Blade ICE G8000 manuale d’uso

2350 Mission College Blvd . Suite 600 Santa Clara, CA 95054 www.bladenetwork.net RackSwitch G8000 Applica tion Guide V ersion 1.0 TM P art Number : BMD00041, November 2008[...]

RackSwitch G8000 Application Guide 2 BMD00041, November 2008 Copyright © 2009 Blade Network T echnologies, Inc., 2350 Mission College Blv d., Suite 600, Santa Clara, California, 95054, USA. All rights reserved. Part Number: BMD00041. This document is protected by c opyright and distributed under licen se s restricting it s use, copying, distributi[...]

BMD00041, Nov ember 2008 3 Co n t e n t s Preface 11 Who Should Use This Guide 11 What You’ll Find in This Guide 12 Typographic Conventions 13 How to Get Help 14 Chapter 1: Accessing the Switch 15 Configuring an IP Interface 16 Using Telnet 17 Using the Browser-Based Interface 18 Configuring BBI access via HTTP 18 Configuring BBI access via HTTPS[...]

RackSwitch G8000 Application Guide 4 BMD00041, November 2008 Chapter 3: VLANs 47 Overview 48 VLANs and Port VLAN ID Numbers 49 VLAN numbers 49 PVID numbers 50 VLAN Tagging 51 VLAN Topologies and De sign Considerations 55 VLAN configuration rules 55 Multiple VLANs with Tagging Adapters 56 VLAN configuration example 58 Private VLANs 59 Private VLAN p[...]

RackSwitch G8000 Application Guide 5 BMD00041, Nov ember 2008 Why do we need multiple Spanning Trees? 84 PVRST configuration guidelines 85 Configuring PVRST 85 Multiple Spanning Tree Protocol 86 MSTP Region 86 Common Internal Spanning Tree 86 MSTP configuration guidelines 87 Fast Uplink Convergence 91 Configu ration G uidelin es 91 Configuring Fast[...]

RackSwitch G8000 Application Guide 6 BMD00041, November 2008 Chapter 8: Basic IP Routing 119 IP Routing Benefits 120 Routing Between IP Subnets 121 Example of Subnet Routing 123 Using VLANs to segregat e Broadcast Domains 124 Configuration example 124 Dynamic Host Conf iguration Protocol 127 Chapter 9: IGMP 129 IGMP Snooping 130 FastLeave 131 IGMPv[...]

BMD00041, Nov ember 2008 7 Fi g u re s Figure 2-1:Authenticating a Port Using EAPoL 41 Figure 3-1:Default VLAN settings 52 Figure 3-2:Port-based VLAN assignment 53 Figure 3-3:802.1Q tagging (aft er port-based VLAN assignment) 53 Figure 3-4:802.1Q tag a ssign ment 54 Figure 3-5:802.1Q tagging (a fter 802.1Q tag assignment) 54 Figure 3-6:Example 1: M[...]

RackSwitch G8000 Application Guide 8 BMD00041, November 2008[...]

BMD00041, Nov ember 2008 9 Ta b l e s Table 1-1: User Access Levels 29 Table 1-2: Blade OS-prop rieta ry Attributes for RADIUS 29 Table 1-3: Default TACACS+ Authorization Levels 31 Table 1-4: Alternate TACACS+ Authorization Levels 31 Table 4-1: Actor vs . Partner LACP configuration 70 Table 5-1: Ports, Trunk Groups, and VLANs 74 Table 6-1: Well-kno[...]

RackSwitch G8000 Application Guide 10 BMD00041, November 2008[...]

BMD00041, Nov ember 2008 11 Pref a ce The RackSwitch G8000 Application Guide describ es how to configure and use the software on the RackSwitch G8000 switch. For documentati on about installing the switch physical ly , see the Installation Guide for your switch . Who Should U se T his Guide This Application Guide is int ended for network installers[...]

RackSwitch G8000 Application Guide 12  Preface BMD00041, November 2008 What Y ou’ll Find in Thi s G u id e This guide will help you p lan, implement, and administer RS G80 00 software. Where po ssible, each section provides feature overviews, usage examples, and configuration instructions.  Chapter 1, “Accessing the Switch,” describes h[...]

RackSwitch G8000 Application Guide Preface  13 BMD00041, Nov ember 2008 T ypographic C on v entions The following table describes th e typog raphic styles used in this book. T able 1 T ypogr aphic Conventions Ty p e f a c e o r Sym b ol Meaning Example AaBbCc123 This type is used for names of commands, files, and dire ctorie s used withi n the t[...]

RackSwitch G8000 Application Guide 14  Preface BMD00041, November 2008 How to Get Help If you need help, service, or technical assis tance, call Blade Network T echnologies T echnical Support: US toll free calls: 1-800 -414-5268 International calls: 1-408-83 4-7871 Y ou also can visit our websit e at the following address: http://www.bladenetwor[...]

BMD00041, Nov ember 2008 15 C HAPTER 1 A cc essing the S witch The Blade OS software provides means for acces sing, configuring, and viewing information and statistics about the RackSwitch G8000. Th is chapter discusses di fferent methods of access- ing the switch and ways to secure the switch for remote admi nistrators:  “Configuring an IP In[...]

RackSwitch G8000 Application Guide 16  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 C onfiguring an IP Inter face T o mana ge the swit ch using T elnet, SNMP , or a W eb browser , you must configure an IP inter- face. Configure the follo wing IP parameters:  IP address  Subnet mask  Default gateway address 1. Log on to the s[...]

RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch  17 BMD00041, No vember 2008 Us i ng T el n e t A T elnet connection offers th e convenience of accessing the swit ch from any workstation con- nected to the network. T elnet access provides the same options for us er access and administra- tor access as those availabl e through [...]

RackSwitch G8000 Application Guide 18  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 Using the Br ow ser-Based Inter face The Browser -Based Interface (BBI) is a W eb- based management interface for interactive switch access through your W eb browser . The BBI provides access to the common configurat ion, management and op eration fea[...]

RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch  19 BMD00041, No vember 2008 Accessing the BBI via HTTPS requires a SSL certi ficate to be used during the key exchange. A default certificate is created the first time HTTPS is enabled, but you can import a new cer- tificate that defines the informat ion you want to be used. Use[...]

RackSwitch G8000 Application Guide 20  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 U sing SNMP Blade OS provides SNMP v1.0 and SNMP v3.0 support for access through any network man- agement software, such as IB M Director or HP-OpenV iew . SNMP v1, v2 T o access th e SNMP agent on the G8000 , th e read and write community strings on [...]

RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch  21 BMD00041, No vember 2008 T o configure an SNMP user name , enter the followin g comm and: User configura tion: Users can be configured to use the authentication/privacy opti ons. The G8000 supp orts two authentication al gorithms: MD 5 and SHA, as specified in the following c[...]

RackSwitch G8000 Application Guide 22  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 3. Assign the user to the user group. Use the gr oup table to link the user to a particular access group. RS G8000 (config)# snmp-server group 5 user-name admin RS G8000 (config)# snmp-server group 5 group-name admingrp[...]

RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch  23 BMD00041, No vember 2008 C onfiguring SNMP T rap Hosts SNMPv1 trap host 1. Configure an entry in the notif y table. 2. Specify the IP address and other trap para meters in the targetAddr and targetParam tables. Use the following command to specify the user name used wi th thi[...]

RackSwitch G8000 Application Guide 24  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 SNMPv3 trap host configuration T o configure a user for SNMPv3 tr aps, you can choose to send the traps with both privacy and authentication, wi th auth entication only , or without privacy or auth enticat ion. This is configured in the access ta ble [...]

RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch  25 BMD00041, No vember 2008 Securing Ac cess to the S witch Secure switch managem ent is needed for environments that perform si gnificant management functions across the Internet. The following features are addressed in this section:  “RADIUS Authentication an d Authorizat[...]

RackSwitch G8000 Application Guide 26  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 RADIUS Authentica tion and Authorization Blade OS supports the RADIUS (Remote Authentication Dial -in User Service) method to authenticate and authorize remo te administrators for managing the switch. This method is based on a client/server model. The[...]

RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch  27 BMD00041, No vember 2008 Configuring RADIUS Use the following procedure to configure RADIUS authentication on your switch. 1. Configure the Primary and Secondar y RADIUS servers, and enable RADIUS authentication. 2. Configure the RADIUS secret and enable the feature. 3. If de[...]

RackSwitch G8000 Application Guide 28  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 RADIUS authentication fe atur es in Blade OS Blade OS supports the followin g RADIUS authentication features:  Supports RADIUS client on the switch, ba sed on the protocol definitions in RFC 2138 and RFC 2866.  Allows RADIUS secret password up t[...]

RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch  29 BMD00041, No vember 2008 Switch User Acco unts The user accounts listed in T able 1 - 1 can be defined in the RADIU S server dictionary file. RADIUS Attributes f o r G8000 user privileges When the user logs in, the sw itch authenticates his/her level of access by sending the [...]

RackSwitch G8000 Application Guide 30  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 T A CACS+ A uthentication Blade OS supports authentication and authorization w ith networks using the Ci sco Systems T ACACS+ protocol. The G8000 f unctions as the Network Access Server (NAS) by interacting with the remote client and initi ating authe[...]

RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch  31 BMD00041, No vember 2008 T ACA CS+ authentication featur es in Blade OS Authentication is the action of determining the iden tit y of a user , and is generally done when the user first attempts to log in to a device or gain access to its serv ices. Blade OS supports ASCII inb[...]

RackSwitch G8000 Application Guide 32  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 If the remote user is successfully authenti cated by the authentication server , the switch verifies the privi leges of the remote user and authorizes the appropriate access. The adminis- trator has an option to allow secure backdoor access via T elne[...]

RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch  33 BMD00041, No vember 2008 When T ACACS+ Command Logging is enabled, Blade OS configuration commands are logged on the T ACACS+ server . Use the follow ing comm a nd to enab le T ACACS+ Command Logging: The following examples illustrat e the format of Blade OS co mmands sent to[...]

RackSwitch G8000 Application Guide 34  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 Secure Shell Secure Shell (SSH) use secure tunnels to en crypt and secure messages between a remote administrator an d the switch. T e lnet does not prov ide this level of security . The T el net method of managing a G8000 does not provide a secure co[...]

RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch  35 BMD00041, No vember 2008 Generating RSA Host and Se r ver Keys for SSH access T o supp ort the SSH server feature, two set s of RSA keys (host and server keys) are required. The host key is 1024 bits and is used to identify the G8000 . The server key is 768 bit s and is used [...]

RackSwitch G8000 Application Guide 36  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 End User A cc e ss C ontrol Blade OS allows an administrator to define e nd user accounts that permit end users to perform operation tasks via the switch CLI commands. Once end user accounts are configured and enabled, the switch requires us ername/pa[...]

RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch  37 BMD00041, No vember 2008 Defining a User ’ s access lev el The end user is by default assigned to the user access level (also known as class of s e rvice, or COS). COS for all user accounts have global access to all resources e xcept for User COS, which has access to view o[...]

RackSwitch G8000 Application Guide 38  Chapter 1: Accessing the Switch BMD00041, Nov ember 2008[...]

BMD00041, Nov ember 2008 39 C HAPTER 2 P or t-based Network A cc ess Contr ol Port-Based Network Access cont rol provides a means of authenticating and authorizing devices attached to a LAN port that has point-to-point connectio n characteristics. It prevents access to ports that fail authentica tion and authoriza tion. This feat ure provides secur[...]

RackSwitch G8000 Application Guide 40  Chapter 2: Port-based Network Access Control BMD00041, Nov ember 2008 Extensible Authentication P rotocol o ver LAN The G8000 can provide user-level security for its ports using the IEEE 802.1X protocol, whi ch is a more secure alternative to other method s of port-based network access control. Any device a[...]

RackSwitch G8000 Application Guide Chapter 2: Port-based Network Access Control  41 BMD00041, No vember 2008 802.1X authentication pr ocess The clients and authenticators communicate using Extensible Authenticati on Protocol (EAP), which was originally designed to run over PPP , and for which the IEEE 802.1X Standard has defined an encapsulation[...]

RackSwitch G8000 Application Guide 42  Chapter 2: Port-based Network Access Control BMD00041, Nov ember 2008 EAP oL mess age exchange During authentication, EAPOL messages are exchanged be tween the client and the G8000 authenticator , while RADIUS-EAP messages ar e exchanged between th e G8000 authenticator and the RADIUS server . Authenticatio[...]

RackSwitch G8000 Application Guide Chapter 2: Port-based Network Access Control  43 BMD00041, No vember 2008 802.1X por t states The state of the port determines whether the client is granted access to the network, as follows:  Unauthorized While in this state the port discards all ingress and egress traf fic except EAP packets.  Authorize[...]

RackSwitch G8000 Application Guide 44  Chapter 2: Port-based Network Access Control BMD00041, Nov ember 2008 Suppor ted RADIUS attributes The G8000 802.1X Authenticator rel ies on external RAD IUS servers fo r auth entication with EAP . Ta b l e 2 lists the RADIUS attributes that are supported as part of RADIUS-EAP authentication based on the gu[...]

RackSwitch G8000 Application Guide Chapter 2: Port-based Network Access Control  45 BMD00041, No vember 2008 C onfiguration guidelines When configuring EAPoL, consid er the following guidelines:  The 802.1X port-based authent ication is currently supported only in point-to-point config- urations, that is, with a single supplicant connected to[...]

RackSwitch G8000 Application Guide 46  Chapter 2: Port-based Network Access Control BMD00041, Nov ember 2008[...]

BMD00041, Nov ember 2008 47 C HAPTER 3 VLANs This chapter describes network design and topol o gy considerations for using V i rt ua l Lo ca l Ar ea Ne tw ork s ( VL ANs ). VLANs commonly are used to split up groups of network users into man- ageable broadcast domains, to create logical segm entation of workgroups, and to enforce security policies [...]

RackSwitch G8000 Application Guide 48  Chapter 3: VLANs BMD00041, Nov ember 2008 Ov ervi e w Setting up virt ual LANs (VLANs) is a way to segment netwo rks to increase network flex ibility without changing the physical network topology . W ith network segmentation, each switch port connects to a segment that is a single broadcast domain. When a [...]

RackSwitch G8000 Application Guide Chapter 3: VLANs  49 BMD00041, Nov e mber 2008 VLANs and P or t VL AN ID Numbers VLAN numbers The G8000 supports up to 1024 VLAN s per switch. Ev en though the maximum num ber of VLANs supported at any given time is 1024, each can be identified wi th any number between 1 and 4094. VLAN 1 is the default VLAN for[...]

RackSwitch G8000 Application Guide 50  Chapter 3: VLANs BMD00041, Nov ember 2008 PVID nu mbers Each port in the switch has a configurable default VLAN number, known as its PV ID . By default, the PVID for all ports is set to 1, which correlates to the default VLAN ID . The PVID for each port can be configured to any VLAN number between 1 and 409[...]

RackSwitch G8000 Application Guide Chapter 3: VLANs  51 BMD00041, Nov e mber 2008 VLAN T aggi ng Blade OS software supports IEEE 802.1Q VLAN tagging, providing standards-based VLAN support for Ethernet systems. T agging places the VLAN id entifier in the frame header of a packet, allowing each port to belong to multiple VLANs. When you add a por[...]

RackSwitch G8000 Application Guide 52  Chapter 3: VLANs BMD00041, Nov ember 2008 N OTE – If a 802.1Q tagged frame is received by a port that has VLAN-tagging d isabled and the port VLAN ID (PVID) is di fferent than the VLAN ID of the packet, then the frame is dropped at the ingress port. Figure 3-1 Default VLAN settings N OTE – The port numb[...]

RackSwitch G8000 Application Guide Chapter 3: VLANs  53 BMD00041, Nov e mber 2008 Figure 3-2 throu gh Figure 3-5 illu strate generic examples of VLAN tagging. In Figure 3 -2 , untagged incoming packets are a ssigned directly to VLAN 2 (PVID = 2). Port 5 is configured as a tagged member of VLAN 2, and po rt 7 is configured as an untagged member o[...]

RackSwitch G8000 Application Guide 54  Chapter 3: VLANs BMD00041, Nov ember 2008 In Figure 3-4 , tagged incoming packets are assigned di rectly to VLAN 2 because of the tag assignment in the packet. Po rt 5 is configured as a tagged member of VLAN 2, and port 7 is configured as an untagged member of VLAN 2. Figure 3-4 802.1Q tag assignm ent As s[...]

RackSwitch G8000 Application Guide Chapter 3: VLANs  55 BMD00041, Nov e mber 2008 VLAN T opologies and Design C onsidera tions  By default, the G8000 software is configured so that tagging is disabled on all po rts.  By default, the G8000 software is configured so that all ports are members of VLAN 1.  If you configure Spanning Tr ee, n[...]

RackSwitch G8000 Application Guide 56  Chapter 3: VLANs BMD00041, Nov ember 2008 Multiple VLANs with T agging Adapters Figure 3-6 Example 1: Multiple VLANs with VLAN-T agged Gigabit Adapters The features of this V LA N are des cribed below: Component Description G8000 switch This switch is configured w ith three VLANs that represent three differ[...]

RackSwitch G8000 Application Guide Chapter 3: VLANs  57 BMD00041, Nov e mber 2008 N OTE – VLAN tagging is required only on ports that are connected to oth er switches or on ports that connect to tag-capable end-stations, such as servers with VLAN-tagging adapters. Server 1 This server is a member of VLAN 1 and has presence in only one IP subne[...]

RackSwitch G8000 Application Guide 58  Chapter 3: VLANs BMD00041, Nov ember 2008 VLAN configurat ion example Use the following procedure to conf igure the example network show n in Figure 3-6 . 1. Enable VLAN taggi ng on server port s that support multiple VLANs. 2. Enable tagging on uplink ports that support multiple VLANs. 3. Configure th e VL[...]

RackSwitch G8000 Application Guide Chapter 3: VLANs  59 BMD00041, Nov e mber 2008 Pri vate VL A Ns Private VLANs provide Layer 2 isolation b etween the ports within the same broadcast domain. Private VLANs can contro l traffic within a VLAN domain, a nd provide port-based security fo r host servers. Use Private VLANs to partition a VLAN domain i[...]

RackSwitch G8000 Application Guide 60  Chapter 3: VLANs BMD00041, Nov ember 2008  Community—A communi ty po rt is a host port that belongs to a community VLAN. Com- munity ports can co mmunicate with o ther ports in the same community VLAN, and with promiscuous ports. These interf aces are isolated at layer 2 from all other interfaces in ot[...]

RackSwitch G8000 Application Guide Chapter 3: VLANs  61 BMD00041, Nov e mber 2008 2. Configure a secondary VLAN and map it to the primary VLAN. 3. V erify the configuration. RS G8000 (config)# vlan 110 RS G8000 (config-vlan)# enable RS G8000 (config-vlan)# member 3 RS G8000 (config-vlan)# member 4 RS G8000 (config-vlan)# private-vlan type isolat[...]

RackSwitch G8000 Application Guide 62  Chapter 3: VLANs BMD00041, Nov ember 2008[...]

BMD00041, Nov ember 2008 63 C HAPTER 4 Po r t s a n d T r u n k i n g T ru nk groups can pro vide super-bandwidth, multi-link connections between swit ches or othe r trunk-capable devices. A trunk g roup is a group of ports that act together , comb ining their bandwidth to create a single, la r ger virtual link. Th is c ha pt e r provides confi gur[...]

RackSwitch G8000 Application Guide 64  Chapter 4: Ports and Trunking BMD00041, Nov ember 2008 Ov ervi e w When using port trunk groups betw een two switches, as shown in Figure 4-1 , you can create a virtual link between the switches, operating up to 40 Gb per second, depen ding on how many physical ports are combined. Each G8000 supports up to [...]

RackSwitch G8000 Application Guide Chapter 4: Ports and Trunking  65 BMD00041, No vember 2008 Before y ou configure sta tic trunks When you create and enable a static trunk, the trunk members (switch ports) take on certain settings necessary for correct ope ration of the trunking feature. Before you confi gure your trunk, you must cons ider thes[...]

RackSwitch G8000 Application Guide 66  Chapter 4: Ports and Trunking BMD00041, Nov ember 2008  All trunk members must be in the same Spanning Tree Group (STG) and can belong to only one Spanning Tree Group (STG). However if all ports are tagg ed , then all trunk ports can belong to multiple STGs.  When a trunk is enabled, the trunk’ s Sp[...]

RackSwitch G8000 Application Guide Chapter 4: Ports and Trunking  67 BMD00041, No vember 2008 Po r t T r u n k i n g E x a m p l e In the example below , three ports are trunked between two switches. Figure 4-1 Port T runk Group Configuration Example Prior to configuring each switch in the above ex ample, you must connect to the appropriate swit[...]

RackSwitch G8000 Application Guide 68  Chapter 4: Ports and Trunking BMD00041, Nov ember 2008 2. Repeat the process on the other switch. 3. Connect the switch port s that will be members in the trunk group. T ru nk group 3 (o n the G80 00) is now connected to trunk group 1 (on the other switch). N OTE – In this example, two G8000 switches are [...]

RackSwitch G8000 Application Guide Chapter 4: Ports and Trunking  69 BMD00041, No vember 2008 C onfigurable T runk Hash Algorithm This feature allows you to configure parameters for the tru nk hash algo rithm, instead of using the default values. Use the IP Trunk Hash commands to configure new default behavior for Layer 2 traffic and Layer 3 tra[...]

RackSwitch G8000 Application Guide 70  Chapter 4: Ports and Trunking BMD00041, Nov ember 2008 Link Aggr egation Con trol Pr otocol Link Aggregation Control Protocol (LACP) is an IEEE 802.3ad standard for grouping sev eral physical ports into one logical port (known as a dynamic tru nk group or Li nk Aggregation group) with any device that suppor[...]

RackSwitch G8000 Application Guide Chapter 4: Ports and Trunking  71 BMD00041, No vember 2008 LACP automatically determi nes which member lin ks can be aggregated and then aggregates them. It provides for the co ntrolled addition and removal of physical links for the link ag grega- tion. Each port on the switch can have one of the following LACP[...]

RackSwitch G8000 Application Guide 72  Chapter 4: Ports and Trunking BMD00041, Nov ember 2008 LA CP configur ation guidelines Consider the following guidelin es when you con figure LACP trunks:  When ports become memb ers of a trunk, configuration parameters (except ACL and QoS) are applied per trunk. When a trunk group is formed, these param[...]

BMD00041, Nov ember 2008 73 C HAPTER 5 Spanning T ree When multiple paths exist on a network , Spanni ng Tree Protocol configures the network so that a switch uses only the most ef ficient path. The following topics are discussed in this chapter:  “Overview” on page 74  “Rapid Spanning Tree Protocol” on page 80  “Per VLAN Rapid S[...]

RackSwitch G8000 Application Guide 74  Chapter 5: Spanning Tree BMD00041, November 2008 Ov ervi e w Spanning Tree Protocol detects and eliminates logi cal loops in a bridged or switched network. When multiple paths exist, Span ning Tr ee configures the network so that a sw itch uses only the most efficient path. If that path fails, Spanning T re[...]

RackSwitch G8000 Application Guide Chapter 5: Spanning Tree  75 BMD00041 , November 2008 Bridge Pr otocol Da ta Units (BPDUs) T o create a Spanning Tr ee, the switch generates a configuration Bridge Protocol Data Unit (BPDU), which it then forwards out of its ports. All switch es in the Layer 2 network parti cipat- ing in the Spanning Tree gathe[...]

RackSwitch G8000 Application Guide 76  Chapter 5: Spanning Tree BMD00041, November 2008 Po r t Pr i o ri t y The port priority helps determine wh ich bri dge po rt beco mes the root/designated port. The case for the root port is when 2 switches ar e connected using a minimum of two links with the same path-cost. The case for the design ated port[...]

RackSwitch G8000 Application Guide Chapter 5: Spanning Tree  77 BMD00041 , November 2008 Assigning a VLAN to a Spanning T ree Gr oup  If no VLANs exist beyond the default VLAN 1 see “Creating a VLAN” on page 78 for information on adding ports to VLANs.  Assign the VLAN to the STG using the foll owing command:  If the association bet[...]

RackSwitch G8000 Application Guide 78  Chapter 5: Spanning Tree BMD00041, November 2008 Creating a VLAN When you create a VLAN, that VLAN automatically belongs to STG 1, the default STG . Y o u can assign the VLAN to another STG .  Move a newly created VLAN to an existing STG by following thi s order:  Create the VLAN.  Enable the VLAN.[...]

RackSwitch G8000 Application Guide Chapter 5: Spanning Tree  79 BMD00041 , November 2008 As an example, assume that port 1 belongs to VLAN 2, and VLAN 2 belongs to STG 2. When you remove port 1 from VLAN 2, port 1 is also removed from STG 2. The port moves to the default VLAN 1. However , if port 1 belon gs to both VLAN 1 and VLAN 2 and both VLA[...]

RackSwitch G8000 Application Guide 80  Chapter 5: Spanning Tree BMD00041, November 2008 Rapid Spanning T ree Pr otocol Rapid Spanning Tree Protocol (RSTP) provides rapid convergence of the spanning tree and provides for fast re-configuration critical for netw orks carrying delay-sensitive traf fic such as voice and video. RSTP significantl y red[...]

RackSwitch G8000 Application Guide Chapter 5: Spanning Tree  81 BMD00041 , November 2008 P or t T ype and Link T ype Spanning Tree configuration includes the following parameters to support RSTP and MSTP: edge port and link type. Edge P or t A port that does not connect to a bridge is called an edge port . Edge ports can start forwarding as soon[...]

RackSwitch G8000 Application Guide 82  Chapter 5: Spanning Tree BMD00041, November 2008 RSTP configura tion example This section provides steps to configure Ra pid Spanning Tree on the G8000, using th e Command-Line Interface (ISCLI). Rapid Spanning T ree Protocol is the default setting on the G8000. Configur e Rapid Spanning T ree Rapid Spannin[...]

RackSwitch G8000 Application Guide Chapter 5: Spanning Tree  83 BMD00041 , November 2008 P er VLAN Rapid Spanning T ree Per VLAN Rapid Spanning T ree Plu s Protocol (PVRST+) enhances the RSTP protocol by adding the ability to have multiple spann ing tree groups. PVRST+ is based on IEEE 802.1w Rapid Spanning T ree Protocol. In PVRST mode, the G80[...]

RackSwitch G8000 Application Guide 84  Chapter 5: Spanning Tree BMD00041, November 2008 Wh y do we need multiple Spanning T rees? The following examples describe why we need mult iple spann ing trees. In Figure 5-1 , VLAN 1 an d VLAN 2 pass traffic between switch 1 and switch 2. If you have a single Spanning Tree Group, the switches see an app a[...]

RackSwitch G8000 Application Guide Chapter 5: Spanning Tree  85 BMD00041 , November 2008 PVRST co nfigura tion guidelines This section provides important informat ion about configuring Per VLAN Rapid Spannin g T ree Groups:  By default, STGs 2-128 are empty , and STG 1 contains all configured VLAN s until indi- vidual VLANs are assigned to ot[...]

RackSwitch G8000 Application Guide 86  Chapter 5: Spanning Tree BMD00041, November 2008 Multiple Spanning T ree P rotocol Multiple Spanning Tree extends Rapid Spannin g T ree Protoco l through multip le Spanning T ree Groups, using multiple VLANs in each ST G . MSTP supports up to 32 Spanning-Tree instances, that corresp ond to STP Groups 1-32. [...]

RackSwitch G8000 Application Guide Chapter 5: Spanning Tree  87 BMD00041 , November 2008 MSTP configur ation guidelines This section provides important informat ion about configuring Multiple Span ning T ree Groups:  When MSTP is turned on, the switch automatically moves all VLANs to the CIST . When MSTP is turned off, the switch moves all VL[...]

RackSwitch G8000 Application Guide 88  Chapter 5: Spanning Tree BMD00041, November 2008 Figure 5-3 Implementing M ultiple S panning T ree Group s Server 1 VLAN 2 Server 2 VLAN 2 Server 3 VLAN 1 Server 4 VLAN 1 Server 5 VLAN 1 Enterprise Routing Switch Enterprise Routing Switch Blocking VLAN 1 Passing VLAN 2 Passing VLAN 1 Blocking VLAN 2 (MSTP G[...]

RackSwitch G8000 Application Guide Chapter 5: Spanning Tree  89 BMD00041 , November 2008 Configuring Multiple Spanning T ree Groups This configuration shows how to configure MSTP Groups on the switch, as shown in Figure 5-3 . 1. Configure port memb ership and define the Spanning T ree gr oups for VLAN 1. Enable tagging on uplink ports th at shar[...]

RackSwitch G8000 Application Guide 90  Chapter 5: Spanning Tree BMD00041, November 2008 3. Configure port memb ership and define the Spanning T ree gr oups for VLAN 2. Add server ports 3, 4, and 5 to VLAN 2. Add uplink po rts 51 and 52 to VLAN 2. Assign VLAN 2 to Spanning T ree G roup 2. N OTE – Each Spanning T r ee Group (STG) is enabled by d[...]

RackSwitch G8000 Application Guide Chapter 5: Spanning Tree  91 BMD00041 , November 2008 Fa s t U p l i n k C o n v e r g e n c e Fast Uplink Conver gence enables the G8000 to r ecover quickly from the failure of the primary link or trunk group in a Layer 2 netwo rk usin g Sp anning T ree Protocol. Normal recovery can take as long as 50 seconds,[...]

RackSwitch G8000 Application Guide 92  Chapter 5: Spanning Tree BMD00041, November 2008[...]

BMD00041, Nov ember 2008 93 C HAPTER 6 Quality of Ser vice Quality of Service featur es allow you to allocat e network reso urces to mission-critical appli ca- tions at the expense of ap plications that are less sensitive to such factors as time delays or net- work congestion. Y ou can configure your networ k to prioritize specifi c types of traffi[...]

RackSwitch G8000 Application Guide 94  Chapter 6: Quality of Service BMD00041, Nov ember 2008 Overview QoS helps you allocate gu aranteed bandwidth to the critical applications, and limit bandwi dth for less critical applications. Ap plications such as video and vo ice must have a certain amount of bandwidth to work correctly; u sing QoS, you ca[...]

RackSwitch G8000 Application Guide Chapter 6: Quality of Service  95 BMD00041, No vember 2008 Us i n g AC L Fi l te r s Access Control Lists are filters that allow you to cl assify dat a packets according to a particular content in the packet header , such as the sour ce address, destination ad dress, source port nu m - ber , destination port nu[...]

RackSwitch G8000 Application Guide 96  Chapter 6: Quality of Service BMD00041, Nov ember 2008 IP Standard A CLs The switch supports up to 127 IP ACLs (standard and extended). IP Standard ACLs are num- bered from 1-1000. Use IP Standard ACLs to filter traffic us ing s ource IP address/network mask and destination IP address/netw ork/mask. T o cre[...]

RackSwitch G8000 Application Guide Chapter 6: Quality of Service  97 BMD00041, No vember 2008 T o create an IP Extended ACL: T o delete an IP Extended ACL: T able 6-1 Well-known protocol types Number Protocol Name 1 4 6 17 89 103 icmp ip tcp udp ospf pim T able 6-2 Well-known application port s Number TC P/UDP Application Number TC P/UDP Applica[...]

RackSwitch G8000 Application Guide 98  Chapter 6: Quality of Service BMD00041, Nov ember 2008 Understanding A CL priorit y Each ACL has a unique priority , based on its nu mber . The higher the ACL number , the higher the priority , so ACL 1 has the lowest priority . The priority is used to decide which ACL rule to apply when a packet m atches o[...]

RackSwitch G8000 Application Guide Chapter 6: Quality of Service  99 BMD00041, No vember 2008 N OTE – T o ensure your ACLs function properly , do not assign the same ACL to different ports using different filtering directions. It is recommended that you create two ACLs, one for ingress traffic, and one for egres s traffic. T o assign an ACL to[...]

RackSwitch G8000 Application Guide 100  Chapter 6: Quality of Service BMD00041, Nov ember 2008 A CL configura tion examples Example 1 Use this configuration to block traf fic to a speci fic host. All traffic that ingresses port 1 is denied if it is destined for the host at IP address 100.10.1.1 1. Configure an Access Contr ol List. 2. Assign the[...]

RackSwitch G8000 Application Guide Chapter 6: Quality of Service  101 BMD00041, No vember 2008 Example 2 Use this configuration to block traffic from a network destined for a specific host address. All traffic that ingresses port 10 with source IP from the class 100.10.1.0/24 and destination IP 200.20.2.2 is denied. 1. Configure an Access Contr [...]

RackSwitch G8000 Application Guide 102  Chapter 6: Quality of Service BMD00041, Nov ember 2008 Example 3 Use this configuration to block traffic from a netw ork that is destined for a specific egress port. All traffic that egresses port 6 from the network 100.10.1.0/24 is denied. 1. Configure an Access Contr ol List. 2. Add the ACL to port 6. Ex[...]

RackSwitch G8000 Application Guide Chapter 6: Quality of Service  103 BMD00041, No vember 2008 Example 5 Use this configuration to block all traffic exce pt traffic of certain ty pes . HTTP/HTTPS, DHCP , and ARP packets are permitted on the port. All other traffic is denied. 1. Configure one IP ACL for each type of traffic that you want to permi[...]

RackSwitch G8000 Application Guide 104  Chapter 6: Quality of Service BMD00041, Nov ember 2008 5. Assign the ACLs to a port. RS G8000 (config)# interface port 7 RS G8000 (config-if)# ip access-group 1103 in RS G8000 (config-if)# ip access-group 1104 in RS G8000 (config-if)# ip access-group 1105 in RS G8000 (config-if)# ip access-group 1106 in RS[...]

RackSwitch G8000 Application Guide Chapter 6: Quality of Service  105 BMD00041, No vember 2008 U sing Storm C ontrol F ilters The G8000 provides filters th at can limit the number of the following packet types transmitted by switch ports:  Broadcast packets  Multicast packets  Unknown unicast packets (destination look up fai lure) Broad[...]

RackSwitch G8000 Application Guide 106  Chapter 6: Quality of Service BMD00041, Nov ember 2008 U sing DSCP V alues to Pro vide QoS The switch uses the Differentiated Services (D if fServ) architecture to provide Qo S fu nctions. DiffServ is described in IETF RFCs 2474 and 2475. The six most significant bits in the TOS byte of the IP header are d[...]

RackSwitch G8000 Application Guide Chapter 6: Quality of Service  107 BMD00041, No vember 2008 The switch can perform the following actions to the DSCP:  Read the DSCP value of ingress packets.  Map the DSCP value to an 802.1p priority . The switch can use the DSCP value to direct traf fic prioritization. W ith DiffServ , you can establish[...]

RackSwitch G8000 Application Guide 108  Chapter 6: Quality of Service BMD00041, Nov ember 2008 P er Hop Behavior The DSCP value determines the Per Hop Behavi or (PHB) of each packet. The PHB is the for- warding treatment given to packets at each hop. QoS policies ar e built by applying a set of rules to packets, based on the DSCP value, as they [...]

RackSwitch G8000 Application Guide Chapter 6: Quality of Service  109 BMD00041, No vember 2008 QoS Lev els T abl e 6-3 shows the default service levels provided by the switch, listed from highest to lowest importance: T able 6-3 Default QoS Service Levels Service Level Default PHB 802.1p Priority Critical CS7 7 Network Control CS6 6 Premium EF ,[...]

RackSwitch G8000 Application Guide 110  Chapter 6: Quality of Service BMD00041, Nov ember 2008 DSCP-to-802.1p mapping The switch can use the DSCP value of ingress p ackets to set the 802.1p pr iority value. Use the following command to vi ew the default settings. Use the following command to tu rn on DSCP mapping globally: Use the following comm[...]

RackSwitch G8000 Application Guide Chapter 6: Quality of Service  111 BMD00041, No vember 2008 U sing 802.1p Priority t o Pr ovide QoS The G8000 provides Qual ity of Service functions based on the priority bits in a packet’ s VLAN header . (The priority bits are defined by the 802 .1 p standard within the IEEE 802.1Q VLAN header .) The 802.1p [...]

RackSwitch G8000 Application Guide 112  Chapter 6: Quality of Service BMD00041, Nov ember 2008 802.1p configur ation e xample 1. Configure a port’ s default 802.1p priority value t o 2. 2. Map the 802.1p priority value to a COS queue and set the COS queue scheduling weight. Queuing and Scheduling The G8000 has up to eight output Class of Se rv[...]

BMD00041, Nov ember 2008 113 C HAPTER 7 Remote Monitor ing Remote Monitoring (RMON) allows network de vi ces to exchange network monitorin g data. RMON allows the switch to perform the following functio ns:  T rack events and trigger alarms when a threshold is reached.  Notify administrators b y issuing a syslog message or SNMP trap. Ov ervie[...]

RackSwitch G8000 Application Guide 114  Chapter 7: Remote Monitoring BMD00041, Nov ember 2008 RMON group 1—Sta tistics The switch supports collection of Ethernet statis tics as outlined in the RMON statistics MIB, in reference to etherStatsT able. Y ou can conf igure RMON statistics on a per -port basis. RMON statistics are sampled every secon[...]

RackSwitch G8000 Application Guide Chapter 7: Remote Monitoring  115 BMD00041 , November 2008 RMON group 2—Histor y The RMON History group allows you to samp le an d archive Ethernet statistics for a specific interface during a specific ti me interval. History sa mpling is done per port. N OTE – RMON port statistics must be enabled for the p[...]

RackSwitch G8000 Application Guide 116  Chapter 7: Remote Monitoring BMD00041, Nov ember 2008 Configuring RMON History Perform the following steps to configure RMO N History on a port. 1. Enable RMON on a port. 2. Configure the RMON History parameters for a port. This configuration enables RMON history collection on port 1. 3. V iew RMON History[...]

RackSwitch G8000 Application Guide Chapter 7: Remote Monitoring  117 BMD00041 , November 2008 Use one of the following commands to corr elate an Alarm index to an Event index: When the alarm threshold is reached, the corresponding even t is triggered. Alarm MIB objects The most common data types us ed for alarm m onitoring are ifStats : errors, [...]

RackSwitch G8000 Application Guide 118  Chapter 7: Remote Monitoring BMD00041, Nov ember 2008 Example 2 1. Configure the RMON Alarm parame ters to track ICMP messages. This configuration creates an RMON alarm that checks icmpInEchos on the switch once every minute. If the statistic ex ceeds 200 within a 60 second interval , an alarm is generated[...]

BMD00041, Nov ember 2008 119 C HAPTER 8 Basic IP Routing Th i s ch apt e r provides configuration background and examples for using the G8000 to perform IP routing functions. The following topics are addressed in this chapter:  “IP Routing Benefits” on page 120  “Routing Between IP Subnets” on page 121  “Example of Subnet Routing[...]

RackSwitch G8000 Application Guide 120  Chapter 8: Basic IP Routing BMD00041, Nov ember 2008 IP Routing Benefits The switch uses a combination of configurable IP switch interfaces and IP routing options. The switch IP routing capab ilities provide the foll owing benefits:  Connects the server IP subnets to the rest of the backbone network. ?[...]

RackSwitch G8000 Application Guide Chapter 8: Basic IP Routing  121 BMD00041, Nov ember 2008 Routing Betw een IP Subnets The physical layout o f most corporat e networks has evolved over time. Classic hub/router topologies have given way to faster sw itched topologies, particularly now that switches are increasingly intelligent. The G80 00 is in[...]

RackSwitch G8000 Application Guide 122  Chapter 8: Basic IP Routing BMD00041, Nov ember 2008 This is a situation that switching alone cannot cure. In st ead, th e router is flooded with cross- subnet communicatio n. This comprom ises efficiency in two ways:  Routers can be slower than switches. The cro ss-subnet side trip from the switch to t[...]

RackSwitch G8000 Application Guide Chapter 8: Basic IP Routing  123 BMD00041, Nov ember 2008 Example of Subnet Routing Consider the role of the G8000 in the following configuratio n example: Figure 8-2 Switch-Based Ro uting T opology The switch connects the Gigabit Ethernet and Fast Ethernet trunks from vario us switched sub- nets throughout one[...]

RackSwitch G8000 Application Guide 124  Chapter 8: Basic IP Routing BMD00041, Nov ember 2008 Using VLANs t o segregate Br oadcast Domains If you want to control the broadcasts on your ne twork, use VLANs to create distinct bro adcast domains. Create one VLAN for each serv er subnet, and one for the router . C onfiguration e xample This section d[...]

RackSwitch G8000 Application Guide Chapter 8: Basic IP Routing  125 BMD00041, Nov ember 2008 3. Determine which switch ports and IP interf aces belong to which VLANs. The following table adds port and VLAN information: N OTE – T o perform this configuration, you mu st be connected to the switch Command Line Interface (CLI) as the administrator[...]

RackSwitch G8000 Application Guide 126  Chapter 8: Basic IP Routing BMD00041, Nov ember 2008 5. Assign a VLAN to each IP interface. Now that the ports are separate d int o VLANs, the VLANs are a ssigned to the appropriate IP interface for each subnet. From T able 8-3 on page 125 , the settings are made as follows: 6. Configure th e defa ult gat [...]

RackSwitch G8000 Application Guide Chapter 8: Basic IP Routing  127 BMD00041, Nov ember 2008 Dynamic Host C onfigura tion Prot ocol Dynamic Host Configuration Protocol (D HCP) is a transport protocol that provides a frame- work for automatically assigning IP addresses a nd config urat ion information to oth e r IP hosts or clients in a large TCP[...]

RackSwitch G8000 Application Guide 128  Chapter 8: Basic IP Routing BMD00041, Nov ember 2008[...]

BMD00041, Nov ember 2008 129 C HAPTER 9 IGMP Internet Group Management Protocol (IGMP) is used by IP Multicast routers to learn abo ut the existence of host group members on their direct ly attached subnet (see RFC 2236). The IP Multicast routers get this information by broa dcasting IGMP Membership Queries an d listen - ing for IP hosts reporting [...]

RackSwitch G8000 Application Guide 130  Chapter 9: IGMP BMD 00041, November 20 08 IGMP Snooping IGMP Snooping allows the switch to fo rward mu lticast traffic only to those ports that request it. IGMP Snooping prevents multicast traffic from being flooded to all ports. The switch learn s which server hosts are interested in receiving multicast t[...]

RackSwitch G8000 Application Guide Chapter 9: IGMP  131 BMD00041, No vember 2008 Fa s t L e a v e In normal IGMP operation, when the switch receives an IGMP v2 Leave message, it sends a Group-Specific Query to determine if any other devices in the same group (and on the same port) are still interested in the specified multicast group traffic. Th[...]

RackSwitch G8000 Application Guide 132  Chapter 9: IGMP BMD 00041, November 20 08 The switch supports the following IG MPv 3 filter modes:  INCLUDE mode: T he host requests membership to a multicast group and provides a list of IP addresses from which it wants to receive traffic.  EXCLUDE mode: The host requests membership to a multicast g[...]

RackSwitch G8000 Application Guide Chapter 9: IGMP  133 BMD00041, No vember 2008 5. V iew dynamic IGMP information. These commands display information about IGMP Gro ups and Mrouters learned by the switch. RS G8000# show ip igmp groups Note: Local groups (224.0.0.x) are not snooped/relayed and will not appear. Source Group VLAN Port Version Mode[...]

RackSwitch G8000 Application Guide 134  Chapter 9: IGMP BMD 00041, November 20 08 Static Multicast Router A static multicast router (Mrou t er) can be configured for a par ticular port on a particular VLAN. A static Mrouter does no t have to be learned thro ugh IGMP Snooping. An y data port can accept a static Mrouter . When you configure a stat[...]

BMD00041, Nov ember 2008 135 C HAPTER 10 High A vailability The RackSwitch G8000 supports high-availabi lity network topolo gies. The following topics are discussed in this chapter:  “Uplink Failure Detect ion” on page 136 .[...]

RackSwitch G8000 Application Guide 136  Chapter 10: High Availability BMD00041, Nov ember 2008 Uplink F ailure Detec tion Uplink Failure Detection (UFD) is designed to suppo rt Net work Adapter T eaming. Network Adapter T eaming allows all the NICs on each serv er to share the same IP address. The NICs are configured into a team. One NIC is the [...]

RackSwitch G8000 Application Guide Chapter 10: High Availability  1 37 BMD00041, November 2008 F ailure Detection Pair T o use UFD , yo u must confi gure a Failure Detectio n Pai r and then turn UFD on. A Failure Detection Pair consists of the following groups of po rts:  Link to Monitor (LtM) The Link to Monitor group consists of one por t o[...]

RackSwitch G8000 Application Guide 138  Chapter 10: High Availability BMD00041, Nov ember 2008 C onfiguring UFD Figure 10-1 shows a basic UFD configurat ion. In this example, NIC 1 is the primary network adapter; NIC 2 is a non-primary adapter . NIC 1 is connected to port 16 and NIC 2 is connected to port 17. Port 2 is connected to a Layer 2/3 r[...]

BMD00041, Nov ember 2008 139 A PPENDIX A T roubleshooting This section discusses some tools to help you troubleshoo t common problems on the RackSwitch G8000:  “Monitoring Ports” on page 140[...]

RackSwitch G8000 Application Guide 140  Appendix A: Troubles hooting BMD00041, November 20 08 Monitoring P or ts The port mirroring feature in the G8000 allows you to attach a sniffer to a monitoring port that is configured to receive a copy of all packets that are forwarded from the mirrored port. The G8000 enables you to m irror port traffic f[...]

RackSwitch G8000 Application Guide Appendix A: Troubleshooting  141 BMD00041, Nov e mber 2008 P or t Mirroring beha vior This section describes the composition of mo nitored packets in the switch, based on the configuration of the ports. The following port-mirroring cases app ly to th e G 8000 :  Ingress mirrored packet s are not modified. ?[...]

RackSwitch G8000 Application Guide 142  Appendix A: Troubles hooting BMD00041, November 20 08[...]

BMD00041, Nov ember 2008 143 Inde x Symbols ............. ........... .............. ............... .............. ..... 129 [ ] ........................ .......................... ..................... 13 Numerics 802.1p .................... .............. .............. .............. 111 802.1Q VLAN tagging .............. .............. .......[...]

RackSwitch G8000 Application Guide 144  Index BMD00041, November 2008 I IBM Director .......................... ........... .............. ....20 ICMP ........... .............. .............. ............ .............. .97 IEEE standards 802.1D ................... ........... .............. .............74 802.1p ......... .............. .....[...]

RackSwitch G8000 Application Guide Index  145 BMD00041, Nov e mber 2008 RSA keys ............ ........... ............... .............. ....... 35 RSTP ............. ......................... ........... .............. .. 80 S security port mirroring ................. ......................... ... 140 RADIUS authentication ............ ........[...]