between the switches, operating up to 40 Gb per second, depending on how many physical ports are combined. Each G8000 supports up to 5[...]

RackSwitch G8000 Application Guide Chapter 4: Ports and Trunking  65 BMD00041, No vember 2008 Befor e you c onfigure sta tic trunks When you create and enable a static trunk, the trunk me mbers (switch ports) take on certain settings necessary for correct ope ration of the trunking feature. Before you co nfigure your trunk, you must cons ider th[...]

RackSwitch G8000 Application Guide 66  Chapter 4: Ports and Trunking BMD00041, Nov ember 2008  All trunk members must be in the same Spanning Tree Group (STG) and can belong to only one Spanning Tree Group (STG). However if all ports are tagg ed , then all trunk ports can belong to multiple STGs .  When a trunk is enabled, the trunk’ s S[...]

RackSwitch G8000 Application Guide Chapter 4: Ports and Trunking  67 BMD00041, No vember 2008 Po r t T r u n k i n g E x a m p l e In the example below , three ports are trunked between two switches. Figure 4-1 Port T runk Group Configuration Example Prior to configuring each switch in the above ex ample, you must connect to the appropriate swit[...]

RackSwitch G8000 Application Guide 68  Chapter 4: Ports and Trunking BMD00041, Nov ember 2008 2. Repeat the proces s on the other switch. 3. Connect the switch port s that will be members in the tru nk group. T runk group 3 (on the G8000) is now connected to trunk grou p 1 (on the other switch). N OTE – In this example, two G8000 switches are [...]

RackSwitch G8000 Application Guide Chapter 4: Ports and Trunking  69 BMD00041, No vember 2008 C onfigurable T runk Hash Algorithm This feature allows you to configure paramete rs for the tru nk hash algo rithm, instead of using the default values. Use the IP Trunk Has h commands to configure new default behavior for Layer 2 traffic and Layer 3 t[...]

RackSwitch G8000 Application Guide 70  Chapter 4: Ports and Trunking BMD00041, Nov ember 2008 Link A ggregation C ontrol P rotoc ol Link Aggregation Control Protocol (LACP) is an IEEE 802.3ad standard for gro upi ng several physical ports into one logical port (known as a dynamic tru nk group or Li nk Aggregation group) with any device that supp[...]

RackSwitch G8000 Application Guide Chapter 4: Ports and Trunking  71 BMD00041, No vember 2008 LACP automatically determi nes which member lin ks can be aggregated and then aggregates them. It provides for the co ntrolled addition and rem oval of physical links for the li nk aggrega- tion. Each port on the switch can have one of the following LAC[...]

RackSwitch G8000 Application Guide 72  Chapter 4: Ports and Trunking BMD00041, Nov ember 2008 LA CP configur ation guidelines Consider the following guidelin es when you configure LACP trunks:  When ports become memb ers of a trunk, configuration parameters (except ACL and QoS) are applied per trunk. When a trunk group is formed, these parame[...]

BMD00041, Nov ember 2008 73 C HAPTER 5 Spanning T ree When multiple paths exist on a network , Spanning T ree Protocol configures the network so that a switch uses only the most ef ficient path. The following topics are discussed in this chapter:  “Overview” on page 74  “Rapid Spanning Tree Protocol” on page 80  “Per VLAN Rapid S[...]

RackSwitch G8000 Application Guide 74  Chapter 5: Spanning Tree BMD00041, November 2008 Ov ervie w Spanning T ree Protocol detects and eliminates logi cal loops i n a bridged or switched network. When multiple paths exist, Span ning T ree confi gures the network so that a sw itch uses only the most efficient path. If that path fails, Spanning T [...]

RackSwitch G8000 Application Guide Chapter 5: Spanning Tree  75 BMD00041, Nov ember 2008 Bridge Pr otocol Da ta Units (BPDU s) T o create a Spanning Tr ee, the switch generates a configuration Bridge Protocol Data Unit (BPDU), which it then forwards out of its ports. All switch es in the Layer 2 network parti cipat- ing in the Spanning Tree gath[...]

RackSwitch G8000 Application Guide 76  Chapter 5: Spanning Tree BMD00041, November 2008 Po r t P ri o r i t y The port priority helps determine wh ich bri dge port becomes the root/designate d port. The case for the root port is when 2 switches ar e connected using a minimum of two links with the same path-cost. The case for th e designated port[...]

RackSwitch G8000 Application Guide Chapter 5: Spanning Tree  77 BMD00041, Nov ember 2008 Assigning a VLAN to a Spanning T ree Gr oup  If no VLANs exist beyond the default VLAN 1 see “Creating a VLAN” on page 78 for information on ad ding ports to V LANs.  Assign the VLAN to the STG using th e following command:  If the association b[...]

RackSwitch G8000 Application Guide 78  Chapter 5: Spanning Tree BMD00041, November 2008 Creating a VLAN When you create a VLAN, that VLAN automatically belongs to STG 1, the default STG . Y ou can assign the VLAN to another STG .  Move a newly created VLAN to an existing STG by following thi s order:  Create the VLAN.  Enable the VLAN. [...]

RackSwitch G8000 Application Guide Chapter 5: Spanning Tree  79 BMD00041, Nov ember 2008 As an example, assume that port 1 belongs to VLAN 2, and VLAN 2 bel ongs to STG 2. When you remove port 1 from VLAN 2, port 1 is also remove d from STG 2. The port moves to the default VLAN 1. However , if port 1 belongs to both VLAN 1 and VLAN 2 and both VL[...]

RackSwitch G8000 Application Guide 80  Chapter 5: Spanning Tree BMD00041, November 2008 Rapid Spanning T ree Pr otoc ol Rapid Spanning Tree Protocol (RSTP) provides rapid convergence of the spanning tree and provides for fast re-configuration critical for netw orks carrying delay-sensitive traf fic such as voice and video. RSTP significantl y re[...]

RackSwitch G8000 Application Guide Chapter 5: Spanning Tree  81 BMD00041, Nov ember 2008 P ort T ype and Link T ype Spanning T ree configuration includes the follo win g param eters to support RSTP and MSTP: edge port and link type. Edge P or t A port that does not connect to a bridge is called an edge port . Edge port s can start forwardin g as[...]

RackSwitch G8000 Application Guide 82  Chapter 5: Spanning Tree BMD00041, November 2008 RSTP configur ation example This section provides steps to configure Ra pid Spanning Tree on the G8000, using th e Command-Line Interface (ISCLI). Rapid Spanning T ree Protocol is the default setting on the G8000. Configur e Rapid Spanning T ree Rapid Spannin[...]

RackSwitch G8000 Application Guide Chapter 5: Spanning Tree  83 BMD00041, Nov ember 2008 P er VLAN R apid Spanning T ree Per VLAN Rapid Spanning T ree Plus Protocol (PVRST+) enh ances the RSTP protocol by adding the ability to have mult iple spann ing tree groups. PVRST+ is based on IEEE 802.1w Rapid Spanning T ree Protocol. In PVRST mode, the G[...]

RackSwitch G8000 Application Guide 84  Chapter 5: Spanning Tree BMD00041, November 2008 Wh y do w e need multiple Spanning T rees? The following examples describe why we need mult iple spanning trees. In Figure 5- 1 , VLAN 1 and VLAN 2 pass traffic between switch 1 and switch 2. If you have a single Spanning Tree Group, the switches see an appar[...]

RackSwitch G8000 Application Guide Chapter 5: Spanning Tree  85 BMD00041, Nov ember 2008 PVRST c onfigura tion guidelines This section provides important in format ion about configuring Per VLAN Rapid Spannin g T ree Groups:  By default, STGs 2-128 are empty , and STG 1 contains all configured VLANs until indi- vidual VLANs are assigned to ot[...]

RackSwitch G8000 Application Guide 86  Chapter 5: Spanning Tree BMD00041, November 2008 Multiple Spanning T ree P r otocol Multiple Spanning T ree extends Rapid Spannin g T ree Protocol through mul tiple Spannin g T ree Groups, using multiple VLANs in each ST G . MSTP supports up to 32 Spanning-T ree instances, that corresp ond to STP Groups 1-3[...]

RackSwitch G8000 Application Guide Chapter 5: Spanning Tree  87 BMD00041, Nov ember 2008 MSTP configur ation guidelines This section provides important in format ion about configuring Multiple Span ning T ree Groups:  When MSTP is turned on, the switch automati cally moves all VLANs to the CIST . When MSTP is turned off, the switch moves all [...]

RackSwitch G8000 Application Guide 88  Chapter 5: Spanning Tree BMD00041, November 2008 Figure 5-3 Implementing Multiple S panning T ree Group s Server 1 VLAN 2 Server 2 VLAN 2 Server 3 VLAN 1 Server 4 VLAN 1 Server 5 VLAN 1 Enterprise Routing Switch Enterprise Routing Switch Blocking VLAN 1 Passing VLAN 2 Passing VLAN 1 Blocking VLAN 2 (MSTP Gr[...]

RackSwitch G8000 Application Guide Chapter 5: Spanning Tree  89 BMD00041, Nov ember 2008 Configuring Multiple Spanning T ree Gr oups This configuration shows how to configure MSTP Groups on the switch, as shown in Figure 5-3 . 1. Configur e port memb ership and define the Spanning T ree gr oups for VLAN 1. Enable tagging on uplink ports th at sh[...]

RackSwitch G8000 Application Guide 90  Chapter 5: Spanning Tree BMD00041, November 2008 3. Configur e port memb ership and define the Spanning T ree gr oups for VLAN 2. Add server ports 3, 4, and 5 to VLAN 2. Add uplink po rts 51 and 52 to VLAN 2. Assign VLAN 2 to Spann ing T ree Group 2. N OTE – Each Spanning T ree Group (STG) is enabled by d[...]

RackSwitch G8000 Application Guide Chapter 5: Spanning Tree  91 BMD00041, Nov ember 2008 Fa s t U p l i n k C o n v e r g e n c e Fast Uplink Conver gence enables the G8000 to r ecover quickly from the failure of the primary link or trunk group in a Layer 2 netwo rk using Spanning Tree Protocol. Normal recovery can take as long as 50 seconds, wh[...]

RackSwitch G8000 Application Guide 92  Chapter 5: Spanning Tree BMD00041, November 2008[...]

BMD00041, Nov ember 2008 93 C HAPTER 6 Quality of Ser vice Quality of Service featur es allow you to allocat e n etwork resources to mission-critical ap plica- tions at the expense of ap plications that are less sensitive to such fact ors as time del ays or net- work congestion. Y ou can configure your networ k to prioritize sp ecifi c types of tra[...]

RackSwitch G8000 Application Guide 94  Chapter 6: Quality of Service BMD00041, Nov ember 2008 Overview QoS helps you allocate gu aranteed bandwidth to the critical applications, and limit bandwidth for less critical applications. Ap plications such as video and vo ice must have a certain amount of bandwidth to work co rrectly; using QoS, you can[...]

RackSwitch G8000 Application Guide Chapter 6: Quality of Service  95 BMD00041, No vember 2008 Us i n g AC L Fi l t e r s Access Control Lists are filters that allow you to cl assify dat a packets according to a particular content in the packet header , such as the sour ce address, destination ad dress, source port num - ber , destination port nu[...]

RackSwitch G8000 Application Guide 96  Chapter 6: Quality of Service BMD00041, Nov ember 2008 IP Standard A C Ls The switch supports up to 127 IP ACLs (standard and extended ). IP Standard ACLs are num- bered from 1-1000. Use IP S tandard A CLs to filter traffic using s ource IP address/network mask and destination IP address/netw ork/mask. T o [...]

RackSwitch G8000 Application Guide Chapter 6: Quality of Service  97 BMD00041, No vember 2008 T o create an IP Extended ACL: T o delet e an IP Extended ACL: T able 6-1 Well-known protocol typ es Number Prot ocol N ame 1 4 6 17 89 103 icmp ip tcp udp ospf pim T able 6-2 Well-known application p orts Number T CP/UDP Application Number T CP/UDP App[...]

RackSwitch G8000 Application Guide 98  Chapter 6: Quality of Service BMD00041, Nov ember 2008 Understanding A CL priority Each ACL has a unique priority , based on it s nu mber . The higher the ACL number , the higher the priority , so ACL 1 has the lowest priority . The priority is used to decide which ACL rule to appl y when a packet m atches [...]

RackSwitch G8000 Application Guide Chapter 6: Quality of Service  99 BMD00041, No vember 2008 N OTE – T o ensure your ACLs function properl y , do not assign the sam e ACL to different ports using different filtering directions. It is recommended that you create tw o ACLs, one for ingress traffic, and one for egres s traffic. T o assign an ACL[...]

RackSwitch G8000 Application Guide 100  Chapter 6: Quality of Service BMD00041, Nov ember 2008 A CL co nfigura tion examples Example 1 Use this configuration to block traf fic to a speci fic host. All traffic that ingresses port 1 is denied if it is destined for the host at IP address 100.10.1.1 1. Configure an Access Contr ol List. 2. Assign th[...]

RackSwitch G8000 Application Guide Chapter 6: Quality of Service  101 BMD00041, No vember 2008 Example 2 Use this configuration to block traffic from a network destined for a specific host address. All traffic that ingresses port 10 with source IP from the class 100.10.1.0/24 and destination IP 200.20.2.2 is denied. 1. Configure an Access Contr [...]

RackSwitch G8000 Application Guide 102  Chapter 6: Quality of Service BMD00041, Nov ember 2008 Example 3 Use this configuration to block t raf fic from a netw ork that is destined for a specific egress port. All traffic that egresses port 6 from the network 100.10.1.0/24 is denied. 1. Configure an Access Contr ol List. 2. Add the ACL to port 6. [...]

RackSwitch G8000 Application Guide Chapter 6: Quality of Service  103 BMD00041, No vember 2008 Example 5 Use this configuration to block all traffic exce pt traffic of certain ty pes . HTTP/HTTPS, DHCP , and ARP packets are permitted on the port. All other traffic is denied. 1. Configure one IP ACL for each type of traffic that you wan t to perm[...]

RackSwitch G8000 Application Guide 104  Chapter 6: Quality of Service BMD00041, Nov ember 2008 5. Assign the ACLs to a port. RS G8000 (config)# interface port 7 RS G8000 (config-if)# ip access-group 1103 in RS G8000 (config-if)# ip access-group 1104 in RS G8000 (config-if)# ip access-group 1105 in RS G8000 (config-if)# ip access-group 1106 in RS[...]

RackSwitch G8000 Application Guide Chapter 6: Quality of Service  105 BMD00041, No vember 2008 U sing Storm C ontrol F ilters The G8000 provides filters th at can limit the n umber of the follow ing packet types transmitted by switch ports:  Broadcast packets  Multicast packets  Unknown unicast packets (destination look up failure) Broa[...]

RackSwitch G8000 Application Guide 106  Chapter 6: Quality of Service BMD00041, Nov ember 2008 U sing DSCP V alues to Pr ovide QoS The switch uses the Differentiated Services (D if fServ) architecture to provide QoS functions. DiffServ is described in IETF RFCs 2474 and 2475. The six most significant bits in the TOS byte of the IP header are def[...]

RackSwitch G8000 Application Guide Chapter 6: Quality of Service  107 BMD00041, No vember 2008 The switch can perform the following actions to the DSCP:  Read the DSCP value of ingress packets .  Map the DSCP value to an 802.1p priori ty . The switch can use the DSCP value to direct traf fic prioritization. W i th Diff Serv , you can estab[...]

RackSwitch G8000 Application Guide 108  Chapter 6: Quality of Service BMD00041, Nov ember 2008 P er Hop Beha vior The DSCP value determines the Per Hop Behavi or (PHB) of each packet. The PHB is the for- warding treatment given to packets at each hop. QoS policies ar e built by applying a set of rules to packets, based on the DSCP value, as they[...]

RackSwitch G8000 Application Guide Chapter 6: Quality of Service  109 BMD00041, No vember 2008 QoS Lev els T a bl e 6-3 shows the default service levels provided by the switch, listed from highest to lowest importance: T able 6-3 Default QoS Service Levels Serv ice Lev el Default PHB 802.1p Priority Critical CS7 7 Network Control CS6 6 Premium E[...]

RackSwitch G8000 Application Guide 110  Chapter 6: Quality of Service BMD00041, Nov ember 2008 DSCP-to-802.1p map ping The switch can use the DSCP value of ingress p ackets to set the 802.1p pr iority value. Use the following comm and to vi ew the default settings. Use the following command to tu rn on DSCP mapping globally: Use the following co[...]

RackSwitch G8000 Application Guide Chapter 6: Quality of Service  111 BMD00041, No vember 2008 U sing 802.1p Priority t o Pr o vide QoS The G8000 provides Qu al ity of Service functions based on the priority bits in a packet’ s VLAN header . (The priorit y bit s are defined by the 802.1p standard within the IEEE 802.1Q VLAN header .) The 802.1[...]

RackSwitch G8000 Application Guide 112  Chapter 6: Quality of Service BMD00041, Nov ember 2008 802.1p configur ation e xample 1. Configur e a port’ s default 802.1p priority value to 2. 2. Map the 802.1p priority value to a COS queue and set the COS queue scheduling weight. Queuing and Scheduling The G8000 has up to eight output Class of Se rv[...]

BMD00041, Nov ember 2008 113 C HAPTER 7 Remote Monitor ing Remote Monitoring (RMON) allows network de vices to exchange network mon ito ring data. RMON allows the switch to perform the following fu nctio ns:  T rack events and trigger alarms when a threshold is reached.  Notify admi nistrators by issuing a syslog message or SNMP trap. Ov ervi[...]

RackSwitch G8000 Application Guide 114  Chapter 7: Remote Monitoring BMD00041, Nov ember 2008 RMON group 1—S tatistics The switch supports collection of Ethernet statis tics as outlined in the RMON statistics MIB, in reference to etherStatsT able. Y ou can conf igure RMON statisti cs on a per -port basis. RMON statistics are sampled every seco[...]

RackSwitch G8000 Application Guide Chapter 7: Remote Monitoring  11 5 BMD00041, Novem ber 2008 RMON group 2—Histor y The RMON History group allows you to samp le an d archive Ethernet statistics for a specific interface during a specific ti me interval. History sa mpling is done per port. N OTE – RMON port statistics must be enabled for the [...]

RackSwitch G8000 Application Guide 116  Chapter 7: Remote Monitoring BMD00041, Nov ember 2008 Configuring RMON History Perform the following steps to config ure RMO N History on a port. 1. Enable RMON on a port. 2. Configur e the RMON History parameters for a port. This configuration enables RMON history collection on port 1. 3. V iew RMON Histo[...]

RackSwitch G8000 Application Guide Chapter 7: Remote Monitoring  11 7 BMD00041, Novem ber 2008 Use one of the following commands to corr elate an Alarm index to an Event index: When the alarm threshold is reached, the corresponding even t is triggered. Alarm MIB objects The most common data types us ed for alarm m onitoring are ifStats : errors,[...]

RackSwitch G8000 Application Guide 118  Chapter 7: Remote Monitoring BMD00041, Nov ember 2008 Example 2 1. Configure the RMON Alarm parame ters to track ICMP messages. This configuration creates an RMON alarm that checks icmpInEchos on the switch once every minute. If the statistic ex ceeds 200 within a 60 second interval , an alarm is generated[...]

BMD00041, Nov ember 2008 119 C HAPTER 8 Basic IP Routing Th i s c h a pt e r provides configuration background and examples for using the G8000 to perform IP routing functions. The following topics are addressed in this chapter:  “IP Routing Benefits” on page 120  “Routing Between IP Subnets” on page 121  “Example of Subnet Routi[...]

RackSwitch G8000 Application Guide 120  Chapter 8: Basic IP Routing BMD00041, Nov ember 2008 IP Routing Benefits The switch uses a combination of configurable IP switch interfaces and IP routing options. The switch IP routing capab ilities provide th e following benefits:  Connects the server IP subnets to the rest of the backbone network. ?[...]

RackSwitch G8000 Application Guide Chapter 8: Basic IP Routing  121 BMD00041, No vember 2008 Routing Betw een IP Subnets The physical layout o f most corp orate networks has evolved o ver time. Classic h ub/router topologies have given way to fast er sw itched topologies, particularly now that switches are increasingly intelligent. The G80 00 is[...]

RackSwitch G8000 Application Guide 122  Chapter 8: Basic IP Routing BMD00041, Nov ember 2008 This is a situation that switching alone cannot cure. In stead, the router is flooded with cro ss- subnet communicatio n. This compromises efficiency in two ways:  Routers can be slower than switches. The cro ss-subnet side trip from the switch to the[...]

RackSwitch G8000 Application Guide Chapter 8: Basic IP Routing  123 BMD00041, No vember 2008 Example of Subnet Routing Consider the role of the G8000 in the following co nfiguratio n example: Figure 8-2 Switch-Based Ro uting T opology The switch connects the Gigabit Ethernet and Fast Ethernet trunks from various switched sub- nets throughout one[...]

RackSwitch G8000 Application Guide 124  Chapter 8: Basic IP Routing BMD00041, Nov ember 2008 Using VLANs t o segregat e Broadcast Domains If you want to control the broadcasts on your ne t work, use VLANs to create distinct broadcast domains. Create one VLAN for each serv er subnet, and one for the router . C onfiguration e xample This section d[...]

RackSwitch G8000 Application Guide Chapter 8: Basic IP Routing  125 BMD00041, No vember 2008 3. Determine which swit ch ports and IP in terfaces belong to which VLANs. The following table adds port and VLAN information: N OTE – T o perform this configuration, you mu st be connected to the switch Command Line Interface (CLI) as the administrato[...]

RackSwitch G8000 Application Guide 126  Chapter 8: Basic IP Routing BMD00041, Nov ember 2008 5. Assign a VLAN to each IP interface. Now that the ports are separate d in t o VLANs, the VLANs are a ssigned to the appropriate IP interface for each subnet. From T able 8-3 on page 125 , the settings are made as follows: 6. Configur e th e defa ult ga[...]

RackSwitch G8000 Application Guide Chapter 8: Basic IP Routing  127 BMD00041, No vember 2008 Dynamic Host C onfigur ation P rot ocol Dynamic Host Configuration Prot ocol (D HCP) is a transport protocol that provides a frame- work for automatically assigning IP addresses a nd configuration inform atio n to other IP hosts or clients in a large TCP[...]

RackSwitch G8000 Application Guide 128  Chapter 8: Basic IP Routing BMD00041, Nov ember 2008[...]

BMD00041, Nov ember 2008 129 C HAPTER 9 IGMP Internet Group Manageme nt Protocol (IGMP) is used by IP Multicast routers to learn about the existence of host group members on thei r direct ly attached subnet (see RFC 2236). The IP Multicast routers get this informati on by broa dcasting IGMP Membership Queries an d listen- ing for IP hosts reporting[...]

RackSwitch G8000 Application Guide 130  Chapter 9: IGMP BMD00041, Nov ember 2008 IGMP Snooping IGMP Snooping allows the switch to fo rward multicast traffic only to those ports that request it. IGMP Snooping prevents mul ticast traf fic from being flooded to all ports. The switch learns which server hosts are interested in receiving multicast tr[...]

RackSwitch G8000 Application Guide Chapter 9: IGMP  131 BMD00041 , November 2008 Fa s t L e a v e In normal IGMP operation, when the switch receives an IGMP v2 Leave message, it sends a Group-Specific Query to determine if any other devices in the same group (and on the same port) are still interested in the specified multicast group traffic. Th[...]

RackSwitch G8000 Application Guide 132  Chapter 9: IGMP BMD00041, Nov ember 2008 The switch supports the following IG MPv3 filter modes:  INCLUDE mode: T he host reques ts membership to a multicast group and provides a list of IP addresses from which it wants to receive traffic.  EXCLUDE mode: The host requests membership to a multicast gr[...]

RackSwitch G8000 Application Guide Chapter 9: IGMP  133 BMD00041 , November 2008 5. V iew dynamic IGMP information. These commands display information abou t IGMP Gro ups and Mrouters learned by the switch. RS G8000# show ip igmp groups Note: Local groups (224.0.0.x) are not snooped/relayed and will not appear. Source Group VLAN Port Version Mod[...]

RackSwitch G8000 Application Guide 134  Chapter 9: IGMP BMD00041, Nov ember 2008 Static Multicast Router A static multicast router (M rou t er) can be configured for a par ticular port on a particular VLAN. A static Mrouter does no t have to be learned t hrough IGMP Snooping. Any data port can accept a static Mrouter . When you configure a stati[...]

BMD00041, Nov ember 2008 135 C HAPTER 10 High A vailability The RackSwitch G 8000 supports high-avai lability network to pologies. The following topics are discussed in this chapter:  “Uplink Failure Detect ion” on page 136 .[...]

RackSwitch G8000 Application Guide 136  Chapter 10: High Availability BMD00041, Nov ember 2008 Uplink F a ilure Det ec tion Uplink Failure Detection (UFD) is design ed to suppo rt Net work Adapter T eaming. Network Adapter T eaming allows all the NICs on each serv er to share the same IP address. The NICs are configured into a team. One NIC is t[...]

RackSwitch G8000 Application Guide Chapter 10: High Availability  137 BMD00041, Nov ember 2008 F ailure Detec tion P air T o use UFD , you must configure a Failure Detection Pair and then turn UFD on. A Failure Detection Pair consists of the following gro ups of po rts:  Link to Monit or (LtM) The Link to Monitor group consi sts of one por t [...]

RackSwitch G8000 Application Guide 138  Chapter 10: High Availability BMD00041, Nov ember 2008 C onfiguring UFD Figure 10-1 shows a basic UFD config urat ion. In this example, NIC 1 is the primary network adapter; NIC 2 is a non-primary adapter . NIC 1 is connected to port 16 and NIC 2 is connected to port 17. Port 2 is connected to a Layer 2/3 [...]

BMD00041, Nov ember 2008 139 A PPENDIX A T roubleshooting This section discusses some tools to help you troub leshoo t common problems on the RackSwitch G8000:  “Monitoring Ports” on page 140[...]

RackSwitch G8000 Application Guide 140  Appendix A: Troubles hooting BMD00041, Nov ember 2008 Monitoring P or ts The port mirroring feature in the G8000 allows you to attach a sniffer to a monitoring port that is configured to receive a copy of all packets that are forwarded from the mirrored port. The G8000 enables you to mirror port traffic fo[...]

RackSwitch G8000 Application Guide Appendix A: Troubleshooting  141 BMD00041, Nov ember 2008 P ort Mirroring beha vior This section describes the composition of mo nitored packets in the switch, based on the configuration of the ports. The following port-mirroring cases app ly to the G8000:  Ingress mirrored packet s are not modified.  Egr[...]

RackSwitch G8000 Application Guide 142  Appendix A: Troubles hooting BMD00041, Nov ember 2008[...]

BMD00041, Nov ember 2008 143 Inde x Symbols .......... .............. .............. ............ .............. ........ 129 [ ] ....... .............. .............. ............ .............. .......... 13 Numerics 802.1p .............. .............. ............... ........... ........ 111 802.1Q VLAN tagging .............. ........... ......[...]

RackSwitch G8000 Application Guide 144  Index BMD00041, November 2008 I IBM Director .................... ........... .............. ..........20 ICMP ................. .............. .............. ........... ..........97 IEEE standards 802.1D ..... ........... .............. .............. .............74 802.1p .............. ...............[...]

RackSwitch G8000 Application Guide Index  145 BMD00041, Nov ember 2008 RSA keys ....... .............. .............. ........... ............. 35 RSTP .......... .............. ........... .............. .............. .. 80 S security port mirroring ................. .............. ........... ... 140 RADIUS authentication .............. .....[...]