Home

Web Browser Interface User's Guide

1. Figure 41 Create Event Log Output Page 5 Configure the following parameters as necessary Output ID Specifies an identification number for the syslog output definition Each definition must be given a unique number The range is 2 to 20 The default is the next available number Output Status Controls the status of the syslog output definition The options are Enabled Enables the output definition The switch uses the output definition to send events to the syslog server Disabled Disables the log output The switch does not use the output definition Message Format Controls the format of the sent event messages The options are Extended Sends the time module severity description file name line number and event ID This is the default Normal Sends the time module severity and description for each event Severity Selections Specifies the severity of events to be sent to the syslog server The options are ALL Sends all event messages of the following types Use Ctrl key to select more than one severity This is the default 148 Section II Advanced Operations Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide Error Sends only error event messages Error messages indicate that the switch operation is severely impaired Warning Sends only warning event messages These messages indicate that an issue may require manager attention Informat
2. Figure 22 Port Statistics Page The Port Statistics page displays a table with the following columns of information Bytes Received Number of bytes received on the port Bytes Sent Number of bytes transmitted from the port Frames Received Number of frames received on the port 89 Chapter 5 Port Parameters 90 Frames Sent Number of frames transmitted from the port Broadcast Frames Received Number of broadcast frames received on the port Broadcast Frames Sent Number of broadcast frames transmitted from the port Multicast Frames Received Number of multicast frames received on the port Multicast Frames Sent Number of multicast frames transmitted from the port Frames 64 Bytes Frames 65 127 Bytes Frames 128 255 Bytes Frames 256 511 Bytes Frames 512 1023 Bytes Frames 1024 1518 Bytes Frames 1519 1522 Number of frames transmitted from the port grouped by size CRC Error Number of frames with a cyclic redundancy check CRC error but with the proper length 64 1518 bytes received on the port Jabber Number of occurrences of corrupted data or useless signals appearing on the port No of Rx Errors Total number of frames received on the port containing errors Undersize Frames Number of frames that were less than the minimum length specified by IEEE 802 3 64 bytes including the CRC received on the port Oversize Frames Number of frames exceeding the maximum specified by IEEE
3. ssscccscsssccscssscccsssscccssssssssscssssssscsseess LOO Chapter 19 Spanning Tree and Rapid Spanning Tree Protocols 291 Enabling or Disabling a Spanning Tree Protocol 0 ce ceeceeceeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeseeeaeeeeeeeeeeeeeeeseeeeaaeeeseeaeeess 292 Eelef fi le GETT 294 Connguring STP Bridge Geltung ee ee ee eee T 294 Configuring STP FOr tie EE 297 Displaying the Rtl e EE 298 Resetting STP to the Default Settings snie n aE E EEE a E E 300 GONMGUNING KN E 302 Configuring RSTP Bridge SettingS esnai aa aa aa a A E a aaa EA 302 Configuring RSTP Port Settings ansieae a a a A 305 Displaying RSIP Settings ninae ean a a A E E N A aE th ee te 306 Resetting RSTP to the Default Settings eseeseesssssessserrresssrrnessennneeernnnnasnnenneentntnnestteanaeantnanentannneeennnneent 309 Chapter 20 Multiple Spanning Tree Protocol c cccccccceeeeeeeeeeececeneecaeeeeeeeeeeseesecaceaesaeeeeeeeeeeeeeneees 311 Enabling MST EG 312 elei ue HOENEN 314 Configuring MSTP Parameters A 314 Configuring the CIST Priority ET 317 Ma agiog MSTIS TEE 318 Creatingan AEN NEE 318 Moding an MST vicinal eit eke ee i ee eee a a ee 319 Deleting EIER EE 320 AT S63 Management Software Web Browser Interface User s Guide Configuring MSTP Port Parameters AAA 322 Displaying the MSTP Configuration sere tie ee eee ee teen eeaaeee eee a aa iea AA A R aia e ieia 326 Resetting MSTP to the Default Settings 2 0 00 cc eeee eee tern e
4. Figure 132 VLAN Tab Configuration Note The Modify and Remove buttons are not shown in the tab if the only VLAN on the switch is the Default_VLAN The VLAN Mode and Uplink Port options are explained in Selecting a VLAN Mode on page 344 336 Secton V Virtual LANs Secton V Virtual LANs AT S63 Management Software Web Browser Interface User s Guide The VLAN List section displays the current VLANs on the switch and contains the following columns of information VID ID The VLAN ID Client Name The name of the VLAN Uplink Port This column contains NA meaning Not Applicable for tagged port based and MAC address based VLANs For a protected ports VLAN this column contains the uplink port s for a port group Tagged uplink ports are designated with T and untagged uplink ports with U If the switch is operating in one of the two multiple VLAN modes this column displays the uplink port for the ports on the switch Type The VLAN type The possible settings are Port Based The VLAN is a port based or tagged VLAN MAC Based The VLAN is a MAC address based VLAN Protected The VLAN is a protected ports VLAN GARP The VLAN was automatically created by GARP Protocol The protocol associated with a VLAN The possible settings are None The VLAN is a port based tagged MAC address based or protected ports VLAN GARP The VLAN was created by GARP Member Ports The unta
5. AT 9424T SP VP Parameters C Enable GVRP Menable GIP IT Mgmt Security Leave Time Leave All Time a 60 centiseconas 1000 CentiSeconds E 7 on EE 1 opt port configuration Figure 136 GVRP Tab Configuration 4 In the GVRP Parameters section configure the following parameters as necessary Note The settings for the three timers must be the same on all GVRP active network devices Enable GVRP Click to enable or disable GVRP 350 Section V Virtual LANs Section V Virtual LANs AT S63 Management Software Web Browser Interface User s Guide Leave Time Use this parameter to specify the leave time The range is 30 to 80 centiseconds and the default is 60 centiseconds Join Time Use this parameter to specify the join time The range is 10 to 60 centiseconds and the default is 20 centiseconds This parameter must be in relation to the GVRP Leave Timer according to the following equation Join Timer lt 2 x GVRP Leave Timer Enable GIP Click to enable GIP which is required to propagate VLAN information among the ports of the switch Leave All Time The range is 500 to 300 centiseconds and the default is 1000 centiseconds Click Apply Configuration changes are immediately activated on the switch TO permanently save your changes select the Save Config option in the Configuration menu 351 Chapter 22 GARP VLAN Registration Protocol Enabling or Disabling GV
6. From the home page select Configuration From the Configuration menu select the Layer 1 option Select the Port Trunking tab The Port Trunking tab is shown in Figure 26 on page 105 Click the button next to the port trunk to be deleted and click Remove You can delete only one trunk at a time The port trunk is deleted from the switch To permanently save your changes select the Save Config option in the Configuration menu Section l Basic Operations AT S63 Management Software Web Browser Interface User s Guide Displaying the Port Trunks Section Basic Operations To display the port trunks perform the following procedure 1 2 From the home page select Monitoring From the Monitoring menu select the Layer 1 option Select the Port Trunking tab The Port Trunking tab is shown in Figure 29 System Name Marketing MAC Addr 00 30 84 AB EF CD C See J Por Trunking system Total Trunks 1 Page 1 of 1 ID Name Type Ports E Lg IE Figure 29 Port Trunking Tab Monitoring The Port Trunking tab displays a table with the following columns of information ID The ID number of the trunk Name The name of the trunk Type The load distribution method The possible settings are SA Source MAC address Layer 2 DA Destination MAC address Layer 2 SA DA Source MAC address destination MAC address Layer 2 SI Source IP address Layer 3 DI
7. Section VI Management Security AT S63 Management Software Web Browser Interface User s Guide Description The key s description You use these keys when you configure Secure Sockets Layer SSL or Secure Shell SSH To configure SSL you must use the AT S63 menus or CLI interface To configure SSH refer to Chapter 26 Secure Shell SSH on page 399 393 Chapter 25 Encryption Keys PKI and SSL Displaying the PKI Settings and Certificates 394 You can view the current PKI settings and certificates on the switch To configure the PKI settings and certificates you must use the AT S63 menus or command line interface For more information about PKI refer to the AT S63 Management Software Menus Interface User s Guide To display the PKI settings and certificates perform the following procedure 1 From the Home page select Monitoring 2 From the Monitoring menu select the Mgmt Security option 3 Select the PKI tab The PKI tab is shown in Figure 157 AT 9424T SP System Name Marketing MAC Addr 00 30 84 4B EF CD Maximum Number of Certificates is 256 Total Certificates 2 Page 1of 1 Mgmt Security Name State MTrust Type Source Local Trusted True EE Command Secondary Trusted True EE Command Figure 157 PKI Tab Monitoring The upper section of the tab states the maximum number of certificates the certificate database can store The defau
8. ecccceeeceeee eee eenne ee eee enne tees eet A atte eset neat a EEE SE A E a T 138 Enabling or Disabling the Event Loge 138 Displaying NC 140 Clearing am Event LOG reiner exc decaee anar cdagaesvtacateavvs gad ance E ATOE tiger sehasazadepe chin A ROA 144 Modifying the Event Log Full Action 0 ec ccccccceeeeeeeeeeeeene eee eeeeaeeeeeeeaaeeeeeeeaaeeeeeeeaaeeeeseeeaaeeeeeeenaeeeessenaaes 145 Saving an Event Log to a Filerio a A r A A A e ea a e eaa 146 Working with Syslog Output Definitions 00 cee cece eee e tent eee eee ee eee e rene eee eeeeaeeeeeeeaeeeeeeeeaeeeesenaeeeeeneaees 147 Configuring a Syslog Output Detinton cece ee eetee eee ee eect eee eeeaeee eee eaaeeeeeesaaaeeeeeeetiaeeeeeseiaeeeeenenaees 147 Viewing a Syslog Output Definition ie eceeeeeeceeenee eee eeeeeee eee eeeeeee eee eeeeeaeeeeeeeeeeeeeeeeseeeeeeeseeeaeeeseeenaeeees 150 Modifying a Syslog Output Definition eee eee ee eee eee e ee eeeeae eee eeeaaeeeeeeeaaeeeeeeeaaeeeeeeeiaeeeeseenaeeeeesenaees 150 Deleting a Syslog Output Definition ideian ii ead ea a A ea EE 151 Chapter 12 Claeslerez eegene ees a EE a ad a Genee 153 eiis iis ENEE 154 Modifying sa Classitler ET 160 BIEN EC Re EE 162 Displaying the Classi S nerne tech e ce sakes Peeks ceca ccetuaee He N Sendeea stad yee uth jh E 163 AT S63 Management Software Web Browser Interface User s Guide Chapter 13 Access Control Lists 0 0 00 eeeeeeee eee ee eee eter ene ee eee eaeeeeeeseeeeeeeees
9. 48 This procedure explains how to set the switch s date and time Setting the date and time is important if you plan to view the events in the switch s event log or send the events to a syslog server The correct date and time are also important if the management software will be sending traps to a management workstation or if you plan to create a self signed SSL certificate Events traps and self signed certificates should contain the date and time of when they occurred or in the case of certificates when they were created There are two ways to set the switch s date and time One method is to set it manually The AT 9400 Series switch has an onboard battery that maintains the date and time even when the unit is powered off or reset The second method uses the Simple Network Time Protocol SNTP The AT S63 management software comes with the client version of this protocol You can configure the AT S63 software to obtain the current date and time from an SNTP or Network Time Protocol NTP server located on your network or the Internet SNTP is a reduced version of the NTP However the SNTP client software in the AT S63 management software is interoperable with NTP servers Note In order for the management software on the switch to communicate with an SNTP or NTP server there must be an interface on the local subnet from where the switch is reaching the server The switch uses the IP address of the interface as its source add
10. Figure 87 Add New SNMPv3 Access Page In the Group Name field enter a descriptive name of the group The Group Name can consist of up to 32 alphanumeric characters You are not required to enter a unique value here because the SNMPv3 Access Table entry is indexed with the Group Name Security Model and Security Level parameter values However a unique group name makes it easier for you to tell the groups apart There are four default values for this field that are reserved for SNMPv1 and SNMPv2c implementations a defaultV1GroupReadOnly o defaultV1GroupReadWrite a defaultV2cGroupReadOnly o defaultV2cGroupReadWrite Note The Context Prefix field is a read only field The Context Prefix field is always set to null In the Read View Name field enter a value that you configured with the View Name parameter in the SNMPv3 View Table 241 Chapter 18 SNMPv3 242 10 This parameter allows the users assigned to this Group Name to view the information specified by the View Table entry This value does not need to be unique In the Write View Name field enter a value that you configured with the View Name parameter in the SNMPv3 View Table This parameter allows the users assigned to this Security Group to write or modify the information in the specified View Table This value does not need to be unique In the Notify View Name field enter a value that you configured with the View Name parameter in the SNMPv
11. Name Description ALL All modules ACL Port access control lists CFG Switch configuration file CLASSIFIER Classifiers used by ACL and QoS CLI Command line interface commands DOS Denial of Service defense ENCO Encryption keys ESTACK Enhanced stacking EVTLOG Event log FILE File system GARP GARP VLAN Registration Protocol HTTP Web server IGMPSNOOP IGMP snooping 141 Chapter 11 Event Logs and Syslog Servers 142 Table 2 AT S63 Software Modules Continued Name Description IP IP configuration LACP Link Aggregation Control Protocol MAC MAC address table MGMTACL Management access control list MLDSNOOP MLD snooping PACCESS 802 1X Port based Access Control PCFG Port configuration PKI Public Key Infrastructure PMIRR Port mirroring PSEC MAC address based port security PTRUNK Static port trunking QOS Quality of Service RADIUS RADIUS authentication protocol RPS Redundant power supply RRP RRP Snooping RTC Real time clock SNMP Simple Network Management Protocol SSH Secure Shell protocol SSL Secure Sockets Layer protocol STP Spanning Tree Rapid Spanning Tree and Multiple Spanning Tree protocols SYSTEM Hardware status Manager and Operator log in and log off events TACACS TACACS authentication protocol TELNET TELNET TFTP Trivial File Transfer Protocol TIME System Time and SNT
12. O flash boot cfg Archive O chash boot cfg Archive Figure 34 File System Tab Configuration 124 Section II Advanced Operations Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide The information in the tab is defined below Current Drives Specifies the location of the files displayed in the Current Files section of the tab The Flash option represents the switch s flash memory This is the default selection The Flash Card option only appears for those AT 9400 Series switch that feature a flash card slot Default Configuration File Specifies the filename of the active configuration file The switch uses this file to configure its operating parameters when reset or power cycled The switch also updates the active boot file when you select the Save Config option The columns in the List Files table are described below This information is for viewing purposes only If your unit has a compact flash card slot the switch by default displays the files in flash memory To view the files on a card go to step 4 File Name Name of the system file Device The device type either flash for flash memory or cflash for compact flash card Size Size of the file in bytes Modified The time the file was created or last modified in the following date and time format month day year hours minutes seconds Attributes The file type one of the following
13. The port parameters can be divided into two groups generic parameters and MSTI specific parameters A generic port parameter is set just once on a port and applies to all of a port s MSTIs assignments Generic parameters are O External path cost Section IV Spanning Tree Protocols Section IV Spanning Tree Protocols AT S63 Management Software Web Browser Interface User s Guide 0 Point to point port o Edge port An MSTI specific parameter can be set on a per MSTI basis This means that you can assign a different value to a MSTI specific parameter for each spanning tree instance where a port is a member These parameters are o Internal path cost o Port priority When setting an MSTI specific parameter use the MSTI List in the window to select the intended MSTI It should be noted that the MSTI List shows all of the spanning tree instances on the switch and not just those where the selected port is currently a member If you select an MSTI where the port is not a member you can pre configure the parameter in the event you later add the port as a member of the MSTI through a VLAN assignment Port Priority This parameter is used as a tie breaker when two or more ports are determined to have equal costs to the regional root bridge The range is O to 240 in increments of 16 The default value is 8 priority value is 128 For a list of the increments refer to Table 7 Port Priority Value Increments on page
14. Entry You can create delete and modify an SNMPv3 Target Parameters Table entry See the following procedures o Creating a Target Address Table Entry on page 258 o Deleting a Target Address Table Entry on page 261 0 Modifying Target Address Table Entry on page 262 For reference information about the SNMPv3 Target Parameters Table see Chapter 21 SNMPv3 in the AT S63 Management Software Menus Interface User s Guide To create an entry in the SNMPv3 Target Parameters Table perform the following procedure 1 From the home page select Configuration The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 2 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 3 In the SNMPv3 section click the button next to Configure Target Parameters Table and then click Configure at the bottom of the tab The SNMPv3 Target Parameters Table tab is shown in Figure 98 AT 9424T SP SNMPv3 Target Parameters Table Total Entries 3 Page lof 1 Security Security Security Storage Row Model Name Level Type Status Message Params Name Processing Model snmpv3manager120 v3 v3 hoa AuthNoPriv NonVolatile Active Mgmt Protocols O snmpv3manager220 v3 v3 luke AuthPriy NonVolatile Active O snmpv3manager330 v3 v3 chitra AuthPriv NonVolatile Active Figure 98 SNMPv3 Target Parameters Table Tab
15. To permanently save your changes select the Save Config option in the Configuration menu 175 Chapter 14 Class of Service Mapping CoS Priorities to Egress Queues This procedure explains how to change the default mappings of CoS priorities to egress priority queues To change the mappings perform the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the Services option 3 Select the Queuing amp Scheduling tab The Queuing amp Scheduling tab is shown in Figure 56 AT 9424T SP Queuing amp Scheduling Configure CoS Priority to Egress Queues CoS 0 to PQ CoS 1to PQ Q1 QoS PriorityQ 1 v Q0 QoS PriorityQ 0 CoS 2to PQ CoS 3to PO EMS PriorityQ 2 la Q3 QoS PriorityQ 3 v CoS 4to PO E Q4 QoS PriorityQ 4 CoS 6to PA es Q6 QoS Priority 6 M Cos 5to PO Op QoS PriorityO 5 x CoS 7 to PQ Q7 QoS PriorityO 7 v Configure Egress Weights Select Schedule Strict Priority Weighted Priority Queue 0 Weight Weighted D 0 15 Queue 1 Weight Weighted 0 0 15 Queue 2 Weight Weighted 0 0 15 Queue 3 Weight Weighted 0 0 15 Queue 4 Weight Weighted 0 0 15 Queue 5 Weight Weighted 0 0 15 Queue 6 Weight Weighted a 0 15 Queue 7 Weight Weighted 0 0 15 Figure 56 Queuing amp Scheduling Tab Configuration Note The Configure Egress Weights section in the tab is explained i
16. Very Anxious Passive Member Apn Anxious Passive Member Qpn Quiet Passive Member Van Very Anxious Active Member Aan Anxious Active Member Qan Quiet Active Member Lan Leaving Active Member The initialized state for the Applicant is Vo 357 Chapter 22 GARP VLAN Registration Protocol 358 Table 12 GVRP State Machine Parameters Continued Parameter Meaning Reg Registrar state machine for the GID index on that particular port One of Mt Empty Lv3 Leaving substate 3 final Leaving substate Lv2 Leaving substate 2 Lv1 Leaving substate 1 Lv Leaving substate initial Leaving substate In In Fix Registration Fixed For Registration Forbidden The initialized state for the Registrar is Mt Section V Virtual LANs AT S63 Management Software Web Browser Interface User s Guide Displaying the GVRP Counters Section V Virtual LANs To display the GVRP counters perform the following procedure 1 2 From the Home page select Monitoring From the Monitoring menu select the Layer 2 option Select the GVRP tab The GVRP tab is shown in Figure 138 on page 353 In the View GVRP Parameters section click View GVRP Counters Click View The GVRP Counters page is shown in Figure 142 Receive Transmit Total GARP Packets Total GARP Packets Invalid
17. m m Returning the switch to its default parameter settings deletes all routing interfaces and port based and tagged VLANs on the switch Returning the switch to its default parameter settings does not delete files from the switch s file system or encryption keys from the key database For instructions on how to delete files refer to the AT S63 Management Software Menus Interface User s Guide or the AT S63 Management Software Command Line Interface User s Guide The speed of the Terminal Port on the switch is not changed Returning a switch to its default values does not alter the contents of the active boot configuration file To reset the file to the default settings you must establish a local or remote management session with the switch after it reboots and select Save Config from the menu Otherwise the switch reverts back to the previous configuration the next time you reset or power cycle the unit If the switch is an isolated switch e a switch that is not a part of an enhanced stack or the master switch of an enhanced stack it is unlikely you will be able to reestablish your web browser management session at the completion of this procedure because all routing interfaces are deleted You must use a local management session to continue managing the switch A Caution This procedure involves a switch reset Some network traffic may be lost while the unit initializes its management software and loads the def
18. Administrator and Comments parameters in the Administration section of the tab The parameters in the IP Configuration section are described in Displaying the IP Address of the Local Interface on page 55 The Passwords section is described in Changing the Manager and Operator Passwords on page 46 The Reset button at the bottom of the tab resets the switch and is explained in Rebooting a Switch on page 51 2 Configure the following parameters as necessary System Name This parameter specifies a name for the switch for example Sales Ethernet switch The name is displayed at the top of the AT S63 management pages and tabs The name can be from 1 to 39 characters The name can include spaces and special characters such as exclamation points and asterisks The default is no name This parameter is optional Administrator This parameter specifies the name of the network administrator responsible for managing the switch The name can be from 1 to 20 characters It can include spaces and special characters such as dashes and asterisks The default is no name This parameter is optional Comments This parameter specifies the location of the switch for example 4th Floor rm 402B The location can be from 1 to 20 characters The location can include spaces and special characters such as dashes and asterisks The default is no location This parameter is optional 3 Click Apply to activate your changes on the s
19. Bridge Forwarding 4 30 15 System Name Marketing MAC Addr 00 30 84 4B EF CD Bridge Max Age 6 40 20 Bridge Identifier 00 21 46 A7 84 43 Root Bridge 00 21 46 A7 B4 43 Root Priority 32768 Section IV Spanning Tree Protocols Figure 114 Configure STP Parameters Tab Configuration Note The Defaults button returns all STP settings to the default settings Configure the following parameters as necessary Bridge Priority The priority number for the bridge This number is used in determining the root bridge for STP The bridge with the lowest priority number is selected as the root bridge If two or more bridges have the same priority value the bridge with the numerically lowest MAC address becomes the root bridge When a root bridge goes off line the bridge with the next priority number automatically takes over as the root bridge This parameter can be from 0 zero to 61 440 in increments of 4096 with 0 being the highest priority For a list of the increments refer to Table 6 295 Chapter 19 Spanning Tree and Rapid Spanning Tree Protocols 296 Table 6 Bridge Priority Value Increments Increment EC Increment GE 0 0 8 32768 1 4096 9 36864 2 8192 10 40960 3 12288 11 45056 4 16384 12 49152 5 20480 13 53248 6 24576 14 57344 7 28672 15 61440 Bridge Hello Time The time interval between generating and sendi
20. Configuration 265 Chapter 18 SNMPv3 266 4 Click Add The Add New SNMPv3 Target Parameter page is shown in Figure 99 Target Parameters Name snmpv3manager50 Message Processing Model tv Ei Security Model Ju wi Security Name debashi Security Level Privacy Storage Type H Volatile Row Status Active 5 Figure 99 Add New SNMPv3 Target Parameters Page In the Target Parameters Name field enter a name of the SNMP manager or host Enter a value of up to 32 alphanumeric characters Note Enter a value for the Message Processing Model parameter only if you select SNMPv1 or SNMPv2c as the Security Model If you select the SNMPv3 protocol as the Security Model then the Message Processing Model is automatically assigned to SNMPv3 In the Message Processing Model field enter a Security Model that is used to process messages Select one of the following SNMP protocols v1 Select this value to process messages with the SNMPv_1 protocol v2c Select this value to process messages with the SNMPv2c protocol v3 Select this value to process messages with the SNMPv3 protocol In the Security Model field select one of the following SNMP protocols as the Security Model for this Security Name or User Name Section Ill SNMPv3 Section Ill SNMPv3 AT S63 Management Software Web Browser Interface User s Guide v1 Select this value to associate the Security Name
21. Enabling or Disabling a Spanning Tree Protocol To enable or disable spanning tree on the switch or to select the active spanning tree protocol perform the following procedure 1 From the Home page select Configuration 2 From the Configuration menu select the Layer 2 option 3 Select the Spanning Tree tab The Spanning Tree tab is shown in Figure 113 System Name Marketing MAC Addr 00 30 84 4B EF CD C Home Spanning system Ka Active Protocol Version i C Enable Spanning Tree Cem rste O MSTP C Mutat e Configure Spanning Tree Parameters Configure Figure 113 Spanning Tree Tab Configuration 4 To select a spanning tree version from the Active Protocol Version parameter click STP RSTP or MSTP The default is RSTP Note Only one spanning tree protocol can be active on the switch at a time 5 To enable or disable spanning tree click the Enable Spanning Tree check box A check indicates that the feature is enabled while no check indicates that the feature is disabled The default is disabled 6 Click Apply A change to the status of the spanning tree protocol is immediately implemented on the switch 292 Section IV Spanning Tree Protocols AT S63 Management Software Web Browser Interface User s Guide 7 To permanently save your changes select the Save Config option in the Configuration menu 8 If you activated STP go to Configuring STP on page 294 I
22. From the Security Mode pull down menu select the desired port security level for the port Options are Automatic Disables MAC address based port security on a port This is the default setting Limited Allows you to specify a maximum number of dynamic source MAC addresses a port can learn After learning its maximum number of addresses a port discards all ingress frames with source MAC addresses not already learned When the Limited security mode is initially activated on a port all dynamic MAC addresses learned by the port are deleted from the MAC address table The port then begins to learn new addresses up to the maximum allowed After the port has learned its maximum number of addresses it does not learn any new addresses even when end nodes are inactive A dynamic MAC address learned on a port operating in the Limited security mode never times out from the MAC address table even when the corresponding end node is inactive Static MAC addresses are retained by the port and are not included in the count of maximum dynamic addresses You can continue to add static MAC addresses to a port operating with this security level even after the port has already learned its maximum number of dynamic MAC addresses A switch port can have up to 255 dynamic and static MAC addresses Secured Instructs a port to forward frames using only static MAC addresses The port does not learn any dynamic MAC addresses and deletes any dynamic a
23. From the home page select Configuration From the Configuration menu select the Utilities option Select the File System tab The File System tab for an AT 9400 series switch with a compact flash card is shown in Figure 34 on page 124 In the Default Configuration File field enter the name of the file to be the new active configuration file When entering the file name note the following 127 Chapter 9 File System 128 o Be sure to include the cfg extension o Precede the name with cflash if the file is stored on a flash card in the switch 5 Click Apply The switch searches the file system or flash memory card for the file If it finds the file it displays the file name in the Default Configuration File field along with the word Exists The file is now the active boot configuration file on the switch If the switch can not locate the file it displays the name of the previous boot configuration file Repeat steps 4 and 5 being sure to enter the name correctly 6 Do one of the following O To configure the switch using the parameter settings in this boot configuration file do not select Save Config Instead reset or power cycle the switch O To overwrite the settings in the configuration file with the switch s current operating settings select Save Config Section Il Advanced Operations Chapter 10 File Downloads and Uploads Section Il Advanced Operations This chapt
24. Gonniguning Porn SECUN EE 366 Displaying Port Security LOVelS roaren iaae E EEEE AA AENEA RE 369 Chapter 24 802 1x Port based Network Access Control ccccccccceeeeeeeececeeceeeeeeeeeeeeeeeeeecseeninaeeees 371 Setting Port Roleeg onenian iiti nA i AE AA ENEE EE ANAVE A A A O AE A aa aA 372 Enabling or Disabling 802 1x Port based Network Access Control 374 Configuring Authenticator Port Parameters sssssseessessirssstttrtstttttttttttt ttnt ttnt Atat t EEEn S EEEE ESAE EE EAn at nn Enn stnn nn narenn 375 Configuring Supplicant Port Parameters A 381 Displaying the Port based Network Access Control Parameters ccccceeeeeseeeeeeeeeneeeeeeeeneeeeeeeenaeeeeeeenaas 383 Displaying el LTC 383 Displaying the Port Settings s34 Aakers nia dk Ae ee et 385 EELER 387 Configuring RADIUS ACCOUNTING esci aa R AEE A AEAEE DAAA RANT EEEIEE 387 Displaying the RADIUS Accounting Settings 000 0 eeeeeeee ersten reese enna eee ee eaeeeeeeeaeeeeeesiceeeeeetiaeeeeeeas 388 Section VII Management Security cccccccsssssccssssssccsssssccsscssssesesssssesssssseseses SOO Chapter 25 Encryption Keys PKI and SSL cccccccccceceececeeenee cece cece cence eee e eee eaeaaeeeeeeeeeeeeeeeeeeenenaeees 391 Displaying the Encryption Keys cccccsccceeeecceceeeeeecneeeeeeseaaeaeeeseeaaeeeeesaeaaesensaeaaaeseeeaeaaaeeeseeaeaeeseeeaaeeeneeeeaea 392 Displaying the PKI Settings and Certificates A 394 Displaying
25. IP traffic 2 244 22 subnet 1 ARP traffic 0 Dst 244 25 traffic 1 VID 12 traffic 1 3 1 2 1 0 1 1 154 Figure 44 Classifier Tab Configuration The tab lists the current classifiers on the switch The columns are defined here ID The ID number of the classifier Description A description of the classifier No of References The number of active and inactive ACLs and QoS policies where the classifier is currently assigned An active ACL or QoS is assigned to at least one switch port while an inactive ACL or QoS policy is not assigned to any port If this column is O zero the classifier is not assigned to any ACLs or policies active or inactive Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide No of Active Associations The number of active ACLs and QoS policies where the classifier is currently assigned An active ACL or QoS policy is assigned to at least one port 4 Click Create The Create Classifier page is shown in Figure 45 Description 1 9999 Destination MAC Source MAC Ethernet Format Any zl Priority 0 7 1 4094 Protocol User Specified Protocol User Specified ze Figure 45 Create Classifier Page Section Il Advanced Operations 155 Chapter 12 Classifiers Some of the variables and settings display additional selections For example selecting IP as the Protocol displays the selections shown in
26. In the Configure CIST Parameters section set the CIST Priority the priority number for the bridge This number is used to determine the root bridge of the bridged network This number is analogous to the RSTP bridge priority value The bridge in the network with the lowest priority number is selected as the root bridge If two or more bridges have the same bridge or CIST priority values the bridge with the numerically lowest MAC address becomes the root bridge Click Apply To permanently save your changes select the Save Config option in the Configuration menu 317 Chapter 20 Multiple Spanning Tree Protocol Managing MSTIs This section contains the following procedures a Creating an MSTI on page 318 0 Modifying an MSTI on page 319 o Deleting an MSTI on page 320 Creating an To create an MSTI perform the following procedure MSL 1 From the home page select Configuration 2 From the Configuration menu select the Layer 2 option 3 Select the Spanning Tree tab The Spanning Tree tab is shown in Figure 113 on page 292 4 Click Configure The expanded MSTP Spanning Tree tab is shown in Figure 125 on page 315 5 In the CIST MSTI Table section of the tab click Add The Add New MSTI page is shown in Figure 126 MSTI ID Priority 8 4096 32768 VLAN List D Figure 126 Add New MSTI Page 6 Inthe MSTI ID field enter an ID number for the MSTI The range is 1 to
27. Services Figure 54 CoS Tab Configuration 3 Select the ports whose CoS settings are to be configured and click Modify 174 Section II Advanced Operations Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide The CoS Setting for Port page is shown in Figure 55 Override Priority No No Priority Level 0 Override Priority Figure 55 CoS Setting for Port Page Use the Priority list to select a new Class of Service priority level for the port The default is level 0 The new priority level will apply to all ingress untagged packets If you perform Step 5 and override the priority level in tagged packets the new priority level will also apply to all ingress tagged packets If you are configuring a tagged port and you want the port to ignore the priority tag in the packets click the Override Priority option A check in the box indicates this feature is activated All tagged packets are directed to the egress queue specified in Step 4 Note The switch does not change the tagged information in a tagged packet A tagged packet exits the switch with the same priority level that it had when it entered The default for this parameter is No meaning that the priority level of a tagged packet is determined by the tagged information in the packet itself Click Apply Configuration changes are immediately activated on the switch
28. The Classifier tab is shown in Figure 44 on page 154 Click the button next to the classifier to be deleted and click Delete Only one classifier can be deleted at a time The classifier is deleted from the switch To permanently save your changes select the Save Config option in the Configuration menu Section II Advanced Operations AT S63 Management Software Web Browser Interface User s Guide Displaying the Classifiers To display the classifiers perform the following procedure 1 From the Home page select Monitoring 2 From the Configuration menu select the Network Security or Services option The Classifier tab is accessible from both menu selections 3 Select the Classifiers tab The Classifiers tab is shown in Figure 48 Classifier No of Description No of Active References Se Associations Product Svr MAC add d 3 Priority 6 traffic d 4 IP traffic 2 2 Services 244 22 subnet 1 1 ARP traffic 0 0 Dst 244 25 traffic 1 1 1 1 VID 12 traffic Figure 48 Classifier Tab Monitoring The Classifier tab displays a table of the currently configured classifiers that contains the following columns of information ID The ID number of the classifier Description A description of the classifier No of References The number of active and inactive ACLs and QoS policies to which the classifier is currently assigned An active ACL or QoS is assigned to at least one switc
29. The management software creates the new flow group Section Il Advanced Operations Modifying a Flow Group Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide 7 To permanently save your changes select the Save Config option in the Configuration menu This procedure explains how to modify a flow group If the flow group is already part of a QoS policy assigned to one or more switch ports you must modify the policy by removing the port assignments before you can modify the flow group You can reassign the ports back to the policy after modifying the flow group To modify a flow group perform the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the Services option 3 Select the Flow Group tab The Flow Group tab is shown in Figure 60 on page 184 4 Click the dialog circle next to the flow group to be modified and click Modify You can modify only one flow group at a time The Modify Flow Group page is displayed as shown in Figure 62 Description Sem 2 DScP Priority 802 1p oeg E Remark Priority NO ze ToS Move ToS To Priority 0 7 NO Move Priority To ToS Classifier List NO e Figure 62 Modify Flow Group Page 5 Modify the parameters as necessary For definitions refer to Configuring a Flow Group on page 184 6 Click Apply 187 Chapter 15 Quality of Service T
30. The time interval between generating and sending configuration messages by the bridge This parameter can be from 1 to 10 seconds The default is 2 seconds This value is active only if the bridge is selected as the root bridge of the network Bridge Forwarding The waiting period before a bridge changes to a new state for example becomes the new root bridge after the topology changes If the bridge transitions too soon not all of the links may have adapted to the change possibly resulting in a network loop The range is from 4 to 30 seconds The default is 15 seconds This setting applies only to ports running in the STP compatible mode Configuration Name The name of the MSTP region The range is O zero to 32 alphanumeric characters in length The name which is case sensitive must be the same on all bridges in a region Examples of a configuration name include Sales Region and Production Region Bridge Max Age The length of time after which stored bridge protocol data units BPDUs are deleted by the bridge This parameter applies only if the bridged network contains an STP or RSTP single instance spanning tree Otherwise the bridges use the Max Hop counter to delete BPDUs All bridges in a single instance bridged LAN use this aging time to test the age of stored configuration messages called bridge protocol data units BPDUs For example if you use the default of 20 all bridges delete current configuration messages after 20
31. and Auto Detect Version Whether the port is operating in MSTP mode or STP compatible mode Internal Port Cost The port cost when the port is connected to a bridge in the same MSTP region 8 Click OK to close the page 330 Section IV Spanning Tree Protocols AT S63 Management Software Web Browser Interface User s Guide Resetting MSTP to the Default Settings Section IV Spanning Tree Protocols To reset MSTP to the factory default settings perform the following procedure 1 2 From the home page select Configuration From the Configuration menu select the Layer 2 option Select the Spanning Tree tab The Spanning Tree tab is shown in Figure 124 on page 312 Click Configure The expanded MSTP Spanning Tree tab is shown in Figure 125 on page 315 Click Defaults The MSTP settings are returned to their default values To permanently save your changes select the Save Config option in the Configuration menu 331 Chapter 20 Multiple Spanning Tree Protocol 332 Section IV Spanning Tree Protocols Section V Virtual LANs The chapters in this section provide information and procedures for basic switch setup using the AT S63 management software The chapters include O Chapter 21 Port based and Tagged VLANs on page 335 o Chapter 22 GARP VLAN Registration Protocol on page 349 Section V VLANs 333 334 Section V VLANs Chapter 21 Port based and Tagged VLANs Thi
32. click the Apply buttons If you enabled the SNTP client the switch immediately polls the SNTP or NTP server for the current date and time The switch automatically polls the server whenever a change is made to any of the parameters in this menu so long as SNTP is enabled To permanently save your changes click Save Config Section l Basic Operations AT S63 Management Software Web Browser Interface User s Guide Rebooting a Switch Note All unsaved parameters changes are discarded when a system is reset To save your parameter changes refer to Saving Your Parameter Changes on page 37 To reboot a switch perform the following procedure 1 From the home page select Configuration The System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 2 Click Reset at the bottom of the tab A confirmation prompt is displayed 3 Click OK to reset the switch or Cancel to cancel the procedure Note The switch does not forward packets while it initializes the AT S63 management software and loads its active configuration file This process takes between 20 seconds to 2 minutes to complete depending on the number and types of commands in the configuration file Resetting the switch ends your web browser management session You must restart the session to continue managing the switch Section Basic Operations 51 Chapter 2 Basic Switch Parameters Pinging a
33. o Normal Read Only Hidden System Volume Directory Archive WS WS WS WS US a Invalid To view the files on a compact flash card insert the card into the slot on the switch select Compact Flash under Current Drivers and click Apply 125 Chapter 9 File System 5 To view the contents of a file such as a configuration file click the file in the Current Files section of the tab and click View You can view one file at a time The contents of the configuration file are displayed in the Viewing File page An example is shown in Figure 35 ewech i File Information Name boot cfg Device flash Last Modified 01 20 2005 at 13 44 42 Attributes Archive File Data System Configuration set system name Marketing set system contact Ralph 1 2 3 4 5 6 7 8 9 IP Configuration KE Figure 35 Viewing File Page 126 Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide Selecting an Active Boot Configuration File Section Il Advanced Operations This procedure changes the active boot configuration file on the switch The switch uses the active boot configuration file to configure its operating parameters whenever it is reset or power cycled The switch also updates the active boot file whenever you select the Save Config option Note the following before performing this procedure o You cannot create a ne
34. select one of the following storage types for this table entry Volatile Select this storage type if you do not want the ability to save an entry in the SecurityToGroup Table After making changes to a SecurityToGroup Table entry with a Volatile storage type the Save Config option is not displayed on the Configuration menu NonvVolatile Select this storage type if you want the ability to save an entry in the SecurityToGroup Table After making changes to a SecurityToGroup Table entry with a NonVolatile storage type the Save Config option is displayed on the Configuration menu Allied Telesyn recommends this storage type 251 Chapter 18 SNMPv3 Note The Row Status parameter is a read only field in the web browser interface The Active value indicates the SNMPv3 SecurityToGroup Table entry takes effect immediately 7 Click Apply to update the SNMPv3 SecurityToGroup Table 8 To permanently save your changes select the Save Config option in the Configuration menu 252 Section Ill SNMPv3 AT S63 Management Software Web Browser Interface User s Guide Configuring the SNMPv3 Notify Table Creating a Notify Table Entry Section Ill SNMPv3 You can create delete and modify an SNMPv3 Notify Table entry See the following procedures o Creating a Notify Table Entry on page 253 0 Deleting a Notify Table Entry on page 255 a Modifying a Notify Table Entry on page 256 For reference inform
35. which sets port cost depending on the speed of the port Default values are 2 000 000 for 10 Mbps ports 200 000 for a 100 Mbps ports and 20 000 for one gigabit ports Enable Migration Check This parameter is displayed only when RSTP is enabled This parameter resets an RSTP port allowing it to send RSTP BPDUs When an RSTP bridge receives STP BPDUs on an RSTP port the port transmits STP BPDUs The RSTP port continues to transmit STP BPDUs indefinitely Type C to reset the MSTP port to transmit RSTP BPDUs Section IV Spanning Tree Protocols 305 Chapter 19 Spanning Tree and Rapid Spanning Tree Protocols Displaying RSTP 306 Settings Point to Point This parameter defines whether the port is functioning as a point to point port The possible settings are Yes No and Auto Detect For an explanation of this parameter refer to Point to Point and Edge Ports in Chapter 22 Spanning Tree and Rapid Spanning Tree Protocols in the AT S63 Management Software Menus Interface User s Guide Edge Port This parameter defines whether the port is functioning as an edge port The possible settings are Yes and No For an explanation of this parameter refer to Point to Point and Edge Ports in Chapter 22 Spanning Tree and Rapid Spanning Tree Protocols in the AT S63 Management Software Menus Interface User s Guide After you have configured the parameters click Apply To permanently save your changes select t
36. 23 Security Name jenny Transport Tag swengtag Storage Type H NonVolatile M Row Status Active Figure 103 Modify SNMPv3 Community Page In the Community Name field enter a Community Name of up to 64 alphanumeric characters The value of the Community Name parameter acts as a password for the SNMPv3 Community Table entry This parameter is case sensitive Note Allied Telesyn recommends that you select SNMP Community Names carefully to ensure these names are known only to authorized personnel In the Security Name field enter a name of an SNMPv1 and SNMPv2c user This name must be unique Enter a value of up to 32 alphanumeric characters Section Ill SNMPv3 AT S63 Management Software Web Browser Interface User s Guide Note Do not use a value configured with the User Name parameter in the SNMPv3 User Table 7 Inthe Transport Tag field enter a name of up to 32 alphanumeric characters The Transport Tag parameter links an SNMPv3 Community Table entry with an SNMPv3 Target Address Table entry Add the value you configure for the Transport Tag parameter to the Tag List parameter in the Target Address Table as desired See Creating a Target Address Table Entry on page 258 8 Inthe Storage Type field select one of the following storage types for this table entry Volatile Select this storage type if you do not want the ability to save an entry in the SNMPv3 Community T
37. 256 The default is 100 Port Participating Applies only when the intrusion action is set to trap or disable This option does not apply when intrusion action is set to discard If this option is set to No when intrusion action is set to trap or disable the port discards invalid packets but it does not send the SNMP trap or disable the port If you want the switch to send a trap and or disable the port you must sent this option to Yes Click Apply TO permanently save your changes select the Save Config option in the Configuration menu Section VI Port Security AT S63 Management Software Web Browser Interface User s Guide Displaying Port Security Levels To display the MAC address based security level of a port perform the following procedure 1 From the Home page select Monitoring 2 From the Monitoring menu select Network Security The Network Security page is displayed with the Port Security tab selected by default as shown in Figure 146 Network Security Section VI Port Security Figure 146 Port Security Tab Monitoring 3 Click the port whose port security level is to be displayed A selected port turns white You can select more than one port at a time 4 Click View The Security for Port s page is shown in Figure 147 Total Ports Selected 3 Page lof 1 Security Mode Intruder Action Participating MAC Limit 2 Limited Send Trap Only Yes 10 3 Limited Send Trap Only Y
38. 802 3 1518 bytes including the CRC received on the port Fragments Number of undersized frames frames with alignment errors and frames with frame check sequence FCS errors CRC errors received on the port TXCollisions Number of transmit collisions Section l Basic Operations AT S63 Management Software Web Browser Interface User s Guide 5 To clear all the counters for the port click Clear To clear the counters for all ports on the switch click Clear All The Clear and Clear All buttons are only available when you log on as a manager They are not available when you log on as an operator Section I Basic Operations 91 Chapter 5 Port Parameters Resetting a Port to the Default Settings 92 To reset a port to the default settings perform the following procedure 1 2 From the Home page select Configuration From the Configuration menu select the Layer 1 option The Layer 1 page is displayed with the Port Settings tab selected by default as shown in Figure 18 on page 80 In the switch image click a port to be returned to the default settings The selected port turns white You can reset more than one port at a time To deselect a port click it again Click Modify To configure all of the ports click Modify All The Port Configuration page is displayed as shown Figure 19 on page 81 Click Defaults The port s are returned to the default settings Section l Basic Operations C
39. Adresses 100 Changing the AGING UE 101 Chapter 7 Static Port Trunks sdn ee ENEE hs ated Paina EN eee Sne 103 Creating a Static Port Trunks icc cecccecceeeicceccees cacececceeeecedden eueuecedel euesceccbeusdesdcei vase dele ebadeeseteesdadeacyensstadeheeuecness 104 Modifying a Static Port Trunk aieia epaia a aea N Se aE A A e E E T 108 Deleting a Port DEE 110 Displaying the Port Trunks ainail at iae atai ra Tra eae ARA TAEI AEAEE AT A AE T EE LTES A TE 111 Chapter 8 Port Mirroring ooe oaeiae an a EEEE AEE AREA rec ds eee TEA Se ege 113 Gredipd a Port MINO ET TE 114 Modig SPor a e TEE 117 Disablingva Port MINO ai a de ae EEN Ed dee aula eek de ae ode 118 Porting a Port Minton eis See ee E 119 Displayingithe Port Mirror draperii E Edge EES Ale 120 Section It Advanced Operations ics cccsccscccsccssccsccsesccancsssescsessccocassssnsasccdsasessseucsseses 21 Chapter 9 File System Eed ledeee necvds oeaediceesnuhdedeveens dicevds esuidbeedssuiuedves ety lideudssnuece aver eubue 123 Listing the Files in Flash Memory or on a Compact Flash Card o cccccccesctceceeeeeeeeeeeeeeeeneeeeeetieeeeeeenieeeeeees 124 Selecting an Active Boot Configuration File 127 Chapter 10 File Downloads and Uploads 129 Downloading a Elena eene EE dee ege 130 uploading a WC 134 Chapter 11 Event Logs and Syslog Servers 00 cccccceceeeeeceeenee erect eee ee eeeeaeeeeeeeaeeeeeeeeneeeeseeenaeeeeeseaaes 137 Working with the Event LOS 00
40. Configuration From the Configuration menu select the Mgmt Protocols option Select the SNMP tab The SNMP tab is shown in Figure 13 on page 70 In the SNMPv1 amp SNMPv2c section click Configure The SNMPv1 amp SNMPv2c Communities tab is shown in Figure 14 on page 72 Click the button next to the community name to be modified and click Modify You can modify only one community string at a time The settings of the selected SNMP community string are displayed in the Modify SNMPv1 amp SNMPv2c Community page Modify the parameters as needed For parameter definitions refer to Creating a New SNMPv1 and SNMPv2c Community on page 72 You cannot change the community name of a string Click Apply The modifications are activated on the community string To permanently save the changes select the Save Config menu option 75 Chapter 4 SNMPv1 and SNMPv2c Deleting an SNMPv1 and SNMPv2c Community 76 To delete an SNMPv1 and SNMPv2c community perform the following procedure 1 2 From the Home page select Configuration From the Configuration menu select the Mgmt Protocols option Select the SNMP tab The SNMP tab is shown in Figure 13 on page 70 In the SNMPv1 amp SNMPv2c section click Configure The SNMPv1 amp SNMPv2c Communities tab is shown in Figure 14 on page 72 Click the button next to the community name to delete and click Remove You can delete only one community string at a tim
41. Configured and Actual untagged ports of a VLAN will always be the same If you are using 802 1x and you assigned a Guest VLAN to an authenticator port or you associated an 802 1x supplicant to a VLAN on the authentication server a port can be in different VLAN than the virtual LAN where it was originally assigned as an untagged port In these situations the Configured and Actual port lists can differ with the Actual list detailing the ports that are currently functioning as untagged ports of the VLAN For example if a port is listed as a Configured member of a VLAN but not as an Actual member that would mean either the port is currently a part of a Guest VLAN or the supplicant who logged on the port was associated with a VLAN assignment on the authentication server 4 To display the groups of a protected ports VLAN click the circle next to the VLAN and click View The View Protected VLAN page is shown in Figure 135 Tei OOOO VLAN Details VID Name 2 Marketing Type Protocol Protected None Untagged Ports Tagged Ports 15 19 22 16 18 Uplink Ports Protected VLAN Groups Group Number P 22 15 21 Port List Figure 135 View Protected VLAN Page The VLAN Details section displays the following information VID The VLAN ID Type The VLAN type which is always Protected 347 Chapter 21 Port based and Tagged VLANs Untagged Ports The untagged ports members of the
42. Destination IP address Layer 3 111 Chapter 7 Static Port Trunks 112 SI DI Source IP address destination IP address Layer 3 Ports The ports of the trunk Section Basic Operations Chapter 8 Port Mirroring This chapter contains the procedures for managing the port mirroring feature The sections in the chapter include Creating a Port Mirror on page 114 Modifying a Port Mirror on page 117 Disabling a Port Mirror on page 118 Deleting a Port Mirror on page 119 WS WS WS gn Displaying the Port Mirror on page 120 Note For background information refer to Chapter 9 Port Mirroring in the AT S63 Management Software Menus Interface User s Guide Section Basic Features 113 Chapter 8 Port Mirroring Creating a Port Mirror To create a port mirror perform the following procedure 1 2 From the home page select Configuration From the Configuration menu select the Layer 1 option Select the Port Mirroring tab The Port Mirroring tab is shown in Figure 30 114 Total Mirrors 1 Page 1of1 Mirror to Port 14 7 8 Enabled Ingress Port s Egress Port s Status Figure 30 Port Mirroring Tab Configuration The tab displays a table with the following columns Mirror to Port Specifies the destination port of the mirrored traffic There can be only one destination port If this column contai
43. Figure 151 Supplicant Parameters Page occi keirin ee REE R EEEE EAA iE AARE EARE 381 Figure 152 802 1x Port Access Tab Monitoring ccccccececeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeaeeeeseeeeaeeeeeseeenaeees 383 Figure 153 Port Access Port Status Page en ireieir erot irie iepa aR EEI Tana RE IARAA REE ERN AAEREN EEEE 384 Figure 154 Authenticator Port Parameters Page 385 Figure 155 Supplicant Port Parameters Page cccccccceeceeeeeeeeeeeeeeeeeeeeeseeeeeeeeeseeeeeeeeeeeeeeeeeeseeaeeeeseeenaneees 386 Chapter 25 Encryption Keys PKI and SSL eccceccceeececeeeeeeeeeeeeee eee eeee eee sees eeeaeeaeeeseeseeeeseeeeeeeeesneaneneees 391 Figure 156 Keys Tab MOnitoring esseen necari a AAA a EA ai aa 392 Figure 157 PKI Tab Monitoring 394 Figure 158 X509 Certificate Details Page 395 Figure 159 SSL Tab MOnitoring he eiaeaen iaaa ierat aE T Ae rE EA aR AA AAAS aT iaaa aT ra lieia 397 Chapter 26 Secure Shell SSH cecescccseeseeeeeeeeneeeeeeeeeeeeseeneeeeeeseeeeeeeeeeeeuseeeeeseeueeeeeseeseeseeeeseseeseeesnensesenans 399 Figure 160 Secure Shell Tab Configuration 0 cccceeeceeeeeeeeeeeeeeeeeeeeeeeeeeeeeseneaeeeeseeeeeeeeeseeeeeeeeseeeeaaeeseeeaeeess 400 Figure 161 Secure Shell Tab MOnitoring rrrainis T A E TEA 402 Chapter 27 TACACS and RADIUS Protocols 2 0 0 2 cccccecceeeeeeeeeeeee eee eeee eee NEEN KEREN EEN 405 Figure 162 Server based Authentication Tab Confouraton 406 Figure 163 TACACS C
44. GARP Packets Discarded GARP Disabled GARP Disabled Port Not Listening Port Not Sending Invalid Port Invalid Protocol Invalid Format Database Full GARP Messages LeaveAll LeaveAll JoinEmpty JoinEmpty Joinin Joinin LeaveEmpty LeaveEmpty Leaveln Leaveln Empty Empty Bad Message Bad Attribute Figure 142 GVRP Counters Page The GVRP Counters page provides the information shown in Table 13 Table 13 GVRP Counters Parameter Meaning Receive Total GARP Total number of GARP PDUs received by this Packets GARP application 359 Chapter 22 GARP VLAN Registration Protocol 360 Table 13 GVRP Counters Continued Parameter Meaning Transmit Total GARP Packets Total number of GARP PDUs transmitted by this GARP application Receive Invalid GARP Packets Receive Discarded GARP Disabled Number of invalid GARP PDUs received by this GARP application Number of received GARP PDUs discarded because the GARP application was disabled Transmit Discarded GARP Disabled Number of GARP PDUs discarded because the GARP application was disabled This counter is incremented when ports are added to or deleted from the GARP application arising from port movements in the underlying VLAN or STP Receive Discarded Port Not Listening Number of GARP PDUs discarded because the port that received the PDUs was not listening that is MODE NONE was set on the port Trans
45. ID of the policy Description A description of the policy Section Il Advanced Operations Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide Active Whether this policy is active on the switch An active policy is assigned to one or more switch ports An inactive policy is not assigned to any switch ports Traffic Class List The traffic classes assigned to the policy Ingress Port List The ingress ports to which the policy is assigned Click Create The Create Policy page opens as shown in Figure 69 Description 0 255 Remark DSCP NONE ToS 0 7 Move Priority To ToS HO e Traffic Class List DSCP Value 0 63 Move ToS To Priority Wo Send To Mirror Port NO e Ingress Port List oA Egress Port Figure 69 Create Policy Page 5 Configure the following parameters as necessary ID Specifies an ID number for the policy Every policy on the switch must be assigned a unique number The range is 0 to 255 The default is 0 This parameter is required Description Specifies the policy description A description can be up to 15 alphanumeric characters including spaces 199 Chapter 15 Quality of Service 200 Remark DSCP Specifies whether the ingress DSCP value is overwritten Select one of the following options from the list None Disables this function All All packets are remarked DSCP Value Speci
46. O 1 test Yes O 23 No Services Figure 63 Flow Group Tab Monitoring The Flow Group tab displays the currently configured flow groups in a table that contains the following columns of information ID The ID number of the flow group Description The flow group description Active The active status of the flow group A flow group is deemed active if it is part of a policy assigned to a switch port A flow group is considered inactive if it is not assigned to any policies or if the policies have not been assigned to any ports Parent Traffic Class ID The traffic class where the flow group is assigned Classifier List The classifiers of the flow group 4 To display detailed information about a flow group select the flow group and click View The details of the flow group are displayed in the View Flow Group page For parameter definitions refer to Configuring a Flow Group on page 184 5 Click Close Section Il Advanced Operations 189 Chapter 15 Quality of Service Managing Traffic Classes 190 This section contains the following procedures Configuring a Traffic Class next Modifying a Traffic Class on page 194 Deleting a Traffic Class on page 196 m UU Displaying the Traffic Classes on page 196 Configuring a To configure a traffic class perform the following procedure Traffic Class 1 From the home page select Configuration 2 From the Conf
47. ON 202 Deleting all Flow Groups Traffic Classes and Policies cccccceeecceeceeeeeeeeeeeeeeceeeceeaaeceeeeeeeeeeneeeeeees 203 Displaying Mee 203 Chapter 16 Denial of Service Defense nnnnnnnenesesesseentttrttrstttttttttt ttt tn n Annn ettr EEE EEEE EnEn EESE EErEE Enn En eneen 205 Configuring Denial of Service Detense A 206 Displaying the DoS Settings aeranrcnin dirai iii a AAE A R A E aaa 209 Chapter 17 IGMP SnOO pling s s ea a A a a aa e aaa e aaa aaa a ai 211 Configuring Eege e e e DEE 212 Displaying a Listor Host Node Siriei ar EE eeh 215 Displaying a List of Multicast Routers ecos rere e E EAA Ea ERa ARAE AEAT AEAEE EIEEE EEEE TEEN 217 Section IMi SNMP y3 EE 29 Chapter 18 SNMPV3 EE 221 Configuring the SNMPv3 Protocol onicssietiesrs iaiia E E A 222 Enabling or Disabling SNMP Management 223 Configuring the SNMPv3 User Table 226 Creatingia User Table Ent deg g et esdegee cee dee ua ea aaa a SE 226 Deleting a User Table Entry 2 c ccccecccceceeeeedenceeeeeccaneeeedeadaneeeeecaaaeceeeeedaneceedeedaneceeededneceeeeddneceedeedeneeees 229 Modifying a User Table Emtm cc e e ea ere T aea A Der aae A A A EAr aAa pE T 230 Configuring the SNMPv3 View Table 234 Creating a View Table Entry eiiiai A AAAS i LAE AE e A L AE S E a 234 Deleting a View Table Entry EE 237 Modifying a View Table Ent 237 Configuring the SNMPv3 Access Table cccccecccceeeeeeeeeeeeeeeeeteeeeeeeeeseeeeeeeseneaeeeeseeeeaeee
48. Remote System This procedure instructs the switch to ping a node on your network This can be useful in determining whether an active path exists between the switch and another network device Note the following before performing this procedure Note The switch must have a routing interface on the local subnet from where it is pinging the end node The switch uses the IP address of the interface as its source address when pinging the device For background information on routing interfaces refer to the AT S63 Management Software Command Line Interface User s Guide To instruct the switch to ping a network device perform the following procedure 1 From the home page select Monitoring 2 From the Monitoring menu select the Utilities option 3 Select the Ping Client tab The Ping Client tab is shown in Figure 7 Ping Client IP Address Utilities Figure 7 Ping Client Tab Monitoring 4 Enter the IP address of the end node to be pinged by the switch 5 Click OK The results of the ping are displayed in a popup window 6 To stop the ping click OK 52 Section Basic Operations AT S63 Management Software Web Browser Interface User s Guide Returning the AT S63 Management Software to the Factory Default Values The procedure in this section returns all AT S63 management software parameters to their default values Note the following before performing this procedure
49. SHA1 Fingerprint Figure 158 X509 Certificate Details Page The X509 Certificate Details page provides the following information about the certificate Name The name of the certificate State Whether the certificate is Trusted or Untrusted 395 Chapter 25 Encryption Keys PKI and SSL 5 396 Manually Trusted Whether the certificate was manually trusted Type The type of the certificate The options are EE SELF and CA Source The source of the certificate The source for a self signed certificate created by the switch is COMMAND Version The version of X 509 that the certificate complies with Serial Number The certificate s serial number Signature Algorithm The algorithm used to sign the certificate Public Key Algorithm The algorithm of the public key certified by the certificate Not Valid Before The date the certificate became active Not Valid After The date the certificate expires Self signed certificates are valid for two years Subject The distinguished name of the subject of the certificate Issuer The distinguished name of the issuer of the certificate MD5 Fingerprint The MD5 algorithm This value provides a unique sequence for each certificate consisting of 16 bytes SHA1 Fingerprint The Secure Hash Algorithm This value provides a unique sequence for each certificate consisting of 20 bytes Click Close to close the page Section VII Management Security A
50. Security Name field enter a User Name that you previously configured with the SNMPv3 User Table See Creating a User Table Entry on page 226 In the Security Level field select one of the following Security Levels Note The value you configure for the Security Level must match the value configured for the User Name in the SNMPv3 User Table Menu See Creating a User Table Entry on page 226 No Authentication Privacy This option represents neither an authentication nor privacy protocol Section IIl SNMPv3 Section Ill SNMPv3 10 11 AT S63 Management Software Web Browser Interface User s Guide Select this security level if you do not want to authenticate SNMP entities and you do not want to encrypt messages using a privacy protocol This security level provides the least security Note If you have selected SNMPv1 or SNMPv2c as the Security Model you must select No Authentication Privacy as the Security Level Authentication This option represents authentication but no privacy protocol Select this security level if you want to authenticate SNMP users but you do not want to encrypt messages using a privacy protocol You can select this value if you configured the Security Model parameter with the SNMPv3 protocol Privacy This option represents authentication and the privacy protocol Select this security level to allow authentication and encryption This level provides the greatest level of
51. TACACS Client Settings To configure the TACACS client perform the following procedure 1 From the home page select Configuration 2 Select the Mgmt Protocols option The Mgmt Protocols tab is displayed with the Server based Authentication tab selected by default as shown in Figure 162 on page 406 In lower section of the Server based Authentication tab click TACACS Configuration and click Configure The TACACS Client Configuration page is shown in Figure 163 Global Secret Global Server Timeout 1 300 20 second s 1 0 0 0 0 2 0 0 0 0 3 0 0 0 0 Figure 163 TACACS Client Configuration Page 4 Configure the following parameters as necessary 408 Global Secret Specify the global secret If all of the TACACS servers have the same encryption secret you can enter the key here If the servers have different keys you must specify each key when you specify a server s IP address The maximum key length is 39 characters Global Server Timeout Specify the maximum amount of time the switch should wait for a response from a TACACS server If the timeout expires without a response the switch queries the next TACACS server in the list If Section VII Management Security Section VI Management Security AT S63 Management Software Web Browser Interface User s Guide there are no more servers the switch defaults to the standard Manager and Operator
52. Target Parameters Table In the Storage Type field enter one of the following storage types for this table entry Volatile Select this storage type if you do not want the ability to save an entry in the Target Address Table After making changes to a Target Address Table entry with a Volatile storage type the Save Config option is not displayed on the Configuration menu Section Ill SNMPv3 Deleting a Target Address Table Section Ill SNMPv3 Entry AT S63 Management Software Web Browser Interface User s Guide NonVolatile Select this storage type if you want the ability to save an entry in the Target Address Table After making changes to a Target Address Table entry with a NonVolatile storage type the Save Config option is displayed on the Configuration menu Allied Telesyn recommends this storage type Note The Row Status parameter is a read only field in the web browser interface The Active value indicates the SNMPv3 Target Address Table entry takes effect immediately 13 Click Apply to update the SNMPv3 Target Address Table 14 To permanently save your changes select the Save Config option in the Configuration menu To delete an entry in the SNMPv3 Target Address Table perform the following procedure 1 From the home page select Configuration The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 2 Select the SNMP tab The SN
53. The Row Status parameter is a read only field in the web browser interface The Active value indicates the SNMPv3 Notify Table entry takes effect immediately Click Apply to update the SNMPv3 Notify Table To permanently save your changes select the Save Config option in the Configuration menu To delete an entry in the SNMPv3 Notify Table perform the following procedure 1 From the home page select Configuration The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 In the SNMPv3 section click the button next to Configure Notify Table and then click Configure at the bottom of the tab The SNMPv3 Notify Table tab is shown in Figure 92 on page 254 255 Chapter 18 SNMPv3 256 Modifying a Notify Table Entry Click the button next to the Notify Table entry to be deleted and then click Remove A warning message is displayed Click OK To permanently save your changes select the Save Config option in the Configuration menu To modify an entry in the SNMPv3 Notify Table perform the following procedure 1 5 From the home page select Configuration The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 In the SNMPv3 section click
54. The port forwards unknown ingress unicast packets This is the default setting Egress Unknown Unicast Filter Use this parameter to configure a port to forward or discard unknown egress unicast packets The possible settings are Enabled The port discards unknown egress unicast packets Disabled The port forwards unknown egress unicast packets This is the default setting Ingress Unknown Multicast Filter Use this parameter to configure a port to forward or discard unknown ingress multicast packets Possible settings are Enabled The port discards unknown ingress multicast packets Disabled The port forwards unknown ingress multicast packets This is the default setting Egress Unknown Multicast Filter Use this parameter to configure a port to forward or discard unknown egress multicast packets Possible settings are Enabled The port discards unknown egress multicast packets Disabled The port forwards unknown egress multicast packets This is the default setting Flow Control Sets flow control on a port This option only applies to ports operating in full duplex mode A switch port uses flow control to control the flow of ingress packets The switch sends a special pause packet to stop the end node from sending frames The pause packet notifies the end node to stop transmitting for a specified period of time Possible settings are Disabled No flow control on the port This is the default Enabled Flow cont
55. Tree Protocol RSTP bridge forwarding delay 304 bridge hello time 304 bridge identifier 304 bridge max age 304 bridge priority 303 bridge settings configuring 302 disabling 292 312 edge port configuring 306 enabling 292 312 force version 303 MCHECK 305 324 point to point port configuring 306 port cost 305 port priority 305 port settings displaying 306 resetting to defaults 309 reauth period configuring 378 redundant ports 39 reg registrar state machine parameter 358 RSTP See Rapid Spanning Tree Protocol RSTP S Secure Shell SSH protocol configuring 400 displaying settings 402 Secure Sockets Layer SSL displaying settings 397 secured port security level 367 server authentication UDP port configuring 413 server key ID parameter 401 server timeout configuring 378 session cache timeout configuring 397 Simple Network Time Protocol SNTP configuring 48 servers 48 slave switch assigning 62 defined 62 SNMP management disabling 70 enabling 70 SNMPv1 and SNMPv2c community creating 72 deleting 76 displaying 77 modifying 75 SNMPv3 Access Table entry creating 240 deleting 243 displaying 281 modifying 244 SNMPv3 community name modifying 276 SNMPv3 Community Table entry creating 272 deleting 275 displaying 286 428 modifying 275 SNMPv3 Notify Table entry creating 253 deleting 255 displaying 283 modifying 256 SNMPv3 SecurityToGroup Table entry creating 247 deleting 250 displaying 282 modifying 2
56. VLAN Uplink Ports The uplink port s for this group of ports Name The VLAN name Protocol Not used Tagged Ports The tagged ports members of the VLAN The Protected VLAN Groups section displays the following information Group Number The number assigned to the group Port List The ports of the group 348 Secton V Virtual LANs Chapter 22 GARP VLAN Registration Protocol Section V Virtual LANs This chapter contains instructions on how to configure GARP VLAN Registration Protocol GVRP This chapter contains the following procedures DU UD DUU UU Configuring GVRP on page 350 Enabling or Disabling GVRP on a Port on page 352 Displaying the GVRP Configuration on page 353 Displaying the GVRP Port Configuration on page 354 Displaying the GVRP Database on page 355 Displaying the GVRP State Machine on page 356 Displaying the GVRP Counters on page 359 Displaying the GIP Connected Ports Ring on page 362 Note For background information refer to Chapter 25 GARP VLAN Registration Protocol in the AT S63 Management Software Menus Interface User s Guide 349 Chapter 22 GARP VLAN Registration Protocol Configuring GVRP To configure GVRP perform the following procedure 1 From the Home page select Configuration 2 From the Configuration menu select the Layer 2 option 3 Select the GVRP tab The GVRP tab is shown in Figure 136
57. access to the switch If you enter a subnet any management node in the subnet will be permitted remote management access to the switch Mgmt ACL IP Mask Specifies a mask that indicates the parts of the IP address the switch should filter on A binary 1 indicates the switch should filter on the corresponding bit of the address while a 0 indicates that it should not If you are filtering on a specific IP address use the mask 255 255 255 255 If you are filtering on a subnet the mask will depend on the address For example to allow all management workstations in the subnet 149 11 11 0 to manage the switch you would enter the mask 255 255 255 0 Application Specifies the application the management station can use to manage the switch You can select more than one by holding down the Shift key when making the selections The options are Telnet Allows Telnet management Web Allows web browser management Ping Allows the management workstation to ping the switch All Allows all of the above Section VII Management Security Section VI Management Security AT S63 Management Software Web Browser Interface User s Guide Click Add The new ACE is added to the table in the middle section of the tab If desired repeat Steps 3 and 4 to add more ACEs to the Management ACL To permanently save your changes select the Save Config option in the Configuration menu 421 Chapter 28 Management Access Cont
58. an entry in the SecurityToGroup Table After making changes to a SecurityToGroup Table entry with a NonVolatile storage type the Save Config option is displayed on the Configuration menu Allied Telesyn recommends this storage type Note The Row Status parameter is a read only field in the web browser interface The Active value indicates the SNMPv3 SecurityToGroup Table entry takes effect immediately 9 Click Apply 249 Chapter 18 SNMPv3 Deleting a SecurityToGroup Table Entry Modifying a SecurityToGroup 250 Table Entry 10 To permanently save your changes select the Save Config option in the Configuration menu To delete an entry SNMPv3 SecurityToGroup Table perform the following procedure 1 From the home page select Configuration The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 In the SNMPv3 section click the button next to Configure SecurityToGroup Table and then click Configure at the bottom of the tab The SNMPv3 Security ToGroup Table tab is shown in Figure 89 on page 248 Click the button next to the SecurityToGroup Table entry to be deleted and then click Remove A warning message is displayed Click OK From the Configuration menu select the Save Config option to permanently save your changes This option is not displayed if th
59. and SNMPv2c Section Basic Operations This chapter explains how to activate SNMP management on the switch and how to create modify and delete SNMPv1 and SNMPv2c community strings This chapter contains the following procedures Enabling or Disabling SNMP Management on page 70 Creating a New SNMPv1 and SNMPv2c Community on page 72 Modifying an SNMPv1 and SNMPv2c Community on page 75 Deleting an SNMPv1 and SNMPv2c Community on page 76 Displaying the SNMPv1 and SNMPv2c Communities on page 77 Odo 0 Note For background information refer to Chapter 5 SNMPv1 and SNMPv2c in the AT S63 Management Software Menus Interface User s Guide 69 Chapter 4 SNMPv1 and SNMPv2c Enabling or Disabling SNMP Management 70 To enable or disable SNMP management on the switch perform the following procedure 1 From the Home page select Configuration 2 From the Configuration menu select the Mgmt Protocols option 3 Select the SNMP tab The SNMP tab is shown in Figure 13 AT 9424T SP Enable SNMP Access Enable Authentication Failure Trap Mgmt Protocols SNMPv1 amp SNMPv2ce Configure SNMPv1 amp SNMPv2c Communities SNMPv3 SNMP Engine ID 80 00 00 CF 03 00 30 84 AB EF CD Configure User Table Configure View Table O Configure Access Table Configure SecurityToGroup Table O Configure Notify Table Configure Target
60. as necessary Force Version This selection determines whether the bridge operates with RSTP or in an STP compatible mode If you select RSTP the bridge operates all ports in RSTP except for those ports that receive STP BPDU packets If you select Force STP Compatible the bridge operates in RSTP using the RSTP parameter settings but it sends only STP BPDU packets out the ports Bridge Priority The priority number for the bridge This number is used in determining the root bridge for RSTP The bridge with the lowest priority number is selected as the root bridge If two or more bridges have the same priority value the bridge with the numerically lowest MAC address becomes the root bridge When a root bridge goes off line the bridge with the next priority number automatically takes over as the root bridge This parameter can be from 0 zero to 61 440 in increments of 4096 with 0 being the highest priority For a list of the increments refer to Table 6 on page 296 303 Chapter 19 Spanning Tree and Rapid Spanning Tree Protocols 304 Bridge Hello Time The time interval between generating and sending configuration messages by the bridge This parameter can be from 1 to 10 seconds The default is 2 seconds Bridge Forwarding The waiting period before a bridge changes to a new state for example becomes the new root bridge after the topology changes If the bridge transitions too soon not all links may have yet adapted to the
61. as opened or closed If there is no check in the box next to the option the community string is closed only those workstations whose IP addresses are assigned to the community string can use it If there is a check in the box the string is open meaning any SNMP management workstation can use it to access the switch Manager IP Address 1 through Manager IP Address 8 Specify the IP addresses of management workstations If you gave the community string a closed status use these fields to specify the IP addresses of up to eight management workstations permitted to use the community string to access the switch Entering manager IP addresses for a community string with an open status has no affect on the string Trap Receiver IP Address 1 through Trap Receiver IP Address 8 Specify the IP addresses of up to eight trap receivers These are nodes on your network such as your management workstation to act as trap receivers for the switch Click Apply The new community string is now available on the switch Repeat this procedure starting with step 4 to add more community strings TO permanently save your changes select the Save Config menu option Section Basic Operations AT S63 Management Software Web Browser Interface User s Guide Modifying an SNMPv1 and SNMPv2c Community Section Basic Operations To modify an SNMPv1 and SNMPv2c community perform the following procedure 1 2 From the Home page select
62. based Guides 222ssccitiisiecstlaiicscettedtaceceit lad ledtelacdascetad iad aE aeaa thdag EEN 20 Contacting Allied Teles yi ze d een eSEdE Seed Eed leveeasoeh T E EE de Dee eebe EE 21 OnIIMESSuUpPOMt icra teas ee Ehe had tee ae a ete ee valle we ten ta e ak oat A 21 Email and Telephone Gupport ttrt tAn AEAASEESAE EOE EEEEEEEASEESREE SEEE EEEAE EEEn neea ee meena 21 Returning Produc CTT 21 Sales or Corporate Information 21 Management Software Updates ccceccccceeeeseeeceeeeeneccecenseeeceneetesececeeeneecceeeessacceeeeseeececeneesneaecenseeeecerenenees 21 Histor ot New Features a ese etic asia adie T es actaeedd ted aaa ee 22 WERSION E EE 22 WEFSION E EE 23 VERSION 2 EE 24 Section I Basic Operations eege Chapter 1 Starting a Web Browser Management Session nissseseeessseerrreserrrrsetrrrsttttrrnssttrrresrnr entet 29 Planning for Remote Management 30 Starting a Web Browser Management Session 0 00 2 eee ceeceeeeeeeteeee eee enne eee eeeeaaeeeeeeeaaaeeeeeeeaaaeeeeeeeaaaeeeeeeenaeeeeeeaas 33 Web Browser TOOS ern fie ee a na i et a 36 Saving Your Parameter Changes eee ar edi i eda eaa a eda ee 37 Quitting a Web Browser Management Session 0 00 0 ceeeceee ester ee eee enne eee eeeeaaeee ee eeaaeeeeeeeaaeeeseeeaaeeeeeeenaeeeeseaas 38 Redundant Twisted Pair Ports 00c 0 cce0csesiecedeceeegcecee ene sicedeesnsnce devesssdedvavessuteedeueduudeeevasensncnddaeesdedehensscheevdeenseta 39 Restrictions to the Web Browser Interfac
63. change possibly resulting in a network loop The range is 4 to 30 seconds The default is 15 seconds This setting applies only to ports running in the STP compatible mode Bridge Max Age The length of time after which stored bridge protocol data units BPDUs are deleted by the bridge All bridges in a bridged LAN use this aging time to test the age of stored configuration messages called bridge protocol data units BPDUs For example if you use the default 20 all bridges delete current configuration messages after 20 seconds This parameter can be from 6 to 40 seconds The default is 20 seconds In selecting a value for maximum age the following must be observed MaxAge must be greater than 2 x HelloTime 1 MaxAge must be less than 2 x ForwardingDelay 1 Bridge Identifier The MAC address of the bridge The bridge identifier is used as a tie breaker in the selection of the root bridge when two or more bridges have the same bridge priority value This value cannot be changed Root Bridge The MAC address of the root bridge of the spanning tree domain This value cannot be changed and is only displayed when RSTP is activated on the switch Root Priority The priority value on the root bridge of the spanning tree domain This parameter is only displayed when RSTP is enabled on the switch To change the priority value on the root bridge you must start a management session on the switch functioning as the root bridge and ch
64. for an IP address XXX XXX XXX XXX In the UDP Port Number field enter a UDP port number You can enter a UDP port in the range of 0 to 65 535 The default UDP port is 162 In the Timeout field enter a timeout value in milliseconds When an Inform message is generated it requires a response from the switch The timeout value determines how long the switch considers the Inform message an active message This parameter applies to Inform messages only The range is from 0 to 2 147 483 647 milliseconds The default value is 1500 milliseconds In the Retries field enter the number of times the switch retries or resends an Inform message When an Inform message is generated it requires a response from the switch This parameter determines how many times the switch resends an Inform message The Retries parameter applies to Inform messages only The range is 0 to 255 retries The default is 3 retries In the Tag List field enter a list of tags that you configured in a SNMPv3 Notify Table with the Notify Tag parameter See Creating a Notify Table Entry on page 253 Enter a Tag List of up to 256 alphanumeric characters Use a space to separate entries for example hwengtag swengtag testengtag In the Target Parameters field enter a Target Parameters name This name can consist of up to 32 alphanumeric characters The value configured here must match the value configured with the Target Parameters Name parameter in the SNMPv3
65. for remote management packets at a time This makes it necessary for you to specify the local subnet on the switch from where your remote management station is reaching the unit You do that by designating the subnet s interface as the local interface This instructs the switch s management Section l Basic Operations Section Basic Operations AT S63 Management Software Web Browser Interface User s Guide software to monitor the traffic on that subnet for the remote management packets If the switch is an isolated unit or the master switch of an enhanced stack you must create at least one interface on the device You create the interface on the local subnet and VLAN through which your management workstation is reaching the device Furthermore you must designate the interface as the local interface To start a remote management session you specify the IP address of the local interface as the switch s IP address The slave switches of a stack are handled differently They do not need any interfaces nor a local interface to be a part of an enhanced stack What is required is that the master and slave switches be interconnected by acommon VLAN and that the VLAN be part of the local interface on the master switch Here is an overview of the required steps to configuring an isolated AT 9400 Series switch for remote management 1 Create a routing interface on the local subnet and VLAN from where your remote management station rea
66. force authorized 377 force unauthorized 377 port cost Multiple Spanning Tree Protocol MSTP 323 Rapid Spanning Tree Protocol RSTP 305 Spanning Tree Protocol STP 298 AT S63 Management Software Web Browser Interface User s Guide port mirror creating 114 deleting 119 disabling 118 displaying 120 modifying 117 port parameters configuring basic 80 Multiple Spanning Tree Protocol MSTP 314 Rapid Spanning Tree Protocol RSTP 302 Spanning Tree Protocol STP 294 port participating parameter 368 port priority Multiple Spanning Tree Protocol MSTP 323 Rapid Spanning Tree Protocol RSTP 305 Spanning Tree Protocol STP 297 port security displaying 369 intrusion action 370 port security levels MAC 367 port speed configuring 82 port trunk creating 104 deleting 110 displaying 111 modifying 108 port based access control See 802 1x Port based Network Access Control port based VLAN creating 336 deleting 343 displaying 345 modifying 341 Public Key Infrastructure PKI settings displaying 394 Q QoS See Quality of Service QoS Quality of Service QoS See also traffic class flow group and policy 183 quiet period configuring 378 R RADIUS configuring 412 disabling 406 displaying settings 414 enabling 406 server timeout 415 RADIUS accounting configuring 387 settings displaying 388 RADIUS server encryption secret 413 encryption secret configuring 409 IP address configuring 413 427 Index Rapid Spanning
67. l Basic Operations AT S63 Management Software Web Browser Interface User s Guide The Modify Trunk page is shown in Figure 28 Trunk ID 1 TrunkName Marketing Trunk Method SAIDA Source amp Dest L2 Address Trunk Port Regular Port Figure 28 Modify Trunk Page 5 To change the name of the trunk click the Trunk Name field and enter the new name The name can be up to 16 alphanumeric characters No spaces or special characters such as asterisks and exclamation points are allowed Each trunk must have a unique name 6 To add or remove ports from a trunk click the ports in the graphical image of the switch A selected port changes to white An unselected port is black A static port trunk can contain up to eight ports 7 Click Apply Changes to a port trunk are activated on the switch 8 To permanently save your changes select the Save Config option in the Configuration menu 9 Reconnect the cables to the ports of the trunk Section Basic Operations 109 Chapter 7 Static Port Trunks Deleting a Port Trunk 110 AN Caution Disconnect the cables from the port trunk on the switch before performing this procedure Deleting the trunk without first disconnecting the cables can result in the formation of a loop in your network topology This can cause a broadcast storm and poor network performance To delete a port trunk from the switch perform the following procedure 1 2
68. of the classifier s to be assigned to the ACL Having this information handy will make it easier for you to perform the procedure To view the classifier ID numbers and specifications refer to Displaying the Classifiers on page 163 To configure an access control list perform the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the Network Security option 3 Select the ACL tab The ACL tab is shown in Figure 49 AT 9424T SP 5 em Name Marketing C Addr 00 30 84 4B EF CD C Lei Description Action Classifier List Port List Product Svr Permit 20 21 L Mgmt Security 244 22 no Protocols am vg W permit Network Security IP traffic Deny 44 15 20 21 deny i IP trafic Permit utilities Sales Figure 49 ACL Tab Configuration The Current ACL s section of the tab displays a table of the existing ACLs The table has the following columns of information ID The ID number of the ACL Description A description of the ACL Action The ACL action of Permit or Deny An action of Permit means the port Section Il Advanced Operations Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide accepts the packets that meet the criteria of the classifiers assigned to the ACL An action of Deny means the port discards the packets unless the packets also match the criteria of a
69. on the switch before performing this procedure if you plan to add or remove ports from the trunk Leaving the cables connected can form a loop in your network topology This can cause a broadcast storm and poor network performance Note the following before performing this procedure o If you are adding a port and the port will be the lowest numbered port in the trunk its parameter settings will overwrite the settings of the existing ports in the trunk Consequently you should check to see if its settings are appropriate prior to adding it If you are adding a port and the port will not be the lowest numbered port in the trunk its settings are automatically changed to match the settings of the existing ports in the trunk If you are adding a port to a trunk check to be sure that the new port is an untagged member of the same VLAN as the other trunk ports A trunk cannot contain ports that are untagged members of different VLANs You cannot change the load distribution method of a static port trunk from the web browser manager interface but you can from the menus and command line interfaces To modify a port trunk perform the following procedure 1 2 From the home page select Configuration From the Configuration menu select the Layer 1 option Select the Port Trunking tab The Port Trunking tab is shown in Figure 26 on page 105 Click the button next to the port trunk to be modified and click Modify Section
70. pair port and a GBIC or SFP module share the same configuration settings including port settings VLAN assignments access control lists and spanning tree An exception to the shared settings is port speed If you disable Auto Negotiation on a twisted pair port and set the speed and duplex mode manually the speed reverts to Auto Negotiation when a GBIC or SFP module establishes a link with an end node 39 Chapter 1 Starting a Web Browser Management Session Note These guidelines do not apply to the SFP slots on the AT 9408LC SP switch and the XFP slots on the AT 9424Ts XP and AT 9448Ts XP switches 40 Section Basic Operations AT S63 Management Software Web Browser Interface User s Guide Restrictions to the Web Browser Interface Section Basic Operations The following management tasks are not support from the web browser interface They must be performed from the menus interface or the command line interface Management tasks marked with an asterisk are only supported from the command line interface o Configuring LACH port trunks O Configuring MAC address based and protected ports VLANs o Copying renaming and deleting files from the file system or from a compact flash memory card Configuring routing interfaces Configuring static IPv4 routes Configuring Routing Information Protocol RIP versions 1 and 2 Changing directories on a compact flash memory card Uploading or downloading files
71. port which starts with Uplink Uplink Port This column contains NA meaning Not Applicable for tagged port based and MAC address based VLANs For a protected ports VLAN this column contains the uplink port s for a port group Tagged uplink ports are designated with T and untagged uplink ports with U If the switch is operating in one of the two multiple VLAN modes this column displays the uplink port for the ports on the switch Type The VLAN type The possible settings are Port Based The VLAN is a port based or tagged VLAN MAC Based The VLAN is a MAC address based VLAN Protected The VLAN is a protected ports VLAN GARP The VLAN was created by GARP Protocol The protocol associated with this VLAN The possible settings are Blank The VLAN is a port based tagged protected port or MAC address based VLAN GARP The VLAN is a dynamic GVRP VLAN or the port is a dynamic GVRP port of a static VLAN Member Ports The untagged and tagged ports of a VLAN These fields will be blank for a MAC address based VLAN The untagged ports of a VLAN are listed as follows O Configured The untagged ports assigned to the VLAN when the VLAN was created or modified Secton V Virtual LANs Secton V Virtual LANs AT S63 Management Software Web Browser Interface User s Guide O Actual The current untagged ports of the VLAN If you are not using 802 1x Port based Network Access Control both the
72. port is configured as an authenticator or a supplicant The Status field can have the following values for an authenticator port Aborting Authenticated Authenticating Connecting Disconnected Force_Auth Force_Unauth Held Initialize The Status field can have the following values for a supplicant port Acquired Authenticated Authenticating Connecting Disconnected Held Logoff Section VI Port Security Displaying the Port Settings Section VI Port Security AT S63 Management Software Web Browser Interface User s Guide Additional Info This field displays the MAC address of an authenticated node for authenticator ports with a status of Authenticated To display the port settings for port based network access control perform the following procedure 1 2 From the Home page select Monitoring From the Monitoring menu select Network Security Select the 802 1x Port Access tab The 802 1x Port Access tab is shown in Figure 152 on page 383 In the switch image click a port and click Settings You can display the settings of more than one port at a time Note To view the settings of multiple ports the selected ports must have the same port role authenticator or supplicant The Authenticator Port Parameters page is displayed for authenticator ports as shown in Figure 154 genge Port Parameters 11 1 Current Port 11 Total Ports 1 Page lof 1 Authentication Mode 802 1x Supplica
73. port settings go to Configuring Supplicant Port Parameters on page 381 Section VI Port Security 373 Chapter 24 802 1x Port based Network Access Control Enabling or Disabling 802 1x Port based Network Access Control 374 To enable or disable 802 1x Port based Network Access Control perform the following procedure 1 2 From the home page select Configuration From the Configuration menu select the Network Security option Select the 802 1x Port Access tab The 802 1x Port Access tab is shown in Figure 148 on page 372 Click the Enable Port Access check box A check in the box means the feature is activated on the switch No check means the feature is disabled For instructions on configuring the accounting feature refer to RADIUS Accounting on page 387 Click Apply A change to the status of 802 1x Port based Network Access Control is immediately implemented on the switch To permanently save your changes select the Save Config option in the Configuration menu Section VI Port Security AT S63 Management Software Web Browser Interface User s Guide Configuring Authenticator Port Parameters Section VI Port Security To configure authenticator port parameters perform the following procedure Note The role of a port must be set to authenticator before the parameters can be configured For instructions refer to Setting Port Roles on page 372 1 From the home pag
74. quit the browser You should always log out from a web browser management session when you are finished managing a switch For instructions see Quitting a Web Browser Management Session on page 38 Logging out prevents unauthorized individuals from making changes to a switch s configuration should you leave your management station unattended Furthermore as long as you are logged in no one else can access the switch through another local or remote connection If you close your web browser without logging out the switch considers the management session as still in progress and will not permit the start of another management session until the expiration of the console timer The switch uses the timer to end inactive local and remote management sessions The default setting for the timer is ten minutes The console timer can be set from the menus or the command line interface but not from the web browser interface 35 36 Chapter 1 Starting a Web Browser Management Session Web Browser Tools You can use the web browser tools to move around the management pages Selecting Back on your browser s toolbar returns you to the previous display You can also use the browser s bookmark feature to save the link to the switch Section Basic Operations AT S63 Management Software Web Browser Interface User s Guide Saving Your Parameter Changes A change to a switch parameter is in most cases immediately activated a
75. s U D Description Action Active Classifier List Port List 237 Local Deny Yes 1 Network Security View Figure 52 ACL Tab Monitoring The ACL tab displays a table of the currently configured ACLs with the following columns of information ID The ID number for the ACL Description A description of the ACL Action The ACL action of Permit or Deny An action of Permit means the port accepts the packets that meet the criteria of the classifiers assigned to the ACL An action of Deny means the port discards the packets unless the packets also match the criteria of a Permit ACL in which case the packets are accepted by the port because a Permit ACL overrides a Deny ACL Active Whether or not the ACL is active A status of Yes means that the ACL Section Il Advanced Operations 171 Chapter 13 Access Control Lists is assigned to at least one port on the switch A status of No means the ACL is not assigned to any ports and therefore is inactive Classifier List The classifiers assigned to the ACL Port List The port assignments of the ACL 4 To view the same information for each ACL select the ACL and click View The View ACLs page opens as shown in Figure 53 L_ i ID Description 237 Local Classifier List Port List 1 3 4 Action Deny Figure 53 View ACLs Page 5 Click Close 172 Section Il Advanced Operations Chapter 14 Class o
76. seconds The range is 0 to 1048575 seconds The default is 300 seconds 5 minutes The value 0 disables the aging timer If the aging timer is disabled inactive dynamic addresses are not deleted from the table and the switch stops learning new addresses after the table reaches maximum capacity Click Apply The new MAC address aging time is activated on the switch To permanently save your changes select the Save Config option in the Configuration menu 101 Chapter 6 MAC Address Table 102 Section Basic Operations Chapter 7 Static Port Trunks Section Basic Operations This chapter contains the procedure for managing static port trunks The sections in this chapter are Creating a Static Port Trunk on page 104 Modifying a Static Port Trunk on page 108 Deleting a Port Trunk on page 110 OQ UU Displaying the Port Trunks on page 111 Note For background information refer to Chapter 8 Static and LACP Port Trunks in the AT S63 Management Software Menus Interface User s Guide Note LACP trunks are not supported from the web browser interface 103 Chapter 7 Static Port Trunks Creating a Static Port Trunk 104 AN Caution Do not connect the cables of a port trunk to the ports on the switch until after you have configured the ports on both the switch and the remote device Connecting the cables prior to configuring the trunk can create a loop in y
77. stored in permanent memory or Output 1 Temporary to configure the log in temporary memory 5 Click Modify The Modify Event Log Output window is displayed The window for the temporary memory log is shown in Figure 40 ModiyeventtogOuputt Output ID Type 1 Temporary Status Action Enabled Wrap a Ss Figure 40 Modifying Event Log Output 1 Window 6 Using the Action pull down menu select one of the following Wrap The log deletes the oldest entries as it adds new entries after reaching its maximum storage capacity Halt The log stops adding new entries 145 Chapter 11 Event Logs and Syslog Servers 7 Click Apply 8 To permanently save the change select the Save Config menu selection Saving an Event You can save the current contents of an event log as an ASCII file in the Log to a File switch s file system You might save an event log to retain a history of the operation of the switch or to assist in resolving a network problem The file can be viewed from the file system or uploaded to your management workstation using Xmodem or TFTP To save an event log to a file perform the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the System option 3 Select the Event Log tab The Event log tab is shown in Figure 37 on page 139 4 Configure the parameters in the Display Filter Settings section of the tab to define w
78. swengtag hwengtag Target Parameters snmpv3manager50 Storage Type Volatile x Row Status Active Figure 97 Modify SNMPv3 Target Address Page In the IP Address field enter the IP address of the host Use the following format for an IP address XXX XXX XXX XXX Section IIl SNMPv3 Section Ill SNMPv3 7 10 11 12 AT S63 Management Software Web Browser Interface User s Guide In the UDP Port Number field enter a UDP port number You can enter a UDP port in the range of 0 to 65 535 The default UDP port is 162 In the Timeout field enter a timeout value in milliseconds When an Inform message is generated it requires a response from the switch The timeout value determines how long the switch considers the Inform message an active message This parameter applies to Inform messages only The range is from 0 to 2 147 483 647 milliseconds The default value is 1500 milliseconds In the Retries field enter the number of times the switch retries or resends an Inform message When an Inform message is generated it requires a response from the switch This parameter determines how many times the switch resends an Inform message The Retries parameter applies to Inform messages only The range is 0 to 255 retries The default is 3 retries In the Tag List field enter a list of tags that you configured with the Notify Tag parameter in a Notify Table entry See Creating a Notif
79. the 802 1x Port Access tab The 802 1x Port Access tab is shown in Figure 152 AT Network Security Section VI Port Security 9424T SP Port Access Parameters Port Access is Disabled Authentication Method RADIUS EAP RADIUS Accountin Accounting Disabled Port Number 1813 Accounting Update Disabled Trigger Type Star_Stop Type Network Update Interval 60 Figure 152 802 1x Port Access Tab Monitoring The image of the switch displays the roles of the ports An A indicates an authenticator port and an S a supplicant port A black port has not been assigned a port role and is not participating in port based access control This is the default setting for a port 383 Chapter 24 802 1x Port based Network Access Control 384 4 To see the status of the port click the port and click Status You can display the status of more than one port at a time The Port Access Port Status page is shown in Figure 153 Total Ports 1 Page lof 1 Port Role Status Additional Info Authenticator Figure 153 Port Access Port Status Page The Port Access Port Status page displays a table that contains the following columns of information Port Port number Port Role Port access role configured for the port The possible settings are None Authenticator or Supplicant Status Status of the port The status field is dependent on whether a
80. the Save Config option in the Configuration menu If you activated STP go to Configuring STP on page 294 If you activated RSTP go to Configuring RSTP on page 302 If you activated MSTP go to Configuring MSTP on page 314 313 Chapter 20 Multiple Spanning Tree Protocol Configuring MSTP This section contains the following procedures WS NS 0 Configuring MSTP Parameters next Configuring the CIST Priority on page 317 Managing MSTIs on page 318 Configuring MSTP Port Parameters on page 322 Note MSTP must be selected as the active spanning tree protocol on the switch before you can configure it For instructions on selecting the active spanning tree refer to Enabling MSTP on page 312 Note When MSTP is enabled the GVRP tab is not shown on the Configuration or Monitoring Layer 2 page Configuring To configure MSTP parameters perform the following procedure MSTP 4 Parameters 2 3 4 314 From the home page select Configuration From the Configuration menu select the Layer 2 option Select the Spanning Tree tab The Spanning Tree tab is shown in Figure 113 on page 292 Click Configure The expanded MSTP Spanning Tree tab is shown in Figure 125 Section IV Spanning Tree Protocols AT S63 Management Software Web Browser Interface User s Guide AT 9424T SP tome J Spanning Tree ayer Configure MSTP Parameters Force Version M
81. the button next to Configure Notify Table and then click Configure at the bottom of the tab The SNMPv3 Notify Table tab is shown in Figure 92 on page 254 Click the button next to the table entry to be changed and then click Modify The Modify SNMPv3 Notify page is shown in Figure 94 T voa swevsnoiy Notify Name swenginform Notify Tag swenginformtag Notify Type P Inform xj Storage Type NonVolatile x Row Status Active Figure 94 Modify SNMPv3 Notify Page In the Notify Tag field enter a description name of the Notify Tag Enter a name of up to 32 alphanumeric characters Section Ill SNMPv3 Section Ill SNMPv3 6 AT S63 Management Software Web Browser Interface User s Guide In the Notify Type field enter one of the following message types Trap Indicates this notify table is used to send traps With this message type the switch does not expects a response from the host Inform Indicates this notify table is used to send inform messages With this message type the switch expects a response from the host In the Storage Type field select one of the following storage types for this table entry Volatile Select this storage type if you do not want the ability to save an entry in the Notify Table After making changes to an Notify Table entry with a Volatile storage type the Save Config option is not displayed on the Configuration menu NonvVolatile Select this st
82. the switch to its factory default settings For instructions refer to Returning the AT S63 Management Software to the Factory Default Values on page 53 3 Inthe TFTP Server IP Address field enter the IP address of the network node containing the TFTP server software 4 For the TFTP Operation parameter click Download 5 Inthe TFTP Remote Filename field enter the filename of the file on the TFTP server to be downloaded to the switch Be sure to include the filename extension such as img for an AT S63 image file or cfg for a configuration file 132 Section Il Advanced Operations Section Il Advanced Operations 6 AT S63 Management Software Web Browser Interface User s Guide In the TFTP Local Filename field enter a name for the file This is the name the switch uses to store the file in its file system To download a new AT S63 image file into the switch s application block enter APPBLOCK as the filename For the TFTP File Type parameter select one of the following Image Select this option to download a new AT S63 image file directly into the application block portion of flash memory of the switch so that the device immediately uses it as its active image file Config Select this option to download a configuration file that the switch is to immediately employ as its new active boot configuration file File Select this option to download a file to the file system suc
83. the value in the ToS priority field on IPv4 packets Options are yes Replaces the value in the 802 1p priority field with the value in the ToS priority field on IPv4 packets no Does not replace the preexisting 802 1p priority level This is the default Move Priority to ToS Replaces the value in the ToS priority field with the 802 1p priority field on IPv4 packets Options are yes Replaces the value in the ToS priority field with the 802 1p priority field on IPv4 packets no Does not replace the ToS priority field This is the default Flow Group List Specifies the flow groups assigned to this traffic class Use lt Ctrl gt click to select more than one When you are finished configuring the parameters click Apply The new traffic class is created on the switch TO permanently save your changes select the Save Config menu selection This procedure explains how to modify an existing traffic class If the traffic class to be modified is already part of a QoS policy assigned to one or more switch ports you must first modify the policy by removing the port assignments before you can modify the traffic class You can reassign the ports back to the policy after you have finished modifying the traffic class Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide To modify a traffic class perform the following procedure 1 From the home page select Configuration 2 From the
84. the value you configure for the Transport Tag parameter to the Tag List parameter in the Target Address Table as desired See Creating a Target Address Table Entry on page 258 In the Storage Type field select one of the following storage types for this table entry Volatile Select this storage type if you do not want the ability to save an entry in the SNMPv3 Community Table After making changes to an SNMPv3 Community Table entry with a Volatile storage type the Save Config option is not displayed on the Configuration menu NonVolatile Select this storage type if you want the ability to save an entry in the SNMPv3 Community Table After making changes to an SNMPv3 Community Table entry with a NonVolatile storage type the Save Config option is displayed on the Configuration menu Allied Telesyn recommends this storage type Section Ill SNMPv3 Deleting an SNMPv3 Community Table Entry Modifying an SNMPv3 Community Table Entry Section Ill SNMPv3 AT S63 Management Software Web Browser Interface User s Guide Note The Row Status parameter is a read only field in the web browser interface The Active value indicates the SNMPv3 Community Table entry takes effect immediately 10 Click Apply 11 To permanently save your changes select the Save Config option in the Configuration menu To delete an entry in the SNMPv3 Community Table perform the following procedure 1 From the home page
85. to 240 in increments of 16 The default value is 8 priority value 128 For a list of the increments refer to Table 7 on page 298 297 Chapter 19 Spanning Tree and Rapid Spanning Tree Protocols Table 7 Port Priority Value Increments Increment Blidge Increment Bridge Priority Priority 0 0 8 128 1 16 9 144 2 32 10 160 3 48 11 176 4 64 12 192 5 80 13 208 6 96 14 224 7 112 15 240 Port Cost The spanning tree algorithm uses the cost parameter to decide which port provides the lowest cost path to the root bridge for that LAN The range is 0 to 65 535 The default setting is Auto detect which sets port cost depending on the speed of the port If you select Auto Detect the management software assigns a value of 100 if the port is operating at 10 Mbps 10 for 100 Mbps and 4 for one gigabit 4 After you have configured the parameters click Apply 5 To permanently save your changes select the Save Config option in the Configuration menu Displaying the To display the STP settings perform the following procedure STP Settings 1 From the Home page select Monitoring 2 From the Monitoring menu select the Layer 2 option 3 Select the Spanning Tree tab 298 Section IV Spanning Tree Protocols AT S63 Management Software Web Browser Interface User s Guide The Spanning Tree tabs is shown in Figure 116 AT 9424T SP Home Sp
86. where the traffic is to be redirected Traffic that matches the defined traffic flow is redirected to the specified port You can specify only one port When you are finished configuring the parameters click Apply If the new policy was assigned ports it is now active on the designated ports To permanently save your changes select the Save Config option in the Configuration menu To modify a policy perform the following procedure 1 2 From the home page select Configuration From the Configuration menu select the Services option Select the Policies tab The Policies tab is shown in Figure 68 on page 198 Select the policy to be modified from the list and click Modify 201 Chapter 15 Quality of Service Deleting a Policy 202 The Modify Policy page is shown in Figure 70 m r ID Description 11 Ser12 Remark DSCP NONE zi DSCP Value mea ToS Move ToS To Priority pa NO e Move Priority To ToS Send To Mirror Port NO ei NO el Traffic Class List Ingress Port List oA 1a Ss o 3 4 Egress Port Redirect Port Figure 70 Modify Policy Page 5 Modify the parameters as needed For parameter definitions refer to Configuring a Policy on page 198 6 When you are finished configuring the parameters click Apply The changes are immediately implemented in the policy 7 To permanently save your changes select the Save Config option in the Configuratio
87. 06 Figure 73 DoS Configuration for Ports Page eececceceeeeeeeeeeeeeeeeeeeeeeeeeeeeseneeeeeeseeeeeeeeeseeeaeeeeeseeeaaeeseeenaeeees 207 Figure 74 DoS Tab Monitoring 209 Figure 75 DoS Monitor for Ports Page 210 AT S63 Management Software Menus Interface User s Guide Chapter 17 IGMP SnOO pling Ee oe seek Soe eee ccna denne de ENEE sys Desde EENEG 211 Figure 76 IGMP Tab Configuration aereis ita eaaa raa aaa aa A ARa E E ieia 212 Figure 77 IGMP Tab Monttonng aai naaaa aa 215 Figure 78 View Multicast Routers List Page 217 Chapter 182SNMPV8 gt E 221 Figure 79 SNMP Tab Conttouraton srie E A TAEA EE AE 224 Figure 80 SNMPv3 User Table Tab CGonfouraton 227 Figure 81 Add New SNMPv3 User Page 227 Figure 82 Modify SNMPv3 User Page 231 Figure 83 SNMPv3 View Table Tab Configuration sssssssssisssessrrssetrrrssttrrrssttnnnsstttnrsttttnnsssttnnnsstennnsennn 235 Figure 84 Add New SNMPV3 View Page ccccccceeeeeeeeeeeeeennee nese etaeeeeeetaeeeeeesaeeeeeeeeieeeeestieeeeeesieeeeene 235 Figure 85 Modify SNMPv3 View Page eee E eee eieeeeee stents eeeaaeeeeeesaeeeeeesaeeeeestaeeeeeee 238 Figure 86 SNMPv3 Access Table Tab Conftouraton 240 Figure 87 Add New SNMPVv3 Access Page 241 Figure 88 Modify SNMPv3 Access Page 245 Figure 89 SNMPv3 SecurityToGroup Table Tab Configuration 0 cccccceeeeeeeeeeeeeeecaeeeeeeeieeeeeeetneeeeereeea 248 Figure 90 Add New SNMPv3 SecurityTOGroup Page 248
88. 15 318 Section IV Spanning Tree Protocols 10 11 AT S63 Management Software Web Browser Interface User s Guide In the Priority field enter an MSTI Priority value This parameter is used in selecting a regional root for the MSTI The range is 0 zero to 61 440 in increments of 4 096 with 0 being the highest priority This parameter is used in selecting a regional root for the MSTI For a list of the increments refer to Table 6 Bridge Priority Value Increments on page 296 The default is 0 To add VLANs to the MSTI enter the VIDs in the VLAN List field Separate multiple VIDs with a comma Click Apply The management software creates the MSTI Repeat steps 5 to 9 to create additional MSTIs To permanently save your changes select the Save Config option in the Configuration menu Modifying an To modify an MSTI perform the following procedure MSTI 4 2 Section IV Spanning Tree Protocols From the home page select Configuration From the Configuration menu select the Layer 2 option Select the Spanning Tree tab The Spanning Tree tab is shown in Figure 113 on page 292 Click Configure The expanded MSTP Spanning Tree tab is shown in Figure 125 on page 315 In the CIST MSTI Table section of the tab click the button next to the MSTI ID to be modified You can only modify one MSTI ID at a time You cannot modify CIST Click Modify 319 Chapter 20 Multiple Spanning Tree Protocol Deletin
89. 286 To display entries in the SNMPv3 User Table perform the following procedure 1 3 From the Home page select Monitoring The Monitoring System page is displayed with the General tab selected by default as shown in Figure 9 on page 57 From the Monitoring menu select Mgmt Protocols The Mgmt Protocols page is displayed with the Server based Authentication tab displayed by default as shown in Figure 12 on page 67 Select the SNMP tab Section IIl SNMPv3 AT S63 Management Software Web Browser Interface User s Guide The SNMP tab is shown in Figure 104 SNMP SNMP Access Enabled Authentication Failure Trap Disabled Mgmt Protocols SNMPv1 amp SNMPv2c View SNMPv1 amp SNMPv2c Communities SNMPv3 SNMP Engine ID 80 00 00 CF 03 00 30 84 AB EF CD View User Table O View View Table Oview Access Table Oview SecurityToGroup Table O View Notify Table O View Target Address Table Oview Target Parameters Table Oview Community Table Figure 104 SNMP Tab Monitoring 4 Inthe SNMPv3 section click the button next to View User Table and then click View at the bottom of the tab Section Ill SNMPv3 279 Chapter 18 SNMPv3 The SNMPv3 User Table tab is shown in Figure 105 stem Name Marketing r 00 30 84 4B EF CD SNMPv3 User Table Total Entries 2 Page lof 1 Authentication Privacy Protocol Protocol blaze SHA DES Nonvo
90. 298 Port Internal Path Cost The port cost of the port if the port is connected to a bridge which is part of the same MSTP region The range is 0 to 200 000 000 The default setting is Auto detect which sets port cost depending on the speed of the port Table 8 lists the MSTP port cost with Auto Update when a port is not part of a port trunk Table 8 MSTP Auto Update Port Internal Path Costs Port Speed Port Cost 10 Mbps 2 000 000 100 Mbps 200 000 1000 Mbps 20 000 Table 9 lists the MSTP port costs with Auto Update when the port is part of a port trunk Table 9 MSTP Auto Update Port Trunk Internal Path Costs Port Speed Port Cost 10 Mbps 20 000 100 Mbps 20 000 323 Chapter 20 Multiple Spanning Tree Protocol 324 Table 9 MSTP Auto Update Port Trunk Internal Path Costs Port Speed Port Cost 1000 Mbps 2 000 MSTI List The MSTIs defined on the switch You can use this list when setting the port priority and port internal path cost parameters to assign different values to a port for each MSTI when the port is a member Before setting priority or internal path cost select the appropriate MSTI where you want the new setting to be applied on the port The default is all MSTIs on the switch The MSTI List shows all of the spanning tree instances on the switch and not just those where the selected port is currently a member If you select an MSTI whe
91. 2P Version Port Cost 17 Disabled 0 Figure 131 MSTP Port Status Port s Page The MSTP Port Status page displays a table with the following columns of information Port The port number State The MSTP state of the port The possible states are Discarding The port is discarding received packets and is not submitting forwarded packets for transmission Learning The port is enabled for receiving but not forwarding packets Forwarding Normal operation Disabled The port has not established a link with its end node Role The MSTP role of the port The possible roles are Root The port that is connected to the root switch directly or through other switches with the least path cost Alternate The port offers an alternate path in the direction of the root switch Backup The port on a designated switch that provides a backup for the path provided by the designated port Designated The port on the designated switch for a LAN that has the least cost path to the root switch This port connects the LAN to the root switch Master Similar to the root port When the port is a boundary port the MSTI port roles follow the CIST port roles The MSTI port role is called master when the CIST role is root 329 Chapter 20 Multiple Spanning Tree Protocol P2P Whether or not the port is functioning as a point to point port The possible settings are Yes No
92. 3 Community Table on page 272 Note Use the SNMPv3 Community Table only if you are configuring the SNMPv3 protocol with an SNMPv1 or an SNMPv2c implementation Allied Telesyn does not recommend this configuration Section Ill SNMPv3 AT S63 Management Software Web Browser Interface User s Guide Enabling or Disabling SNMP Management Section Ill SNMPv3 In order to allow an SNMP manager or host to access the switch you need to enable SNMP access In addition to allow the switch to send a trap when it receives a login attempt from an unauthenticated user you need to enable authentication failure traps This section provides a procedure to accomplish both of these tasks To enable SNMP access and authentication failure traps perform the following procedure 1 From the Home page select Configuration The System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 2 From the Configuration menu select the Mgmt Protocols option The Mgmt Protocols page is displayed with the Server based Authentication tab selected by default as shown in Figure 162 on page 406 3 Select the SNMP tab 223 Chapter 18 SNMPv3 224 The SNMP tab is shown in Figure 79 AT 9424T SP System Name Marketing MAC Addr 00 30 84 AB EF CD Cl Enable SNMP Access Enable Authentication Failure Trap Mgmt Protocols SNMPv1 amp SNMPv2c Configure SNMPv1 amp S
93. 3 View Table This parameter allows the users assigned to this Group Name to send traps permitted in the specified View This value does not need to be unique In the Security Model field enter an SNMP protocol Select one of the following SNMP protocols as the Security Model for this Group Name v1 Select this value to associate the Group Name with the SNMPv1 protocol v2c Select this value to associate the Group Name with the SNMPv2c protocol v3 Select this value to associate the Group Name with the SNMPv3 protocol In the Security Level field enter a security level Select one of the following security levels No Authentication Privacy This option represents neither an authentication nor privacy protocol Select this security level if you do not want to authenticate SNMP entities and you do not want to encrypt messages using a privacy protocol This option provides the least security Note If you have selected SNMPv1 or SNMPv2c N NoAuthNoPriv is the only security level you can select Authentication This option permits an authentication protocol but not a privacy Section Ill SNMPv3 Deleting an Access Table Section Ill SNMPv3 Entry 11 12 13 AT S63 Management Software Web Browser Interface User s Guide protocol Select this security level if you want to authenticate SNMP users but you do not want to encrypt messages using a privacy protocol You can select this value if you confi
94. 4 ff Included Volatile internet 1 3 6 1 Included NonvVolatile O directory 1 3 6 1 1 Included NonvVolatile O experimental ECH GE Excluded NonvVolatile Figure 83 SNMPv3 View Table Tab Configuration 4 Click Add The Add New SNMPv3 View page is shown in Figure 84 wiiren View Name private Subtree OID private Subtree Mask P View Type Included e Storage Type Volatile Row Status Active Figure 84 Add New SNMPv3 View Page 5 Inthe View Name field enter a descriptive name for this view Assign a name that reflects the subtree OID for example internet Enter a unique name of up to 32 alphanumeric characters Section Ill SNMPv3 235 Chapter 18 SNMPv3 236 Note The defaultViewAll value is the default entry for the SNMPv1 and SNMPv2c configuration You cannot use the default value for an SNMPv3 View Table entry In the Subtree OID field enter a subtree that this view will or will not be permitted to display You can enter either a numeric value in hex format or the equivalent text name For example the OID hex format for TCP IP is 1 3 6 1 2 1 6 The text format is for TCP IP is tcp In the Subtree Mask field enter a subtree mask in hexadecimal format This is an optional parameter that is used to further refine the value of the Subtree OID parameter The Subtree OID parameter def
95. 4 43 Spanning Tree Monitor MSTP Parameters Wes Version Revision Level 0 pais Hello Time Root Hello Time 2 Ps Forwarding Root Forwarding 5 Configuration Name Root Max Age Bridge Max Age 20 20 Root Path Cost Bridge Max Hops 0 20 Root Identifier Bridge Identifier 00 21 46 A7 B4 43 00 21 46 A7 B4 43 Monitor CIST Parameters CIST Priority 8 4096 32768 Root ID 00 21 46 A7 B4 43 Root Path Cost 0 Regional Root ID 00 21 46 A7 B4 43 CIST MSTI Table Regional Root Path Cost 0 Total CIST MSTIs 2 Page 1of 1 E CISTMSTI ID Priority VLAN Associations 0 32768 1 1 32768 2 Section IV Spanning Tree Protocols 5 Figure 129 Monitor MSTP Parameters Tab Monitoring The Monitor MSTP Parameters section displays the current MSTP parameter settings and the settings for the same parameters from the root bridge of the spanning tree domain For definitions of the parameters refer to Configuring MSTP Parameters on page 314 To view MSTP port settings or status click a port You can select more than one port 327 Chapter 20 Multiple Spanning Tree Protocol 328 6 In the CIST MSTI field specify the MSTI where the port is a member through its VLAN assignment You can specify only one value The default is 0 for CIST Click Settings or Status The MSTP Settings Port s page is shown in Figure 130 T st setings bei Total Ports Selected 1 Page 1 of 1
96. 4T SP switches do not support the IPv4 packet routing feature However these switches do allow you to create one routing interface as a means of assigning an IP address to the units to support those management functions where an IP address is necessary Version 1 3 0 AT S63 Management Software Web Browser Interface User s Guide Note When an AT 9400 Series switch with an IP address is upgraded from AT S63 version 1 3 0 or earlier to the latest version a routing interface is automatically created on the device to preserve its IP configuration The interface is assigned to the same VLAN that functioned as the switch s management VLAN If the switch does not have an IP address no routing interface is created For further information on routing interfaces refer to Chapter 32 Internet Protocol Version 4 Packet Routing in the latest version of the AT S63 Management Software Command Line Interface User s Guide Table 2 list the new features in version 1 3 0 of the AT S63 management software For background information on the new features refer to the AT S63 Management Software Menus Interface User s Guide Table 2 New Features in AT S63 Version 1 3 0 Feature Change Chapter and Procedure 802 1x port based network access control Added the following new features o GUESTVLAN parameter for supporting Guest VLANs oO VLANASSIGNMENT and SECUREVLAN parameters for supporting dynamic VLAN as
97. 5 on page 44 This procedure discusses the parameters in the IP Configuration section of the web page Obtain IP Address from The options in this section indicate the source of the IP address of the local interface If DHCP or BOOTP is checked the interface obtained its IP address from a DHCP or BOOTP server on the network If Static is checked the IP address was set manually IP Address This parameter displays the IP address of the local management interface This address is either manually assigned to the interface or obtained from a DHCP or BOOTP server Subnet Mask This parameter specifies the subnet mask for the interface The IP address and subnet mask fields will be empty if no interface has been designated as the local interface Default Gateway For AT 9400 Series switches that support IPv4 routing such as the AT 9448Ts and AT 9448Ts XP switches this field displays the IP address of the next hop of the switch s default route The switch uses the default route when it receives a network packet for routing but cannot find a route for it in the routing table This field will contain 0 0 0 0 if no default route is defined on the switch For AT 9400 Series switches that do not support IPv4 packet routing such as the AT 9424T GB and AT 9424T SP switches this field displays the default gateway address This is the IP address of a router interface on your network The switch s management software uses 55 Chapter 2 Bas
98. 50 SNMPv3 Target Address Table entry creating 258 deleting 261 displaying 284 modifying 262 SNMPv3 Target Parameters Table entry creating 265 deleting 268 displaying 285 modifying 269 SNMPv3 User Table entry creating 226 deleting 229 displaying 278 modifying 230 SNMPv3 View Table entry creating 234 deleting 237 displaying 280 modifying 237 SNTP See Simple Network Time Protocol SNTP software information 57 Spanning Tree Protocol RSTP parameters displaying 298 Spanning Tree Protocol STP bridge forwarding delay 296 bridge hello time 296 bridge identifier 297 bridge max age 296 bridge parameters configuring 294 bridge priority 295 disabling 292 312 enabling 292 312 parameters displaying 298 port cost 298 port priority 297 resetting to defaults 300 SSH See Secure Shell SSH SSL See Secure Sockets Layer SSL static MAC address adding 97 deleting 99 static unicast MAC address displaying 94 STP ID 362 STP See Spanning Tree Protocol STP supplicant port start period 382 supplicant timeout 378 AT S63 Management Software Web Browser Interface User s Guide switch W hardware information 57 web browser management session software information 57 quitting 38 switch name configuring 44 starting 33 switch rebooting 51 system date setting 48 system file downloading 130 uploading 134 system name configuring 45 system time setting 48 T TACACS configuring 408 disabling 406 displaying settings 410 en
99. AT S63 Management Software to the Factory Default Values on page 53 Q Displaying the IP Address of the Local Interface on page 55 Q Displaying System Information on page 57 43 Chapter 2 Basic Switch Parameters Configuring the Switch s Name Location and Contact This procedure assigns a name to the switch The name appears at the top of the web browser windows Names can help you identify your switches when you manage them and avoid performing a configuration procedure on the wrong switch This procedure also assigns the name of the administrator responsible for maintaining the unit and the location of the switch To assign a name location and contact to a switch perform the following procedure 1 From the home page select Configuration The System page is displayed with the General tab selected by default as shown in Figure 5 ii a System Name IP Configuration __Momt Security Marketing Obtain IP Address From Administrator Static DHCP BOOTP C post Protocols a EE C Network Security EE Error Services Building 212 rm 502 Subnet Mask C es Defaut Gateway passwords Manager Password Operator Password Confirm Manager Password Confirm Operator Password Figure 5 General Tab Configuration 44 Section Basic Operations AT S63 Management Software Web Browser Interface User s Guide Note This procedure describes the System Name
100. Aa Fix Aa Fix Aa Fix Fix Aa Fix Aa Fix Fix Aa Fix Aa Fix Fix Aa Fix Aa Fix Fix Aa Fix Aa Fix Fix Aa Fix Aa Fix Fix Aa Fix Figure 141 GVRP State Machine for VLAN Page The GVRP State Machine for VLAN page provides the information shown in Table 12 Table 12 GVRP State Machine Parameters Parameter Meaning Port Port number on the switch this port belongs to the GARP application If the GARP application has no ports No ports have been assigned is displayed 356 Section V Virtual LANs Section V Virtual LANs AT S63 Management Software Web Browser Interface User s Guide Table 12 GVRP State Machine Parameters Continued Parameter Meaning App Applicant state machine for the GID index on that particular port One of Normal Participant Management state Vo Very Anxious Observer Ao Anxious Observer Qo Quiet Observer Lo Leaving Observer Vp Very Anxious Passive Member Ap Anxious Passive Member Qp Quiet Passive Member Va Very Anxious Active Member Aa Anxious Active Member Qa Quiet Active Member La Leaving Active Member App Continued Non Participant Management state Von Very Anxious Observer Aon Anxious Observer Qon Quiet Observer Lon Leaving Observer Vpn
101. Access Control Section VI Port Security This chapter contains instructions on how to configure the 802 1x Port based Network Access Control feature on the switch The chapter contains the following sections O Setting Port Roles on page 372 o Enabling or Disabling 802 1x Port based Network Access Control on page 374 o Configuring Authenticator Port Parameters on page 375 0 Configuring Supplicant Port Parameters on page 381 o Displaying the Port based Network Access Control Parameters on page 383 ao RADIUS Accounting on page 387 Note For background information refer to Chapter 31 802 1x Port based Network Access Control in the AT S63 Management Software Menus Interface User s Guide 371 Chapter 24 802 1x Port based Network Access Control Setting Port Roles To set port roles for port based network access control perform the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the Network Security option 3 Select the 802 1x Port Access tab The 802 1x Port Access tab is shown in Figure 148 Authentication Method RADIUS EAP ze Trigger Type Start Stop v Port Number 1813 C Enable update Figure 148 802 1x Port Access Tab Configuration The image of the switch displays the roles of the ports An A indicates an authenticator port and an S a supplica
102. Address Table O Configure Target Parameters Table Configure Community Table Figure 13 SNMP Tab Configuration 4 Click the Enable SNMP Access checkbox to enable or disable SNMP management A check in the box indicates the feature is enabled meaning the switch can be managed from an SNMP management station No check indicates the feature is disabled The default is disabled Section Basic Operations Section I Basic Operations 5 AT S63 Management Software Web Browser Interface User s Guide If you want the switch to send authentication failure traps click the Enable Authentication Failure Traps checkbox A check in the box indicates the switch sends the trap Click Apply A change to SNMP access is immediately activated on the switch To permanently save your changes select the Save Config option in the Configuration menu 71 Chapter 4 SNMPv1 and SNMPv2c Creating a New SNMPv1 and SNMPv2c Community To create anew SNMPv1 and SNMPv2c community perform the following procedure 1 From the Home page select Configuration 2 From the Configuration menu select the Mgmt Protocols option 3 Select the SNMP tab The SNMP tab is shown in Figure 13 on page 70 4 Inthe SNMPv1 amp SNMPv2c section click Configure The SNMPv1 amp SNMPv2c Communities tab is shown in Figure 14 SNMPv1 amp SNMPv2c Communities Total Entries 3 Page lof 1 Community Name Access Manage
103. Configuration menu select the Services option 3 Select the Traffic Class tab The Traffic Class tab is shown in Figure 64 on page 190 4 Select the traffic class to be modified and click Modify The Modify Traffic Class page is shown in Figure 66 ModifytrafficGless ID Description 12 Gen Exceed Action Exceed Remark value Feet Eer DROP _ i 0 0 63 DSCH Value Max Bandwidth 62 0 63 0 101 6 Burst Size Priority 4 512 0 7 Remark Priority YES v ToS Move ToS To Priority w No w Move Priority To ToS Flow Group List NO y o w Figure 66 Modify Traffic Class Page 5 Configure the parameters as necessary For parameter definitions refer to Configuring a Traffic Class on page 190 6 When you are finished modifying the parameters click Apply The changes are immediately implemented in the traffic class 7 To permanently save your changes select the Save Config menu selection Section Il Advanced Operations 195 Chapter 15 Quality of Service Deleting a Traffic This procedure explains how to delete a traffic class If the traffic class to 196 Class e deleted is already part of a QoS policy assigned to one or more switch ports you must first modify the policy by removing the port assignments before you can delete the traffic class You can reassign the ports back to the policy after you have deleted the traffic class To delete a traffic class perfo
104. Creating an ACE on page 420 Section VII Management Security 423 Chapter 28 Management Access Control List 424 Section VII Management Security Index Numerics 802 1x Port based Network Access Control access role configuring 372 authenticator port configuring 375 configuring 372 disabling 374 enabling 374 port parameters displaying 385 port role configuring 372 port status displaying 383 supplicant port configuring 381 A active boot configuration file setting 127 administrator name configuring 45 aging time changing 101 app applicant state machine 357 AT S63 software resetting to factory defaults 53 auth period 381 authentication protocols enabling or disabling 406 automatic port security level 367 autonegotiation configuring 82 B back pressure configuring 84 boot configuration file 127 bridge forwarding delay Multiple Spanning Tree Protocol MSTP 316 Rapid Spanning Tree Protocol RSTP 304 Spanning Tree Protocol STP 296 bridge hello time Multiple Spanning Tree Protocol MSTP 316 Rapid Spanning Tree Protocol RSTP 304 Spanning Tree Protocol STP 296 bridge identifier Rapid Spanning Tree Protocol RSTP 304 Spanning Tree Protocol STP 297 bridge max age Multiple Spanning Tree Protocol MSTP 316 Rapid Spanning Tree Protocol RSTP 304 Spanning Tree Protocol STP 296 bridge priority Rapid Spanning Tree Protocol RSTP 303 Spanning Tree Protocol STP 295 bridge protocol data
105. Disabling SNMP Management on page 223 Configuring the SNMPv3 User Table on page 226 Configuring the SNMPv3 View Table on page 234 Configuring the SNMPv3 Access Table on page 240 Configuring the SNMPv3 SecurityToGroup Table on page 247 Configuring the SNMPv3 Notify Table on page 253 Configuring the SNMPv3 Target Address Table on page 258 Configuring the SNMPv3 Target Parameters Table on page 265 Configuring the SNMPv3 Community Table on page 272 Displaying SNMPv3 Tables on page 278 WS WS WS WS US US WS WS US E Note For background information refer to Chapter 21 SNMPv3 in the AT S63 Management Software Menus Interface User s Guide Section Ill SNMPv3 221 Chapter 18 SNMPv3 Configuring the SNMPv3 Protocol 222 To configure the SNMPv3 protocol you need to first enable SNMP access on the switch Then you configure the SNMPv3 tables See the following procedures UU D DUU n Enabling or Disabling SNMP Management on page 223 Configuring the SNMPv3 User Table on page 226 Configuring the SNMPv3 View Table on page 234 Configuring the SNMPv3 Access Table on page 240 Configuring the SNMPv3 SecurityToGroup Table on page 247 Configuring the SNMPv3 Notify Table on page 253 Configuring the SNMPv3 Target Address Table on page 258 Configuring the SNMPv3 Target Parameters Table on page 265 Configuring the SNMPv
106. Edge Port Point to Point External Cost Internal Cost Priority Port 15 Yes Auto Detect 200000 Auto Update 128 Figure 130 MSTP Settings Port s Page The MSTP Settings page displays a table that contains the following columns of information Port The port number Edge Port Whether the port is functioning as an edge port The possible settings are Yes and No Point to Point Whether the port is functioning as a point to point port The possible settings are Yes No and Auto Detect External Cost The port cost of the port if the port is connected to a bridge which is a member of another MSTP region or is running STP or RSTP Internal Cost The port cost of the port if the port is connected to a bridge which is part of the same MSTP region If the setting is Auto Update the port cost is set automatically depending on the speed of the port Default values are 2 000 000 for 10 Mbps ports 200 000 for a 100 Mbps ports and 20 000 for one gigabit ports Priority This parameter is used as a tie breaker when two or more ports are determined to have equal costs to the regional root bridge Section IV Spanning Tree Protocols Section IV Spanning Tree Protocols AT S63 Management Software Web Browser Interface User s Guide The MSTP Port Status Port s page is shown in Figure 131 STP Port Status Pons 17 Total Ports Selected 1 Page 1of1 Port State CISTMSTI ID Role P
107. Figure 46 Description D 2 1 9999 Destination MAC Source MAC 1 Hk Ethernet Format Any Priority VLAN ID 0 7 1 4094 Protocol IP TOS DSCP None Source IP H Source IP Mask LI LU Destination IP Address Destination IP Mask LL l ste IP Protocol User Specified IP Protocol User Specified E Figure 46 Create Classifier Page IP Protocol 5 Configure the following parameters as desired ID Specifies an ID number for the classifier Every classifier on the switch must have a unique ID number The range is 1 to 9999 This parameter is required Description Specifies a description for the classifier A description can be up to fifteen alphanumeric characters Spaces are allowed Destination MAC Defines a traffic flow by its destination MAC address Source MAC Defines a traffic flow by its source MAC address 156 Section Il Advanced Operations Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide Ethernet Format Defines a traffic flow by the format of the Ethernet packets Selections are o Untagged Ethernet II untagged packets o Tagged Ethernet II tagged packets 0 802 2 untagged Ethernet 802 2 untagged packets ao 802 2 tagged Ethernet 802 2 tagged packets Priority Defines a traffic flow by the user priority level in tagged Ethernet frames The range is 0 to 7 VLAN ID Defines a traffic flow of tagged p
108. Figure 91 Modify SNMPv3 SecurityTOGroup Page etter teste eteeeeee tienes eeetaeeeeeetiaeeeeeetiaeeenenea 251 Figure 92 SNMPv3 Notify Table Tab Conftouraton 254 Figure 93 Add New SNMPV3 Notify Page 0 ee eecceeeee centre eee ente eee EA EE EEE EAE E EREA AERE A EARRAS 254 Figure 94 Modify SNMPv3 Notify Page iiai e i TEE EA A EEE ae eee Ai E AEREE REAREA SATR ET 256 Figure 95 SNMPv3 Target Address Table Tab Confouraton 259 Figure 96 Add New SNMPVv3 Target Address Page 259 Figure 97 Modify SNMPv3 Target Address Page 262 Figure 98 SNMPv3 Target Parameters Table Tab Configuration ccccecceceeceeeeeeeenceeeeeeeeeeeeeeseeneaeeees 265 Figure 99 Add New SNMPVv3 Target Parameters Page isesseesssesrirsseserrssstrrssstrtrrsstttrnssstentrsnttennssstennnent 266 Figure 100 Figure 101 Figure 102 Figure 103 Figure 104 Figure 105 Figure 106 Figure 107 Figure 108 Figure 109 Figure 110 Figure 111 Figure 112 Modify SNMPv3 Target Parameter Page asessseesessseesesrnneessrnreesirnnnessennadestenneeetnaneentnennesttanneenenn 269 SNMPv3 Community Table Tab Confouraton 273 Add New SNMPv3 Community Page 273 Modify SNMPv3 Community Page eare a a anaE AEA aR EIERE ARRS S 276 SNMP TAPONO ee E E A ATE E TO TO T 279 SNMPv3 User Table Tab Monitoring 280 SNMPv3 View Table Tab Monitoring ccceeceeceeeeeeneeeeeeeenaeeeseeeaeeeeeeeaaaeeeseeeaaeeeseeenaeeeeeeaaas 281 SNMPv3 Access Table Tab Moni
109. MP tab is shown in Figure 79 on page 224 3 In the SNMPv3 section click the button next to Configure Target Address Table and then click Configure at the bottom of the tab The SNMPv3 Target Address Table tab is shown in Figure 95 on page 259 4 Click Next or Previous to display the SNMPv3 Target Address Table entry to be deleted 5 Click Remove A warning message is displayed 6 Click OK 7 To permanently save your changes select the Save Config option in the Configuration menu 261 Chapter 18 SNMPv3 Modifying Target 262 Address Table Entry To modify an entry in the SNMPv3 Target Address Table perform the following procedure 1 6 From the home page select Configuration The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 In the SNMPv3 section click the button next to Configure Target Address Table and then click Configure at the bottom of the tab The SNMPv3 Target Address Table tab is shown in Figure 95 on page 259 Click Next or Previous to display the Target Address Table entry to be changed Click Modify The Modify SNMPv3 Target Address page is shown Figure 97 T Moaity sumPv3 Target Aadaress Target Address Name snmpy3host50 IP Address 1192 1 1 1 UDP Port Number 162 Timeout 1500 Retries is Tag List
110. MULTICAST for displaying and deleting dynamic unicast and multicast MAC addresses The web interface supports displaying MAC addresses as explained in Chapter 6 MAC Address Table on page 93 but not the new parameters The new parameters are only supported in the CLI interface Quality of Service Added the following new parameters to QoS flow groups traffic classes and policies O ToS parameter for replacing the Type of Service field of IPv4 packets O Move ToS to Priority parameter for replacing the value in the 802 1p priority field with the value in the ToS priority field on IPv4 packets O Move Priority to ToS parameter for replacing the value in the ToS priority field with the 802 1p priority field on IPv4 packets The web browser interface supports flow groups traffic classes and policies as explained in Chapter 15 Quality of Service on page 183 but not the new parameters The new parameters are supported in the menus and command line interfaces 24 AT S63 Management Software Web Browser Interface User s Guide Table 3 New Features in AT S63 Version 1 2 0 Feature Change Chapter and Procedure Quality of Service continued O Send to Mirror Port parameter for copying traffic to a destination mirror port This parameter only applies to QoS policies MLD Snooping MAC address based VLANs New feature New feature This feature is
111. Management Software AT S63 Web Browser Interface User s Guide AT 9400 Series Layer 2 Gigabit Ethernet Switches Version 2 0 0 PN 613 50592 00 Rev E A Allied Telesyn Copyright 2006 Allied Telesyn Inc All rights reserved No part of this publication may be reproduced without prior written permission from Allied Telesyn Inc Microsoft and Internet Explorer are registered trademarks of Microsoft Corporation Netscape Navigator is a registered trademark of Netscape Communications Corporation All other product names company names logos or other designations mentioned herein are trademarks or registered trademarks of their respective owners Allied Telesyn Inc reserves the right to make changes in specifications and other information contained in this document without prior written notice The information provided herein is subject to change without notice In no event shall Allied Telesyn Inc be liable for any incidental special indirect or consequential damages whatsoever including but not limited to lost profits arising out of or related to this manual or the information contained herein even if Allied Telesyn Inc has been advised of known or should have known the possibility of such damages Contents PROTACG ed ie es casos ee Ee See Ee 17 How This Guide is OrganiZed i ci iesse ntde devin te E e ta ee etd et a teeta eee 18 Document Conmventions cee eeee cece EE E A 19 Whereto Find Web
112. NEE EEN 79 Figure 18 Port Settings Tab Confiouraton eent 80 Figure 19 Port Configuration Page 81 Figure 20 Port Settings Tab Monitoring 87 Figure MEET 88 Figure 22 Port Statistics Pages EE EE 89 Chapter 6 MAC Address Table 0 cccccicascesvessasnnnnstetecessasnvarseapnnanteceeeendtnannaadusongesenenetearaniaduaesncasengedaneretcean ens 93 Figure 23 MAC Address Tab Configuration ccccccccceeeeeeeeeeenee eee eeeeaeeeeeeeeaeeeeseeeaaaeeeeeeeaaeeeseeenaeeeeeneeaas 94 Figure 24 View MAC Addresses Page ccecscecsececeeeeseeteeeseneeetecseeseseeeneaseeeesneneaeeeesnnaateseessenseseeseenseeeneneenes 96 Figure 25 Add MAC Addr ss Kapen eene ed 97 Chapter 7 Static Port Trunke riismon niaaa nara sa tiene aaa aa aa a cece sihdect dvvsedsaeseuntdeceiisctvecensestveteccecentedeeceets 103 Figure 26 Port Trunking Tab Confouraton nanen 105 Figure 27 Add New Trunk Page cccccceccccceeeeeencceeeeeeeaeeeeeeeeaceeeeesaaaeedeessaeaeedenssaseesdtbeasadedeebaaeeedteessaeeedenesas 106 Figure 28 Modify Trunk Page EE 109 Figure 29 Port Trunking Tab Monitoring cccecceeeeeeeeee eee eeeeeeeeeeeeeeee eee eaeeeeeeeeeeeeeeeneeeeeeetieeeessiaeeeeeeee 111 Chapter 8 Port Minroring WEE 113 Figure 30 Port Mirroring Tab Confouraton eee eaeeeeeeeaaeeeeeesiaeeeeeetaeeeeeesaeeeeeee 114 Figure 31 Modify Mirror Page icraata E Ea a EE ERE EAA OPREA EAEE RRE 115 Figure 32 Example of a Modify Mirror Page eee
113. NMPv2c Communities SNMPv3 SNMP Engine ID 80 00 00 CF 03 00 30 84 AB EF CD Configure User Table O Configure View Table O Configure Access Table O Configure SecurityToGroup Table O Configure Notify Table O Configure Target Address Table O Configure Target Parameters Table O Configure Community Table Figure 79 SNMP Tab Configuration 4 Click the Enable SNMP Access checkbox to enable or disable SNMP management A check in the box indicates that the feature is enabled meaning that the switch can be managed from an SNMP management station No check indicates that the feature is disabled The default is disabled Use this parameter to enable the switch to be remotely managed with an SNMP application program Note If the Enable SNMP Access check box is not checked the switch cannot be managed through SNMP This is the default 5 If you want the switch to send authentication failure traps click the Enable Authentication Failure Traps checkbox A check in the box indicates that the switch sends the trap 6 Click Apply Section Ill SNMPv3 AT S63 Management Software Web Browser Interface User s Guide 7 To permanently save your changes select the Save Config option in the Configuration menu Section Ill SNMPv3 225 Chapter 18 SNMPv3 Configuring the SNMPv3 User Table 226 Creating a User Table Entry You can create delete and modify an SNMPv3 User Table entry See the foll
114. NONE to a super user In the Authentication Password field enter an authentication password of up to 32 alphanumeric characters In the Confirm Authentication Password field re enter the authentication password Note If you have the nonencrypted version of the AT S60 software then the Privacy Protocol field is read only Note You can only configure the Privacy Protocol if you have configured the Authentication Protocol with the MD5 or SHA values In the Privacy Protocol field enter one of the following options DES Select this value to make the DES privacy or encryption protocol the Section Ill SNMPv3 Deleting a User Table Entry Section Ill SNMPv3 10 11 12 13 14 AT S63 Management Software Web Browser Interface User s Guide privacy protocol for this User Table entry With this selection messages transmitted between the host and the switch are encrypted with the DES protocol None Select this value if you do not want a privacy protocol for this User Table entry With this selection messages transmitted between the host and the switch are not encrypted In the Privacy Password field enter a privacy password of up to 32 alphanumeric characters In the Confirm Privacy Password field re enter the privacy password In the Storage Type field enter one of the following storage options for this table entry Volatile Select this storage type if you do not want the ability to s
115. P VLAN Port based and tagged VLANs and multiple VLAN modes Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide Figure 38 shows an example of an event log in Normal mode Events view eebe O O O O O O oO 04 20 04 06 56 54 04 20 04 06 56 54 04 20 04 06 56 54 04 20 04 06 56 55 04 20 04 06 56 55 04 20 04 06 56 55 04 20 04 06 56 55 04 20 04 06 56 56 04 20 04 06 56 56 04 20 04 06 56 56 file File System initialized http Server reset to defaults ssh SSH server disabled cfg Configuration initialized tacacs TACACS initialized radius RADIUS initialized garp GARP initialized qos Number of Egress Queues setto 8 qos Priority 0 mapped to Egress Queue 0 qos Priority 1 mapped to Egress Queue 1 Section Il Advanced Operations Figure 38 Event Log Example Displayed in Normal Mode The columns in the table are defined here Severity The event s severity The severity codes and their corresponding severity level and description are listed in Table 3 Table 3 Event Severity Levels Severity ke Code Severity Level Description E Error Switch operation is severely impaired W Warning An issue that may require network manager attention Information Useful information that can be ignored during normal operation D Debug Messages intended for technical support and software development Date and Time T
116. P Messages JoinIn Total number of GARP JoinIn messages received for all attributes in the GARP application Transmit GARP Messages JoinIn Total number of GARP JoinIn messages transmitted for all attributes in the GARP application Receive GARP Messages LeaveEmpty Transmit GARP Messages LeaveEmpty Total number of GARP LeaveEmpty messages received for all attributes in the GARP application Total number of GARP LeaveEmpty messages transmitted for all attributes in the GARP application Receive GARP Messages Leaveln Total number of GARP Leaveln messages received for all attributes in the GARP application Transmit GARP Messages Leaveln Total number of GARP Leaveln messages transmitted for all attributes in the GARP application Receive GARP Messages Empty Total number of GARP Empty messages received for all attributes in the GARP application Transmit GARP Messages Empty Total number of GARP Empty messages transmitted for all attributes in the GARP application Receive GARP Messages Bad Message Receive GARP Messages Bad Attribute Number of GARP messages that had an invalid Attribute Type value an invalid Attribute Length value or an invalid Attribute Event value Number of GARP messages that had an invalid Attribute Value value Section V Virtual LANs 361 Chapter 22 GARP VLAN Registration Protocol Displaying the GIP Connected Ports R
117. Permit ACL in which case the packets are accepted by the port because a Permit ACL overrides a Deny ACL Active Whether or not the ACL is active A status of Yes means that the ACL is assigned to at least one port on the switch A status of No means the ACL is not assigned to any ports and therefore is inactive Classifier List The classifiers assigned to the ACL Port List The port assignments of the ACL To create a new ACL click Create The Create ACLs page is displayed as shown in Figure 50 ID Description 0 255 Classifier List Port List 1 1 o 2 v Action DENY x Figure 50 Create ACLs Page Configure the following parameters ID Use this field to enter an ID number for the ACL Every ACL on the switch must have a unique ID number The range is 0 to 255 Classifier List Use the list to select the classifier to be assigned to the ACL You can assign more than one classifier to an ACL To select multiple classifiers hold down the Ctrl key while making your selections To view the classifiers on a switch refer to Displaying the Classifiers on page 163 An ACL must have at least one classifier 167 Chapter 13 Access Control Lists 168 Action Use this menu to specify the action of the ACL An action of Permit means the port accepts the packets that meet the criteria of the classifiers assigned to the ACL An action of Deny means the port discards the packets unless the pa
118. Port Whether the examined traffic is copied to a mirror port Section Il Advanced Operations Chapter 17 IGMP Snooping This chapter describes how to configure the IGMP snooping feature on the switch The sections in the chapter include 0 Configuring IGMP Snooping on page 212 0 Displaying a List of Host Nodes on page 215 o Displaying a List of Multicast Routers on page 217 Note For background information refer to Chapter 18 IGMP Snooping in the AT S63 Management Software Menus Interface User s Guide Section Il Advanced Operations 211 Chapter 17 IGMP Snooping Configuring IGMP Snooping To configure IGMP snooping perform the following procedure 1 2 From the home page select Configuration From the Configuration menu select the Multicast option The Multicast page is displayed with the IGMP tab selected by default as shown in Figure 76 3 212 Multicast AT 9424T SP System Name Marketing MAC Addr 00 30 84 4B EF CD C Enable IGMP Snooping Host Route Timeout Interval 0 to 86400 Multicast Host Topology 260 seconds Ka Single Host Port Edge Maximum Multicast Groups 0 to 256 Multi Hosts Port Intermediate 64 Multicast Router Ports Mode Auto Detect Manual Select Figure 76 IGMP Tab Configuration Configure the following parameters as necessary Enable IGMP Snooping Status Enables and disables IGMP s
119. Privacy Protocol Privacy Password Confirm Privacy Password Storage Type NonVolatile ze Row Status Active Figure 81 Add New SNMPv3 User Page 5 Inthe User Name field enter a name or logon id that consists of up to 32 alphanumeric characters Section Ill SNMPv3 227 Chapter 18 SNMPv3 228 6 9 In the Authentication Protocol field enter an authentication protocol This is an optional parameter Select one of the following MD5 This value represents the MD5 authentication protocol With this selection users SNMP entities are authenticated with the MD5 authentication protocol after a message is received This algorithm generates the message digest The user is authenticated when the authentication protocol checks the message digest With the MD5 selection you can configure a Privacy Protocol SHA This value represents the SHA authentication protocol With this selection users are authenticated with the SHA authentication protocol after a message is received This algorithm generates the message digest The user is authenticated when the authentication protocol checks the message digest With the SHA selection you can configure a Privacy Protocol None This value represents no authentication protocol When messages are received users are not authenticated With the None selection you cannot configure a Privacy Protocol Note You may want to assign
120. RP on a Port To enable or disable GVRP on a port perform the following procedure 1 2 352 From the home page select Configuration From the Configuration menu select the Layer 2 option Select the GVRP tab The GVRP tab is shown in Figure 136 on page 350 In the GVRP Port Configuration section click the ports to be to configured Click Modify The GVRP Port Configuration page is shown in Figure 137 Port Mode Normal None Figure 137 GVRP Port Configuration Page Click Normal to have the port propagate GVRP information or None to prevent processing GVRP information and transmitting PDUs Click Apply to activate the change or Cancel to cancel To permanently save your changes select the Save Config option in the Configuration menu Section V Virtual LANs AT S63 Management Software Web Browser Interface User s Guide Displaying the GVRP Configuration Section V Virtual LANs To display the GVRP configuration perform the following procedure 1 2 From the Home page select Monitoring From the Monitoring menu select the Layer 2 option Select the GVRP tab The GVRP tab is shown in Figure 138 mer emp Parameters GVRP is Disabled GIP is Enabled TI Mgmt Security Leave Time Leave All Time 60 CentiSeconds 1000 CentiSeconds L Mgmt Protocols bi ina Multicast View GVRP Parameters Utilities View Port Configuration View GVRP C
121. S _USERS_2 00 30 84 F 3 85 00 SV_USERS_5 00 30 84 F3 B6 20 S V_USERS_3 00 30 84 F3 C9 40 S V_USERS_ 563 v2 0 0 AT 9448T SP 63 v2 0 0 AT 9448T SP 563 v2 0 0 AT 9448T SP 63 v2 0 0 AT 9424T SP 63 v2 0 0 AT 9424T SP 39 v3 2 0 AT 8026T 39 v3 2 0 AT 8026T 63 v1 2 0 AT 9424T SP 63 v1 2 0 AT 9424T SP 63 v1 2 0 AT 9424T SP OOOOOOOOOe Figure 11 Stacking Switches Page 64 Section Basic Operations Section I Basic Operations AT S63 Management Software Web Browser Interface User s Guide Note The list does not include the master switch where you started the management session nor any switches with an enhanced stacking status of Unavailable You can sort the switches in the list by switch name or MAC address by clicking on the column headers By default the list is sorted by MAC address To refresh the list click Refresh To start a management session on another switch in the enhanced stack click the button to the left of the switch in the list You can select only one switch Note The web server mode i e HTTP or HTTPS must be the same on both the master switch and slave switch For example a master switch operating in the default HTTP mode can be used to manage switches configured for HTTP but not HTTPS For information on HTTPS refer to the AT S63 Management Software Menus Interface User s Guide Click Connect Enter a user name and passwor
122. T S63 Management Software Web Browser Interface User s Guide Displaying the SSL Settings To configure the SSL settings you must use the AT S63 menus or command line interface For information refer to the AT S63 Management Software Menus Interface User s Guide and the AT S63 Management Software Command Line Interface User s Guide To display the SSL settings perform the following procedure 1 From the Home page select Monitoring 2 From the Monitoring menu select the Mgmt Protocols option 3 Select the SSL tab The SSL tab is shown in Figure 156 Maximum Number of Sessions is 50 Session Cache Timeout is 300 seconds Mgmt Protocols Figure 159 SSL Tab Monitoring The SSL tab provides the following information Maximum Number of Sessions The maximum number of SSL sessions allowed at one time Session Cache Timeout The length of time before the session cache times out in seconds Section VI Management Security 397 Chapter 25 Encryption Keys PKI and SSL 398 Section VII Management Security Chapter 26 Secure Shell SSH Section VII Management Security This chapter explains how to configure the Secure Shell SSH protocol and contains the following sections o Configuring SSH on page 400 o Displaying the SSH Settings on page 402 Note For background information refer to Chapter 35 Secure Shell SSH in the AT S63 Management Softwar
123. The TACACS client configuration page is shown in Figure 165 Global Secret Global Server Timeout 1 300 Winner 30 second s 149 32 14 237 RC Corp 149 32 14 248 RC Corp 149 32 14 248 Figure 165 TACACS Client Configuration Page The upper portion of the page provides the following information Global Secret The TACACS server encryption secret Global Server Timeout The maximum amount of time the switch waits for a response from a TACACS server The lower portion of the page displays a table with the following columns of information Server The server number one of three IP Address IP addresses of up a network server containing TACACS server software Encryption Key Encryption key for the server This parameter is blank if the key is specified in the global secret Section VII Management Security 411 Chapter 27 TACACS and RADIUS Protocols Configuring the RADIUS Client Settings To configure the RADIUS client perform the following procedure 1 From the home page select Configuration 2 Select the Mgmt Protocols option The Mgmt Protocols tab is displayed with the Server based Authentication tab selected by default as shown in Figure 162 on page 406 In lower section of the Server based Authentication tab click RADIUS Configuration and click Configure The RADIUS Client Configuration page is shown in Figure 163 4 412 Global Encryption Key Global Se
124. VID Enter a VID value for the new VLAN The range of the VID value is 2 to 4096 The default is the next available VID number on the switch If this VLAN is unique in your network then its VID should also be unique If this VLAN is part of a larger VLAN that spans multiple switches then the VID value for the VLAN should be the same on each switch For example if you are creating a VLAN called Sales that spans three switches you should assign the Sales VLAN on each switch the same VID value Note A VLAN must have a VID The switch is only aware of the VIDs of the VLANs on the device and not those already being used in the network For example if you add a new AT 9400 Series switch to a network where the existing VLANs Secton V Virtual LANs Secton V Virtual LANs AT S63 Management Software Web Browser Interface User s Guide use VIDs 2 through 24 the default VID value for the first VLAN created on the switch is still VID 2 even though that number is already being used To prevent inadvertently using the same VID for two different VLANs you should keep a list of all your network VLANs and their VID values Name Specify a name for the new VLAN The name can be from one to fifteen alphanumeric characters in length The name should reflect the function of the nodes that are part of the VLAN for example Sales or Accounting The name cannot contain spaces or special characters such as asterisks or exclamation poin
125. able After making changes to an SNMPv3 Community Table entry with a Volatile storage type the Save Config option is not displayed on the Configuration menu NonVolatile Select this storage type if you want the ability to save an entry in the SNMPv3 Community Table After making changes to an SNMPv3 Community Table entry with a NonVolatile storage type the Save Config option is displayed on the Configuration menu Allied Telesyn recommends this storage type Note The Row Status parameter is a read only field in the web browser interface The Active value indicates the SNMPv3 Community Table entry takes effect immediately 9 Click Apply to update the SNMPv3 Community Table 10 To permanently save your changes select the Save Config option in the Configuration menu Section III SNMPv3 277 Chapter 18 SNMPv3 Displaying SNMPv3 Tables 278 Displaying User Table Entries This section contains procedures to display the SNMPv3 Tables The following procedures are provided WS US WS WS 00 0 Displaying User Table Entries next Displaying View Table Entries on page 280 Displaying Access Table Entries on page 281 Displaying SecurityToGroup Table Entries on page 282 Displaying Notify Table Entries on page 283 Displaying Target Address Table Entries on page 284 Displaying Target Parameters Table Entries on page 285 Displaying SNMPv3 Community Table Entries on page
126. abling 406 server timeout configuring 412 tagged VLAN creating 336 deleting 343 displaying 345 modifying 341 threshold 368 traffic class configuring 190 deleting 196 displaying 196 modifying 195 tx period configuring 378 U unavailable status defined 62 uplink port configuring 344 displaying 337 346 user name configuring 382 default 34 user password configuring 382 V versions supported SSH parameter 402 virtual LAN VLAN creating 336 deleting 343 displaying 345 mode selecting 344 modifying 341 VLAN type port based or tagged VLAN 339 429 Index 430
127. accounts The default is 30 seconds The range is 1 to 30 seconds IP Address and Encryption Key Specify the IP addresses and encryption secrets of up to three TACACS servers You can leave an encryption field blank if you entered the server s secret in the Global Secret field The maximum length is 39 characters Click Apply TO permanently save your changes select the Save Config option in the Configuration menu 409 Chapter 27 TACACS and RADIUS Protocols Displaying the TACACS Client Settings To display the TACACS client settings on the switch perform the following procedure 1 From the Home page select Monitoring 2 Select the Mgmt Protocols option The Mgmt Protocols tab is displayed with the Server based Authentication tab selected by default as shown in Figure 164 Server based Authentication Server based Authentication Authentication Method Disabled TACACS Mgmt Protocols TACACS Settings O RADIUS Settings Figure 164 Server Based Authentication Tab Monitoring The upper part of the page shows whether server based authentication is enabled or disabled and the authentication method The lower part of the page is used to view the settings of an authentication client 3 In the lower portion of the tab click TACACS Settings 4 Click View 410 Section VII Management Security AT S63 Management Software Web Browser Interface User s Guide
128. ace but you can from the menus or command line interface o You cannot modify VLANs when the switch is operating in one of the multiple VLAN modes o You cannot modify a protected posts VLAN or a MAC address based VLAN from the web browser interface o If the switch is using 802 1x Port based Network Access Control and you want to move an untagged port to a different VLAN the port s 802 1x role must be set to none You cannot move an untagged port to a different VLAN while the port is functioning as an 802 1x authenticator or supplicant port For instructions on how to change a port s 802 1x role refer to Setting Port Roles on page 372 To modify a VLAN perform the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the Layer 2 option 3 Select the VLAN tab The VLAN tab is shown in Figure 132 on page 336 4 Click the button next to the name of the VLAN to be modified 5 Click Modify The Modify VLAN page for the VLAN is displayed 6 To add or remove ports from the VLAN click on the appropriate ports in the switch image Clicking repeatedly on a port toggles the port through the following possible settings Untagged port DI EI Port is not a member of the VLAN Tagged port 7 Click Apply 341 Chapter 21 Port based and Tagged VLANs Note Untagged ports added to a VLAN are automatically removed from their current untagged VLAN assignment Unt
129. aces with static IP addresses downloading the same configuration file onto more than one switch may result in an IP address conflict in your network where routing interfaces on different switches have the same IP addresses You can download the file as the active boot file for the switch in which case it automatically becomes the switch s active boot file or just into the file system If you choose the latter you can manually designate the file as the switch s active boot file at a later time b Caution Downloading a configuration file as the switch s new active boot configuration file will cause a switch reset Some network traffic may be lost 131 Chapter 10 File Downloads and Uploads To download a file perform the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the Utilities option The Utilities page is displayed with the System Utilities tab selected by default as shown in Figure 36 Utilities System Utilities Reset to Factory Defaults C Reboot Switch After Resetting to Defaults TFTP File Uploads and Downloads TFTP Server IP Address 0 D D H TFTP Operation Download Upload TFTP Remote Filename TFTP Local Filename TFTP FileType Image Config set default amp reboot O File Figure 36 System Utilities Tab Configuration Note The top portion of the System Utilities tab returns
130. ackets by its VLAN ID number The range is 1 to 4094 Protocol Defines a traffic flow by the protocol specified in the Ethertype field of the MAC header in an Ethernet II frame Possible values are o User Specified oO IP oO ARP oO RARP User Specified Protocol Defines a traffic flow by the protocol number specified in the Ethertype field of the MAC header in an Ethernet II frame To use this parameter the Protocol parameter must be set to User Specified The number can be entered in either decimal or hexadecimal format If the latter precede the number with Ox The range is 1536 0x600 to 65535 OxXFFFF TOS DSCP Defines a traffic flow by its Type of Service or DSCP value To set this parameter the Protocol parameter must be set to IP Options are ao TOS Type of Service o DSCP TOS Defines a traffic flow by its Type of Service value The range is 0 to 7 To set this value the TOS DSCP parameter must be set to TOS DSCP Defines a traffic flow by its DSCP value The range is 0 to 63 To set this value the TOS DSCP parameter must be set to DSCP 157 Chapter 12 Classifiers 158 IP Protocol Defines a traffic flow by the following Layer 3 protocols o User Specified o TCP o UDP o ICMP o IGMP User Specified IP Protocol Defines a traffic flow of an Layer 3 protocol by its protocol number To set this parameter the IP Protocol parameter must be set to User Specified The number can be en
131. age 420 4 Click either Enable MGMT ACL or Disable MGMT ACL The default setting is disabled 5 Click Apply A change to the status of the management ACL is immediately activated on the switch Note If you activate the feature before entering an access control entry that specifies your management workstation either by its IP address or subnet your web browser management session will end and you will not be able to reestablish it 6 To permanently save your changes select the Save Config option in the Configuration menu Section VII Management Security 419 Chapter 28 Management Access Control List Creating an ACE 420 To add a new ACE to the management ACL perform the following procedure From the home page select Configuration 2 From the Configuration menu select the Mgmt Security option 3 Select the Mgmt ACL tab The tab is shown in Figure 168 on page 419 To add anew ACE configure the following parameters in the Mgmt ACT tab MACL ID Specifies an identification number for the access control entry Every ACE must have a unique number The range is 1 to 256 Mgmt ACL IP Address Specifies the IP address of a management workstation to be allowed management access to the switch for example 149 11 11 11 Alternatively you can specify a subnet You must enter an IP address If you enter an IP address of a specific management node that node will be permitted remote management
132. age 80 or Chapter 6 Port Parameters in the AT S63 Management Software Menus Interface User s Guide Section Basic Operations AT S63 Management Software Web Browser Interface User s Guide Displaying Port Statistics Section Basic Operations To display the statistics of a port perform the following procedure 1 From the Home page select Monitoring 2 From the Monitoring menu select the Layer 1 option The Layer 1 page is displayed with the Port Settings tab selected by default as shown in Figure 20 on page 87 The Port Setting tab displays a image of the front of the switch Ports with a valid link to an end node are green In the switch image click a port You can select only one port when displaying statistics A selected port turns white To deselect a port click it again Click Statistics The Port Statistics page is shown in Figure 22 T Current Port 1 Total Ports Selected 1 Page 1of 1 Bytes Received 62591 Bytes Sent 244962 Frames Received 571 Frames Sent 292 Broadcast Frames Received 358 Broadcast Frames Sent 4 Multicast Frames Received 45 Multicast Frames Sent 72 Frames 64 Bytes 211 Frames 65 127 Byte 348 Frames 128 255 Bytes 105 Frames 256 511 Bytes 33 Frames 512 1023 Bytes 19 Frames 1024 1518 Bytes 147 Frames 1519 1522 Bytes 0 Dropped Frames 0 CRC Error Jabber No of Rx Errors No of Tx Errors UnderSize Frames OverSize Frames Fragments TX Collisions
133. agged ports removed from a VLAN are returned to the Default_VLAN Removing an untagged port from the Default_VLAN without assigning it to another VLAN leaves the port as an untagged member of no VLAN The modified VLAN is now ready for network operations 8 To permanently save your changes select the Save Config option in the Configuration menu 342 Secton V Virtual LANs Deleting a VLAN AT S63 Management Software Web Browser Interface User s Guide Secton V Virtual LANs This procedure deletes port based and tagged VLANs from the switch Note the following before performing this procedure o You cannot delete the Default_VLAN o You cannot delete a VLAN if it has a routing interface You must delete the routing interface first Deleting an interface is not supported from the web browser interface That management function must be performed from the menus or command line interface o All untagged ports in a deleted VLAN are returned to the Default_VLAN as untagged ports 0 Static addresses assigned to the ports of a deleted VLAN become obsolete and should be deleted from the MAC address table For instructions refer to Deleting Unicast and Multicast MAC Addresses on page 99 If the switch is part of an enhanced stack deleting the common VLAN that interconnects the switch with the stack removes the switch from the stack To delete a port based or tagged VLAN from the switch perform the followin
134. amic unicast and multicast MAC addresses from the MAC address table perform the following procedure 1 From the Home page select Configuration 2 From the Configuration menu select the Layer 2 option The Layer 2 page opens with the MAC Address tab selected by default as shown in Figure 23 on page 94 3 In the Delete All Dynamic MAC Addresses section click Delete All dynamic unicast and multicast MAC address are deleted from the switch The switch immediately begins to learn new dynamic addresses 100 Section Basic Operations AT S63 Management Software Web Browser Interface User s Guide Changing the Aging Time Section Basic Operations This procedure changes the aging time of the MAC address table The switch uses the aging time to delete inactive dynamic MAC addresses from the MAC address table The switch deletes an address from the table if no packets are sent to or received from the address for the period of time specified in the timer This prevents the table from becoming full of addresses of inactive nodes The default setting for the aging time is 300 seconds 5 minutes To configure the aging time perform the following procedure 1 2 From the Home page select Configuration From the Configuration menu select the Layer 2 option The Layer 2 page opens with the MAC Address tab selected by default as shown in Figure 23 on page 94 In the MAC Address Aging Time field enter a new value in
135. anced Operations AT S63 Management Software Web Browser Interface User s Guide Displaying the CoS Settings To display the CoS settings perform the following procedure 1 From the Home page select Monitoring 2 From the Monitoring menu select Services The Services page is displayed with the CoS tab selected by default as shown in Figure 57 Figure 57 CoS Tab Monitoring Click the port whose settings are to be displayed You can select more than one port A selected port turns white To deselect a port click it again Click View The CoS Setting for Port page is shown in Figure 58 Treesssmomra VLAN ID Default Priority Override Priority I 0 k Port DG _Gose _ Figure 58 CoS Setting for Port Page Section Il Advanced Operations 179 Chapter 14 Class of Service 180 The CoS Setting for Port page displays a table that contains the following columns of information Port The port number VLAN ID The VLAN where the port is an untagged member Default Priority The default priority level assigned to ingress untagged packets on this port Override Priority Whether the priority level in tagged packets should be overridden 5 Click Close Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide Displaying the QoS Schedule To display the QoS schedule perform the following procedure 1 From the Home page s
136. andwidth Specifies the maximum bandwidth available to the traffic class The range is 0 to 1016 Mbps This parameter determines the maximum rate at which the ingress port accepts packets belonging to this traffic class before either dropping or remarking occurs depending on the Exceed Action parameter If the sum of the maximum bandwidth for all traffic classes on a policy exceeds the ingress bandwidth of the port to which the policy is assigned the bandwidth for the port takes precedence and the port discards packets before they can be classified The value for this parameter is rounded up to the nearest Mbps value when this traffic class is assigned to a policy on a 10 100 port and up to the nearest 8 Mbps value when assigned to a policy on a gigabit port for example on a gigabit port 1 Mbps is rounded to 8 Mbps and 9 is rounded to 16 Note If this option is set to 0 zero all traffic that matches the traffic class is dropped However an access control list can be created to match the traffic that is marked for dropping or a subset of it and given an action of permit to override this This functionality can be used to discard all but a certain type of traffic Section II Advanced Operations Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide Burst Size Specifies the size of a token bucket for the traffic class The range is 4 to 512 Kbps The default is 512 Kbps T
137. ange its bridge priority value After you have made your changes click Apply TO permanently save your changes select the Save Config option in the Configuration menu Section IV Spanning Tree Protocols AT S63 Management Software Web Browser Interface User s Guide Configuring To configure RSTP port parameters perform the following procedure RSTP Port 1 Perform steps 1 to 4 in Configuring RSTP Bridge Settings on Settings page 302 to display the Spanning Tree tab 2 To configure RSTP port settings click on the port in the switch image and click Modify You can select more than one port at a time The RSTP Settings Port s page is shown in Figure 120 Port Priority 0 15 Point To Point 8 16 128 Auto Detect Port Cost 0 200000000 Edge Port 0 0 Auto Update Yes _ Enable Migration Check Figure 120 RSTP Settings Port s Page 3 Configure the following parameters as necessary Port Priority This parameter is used as a tie breaker when two or more ports are determined to have equal costs to the root bridge The range is 0 to 240 in increments of 16 The default value is 8 priority value 128 For a list of the increments refer to Table 7 on page 298 Port Cost The spanning tree algorithm uses the cost parameter to decide which port provides the lowest cost path to the root bridge for that LAN The range is 0 to 20 000 000 The default setting is Automatic detect
138. anning Tree system C layeri Spanning Tree is Disabled SE Protocol Version L Mgmt Security L net Protocols we Network Security View Spanning Tree Parameters Services L Multicast L Utilities LC wee L logot Figure 116 Spanning Tree Tab Monitoring 4 Click View The Monitor STP Parameters tab is shown in Figure 117 Layer 2 Monitor STP Parameters Bridge Priority 8 4096 32768 Bridge Hello Time 2 Bridge Forwarding 15 Bridge Max Age 20 Bridge Identifier 00 30 84 FE D2 00 Spanning Tree Root Bridge 00 30 84 FE D2 00 Root Priority 32768 Root Hello Time 2 Root Forwarding 15 Root Max Age 20 Root Path Cost 0 Figure 117 Monitor STP Parameters Tab Monitoring Section IV Spanning Tree Protocols 299 Chapter 19 Spanning Tree and Rapid Spanning Tree Protocols Resetting STP to the Default Settings 300 5 6 To view port settings click a port in the switch and click Status or Settings The STP Settings page is shown in Figure 118 sms Poro is OOOO Total Ports Selected 1 Page 1of1 Cost Priority Port State 15 Disabled 128 Figure 118 STP Settings Page The STP Settings page displays a table that contains the following columns of information Port The port number State Current state of a port The possible states are Listening Learning Forwarding or Blocking when spanni
139. ation ee eeeeeneeeeeeeneeeeeeeeaeeeeseeeaeeeeeeeaeeeeseeeceeeeseiaeeeeeeenaees 350 Figure 137 GVRP Port Configuration Page ccccceseeceeeeeeeeeeeeceeeeeeeeeaeeeeseeeaeeeeeeeaeeeeseeecaeeeeeneeineeessenaees 352 Figure 138 GVRP Tab Monitoring 353 Figure 139 GVRP Port Configuration Page cccceeeeceeeeeneeeeeeeeeeeeeeeeeeaeeeeseeeaeeeeeeeaeeeeeeseceeeeseeeineeeeeenaees 354 Figure 140 GVRP Database Page 355 Figure 141 GVRP State Machine for VLAN Page 356 Figure 142 GVRP Counters Page EE 359 Figure 143 GIP Connected Ports Ring Page c cccccceeseeeeeeeeeeneeeeeeeeeaaeeeeeeeaaeeeeeeeaaeeeeeeeiaeeeeeeeiaeeeeenenaees 362 Chapter 23 MAC Address based Port Security ccceeecceceeeeeeeeeeeeeneeeeeeeeeneeseeeeseneeseeseseneeeeesesseeeeenseeseenees 365 Figure 144 Port Security Tab Configuration cececeeeeeeeeeeeeeeeeenneeeeeeeaeeeeseeeaeeeeseeaeeeeeeeeaeeeeseeneeeeesenaees 366 Figure 145 Security for Ports Page Configuration cecccceeeeecneeeeeeeeneeeeeeeeaeeeeeeeaaeeeeseeenaeeeeeeenieeeeenenates 366 Figure 146 Port Security Tab Monitoring 369 Figure 147 Security for Port S Page eee ina A AT ARA A TA A 369 Chapter 24 802 1x Port based Network Access Control ssssssassessessnnnnnnunnennnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnennnnn nnne 371 Figure 148 802 1x Port Access Tab Confiouration na 372 Figure 149 Port Role Configuration Page 373 Figure 150 Authenticator Parameters Page 376
140. ation about the SNMPv3 Notify Table see Chapter 21 SNMPv32 in the AT S63 Management Software Menus Interface User s Guide To create an entry in the SNMPv3 Notify Table perform the following procedure 1 From the home page select Configuration The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 2 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 3 In the SNMPv3 section click the button next to Configure Notify Table and then click Configure at the bottom of the tab 253 Chapter 18 SNMPv3 The SNMPv3 Notify Table tab is shown in Figure 92 System Name Marketing MAC Addr 00 30 84 4B EF CD SNMPV3 Notify Table Total Entries 16 Page 4of 4 Notify Name Notify Tag Notify Type Storage Type Row Status swenginform swenginformtag Inform NonvVolatile Active swengtra Nonvolatile Active Mgmt Protocols O gTap O testenginform Non olatile Active O testengtrap NonVolatile Active Figure 92 SNMPv3 Notify Table Tab Configuration 4 Click Add The Add New SNMPv3 Notify page is shown in Figure 93 T AddNewsnwPvanotfy Notify Name swengtrap Notify Tag swengtag Notify Type Trap M Storage Type NonVolatile Row Status Active Figure 93 Add New SNMPv3 Notify Page 5 In the Notify Name field enter t
141. ault configuration settings a process that takes approximately 20 seconds to complete Note The AT S63 management software default values are listed in Appendix A AT S63 Default Settings in the AT S63 Management Software Menus Interface User s Guide To return the AT S63 management software to the default settings perform the following procedure 1 Section Basic Operations From the home page select Configuration 53 Chapter 2 Basic Switch Parameters 2 From the Configuration menu select the Utilities option The Utilities page is displayed with the System Utilities tab selected by default as shown in Figure 8 System Name Marketing MAC Addr 00 30 84 4B EF CD System Utilities Reset to Factory Defaults C Reboot Switch After Resetting to Defaults TFTP File Uploads and Downloads TFTP Server IP Address TFTP Operation 0 0 0 0 Download Upload Utilities TFTP Remote Filename TFTP Local Filename TFTP FileType Image Config set default amp reboot O File Figure 8 System Utilities Tab Configuration 3 Click the Reboot Switch After Resetting to Defaults checkbox 4 Click Apply The web browser displays the following prompt This page may no longer be available while the switch reboots Do you want to continue 5 Click OK to continue or Cancel to cancel the procedure If you select OK the switch resets and returns all values t
142. ave an entry in the User Table After making changes to an User Table entry with a Volatile storage type the Save Config option is not displayed on the Configuration menu NonVolatile Select this storage type if you want the ability to save an entry in the User Table After making changes to an User Table entry with a NonVolatile storage type the Save Config option is displayed on the Configuration menu Allied Telesyn recommends this storage type Note The Row Status parameter is a read only field in the web browser interface The Active value indicates the SNMPv3 User Table entry takes effect immediately Click Apply to update the SNMPv3 User Table To permanently save your changes select the Save Config option in the Configuration menu To delete an entry in the SNMPv3 User Table perform the following procedure 1 From the home page select Configuration The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 229 Chapter 18 SNMPv3 Modifying a User 230 Table Entry In the SNMPv3 section click the button next to Configure User Table and then click Configure The SNMPv3 User Table tab is shown in Figure 80 on page 227 Click the button next to the User Table entry to be deleted and click Remove A warning message is displayed Click OK From the Configuration men
143. ay the MAC address table and scroll through the list looking for the MAC address but if the switch is part of a large network finding the address could prove difficult This option allows you to specify the MAC address and let the AT S63 management software automatically locate the port where the address was learned 3 After selecting an option click View Section Basic Operations 95 Chapter 6 MAC Address Table Figure 24 shows an example of viewing all unicast MAC addresses Viewmacadaresses O OOOO Total MAC Addresses 117 Page 1 of 12 VLANID MAC ADDRESS oil O ME O 00 00 CD 01 65 5D 00 00 CD 0D 40 CC 00 00 F 4 44 12 44 00 00 F 4 0D 29 31 00 02 2D 7B AA EA 00 02 2D 7C AF F9 00 02 55 81 1E 98 00 02 DD 32 3D 1C 00 04 23 56 70 6B 00 04 23 80 83 0E 5 5 5 5 5 5 5 5 5 Figure 24 View MAC Addresses Page The View MAC Addresses page displays a table that contains the following columns of information VLAN ID The ID number of the VLAN where the port is a member MAC Address The static or dynamic MAC address Port s The port where the address was learned or assigned The MAC address with port CPU is the address of the switch Type The type of the address static or dynamic 96 Section Basic Operations AT S63 Management Software Web Browser Interface User s Guide Adding Static Unicast and Multicast MAC Addresses This section contains the procedure for assignin
144. ble Total Entries 5 Page 1of 2 Security Ke Group Name Storage Type Security Model hoa swengineering NonVolatile Mgmt Protocols luke testengineering NonVolatile jenny swengineering NonVolatile chitra testengineering NonVolatile debashis swengineering NonVolatile Figure 108 SNMPv3 SecurityToGroup Table Tab Monitoring Displaying Notify To display entries in the SNMPv3 Notify Table perform the following Table Entries Procedure 1 From the Home page select Monitoring The Monitoring System page is displayed with the General tab selected by default as shown in Figure 9 on page 57 2 Select the SNMP tab The SNMP tab is shown in Figure 104 on page 279 3 In the SNMPv3 section click the button next to View Notify Table and then click View at the bottom of the tab Section Ill SNMPv3 283 Chapter 18 SNMPv3 The SNMPv3 Notify Table tab is shown in Figure 109 AT 9424T SP System Name Marketing r 00 30 84 4B EF CD SNMPv3 Notify Table Total Entries 1 Page lof 1 Notify Name Notify Tag Notify Type Storage Type Row Status techpubsnotify tptag Inform Nonvolatile Active Mgmt Protocols Figure 109 SNMPv3 Notify Table Tab Monitoring Displaying Target To display entries in the SNMPv3 Target Address Table perform the Address Table following procedure Entries 1 From the Home page select Monitoring The Monitoring Sy
145. ble or disable it To select MSTP as the active spanning tree protocol and to enable or disable it perform the following procedure Note Changing the active spanning tree protocol resets the switch 1 From the Home page select Configuration 2 From the Configuration menu select the Layer 2 option 3 Select the Spanning Tree tab The Spanning Tree tab is shown in Figure 124 AT 9424T SP Spanning Tree Active Protocol Version Layer 2 Camp RSTP OmstP C Enable Spanning Tree Configure Spanning Tree Parameters Configure 312 Figure 124 Spanning Tree Tab Configuration Note If you do not want to change the active spanning tree protocol and just want to enable or disable it go to Step 5 Section IV Spanning Tree Protocols Section IV Spanning Tree Protocols AT S63 Management Software Web Browser Interface User s Guide To change the active spanning tree protocol on the switch click STP RSTP or MSTP in the Active Protocol Version section of the tab The default is RSTP Note Only one spanning tree protocol can be active on the switch ata time To enable or disable the active spanning tree protocol on the switch click the Enable Spanning Tree check box A check indicates that the spanning tree is enabled while no check indicates that spanning tree is disabled The default is disabled Click Apply To permanently save your changes select
146. bothell99 Read Only 196 1 1 1 Mgmt Protocols miami 7 Read Only milan Read Only 198 10 10 10 198 10 10 11 Figure 17 SNMPv1 A SNMPv2c Communities Tab Monitoring The columns in the table are defined here Community Name The name of a community string Access Mode The access mode of a community string A string with a Read Only access mode permits the viewing of the MIB objects on the switch A string with a Read Write access mode permits both viewing and changing the SNMP MIB objects Manager Stations The IP addresses of management workstations permitted to use a string with a closed access status Trap Receivers The IP addresses of trap receivers to receive traps from the switch Open Status The access status of a community string Yes means the string has an open status and any management workstation can use it No means the string has a closed status and that those workstations whose IP addresses are assigned to the string are permitted to use it Status The operating status of a community string Enabled means the string is available for use and Disabled means it is unavailable Section Basic Operations Chapter 5 Port Parameters This chapter explains how to view and change the parameter settings of the ports on the switch Examples of the parameters include port speed duplex mode and packet filtering This chapter contains the following procedures Configuring Port Paramete
147. ches the switch 2 Designate the interface as the local interface so the switch monitors the subnet for the management packets 3 To start a remote management session using a Telnet client a web browser or an SNMP program specify the IP address of the switch s local interface Here is an overview of the steps to configuring an AT 9400 Series master switch of an enhanced stack for remote management 1 Create a routing interface on the local subnet and VLAN that interconnects the switches and from where your remote management station is reaching the master switch 2 Designate the interface as the local interface so the master switch monitors the subnet for the management packets 3 To start a remote management session on the enhanced stack using a Telnet client a web browser or an SNMP program specify the IP address of the local interface on the master switch Here is an overview of the steps for a slave switch of an enhanced stack 1 Connect the slave switch to the master switch using a common VLAN and subnet A slave switch does not need a routing interface on the common VLAN to support remote management of the device when part of an enhanced stack 31 Chapter 1 Starting a Web Browser Management Session 32 2 If you do create interfaces on a slave switch and designate a local interface the local interface must be applied to the common VLAN that connects the slave switch to the enhanced stack 3 To remotel
148. ckets also match the criteria of a Permit ACL in which case the packets are accepted by the port because a Permit ACL overrides a Deny ACL Description Use this field to enter a description for the ACL A description can be up to 15 alphanumeric characters including spaces A description is optional Port List Use this list to specify the port where the ACL is to be assigned You can assign an ACL to more than one port To select multiple ports hold down the Ctrl key while making your selections You do not have to assign an ACL to a port when you initially create it However an ACL remains inactive until it is assigned to a port Click Apply The new ACL is immediately activated on the specified ports If you did not specify any ports for the ACL the ACL is created but remains inactive until you assign it to a port TO permanently save your changes select the Save Config option in the Configuration menu Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide Modifying an Access Control List To modify an access control list perform the following procedure 1 2 Section Il Advanced Operations From the home page select Configuration From the Configuration menu select the Network Security option Select the ACL tab The ACL tab is shown in Figure 49 on page 166 Select the ACL to be modified and click Modify The Modify ACLs page is displayed as shown in Fi
149. col Select this security level to allow authentication and encryption This level provides the greatest level of security You can select this value if you configured the Security Model parameter with the SNMPv3 protocol 267 Chapter 18 SNMPv3 Deleting a Target Parameters Table 268 Entry 10 11 12 In the Storage Type parameter select one of the following storage types for this table entry Volatile Select this storage type if you do not want the ability to save an entry in the Target Parameters Table After making changes to a Target Parameters Table entry with a Volatile storage type the Save Config option is not displayed on the Configuration menu NonVolatile Select this storage type if you want the ability to save an entry in the Target Parameters Table After making changes to a Target Parameters Table entry with a NonVolatile storage type the Save Config option is displayed on the Configuration menu Allied Telesyn recommends this storage type Note The Row Status parameter is a read only field in the web browser interface The Active value indicates the SNMPv3 Target Parameters Table entry takes effect immediately Click Apply to update the SNMPv3 Target Parameters Table To permanently save your changes select the Save Config option in the Configuration menu To delete an entry in the SNMPv3 Target Parameters Table perform the following procedure 1 From the home page select Config
150. commends this storage type Note The Row Status parameter is a read only field in the web browser interface The Active value indicates the SNMPv3 View Table entry takes effect immediately 10 Click Apply to update the SNMPv3 View Table 11 To permanently save your changes select the Save Config option in the Configuration menu To delete an entry in the SNMPv3 View Table perform the following procedure 1 From the home page select Configuration The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 In the SNMPv3 section click the button next to Configure View Table and then click Configure The SNMPv3 View Table tab is shown in Figure 83 on page 235 Click the button next to the View Table entry to be deleted and then click Remove A warning message is displayed Click OK To permanently save your changes select the Save Config option in the Configuration menu To modify an entry in the SNMPv3 View Table perform the following procedure 1 From the home page select Configuration The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 237 Chapter 18 SNMPv3 238 2 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 In the SNMPv3 section click the button next to Confi
151. d for the switch when prompted The home page of the selected switch is displayed You can now manage the selected switch 65 Chapter 3 Enhanced Stacking Returning to the Master Switch 66 When you are finished managing the switch and want to manage another switch in the stack select Disconnect from the main menu This returns you to the Enhanced Stacking page Figure 11 on page 64 of the master switch where you started the management session At this point you can do one of the following o Manage the master switch o Select another switch in the list to manage O Select Logout to end your management session Section l Basic Operations AT S63 Management Software Web Browser Interface User s Guide Displaying the Enhanced Stacking Status To display the enhanced stacking status of the switch perform the following procedure 1 From the Home page select Monitoring 2 From the Monitoring menu select the Mgmt Protocols option 3 Select the Enhanced Stacking tab The Enhanced Stacking tab is shown Figure 12 AT 9424T SP Enhanced Stacking The current switch mode is Master Mgmt Protocols Figure 12 Enhanced Stacking Tab Monitoring The information in the tab states the current enhanced stacking status of the switch as master slave or unavailable Section Basic Operations 67 Chapter 3 Enhanced Stacking 68 Section Basic Operations Chapter 4 SNMPv1
152. ddressees that it has already learned Only those end nodes whose MAC addresses are entered as static addresses are able to forward frames through the port After activating this security level you must enter the static MAC addresses of the end nodes to be allowed to forward frames through the port Locked Instructs a port to immediately stop learning new dynamic MAC addresses Frames are forwarded using the dynamic MAC addresses already learned by the port has and any static MAC addresses assigned to the port Dynamic MAC addresses learned by the port prior to the activation of this security level never time out from the MAC address table even when the corresponding end nodes are inactive The port will not learn any new dynamic addresses 367 Chapter 23 MAC Address based Port Security 368 You can continue to add new static MAC addresses to a port operating under this security level If you select the Limited security level additional options are displayed in the window for you to configure They are defined here Intrusion Action Specifies what the switch should do if a port receives an invalid frame Options are o Discard Discards the invalid frame o Trap Discards the invalid frame and sends an SNMP trap o Discard Discards the invalid frame sends an SNMP trap and disables the port Threshold Specifies the maximum number of dynamic MAC addresses you want the port to be able to learn The range is 1 to
153. displays a table that contains the following columns of information Server Specifies the server number one of three IP Address Specifies the IP address of the RADIUS server Port Specifies the port of the RADIUS server Encryption Key Specifies the encryption key for that server This parameter is blank if the key is specified in the Global Encryption Key field 415 Chapter 27 TACACS and RADIUS Protocols 416 Section VII Management Security Chapter 28 Management Access Control List A management access control list ACL allows you to restrict Telnet and web browser management access to the switch The sections in this chapter include Enabling or Disabling the Management ACL on page 418 Creating an ACE on page 420 Deleting an ACE on page 422 Displaying the Management Access Control List on page 423 UU UU Note For background information refer to Chapter 37 Management Access Control List in the AT S63 Management Software Menus Interface User s Guide Section VII Management Security 417 Chapter 28 Management Access Control List Enabling or Disabling the Management ACL 418 This procedure enables and disables the management ACL When enabled only those management stations specified by the access control entries in the ACL are allowed to manage the switch remotely using the Telnet application protocol or a web browser When the feature is disabled an
154. ds less that the specified value For example a setting of 25 seconds can result in the switch classifying a host node or multicast router as inactive after just 15 seconds A setting of 10 seconds or less can result in the immediate timeout of an inactive host node or router Maximum Multicast Groups Specifies the maximum number of IGMP multicast groups the switch can learn This parameter is useful with networks that contain a large number of multicast groups The range is 0 to 255 groups The default is 64 multicast groups 213 Chapter 17 IGMP Snooping Note The combined number of multicast address groups for IGMP and MLD snooping cannot exceed 255 4 Click Apply Changes to the IGMP snooping parameters are immediately implemented on the switch 5 To permanently save your changes select the Save Config option in the Configuration menu 214 Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide Displaying a List of Host Nodes You can use the AT S63 management software to display a list of the multicast groups on a switch as well as the host nodes You can also view the multicast routers A multicast router is a router that is receiving multicast packets from a multicast application and transmitting the packets to host nodes To view host nodes perform the following procedure 1 2 From the Home page select Monitoring From the Monitoring menu select the Mu
155. dth parameter Specifying a token bucket size without also specifying a maximum bandwidth serves no function Priority Specifies the priority value in the IEEE 802 1p tag control field that traffic belonging to this traffic class is assigned Priority values range from 0 to 7 with 0 being the lowest priority and 7 being the highest priority Incoming frames are mapped into one of four Class of Service CoS queues based on the priority value If you want the packets to retain the new value when they exit the switch change the Remark Priority parameter to Yes If you specify a new user priority value here and in Flow Group the value in Flow Group overwrites the value here 193 Chapter 15 Quality of Service 194 Modifying a Traffic Class Remark Priority Replaces the user priority value in the packets with the new value specified in the Priority parameter if set to Yes If set to No which is the default the packets retain their preexisting priority level when they leave the switch ToS Specifies a replacement value to write into the Type of Service ToS field of IPv4 packets The range is 0 to 7 A ToS value can be set at all three levels flow group traffic class and policy The ToS value in a flow group overrides the value specified at the traffic class or policy level while the ToS value in a traffic class overrides the value in a policy Move TOS to Priority Replaces the value in the 802 1p priority field with
156. e cc ccccceeeeeeeeeeeeeee eee eeeeaeeeeeeeaaeeeeeeeaaeeeeseeaaeeeeseeaaeeeeseeneeeeeeeeaas 41 Chapter 2 Basic Switch Parameters c cccccccceeeeeeeeececeneecaeeeeeeeeeeeteceacaaeaeeaeeeeeeeeeeeseesecsaaaeeaeeeeeess 43 Configuring the Switch s Name Location and Contact 44 Changing the Manager and Operator PasswordS eee eneee eee eet e teste taeee eee taeeeeeeteeeeeeenneeeenee 46 Setting the System Date ANd TIME iren eoii aeea eea a E E EE E ARE ATA 48 FRED OOUING a e EE 51 Pinging a Remote TEE 52 Returning the AT S63 Management Software to the Factory Default Values eeeeseesereesseerresserrrrsererrressee 53 Displaying the IP Address of the Local Interface seeesssenesessrssesrrerressrennnessnnnanesrtnanenntinneesntenneatnnnaesttennaaennn 55 Displaying System Information ccccceceeecdeceeeeeeccceeeseneeceeeeseeedacaeesencenersnedeeessnadacenseseeceeeesneceeenessaneeeeenensaes 57 Chapter 3 Enhanced Stacking 0 0 0 0 ccc eeeeeee eee eeee eee eeeeeneee eee eeeeeeeeeeseeeeeeeeeceeeaeeeeseneaeeeeeseeeneeeesenaeees 61 Setting a Switch s Enhanced Stacking Status 0 cc eee eect cneee eee entre eee eet ne eee eet aaeee eee eaeeeeeeteeeeeniaeeeene 62 Selecting a Switch in an Enhanced Stack aceiro nna aa EAE EEE eee eee eaeeee ee naaeeeeeeeaeeeeestieesessaeeeeeee 64 Returning to the Master Switch 2 c carcectsactavcceeddancheaes gupteccsansaccceceeesteadeds sadanchedve lang cgeca dads ceedi
157. e A warning message is displayed Click OK The community string is deleted from the switch To permanently save the change select the Save Config menu option Section Basic Operations AT S63 Management Software Web Browser Interface User s Guide Displaying the SNMPv1 and SNMPv2c Communities To display the SNMPv1 and SNMPv2c communities perform the following procedure 1 From the Home page select Monitoring 2 From the Monitoring menu select the Mgmt Protocols option 3 Select the SNMP tab The SNMP tab is shown in Figure 16 AT 9424T SP SNMP Access Enabled Authentication Failure Trap Disabled Mgmt Protocols SNMPv1 amp SNMPv2c View SNMPv1 amp SNMPv2c Communities SNMPv3 SNMP Engine ID 80 00 00 CF 03 00 30 84 AB EF CD View User Table O View View Table OvView Access Table Oview SecurityToGroup Table O View Notify Table O View Target Address Table Oview Target Parameters Table Oview Community Table Figure 16 SNMP Tab Monitoring Section Basic Operations 77 Chapter 4 SNMPv1 and SNMPv2c 78 4 Inthe SNMPv1 A SNMPv2c section click View The SNMPv1 amp SNMPv2c Communities tab is shown in Figure 17 AT 9424T SP SNMP v1 v2c Communities Total Entries 7 Page 1 of 2 Community Access 8 Trap Name Mode Manager Stations Receivers Access 196 1 1 1 atif4sunnyvale Read WWrite 198 12 19 1 198 12 20 1 198 12 19 1 198 12 20 1
158. e select Configuration 2 From the Configuration menu select the Network Security option 3 Select the 802 1x Port Access tab The 802 1x Port Access tab is shown in Figure 148 on page 372 4 In the switch image click the authenticator port to be configured You can configure more than one authenticator port at a time The selected port turns white 5 Click Settings 375 Chapter 24 802 1x Port based Network Access Control 376 The Authenticator Parameters page is shown in Figure 150 __AuthenticatorParameters t Authentication Mode Supplicant Mode B02 1x mi Single Port Control Max Requests Auto 2 Tx Period Quiet Peri SE 60 Reauth Enabled Reauth Period Enabled se 3600 Supplicant Timeout Server Timeout 3 30 Control Direction Piggyback Mode Both i Disabled Si VLAN Assignment Secure VLAN Enabled se ON Guest VLAN Figure 150 Authenticator Parameters Page 6 Configure the following parameters as needed Authenticator Mode Sets the authenticator mode of an authenticator port This parameter can take the following values 802 1x Specifies 802 1x username and password authentication With this authentication method the supplicant must provide either manually or automatically a username and password to the authenticator port This authentication method requires 802 1x client software on the supplicant nodes O MAC Based Specifies MAC addre
159. e Menus Interface User s Guide 399 Chapter 26 Secure Shell SSH Configuring SSH 400 To configure SSH perform the following procedure 1 2 From the Home page select Configuration From the Configuration menu select the Mgmt Protocols option Select the Secure Shell tab The Secure Shell tab is shown in Figure 160 Mgmt Protocols 4 Secure Shell Secure Shell Configuration Status Disabled O Enabled Host Key ID Not Defined Host Key Size must differ Srvr Key Size by 128 Bits Server Key ID Not Defined Key Size 512 Bits Server Expiry Time Login Timeout D hours 0 5 180 seconds 60 600 Figure 160 Secure Shell Tab Configuration Configure the following parameters as necessary Status Enables and disables the SSH server The default is Disabled SSH must be disabled to configure the protocol parameters Note You cannot disable the SSH server when there is an active SSH connection Host Key ID Specifies the ID number of the encryption key for the SSH host The key must already exist on the switch To view key ID numbers refer to Displaying the Encryption Keys on page 392 The default is Not Defined Section VII Management Security Section VI Management Security 5 6 AT S63 Management Software Web Browser Interface User s Guide Note You cannot create encryption keys from the web browser interface but you ca
160. e eee ene eee e rete eee eetaeeeeeeeeaaaeeeeeeeaeeeeeeenaeeeeeeeeaas 331 Section V Virtual LANS EE OO Chapter 21 Port based and Tagged VLANS eccccceeeeeeeeeeceeeeeeeeeeeeeeeeeeeseceeeeeeeseneeeeeeseeeaaaeeeteeeaeees 335 Creating a New Port Based or Tagged VAN 336 Ok ele a V AN WEE 341 Deleting a VLAN cerna e AE AE Sead Seceihs tad athesasleaacncaus E seddned det facteds A EREE cies veda 343 Selecting a VLAN Modai ccecceesesccenceseaecennenssncedensasadcccecaeeaacedenessenacenneneuaccnneeeseaadeneseesueenessdadgaseseauuadenerseds 344 Displaying NA ET 345 Chapter 22 GARP VLAN Registration Protocol 00 ccccceccceeeeeeeeee eee eeneeeeeeeteneeeeeeeseeeeeeeeseseaaeeesseeeanees 349 Contiguring EC KEE 350 Enabling or Disabling GVRP on a Port 352 Displaying the GVRP Configuration c cece eteereee eee tie eee ee eee ee eet nee AEEA teeeeeeenaeeeeeseneeeeeenieeeeeeenea 353 Displaying the GVRP Port Configuration sasssa aaa eiea aria direa aa ari 354 Displaying the GVRP Databhase iiu secssnni deii i i e a iE a A r ETE A E a a aa 355 Displaying the GVRP State Machine 356 Displaying the GVRP Counters sicsesni nanrisiaiis iii ieii serene ASEE AA E AA A A 359 Displaying the GIP Connected Ports Himg tnta ttnt uant tE nunnat EnEn tattu Enant Ennus atenn nanena 362 Section VI Port TEE DOD Chapter 23 MAC Address based Port Security 0 0 0 0 ccceeccceeeeeeeee eee eeeeeee eee eeeeeeeeeeseneaeeeeseeeaeeeeeeeeaeees 365
161. e is shown in Figure 100 on page 269 Wees Target Parameter Target Parameters Name snmpy3manager1 00 Message Processing Model LI vi Security Model gt v3 Security Name chitra Security Level Privacy Storage Type NonVolatile Row Status Active Figure 100 Modify SNMPv3 Target Parameter Page Section Ill SNMPv3 269 Chapter 18 SNMPv3 270 Note Enter a value for the Message Processing Model field only if you select SNMPv1 or SNMPv2c as the Security Model If you select the SNMPv3 protocol as the Security Model then the switch automatically assigns the Message Processing Model to SNMPv3 In the Message Processing Model field enter a Security Model that is used to process messages Select one of the following SNMP protocols v1 Select this value to process messages with the SNMPv_1 protocol v2c Select this value to process messages with the SNMPv2c protocol v3 Select this value to process messages with the SNMPv3 protocol In the Security Model field select one of the following SNMP protocols as the Security Model for this Security Name or User Name v1 Select this value to associate the Security Name or User Name with the SNMPv1 protocol v2c Select this value to associate the Security Name or User Name with the SNMPv2c protocol v3 Select this value to associate the Security Name or User Name with the SNMPv3 protocol In the
162. e load distribution method The possible settings are SA Source MAC address Layer 2 DA Destination MAC address Layer 2 SA DA Source MAC address destination MAC address Layer 2 SI Source IP address Layer 3 DI Destination IP address Layer 3 SI DI Source IP address destination IP address Layer 3 Ports The ports of the trunk 105 Chapter 7 Static Port Trunks 4 To create a new static trunk click Add The Add New Trunk page is shown in Figure 27 new O Trunk ID Trunk Name Trunk Method SADA Source amp Dest L2 Address Sescesscseses n n O Trunk Port Regular Port Figure 27 Add New Trunk Page 5 Click the Trunk Name field and enter a name for the static trunk The name can be up to 16 alphanumeric characters No spaces or special characters such as asterisks and exclamation points are allowed Each trunk must be given a unique name 6 From the Trunk Method pull down menu select a load distribution method for the trunk The possible settings are SA Source MAC address Layer 2 DA Destination MAC address Layer 2 SA DA Source MAC address destination MAC address Layer 2 SI Source IP address Layer 3 DI Destination IP address Layer 3 SI DI Source IP address destination IP address Layer 3 7 Inthe switch image click the ports to be in the port trunk A selected port changes to white An unselected port is black A static p
163. e port remains in the VLAN specified in the initial authentication regardless of the VLAN assignments of subsequent authentications Guest VLAN Specifies the VID of a Guest VLAN The authenticator port is a member of a Guest VLAN when no supplicant is logged on Clients do not log on to access a Guest VLAN You can specify a Guest VLAN by either its name or VID To remove a Guest VLAN without assigning a new one delete the name or VID of the assigned VLAN 7 Click Apply 379 Chapter 24 802 1x Port based Network Access Control Changes to the authenticator settings are immediately implemented on a port 8 To permanently save your changes select the Save Config option in the Configuration menu 380 Section VI Port Security AT S63 Management Software Web Browser Interface User s Guide Configuring Supplicant Port Parameters Section VI Port Security To configure supplicant port parameters perform the following procedure Note The role of a port must be set to supplicant before the parameters can be configured For instructions refer to Setting Port Roles on page 372 From the home page select Configuration From the Configuration menu select the Network Security option Select the 802 1x Port Access tab The 802 1x Port Access tab is shown in Figure 148 on page 372 Click the supplicant port to be configured You can configure more than one supplicant port at a time The selected port turns whi
164. e procedures for working with the switch s file system The sections include 0 Listing the Files in Flash Memory or on a Compact Flash Card on page 124 o Selecting an Active Boot Configuration File on page 127 Note For background information refer to Chapter 10 File System in the AT S63 Management Software Menus Interface User s Guide Section Il Advanced Operations 123 Chapter 9 File System Listing the Files in Flash Memory or on a Compact Flash Card This procedure displays the files stored in the switch s flash memory or on a compact flash card Not all AT 9400 Series switches support a flash card slot Note You cannot copy rename or delete files from a web browser management session Those tasks can be performed from the menus and command line interfaces To display a list of the system files stored in the switch s flash memory or on a compact flash card perform the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the Utilities option 3 Select the File System tab The Flle System tab is shown in Figure 34 AT 9408LC SP System Name Tech Pubs aa a Flash CompactFlash Network Security Default Configuration File boot ctg Exists Utilities Page 1of1 File Name Modified Attributes Disconnect 0210172005 boot cfg Archive 10 32 40 05 07 1980 21 28 12 05 07 1980 21 33 20
165. e to make the DES privacy or encryption protocol the privacy protocol for this User Table entry With this selection messages transmitted between the host and the switch are encrypted with the DES protocol None Select this value if you do not want a privacy protocol for this User Table entry With this selection messages transmitted between the host and the switch are not encrypted In the Privacy Password field enter a privacy password of up to 32 alphanumeric characters In the Confirm Privacy Password field re enter the privacy password In the Storage Type field enter one of the following storage options for this User Table entry Volatile Select this storage type if you do not want the ability to save an entry in the SNMPv3 User Table After making changes to an SNMPv3 User Table entry with a Volatile storage type the Save Config option is not displayed on the Configuration menu NonVolatile Select this storage type if you want the ability to save an entry in the SNMPv3 User Table After making changes to an SNMPv3 User Table Section Ill SNMPv3 Section Ill SNMPv3 AT S63 Management Software Web Browser Interface User s Guide entry with a NonVolatile storage type the Save Config option is displayed on the Configuration menu Allied Telesyn recommends this storage type Note The Row Status parameter is a read only field in the web browser interface The Active value indicates the SNMPv3 User Table ent
166. eag Acceeeeandcendides td 4 66 Displaying the Enhanced Stacking Status cc cece eee eenee eect eencne ee eee teense eeeaaeeeeeeeaaeeeeseeeaeeeeseenaeeeeeseeaas 67 Chapter 4 SNMPv1 and SNMPv2c oo cc ccc cee ceeeceeececc cece eee ee tect e ee ceaeaaeaeeceeeeeeeeeeesecaaaaeceseseeeeeeeeeeeeneennaeees 69 Enabling or Disabling SNMP Management 70 Creating a New SNMPv1 and SNMPv2c Community c ccceccceeeeeee eet eee ee eitieee eee teeeeeeteeeeeetiaeeeeeenaeeeeena 72 Modifying an SNMPv1 and SNMPv2c Community 75 Contents Deleting an SNMPv1 and SNMPv2c Community 76 Displaying the SNMPv1 and SNMPv2c Communities cece teeter tenner ee ee eee eee eee eaaeee eee taeeeeeeenaeeeeees 77 Chapter 5 Port Parameters 79 COnfiguring Port En 80 Displaying Port Parameters ireen TAT AA T eege Duer 87 Displaying Forn Statistics sarren ara E aE E EE EE E ER dann eaees 89 Resetting a Port to the Default Settings iscri reiii eeeeeee eee eeeeeee eee EERE AKATE EN A RENAA EAE KEEA PENETANA AEE EKETIA KREE EEE 92 Chapter 6 MAC Address Table cccccceccccceeeeeeeeeeeeeceeeeae ttr eeeeeee cece a ceceaaaaaeaeeeeeeeeeeeeesecncaceeaeeeeeeeeeeteee 93 Displaying the MAC Address Table cccccecceeeeeeceeeeseeeeeeeeeceeneeeeeeseceeeeeeeseeneaeeeeeseneaeeeeeeeneaeeeeseneaeeeeteeaeeees 94 Adding Static Unicast and Multicast MAC Addresses A 97 Deleting Unicast and Multicast MAC Adresses 99 Deleting All Dynamic MAC
167. ect the Save Config option in the Configuration menu 413 Chapter 27 TACACS and RADIUS Protocols Displaying the RADIUS Client Settings To display the RADIUS client settings on the switch perform the following procedure 1 From the Home page select Monitoring 2 Select the Mgmt Protocols option The Mgmt Protocols tab is displayed with the Server based Authentication tab selected by default as shown in Figure 164 on page 410 The upper part of the page shows whether server based authentication is enabled or disabled and the authentication method The lower part of the page is used to view the settings of an authentication client 3 In the lower portion of the page click RADIUS Settings 4 Click View The RADIUS Client Configuration page is shown in Figure 165 Global Encryption Key Global Server Timeout 1 60 ATI 30 second s Port 8 Ka IP Address Encryption Key 149 11 11 11 1812 s24aa 149 22 22 22 1812 s45nnn 0 0 0 0 1812 Not Defined Figure 167 RADIUS Client Configuration Page The upper portion of the page displays the following information Global Encryption Key The global encryption secret 414 Section VII Management Security Section VI Management Security AT S63 Management Software Web Browser Interface User s Guide Global Server Timeout Specifies the maximum amount of time the switch waits for a response from a RADIUS server The lower portion of the page
168. ected educeeddedeedesbodendeversatiegeve 143 Table 7 Default Syslog Facilities syr oenina a a ae a eaa aaar aata 149 Table 8 Default Mappings of IEEE 802 1p Priority Levels to Egress Priority Queues ccccceceeeeeeceeeeeeeeaeeeeteteeaees 177 Table 9 Bridge Priority Value Increments A 296 Table 1 0 Port Priority Value INCreMmemnt ission e e ea geidebecdeneedemeesaneeden 298 Table 11 MSTP Auto Update Port Internal Path Costs 200 0 eee ecceeeeeeecenneeeeeeeeeeeneeeseaaeeseeeeeeesaeeseeaaeeeneeeensieeeseaaeeesneeeee 323 Table 12 MSTP Auto Update Port Trunk Internal Path Costs 0 eee eeeeeecereeeeeneeeeeaeeeeeeeeeeaeesesaaeeseeeeesneeeeeneeeeneaeess 323 Table 13 MSTP Auto External Path Costs cccccccecsecceeeeceneeceeeeeeeeeee cee cece eaaeeeeeeeeaaeeeeeeecaeaeeeeseseaeeeesesaeaeeeeeeeeeeeeeseeeeaees 324 Table 14 MSTP Auto External Path Trunk Costs cccccccceceeseeece cence eee eeeeseaaeceeeeseaaeaeeeecedacaeceeeesaaeceseseeaeeeeseeeeaeeeeeeteeaees 325 Table 15 GVRP State Machine Parameters cccccceecceeececeeceeeeseeaeee eee eecaeceeeeeeceeaeeeesegcaeceeeesesaeceseseeaeeeeeeeeeeeeeeeeeeaees 356 Table 162 GVRP COuUnerS nornas chess ss coc E paac ea 359 15 Tables Preface This guide contains instructions on how to configure and maintain an AT 9400 Series Layer 2 Gigabit Ethernet switch using the web browser interface in the AT S63 management software For instructions on how to manage
169. ed above Excluded Enter this value to not permit the View Name to see the subtree specified above In the Storage Type field enter a storage type for this table entry Volatile Select this storage type if you do not want the ability to save an entry in the Target Parameters Table After making changes to an Target Parameters Table entry with a Volatile storage type the Save Config option is not displayed on the Configuration menu NonvVolatile Select this storage type if you want the ability to save an entry in the View Table After making changes to a View Table entry with a NonVolatile storage type the Save Config option is displayed on the Configuration menu Allied Telesyn recommends this storage type Note The Row Status parameter is a read only field in the web browser interface The Active value indicates the SNMPv3 View Table entry takes effect immediately Click Apply To permanently save your changes select the Save Config option in the Configuration menu 239 Chapter 18 SNMPv3 Configuring the SNMPv3 Access Table Creating an Access Table 240 You can create delete and modify an SNMPv3 Access Table entry See the following procedures o Creating an Access Table on page 240 O Deleting an Access Table Entry on page 243 o Modifying an Access Table Entry on page 244 For information about the SNMPv3 Access Table see Chapter 21 SNMPv3 in the AT S63 Managem
170. edenesseeneeeneesaedenenseaneds 179 Figure 59 QoS Scheduling Tab Monitoring c ccc cence eect tener eee eeeeeaaeeeeeeeaaaeeeeeeeaaaeeeeeeeiaeeeeseeniaeeeeseenaees 181 Chapter 15 Quality Of Service ecseeeeteeeseneeeeeeeeeeeeeeeeeeneeeeeeeeeeeeeseeeeeneeseeseeeneesaeseseeeeeeeeessnaeseesesenseesseeees 183 Figure 60 Flow Group Tab Configuration 0 c cceeceeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeseeeeeeeeseeeeeeeeeseeeaeeeeeeeeeaeeeseeenaeeees 184 Figure 61 Create Flow Group Page ocorre o Taa e T O AOE T ONAE DRE T 185 Figure 62 Modify Flow Group Page creeren aE EAE E Aa EERE EA EARE EERE 187 Figure 63 Flow Group Tab Monitoring ei pearen ATEREA E A T AREE A 189 Houte 64 Trae EE EE 190 Figure 65 Create Traffic Class Paga cc ceccccecesceneeeeeeseneeeeeeeceneeereeecaneeseeesuneeeeeeacanseeseeecaeeeteeeaneeeeeenseneetees 191 Figure 66 Modify Traffic Class Page 195 Figure 67 Traffic Class Tab Monitorning ierra ea EEEE EE AAEE DEEA EERE TA EERIE 196 Figure 68 Policies Tab Configuration oinin aaa a a R AET AEE a Re Aa TEK R ASE 198 Figure 69 Create Policy Page eran E a E T AA Es ea tuty 199 Figure 70 MGdity Policy Fage eiriaa e AEA EEA A EEEE AEE E EE AAR 202 Figure 71 Policies Tab MOnitoring ae nE A E O S 203 Chapter 16 Denial of Service Defense ssssssunssennuunrnnunnnrnnunnnnnnnnnnnnnnnnnnnnnunnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn nnmnnn ne 205 Figure 72 DoS Tab Configuratio jorns a a ea A a aa alea e Ga 2
171. eeeaeeeeseeeaaaeeeseeeaeees 165 Configuring an Access Control LiSt 2 0 00 cee eee einer teeter eee renee eee ae nese eet aeee eee E a e arana ARA AE ie 166 Modifying an Access Control LiSt 2 0 cceceeceeeeseeeeeeeeeeeeeeeeeeeeeeeeeeeeeseeeeeeeeeseceeeeeeeseceeeeeeeeseneaeeeeseeaeeeeseeenaneeees 169 Deleting an Access Control List ccccececeeeeeeeeeceneeeeeeecueeeseaueeeeeseauenseseeaaaeeeseeeaenseeeseaueeseseesenteeeseneenaeesess 170 Displaying the Access Control Lists 20 00 ccecceeee eet tnr eee etter eee nine eee e Eataa Eea EA 171 Chapter E E Ee TEE 173 Gom fhigunnG EE 174 Mapping CoS Priorities to Egress Oueues eee E eee AEA ETA EEA EEEE REAA EE R 176 Configuring Egress Scheduling E 178 Displaying the CoS ue ET 179 Displaying Huert chelen desser eene dee Eeer 181 Chapter 15 Quality of Service 0 0 ccc ceeeee eee ee teeter eee eeee eee eaeeeeeeeeeeeaaeeeseeeeaeeeeseeeeeeeeeseeeaaeeeseeeaeees 183 Managing Flow Group TEE 184 Configuring a Flow Group 184 Moditying a Flow Group sennae e ee a A e Aara 187 Deleting a Flow Group acrniaisiii d e a eia a a Terr REENEN Keen 188 Displaying the FlOW GOUS Tassinari eoa a A aT S A TREAS R AA ASAE E A OTAS TRSAT 188 Managing UC ee EE 190 Configuring a Traffic Class 190 Modifying ERC eer 194 Deleting a Trath GE 196 Displaying the Traffic Classes 196 Managing Re 198 Configuring lee 198 Oe elt le ECH dee 201 Deleting a Policy nrnisns aciendo iiair i a addceee vie TA a E A EUSE
172. eeeeeeeeeeeenneeeeeeeaaeeeeeeeaaaeeeseeenaeeeeeeeenaeeeeeeenaeeseeeaas 268 Modifying a Target Parameters Table Entry ccccccceseeeeeeeeeecneeeeeeeeaeeeeeeeaaeeeeeeeaaeeeeeeeaaaeeeeseeiaeeeeeeeaas 269 Configuring the SNMPv3 Community Table 0 eceeeeee seen eee ee ener eee ee eee eee ee eeaeeeeeeeaeeeeseeeiaeeeeeeeenaeeeeenaees 272 Creating an SNMPv3 Community Table Entry 00 0 ceeceeeeeeeenee crete eecneeeeeeeaeeeeeeeeaeeeeeeeaaeeeeeeenaeeeeneeas 272 Deleting an SNMPv3 Community Table Entre 275 Modifying an SNMPv3 Community Table Entry 00 ee ee cence eeeeene eee eeeeaaaeeeeeeeaaaeeeeeeeaaeeeeeeeenaeeeeseeeaas 275 Displaying SNMPV3 Tables oriant E apd eauedecpeec R E S R S AES T A 278 Displaying User Table Entries 0000 20 ccc ceeeecceeeeeeeecne eee erence eee ee eaeeeeeeeaaeeeeeeeaaeeeeeeeaeeeeeeeeceeeessiaeeeeeeenaees 278 Displaying View Table Entree 280 Displaying Access Table Entries 0 ececccceeeeeecne eee ee eecneeeeeeeaaeeeeeeeaaeeeeeeeaeeeeeeesaeeeeeeesnaeeeeenenieeeeeesenaees 281 Displaying SecurityToGroup Table Entrtes nanen 282 Displaying Notify Table Entree 283 Displaying Target Address Table Entries AAA 284 Displaying Target Parameters Table Entries 0 cc cceececeeeeeeecneeeeeeeeneeeeeeeaaeeeeeeeaeeeeeneeneeeeeseniaeeeenenaees 285 Displaying SNMPv3 Community Table Entries cc cccecececeeeeeeeeeeeeeeeeeeeeeaeeeeeeeaaeeeeeeenaeeeeeeeeneeeeeneas 286 Section IV Spanning Tree Protocols
173. elect Monitoring 2 From the Monitoring menu select the Services option 3 Select the Queuing and Scheduling tab The Queuing and Scheduling tab is shown in Figure 59 AT 9424T SP Queuing amp Scheduling CoS Oto PO CoS 1to PO QoS PriorityQ 1 QoS Priority 0 CoS 2to PQ CoS 3to POQ QoS PriorityQ 2 QoS PriorityO 3 CoS 4to PO CoS 5toPO QoS PriorityQ 4 QoS PriorityQ 5 CoS 6 to PQ CoS 7 to PQ QoS Priority 6 QoS PriorityQ 7 Egress Weights Select Schedule Strict Priority Queue 0 Weight Weighted Weight 0 Queue 1 Weight Weighted Weight 0 Queue 2 Weight Weighted Weight 0 Queue 3 Weight Weighted Weight 0 Queue 4 Weight Weighted Weight 0 Queue 5 Weight Weighted Weight 0 Queue 6 Weight Weighted Weight 0 Queue 7 Weight Weighted Weight 0 Figure 59 QoS Scheduling Tab Monitoring The upper section displays the CoS priority to egress queue assignments The lower section displays the egress weight settings Section Il Advanced Operations 181 Chapter 14 Class of Service 182 Section Il Advanced Operations Chapter 15 Quality of Service Section Il Advanced Operations This chapter contains instructions on how to configure Quality of Service QoS This chapter contains the following procedures a Managing Flow Groups on page 184 o Managing Traffic Classes on page 190 o Managing Policies on page 198 Note For background i
174. emark Priority to Yes Remark Priority If set to Yes replaces the user priority value in the packets with the new value specified in the Priority parameter when the packet leaves the switch ToS Specifies a replacement value to write into the Type of Service ToS field of IPv4 packets The range is 0 to 7 A new ToS value can be set at all three levels flow group traffic class and policy A ToS value specified in a flow group overrides a ToS value specified at the traffic class or policy level Move TOS to Priority Replaces the value in the 802 1p priority field with the value in the ToS priority field on IPv4 packets Options are yes Replaces the value in the 802 1p priority field with the value in the ToS priority field on IPv4 packets no Does not replace the preexisting 802 1p priority level This is the default Move Priority to ToS Replaces the value in the ToS priority field with the 802 1p priority field on IPv4 packets Options are yes Replaces the value in the ToS priority field with the 802 1p priority field on IPv4 packets no Does not replace the ToS priority field This is the default Classifier List Lists the classifiers on the switch You use the list to specify the classifier for the flow group The classifier must already exist on the switch A flow group can be assigned more than one classifier To select more than one classifier hold down the Ctrl key when making your selections Click Apply
175. ent Software Menus Interface User s Guide To create an entry in the SNMPv3 Access Table perform the following procedure 1 From the home page select Configuration The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 2 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 3 In the SNMPv3 section click the button next to Configure Access Table and then click Configure at the bottom of the tab The SNMPv3 Access Table tab is shown in Figure 86 AT 9424T SP System Name Marketing MAC Addr 00 30 84 4B EF CD SNMPv3 Access Table Total Entries 6 Page 2 of 6 Group Name Security Model testengineering v3 Security Level Context Prefix AuthPriv Mgmt Protocols Read View Context Match internet Exact Write View Storage Type private NonVolatile Notify View Row Status internet Active Figure 86 SNMPv3 Access Table Tab Configuration Section Ill SNMPv3 Section Ill SNMPv3 AT S63 Management Software Web Browser Interface User s Guide 4 Tocreate an SNMPv3 Access Table entry click Add 5 The Add New SNMPv3 Access page is shown in Figure 87 Group Name swengineering Context Prefix Read View internet Write View internet Notify View internet Security Model v3 m Security Level Privacy Context Match Exact Storage Type Row Status Active
176. er explains how to upload and download files such as a new AT S63 image file onto the switch This chapter contains the following sections 0 Downloading a File on page 130 0 Uploading a File on page 134 129 Chapter 10 File Downloads and Uploads Downloading a File This procedure explains how to download a file from a TFTP server on your network to the switch using the web browser interface You can download any of the following files 0 AT S63 image file o Boot configuration file 0 CAcertificate Here are the general guidelines to follow when performing this procedure o You must use TFTP to download a file from a web browser management session O There must be a node on your network with the TFTP server software 0 The file must be stored on the TFTP server node o You should start the TFTP server before you begin the download procedure o The switch must have a routing interface on the local subnet from where it will reach the TFTP server The switch uses the IP address of the interface as its source address when sending packets to the TFTP server This rule applies to both master and slave switches in an enhanced stack For a switch without a routing interface you can download the file from a local management session on the switch using Xmodem or alternatively switch to switch For instructions refer to the AT S63 Management Software Menus Interface User s Guide O You cannot download a pr
177. er supply if present and internal power consumption Temperature Deg C The ambient temperature as measured where the air enters the cooling vents on the side of the unit Fan Information The speed or operating status of the system fan s 59 Chapter 2 Basic Switch Parameters 60 Section Basic Operations Chapter 3 Enhanced Stacking Section Basic Operations This chapter contains the following procedures for setting up enhanced stacking Setting a Switch s Enhanced Stacking Status on page 62 Selecting a Switch in an Enhanced Stack on page 64 Returning to the Master Switch on page 66 QOQ0Q 0 Displaying the Enhanced Stacking Status on page 67 Note For background information refer to Chapter 4 Enhanced Stacking in the AT S63 Management Software Menus Interface User s Guide 61 Chapter 3 Enhanced Stacking Setting a Switch s Enhanced Stacking Status The enhanced stacking status of the switch can be master slave or unavailable Each status is described below O Master Starting a local or remote management session on a master switch of a stack allows you to easily transition to the other switches in the stack from the same management session O Slave A slave switch can be remotely managed through a master switch or independently such as through a local management session O Unavailable A switch with an unavailable stacking status ca
178. ere are no changes to save To modify an entry SNMPv3 Security ToGroup Table perform the following procedure 1 From the home page select Configuration The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 In the SNMPv3 section click the button next to Configure SecurityToGroup Table and then click Configure at the bottom of the tab The SNMPv3 Security ToGroup Table tab is shown in Figure 89 on page 248 Section IIl SNMPv3 Section Ill SNMPv3 4 5 AT S63 Management Software Web Browser Interface User s Guide Click the button next to the SecurityToGroup Table entry to be changed and then click Modify The Modify SNMPv3 SecurityToGroup page is shown in Figure 91 Modify SNMPVSSeauriyToGrouy Security Model S wi Security Name hoa Group Name swengineering Storage Type NonVolatile Row Status Active Figure 91 Modify SNMPv3 SecurityToGroup Page In the Group Name field enter a Group Name that you configured in the SNMPv3 Access Table See Creating an Access Table on page 240 There are four default values for this field that are reserved for SNMPv1 and SNMPv2c implementations a defaultV1GroupReadOnly o defaultV1GroupReadWrite a defaultV2cGroupReadOnly o defaultV2cGroupReadWrite In the Storage Type field
179. es 10 4 Limited Send Trap Only Yes 10 Figure 147 Security for Port s Page 369 Chapter 23 MAC Address based Port Security The Security for Ports page displays a table that contains the following columns of information Port The number of the port Security Mode The active security mode on the port The possible settings are Automatic Limited Secured and Locked Intruder Action The column specifies the action taken by the switch if a port receives an invalid packet The possible settings are Discard The port discards invalid packets This is the default Trap The port discards invalid packets and sends a trap This action applies only to the Limited security mode Trap Disable The port discards invalid packets sends a trap and disables the port This action applies only to the Limited security mode Note The Participating and MAC Limit parameters only apply the Limited security level Participating This column only applies when the intrusion action for a port is set to trap or disable This option does not apply when intrusion action is set to No Action discard If this option is set to No when intrusion action is set to trap or disable the port discards invalid packets but it does not send a trap or disable the port MAC Limit This column specifies the maximum number of dynamic MAC addresses the port learns 370 Section VI Port Security Chapter 24 802 1x Port based Network
180. es or to policies that are not assigned to switch ports Parent Policy ID The QoS policies where the traffic class is assigned Flow Group List The flow groups assigned to this traffic class To display detailed information about a traffic class select the traffic class and click View The details of the traffic class are displayed in the View Traffic Class page For parameter definitions refer to Configuring a Traffic Class on page 190 5 Click Close 197 Chapter 15 Quality of Service Managing Policies Configuring a Policy This section contains the following procedures Configuring a Policy next Modifying a Policy on page 201 Deleting a Policy on page 202 Deleting all Flow Groups Traffic Classes and Policies on page 203 UD DD a Displaying Policies on page 203 To configure a policy perform the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the Services option 3 Select the Policies tab The Policies tab is shown in Figure 68 Services Policies Current Policies Description DSCP 17 traffic DSCP 4 traffic Active No 1 8 Traffic Class List Ingress Port List elt Yes 2 3 O 12 198 Figure 68 Policies Tab Configuration The Policies tab displays the existing policies in a table that contains the following columns of information ID The
181. eseeeaeeeeeseneaeeeteeeaaees 240 Elte RRE 240 Deleting an Access Table Entry 22 cccccccceeceeseneceeecesdeceeeeeaneceesesdeneceseeesneeeeeeaneceeeesseaeceeeeesdaeetensttneees 243 Contents Modifying an Access Table Entry c ccececseecceeeeeneeeeeeeeeneneeeeeeensnaedeneesenaaeseeeneeaeeeneeseaeaeetensenaeenenneeeess 244 Configuring the SNMPv3 SecurityTOGroup Table ccceceseeeeeeeeeeeeeeseeeeeeeeeseeeeaeeeeeeeeaeeeeseeeeaeeeeseeeaeeeseaaees 247 Creating a SecurityToGroup Table Entry 0 2 cceeeeeceeeeeenne eee ee ennneee eee eaaeeeeeeeaeeeeeesaaeeeeeeeaeeeeeeenaeeseeeaas 247 Deleting a SecurityTOGroup Table Emir 250 Modifying a SecurityToGroup Table Emtrm na nannn 250 Configuring the SNMPv3 Notify Table 253 Creating a Notify Table Entry 0 0 cece nr rt in ie eee E ee eee Aa i i 253 Deleting a Notify Table Ent 255 Modifying a Notify Table Ent 256 Configuring the SNMPv3 Target Address Table ooo eee cecceeeeeeeeeeeenneeeeeeeaaeeeeeeeaaaeeeeeeeaeeeeeeeaaeeeeseeiaeeeseeaas 258 Creating a Target Address Table Entre 258 Deleting a Target Address Table Entry cc ceeececeeceeeeenneeeeeeeecteeeeeeeaeeeeeetaeeeeeesaaeeeeeeeenaeeeeestnaeeeeeeenaees 261 Modifying Target Address Table Ent 262 Configuring the SNMPv3 Target Parameters Table 265 Creating a Target Parameters Table Emtm eee eeeeeeeeaaeeeseeeaaeeeeeeenaeeeeeneenaeeeeeeaas 265 Deleting a Target Parameters Table Entry ccecccce
182. etermines the source ports 115 Chapter 8 Port Mirroring Figure 32 shows an example of the Modify Mirror page configured for a port mirror The ingress and egress traffic on ports 1 2 and 7 to 10 is being mirrored to the destination port 11 Enable Mirror Mirror Ingress Port E Mirror Egress Port IT Mirror Ingress Egress Port O Mirror To Port Figure 32 Example of a Modify Mirror Page 6 After selecting the destination and source ports click the Enable Mirror check box 7 Click Apply The port mirror is now active on the switch You can connect a data analyzer to the destination port to monitor the traffic on the source ports 8 To permanently save your changes select the Save Config option in the Configuration menu 116 Section Basic Features AT S63 Management Software Web Browser Interface User s Guide Modifying a Port Mirror To modify a port mirror perform the following procedure 1 2 Section Basic Features From the home page select Configuration From the Configuration menu select the Layer 1 option Select the Port Mirroring tab The Port Mirroring tab is shown in Figure 30 on page 114 Click Modify The Modify Mirror page is shown in Figure 31 on page 115 Change the ports of the port mirror as needed Clicking a port toggles it through the possible settings which are as follows i The destination mirror port There can be only one L destination p
183. ettings while the latter only allows you to view the settings For manager access enter manager as the user name The default password is friend For operator access enter operator as the user name The default password is operator Login names and passwords are case sensitive For information about the two access levels refer to Chapter 1 Overview in the AT S63 Management Software Menus Interface User s Guide For background information on creating management accounts using a RADIUS or TACACS server refer to Chapter 36 TACACS and RADIUS Protocols in the A7 S63 Management Software Menus Interface User s Guide You cannot change the default user names To change a password refer to Changing the Manager and Operator Passwords on page 46 The home page is shown in Figure 3 opyright 2005 Allied Telesyn Inc All rights reserved AT 9424T SP Figure 3 Home page The main menu is on the left side of the home page It consists of the following selections UU UU Enhanced Stacking Configuration Monitoring Logout Section Basic Operations Section I Basic Operations AT S63 Management Software Web Browser Interface User s Guide Note Only a master switch has the Enhanced Stacking selection A web browser management session remains active even if you link to other sites You can return to the management web pages anytime as long as you do not
184. ew SNMPv3 SecurityToGroup Page 5 In the Security Model field select the SNMP protocol that was configured for this User Name Choose from the following v1 Select this value to associate the Group Name with the SNMPv1 protocol 248 Section Ill SNMPv3 Section Ill SNMPv3 AT S63 Management Software Web Browser Interface User s Guide v2c Select this value to associate the Group Name with the SNMPv2c protocol v3 Select this value to associate the Group Name with the SNMPv3 protocol In the Security Name field enter the User Name to be associated with a group Enter a User Name that you configured in Creating a User Table Entry on page 226 In the Group Name field enter a Group Name that you configured in the Access Table See Creating an Access Table on page 240 There are four default values for this field that are reserved for SNMPv1 and SNMPv2c implementations a defaultV1GroupReadOnly o defaultV1GroupReadWrite a defaultV2cGroupReadOnly o defaultV2cGroupReadWrite In the Storage Type field select one of the following storage types for this table entry Volatile Select this storage type if you do not want the ability to save an entry in the SecurityToGroup Table After making changes to a SecurityToGroup Table entry with a Volatile storage type the Save Config option is not displayed on the Configuration menu NonvVolatile Select this storage type if you want the ability to save
185. f Service This chapter contains instructions on how to configure Class of Service CoS This chapter contains the following procedures Configuring CoS on page 174 Mapping CoS Priorities to Egress Queues on page 176 Configuring Egress Scheduling on page 178 Displaying the CoS Settings on page 179 WS WS WS n Displaying the QoS Schedule on page 181 Note For background information refer to Chapter 15 Class of Service in the AT S63 Management Software Menus Interface User s Guide Section Il Advanced Operations 173 Chapter 14 Class of Service Configuring CoS This procedure sets the Class of Service priority level for ingress untagged packets on a port The priority level dictates which priority queue the packets are stored in on the egress port In the default settings ingress untagged packets on a port are assigned a priority level of 0 and are stored in egress queue Q1 on the egress port This procedure also overrides the priority level in tagged ingress packets To adjust the mappings of priority levels to egress queues refer to Mapping CoS Priorities to Egress Queues on page 176 To change the CoS priority level on a port perform the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the Services option The Services page is displayed with the CoS tab selected by default as shown in Figure 54
186. f a port trunk Table 11 MSTP Auto External Path Trunk Costs Port Speed Port Cost 10 Mbps 20 000 100 Mbps 20 000 1000 Mbps 2 000 Edge Port This parameter defines whether the port is functioning as an edge port The possible settings are Yes and No For an explanation of this parameter refer to Point to Point and Edge Ports in Chapter 22 Spanning Tree and Rapid Spanning Tree Protocols in the AT S63 Management Software Menus Interface User s Guide 8 After configuring the parameters click Apply 9 To permanently save your changes select the Save Config option in the Configuration menu 10 Repeat this procedure to configure the MSTP parameters for other switch ports 325 Chapter 20 Multiple Spanning Tree Protocol Displaying the MSTP Configuration To display the MSTP configuration perform the following procedure 1 From the Home page select Monitoring 2 From the Monitoring menu select the Layer 2 option 3 Select the Spanning Tree tab The Spanning Tree tab is shown in Figure 113 on page 292 This tab displays information on whether spanning tree is enable or disabled and which protocol version STP RSTP or MSTP is active 4 Click View 326 Section IV Spanning Tree Protocols AT S63 Management Software Web Browser Interface User s Guide The MSTP Parameters tab is shown in Figure 129 Layer 2 AT 9424Ti SP System Name MAC Addr 00 21 46 47 8
187. f you activated RSTP go to Step Configuring RSTP on page 302 If you activated MSTP go to Chapter 20 Multiple Spanning Tree Protocol on page 311 Section IV Spanning Tree Protocols 293 Chapter 19 Spanning Tree and Rapid Spanning Tree Protocols Configuring STP This section contains the following procedures Configuring STP Bridge Settings next Configuring STP Port Settings on page 297 Displaying the STP Settings on page 298 Resetting STP to the Default Settings on page 300 02 a 0 AN Caution The bridge provides default STP parameters that are adequate for most networks Changing them without prior experience and an understanding of how STP works might have a negative effect on your network You should consult the IEEE 802 1d standard before changing any of the STP parameters Configuring STP To configure STP bridge settings perform the following procedure Bridge Settings 1 From the Home page select Configuration 2 From the Configuration menu select the Layer 2 option 3 Select the Spanning Tree tab The Spanning Tree tab is shown in Figure 113 on page 292 4 Click Configure 294 Section IV Spanning Tree Protocols AT S63 Management Software Web Browser Interface User s Guide The Configure STP Parameters tab is shown in Figure 114 Layer 2 2 Configure STP Parameters Bridge Priority 0 15 8 4096 32768 Bridge Hello Time 1 10
188. fic that meets the criteria of the policy s classifiers to a destination mirror port Options are Yes Copies the traffic that meets the criteria of the classifiers to a destination mirror port You must specify the destination port by creating a port mirror For instructions refer to Creating a Port Mirror on page 114 Section II Advanced Operations Modifying a Policy Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide No Does not copy the traffic to a destination mirror port This is the default Traffic Class List Specifies the traffic class to be assigned to the policy The traffic class must already exist A policy can have more than one traffic class To select more than one traffic class hold down the Ctrl key when making your selections Ingress Port List Specifies the ingress port to which the policy is to be assigned A policy can be assigned to more than one ingress port To select more than one port hold down the Ctrl key when you make your selections A port can be an ingress port of only one policy at a time Egress Port Specifies the egress port to which the policy is to be assigned You can enter only one egress port A port can be an egress port of only one policy at a time If a port is already an egress port of a policy you must remove the port from its current policy assignment before adding it to another policy Redirect Port Specifies a port to
189. fies a replacement value to write into the DSCP TOS field of the packets The range is 0 to 63 A new DSCP value can be set at all three levels flow group traffic class and policy A DSCP value specified in a flow group overrides a DSCP value specified at the traffic class or policy level A DSCP value specified at the policy level is used only if no value has been specified at the flow group and traffic class levels ToS Specifies a replacement value to write into the Type of Service ToS field of IPv4 packets The range is 0 to 7 A ToS value can be set at all three levels flow group traffic class and policy The ToS value in a flow group overrides the value specified at the traffic class or policy level while the ToS value in a traffic class overrides the value in a policy Move TOS to Priority Replaces the value in the 802 1p priority field with the value in the ToS priority field on IPv4 packets Options are yes Replaces the value in the 802 1p priority field with the value in the ToS priority field on IPv4 packets no Does not replace the preexisting 802 1p priority level This is the default Move Priority to ToS Replaces the value in the ToS priority field with the 802 1p priority field on IPv4 packets Options are yes Replaces the value in the ToS priority field with the 802 1p priority field on IPv4 packets no Does not replace the ToS priority field This is the default Send to Mirror Port Copies the traf
190. figuration J s nersige iaire e aR Eaa AAE EE AEAEE RAEE ARR ERAEN 154 Figure 45 Create Classifier Page ieina ia aA ER A EATA A ERE A EATE 155 Figure 46 Create Classifier Page IP Protocol essesesssssesssrreesssrneeerernnessrrnnsesntnnesstnnaessttanaensttnnseeneneennnnnnerene 156 Figure 47 Modify Classifier Page ccecssseecceeeeeesereteesesenceenesseenceteesnseneeeeneseneneneaneneceenensenceneesenaneneensencess 160 Figure 48 Classifier Tab Montortmg iarr EnEn AEAEE A EAE AE TAAA EA EAEE EE 163 Chapter 13 Access Control Lists ccccccsseeeceeeeseeeeeeeeeeeeeeeeeeeeneeseeeeeeneeseeeeseeeeseesesneeeeeseesseeeseesesneeeeneeseeees 165 Figure 49 ACL Tab Configuration sesiooni ee E EE EE EE ERE EEA EEE AARE NEE 166 Figure S0 Greate ACLS Pig Garrat E T Seu R EE T 167 Figure St Modi ACLs Fees n a a E E E O ad dee a n Ra 169 Figure SA ACL Tab MOnitOring y a ir E OE EEE EEEE EATE 171 Figuro S9 View ACLS Fagas EE 172 Chapter 14 Class f S nviCe sci a e a a e aa aa aaa a a aaa ae are e a aaa aAa a a aaa aaa Aar aa aa aeaa 173 Figure 54 CoS Tab Confouraton 174 Figure 55 CoS Setting for Port Page sonnn Gnda iiia a e ar aia Ea 175 Figure 56 Queuing amp Scheduling Tab Configuration ssesssssssesssesrrrsseerrssstterrssttinrrssttenrssattennesstensssenn 176 Figure 57 CoS Tab Monitoring 179 Figure 58 CoS Setting for Port Page ccccccececceeecceececeeeeneenceeeeeneneeddessneceecenenseneeeneesens
191. figure a 10 100 1000Base T twisted pair port to 1000 Mbps MDI MDIX Crossover The wiring configuration of a twisted pair port This parameter does not apply to fiber optic ports Possible settings are O Auto Sets the port to automatically configure itself as MDI or MDIX depending upon the end node This is the default This setting is only available when a port is set to Auto Negotiation 0 MDI Sets a port to MDI This setting is only available when a port s speed and duplex mode are set manually o MDIX Sets a port to MDIX This setting is only available when a port s speed and duplex mode are set manually Ingress Broadcast Filter Use this parameter to configure a port to forward or discard ingress broadcast packets Possible settings are Enabled The port discards ingress broadcast packets Disabled The port forwards ingress broadcast packets This is the default setting Egress Broadcast Filter Use this parameter to configure a port to forward or discard egress broadcast packets Possible settings are Enabled The port discards egress broadcast packets Disabled The port forwards egress broadcast packets This is the default setting 83 Chapter 5 Port Parameters 84 Ingress Unknown Unicast Filter Use this parameter to configure a port to forward or discard unknown ingress unicast packets The possible settings are Enabled The port discards unknown ingress unicast packets Disabled
192. g eee tieeeeeetieeeeeetaeeeeeenea 307 RSITP Port Status Page ERNENNUNG EENEG dE 307 ROP Settings Haeren e EES te a Se 308 Figures Chapter 20 Multiple Spanning Tree Protocol eccceeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeseeesseaaeeeseseeeeeeeseeeeeseeaees 311 Figure 124 Spanning Tree Tab Configuration cc cccceceeeeeeeeeeeeeeeeenaeeeeeeeaeeeeeeeeaeeeeeeenaeeeeseeiaeeeeseenaees 312 Figure 125 Configure MSTP Parameters Tab Confouraton 315 Figure 126 Add New MSTI Page EE 318 Figure 127 Modify MSTI Page EE 320 Figure 128 MSTP Settings Port S Page ceceeeeeeeeeeeee eee eeeecee eee eeeeaaeeeseeeaaaeeeeeeeaaeeeeeeecaeeeeeeeeiteeeeeeenaees 322 Figure 129 Monitor MSTP Parameters Tab Monttorng 327 Figure 130 MSTP Settings Port S Page ce ceeeeeeeeeeee eee eeeeaeeeeeeeaaeeeseeeaaaeeeeseeaaeeeeeeeceeeeeeeenneeeeeneaees 328 Figure 131 MSTP Port Status Port S Page 329 Chapter 21 Port based and Tagged VLANS cccesseesceeeeseeeeeeeeeneeeeeeeeeneeseeeesneaeseeeeseaeseesesseaeseesesseanseeesenees 335 Figure 132 VLAN Tab Configuration eoira EAEEREN E O AATTEET TA RREA EEE TORRE 336 Figure 133 Add New VLAN Pagiras r E aa a aa a Naaa 338 Figure 134 VLAN Tab Monitoring Je reren a 345 Figure 135 View Protected VLAN Page 347 Chapter 22 GARP VLAN Registration Protocol cccceeeeeeeesteeeeeeeeseeeeeeeeeseeeeeeeeeseeaeseeeeseeaesesessecanseeseeeenes 349 Figure 136 GVRP Tab Configur
193. g a static unicast or multicast address to a port A switch port can have up to 255 static MAC addresses To add a static address to the MAC address table perform the following procedure 1 From the Home page select Configuration 2 From the Configuration menu select the Layer 2 option The Layer 2 page is displayed with the MAC Address tab selected by default as shown in Figure 23 on page 94 3 To add a static unicast address click Add in the View Add Unicast MAC Addresses section To add a static multicast address click Add in the View Add Multicast MAC Addresses section The Add MAC Address page is shown in Figure 25 MAC Address HN HHH 1 Port Number VLAN ID Section Basic Operations Figure 25 Add MAC Address Page 4 Configure the following parameters as necessary MAC Address Specifies the new static unicast or multicast MAC address Port Number Specifies the number of the port on the switch where the static address is to be assigned For a static unicast address you can enter only one port For a static multicast address you must specify the port when the multicast application is located as well as the ports where the host nodes are connected Assigning the address only to the port where the 97 Chapter 6 MAC Address Table multicast application is located results in the failure of the multicast packets to be properly forwarded to the host nodes You can specify the po
194. g an MSTI 320 The Modify MSTI page is shown in Figure 127 10 11 MSTI ID 2 Priority 4096 28672 VLAN List 3 Figure 127 Modify MSTI Page To change the MSTI s priority value enter a value in the Priority field This parameter is used in selecting a regional root for the MSTI The range is 0 zero to 61 440 in increments of 4 096 with 0 being the highest priority For a list of the increments refer toTable 6 Bridge Priority Value Increments on page 296 The default is 0 To add or remove VLANs from the MSTI edit the VIDs in the VLAN List field Separate multiple VIDs with a comma Click Apply Repeat steps 5 to 9 to modify additional MSTIs To permanently save your changes select the Save Config option in the Configuration menu To delete an MSTI perform the following procedure 1 2 From the home page select Configuration From the Configuration menu select the Layer 2 option Select the Spanning Tree tab The Spanning Tree tab is shown in Figure 113 on page 292 Click Configure The expanded MSTP Spanning Tree tab is shown in Figure 125 on page 315 In the CIST MSTI Table section of the tab click the button next to the MSTI to be deleted You can only delete one MSTI at a time Click Remove Section IV Spanning Tree Protocols Section IV Spanning Tree Protocols 10 AT S63 Management Software Web Browser Interface User s Guide A confirmation
195. g procedure 1 From the home page select Configuration 2 From the Configuration menu select the Layer 2 option 3 Select the VLAN tab The VLAN tab is shown in Figure 132 on page 336 4 Click the button next to the name of the VLAN to be deleted You cannot delete the Default_VLAN 5 Click Remove A confirmation prompt is displayed 6 Click OK to delete the VLAN or Cancel to cancel the procedure If you click OK the VLAN is deleted from the switch The untagged ports in the VLAN are returned to the Default_VLAN as untagged ports 7 To permanently save your changes select the Save Config option in the Configuration menu 343 Chapter 21 Port based and Tagged VLANs Selecting a VLAN Mode 344 The AT S63 management software features three VLAN modes o Port based and tagged VLAN Mode default mode o IEEE 802 1Q compliant Multiple VLAN Mode o Non lEEE 802 1Q compliant Multiple VLAN Mode For background information on port based and tagged VLANs refer to Chapter 24 Port based and Tagged VLANs in the AT S63 Management Software Menus Interface User s Guide For information on the multiple VLAN modes refer to Chapter 26 Multiple VLAN Modes in the AT S63 Management Software Menus Interface User s Guide Note Any existing port based or tagged VLANs are not retained when you change the VLAN mode from the user configured mode to a multiple VLAN mode and at some point reset the switch T
196. ge 5 Configure the following parameters ID Specifies an ID number for the traffic class Each traffic class on the switch must be assigned a unique number The range is 0 to 511 The default is 0 This parameter is required Description Specifies the traffic class description A description can be up to 15 alphanumeric characters including spaces 191 Chapter 15 Quality of Service 192 Exceed Action Specifies the action to be taken if the traffic of the traffic class exceeds the maximum bandwidth There are two possible exceed actions drop and remark If drop is selected traffic exceeding the bandwidth is discarded If remark is selected the packets are forwarded after replacing the DSCP value with the new value specified in Exceed Remark Value The default is drop Exceed Remark Value Specifies the DSCP replacement value for traffic that exceeds the maximum bandwidth This value takes precedence over the DSCP value The default is 0 DSCP Value Specifies a replacement value to write into the DSCP TOS field of the packets The range is 0 to 63 A new DSCP value can be set at all three levels flow group traffic class and policy A DSCP value specified in a flow group overrides a DSCP value specified at the traffic class or policy level A DSCP value specified at the traffic class level is used only if no value has been specified at the flow group level It will override any value set at the policy level Max B
197. ge this value Enable Update Controls whether the switch is to send interim accounting updates to the RADIUS server A check in the box indicates that updating is enabled No check in the box means that updating is disabled 387 Chapter 24 802 1x Port based Network Access Control 388 Displaying the RADIUS Accounting Settings Update Interval Specifies the intervals at which the switch sends interim accounting updates to the RADIUS server The range is 30 to 300 seconds The default is 60 seconds Click Apply Changes to the accounting settings are immediately implemented on the switch TO permanently save your changes select the Save Config option in the Configuration menu To display the RADIUS accounting settings perform the following procedure From the home page select Monitoring 2 From the Monitoring menu select the Network Security option 3 Select the 802 1x Port Access tab The 802 1x Port Access tab is shown in Figure 152 on page 383 The RADIUS Accounting section provides the following information Accounting The status of RADIUS accounting either Enabled or Disabled Trigger Type The action that causes the switch to send accounting information to the RADIUS server The possible settings are Start_Stop The switch sends accounting information whenever a client logs on or logs off the network This is the default Stop The switch sends accounting information only when a client lo
198. gged and tagged ports of a VLAN These fields will be blank for a MAC address based VLAN The untagged ports of a VLAN are listed as follows o Configured The untagged ports assigned to the VLAN when the VLAN was created or modified o Actual The current untagged ports of the VLAN If you are not using 802 1x Port based Network Access Control both the Configured and Actual untagged ports of a VLAN will always be the same If you are using 802 1x and assigned a Guest VLAN to an authenticator port or associated an 802 1x supplicant to a VLAN on the authentication server a port can be in different VLAN than the virtual LAN where it was originally assigned as an untagged port In these situations the Configured and Actual port lists can differ with the Actual list detailing the ports that are currently functioning as 337 Chapter 21 Port based and Tagged VLANs 4 untagged ports of the VLAN For example if a particular port is listed as a Configured member of a VLAN but not as an Actual member that would mean either the port is currently a part of a Guest VLAN or the supplicant who logged on the port was associated with a VLAN assignment on the authentication server To add a new VLAN click Add The Add New VLAN page is shown in Figure 133 Name Type PortBased Protocol None BESSER ESESER v 5 338 Figure 133 Add New VLAN Page Configure the following parameters as necessary
199. gmt Security O Force STP Compatible MSTP Bridge Max Age 6 40 C Mgmt Protocols _ Bridge Hello Time 1 10 20 Network Security p pidge Mex Hops 1 40 Eege Bridge Forwarding 4 30 20 15 Revision Level 0 255 C neg Configuration Name Configure CIST Parameters CIST Priority 0 15 D 4096 32768 CIST MSTI Table Total CIST MSTIs 1 Page 1of 1 CISTMSTI ID VLAN Associations Figure 125 Configure MSTP Parameters Tab Configuration Note This procedure explains the Configure MSTP Parameters section of the page The CIST MSTI Table is explained in Creating an MSTI on page 318 Modifying an MSTI on page 319 and Deleting an MSTI on page 320 The graphic image of the switch is described in Configuring MSTP Port Parameters on page 322 Section IV Spanning Tree Protocols 315 Chapter 20 Multiple Spanning Tree Protocol 316 Configure the following parameters as necessary Force Version This selection determines whether the bridge operates with MSTP or in an STP compatible mode If you select MSTP the bridge operates all ports in MSTP except those ports that receive STP or RSTP BPDU packets If you select Force STP Compatible the bridge uses its MSTP parameter settings but sends only STP BPDU packets from the ports The default is MSTP Note Selecting the STP compatible mode deletes all spanning tree instances on the switch Bridge Hello Time
200. gs off Port Number The UDP port for RADIUS accounting Type The type of RADIUS accounting The default is Network Accounting Update Whether or not the switch sends interim accounting updates to the RADIUS server The options are Enabled or Disabled Update Interval The intervals in seconds at which the switch sends interim accounting updates to the RADIUS server Section VI Port Security Section VII Management Security Section VII Management Security The chapters in this section contain the procedure for implementing management security on the switch to prevent unauthorized changes to a switch s parameter settings The chapters include Chapter 25 Encryption Keys PKI and SSL on page 391 Chapter 26 Secure Shell SSH on page 399 Chapter 27 TACACS and RADIUS Protocols on page 405 Chapter 28 Management Access Control List on page 417 UU UU 389 390 Section VII Management Security Chapter 25 Encryption Keys PKI and SSL Section VII Management Security This chapter explains how to view the encryption keys PKI based certificates and SSL settings and includes the following sections 0 Displaying the Encryption Keys on page 392 0 Displaying the PKI Settings and Certificates on page 394 o Displaying the SSL Settings on page 397 Note To configure encryption keys PKI or SSL you must use the menus or command line interface For bac
201. gure 37 AT 9424T SP em Name dr 00 3 C Home Ggs as Clear Log O Disabled O Permanent L Mgmt Protocols Enabled Utilities Page 1of 1 Cepesrz Log Outputs ID 4 Type Status Details IT Logg 0 Permanent Enabled Wrap on Full el Temporary Enabled Wrap on Full O 3 Syslog Enabled 149 35 8 45 CO Syslog Disabled 149 35 5 42 Display Filter Settings Log Location Mode Temporary RAM Normal O Permanent Nvs OFull Severity Selections Module Selections al SYSTEM EI Lal E W Warning Hnformation v MAC Display Order Chronological O Reverse Chronological Save Filename Figure 37 Event Log Tab Configuration 4 Inthe Log Settings section click Enabled for the Status to enable the event logs or Disabled to disable the event logs and to stop the switch from sending events to syslog servers The default setting is enabled 5 Click Apply to activate the settings on the switch If you enabled the logs the switch immediately begins to add events to the logs and send events to defined syslog servers 6 To permanently save your changes select the Save Config option in the Configuration menu Section Il Advanced Operations 139 Chapter 11 Event Logs and Syslog Servers Displaying Events 140 This procedure explains how to display the events in an event log You can view all or just specific events of a log To view the events in an e
202. gure 51 aao Cd ID Description 237 Local Classifier List Port List 1 1 a 2 2 a d v Action DENY Figure 51 Modify ACLs Page Configure the parameters as needed For definitions of the parameters refer to Configuring an Access Control List on page 166 Click Apply Changes to the ACL are immediately implemented on the switch To permanently save your changes select the Save Config option in the Configuration menu 169 Chapter 13 Access Control Lists Deleting an Access Control List To delete an access control list perform the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the Network Security option 3 Select the ACL tab The ACL tab is shown in Figure 49 on page 166 4 Select the ACL to be deleted and click Delete You can delete one access control list at a time The ACL is immediately deleted from the switch 5 To permanently save your changes select the Save Config option in the Configuration menu 170 Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide Displaying the Access Control Lists To display the current ACLs perform the following procedure 1 From the Home page select Monitoring 2 From the Monitoring menu select Network Security 3 Select the ACL tab The ACL tab is shown in Figure 52 AT 9424T SP Page lof1 Current ACL
203. gure View Table and then click Configure at the bottom of the tab The SNMPv3 View Table tab is shown in Figure 83 on page 235 Click the button next to the SNMPv3 View Table entry to be changed and then click Modify The Modify SNMPv3 View page is shown in Figure 85 T Modiysuwpvsview O O O OOOO Oo View Name mgmt Subtree OID gt 1 3 6 1 2 Subtree Mask View Type Included vj Storage Type NonVolatile Row Status Active 5 6 Figure 85 Modify SNMPv3 View Page In the Subtree Mask field enter a subtree mask in hexadecimal format This is an optional parameter that is used to further refine the value of the Subtree OID parameter The Subtree OID parameter defines a MIB View and the Subtree Mask parameter further restricts a user s view to a specific the column and row of the MIB View The value of the Subnet Mask parameter is dependent on the subtree you select For example if you configure the View Subtree parameter as MIB ifEntry 0 3 it has the following value 1 3 6 1 2 1 2 2 1 0 3 To restrict the user s view to the third row all columns of the MIB ifEntry 0 3 enter the following value for the Subtree Mask parameter ff bf In the View Type field enter one of the following view types Section Ill SNMPv3 Section Ill SNMPv3 AT S63 Management Software Web Browser Interface User s Guide Included Enter this value to permit the View Name to see the subtree specifi
204. gured the Security Model parameter with the SNMPv3 protocol Privacy This option represents authentication and the privacy protocol Select this security level to allow authentication and encryption This level provides the greatest level of security You can select this value if you configured the Security Model parameter with the SNMPv3 protocol Note The Context Match field is a read only field The Context Match field is always set to Exact In the Storage Type field select one of the following storage types for this table entry Volatile Select this storage type if you do not want the ability to save an entry in the Access Table After making changes to an Access Table entry with a Volatile storage type the Save Config option is not displayed on the Configuration menu NonvVolatile Select this storage type if you want the ability to save an entry in the Access Table After making changes to an Access Table entry with a NonVolatile storage type the Save Config option is displayed on the Configuration menu Allied Telesyn recommends this storage type Note The Row Status parameter is a read only field in the web browser interface The Active value indicates the SNMPv3 Access Table entry will take effect immediately Click Apply To permanently save your changes select the Save Config option in the Configuration menu To delete an entry in the SNMPv3 Access Table perform the following procedure 1 F
205. h as a CA certificate or a boot configuration file that is not to be designated as the active boot configuration file Click Apply The management software notifies you after the download is complete A Caution When you download a new AT S63 image file to the switch s application block the file is written to flash memory This can require one to two minutes to complete Do not reset or power off the unit After the file has been written to flash the switch automatically resets ending your web browser management session Some network traffic may be lost during the reset process To continue managing the switch you must reestablish the management session after the reset process is completed Note When you download a configuration file using the Config selection the file is automatically designated as the switch s new active configuration file When the download is complete the switch resets ending your web browser management session Some network traffic may be lost during the reset process After the reset the switch operates with the parameter settings in the downloaded configuration file To continue managing the switch you must reestablish the management session 133 Chapter 10 File Downloads and Uploads Uploading a File 134 This procedure explains how to upload a file from the switch s file system to a TFTP server on your network using the web browser interface You can upload any of the fol
206. h port while an inactive ACL or QoS policy is currently not assigned to any port If this column is O zero the classifier is not assigned to any ACLs or policies active or inactive Section Il Advanced Operations 163 Chapter 12 Classifiers No of Active Associations The number of active ACLs and QoS policies to which the classifier is currently assigned An active ACL or QoS policy is assigned to at least one switch 4 To display detailed information about a classifier select the classifier and click View For descriptions of the variables refer to Configuring a Classifier on page 154 5 Click Close to close the page 164 Section Il Advanced Operations Chapter 13 Access Control Lists Section Il Advanced Operations An access control list ACL is a tool for managing network traffic This chapter contains the following sections Configuring an Access Control List on page 166 Modifying an Access Control List on page 169 Deleting an Access Control List on page 170 UU UU Displaying the Access Control Lists on page 171 Note For background information refer to Chapter 14 Access Control Lists in the AT S63 Management Software Menus Interface User s Guide 165 Chapter 13 Access Control Lists Configuring an Access Control List 166 This procedure explains how to create an ACL Before starting this procedure jot down on paper the ID number s
207. h to a RADIUS server includes the date and time when clients log on and log off as well as the number of packets sent and received by a switch port during a client session For background information on this feature refer to Chapter 31 802 1x Port based Network Access Control in the AT S63 Management Software Menus Interface User s Guide This feature is disabled by default on the switch To configure RADIUS accounting perform the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the Network Security option 3 Select the 802 1x Port Access tab The 802 1x Port Access tab is shown in Figure 148 on page 372 4 In the Configure RADIUS Accounting section configure the following parameters as necessary Enable Accounting Activates or deactivates RADIUS accounting on the switch Select Enabled to activate the feature or Disabled to deactivate it The default is Disabled Trigger Type Specifies the action that causes the switch to send accounting information to the RADIUS server The possible settings are Start_Stop The switch sends accounting information whenever a client logs on or logs off the network This is the default Stop The switch sends accounting information only when a client logs off Port Number Specifies the UDP port for RADIUS accounting The default is port 1813 Type Specifies the type of RADIUS accounting The default is Network You cannot chan
208. hapter 6 MAC Address Table Section Basic Operations This chapter contains instructions on how to view the MAC addresses in the MAC address table It also explained how to add static addresses to the table This chapter contains the following procedures Displaying the MAC Address Table on page 94 Adding Static Unicast and Multicast MAC Addresses on page 97 Deleting Unicast and Multicast MAC Addresses on page 99 Deleting All Dynamic MAC Addresses on page 100 Oo 0 Changing the Aging Time on page 101 Note For background information refer to Chapter 7 MAC Address Table in the AT S63 Management Software Menus Interface User s Guide 93 Chapter 6 MAC Address Table Displaying the MAC Address Table To view the MAC address table perform the following procedure 1 2 From the Home page select Monitoring or Configuration From the Monitoring or Configuration menu select the Layer 2 option The Layer 2 page is displayed with the MAC Address tab selected by default as shown in Figure 23 Layer 2 MAC Address MAC Address Aging Time MAC Address Aging Time 300 0 1048575 second s View Add Unicast MAC Addresses View All O View Static View Dynamic m Name Marketing 34 FE D2 00 View MAC Addresses on Port s O View MAC Addresses for VLAN O View MAC Address EEL EL LEI View Add Multicast MAC Add
209. he MD5 authentication protocol after a message is received This algorithm generates the message digest The user is authenticated when the authentication protocol checks the message digest With the MD5 selection you can configure a Privacy Protocol SHA This value represents the SHA authentication protocol With this selection users are authenticated with the SHA authentication protocol after a message is received This algorithm generates the message digest The user is authenticated when the authentication protocol checks the message digest With the SHA selection you can configure a Privacy Protocol None This value represents no authentication protocol When messages are received users are not authenticated With the None selection you cannot configure a Privacy Protocol Section Ill SNMPv3 231 Chapter 18 SNMPv3 232 10 11 Note You may want to assign NONE to a super user In the Authentication Password field enter an authentication password of up to 32 alphanumeric characters In the Confirm Authentication Password field re enter the authentication password Note If you have the nonencrypted version of the AT S60 software then the Privacy Protocol field is read only Note You can only configure the Privacy Protocol if you have configured the Authentication Protocol with the MD5 or SHA values In the Privacy Protocol field enter one of the following options DES Select this valu
210. he SNMPv3 Target Parameters Table tab is shown in Figure 111 SNMPv3 Target Parameters Table Total Entries 6 Page 1of2 Message Params Name Processing Model Security Model Security Security Name Level Storage Type Row Status managerS0 vi Mgmt Protocols snmpmanager65 v3 snmpmanager 5 v3 snmpyv3manager1 20 v3 snmpyv3manager220 v3 v3 v3 v3 v3 v3 jenny murthy teresa hoa luke AuthPriv Nonvolatile AuthPriv NonvVolatile AuthPriv Nonvolatile AuthNoPriv NonVolatile AuthNoPriv NonVolatile Active Active Active Active Active Figure 111 SNMPv3 Target Parameters Table Tab Monitoring To display entries in the SNMPv3 Community Table perform the following procedure 1 From the Home page select Monitoring The Monitoring System page is displayed with the General tab selected by default as shown in Figure 9 on page 57 2 Select the SNMP tab The SNMP tab is shown in Figure 104 on page 279 3 In the SNMPv3 section click the button next to View Community Table and then click View at the bottom of the tab Section Ill SNMPv3 AT S63 Management Software Web Browser Interface User s Guide The SNMPv3 Community Table tab is shown in Figure 112 AT 9424T SP SNMPv3 Community Table Total Enties 5 Page 1 of 2 Community Security Transport Community Index Name Name Tag Storage Type testengtag testenginform 10555 SanJ
211. he Save Config option in the Configuration menu To display RSTP parameter settings perform the following procedure 1 2 3 4 From the Home page select Monitoring From the Monitoring menu select the Layer 2 option Select the Spanning Tree tab The Spanning Tree tabs is shown in Figure 116 on page 299 This tab displays information on whether spanning tree is enable or disabled and which protocol version STP or RSTP is active Click View Section IV Spanning Tree Protocols AT S63 Management Software Web Browser Interface User s Guide The Monitor RSTP Parameters tab is shown in Figure 121 Layer 2 dr 00 30 84 AB EF CD Monitor RSTP Parameters Force Version RSTP Bridge Priority 8 4096 32768 Bridge Hello Time 2 Bridge Forwarding 15 Bridge Max Age 20 Bridge Identifier 00 30 84 FE D2 00 Spanning Tree Root Bridge 00 30 84 FE D2 00 Root Priority 32768 Root Hello Time 2 Root Fowarding 5 Root Max Age 20 Root Path Cost 0 Figure 121 Monitor RSTP Parameters Tab Monitoring 5 To view port settings click a port in the switch image and click Status or Settings You can select more than one port An example of the RSTP Status page is shown in Figure 123 Rs onsas i OO Cd Total Ports Selected 1 Page lof 1 ate Role P2P Version Port Cost Figure 122 RSTP Port Status Page The RSTP Port Status page di
212. he changes are applied to the flow group 7 To permanently save your changes select the Save Config menu selection Deleting a Flow This procedure explains how to delete a flow group If the flow group to be Group deleted is already part of a QoS policy assigned to one or more switch ports you must modify the policy by removing the port assignments before you can delete the flow group You can assign the ports back to the policy after you have deleted the flow group To delete a flow group perform the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the Services option 3 Select the Flow Group tab The Flow Group tab is shown in Figure 60 on page 184 4 Select the flow group to be deleted and click Delete The flow group is deleted from the switch 5 To permanently save your changes select the Save Config menu selection Displaying the To display the flow groups perform the following procedure Flow Groups 1 From the Home page select Monitoring 2 From the Monitoring menu select the Services option 3 Select the Flow Group tab 188 Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide The Flow Group tab is shown in Figure 63 AT 9424T SP System Name Marketing MAC Addr 00 30 84 4B EF CD Page lof 1 Current FG s ID Description Active Parent Traffic Class Classifier List test No Gin
213. he date and time the event occurred Event This item contains two parts The first is the name of the AT S63 module that generated the event The second is a description of the event 143 Chapter 11 Event Logs and Syslog Servers 144 An example of the Full mode is shown in Figure 39 Severity Date and Time Filename Line Event 04 20 04 04 20 04 04 20 04 04 20 04 04 20 04 0420 04 04 20 04 04 20 04 04 20 04 04 20 04 06 56 54 06 56 54 06 56 54 06 56 55 06 56 55 06 56 55 06 56 55 06 56 56 06 56 56 06 56 56 gt O e gt O e e e e e e E e d oon 232 2 2 Q0 A 2 gt fileapp c 131 webserv c 9 atissh c 535 cfgmain c 159 tacacs c 830 radiusclient c 1280 garpmain c 259 qosapp c 711 qosapp c 787 qosapp c 787 file File System initialized http Server reset to defaults ssh SSH server disabled cfg Configuration initialized tacacs TACACS initialized radius RADIUS initialized garp GARP initialized qos Number of Egress Queues setto 8 qos Priority D mapped to Egress Queue 0 qos Priority 1 mapped to Egress Queue 1 Clearing an Event Log 2 1 Figure 39 Event Log Example Displayed in Full Mode The additional information displayed in Full mode is defined here Event ID A unique random number assigned to each event Filename Line The originator of the event displayed as the name of the AT S63 software source file and
214. he local subnet from where it will reach the syslog server The switch uses the IP address of the interface as its source address when sending packets to the server Configuring the switch to send its events to a syslog server involves creating a syslog output definition This involves specifying the IP address of the syslog server along with other information such as the types of event messages the switch is to send to the server This section contains the following topics Configuring a Syslog Output Definition next Viewing a Syslog Output Definition on page 150 Modifying a Syslog Output Definition on page 150 UU UU Deleting a Syslog Output Definition on page 151 Configuring a To configure a syslog output file perform the following procedure Syslog Output fie 1 From the home page select Configuration Definition 2 From the Configuration menu select the System option 3 Select the Event Log tab The Event log tab is shown in Figure 37 on page 139 4 In the Configure Log Outputs section click Create Section Il Advanced Operations 147 Chapter 11 Event Logs and Syslog Servers The Create Log Output page is shown in Figure 41 Output ID Type 0 2 20 0 1 Reserved SysLog Output Status Syslog Server IP Address Enabled e Message Format Facility Level Extended x DEFAULT x Severity Selections Module Selections D Debug E Error VWeWarning Hnformation zs
215. he name associated with this trap message Enter a descriptive name of up to 32 alphanumeric characters For example you might want to define a trap message for hardware engineering and enter a value of hardwareengineeringtrap for the Notify Name 6 In the Notify Tag field enter a description name of the Notify Tag 254 Section Ill SNMPv3 Deleting a Notify Table Entry Section Ill SNMPv3 10 AT S63 Management Software Web Browser Interface User s Guide Enter a name of up to 32 alphanumeric characters In the Notify Type field enter one of the following message types Trap Indicates this notify table is used to send traps With this message type the switch does not expects a response from the host Inform Indicates this notify table is used to send inform messages With this message type the switch expects a response from the host In the Storage Type field select one of the following storage types for this table entry Volatile Select this storage type if you do not want the ability to save an entry in the Notify Table After making changes to a Notify Table entry with a Volatile storage type the Save Config option is not displayed on the Configuration menu NonVolatile Select this storage type if you want the ability to save an entry in the Notify Table After making changes to a Notify Table entry with a NonVolatile storage type the Save Config option is not displayed on the Configuration menu
216. he token bucket is used in situations where you set a maximum bandwidth for a class but where traffic activity may periodically exceed the maximum A token bucket can provide a buffer for those periods where the maximum bandwidth is exceeded Tokens are added to the bucket at the same rate as the traffic class maximum bandwidth set with option 6 Max Bandwidth For example a maximum bandwidth of 50 Mbps adds tokens to the bucket at the same rate If the amount of traffic flow matches the maximum bandwidth no traffic is dropped because the number of tokens added to the bucket matches the number being used by the traffic However no unused tokens will accumulate in the bucket If the traffic increases the excess traffic is discarded since no tokens are available for handling the increase If the traffic is below the maximum bandwidth unused tokens will accumulate in the bucket since the actual bandwidth falls below the specified maximum The unused tokens will be available for handling excess traffic should the traffic exceed the maximum bandwidth Should an increase in traffic continue to the point where all the unused tokens are used up packets will be discarded Unused tokens accumulate in the bucket until the bucket reaches maximum capacity set by this parameter Once the maximum capacity of the bucket is reached no extra tokens are added Note To use this parameter you must specify a maximum bandwidth using the Max Bandwi
217. he user configured VLAN information is lost and you must recreate the information if you later return the switch to the user configured VLAN mode To select a VLAN mode for the switch perform the procedure below 1 From the home page select Configuration 2 From the Configuration menu select the Layer 2 option 3 Select the VLAN tab The VLAN tab is shown in Figure 132 on page 336 4 Inthe VLAN Mode section select a VLAN mode Only one mode can be active on the switch at a time The modes are User Configured Port based and tagged VLAN Mode Multiple Non IEEE 802 1Q compliant Multiple VLAN Mode Multiple 802 1Q IEEE 802 1Q compliant Multiple VLAN Mode 5 If you are selecting one of the multiple VLAN modes specify an uplink port in the Uplink Port field This port functions as the uplink port for the VLANs The default is port 1 6 Click Apply The new mode is automatically activated on the switch 7 To permanently save your changes select the Save Config option in the Configuration menu Secton V Virtual LANs AT S63 Management Software Web Browser Interface User s Guide Displaying VLANs To display the current VLANs on a switch perform the following procedure 1 From the Home page select Monitoring 2 From the Monitoring menu select the Layer 2 option 3 Select the VLAN tab The VLAN tab is shown in Figure 134 Home eg L aert VLAN Configuration VLAN Medie U
218. hich events in the log are to be saved to the file For instructions refer to steps 3 to 7 in Displaying Events on page 140 5 In the Save Filename field enter a name for the file The name can be up to 16 alphanumeric characters and must include be log file name extension 6 Click Save The specified events in the log file are saved to the switch s file system as an ASCII file 7 To view the contents of the file refer to Listing the Files in Flash Memory or on a Compact Flash Card on page 124 To upload the file to a TFTP server refer to Uploading a File on page 134 To upload the file using Xmodem you must use a local management session 146 Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide Working with Syslog Output Definitions You can configure the switch to send its events to a syslog server which can store the events of many network devices simultaneously This can make managing your network easier since you need only go to one site the syslog server to see all the events of your network devices Here are the guidelines to observe when using this feature o You can define up to 19 syslog servers o The event log feature must be enabled on the switch in order for the device to send events to a syslog server For instructions refer to Enabling or Disabling the Event Logs on page 138 O The switch must have a routing interface on t
219. hould also be using Auto Negotiation Otherwise a duplex mode mismatch can occur A switch port using Auto Negotiation defaults to half duplex if it detects that the end node is not using Auto Negotiation This results in a mismatch if the end node is operating at a fixed duplex mode of full duplex To avoid this problem when connecting an end node with a fixed duplex mode of full duplex to a switch port you should disable Auto Negotiation on the port and set its speed and duplex mode manually O Ifyou disable Auto Negotiation on a twisted pair port the auto MDI MDI X feature on a port is also disabled and the port defaults to the MDI X configuration If you disable Auto Negotiation and set a port s speed and duplex mode manually you might also need to set the port s MDI MDI X setting as well Section Basic Operations Section Basic Operations AT S63 Management Software Web Browser Interface User s Guide Possible settings are Auto Negotiate The port autonegotiates both speed and duplex mode This is the default 10Mbps Half Duplex 10Mbps Full Duplex 100Mbps Half Duplex 100Mbps Full Duplex 1Gb Full Duplex Applies only to 1000Base SFP and GBIC modules This selection should not be used An SFP or GBIC module should use Auto Negotiation to set its speed and duplex mode Note A 10 100 1000Base T twisted pair port must be set to Auto Negotiation to operate at 1000 Mbps You cannot manually con
220. ic Switch Parameters 56 this address as the next hop to reaching a remote network device such as a remote management workstation or a syslog server when the switch s local interface and the remote device are on different subnets The default value is 0 0 0 0 Section Basic Operations AT S63 Management Software Web Browser Interface User s Guide Displaying System Information To view basic information about the switch perform the following procedure 1 From the Home page select Monitoring The Monitoring System page is displayed with the General tab selected by default as shown in Figure 9 System System Information MAC Address IP Address 00 30 84 FE D2 00 149 35 62 14 Model Name Subnet Mask AT 9448TS XP 255 255 255 0 Serial Number Default Gateway A00502L040200004 0 0 0 0 System Up Time 0 Days 0 Hours 19 Minutes 44 Seconds System Name Marketing Administrator J Smith Comments Building 212 rm 502 BOOTP DHCP Static Software Information Application Software ATS63 v2 0 0 Build Date Mar 31 2006 15 46 33 Bootloader ATS63_LOADER v1 7 0 Build Date Mar 22 2006 14 06 25 Hardware Information Power Information Main Power Supply On Redundant Power Supply Not Connected System 1 254 Power 1 25V System 1 8V Power 1 83 System 2 5 Power 2 51V System 3 0 Power System 3 3V Power System 5 0 Power System 12 0V Power Temperature Information Syste
221. ick Apply The defense is immediately activated on the ports To permanently save your changes select the Save Config option in the Configuration menu Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide Displaying the DoS Settings To display the DoS settings perform the following procedure 1 From the Home page select Monitoring 2 From the Monitoring menu select Network Security 3 Select the DoS tab The DoS tab is shown in Figure 74 DoS LAN Subnet IP DoS LAN Subnet Mask 0 0 0 0 0 0 0 0 DoS Uplink Port 24 Network Security Syn Flood Ge Figure 74 DoS Tab Monitoring 4 Click the port whose DoS settings are to be displayed You can select more than one port at a time 5 Using the DoS Type list select the type of Denial of Service defense whose settings are to be displayed D Click View Section Il Advanced Operations 209 Chapter 16 Denial of Service Defense 210 The DoS Monitor for Port page opens as shown in Figure 75 Ties monitor for Pors 58 Type Mirror Port IP_OPTION Disable IP_OPTION Disable IP_OPTION Disable IP_OPTION Disable Figure 75 DoS Monitor for Ports Page The page displays a table that contains the following columns of information Port The port number Status Whether DoS is enabled or disabled on the port Type The type of DoS prevention Mirror
222. ield is always set to Exact In the Storage Type field select one of the following storage types for this table entry Volatile Select this storage type if you do not want the ability to save an entry in the Access Table After making changes to an Access Table entry with a Volatile storage type the Save Config option is not displayed on the Configuration menu NonVolatile Select this storage type if you want the ability to save an entry in the Access Table After making changes to an Access Table entry with a NonvVolatile storage type the Save Config option is displayed on the Configuration menu Allied Telesyn recommends this storage type Note The Row Status parameter is a read only field in the web browser interface The Active value indicates the Access Table entry takes effect immediately Click Apply to update the SNMPv3 Access Table To permanently save your changes select the Save Config option in the Configuration menu Section IIl SNMPv3 AT S63 Management Software Web Browser Interface User s Guide Configuring the SNMPv3 SecurityToGroup Table Creating a SecurityToGroup Table Entry Section Ill SNMPv3 You can create delete and modify an SNMPv3 SecurityToGroup Table entry See the following procedures o Creating a SecurityToGroup Table Entry on page 247 0 Deleting a SecurityToGroup Table Entry on page 250 0 Modifying a SecurityToGroup Table Entry on page 250 F
223. iguration menu select the Services option 3 Select the Traffic Class tab The Traffic Class tab is shown in Figure 64 AT 9424T SP Current Traffic Classes ID Description Active Parent Policy ID Flow Group List Gin DSCP traffic 17 No 1 o 8 DSCP 4 Yes 12 Services Figure 64 Traffic Class Tab The columns in the tab are defined here ID The ID of the traffic class Description A description of the traffic class Active Whether this traffic class is active on the switch An active traffic class is part of a policy assigned to one or more switch ports An inactive traffic class is not assigned to any policies or to policies that are not assigned to switch ports Section Il Advanced Operations Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide Parent Policy ID The QoS policies to which the traffic class is assigned Flow Group List The flow groups assigned to this traffic class To create a new traffic class click Create The Create Traffic Class page is shown in Figure 65 Description D 0 511 Exceed Action DROP e DSCP Value 0 63 Burst Size He 2 Remark Priority NO W ToS Move Priority To ToS Exceed Remark value 0 0 63 Max Bandwidth 0 1016 Priority 0 7 Move ToS To Priority No si Flow Group List De Pa v Figure 65 Create Traffic Class Pa
224. igure SH IOME Page TTT 34 Figure 4 Save Config Option in the Configuration Men 37 Chapter 2 Basic Switch Parameters ucecicic cccccces tees scevecescanseeteee ccs ccneneseevevscauedenenensceverueencesenantned etedeeeenete 43 Figure 5 General Tab Configuration eee eeeenee eee eeeaeeeeseeeaaeeeeeeeeaeeeeeeecaeeeeeneereeeseenieeeeeeneaas 44 Figure 67 System Time Val E 49 Figure 7 Ping Client Tab Monitoring 52 Figure 8 System Utilities Tab Confiouraton cece eeeeeeeeeeeeece eee eeeaaeeeeseeaaaeeeeeeeaaeeeeseenaeeeeeeeneeeeeneeaas 54 Figure 9 General Tab Monitoring 57 Chapter 3 Enhanced Stacking ccccsseecccecsseeeeeeeeeeeeeeeeeeeseeeeseeeeeeaeseeeesseeeseeeesseaeseeeeseaaeseeseseeaseeeseseeaseeeeenees 61 Figure 10 Enhanced Stacking Tab Configuration sesssssseessssserreseerrresttertsstttrrnssttnnnnssttnnsnsttnrnssttennssten n 63 Figure 11 Stacking Switches Page arees rnar a E T O E OA 64 Figure 12 Enhanced Stacking Tab Monitoring 67 Chapter 4 SNMPv1 and SNMPV2C eeeeeeeee eee eee eens eea anon eee e eena aaa aa sa a eanan Saa aa aaaea aaa inanan aaiae 69 Figure 13 SNMP Tab CGontouraton naaa aiinaaaa anaa 70 Figure 14 SNMPv1 amp SNMPv2c Communities Tab 72 Figure 15 Add New SNMPv1 amp SNMPv2c Community Page 73 Figure 16 SNMP Tab Monitoring niiin a E LAE AAAA R AARE A AAA LAE 77 Figure 17 SNMPv1 amp SNMPv2c Communities Tab Monitoring 78 Chapter 5 Port Para O O S a r E
225. in 15 C F R Part 740 17 In no case may it be exported to Cuba Iran Iraq Libya North Korea Sudan or Syria If you wish to transfer this software outside the United States or Canada please contact your local Allied Telesyn sales representative for current information on this product s export status Preface How This Guide is Organized This guide is organized into the following sections Section Basic Operations The chapters in this section explain how to start a management session and perform basic tasks including how to configure port parameters set up SNMPv1 and SNMPv2c access enhanced stacking and create port trunks and a port mirror O Section Il Advanced Operations This section includes information about the file system uploading and downloading files using the event log and working with classifiers Quality of Service IGMP and Denial or Service prevention D Section Ill SNMPv3 The chapter in this section contains the procedures for configuring SNMPv3 O Section IV Spanning Tree Protocols The chapters in this section contain the procedures for configuring the Spanning Tree Rapid Spanning Tree and Multiple Spanning Tree Protocols Section V Virtual LANs The chapters in this section cover port based and tagged VLANs and GVRP O Section VI Port Security This section includes chapters on MAC address based port security and 802 1x port based network access control O Sectio
226. ines a MIB View and the Subtree Mask parameter further restricts a user s view to a specific the column and row of the MIB View The value of the Subnet Mask parameter is dependent on the subtree you select For example if you configure the View Subtree parameter as MIB ifEntry 0 3 it has the following value 1 3 6 1 2 1 2 2 1 0 3 To restrict the user s view to the third row all columns of the MIB ifEntry 0 3 enter the following value for the Subtree Mask parameter ff bf In the View Type field enter one of the following view types Included Enter this value to permit the user to see the subtree specified above Excluded Enter this value to not permit the user to see the subtree specified above In the Storage Type field enter a storage type for this table entry Volatile Select this storage type if you do not want the ability to save an entry in the View Table After making changes to a View Table entry with a Volatile storage type the Save Config option is not displayed on the Configuration menu Section Ill SNMPv3 Deleting a View Table Entry Modifying a View Table Entry Section Ill SNMPv3 AT S63 Management Software Web Browser Interface User s Guide NonVolatile Select this storage type if you want the ability to save an entry in the View Table After making changes to a View Table entry with a NonVolatile storage type the Save Config option is displayed on the Configuration menu Allied Telesyn re
227. ing 362 To display the GIP connected ports ring perform the following procedure 1 2 From the Home page select Monitoring From the Monitoring menu select the Layer 2 option Select the GVRP tab The GVRP tab is shown in Figure 138 on page 353 In the View GVRP Parameters section click View GIP Connected Ports Ring Click View The GIP Connected Ports Ring page is shown in Figure 143 Figure 143 GIP Connected Ports Ring Page The GIP Connected Ports Ring page displays a table that contains the following columns of information GIP Context ID A number assigned to the instance for the GIP context STP ID Present if the GARP application is GVRP identifies the spanning tree instance associated with the GIP context Ring The ring of connected ports Only ports presently in the spanning tree Forwarding state are eligible for membership in the GIP connected ring If no ports exist in the GIP connected ring No ports are connected is displayed If the GARP application has no ports No ports have been assigned is displayed Section V Virtual LANs Section VI Port Security The chapters in this section provide the procedures for configuring port security The chapters include Oo Chapter 23 MAC Address based Port Security on page 365 Oo Chapter 24 802 1x Port based Network Access Control on page 371 Section VI Port Security 363 364 Section VI Port Secu
228. ion Sends only informational event messages Informational messages display useful information that you can ignore during normal operation Debug Sends debug event messages These events provide detailed high volume information that is intended only for technical support personnel Type Specifies the type of the output definition The only option is Syslog Syslog Server IP Address Specifies the IP address of the syslog server Facility Level Specifies the numerical code to be added to the entries when sent to the syslog server The facility levels are listed in Table 4 Table 4 Default Syslog Facilities Facility Mapped Event Log Modules and Events Default This setting uses the functional groupings as defined in the RFC 3164 standard local 1 through These settings assign a specific identifier to the local 7 events Note For further information about the syslog facility levels refer to Chapter 12 Event Logs and Syslog Servers in the AT S63 Management Software Menus Interface User s Guide Module Selections Specifies the AT S63 management software module s whose events are to be sent to the syslog server To select more than one use the Ctrl key when making your selections The default is All For a list of modules refer to Table 2 on page 141 Click Apply The switch creates the new log output server definition and immediately begins sending events to the server provided that the Ou
229. ions Services S em Name Marketing ddr 00 30 84 AB EF CD Policies Page 1of1 Current Policies Description Active GI DSCP 17 traffic No 12 DSCP 4 traffic Yes 2 3 Traffic Class List Ingress Port List Figure 71 Policies Tab Monitoring The Policies tab displays the existing policies in a table with the following columns of information 203 Chapter 15 Quality of Service 204 ID The ID of the policy Description A description of the policy Active Whether this policy is active on the switch An active policy is assigned to one or more switch ports An inactive policy is not assigned to any switch ports Traffic Class List The traffic classes of the policy Ingress Port List The ingress ports of the policy To view the details of a specific policy select the policy and click View The settings of the policy are displayed in the View Policy page For parameter definitions refer to Configuring a Policy on page 198 5 Click Close Section Il Advanced Operations Chapter 16 Denial of Service Defense This chapter contains instructions on how to configure the Denial of Service defense feature on the switch The sections include o Configuring Denial of Service Defense on page 206 o Displaying the DoS Settings on page 209 Note For background information refer to Chapter 17 Denial of Service Defense in the AT S63 Manageme
230. irror is now disabled The switch stops copying the traffic on the source ports to the destination port To permanently save your changes select the Save Config option in the Configuration menu Section Basic Features AT S63 Management Software Web Browser Interface User s Guide Deleting a Port Mirror Section Basic Features To delete a port mirror so that you can use the destination port for normal network operations perform the following procedure 1 2 From the home page select Configuration From the Configuration menu select the Layer 1 option Select the Port Mirroring tab The Port Mirroring tab is shown in Figure 30 on page 114 Click Modify The Modify Mirror page is shown in Figure 31 on page 115 Click the Enable Mirror checkbox to remove the check and disable the mirror Click the destination port white port until it is black Click Apply The destination port can now be used for normal network operations To permanently save your changes select the Save Config option in the Configuration menu 119 Chapter 8 Port Mirroring Displaying the Port Mirror 120 To display the port mirror perform the following procedure 1 From the Home page select Monitoring 2 From the Monitoring menu select the Layer 1 option 3 Select the Port Mirroring tab The Port Mirroring tab is shown in Figure 33 AT 9424T SP tome Por Mirroring system Total Mirr
231. is unavailable To create a new community string click Add The Add New SNMPv1 amp SNMPv2c Community page is shown in Figure 15 on page 73 EAs tid Community Name Status Enable O Disable Access Mode Read Only O Read Write Managers Trap Receivers DAllow Any Station Manager IP Address 1 Trap Receiver IP Address 1 Manager IP Address 2 Trap Receiver IP Address 2 Manager IP Address 3 Trap Receiver IP Address 3 Manager IP Address 4 Trap Receiver IP Address 4 Manager IP Address 5 Trap Receiver IP Address 5 Manager IP Address 6 Trap Receiver IP Address 6 Manager IP Address 7 Trap Receiver IP Address 7 Manager IP Address 8 Trap Receiver IP Address 8 Figure 15 Add New SNMPv1 amp SNMPv2c Community Page 73 Chapter 4 SNMPv1 and SNMPv2c 74 6 Configure the following parameters Community Name Enter the new community string The name can be up to 32 alphanumeric characters No spaces or special characters such as or amp are allowed Status Enable or disable the community string A disabled community string cannot be used to access the switch The default is enabled Access Mode Specify the access mode for the SNMP community string A string with a Read Only access mode can only be used to view the MIB objects on the switch A string with a Read Write access mode can be used to both view and change the SNMP MIB objects Allow Any Station Set the community string
232. isplaying RSTP Settings on page 306 Resetting RSTP to the Default Settings on page 309 uN Caution The bridge provides default RSTP parameters that are adequate for most networks Changing them without prior experience and an understanding of how RSTP works might have a negative effect on your network You should consult the IEEE 802 1w standard before changing any of the RSTP parameters 02 a 0 Configuring To configure RSTP bridge parameters perform the following procedure RSTP Bridge From the Home page select Configuration Settings 2 From the Configuration menu select the Layer 2 option 3 Select the Spanning Tree tab The Spanning Tree tab is shown in Figure 113 on page 292 4 Click Configure 302 Section IV Spanning Tree Protocols AT S63 Management Software Web Browser Interface User s Guide The Configure RSTP Bridge Parameters tab is shown in Figure 119 Layer 2 Configure RSTP Parameters Force Version Bridge Max Age 6 40 O Force STP Compatible RSTP 20 Bridge Priority 0 15 Bridge Identifier 8 2 Bridge Hello Time 1 10 Root Bridge Bridge Forwarding 4 30 32768 System Name Marketing MAC Addr 00 30 84 A4B EF CD 4096 32768 00 21 46 A7 B4 43 00 21 46 A7 B4 43 Root Priority 15 Section IV Spanning Tree Protocols Figure 119 Configure RSTP Parameters Tab Configuration 5 Configure the following parameters
233. ither log to display the events of the switch since the unit was last reset But to view the events that preceded a system reset you must view the permanent event log The following procedures explain how to view the events in the event logs as well as how to enable and disable the logs The procedures include Enabling or Disabling the Event Logs on page 138 Displaying Events on page 140 Clearing an Event Log on page 144 Modifying the Event Log Full Action on page 145 WS WS WS ST Saving an Event Log to a File on page 146 This procedure explains how to enable and disable the event logs on the switch If you disable the logs the AT S63 management software will not store events in its logs or send events to a syslog server The default setting for the event logs is enabled Note Allied Telesyn recommends setting the switch s date and time if you intend to use the event logs Otherwise the entries will not have the correct information when entered in the logs or sent to a syslog server For instructions refer to Setting the System Date and Time on page 48 To enable or disable the event logs perform the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the System option 3 Select the Event Log tab Section II Advanced Operations AT S63 Management Software Web Browser Interface User s Guide The Event log tab is shown in Fi
234. ivate encryption key onto a switch but you can a public key However since the switch can use only those encryption keys it has generated itself Allied Telesyn recommends against downloading any keys onto the switch O The web browser interface does not support downloading a file to a compact flash memory card in a switch If you are downloading the AT S63 image file note these additional guidelines 0 All models of the AT 9400 Series switch use the same AT S63 image file D The AT S63 image file contains the bootloader for the switch You cannot load the image file and bootloader separately o Installing a new AT S63 software image does not change the current configuration of a switch D If you are upgrading an AT 9400 Series switch from AT S63 version 1 3 0 or earlier and the switch has an IP address the upgrade process automatically creates a routing interface on the switch to preserve the 130 Section II Advanced Operations Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide device s IP configuration If the switch has a static address the interface is assigned the same address If the unit obtained its IP configuration from a DHCP or BOOTP server the interface is created with its DHCP or BOOTP client activated The interface is given the interface number 0 and assigned to the preexisting management VLAN Furthermore the interface is designated as the local interface on
235. ix A in the AT S63 Management Software Menus Interface User s Guide 5 Configure the following parameters as necessary 81 Chapter 5 Port Parameters 82 Description Name Use this selection to assign a name to a port from 1 to 15 alphanumeric characters Spaces are allowed but do not use special characters such as asterisks or exclamation points You cannot assign a name when you are configuring more than one port Status Use this selection to enable or disable a port When disabled a port does not accept or forward frames You might disable a port if a problem occurs with the end node or cable After the problem has been fixed you can enable the port again to resume normal operation You might also disable an unused port to secure it from unauthorized connections The possible settings are Enabled The port forwards ingress and egress packets This is the default setting Disabled The port does not forward any ingress or egress packets Speed and Duplex You use this selection to configure a port for Auto Negotiation or to manually set a port s speed and duplex mode If you select Auto Negotiate for Auto Negotiation which is the default setting the switch sets both speed and duplex mode for the port automatically Note the following about the operation of Auto Negotiation on a switch port O In order for a switch port to successfully autonegotiate its duplex mode with an end node the end node s
236. kground information on encryption keys refer to Chapter 33 Encryption Keys in the AT S63 Management Software Menus Interface User s Guide For background information on PKI and SSL refer to Chapter 34 PKI Certificates and SSL in the AT S63 Management Software Menus Interface User s Guide 391 Chapter 25 Encryption Keys PKI and SSL Displaying the Encryption Keys 392 To configure the encryption keys you must use the AT S63 menus or command line interface For more information about encryption keys refer to the AT S63 Management Software Menus Interface User s Guide To display the encryption keys perform the following procedure 1 From the Home page select Monitoring 2 From the Monitoring menu select the Mgmt Security option 3 Select the Keys tab The Keys tab is shown in Figure 156 System Name Marketing MAC Addr 00 30 84 4B EF CD Total Keys 1 Page lof 1 Key ID Algorithm Length Digest Description 243 RSA Private 512 E8DD94FB Local key Mgmt Security Figure 156 Keys Tab Monitoring The Keys tab displays a table that contains the following columns of information ID The identification number of the key Algorithm The algorithm used in creating the encryption This is always RSA Private Length The length of the key in bits Digest The CRC32 value of the MD5 digest of the public key Section VII Management Security
237. lassifier tab The Classifier tab is shown in Figure 44 on page 154 4 Click the dialog circle next to the classifier to be modified and click Modify You can modify only one classifier at a time An example of the Modify Classifier page is shown in Figure 47 Met ID Description 1 test Destination MAC Source MAC Ethernet Format Any m Priority VLAN ID 0 7 1 4094 Protocol User Specified Protocol User Specified xj ae _lose_ Figure 47 Modify Classifier Page 5 Modify the parameters as necessary For descriptions of the parameters refer to Configuring a Classifier on page 154 160 Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide 6 When you are finished modifying the parameters click Apply The modifications are immediately implemented in the classifier 7 To permanently save your changes select the Save Config option in the Configuration menu Section Il Advanced Operations 161 Chapter 12 Classifiers Deleting a Classifier To delete a classifier perform the following procedure 162 Note A classifier must be removed from all access control lists and QoS policies before it can be deleted From the home page select Configuration From the Configuration menu select the Network Security or Services option The Classifier tab is accessible from both menu selections Select the Classifier tab
238. latile Active summer MD5 DES Nonvolatile Active aal ae Type Row Status User Name Mgmt Protocols Figure 105 SNMPv3 User Table Tab Monitoring Displaying View To display entries in the SNMPv3 View Table perform the following Table Entries Procedure 1 From the Home page select Monitoring The Monitoring System page is displayed with the General tab selected by default as shown in Figure 9 on page 57 2 Select the SNMP tab The SNMP tab is shown in Figure 104 on page 279 3 In the SNMPv3 section click the button next to View View Table and then click View at the bottom of the tab 280 Section Ill SNMPv3 AT S63 Management Software Web Browser Interface User s Guide The SNMPv3 View Table tab is shown in Figure 106 SNMPv3 View Table Total Entries 6 Page 1 of 2 View Name SubTree OID SubTree Mask View Type Storage Type Row Status Mgmt Protocols internet O directory O experimental 1 3 6 1 2 1 3 6 1 4 1 3 6 1 1 3 6 1 1 1 3 6 1 3 Excluded Included Included Included Excluded Nonvolatile Volatile Nonvolatile NonvVolatile NonvVolatile Figure 106 SNMPv3 View Table Tab Monitoring Displaying Access To display entries in the SNMPv3 Access Table perform the following Table Entries Procedure 1 From the Home page select Monitoring The Monitoring System page is displayed with the General tab selected by defa
239. lient Configuration Page cecccecereeeeeetneeee eee etneeeeeeeicieeeeeeteeeeesenieeeeersieeeeees 408 Figure 164 Server Based Authentication Tab Monitong 410 Figure 165 TACACS Client Configuration Page ccececeecereeeeeeeneeeeeeeeineeeeee tases eeeeeeeeeeetieeeeeseieeeees 411 Figure 166 RADIUS Client Configuration Page ccccccesceceeeeeeeeeeeeeeeeeeeeeseneeeeeeeeeeeeeeeeseneaeeeeeteeaaaeesenenaeeees 412 Figure 167 RADIUS Client Configuration Page ccccccccceceseeeneeeeeseeeeeeeeeseneeeeeeseeeeeeeeeseneaeeeeesenaeeeseeenaneees 414 AT S63 Management Software Menus Interface User s Guide Chapter 28 Management Access Control List ccceeeceeeeeneeeeeeeeeeeeeeeseeeeeeeneaseeeeeeeeaeseeeeeeseeseeeeeneseseenens 417 Figure 168 Mgmt ACL Tab Configuration c ccecceeeeeee enter teeter tenses eter eee eetaeee eee teeeeeeeneeeeessieeeeenenea 419 Figure 169 Mgmt ACL Tab Monitoring cecccceeeeeneeee eee enne eee seen eee ee eaaeeeeeeeaeeeeeeeaaeeeeeeeaaeeessiaeeeeeneeaas 423 Figures Tables Table 1 New Features in AT S63 Version 200 22 Table 2 New Features in AT S63 Version 30 23 Table 3 New Features in AT S63 Version 20 24 Table 4 Twisted Pair Ports Matched with GBIC and SFP Slots 0 0 c ccccececeecceeesecee cece eeeeaeeeeeeeseaaeeeeeeecaeaeeeseeeeaeeeeenennaees 39 Table 5 AT S63 Software MOdUles A 141 Table 6 Event Severity Levels irens hiii e eia iei cudhcues r e t
240. llowing procedure 1 Start your web browser Note If your PC with the web browser is connected directly to the switch to be managed or is on the same side of a firewall as the switch you must configure your browser s network options not to use proxies Consult your web browser s documentation on how to configure the switch s web browser to not use proxies 2 Inthe URL field of the browser enter the IP address of the local interface on the isolated switch or the master switch of an enhanced stack If the switch is configured for SSH management the prefix HTTPS is required Z Home Microsoft Internet Explorer File Edit View Favorites Tools Help EE Ala ma ol P G Search Favorites History Mail Print Edit Related Back Forward Stop Refresh Home Address Switch s R Address Figure 1 Entering a Switch s IP Address in the URL Field The AT S63 management software displays the login page shown in Figure 2 AT 9424T SP System Name Marketing MAC Addr 00 30 84 4B EF CD User Name Password Copyright 2005 Allied Telesyn Inc All rights reserved Figure 2 AT S63 Login Page Section Basic Operations 33 Chapter 1 Starting a Web Browser Management Session 34 Enter a user name and password The AT S63 management software comes with two standard accounts manager and operator The former allows you to change the switch s parameter s
241. lowing files 02 a 0 Boot configuration file Public encryption key CA enrollment request Event log file Note the following before performing this procedure m You must use TFTP to upload a file from a web browser management session There must be a node on your network with the TFTP server software You should start the TFTP server before beginning the upload procedure The switch must have a routing interface on the local subnet from where it will reach the TFTP server The switch uses the IP address of the interface as its source address when sending packets to the TFTP server If the switch does not have an interface you can upload the file from a local management session on the switch using Xmodem For instructions refer to the AT S63 Management Software Menus Interface User s Guide The web browser interface does not support uploading a file from a compact flash memory card in the switch to a TFTP server That type of transfer is supported from the menus and command line interfaces To upload a file perform the following procedure 1 2 From the home page select Configuration From the Configuration menu select the Utilities option The Utilities page is displayed with the System Utilities tab displayed by default Note The top portion of the tab is used to return the switch to its factory default settings For instructions refer to Returning the AT S63 Management Software to the Fac
242. lt value is 256 certificates The lower section displays a table that lists the current certificates in the database and contains the following columns of information Name The certificate name State The state of the certificate one of the following Section VII Management Security Section VII Management Security AT S63 Management Software Web Browser Interface User s Guide Trusted The certificate is from a trusted CA Untrusted The certificate is from an untrusted CA MTrust Manually Trusted The certificate has been manually verified that it is from a trusted or untrusted authority Type The certificate type one of the following EE The certificate was issued by a CA CA The certificate belongs to a CA Self A self signed certificate Source The certificate was created on the switch To view the details about a certificate click the certificate and click View The X509 Certificate Details page is shown in Figure 158 X509 Certificate Details Name first State Trusted Manually Trusted True Type EE Source Command Version V3 0X2 Serial Number 0 0X0 mdd5WithRSAEncryption rsaEncryption May 12 07 39 41 2004 GMT May 12 07 39 41 2006 GMT Signature Algorithm Public Key Algorithm Not Valid Before Not Valid After Subject CN marketing Issuer CN marketing 6B 5C A8 81 AA1 7 AE DB E7 2B 3C 11 2F 90 92 D3 A5 0D 6B 89 E7 75 25 36 BE 72 34 BC 24 87 33 8D 15 80 75 94 MD5 Fingerprint
243. lticast option The Multicast page is displayed with the IGMP tab as shown in Figure 77 Multicast AT 9424T SP IGMP Snooping Status Host Roger Timeout Interval Disable 260 seconds Snoop Topology Maximum Multicast Groups Single Host Port Edge Multicast Router Ports Mode Auto Select View Multicast Hosts List O View Multicast Routers List Section Il Advanced Operations Figure 77 GMP Tab Monitoring For definitions of the parameters in the tab refer to Configuring IGMP Snooping on page 212 To view the multicast addresses and the host nodes click View Multicast Hosts List and then click View The View Multicast Hosts List page is displayed The page contains the following columns of information Multicast Group The multicast address of the group 215 Chapter 17 IGMP Snooping 216 VLAN ID The VID of the VLAN where the port is an untagged member Member Port Trunk ID The port on the switch where the host node is connected If the host node is connected to the switch through a trunk the trunk ID number not the port number is displayed Host IP The IP address of the host node connected to the port Version The version of IGMP used by the host Exp Time The number of seconds remaining before the host is timed out if no further IGMP reports are received from it Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s G
244. m Temperature Celsius Fan Information System Fan 1 Speed 7417 RPM System Fan 2 Speed 7336 RPM System Fan 3 Speed 6026 RPM System Fan 4 Speed 7258 RPM Figure 9 General Tab Monitoring Section Basic Operations 57 Chapter 2 Basic Switch Parameters 58 The System Information section displays the following information MAC Address The MAC address of the switch Model Name The model name of the switch Serial Number The serial number of the switch System Name The name of the switch To set the name refer to Configuring the Switch s Name Location and Contact on page 44 Administrator The name of the network administrator responsible for managing the switch To set the name of the administrator refer to Configuring the Switch s Name Location and Contact on page 44 Comments The location of the switch for example 4th Floor rm 402B To set the location refer to Configuring the Switch s Name Location and Contact on page 44 BOOTP DHCP The source of the IP address of the local interface This field will be DHCP or BOOTP if the local interface obtained its IP configuration from a DHCP or BOOTP server Alternatively if the IP address was set manually this field will be Static This field will be blank if the switch does not have a local interface IP Address The IP address of the local interface Subnet Mask The subnet mask of the local i
245. mit Discarded Port Not Sending Number of GARP PDUs discarded because the port that the PDUs were to be transmitted on was not sending that is MODE NONE was set on the port Receive Discarded Invalid Port Number of GARP PDUs discarded because the port that received the PDU does not belong to the GARP application Receive Discarded Invalid Protocol Number of GARP PDUs discarded because the GARP PDU contained an invalid protocol Receive Discarded Invalid Format Number of GARP PDUs discarded because the format of the GARP PDU was not recognized Receive Discarded Database Full Number of GARP PDUs discarded because the database for the GARP application was full that is the maximum number of attributes for the GARP application is in use Receive GARP Messages LeaveAll Number of GARP LeaveAll messages received by the GARP application Transmit GARP Messages LeaveAll Number of GARP LeaveAll messages transmitted by the GARP application Receive GARP Messages JoinEmpty Total number of GARP JoinEmpty messages received for all attributes in the GARP application Section V Virtual LANs AT S63 Management Software Web Browser Interface User s Guide Table 13 GVRP Counters Continued Parameter Meaning Transmit GARP Messages JoinEmpty Total number of GARP JoinEmpty messages transmitted for all attributes in the GARP application Receive GAR
246. n Il Advanced Operations Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide TCP Flags Defines a traffic flow by TCP flag To set this parameter IP Protocol must be set to TCP Options are URG Urgent ACK Acknowledgement RST Reset PSH Push SYN Synchronization o EIN Finish WS WS WS ST UDP Source Port Defines a traffic flow by source UDP port To set this parameter IP Protocol must be set to UDP UDP Destination Port Defines a traffic flow by a destination UDP port To set this parameter IP Protocol must be set to UDP Click Apply The new classifier is created on the switch TO permanently save your changes select the Save Config option in the Configuration menu 159 Chapter 12 Classifiers Modifying a Classifier This procedure explains how to modify a classifier Note If the classifier to be modified is currently assigned to an ACL or QoS policy that has been assigned to a switch port you must first remove the port assignments from the ACL or policy before modifying the classifier After modifying the classifier you can reassign the ports again to the ACL or QoS policy To modify a classifier perform the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the Network Security or Services option The Classifier tab is accessible from both menu selections 3 Select the C
247. n VII Management Security This section contains chapters about encryption keys PKI Secure Shell TACACS and RADIUS and the management access control list Note The web browser interface supports a subset of the management functions of the switch Refer to Restrictions to the Web Browser Interface on page 41 for a list of the management tasks not supported by this interface Management tasks not supported from the web browser interface can be performed from the menus and command line interfaces AT S63 Management Software Web Browser Interface User s Guide Document Conventions This document uses the following conventions Note Notes provide additional information Caution Cautions inform you that performing or omitting a specific action may result in equipment damage or loss of data AN Warning Warnings inform you that performing or omitting a specific action may result in bodily injury Preface Where to Find Web based Guides 20 The installation and user guides for all Allied Telesyn products are available in portable document format PDF on our web site at www alliedtelesyn com You can view the documents online or download them onto a local workstation or server AT S63 Management Software Web Browser Interface User s Guide Contacting Allied Telesyn Online Support Email and Telephone Support Returning Products Sales or Corporate Information Manageme
248. n from the menus and command line interfaces Server Key ID Specifies the ID number of the encryption key for the SSH server The key must already exist on the switch The default is Not Defined Server Expiry Time Sets the time in hours for a server key to expire This timer determines how often a server key is regenerated for security purposes A server key is only valid for the time period configured in the Server Key Expiry Expiration Time timer Allied Telesyn recommends setting this field to 1 to regenerate the key every hour Login Timeout Specifies the time in seconds it takes to release the SSH server from an incomplete SSH client connection The default is 180 seconds 3 minutes The range is 60 to 600 seconds Click Apply To permanently save your changes select the Save Config option in the Configuration menu 401 Chapter 26 Secure Shell SSH Displaying the SSH Settings To view the Secure Shell settings perform the following procedure 1 2 From the Home page select Monitoring From the Configuration menu select the Mgmt Protocols option Select the Secure Shell tab The Secure Shell tab is shown in Figure 161 Mgmt Protocols Secure Shell Secure Shell Settings SSH Versions Supported 1 3 1 5 2 0 Status Disabled Server Port 22 Host Keyld Not Defined Server Key ID Not Defined Server Key Expiry Time 0 Login Timeout 180 Authentication Available Pa
249. n in Figure 123 Pen Total Ports Selected 1 Page 1 of 1 Port Edge Port Point to Point Cost Priority g No Auto Detect Auto Update 128 Figure 123 RSTP Settings Page The RSTP Settings page displays a table with the following columns of information Port The port number Section IV Spanning Tree Protocols AT S63 Management Software Web Browser Interface User s Guide Edge Port Whether or not the port is operating as an edge port The possible settings are Yes and No Point to Point Whether or not the port is functioning as a point to point port The possible settings are Yes No and Auto Detect Cost Port cost of the port The default is Auto Update Priority The number used as a tie breaker when two or more ports have equal costs to the root bridge 6 Click OK to close the page Resetting RSTP To reset RSTP to the default settings perform the following procedure to the Default e From the Home page select Configuration Settings 2 From the Configuration menu select Layer 2 3 Select the Spanning Tree tab The Spanning Tree tab is shown in Figure 113 on page 292 4 Verify that there is no check in the Enable Spanning Tree check box If there is a check click the option to remove it Spanning tree must be disabled in order for you to return it to its default settings 5 Click Configure The Configure RSTP Bridge Parameters tab is shown in Figure 119
250. n menu To delete a policy perform the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the Services option 3 Select the Policies tab The Policies tab is shown in Figure 68 on page 198 4 Selecta policy from the list and click Delete You can only delete one policy at a time The policy is deleted from the switch Section Il Advanced Operations Deleting all Flow Groups Traffic Classes and Policies Displaying Policies AT S63 Management Software Web Browser Interface User s Guide 5 To permanently save your changes select the Save Config option in the Configuration menu To delete all flow groups traffic classes and policies from the switch perform the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the Services option 3 Select the Policies tab The Policies tab is shown in Figure 68 on page 198 4 Click Purge to delete all flow groups traffic classes and policies from the switch The switch deletes all flow groups traffic classes and policies 5 To permanently save your changes select the Save Config option in the Configuration menu To display the policies perform the following procedure 1 From the Home page select Monitoring 2 From the Monitoring menu select Services 3 Select the Policies tab The Policies tab is shown in Figure 71 Section Il Advanced Operat
251. n next to Configure Target Address Table and then click Configure at the bottom of the tab Section Ill SNMPv3 AT S63 Management Software Web Browser Interface User s Guide The SNMPv3 Target Address Table tab is shown in Figure 95 AT 9424T SP SNMPv3 Target Address Table Total Entries 20 Page 20 of 20 Target Address Timeout snmpv3hosti 00 2500 Parameters Retries Mgmt Protocols snmpv3manager1 D I H IP Address UDP Port Number 194 1 1 1 162 Storage Type Row Status NonVolatile Active Tag List hwengtag swenttag testengtag Figure 95 SNMPv3 Target Address Table Tab Configuration 4 Click Add The Add New SNMPv3 Target Address page is shown in Figure 96 T had New SNMPv3 Tarik Target Address Name gt snmpv3host50 IP Address gt 192 1 1 1 UDP Port Number 162 Timeout 11500 Retries HK Tag List gt swengtag hwengtag Target Parameters gt snmpv3manager50 Storage Type Volatile k Row Status Active Figure 96 Add New SNMPv3 Target Address Page 5 Inthe Target Address Name field enter the name of the SNMP manager or host that manages the SNMP activity on your switch Section Ill SNMPv3 259 Chapter 18 SNMPv3 260 10 11 12 You can enter a name of up to 32 alphanumeric characters In the IP Address field enter the IP address of the host Use the following format
252. n page 139 150 Section Il Advanced Operations Deleting a Syslog Output Definition Section Il Advanced Operations 4 In the Configure Log Outputs section of the tab select the log output AT S63 Management Software Web Browser Interface User s Guide file to be modified and click Modify The Modify Event Log Output page is shown in Figure 43 Output ID 3 Output Status Disabled x Message Format Normal x Severity Selections Type Syslog Syslog Server IP Address 149 35 8 Facility Level LOCAL_1 sl Module Selections 45 D Debug A E Error WWarming l Information v Figure 43 Modify Event Log Output Page Modify the following parameters as necessary For definitions of the parameters refer to Configuring a Syslog Output Definition on page 147 Click Apply to apply the changes or Close to close the page without making changes To permanently save your changes select the Save Config option in the Configuration menu To delete a syslog output definition perform the following procedure 1 2 From the home page select Configuration From the Configuration menu select the System option Select the Event Log tab The Event log tab is shown in Figure 37 on page 139 In the Configure Log Outputs section select the syslog output definition to be deleted and click Delete The syslog output definition is deleted from the list and the switch stop
253. n the next procedure Configuring Egress Scheduling on page 178 176 Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide The default values are listed in Table 5 Table 5 Default Mappings of IEEE 802 1p Priority Levels to Egress Priority Queues IEEE 802 1p Priority Egress Port Priority Level Queue 0 Q1 1 QO Q2 Q3 Q4 Q5 Q6 Q7 NIL Ou ao AJ OJN 4 In the Configure CoS Queues to Egress Queues section of the tab click the list for a CoS priority whose queue assignment is to be changed and select the new queue For example to direct all ingress tagged packets with a CoS priority of 5 to egress queue Q3 you would use the list in CoS 5 to PQ and select Q3 QoS PriorityQ 3 5 If desired repeat Step 4 to change the egress queue assignment of other CoS priorities 6 Click Apply 7 To permanently save your changes select the Save Config option in the Configuration menu Section Il Advanced Operations 177 Chapter 14 Class of Service Configuring Egress Scheduling 178 This procedure explains how to select and configure a scheduling method for Class of Service Scheduling determines the order in which the ports handle packets in their egress queues For an explanation of the two scheduling methods refer to Chapter 15 Class of Service in the AT S63 Management Software Menus Interface User s Guide Sched
254. nected to a switch port have transmitted leave requests or have timed out does the switch stop sending multicast packets out the port If a switch has a mixture of host nodes that is some connected directly to the switch and others through an Ethernet hub you should select the Intermediate Multi Host Port Intermediate selection Multicast Router Ports Mode Specifies whether the router ports are determined automatically or if you enter them manually If you want the switch to determine the ports automatically select Auto Detect which is the default To enter them yourself click Manual Select and enter the ports in the field Host Router Timeout Interval Specifies the time period in seconds at which the switch determines that a host node is inactive An inactive host node is a node that has not sent an IGMP report during the specified time interval The range is from 0 second to 86 400 seconds 24 hours The default is 260 seconds If you set the timeout to zero 0 the timer never times out and the timeout interval is essentially disabled This parameter also controls the time interval used by the switch in determining whether a multicast router is still active The switch makes the determination by watching for queries from the router If the switch does not detect any queries from a multicast router during the specified time interval the router is assumed to be no longer active on the port The actual timeout may be ten secon
255. nfiguration Figure 162 Server based Authentication Tab Configuration 3 To select an authentication protocol in the Authentication Method section of the tab click either RADIUS or TACACS The default is TACACS Note The switch supports only one authentication protocol at a time Furthermore you cannot change to a different authenticator protocol when this feature is enabled 4 To enable or disable the authentication feature click the Enable Server based Authentication check box A check in the box indicates the feature is enabled No check indicate the feature is disabled The default is disabled Section VII Management Security Section VI Management Security AT S63 Management Software Web Browser Interface User s Guide Note The Enable Server based Authentication check box only applies to new TACACS or RADIUS manager accounts If you are only using RADIUS for 802 1x port based access control and not manager accounts leave the check box empty The switch can still access the RADIUS configuration information for 802 1x port based access control 5 Click Apply 6 To permanently save your changes select the Save Config option in the Configuration menu To configure TACACS go to Configuring the TACACS Client Settings on page 408 To configure RADIUS go to Configuring the RADIUS Client Settings on page 412 407 Chapter 27 TACACS and RADIUS Protocols Configuring the
256. nfiguration 4 Click Add The Add New SNMPv3 Community page is shown in Figure 102 TE Mda New SNWPvS Community Community Index 10456 Community Name SantaClaraCA333 Security Name mune Transport Tag swengtag swenginform Storage Type gt NonVolatile w Row Status Active Figure 102 Add New SNMPv3 Community Page 5 In the Community Index field enter a numerical value for this Community This parameter is used to index the other parameters in an SNMPv3 Community Table entry Enter a value of up to 32 alphanumeric characters 6 In the Community Name field enter a Community Name of up to 64 alphanumeric characters Section Ill SNMPv3 273 Chapter 18 SNMPv3 274 The value of the Community Name parameter acts as a password for the SNMPv3 Community Table entry This parameter is case sensitive Note Allied Telesyn recommends that you select SNMP Community Names carefully to ensure these names are known only to authorized personnel In the Security Name field enter a name of an SNMPv1 and SNMPv2c user This name must be unique Enter a value of up to 32 alphanumeric characters Note Do not use a value configured with the User Name parameter in the SNMPv3 User Table In the Transport Tag field enter a name of up to 32 alphanumeric characters The Transport Tag parameter links an SNMPv3 Community Table entry with an SNMPv3 Target Address Table entry Add
257. nfiguring 213 MCHECK 305 324 MDI MDIX mode 83 MSTI ID creating 318 deleting 320 modifying 319 MSTP See Multiple Spanning Tree Protocol MSTP multicast groups maximum configuring 213 multicast host topology configuring 212 multicast MAC address adding 97 deleting 99 displaying 94 multicast router ports configuring 213 multicast routers displaying 217 Multiple Spanning Tree Protocol MSTP bridge forwarding delay 316 bridge hello time 316 bridge max age 316 bridge settings configuring 314 configuration name 316 configuring 314 disabling 312 edge port 325 enabling 312 force version 316 max hops 317 parameters configuring 314 point to point port 324 port external path cost 324 port internal path cost 323 port parameters configuring 322 displaying 326 port priority 323 port status displaying 326 resetting to defaults 331 O operator access 46 operator password configuring 46 P password changing 46 default 34 piggyback mode 379 pinging 52 PKI certificates displaying 394 PKI certificates displaying 394 PKI See Public Key Infrastructure PKI point to point port Multiple Spanning Tree Protocol MSTP 324 Rapid Spanning Tree Protocol RSTP 306 policy configuring 198 deleting 202 203 displaying 203 modifying 201 port configuring parameters basic 80 disabling 82 enabling 82 resetting to defaults 92 statistics displaying 89 status displaying 87 port control 802 1x port based access control 377
258. nformation refer to Chapter 16 Quality of Service in the AT S63 Management Software Menus Interface User s Guide 183 Chapter 15 Quality of Service Managing Flow Groups This section contains the following procedures Configuring a Flow Group next Modifying a Flow Group on page 187 Deleting a Flow Group on page 188 m UU Displaying the Flow Groups on page 188 Configuring a To configure a flow group perform the following procedure Flow Group 1 From the home page select Configuration 2 From the Configuration menu select the Services option 3 Select the Flow Group tab The Flow Group tab is shown in Figure 60 AT 9424T SP Varketing 0 30 84 4B EF CD Parent Traffic Class Classifier List Description Active DSCP 17 traffic Yes 1 DSCP 4 traffic Yes 8 Priority 7 No Services Figure 60 Flow Group Tab Configuration The columns in the tab are defined here ID The ID number of the flow group Description The flow group description Active The active status of the flow group A flow group is deemed active if it is part of a policy assigned to a switch port A flow group is considered 184 Section II Advanced Operations Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide inactive if it is not a part of any policies or if the policies are not assigned to any ports Pare
259. ng and quitting a web browser management session on an AT 9400 Series switch Sections in the chapter include Planning for Remote Management on page 30 Starting a Web Browser Management Session on page 33 Web Browser Tools on page 36 Saving Your Parameter Changes on page 37 Quitting a Web Browser Management Session on page 38 Redundant Twisted Pair Ports on page 39 o2 n Restrictions to the Web Browser Interface on page 41 Section Basic Operations 29 Chapter 1 Starting a Web Browser Management Session Planning for Remote Management 30 There are a number of factors that need to be considered before you can begin to remotely manage an AT 9400 Series switch with the Telnet application protocol the Secure Shell SSH protocol or a web browser As explained in this section these factors include whether the switch is an isolated device that is not a member of an enhanced stack or part of an enhanced stack and if the latter whether the switch is the master switch of the stack or a slave switch Here are the main points o An isolated or master switch must have at least one routing interface o The routing interface must be designated as the local interface o The master switch and slave switches of an enhanced stack must be interconnected by a common VLAN of the local interface on the master switch O The remote management workstation must be able t
260. ng configuration messages by the bridge This parameter can be from 1 to 10 seconds The default is 2 seconds Bridge Forwarding Delay The waiting period in seconds before a bridge changes to a new state for example becomes the new root bridge after the topology changes If the bridge transitions too soon not all links may have yet adapted to the change resulting in network loops The range is 4 to 30 seconds The default is 15 seconds Bridge Max Age The length of time after which stored bridge protocol data units BPDUs are deleted by the bridge All bridges in a bridged LAN use this aging time to test the age of stored configuration messages called bridge protocol data units BPDUs For example if you use the default value 20 all bridges delete current configuration messages after 20 seconds This parameter can be from 6 to 40 seconds In selecting a value for maximum age the following rules must be observed MaxAge must be greater than 2 x HelloTime 1 MaxAge must be less than 2 x ForwardingDelay 1 Note The aging time for BPDUs is different from the aging time used by the MAC address table Section IV Spanning Tree Protocols Configuring STP Port Settings Section IV Spanning Tree Protocols AT S63 Management Software Web Browser Interface User s Guide Bridge Identifier The MAC address of the bridge The bridge identifier is used as a tie breaker in the selection of the root bridge when two or mo
261. ng tree is enabled on the switch When spanning tree is not enabled on the switch or if a port is not being used its state will be disabled Cost Port cost of the port Priority The port s priority value The number is used as a tie breaker when two or more ports have equal costs to the root bridge Click OK to close the page To reset STP to the factory default settings perform the following procedure 1 From the Home page select Configuration 2 From the Configuration menu select the Layer 2 option 3 Select the Spanning Tree tab The Spanning Tree tab is shown in Figure 113 on page 292 4 Verify there is no check in the Enable Spanning Tree check box If there is a check click the option to remove it Spanning tree must be disabled in order for you to return it to its default settings Section IV Spanning Tree Protocols Section IV Spanning Tree Protocols AT S63 Management Software Web Browser Interface User s Guide 5 Click Configure The Configure STP Parameters tab is shown in Figure 114 on page 295 6 Click Defaults The STP settings are returned to their default values 7 To permanently save your changes select the Save Config option in the Configuration menu 301 Chapter 19 Spanning Tree and Rapid Spanning Tree Protocols Configuring RSTP This section contains the following procedures Configuring RSTP Bridge Settings next Configuring RSTP Port Settings on page 305 D
262. nge is 1 to 600 seconds Control Direction Specifies how the port handles ingress and egress broadcast and multicast packets when in the unauthorized state When a port is set to the Authenticator role it remains in the unauthorized state until the client logs on by providing a username and password combination In the unauthorized state the port only accepts EAP packets from the client All other ingress packets that the port might receive from the client including multicast and broadcast traffic are discarded until the supplicant has logged in The options are Ingress A port when in the unauthorized state discards all ingress broadcast and multicast packets from the client but forwards all egress broadcast and multicast traffic to the same client Both A port when in the unauthorized state does not forward ingress or egress broadcast and multicast packets from or to the client until the Section VI Port Security Section VI Port Security AT S63 Management Software Web Browser Interface User s Guide client logs in This is the default Piggyback Mode Controls who can use the switch port in cases where there are multiple clients e g the port is connected to an Ethernet hub If set to enabled the port allows all clients on the port to piggy back onto the initial client s authentication The port forwards all packets regardless of the client after one client has been authenticated If set to Disabled the switch
263. nnot be remotely managed through a master switch A switch with this designation can be managed locally It can also be managed remotely if it has a routing interface and the interface is designated as the local interface Note The default setting for a switch is slave Note The only switch whose stacking status can be changed through a web browser management session is the switch where you started the management session typically a master switch You cannot change the setting on a switch accessed through enhanced stacking As an alternative you can use a local management session or if the switch has a local interface you can use a Telnet or web browser management session To configure a switch s enhanced stacking status perform the following procedure 1 From the Home page select Configuration 2 From the Configuration menu select the Mgmt Protocols option 3 Select the Enhanced Stacking tab 62 Section l Basic Operations Section Basic Operations AT S63 Management Software Web Browser Interface User s Guide The Enhanced Stacking tab is shown in Figure 10 stem Name Marketing dr 00 30 84 4B EF CD Enhanced Stacking Switch State Master OSlave O Unavailable Mgmt Protocols Figure 10 Enhanced Stacking Tab Configuration 4 Click the desired enhanced stacking status for the switch The default is Slave 5 Click Apply The new setting for the enhanced
264. nooping on the switch A check in the box indicates that IGMP snooping is enabled Multicast Host Topology Defines whether there is only one host node per switch port or multiple host nodes per port Possible settings are Edge Single Host Port and Intermediate Multi Host Port The Single Host Port Edge setting is appropriate when there is only one host node connected to each port on the switch This setting causes the switch to immediately stop sending multicast packets out a switch port when a host node signals its desire to leave a multicast group by sending a leave request or when the host node stops sending reports and times out The switch forwards the leave request to the router and simultaneously ceases transmission of any further multicast packets out the port where the host node is connected Section Il Advanced Operations Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide The Multi Host Port Intermediate setting is appropriate if there is more than one host node connected to a switch port such as when a port is connected to an Ethernet hub to which multiple host nodes are connected With this setting selected the switch continues sending multicast packets out a port even after it receives a leave request from a host node on the port This ensures that the remaining active host nodes on the port continue to receive the multicast packets Only after all of the host nodes con
265. not supported from the web browser interface Use the menus interface or command line interface to configure this feature This feature is not supported from the web browser interface Use the menus interface or command line interface to configure this feature 802 1x port based network access control Added the following new parameter to an authenticator port O Supplicant Mode for supporting multiple supplicant accounts on an authenticator port Chapter 24 802 1x Port based Network Access Control on page 371 Modified procedure Configuring Authenticator Port Parameters on page 375 25 Preface 26 Section I Basic Operations Section Basic Operations The chapters in this section provide information and procedures for basic switch setup using the AT S63 management software The chapters include Chapter 1 Starting a Web Browser Management Session on page 29 Chapter 2 Basic Switch Parameters on page 43 Chapter 3 Enhanced Stacking on page 61 Chapter 4 SNMPv1 and SNMPv2c on page 69 Chapter 5 Port Parameters on page 79 Chapter 6 MAC Address Table on page 93 Chapter 7 Static Port Trunks on page 103 Chapter 8 Port Mirroring on page 113 WS US WS EES US US 27 28 Section Basic Operations Chapter 1 Starting a Web Browser Management Session This chapter contains the procedure for starting usi
266. ns a 0 zero there is no port mirror Ingress Ports Specifies the ports whose ingress traffic is to be mirrored to the destination port Egress Ports Specifies the ports whose egress traffic is to be mirrored to the destination port Status Specifies the status of the port mirror as either enabled or disabled Section Basic Features Section Basic Features AT S63 Management Software Web Browser Interface User s Guide 4 Click Modify The Modify Mirror page is shown in Figure 31 men O Enable Mirror Sesesscseses n n Mirror Ingress Port Mirror Egress Port IT Mirror Ingress Egress Port Mirror To Port Figure 31 Modify Mirror Page 5 Click the ports to be in the port mirror Clicking a port toggles it through the following possible settings e The destination mirror port There can be only one destination port A source port The port s ingress traffic is mirrored to the destination port A source port The port s egress traffic is mirrored to the destination port A source port The port s ingress and egress traffic is mirrored to the destination port Not part of a port mirror You can mirror one port a few ports or all of the ports on the switch with the exception of course of the destination port Note To create a mirror port for the Denial of Service defenses specify only the destination port The management software automatically d
267. nse to an EAP request identity frame from the client before retransmitting the request The default value is 30 seconds The range is 1 to 65 535 seconds Quiet Period Sets the number of seconds that the port remains in the quiet state following a failed authentication exchange with the client The default value is 60 seconds The range is 0 to 65 535 seconds Reauth Enabled Controls whether the client must periodically reauthenticate The default setting of enabled requires the client to periodically reauthenticate The time period between reauthentications is set with the Reauth Period option If this parameter is set to disabled the client is not required to reauthenticate after the initial authentication unless there is a change to the status of the link between the supplicant and the switch or the switch is reset or power cycled The options are Enabled or Disabled The default is Enabled Reauth Period Specifies the time period in seconds between reauthentications of the client when the Reauth Enabled option is set to Enabled The default value is 3600 seconds The range is 1 to 65 535 seconds Supplicant Timeout Sets the switch to client retransmission time for the EAP request frame The default value for this parameter is 30 seconds The range is 1 to 600 seconds Server Timeout Sets the timer used by the switch to determine authentication server timeout conditions The default value for this parameter is 30 seconds The ra
268. nt Software Updates This section provides Allied Telesyn contact information for technical support as well as sales and corporate information You can request technical support online by accessing the Allied Telesyn Knowledge Base http kb alliedtelesyn com You can use the Knowledge Base to submit questions to our technical support staff and review answers to previously asked questions For Technical Support via email or telephone refer to the Support amp Services section of the Allied Telesyn web site www alliedtelesyn com Products for return or repair must first be assigned a return materials authorization RMA number A product sent to Allied Telesyn without an RMA number will be returned to the sender at the sender s expense To obtain an RMA number contact Allied Telesyn Technical Support through our web site www alliedtelesyn com You can contact Allied Telesyn for sales or corporate information through our web site www alliedtelesyn com To find the contact information for your country select Contact Us gt Worldwide Contacts New releases of management software for our managed products are available from either of the following Internet sites 0 Allied Telesyn web site www alliedtelesyn com o Allied Telesyn FTP server ftp ftp alliedtelesyn com If you prefer to download new software from the Allied Telesyn FTP server from your workstation s command prompt you will need FTP client software and you mu
269. nt Mode Single Port Control Auto Quiet Period 60 Seconds Tx Period 30 Seconds Supplicant Timeout 30 Seconds Server Timeout 30 Seconds Reauth Enabled Enabled Reauth Period 3600 Seconds Max Requests 2 VLAN Assignment Enabled Secure VLAN ON Control Direction Both Piggyback Mode Disabled Guest VLAN 0 Figure 154 Authenticator Port Parameters Page 385 Chapter 24 802 1x Port based Network Access Control If you selected more than one authenticator port the page includes a Next button Use the button to scroll the page to view the settings of the other ports For definitions of the authenticator port settings refer to Configuring Authenticator Port Parameters on page 375 The Supplicant Port Parameters Page is displayed for supplicant ports as shown in Figure 155 T suppicant Port Parameters 11 Total Ports 1 Page lof 1 User Name User Password m EC TT Port AuthPeriod HeldPeriod 3 3 Figure 155 Supplicant Port Parameters Page For definitions of the supplicant port settings refer to Configuring Supplicant Port Parameters on page 381 386 Section VI Port Security AT S63 Management Software Web Browser Interface User s Guide RADIUS Accounting Configuring RADIUS Accounting Section VI Port Security The AT S63 management software supports RADIUS accounting for ports operating in the Authenticator role The accounting information sent by the switc
270. nt Software Menus Interface User s Guide Section Il Advanced Operations 205 Chapter 16 Denial of Service Defense Configuring Denial of Service Defense 206 To configure the ports on the switch for a Denial of Service attack defense perform the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the Network Security option 3 Select the DoS tab The DoS tab is shown in Figure 72 System Name Marketing MAC Addr 00 30 84 4B EF CD DoS LAN Subnet IP DoS LAN Subnet Mask fo num a lo j fo LU Dos Uplink Port 24 Network Security SynFlood Figure 72 DoS Tab Configuration A If you are implementing the SMURF or Land defense you must provide an IP address and mask for your LAN To do this complete the following procedure Otherwise skip ahead to Step 5 a Inthe DoS LAN Subnet IP field enter the IP address of one of the devices connected to the switch preferably the lowest IP address b In the DoS Subnet Mask field enter the LAN s mask enter the mask A binary 1 indicates the switch should filter on the corresponding bit of the IP address while a 0 indicates that it should not As an example assume that the devices connected to a switch are using the IP address range 149 11 11 1 to Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide 149 11 11 50 The mask w
271. nt Traffic Class ID The traffic class where the flow group is assigned Classifier List The classifiers of the flow group Click Create The Create Flow Group page opens as shown in Figure 61 Description ID 0 1023 DSCP Priority 802 1p men er Remark Priority NO e ToS Move ToS To Priority 0 7 Move Priority To ToS NO e Figure 61 Create Flow Group Page 5 Configure the following parameters as necessary ID Specifies the ID number for this flow group A flow group must be assigned a unique ID number The range is 0 to 1023 Description Specifies the flow group description A description can be up to 15 alphanumeric characters including spaces DSCP Specifies a replacement value to write into the DSCP TOS field of the packets The range is 0 to 63 Anew DSCP value can be set at all three levels flow group traffic class and policy A DSCP value 185 Chapter 15 Quality of Service 186 specified in a flow group overrides a DSCP value specified at the traffic class or policy level Priority 802 1p Specifies a new user priority value for the packets The range is 0 to 7 You can specify a new priority value at both the flow group and traffic class levels If you specify a new user priority value at both levels the value in the flow group here overrides the value in Traffic Class If you want the packets to retain the new value when they exit the switch change R
272. nt port A black port has not been assigned a port role and is not participating in port based access control This is the default setting for a port 4 To seta por s role click the port A selected port turns white You can configure more than one port at a time 372 Section VI Port Security AT S63 Management Software Web Browser Interface User s Guide 5 Click Port Role The Port Role Configuration page is shown in Figure 149 Port Role None O Authenticator Supplicant Figure 149 Port Role Configuration Page 6 Select the desired role for the port A port can have only one port role at a time The possible settings are None The port does not participate in 802 1x port based access control This is the default setting Authenticator The port functions as an authenticator This is the appropriate setting if the port is connected to a supplicant Supplicant The port functions as an supplicant This is the appropriate setting if the port is connected to an authenticator 7 Click Apply The new role is immediately implemented on the port 8 To permanently save your changes select the Save Config option in the Configuration menu To enable or disable port based access control go to Enabling or Disabling 802 1x Port based Network Access Control on page 374 To configure authenticator port settings go to Configuring Authenticator Port Parameters on page 375 To configure supplicant
273. nterface Default Gateway For AT 9400 Series switches that support IPv4 routing such as the AT 9448Ts and AT 9448Ts XP switches this field displays the IP address of the next hop of the switch s default route The switch uses the default route when it receives a network packet for routing but cannot find a route for it in the routing table This field will contain 0 0 0 0 if no default route is defined on the switch For AT 9400 Series switches that do not support IPv4 packet routing such as the AT 9424T GB and AT 9424T SP switches this field displays the default gateway address This is the IP address of a router interface on your network The switch s management software uses this address as the next hop to reaching a remote network device when the switch s local interface and the remote device are on different subnets The default value is 0 0 0 0 Section l Basic Operations Section I Basic Operations AT S63 Management Software Web Browser Interface User s Guide System Up Time The length of time since the switch was last reset or power cycled The Software Information section displays the following information Application Software The version number and build date of the AT S63 management software Bootloader The version number and build date of the AT S63 bootloader The Hardware Information section displays the following information Power Information The status of the main power supply the redundant pow
274. nterface User s Guide Group Name Context Prefix Read View Write View Notify View Security Model Security Level Context Match Modifysnwpvsaccess testengineering jinternet private internet gt W3 AuthPriv Exact Storage Type NonVolatile x Row Status Active Figure 88 Modify SNMPv3 Access Page Note The Context Prefix field is a read only field The Context Prefix field is always set to null 6 In the Read View Name field enter a value that you configured with the View Name parameter in the View Table This parameter allows the users assigned to this Group Name to view the information specified by the View Table entry This value does not need to be unique 7 Inthe Write View Name field enter a value that you configured with the View Name parameter in the View Table This parameter allows the users assigned to this Security Group to write or modify the information in the specified View Table This value does not need to be unique 8 In the Notify View Name field enter a value that you configured with the View Name parameter in the View Table This parameter allows the users assigned to this Group Name to send traps permitted in the specified View This value does not need to be unique Section Ill SNMPv3 245 Chapter 18 SNMPv3 246 9 10 11 Note The Context Match field is a read only field The Context Match f
275. ntry on page 275 For reference information about the SNMPv3 Community Table see Chapter 21 SNMPv3 in the AT S63 Management Software Menus Interface User s Guide Note Use the SNMPv3 Community Table only if you are configuring the SNMPv3 protocol with an SNMPv1 or an SNMPv2c implementation Allied Telesyn does not recommend this configuration Creating an To create an entry in the SNMPv3 Community Table perform the SNMPy3_ following procedure Community 4 From the home page select Configuration Table Entry The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 2 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 3 In the SNMPv3 section click the button next to Configure Community Table and then click Configure at the bottom of the tab 272 Section Ill SNMPv3 AT S63 Management Software Web Browser Interface User s Guide The SNMPv3 Community Table tab is shown in Figure 101 AT 9424T SP SNMPv3 Community Table Total Entries 4 Page lof 1 Community Security Transport Community Index Name Name Tag Storage Type California SantaClara456 wilson Tp Nonvolatile Mgmt Protocols O alabama birmingham1 23 jenny swengtag NonVolatile O carolina raleigh998 chitra testengtag NonvVolatile hwengtag j bismarck778 swengtag NonvVolatile Figure 101 SNMPv3 Community Table Tab Co
276. o reach an isolated switch or a master switch through the subnet of the local interface of the switch A key element in this discussion is the routing interface which first appeared on the AT 9400 Series switches with the introduction of Layer 3 routing An interface represents a logical connection to a network or subnet local to the switch The switch uses interfaces to route packets among its local i e directly connected networks and subnets An interface consists of an IP address and subnet mask of a local subnet and the identification number VID of the VLAN on the switch where the subnet resides Though interfaces are primarily intended for routing IPv4 packets there are several AT S63 management features that require at least one interface on a switch for the feature to function properly The common denominator is the need of the switch to have an IP address Remote management is one of those features To remotely manage a switch you have to be able to specify its IP address This is true whether you are using the Telnet application protocol the SSH protocol or a web browser For a discussion of the other management functions that require a routing interface refer to Chapter 32 Internet Protocol Version 4 Packet Routing in the AT S63 Management Software Command Line Interface User s Guide Also important to remote management is what s referred to as the local interface A switch s CPU can monitor only one local subnet
277. o the default settings After the reset is complete you must establish a new management session if you want to continue managing the unit probably from a local management session As mentioned at the start of this procedure returning a switch to is default settings does not alter the contents of the active boot configuration file To return the file to the default settings you must save the current switch settings after you establish a new management session with the switch Otherwise the switch returns to its previous parameter settings the next time you reset or power cycled the unit 54 Section Basic Operations AT S63 Management Software Web Browser Interface User s Guide Displaying the IP Address of the Local Interface Section Basic Operations This procedure displays the IP address and subnet mask of the local interface on the switch The local interface is used for enhanced stacking and remote management of the switch with a Telnet or SSH client or a web browser You cannot configure the local interface from the web browser interface You must use the menus interface or command line interface For background information refer to Planning for Remote Management on page 30 To view the IP address and subnet mask of the local interface perform the following procedure 1 From the home page select Configuration The System page is displayed with the General tab selected by default as shown in Figure
278. on ifName Port_05 Speed and Duplex o Auto Negotiate iv Ingress Broadcast Filter Status W Enabled e MDIMDIX Crossover Auto M Egress Broadcast Filter Disabled v Disabled Ingress Unknown Unicast Filter Egress Unknown Unicast Filter Disabled Disabled v Ingress Unknown Multicast Filter Egress Unknown Multicast Filter Disabled Disabled v Flow Control Back Pressure Disabled Disabled Flow Control Back Pressure Limit HOL Blocking 7935 1 7935 Cells 682 0 8191 Cells Broadcast Rate Limiting Broadcast Rate Disabled v 262143 0 262143 Pkts Sec Unknown Unicast Rate Limiting Unknown Unicast Rate Disabled v 262143 0 262143 Pkts Sec Multicast Rate Limiting Multicast Rate Disabled v 262143 0 262143 Pkts Sec Figure 19 Port Configuration Page Note The Port Configuration page in the figure above is from a 10 100 1000 Mbps twisted pair port The page for a fiber optic port will contain a subset of the parameters If you are configuring multiple ports and the ports have different settings the Port Configuration page displays the settings of the lowest numbered port After you have configured the settings of the port all of its settings including those that were not changed are copied to the other selected ports The Defaults button at the bottom of the page returns the port settings to the default values which can be found in Append
279. on page 303 6 Click Defaults The RSTP settings are returned to their default values 7 To permanently save your changes select the Save Config option in the Configuration menu Section IV Spanning Tree Protocols 309 Chapter 19 Spanning Tree and Rapid Spanning Tree Protocols 310 Section IV Spanning Tree Protocols Chapter 20 Multiple Spanning Tree Protocol Section IV Spanning Tree Protocols This chapter explains how to configure multiple spanning tree protocol MSTP parameters on an AT 9400 Series switch using a web browser management session It contains the following procedures Enabling MSTP on page 312 Configuring MSTP on page 314 Managing MSTIs on page 318 Configuring MSTP Port Parameters on page 322 Displaying the MSTP Configuration on page 326 Resetting MSTP to the Default Settings on page 331 WS ES ES US n Note For background information refer to Chapter 23 Multiple Spanning Tree Protocol in the AT S63 Management Software Menus Interface User s Guide 311 Chapter 20 Multiple Spanning Tree Protocol Enabling MSTP The AT 9400 Series switch can support the three spanning tree protocols STP RSTP and MSTP However only one spanning tree protocol can be active on the switch at a time So before you can enable a spanning tree protocol you must first select it as the active spanning tree protocol After you select it you can then ena
280. onnected ports ring displaying 362 GVRP state machine displaying 356 port configuration displaying 354 global encryption key configuring 412 414 global secret configuring 408 411 global server timeout configuring 408 411 GVRP See GARP VLAN Registration Protocol GVRP H hardware information 57 held period 382 hello time Rapid Spanning Tree Protocol RSTP 304 Spanning Tree Protocol STP 296 host key ID parameter 400 host nodes displaying 215 host router timeout interval configuring 213 l IGMP See Internet Group Management Protocol IGMP Snooping Internet Group Management Protocol IGMP snooping configuring 212 disabling 212 enabling 212 intrusion action 368 intrusion action port configuring 370 426 L limited port security level 367 local interface displaying IP address 55 locked port security level 367 login timeout parameter 401 MAC address aging time changing 101 MAC address table displaying 94 MAC addresses adding 97 deleting dynamic 100 deleting multicast 99 displaying 94 MACs available parameter 403 management access control list disabling 418 enabling 418 management access levels 46 manager access 46 manager password configuring 46 master switch assigning 62 defined 62 returning to 66 max age Rapid Spanning Tree Protocol RSTP 304 Spanning Tree Protocol STP 296 max hops Multiple Spanning Tree Protocol MSTP 317 max requests 377 max start 382 maximum multicast groups co
281. or User Name with the SNMPv1 protocol v2c Select this value to associate the Security Name or User Name with the SNMPv2c protocol v3 Select this value to associate the Security Name or User Name with the SNMPv3 protocol In the Security Name field enter a User Name that you previously configured with the SNMPv3 User Table See Creating a User Table Entry on page 226 In the Security Level field select one of the following Security Levels Note The value you configure for the Security Level must match the value configured for the User Name in the User Table Menu See Creating a User Table Entry on page 226 No Authentication Privacy This option represents neither an authentication nor privacy protocol Select this security level if you do not want to authenticate SNMP entities and you do not want to encrypt messages using a privacy protocol This security level provides the least security Note If you have selected SNMPv1 or SNMPv2c as the Security Model you must select No Authentication Privacy as the Security Level Authentication This option represents authentication but no privacy protocol Select this security level if you want to authenticate SNMP users but you do not want to encrypt messages using a privacy protocol You can select this value if you configured the Security Model parameter with the SNMPv3 protocol Privacy This option represents authentication and the privacy proto
282. or reference information about the SNMPv3 SecuritytoGroup Table see Chapter 21 SNMPv3 in the AT S63 Management Software Menus Interface User s Guide To create an entry in the SNMPv3 SecurityToGroup Table perform the following procedure 1 From the home page select Configuration The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 2 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 3 In the SNMPv3 section click the button next to Configure SecurityToGroup Table and then click Configure at the bottom of the tab 247 Chapter 18 SNMPv3 The SNMPv3 SecurityToGroup Table tab is shown in Figure 89 AT 9424T SP System Name Marketing MAC Addr 00 30 84 4B EF CD SNMPv3 SecurityToGroup Table Total Entries 19 Page Sof 5 Security Name Group Name Storage Type Row Status Security Model jenny swengineering NonVolatile Active Mgmt Protocols chitra testengineering NonVolatile Active debashis swengineering NonVolatile Active Figure 89 SNMPv3 SecurityToGroup Table Tab Configuration 4 To create an SNMPv3 SecurityToGroup Table entry click Add The Add New SNMPv3 SecurityToGroup page is shown in Figure 90 Security Model Security Name E chita Group Name ltestengineering Storage Type NonVolatile v Row Status Active Figure 90 Add N
283. orage type if you want the ability to save an entry in the Notify Table After making changes to an Notify Table entry with a NonVolatile storage type the Save Config option is not displayed on the Configuration menu The Row Status parameter is a read only field in the web browser interface The Active value indicates the SNMPv3 Notify Table entry takes effect immediately Click Apply to update the SNMPv3 Notify Table To permanently save your changes select the Save Config option in the Configuration menu 257 Chapter 18 SNMPv3 Configuring the SNMPv3 Target Address Table Creating a Target 258 Address Table Entry You can create delete and modify an SNMPv3 Target Address Table entry See the following procedures o Creating a Target Address Table Entry on page 258 0 Deleting a Target Address Table Entry on page 261 0 Modifying Target Address Table Entry on page 262 For reference information about the SNMPv3 Target Address Table see Chapter 21 SNMPv3 in the AT S63 Management Software Menus Interface User s Guide To create an entry in the SNMPv3 Target Address Table perform the following procedure 1 From the home page select Configuration The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 2 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 3 In the SNMPv3 section click the butto
284. ord is friend The password is case sensitive uN Caution Do not use spaces or special characters such as asterisks and exclamation points in a password if you are managing the switch from a web browser Many web browsers cannot handle special characters in passwords Operator Password Confirm Operator Password Use these parameters to change the operator s login password for the switch The password can be from 0 to 16 characters in length The same password is used for both local and remote management sessions To create a new password enter the new password into both fields The default password for operator is operator The password is case sensitive Section l Basic Operations Section I Basic Operations AT S63 Management Software Web Browser Interface User s Guide A Caution Do not use spaces or special characters such as asterisks and exclamation points in a password if you are managing the switch from a web browser Many web browsers cannot handle special characters in passwords Note A change to a password is immediately activated on the switch You must use the new password the next time you start a management session of the switch 3 Click Apply to activate your change on the switch 4 To permanently save your changes select the Save Config option in the Configuration menu 47 Chapter 2 Basic Switch Parameters Setting the System Date and Time
285. ors 1 Page 1 of 1 a MTOTO Ingress Port s Egress Port s Status a In Se Figure 33 Port Mirroring Tab Monitoring The tab displays a table with the following columns Mirror to Port The destination port where the traffic is copied and where the network analyzer is located Ingress Port s The source ports whose ingress traffic is mirrored to the destination port Egress Port s The source ports whose egress traffic is mirrored to the destination port Status The status of the mirroring feature The possible settings are Enabled Traffic is being copied to the destination port Disabled No traffic is being mirrored Section Basic Features Section IT Advanced Operations Section Il Advanced Operations The chapters in this section contain the procedures for advanced switch setup using the AT S63 management software The chapters include Chapter 9 File System on page 123 Chapter 10 File Downloads and Uploads on page 129 Chapter 11 Event Logs and Syslog Servers on page 137 Chapter 12 Classifiers on page 153 Chapter 13 Access Control Lists on page 165 Chapter 14 Class of Service on page 173 Chapter 15 Quality of Service on page 183 Chapter 16 Denial of Service Defense on page 205 Oagaaqgdaaa a Chapter 17 IGMP Snooping on page 211 121 122 Section Il Advanced Operations Chapter 9 File System This chapter contains th
286. ort To change the destination port you must first change the current destination port to one of the other settings f 1 A source port The port s ingress traffic is mirrored to the LA destination port A source port The port s egress traffic is mirrored to the destination port TF A source port The port s ingress and egress traffic is JE mirrored to the destination port Not part of a port mirror CC Click Apply The changes to the port mirror are now active on the switch To permanently save your changes select the Save Config option in the Configuration menu 117 Chapter 8 Port Mirroring Disabling a Port Mirror 118 This procedure disables a port mirror When disabled a port mirror stops copying traffic from the source ports to the destination port However the destination port is still reserved for port mirroring To delete the port mirror so that the destination port can be used for normal network operations refer to Deleting a Port Mirror on page 119 To disable a port mirror perform the following procedure 1 2 From the home page select Configuration From the Configuration menu select the Layer 1 option Select the Port Mirroring tab The Port Mirroring tab is shown in Figure 30 on page 114 Click Modify The Modify Mirror page is shown in Figure 31 on page 115 Click the Enable Mirror checkbox to remove the check and disable the mirror Click Apply The port m
287. ort trunk can contain up to eight ports 106 Section Basic Operations AT S63 Management Software Web Browser Interface User s Guide Note Some AT 9400 Series switches feature twisted pair ports that are paired with SFP and GBIC slots Allied Telesyn recommends not including these ports in a port trunk The operation of a port trunk with one of these ports may be unpredictable if the port were to transition to the redundant uplink status For further information refer to Redundant Twisted Pair Ports on page 39 8 Click Apply The new port trunk is now active on the switch 9 To permanently save your changes select the Save Config option in the Configuration menu 10 Configure the ports on the remote device for port trunking 11 Connect the cables to the ports of the trunk on the switch and on the remote device The port trunk is ready for network operations Section I Basic Operations 107 Chapter 7 Static Port Trunks Modifying a Static Port Trunk 108 This section contains the procedure for modifying a static port trunk on the switch You can change the name and ports of a trunk from the web browser interface but not the load distribute method Be sure to review the guidelines in Chapter 8 Static and LACP Port Trunks in the AT S63 Management Software Menus Interface User s Guide before performing the procedure b Caution Disconnect all data cables from the ports of the trunk
288. ose78 ross testenginform NonVolatile swengtag swenginform hwengtag hwenginform testengtag 10456 SantaClara5 tomas Nonvolatile Mgmt Protocols 10650 Sunnyvale45 nelvid NonVolatile 10675 Fremont loan NonvVolatile 10725 Campbell98 frankk NonVolatile testenginform Figure 112 SNMPv3 Community Table Tab Monitoring Section Ill SNMPv3 287 Chapter 18 SNMPv3 288 Section Ill SNMPv3 Section IV Spanning Tree Protocols The chapters in this section contain the procedures for configuring the spanning tree protocols The chapters include O Chapter 19 Spanning Tree and Rapid Spanning Tree Protocols on page 291 O Chapter 20 Multiple Spanning Tree Protocol on page 311 Section IV Spanning Tree Protocols 289 290 Section IV Spanning Tree Protocols Chapter 19 Spanning Tree and Rapid Spanning Tree Protocols Section IV Spanning Tree Protocols This chapter explains how to configure the STP and RSTP parameters on an AT 9400 Series switch The sections in the chapter include o Enabling or Disabling a Spanning Tree Protocol on page 292 o Configuring STP on page 294 0 Configuring RSTP on page 302 Note For background information refer to Chapter 22 Spanning Tree and Rapid Spanning Tree Protocols in the AT S63 Management Software Menus Interface User s Guide 291 Chapter 19 Spanning Tree and Rapid Spanning Tree Protocols
289. ould be 0 0 0 63 c If you are activating the Land defense in the DoS Uplink Port field enter the number of the port connected to the device e g DSL router that leads outside your network You can specify only one uplink port 5 Click the ports in the switch image where a defense mechanism is to be enabled or disabled 6 Using the DoS Type list select the type of denial of service attack to be enabled or disabled on the ports The possible selections are Syn Flood attack Smurf attack Land attack Tear drop attack Ping of death attack IP Options WS WS WS WS 0 7 Click Modify To configure all the ports click Modify All The DoS Configuration for Ports page opens The page shown in Figure 73 is for IP Options Status Mirror Port Disabled Disabled Enabled O Enabled Figure 73 DoS Configuration for Ports Page Section Il Advanced Operations 207 Chapter 16 Denial of Service Defense 208 8 10 Configure the following parameters as necessary Status Click Enable or Disable to enable or disable DoS on the selected ports Mirror Port This option applies to the Land Tear Drop Ping of Death and IP Options Enabling this option mirrors the traffic examined by a defense mechanism to another port on the switch To use this feature you must activate port mirroring on the switch and specify a destination mirror port as explained in Creating a Port Mirror on page 114 Cl
290. ounters Hep O View GVRP Database O View GIP Connected Ports Ring LC ee T View GVRP State Machine for VLAN Figure 138 GVRP Tab Monitoring The GVRP Parameters section provides the following information GVRP The GVRP status Enabled or Disabled Leave Time The range is 30 to 80 centiseconds and the default is 60 centiseconds Join Time The range is 10 to 60 centiseconds and the default is 20 centiseconds GIP The GIP status Enabled or Disabled Leave All Time The range is 500 to 300 centiseconds and the default is 1000 centiseconds 353 Chapter 22 GARP VLAN Registration Protocol Displaying the GVRP Port Configuration To display the GVRP port configuration perform the following procedure 1 2 354 From the Home page select Monitoring From the Monitoring menu select the Layer 2 option Select the GVRP tab The GVRP tab is shown in Figure 138 on page 353 In the View GVRP Parameters section click View Port Configuration Click View The GVRP Port Configuration page is shown in Figure 139 T GVRP Port Contiouraion Page 1of3 Port Number 1 2 3 4 5 6 7 8 9 Figure 139 GVRP Port Configuration Page The GVRP Port Configuration page provides the following information Port Number The port number Mode The port mode either Normal or None Section V Virtual LANs AT S63 Management Software Web Browser Interface Use
291. our network topology This can cause a broadcast storm and poor network performance Note Prior to creating a static port trunk examine the speed duplex mode and flow control settings of the lowest numbered port that will be a part of the trunk Check to be sure that the settings are correct for the end node to which the trunk will be connected When you create the trunk the AT S63 management software copies the settings of the lowest numbered port in the trunk to the other ports so that all the settings are the same You should also check to be sure that the ports are untagged members of the same VLAN You cannot create a trunk of ports that are untagged members of different VLANs To create a port trunk perform the following procedure From the home page select Configuration 2 From the Configuration menu select the Layer 1 option 3 Select the Port Trunking tab Section l Basic Operations AT S63 Management Software Web Browser Interface User s Guide The Port Trunking tab is shown in Figure 26 Layer 1 AT 9424T SP System Name Marketing MAC Addr 00 30 84 4B EF CD Total Trunks 1 Page lof 1 EE a E e fp p o Section Basic Operations Figure 26 Port Trunking Tab Configuration The tab displays the current static trunks in a table with the following columns of information ID The ID number of the trunk Name The name of the trunk Type Th
292. owing procedures o Creating a User Table Entry on page 226 o Deleting a User Table Entry on page 229 a Modifying a User Table Entry on page 230 For reference information about the SNMPv3 User Table see Chapter 21 SNMPv3 in the AT S63 Management Software Menus Interface User s Guide To create an entry in the SNMPv3 User Table perform the following procedure 1 From the home page select Configuration The Configuration System page is displayed with the General tab selected by default as shown in Figure 79 on page 224 2 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 3 In the SNMPv3 section click the button next to Configure User Table and then click Configure at the bottom of the tab Section Ill SNMPv3 AT S63 Management Software Web Browser Interface User s Guide The SNMPv3 User Table tab is shown in Figure 80 AT 9424T SP Home SNMPv3 User Table IT yeri Gg Total Entries 4 Page lof 1 C me Username ET ACC Sean Twee Ir neie ep None NonVolatile IT ege MDS NonVolatile SHA NonvVolatile O debashis NonVolatile Figure 80 SNMPv3 User Table Tab Configuration 4 Click Add The Add New SNMPv3 User page is shown in Figure 81 Engine ID 80 00 00 cf 03 00 30 84 fd 57 da User Name chitra Authentication Protocol SHA Authentication Password Confirm Authentication Password
293. plink Port Mgmt Security User Configured Not Applicable Total VLANs 3 Page lof 1 __Network Security VLAN List Services VLAN ID Client Name Uplink Port Protocol Member Ports Untagged Multicast 1 Default VLAN NA Port Based None Configured 7 8 11 19 24 Untagged Help O 12 Sales Port Based None Configured 1 6 L toot eric Tagged 23 Untagged O 27 Production Port Based None Configured 9 10 12 18 Actual 9 10 12 18 Tagged 23 Figure 134 VLAN Tab Monitoring The upper part of the tab displays the following information VLAN Mode The VLAN mode of the switch Possible settings are User Configured This mode supports port based and tagged VLANs Multiple 802 1Q The IEEE 802 1Q compliant multiple VLAN mode Multiple The non IEEE 802 1Q compliant multiple VLAN mode Secton V Virtual LANs 345 Chapter 21 Port based and Tagged VLANs 346 Uplink Port This item only applies when the switch is operating in the IEEE 802 1Q compliant multiple VLAN mode or the non IEEE 802 1Q compliant multiple VLAN modes It displays the uplink port for the VLANs The lower part of the tab displays a table that contains the following columns of information VLAN ID The VID number of the VLAN Client Name The name of the VLAN If the switch is operating in one of the multiple VLAN modes the names of the VLANs start with Client with the exception of the VLAN containing the uplink
294. port forwards only those packets from the client who was authenticated and discards packets from all other users VLAN Assignment Controls whether an authenticator port uses the VLAN assignments returned by a RADIUS server Options are O Enabled Specifies that the authenticator port is to use the VLAN assignment returned by the RADIUS server when a supplicant logs on This is the default setting The port automatically moves to the designated VLAN after the supplicant successfully logs on O Disabled Specifies that the authenticator port ignore any VLAN assignment information returned by the RADIUS server when a supplicant logs on The authenticator port remains in its predefined VLAN assignment even if the RADIUS server returns a VLAN assignment when a supplicant logs on This is the default setting Secure VLAN Controls the action of an authenticator port to subsequent authentications after the initial authentication where VLAN assignments have been added to the user accounts on the RADIUS server This parameter only applies when the port is operating in the Multiple operating mode Possible settings are O On Specifies that only those supplicants with the same VLAN assignment as the initial supplicant are authenticated Supplicants with a different or no VLAN assignment are denied entry to the port This is the default setting O Off Specifies that all supplicants regardless of their assigned VLANs are authenticated However th
295. prompt is displayed Click OK to delete the MSTI or Cancel to cancel the procedure If you select OK the MSTI is deleted and VLANs associated with it are returned to CIST which has an ID of 0 Repeat steps 5 to 8 to delete additional MSTIs To permanently save your changes select the Save Config option in the Configuration menu 321 Chapter 20 Multiple Spanning Tree Protocol Configuring MSTP Port Parameters 322 To configure MSTP port parameters perform the following procedure 1 2 From the home page select Configuration From the Configuration menu select the Layer 2 option Select the Spanning Tree tab The Spanning Tree tab is shown in Figure 124 on page 312 Click Configure The expanded MSTP Spanning Tree tab is shown in Figure 125 on page 315 In the diagram of the switch at the bottom of the MSTP Spanning Tree Expanded page click the port to be configured You can configure more than one port at a time Click Modify The MSTP Settings Port s page is shown in Figure 128 T_MSTP setings Pors 5 Port Priority 0 15 Point To Point 8 16 128 Auto Detect Port Internal Path Cost 0 200000000 Port External Path Cost 0 200000000 0 0 Auto Update 0 MSTI List Priority amp Internal Cost S Seel Edge Port 3 MST No 8 4 MSTI Enable Migration Check Figure 128 MSTP Settings Port s Page Configure the following parameters as necessary
296. r Stations Trap Receivers Open Status de Access lemondrop19 Read Only Yes Enabled Mgmt Protocols O rootheer14 Read Only 198 1 1 9 198 1 1 9 No Enabled 198 1 1 1 198 1 1 1 O sassafras12 Read Vrite 198 20 2 2 198 20 2 2 No Enabled 198 30 3 3 198 30 3 3 Figure 14 SNMPv1 amp SNMPv2c Communities Tab The table in the tab displays the existing community strings The columns of the table are defined here Community Name The name of a community string Access Mode The access mode of a community string A string with a Read Only access mode permits the viewing of the MIB objects on the switch A string with a Read Write access mode permits both viewing and changing the SNMP MIB objects 72 Section Basic Operations Section Basic Operations AT S63 Management Software Web Browser Interface User s Guide Manager Stations The IP addresses of management workstations permitted to use a string with a closed access status Trap Receivers The IP addresses of trap receivers to receive traps from the switch Open Status The access status of a community string Yes means the string has an open status and that any management workstation can use it No means the string has a closed status and that only those workstations whose IP addresses are assigned to the string are permitted to use it Status The operating status of a community string Enabled means the string is available for use and Disabled means it
297. r include ao Working with the Event Logs on page 138 o Working with Syslog Output Definitions on page 147 For background information refer to Chapter 12 Event Logs and Syslog Servers in the AT S63 Management Software Menus Interface User s Guide Note The event logs even when disabled log all AT S63 initialization events that occur when the switch is reset or power cycled Any switch events that occur after AT S63 initialization are entered into the logs only if the event log feature is enabled which is the default setting for this feature 137 Chapter 11 Event Logs and Syslog Servers Working with the Event Logs 138 Enabling or Disabling the Event Logs The event logs contain event messages generated by a switch These events can provide vital information about the operation of the device and can help you identify and resolve network problems The information includes the time and date when an event occurred the event s severity the AT S63 module that generated the event and an event description The AT 9400 Series switch has two event logs Both logs store the same event messages There is a temporary log with a storage capacity of 4 000 events Events in this log are not retained when the switch is reset or power cycled The other log is in permanent memory with a capacity of 2 000 entries Events in this log are retained even when the switch is reset or power cycled You can view e
298. r s Guide Displaying the GVRP Database To display the GVRP database perform the following procedure 1 2 Section V Virtual LANs From the Home page select Monitoring From the Monitoring menu select the Layer 2 option Select the GVRP tab The GVRP tab is shown in Figure 138 on page 353 In the View GVRP Parameters section click View GVRP Database Click View The GVRP Database page is shown in Figure 140 Page iof 0 GID Index VLAN ID Used 0 E ves Figure 140 GVRP Database Page The GVRP Database page provides the following information GID Index The value of the GID index corresponding to the attribute VLAN ID The value of the attribute Used Whether the GID index is currently being used by any port in the GARP application 355 Chapter 22 GARP VLAN Registration Protocol Displaying the GVRP State Machine To display the GVRP state machine perform the following procedure 1 2 From the Home page select Monitoring From the Monitoring menu select the Layer 2 option Select the GVRP tab The GVRP tab is shown in Figure 138 on page 353 In the View GVRP Parameters section click View GVRP State Machine for VLAN and enter the VLAN number in the box Click View The GVRP State Machine for VLAN page is shown in Figure 141 Port App Reg Port App Reg Port App Reg Port App Reg Aa Fix Aa Fix Aa Fix Aa Fix
299. re bridges have the same bridge priority value This value cannot be changed Root Bridge The MAC address of the root bridge of the spanning tree domain This value cannot be changed and is only displayed when STP is activated on the switch Root Priority The priority value on the root bridge of the spanning tree domain This parameter is only displayed when STP is enabled on the switch To change the priority value on the root bridge you must start a management session on the switch functioning as the root bridge and change its bridge priority value After you have made the desired changes click Apply To permanently save your changes select the Save Config option in the Configuration menu To configure STP port parameters perform the following procedure 1 Perform steps 1 to 4 in Configuring STP Bridge Settings on page 294 to display the Spanning Tree tab To configure a port s STP settings click on the port in the switch image and click Modify You can select more than one port at a time The STP Settings Port s page is shown in Figure 115 T S senos Porno i3 O OOOO Port Priority 0 15 Port Cost 0 65535 8 16 128 0 0 Auto Update Figure 115 STP Settings Port s Page Configure the following parameters as necessary Port Priority This parameter is used as a tie breaker when two or more ports are determined to have equal costs to the root bridge The range is 0
300. re the port is not a member you can pre configure the parameter in the event you later add the port as a member of the MSTI through a VLAN assignment Enable Migration Check This parameter is displayed only when MSTP is enabled This parameter resets a port allowing it to send RSTP BPDUs When an MSTP bridge receives STP BPDUs on an MSTP port the port transmits STP BPDUs The port continues to transmit STP BPDUs indefinitely Point to Point This parameter defines whether the port is functioning as a point to point port The possible settings are Yes No and Auto Detect For an explanation of this parameter refer to Point to Point and Edge Ports in Chapter 22 Spanning Tree and Rapid Spanning Tree Protocols in the AT S63 Management Software Menus Interface User s Guide Port External Path Cost The port cost of the port if the port is connected to a bridge which is a member of another MSTP region or is running STP or RSTP The range is 0 to 200 000 000 Table 10 on page 324 lists the MSTP port costs with the Auto setting when the port is not a member of a trunk Table 10 MSTP Auto External Path Costs Port Speed Port Cost 10 Mbps 2 000 000 100 Mbps 200 000 1000 Mbps 20 000 Section IV Spanning Tree Protocols Section IV Spanning Tree Protocols AT S63 Management Software Web Browser Interface User s Guide Table 11 lists the MSTP port costs with the Auto setting when the port is part o
301. ress when sending packets to the server For background information on routing interfaces refer to the AT S63 Management Software Command Line Interface User s Guide Note The default system time on the switch is midnight January 1 1980 To set the system time manually or to configure SNTP client do the following 1 From the Home Page select Configuration 2 Select the System Time tab Section l Basic Operations AT S63 Management Software Web Browser Interface User s Guide The System Time tab is shown in Figure 6 arketing 30 84 AB EF CD C Home e SE es layer System Time 13 126 112 on 20 41 aa Time Format HH MM SS on DAY MON YEAR Network Security Additional Time Parameters a eg a Multicast Daylight Savings Time DST Disabled Enabled C Save Config Simple Network Time Protocol SNTP Settings a Status Disabled Enabled Server IP Address 0 0 0 0 Poll Interval 600 seconds Figure 6 System Time Tab 3 To set the system time manually do the following 4 Section Basic Operations a Inthe System Time section of the tab enter the time and date in the following format hh mm ss dd mm yyyy b Click Apply To configure the switch to obtain its date and time from an SNTP or NTP server on your network or the Internet configure the following options UTC Offset Specifies the difference between the UTC and local time The default is 0 hour
302. resses O View All O View Static View Dynamic Delete All Dynamic MAC Addresses Click Delete to Remove All Dynamic MAC Addresses View MAC Addresses on Ports O View MAC Addresses for VLAN View MAC Address 94 Figure 23 MAC Address Tab Configuration Section Basic Operations AT S63 Management Software Web Browser Interface User s Guide The View Unicast MAC Addresses section and the View Multicast MAC Addresses section display unicast and multicast addresses respectively The options function the same in both sections You can select only one option at a time View All Displays all dynamic and static unicast or multicast addresses in the MAC address table View Static Displays just the static unicast or multicast addresses assigned to the ports View Dynamic Displays just the dynamic addresses learned on the ports View MAC Addresses on Port Displays the dynamic and static MAC addresses of a particular port You can specify more than one port at a time View MAC Addresses for VLAN Displays the static and dynamic addresses learned on the tagged and untagged ports of a VLAN You specify the VLAN by entering the VLAN ID number You can specify only one VLAN at a time View MAC Address Displays the port number where a MAC address was assigned or learned In some situations you might want to know which port learned a particular MAC address You could displ
303. rface User s Guide Redundant Twisted Pair Ports Section Basic Operations Your AT 9400 Series switch may have two or four twisted pair ports that are paired with GBIC or SFP slots The twisted pair ports are identified with the letter R for Redundant as part of their number on the front faceplate of the unit The ports and slots are listed in Table 1 Table 1 Twisted Pair Ports Matched with GBIC and SFP Slots Model Ports and Slots AT 9424T GB_ 23R with GBIC slot 23 24R with GBIC slot 24 AT 9424T SP 23R with SFP slot 23 23R with SFP slot 24 AT 9424Ts and 21R with SFP slot 21 AT 9424Ts XP_ 22R with SFP slot 22 23R with SFP slot 23 23R with SFP slot 24 AT 9448T SP 45R with SFP slot 45 46R with SFP slot 46 47R with SFP slot 47 48R with SFP slot 48 Follow these guidelines when using these ports and slots O Only one port in a pair either the twisted pair port or a corresponding GBIC or SFP module can be active at a time 0 The twisted pair port is the active port when its GBIC or SFP slot is empty or when a GBIC or SFP module is installed but has not established a link to an end node O The twisted pair port automatically changes to the redundant status mode when a GBIC or SFP module establishes a link with an end node O A twisted pair port automatically transitions back to the active status when the link is lost on the GBIC or SFP module 0 A twisted
304. rity Chapter 23 MAC Address based Port Security Section VI Port Security This chapter explains how to configure and display the MAC address based security levels on the ports on the switch It contains the following sections o Configuring Port Security on page 366 o Displaying Port Security Levels on page 369 Note For background information refer to Chapter 30 MAC Address based Port Security in the AT S63 Management Software Menus Interface User s Guide 365 Chapter 23 MAC Address based Port Security Configuring Port Security To configure security for the ports perform the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the Network Security option The Network Security page opens with the Port Security tab selected by default as shown in Figure 144 Network Security Figure 144 Port Security Tab Configuration In the image of the switch click the port to be configured and click Modify A selected port turns white You can configure more than one port at a time The Security for Ports page is shown in Figure 147 Security Mode MAC Limit Automatic No Limit Security Mode Automatic v Figure 145 Security for Ports Page Configuration 366 Section VI Port Security Section VI Port Security AT S63 Management Software Web Browser Interface User s Guide 4
305. rm the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the Services option w Select the Traffic Class tab The Traffic Class tab is shown in Figure 64 on page 190 4 Select the traffic class to be deleted and click Delete The traffic class is deleted from the switch 5 To permanently save your changes select the Save Config menu selection Displaying the To display the traffic classes perform the following procedure Traffic Classes 1 From the Home page select Monitoring 2 From the Monitoring menu select Services 3 Select the Traffic Class tab The Traffic Class tab is shown in Figure 67 Traffic Page 1of1 Current Traffic Classes Description Active Parent Policy ID Flow Group List GI DSCP traffic 17 No 1 oO 8 DSCP 4 Yes 12 Services Figure 67 Traffic Class Tab Monitoring Section Il Advanced Operations Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide The Traffic Class tab displays the currently configured flow groups in a table that contains the following columns of information ID The ID of the traffic class Description A description of the traffic class Active Whether the traffic class is active on the switch An active traffic class is part of a policy assigned to one or more switch ports An inactive traffic class is not assigned to any polici
306. rol List Deleting an ACE To delete an ACE from the Management ACL perform the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the Mgmt Security option 3 Select the Mgmt ACL tab The tab is shown in Figure 168 on page 419 4 Select the ACE to be deleted from the Management ACL List section in the tab and click Delete The ACE is deleted from the switch 5 To permanently save your changes select the Save Config option in the Configuration menu 422 Section VII Management Security AT S63 Management Software Web Browser Interface User s Guide Displaying the Management Access Control List To display the management access control list and its access control entries perform the following procedure 1 From the home page select Monitoring 2 From the Monitoring menu select the Mgmt Security option 3 Select the Mgmt ACL tab The Mgmt ACL tab is shown in Figure 169 AT 9424T SP Total Mgmt ACLS 2 Page lof 1 Mgmt Security Browse Mgmt ACL Entries C Mgmt Protocols D IP Address IP Mask Application Type 144 144 144 11 255 255 255 255 Network Security 144 144 1420 255 255 255 0 Figure 169 Mgmt ACL Tab Monitoring The top section of the tab displays the status of the Management ACL as enabled or disabled The bottom section lists the existing ACEs For definitions of the columns refer to
307. rol is activated Back Pressure Use this parameter to set backpressure on a port This option only appears for ports operating in half duplex mode A port uses backpressure to control the flow of ingress packets Possible settings are Enabled Backpressure is enabled Section l Basic Operations Section Basic Operations AT S63 Management Software Web Browser Interface User s Guide Disabled Backpressure is disabled This is the default Flow Control Back Pressure Limit Use this parameter to specify the threshold for flow control or backpressure The threshold is specified in cells A cell equals 128 bytes The range is 1 to 7935 The default is 7935 cells HOL Blocking HOL blocking sets a threshold on the utilization of a port s egress queue When the threshold for a port is exceeded the switch signals other ports to discard packets to the oversubscribed port The threshold is specified in number of cells A cell is 128 bytes The range is 1 to 8191 The default is 682 Broadcast Rate Limiting Use this parameter to enable or disable ingress broadcast packet limits Possible settings are Enabled Broadcast packet ingress rate limiting is enabled To set the rate limit use the Broadcast Rate parameter Disabled Broadcast packet ingress rate limiting is disabled This is the default Broadcast Rate Use this parameter to set the broadcast rate limit in packets per second The range is 0 to 262143 The defaul
308. rom the home page select Configuration The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 243 Chapter 18 SNMPv3 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 In the SNMPv3 section click the button next to Configure Access Table and then click Configure at the bottom of the tab The SNMPv3 Access Table tab is shown in Figure 86 on page 240 Click Next or Previous to display the Access Table entry to be deleted Click Remove A warning message is displayed Click OK to remove the Access Table entry To permanently save your changes select the Save Config option in the Configuration menu Modifying an To modify an entry in the SNMPv3 Access Table perform the following Access Table Procedure Entry 4 244 From the home page select Configuration The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 In the SNMPv3 section click the button next to Configure Access Table and then click Configure at the bottom of the tab The SNMPv3 Access Table tab is shown in Figure 86 on page 240 Click Next or Previous to display the Access Table entry to be changed Click Modify The Modify SNMPv3 Access page is shown in Figure 88 Section Ill SNMPv3 AT S63 Management Software Web Browser I
309. rs on page 80 Displaying Port Parameters on page 87 Displaying Port Statistics on page 89 Oo UD Resetting a Port to the Default Settings on page 92 Note For background information refer to Chapter 6 Port Parameters in the AT S63 Management Software Menus Interface User s Guide Section Basic Operations 79 Chapter 5 Port Parameters Configuring Port Parameters To configure the parameter settings of a port on the switch perform the following procedure 1 2 Layer 1 From the Home page select Configuration From the Configuration menu select the Layer 1 option The Layer 1 page is displayed with the Port Settings tab selected by default as shown in Figure 18 3 4 80 Figure 18 Port Settings Tab Configuration The Port Settings tab displays an image of the front of the switch Ports with a valid link to an end node are green In the switch image click a port to configure The selected port turns white You can configure more than one port at a time though they must all be the same type i e all twisted pair ports or all fiber optic ports To deselect a port click it again Click Modify To configure all the ports click Modify All Section Basic Operations Section Basic Operations AT S63 Management Software Web Browser Interface User s Guide The Port Configuration page is shown Figure 19 rarer i Descripti
310. rts individually eg 1 4 5 as a range e g 11 14 or both eg 15 17 22 24 VLAN ID Specifies the VLAN ID where the port is a member 5 Click Apply 6 Repeat this procedure to add other static addresses to the switch 7 To permanently save your changes select the Save Config option in the Configuration menu 98 Section Basic Operations AT S63 Management Software Web Browser Interface User s Guide Deleting Unicast and Multicast MAC Addresses Section I Basic Operations To delete a static or dynamic unicast or multicast MAC address from the switch perform the following procedure 1 From the Home page select Configuration 2 From the Configuration menu select the Layer 2 option The Layer 2 page opens with the MAC Address tab selected by default as shown in Figure 23 on page 94 3 Display the MAC addresses on the switch by selecting one of the options For instructions refer to Displaying the MAC Address Table on page 94 4 Click the button next to the MAC address to be deleted from the switch You can only delete one address at a time Note You cannot delete a switch s MAC address an STP BPDU MAC address or a broadcast address 5 Click Remove The MAC address is deleted from the table 6 To permanently save your changes select the Save Config option in the Configuration menu 99 Chapter 6 MAC Address Table Deleting All Dynamic MAC Addresses To delete all dyn
311. rver Timeout 1 60 AT 30 second s Port 8 IP Address 1 65535 Encryption Key 1812 Not Defined 1812 Not Defined 1812 Not Defined Figure 166 RADIUS Client Configuration Page Configure the following parameters as necessary Global Encryption Key Specify the global encryption key If all of the RADIUS servers have the same encryption secret you can enter the key here If the servers have different keys you must specify the keys with the servers IP addresses The maximum key length is 39 characters Global Server Timeout Specify the maximum amount of time the switch should wait for a response from a RADIUS server If the timeout expires without a response the switch queries the next RADIUS server in the list If Section VII Management Security Section VI Management Security AT S63 Management Software Web Browser Interface User s Guide there are no more servers the switch defaults to the standard Manager and Operator accounts The default is 30 seconds The range is 1 to 30 seconds IP Address Port and Encryption Key Specify the IP address UDP port number and encryption key of each RADIUS server You can specify up to three servers You can leave the encryption field blank for a server if you entered the server s key in the Global Encryption Key field The maximum length of the encryption key is 39 characters Click Apply To permanently save your changes sel
312. ry takes effect immediately 12 Click Apply to update the SNMPv3 User Table 13 To permanently save your changes select the Save Config option in the Configuration menu 233 Chapter 18 SNMPv3 Configuring the SNMPv3 View Table 234 Creating a View Table Entry You can create delete and modify an SNMPv3 View Table entry See the following procedures o Creating a View Table Entry on page 234 o Deleting a View Table Entry on page 237 0 Modifying a View Table Entry on page 237 For reference information about the SNMPv3 View Table see Chapter 21 SNMPv3 in the AT S63 Management Software Menus Interface User s Guide To create an entry in the SNMPv3 View Table perform the following procedure 1 From the home page select Configuration The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 2 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 3 Inthe SNMPv3 section click the button next to Configure View Table and then click Configure at the bottom of the tab Section Ill SNMPv3 AT S63 Management Software Web Browser Interface User s Guide The SNMPv3 View Table tab is shown in Figure 83 SNMPvs3 View Table Total Entries 6 Page 1 of 2 SubTree SubTree View Name om Mask View Type Storage Type Row Status 1 3 6 1 2 Excluded Nonvolatile Mgmt Protocols 1 3 6 1
313. s The range is 12 to 12 hours Note If the interface on the local subnet from where the switch is reaching the server is using DHCP to set its IP configuration it automatically attempts to determine this value In this case you do not need to configure a value for the UTC Offset parameter 49 Chapter 2 Basic Switch Parameters 5 6 50 Daylight Savings Time DST Enables or disables the system s adjustment for daylight savings time The default is enabled Note The switch does not set DST automatically If the switch is in a locale that uses DST you must remember to enable this in April when DST begins and disable it in October when DST ends If the switch is in a locale that does not use DST this option should be set to disabled all the time Status Enables or disables the SNTP client on the switch The default is disabled Server IP Address Specifies the IP address of an SNTP server Note If the local interface on the switch is obtaining its IP address and subnet mask from a DHCP server you can configure the server to provide the interface with an IP address of an NTP or SNTP server If you configured the server to provide this address then you do not need to enter it here Poll Interval Specifies the number of seconds the switch waits between polling the SNTP or NTP server The default is 600 seconds The range is from 60 to 1200 seconds When you finish configuring the parameters
314. s chapter explains how to create modify and delete port based and tagged VLANs This chapter also explains how to select a multiple VLAN mode This chapter contains the following sections Creating a New Port Based or Tagged VLAN on page 336 Modifying a VLAN on page 341 Deleting a VLAN on page 343 Selecting a VLAN Mode on page 344 Displaying VLANs on page 345 OQ 00 0 Note For background information on VLANs refer to the AT S63 Management Software Menus Interface User s Guide Secton V Virtual LANs 335 Chapter 21 Port based and Tagged VLANs Creating a New Port Based or Tagged VLAN To create a new port based or tagged VLAN perform the following procedure 1 From the Home page select Configuration 2 From the Configuration menu select the Layer 2 option 3 Select the VLAN tab The VLAN tab is shown in Figure 132 System Name Marketing C Addr 00 30 84 4B EF CD L aert LAN Conflauration SA Uplink Port L Mgmt Security User Configured Total VLANs 3 Page 1of1 Utilities VLAN List C Help Client Name Uplink Port Type Protocol Member Ports Untagged L ege Default VLAN NA Port Based None Configured 7 8 11 19 24 Actual 7 8 11 19 24 Untagged Sales Port Based None Configured 1 6 Actual 1 6 Tagged 23 Untagged Production Port Based None Configured 9 10 12 18 Actual 9 10 12 18 Tagged 23
315. s sending log events to the syslog server To permanently save your changes select the Save Config option in the Configuration menu 151 Chapter 11 Event Logs and Syslog Servers 152 Section Il Advanced Operations Chapter 12 Classifiers A classifier defines a traffic flow Classifiers are used with access control lists ACLs to filter ingress traffic on a port and with Quality of Service policies to regulate the traffic flows passing through a switch This chapter contains the following sections Configuring a Classifier on page 154 Modifying a Classifier on page 160 Deleting a Classifier on page 162 Oo a D Displaying the Classifiers on page 163 Note For background information refer to Chapter 13 Classifiers in the AT S63 Management Software Menus Interface User s Guide Section Il Advanced Operations 153 Chapter 12 Classifiers Configuring a Classifier To configure a classifier perform the following procedure 1 2 From the home page select Configuration From the Configuration menu select the Network Security or Services option The Classifier tab is accessible from both menu selections Select the Classifier tab The Classifier tab is shown in Figure 44 AT 9424T SP Classifier Page lof 1 Current Classifiers No of Description Novo Active References ae Associations Product Svr MAC add 1 Priority 6 traffic 1
316. s soon as you click the Apply button on a web page However a change is initially saved only to temporary memory and will be lost the next time you reset or power cycle the unit To permanently save a change you must click the Save Config option in the main menu as shown in Figure 4 Selecting the option updates the switch s active configuration file A change saved to the active configuration file is retained even when the unit is powered off or reset This menu option is only displayed after you have made a configuration change After you click Save Config your change is added to the active configuration file and the option is removed from the menu arketing 4 FE D2 00 a 7 IT Leer System Name i IP Configuration Meet Security Marketing Obtain IP Address From Administrator Static DHCP BOOTP Mgmt Protocols ES address L Network Security EE ba LU Services Building 212 rm 502 Subnet Mask Ce Default Gateway Ze rasswords Save Confi g Manager Password Operator Password Option SE Confirm Manager Password Confirm Operator Password Figure 4 Save Config Option in the Configuration Menu Section Basic Operations 37 Chapter 1 Starting a Web Browser Management Session Quitting a Web Browser Management Session To exit a web browser management session select the Logout option from the main menu 38 Section l Basic Operations AT S63 Management Software Web Browser Inte
317. seconds The range of this parameter is from 6 to 40 seconds The default is 20 seconds In selecting a value for maximum age the following must be observed MaxAge must be greater than 2 x HelloTime 1 MaxAge must be less than 2 x ForwardingDelay 1 Section IV Spanning Tree Protocols Configuring the CIST Priority Section IV Spanning Tree Protocols AT S63 Management Software Web Browser Interface User s Guide Bridge Max Hops MSTP regions use this parameter to discard BPDUs The Max Hop counter in a BPDU is decremented every time the BPDU crosses an MSTP region boundary After the counter reaches zero the BPDU is deleted Revision Level The revision level of an MSTP region This is an arbitrary number that you assign to a region The revision level must be the same on all bridges in a region Different regions can have the same revision level without conflict The range is 0 zero to 255 Click Apply To permanently save your changes select the Save Config option in the Configuration menu Proceed to the next procedure to configure the CIST priority To configure the CIST priority perform the following procedure 1 2 From the home page select Configuration From the Configuration menu select the Layer 2 option Select the Spanning Tree tab The Spanning Tree tab is shown in Figure 113 on page 292 Click Configure The expanded MSTP Spanning Tree tab is shown in Figure 125 on page 315
318. security You can select this value if you configured the Security Model parameter with the SNMPv3 protocol In the Storage Type parameter select one of the following storage types for this table entry Volatile Select this storage type if you do not want the ability to save an entry in the Target Parameters Table After making changes to an Target Parameters Table entry with a Volatile storage type the Save Config option is not displayed on the Configuration menu NonVolatile Select this storage type if you want the ability to save an entry in the Target Parameters Table After making changes to an Target Parameters Table entry with a NonVolatile storage type the Save Config option is displayed on the Configuration menu Allied Telesyn recommends this storage type Note The Row Status parameter is a read only field in the web browser interface The Active value indicates the SNMPv3 Target Parameters Table entry will take effect immediately Click Apply to update the SNMPv3 Target Parameters Table To permanently save your changes select the Save Config option in the Configuration menu 271 Chapter 18 SNMPv3 Configuring the SNMPv3 Community Table You can create delete and modify an SNMPv3 Community Table entry See the following procedures o Creating an SNMPv3 Community Table Entry on page 272 o Deleting an SNMPv3 Community Table Entry on page 275 o Modifying an SNMPv3 Community Table E
319. select Configuration The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 In the SNMPv3 section click the button next to Configure Community Table and then click Configure at the bottom of the tab The SNMPv3 Community Table tab is shown in Figure 101 on page 273 Click the button next to the SNMPv3 Community Table entry to be deleted and then click Remove A warning message is displayed Click OK To permanently save your changes select the Save Config option in the Configuration menu To modify an entry in the SNMPv3 Community Table perform the following procedure 1 From the home page select Configuration The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 275 Chapter 18 SNMPv3 276 3 In the SNMPv3 section click the button next to Configure Community Table and then click Configure at the bottom of the tab The SNMPv3 Community Table tab is shown in Figure 101 on page 273 Click the button next to the SNMPv3 Community Table entry to be changed and then click Modify The Modify SNMPv3 Community page is shown in Figure 103 5 Modify SNMPVS Community Community Index alabama Community Name birmingham
320. signments from a RADIUS authentication server for supplicant accounts O MACBASED parameter for supporting MAC address based authentication as an alternative to 802 1x username and password authentication Chapter 24 802 1x Port based Network Access Control on page 371 Modified procedure Configuring Authenticator Port Parameters on page 375 Management Access Control List Simplified the web interface for managing the access control entries in the Management ACL Chapter 28 Management Access Control List on page 417 23 Preface Version 1 2 0 Table 3 lists the new features in version 1 2 0 of the AT S63 management software The only new feature supported in the web browser interface is the Supplicant Mode parameter for 802 1x authenticator ports The other new features are supported in the menus and command line interfaces For background information on the new features refer to the AT S63 Management Software Menus Interface User s Guide Table 3 New Features in AT S63 Version 1 2 0 Feature Change Chapter and Procedure MAC Address Table Added new parameters to the CLI commands for deleting and displaying specific types of MAC addresses in the MAC address table The new parameters are o STATIC STATICUNICAST and STATICMULTICAST for displaying and deleting static unicast and multicast MAC addresses o DYNAMIC DYNAMICUNICAST and DYNAMIC
321. splays a table that contains the following columns of information Port The port number State The RSTP state of the port The possible states for a port connected to another device running RSTP are Discarding and Forwarding Section IV Spanning Tree Protocols 307 Chapter 19 Spanning Tree and Rapid Spanning Tree Protocols 308 The possible states for a port connected to a device running STP are Listening Learning Forwarding and Blocking The possible states for a port not being used or where spanning tree is not activated is Disabled Role The RSTP role of the port Possible roles are Root The port that is connected to the root switch directly or through other switches with the least path cost Alternate The port offers an alternate path in the direction of the root switch Backup The port on a designated switch that provides a backup for the path provided by the designated port Designated The port on the designated switch for a LAN that has the least cost path to the root switch This port connects the LAN to the root switch Edge Port Whether or not the port is operating as an edge port The possible settings are Yes and No P2P Whether or not the port is functioning as a point to point port The possible settings are Yes and No Version Whether the port is operating in RSTP mode or STP compatible mode Port Cost The port cost of the port An example of the RSTP Settings page is show
322. ss based authentication The authenticator port extracts the source MAC address from the initial frames received from a supplicant and automatically sends the address as both the username and password of the supplicant to the authentication server Supplicant nodes do not need 802 1x client software for this authentication method Section VI Port Security Section VI Port Security AT S63 Management Software Web Browser Interface User s Guide Supplicant Mode Sets the supplicant mode of an authenticator port The possible settings are O Single Configures the authenticator port to accept only one authentication This mode should be used together with the piggy back mode When an authenticator port is set to the Single mode and the piggy back mode is disabled only the one client who is authenticated can use the port Packets from or to other clients on the port are discarded If piggy back mode is enabled other clients can piggy back onto another client s authentication and so be able to use the port O Multiple Configures the port to accept up to 20 authentications Every client using an authenticator port in this mode must have a username and password combination Port Control The possible settings are Auto Activates 802 1x port based authentication and causes the port to begin in the unauthorized state allowing only EAPOL frames to be sent and received through the port The authentication process begins when the link s
323. sssssssessrreessirnnesrnrnrnessnanneedtenneestttnneseteanadstnanneeetannaetninnnanana 116 Figure 33 Port Mirroring Tab Monitoring jeere te ia REEE AANA Rea TE TARAK EE AIE ERA 120 Figures Chapter 9 File Systemi ce Nee EENS dee 123 Figure 34 File System Tab Configuration ececcececeeeeeeeeeeeeeeeeeeeeceneeeeeeseeeeaeeeeceeeeeeeeeseeeaeeeeseeneeeeeseeenaneees 124 Figure 35 Viewing File Page u ices cccee ce ciceneeeeeenees ieii AE E E A EA S a 126 Chapter 10 File Downloads and Uploads EEN 129 Figure 36 System Utilities Tab Configuration acessseseessrneeeesnrnesnsnnnnsnsanneeceennnettnnnesttnnnnennnnnneeeeennneennnna 132 Chapter 11 Event Logs and Syslog Servers cccceeeeeeeeeeeeeeeeceeeeeeeeeeeeeeenseseeeeeeaseeeeeeeasaseeeeseeneeeeeeeneesenes 137 Figure 37 Event Log Tab Configuration esisiini edinen iraia eaii aai a iaeei aaa 139 Figure 38 Event Log Example Displayed in Normal Mode 143 Figure 39 Event Log Example Displayed in Full Mode ccccccceeceeeceeeeeeeeceeeeeceeeeeeeeeseneeaeeeseeeeaeeeseeeneees 144 Figure 40 Modifying Event Log Output 1 Wimdow nenten na 145 Figure 41 Create Event Log Output Page 148 Figure 42 View Event Log Output Page ce ccccceeeceeeeeeeeneeeeeeeeeeeeeeeeeeeeaeeeseeeeeeeeeseeeeeeeeseeeaeeesseeeeeeeseenaneess 150 Figure 43 Modify Event Log Output Page 151 Chapter 12 Classifiers eege Ae EES AKUA UNAKAA ARENASA EENS EE Ee EC Ee 153 Figure 44 Classifier Tab Con
324. ssword Ciphers Available 3DES 128 bit AES 192 bit AES 256 bit AES Arcfour RC4 MAC s Available hmac sha1 hmac md5 Data Compression Available 402 Figure 161 Secure Shell Tab Monitoring The Secure Shell tab provides the following information SSH Versions Supported The versions of SSH supported by the AT S63 management software Status Whether the SSH server is enabled or disabled Server Port The well known port number for SSH The default is port 22 Host Key ID The encryption key ID of the host key Section VII Management Security Section VI Management Security AT S63 Management Software Web Browser Interface User s Guide Server Key ID The encryption key ID of the server key Server Key Expiry Time Length of time in hours until the server key is regenerated The default is 0 hours which means the server key is not regenerated Login Timeout Time in seconds until a SSH server is released from an incomplete connection with a SSH client Authentication Available Authentication method available Currently password authentication is the only supported method Ciphers Available SSH ciphers that are available on the switch MAC s Available Message Authorization Code MAC that is used to validate incoming SSH messages to the server Two algorithms are supported Data Compression Whether or not data compression is available on the switch Data compression is useful for networks tha
325. st log in to the server Enter anonymous for the user name and your email address for the password 21 Preface History of New Features The following subsections contain the history of the new features in the AT S63 management software Version 2 0 0 Table 1 lists the new feature in version 2 0 0 of the AT S63 management software Table 1 New Features in AT S63 Version 2 0 0 Feature Change Chapter Internet Protocol version 4 IPv4 packet routing with o Routing interfaces Oo Static routes Router Information Protocol RIP versions 1 and 2 m New feature This feature is not supported from the web browser interface For background information and commands refer to the AT S63 Management Software Command Line User s Guide Quality of Service Added the following parameters to the Quality of Service QoS web pages for flow groups traffic classes and policies o Type of Service ToS a Move ToS to Priority 0 Move Priority to ToS Send to Mirror Port These QoS parameters were included in the menus and command line interfaces in earlier versions of the management software m Chapter 15 Quality of Service on page 183 Modified procedures 0 Configuring a Flow Group on page 184 o Configuring a Traffic Class on page 190 o Configuring a Policy on page 198 22 Note The AT 9408LC SP AT 9424T GB and AT 942
326. stacking status is activated on the switch 6 To permanently save your changes select the Save Config option in the Configuration menu 63 Chapter 3 Enhanced Stacking Selecting a Switch in an Enhanced Stack This procedure explains how to select a switch to manage in an enhanced stack You can manage only one switch at a time When you start a web browser management session on an enhanced stack you are initially managing the master switch where you started the session To select a switch in an enhanced stack to manage perform the following procedure 1 From the home page of the master switch select Enhanced Stacking Note If the Home page does not have an Enhanced Stacking menu option the switch s enhanced stacking status is either slave or unavailable For instructions on how to change a switch s stacking status refer to the previous procedure To discover the switches in the stack the master switch sends a broadcast packet out the ports of its local interface and monitors the interface for the responses from the switches It displays the results in the Stacking Switches page An example is shown in Figure 11 AT 9424T SP Stacking Switches Total Switches 12 Page 1 of 2 Software Switch Mac Addr Name S S Version Model 00 00 00 A4 BB CD 00 30 80 00 4D 34 00 30 84 52 02 60 SV Users 8 00 30 84 54 4B 00 00 30 84 54 F 5 80 00 30 84 F3 B4 00 S V_USERS_4 00 30 84 F3 B4 20
327. stem page is displayed with the General tab selected by default as shown in Figure 9 on page 57 2 Select the SNMP Tab The SNMP tab is shown in Figure 104 on page 279 3 In the SNMPv3 section lick the button next to View Target Address Table and then click View at the bottom of the tab 284 Section Ill SNMPv3 AT S63 Management Software Web Browser Interface User s Guide The SNMPv3 Target Address Table tab is shown in Figure 110 n Name Marketing r 00 30 84 4B EF CD SNMPv3 Target Address Table Total Entries 2 Page 1 of 2 Target Address Timeout snmpv3hostt 1500 Parameters Retries Mgmt Protocols snmpv3manager1 2 IP Address UDP Port Number 162 187 1 1 1 Storage Type Row Status NonvVolatile Active Tag List testengtag swengtag Figure 110 SNMPv3 Target Address Table Tab Monitoring Displaying Target To display entries in the SNMPv3 Target Parameters Table perform the Parameters Table following procedure Entries 1 From the Home page select Monitoring The Monitoring System page is displayed with the General tab selected by default as shown in Figure 9 on page 57 2 Select the SNMP tab The SNMP tab is shown in Figure 104 on page 279 3 In the SNMPv3 section click the button next to the View Target Parameters Table and then click View at the bottom of the tab Section Ill SNMPv3 285 Chapter 18 SNMPv3 Displaying SNMPv3 Community Table Entries 286 T
328. t Monitoring 2 From the Monitoring menu select the Layer 1 option The Layer 1 page is displayed with the Port Settings tab selected by default as shown in Figure 20 Figure 20 Port Settings Tab Monitoring The Port Settings tab displays an image of the front of the switch Ports with a valid link to an end node are green 3 In the switch image click a port You can select more than one port A selected port turns white To deselect a port click it again 4 Click Status Section Basic Operations 87 Chapter 5 Port Parameters 88 The Port Status page is shown in Figure 21 Description ifName Port_03 Vian Id 1 Speed and Duplex Auto Ingress Broadcast Filter Disabled Ingress Unknown Unicast Filter Disabled Ingress Unknown Multicast Filter Disabled Flow Control Disabled Flow Control Back Pressure Limit 7935 Broadcast Rate Limiting Disabled Unknown Unicast Rate Limiting Disabled Multicast Rate Limiting Disabled T Porseus 3 SO Status Enabled Link Status Down MDLMDIX Crossover MDIX Egress Broadcast Filter Disabled Egress Unknown Unicast Filter Disabled Egress Unknown Multicast Filter Disabled Back Pressure Disabled HOL Blocking 682 Broadcast Rate 262143 Unknown Unicast Rate 262143 Multicast Rate 262143 Figure 21 Port Status Page For descriptions of the parameters refer to Configuring Port Parameters on p
329. t have a slow throughput speed 403 Chapter 26 Secure Shell SSH 404 Section VII Management Security Chapter 27 TACACS and RADIUS Protocols Section VII Management Security This chapter contains instructions on how to configure the authentication protocols This chapter contains the following procedures m WS US 0 Enabling or Disabling TACACS or RADIUS on page 406 Configuring the TACACS Client Settings on page 408 Displaying the TACACS Client Settings on page 410 Configuring the RADIUS Client Settings on page 412 Displaying the RADIUS Client Settings on page 414 Note For background information refer to Chapter 36 TACACS and RADIUS Protocols in the AT S63 Management Software Menus Interface User s Guide 405 Chapter 27 TACACS and RADIUS Protocols Enabling or Disabling TACACS or RADIUS 406 To enable or disable server based authentication or to select a different authentication protocol perform the following procedure 1 From the Home page select Configuration 2 From the Configuration menu select the Mgmt Protocols option The Mgmt Protocols page is displayed with the Server based Authentication tab selected by default as shown in Figure 162 Server based Authentication C Enable Server based Authentication Authentication Method Tacacs O RADIUS Mgmt Protocols TACACS Configuration RADIUS Co
330. t is 262143 Unknown Unicast Rate Limiting Use this parameter to enable or disable unknown ingress unicast packet limits Possible settings are Enabled Unknown unicast packet ingress rate limiting is enabled To set the rate limit use the Unknown Unicast Rate parameter Disabled Unknown unicast packet ingress rate limiting is disabled This is the default Unknown Unicast Rate Use this parameter to set the unknown unicast rate limit in packets per second The range is 0 to 262143 The default is 262143 Multicast Rate Limiting Use this parameter to enable or disable ingress multicast packet limits Possible settings are Enabled Multicast packet ingress rate limiting is enabled To set the rate limit use the Multicast Rate parameter Disabled Multicast packet ingress rate limiting is disabled This is the default 85 Chapter 5 Port Parameters Multicast Rate Use this parameter to set the multicast rate limit in packets per second The range is 0 to 262143 The default is 262143 6 After entering the desired changes click Apply The switch activates the parameter changes on the port 7 To permanently save your changes select the Save Config option in the Configuration menu 86 Section Basic Operations AT S63 Management Software Web Browser Interface User s Guide Displaying Port Parameters To display the parameter settings of a port perform the following procedure 1 From the Home page selec
331. tate of the port changes or the port receives an EAPOL Start packet from a supplicant The switch requests the identity of the client and begins relaying authentication messages between the client and the authentication server This is the default setting Force authorized Disables IEEE 802 1X port based authentication and causes the port to transition to the authorized state without any authentication exchange required The port transmits and receives normal traffic without 802 1x based authentication of the client Note A supplicant connected to an authenticator port set to force authorized must have 802 1x client software if the port s authenticator mode is 802 1x Though the force authorized setting prevents an authentication exchange the supplicant must still have the client software to forward traffic through the port Force unauthorized Causes the port to remain in the unauthorized state ignoring all attempts by the client to authenticate The switch cannot provide authentication services to the client through the interface Max Requests Specifies the maximum number of times that the switch retransmits an EAP Request packet to the client before it times out the authentication session The default value for this parameter is 2 retransmissions The range is 1 to 10 retransmissions 377 Chapter 24 802 1x Port based Network Access Control 378 TX Period Sets the number of seconds that the switch waits for a respo
332. te Click Settings The Supplicant Parameters page is shown in Figure 150 ___SupplcantParameters20 Auth Period Held Period o leo Max Start Start Period 1 o Bo User Name User Password Figure 151 Supplicant Parameters Page 6 Configure the following parameters as needed Auth Period Specifies the period of time in seconds that the supplicant waits for a reply from the authenticator after sending an EAP Response frame The range is 1 to 300 seconds The default is 30 seconds 381 Chapter 24 802 1x Port based Network Access Control Held Period Specifies the amount of time in seconds the supplicant is to refrain from retrying to re contact the authenticator in the event the end user provides an invalid username and or password After the time period has expired the supplicant can attempt to log on again The range is 0 to 65 535 seconds The default value is 60 seconds Max Start Specifies the maximum number of times the supplicant sends EAPOL Start frames before assuming that there is no authenticator present The range is 1 to 10 The default is 3 Start Period Specifies the time period in seconds between successive attempts by the supplicant to establish contact with an authenticator when there is no reply The range is 1 to 60 The default is 30 User Name Specifies the username for the switch port The port sends the name to the authentication server for verification
333. tered in either decimal or hexadecimal format If the latter precede the number with Ox The range is 0 0x0 to 255 OxFF Source IP Address Source IP Mask Defines a traffic flow by a source IP address The address can be of a specific node or a subnet You do not need to include a source IP mask if you are filtering on the IP address of a specific end node A mask is required however when filtering on a subnet A binary 1 indicates the switch should filter on the corresponding bit of the IP address while a O indicates that it should not For example the Class C subnet address 149 11 11 0 would have the mask 255 255 255 0 Destination IP Address Destination IP Mask Defines a traffic flow by its destination IP address The address can be of a specific node or a subnet You do not need to include a source IP mask if you are filtering on the IP address of a specific end node A mask is required however when filtering on a subnet A binary 1 indicates the switch should filter on the corresponding bit of the IP address while a 0 indicates that it should not For example the Class C subnet address 149 11 11 0 would have the mask 255 255 255 0 TCP Source Port Defines a traffic flow by source TCP port To set this parameter IP Protocol must be set to TCP TCP Destination Port Defines a traffic flow by destination TCP port To set this parameter IP Protocol must be set to TCP Sectio
334. the SSL SeuingsS iniri a a a ne ele 397 Chapter 26 Secure Shell SSH 0 2 eee cece eee eeeee eters eeeeeee eee caeeeeeeseeeeeeeesegeeeeeeeseeeaeeeeseneaaeeeseeenaeess 399 COMMGUMNG SS EE 400 Displaying Ihe SSH Rtl e ET 402 Chapter 27 TACACS and RADIUS Protocols 00 00 00 cece eeeeeee eee eeeeeeeeeeeeeeeeeeeeseneeeeeeseeeaaeeeeseeeanees 405 Enabling or Disabling TACACS or RADIUS 000 cee eee ee tee rete ae et ae eee taaae esas ee etaaee seas eeeaaeeeags 406 Configuring the TACACS Client Settings 00 eee ee eter ee ert ne ee ane eee gee teaser sagas snes eee geeeeeeeea 408 Contents Displaying the TACACS Client Gettngs cceeeeeeeeceeeeeeeeeeeeeseeeeeeeeeseneeeeeeeseseeeeeeeseeneeeeeseeeeeeeseeenaneees 410 Configuring the RADIUS Client Settings 00 0 eee ee eeeenee rere eect eee eeeeeaeeeeeeeaaaeeeeseeaaeeeeseeedaeeeeseenaeeeeeeenaaes 412 Displaying the RADIUS Client Settings eee eeeeeee eset eeeeee eee eteeeeeeeeeeeaeeeeeeeeneeeeeeeseneaeeeeeseaaeeeeseeeaeeees 414 Chapter 28 Management Access Control Let 417 Enabling or Disabling the Management ACTA 418 Creating an AGE EE 420 Deleting an ACE rics Seeerei 422 Displaying the Management Access Control List 423 It E TTT 425 Figures Chapter 1 Starting a Web Browser Management Session ceseeeceeceeeeeneeeeeeeeeneeeeeneeneeeeneeeceneeenseeeneeeenees 29 Figure 1 Entering a Switch s IP Address in the URL Field 33 Figure 2 AT S63 Login Page EE 33 F
335. the line number To clear a log of all events do the following From the home page select Configuration From the Configuration menu select the System option Select the Event Log tab The Event log tab is shown in Figure 37 on page 139 In the Log Settings section click the button next to the event log to be cleared either Permanent or Temporary Click the Clear Log checkbox Click Apply The events in the log are deleted If the event log feature is enabled the switch starts to add new events to the log Section Il Advanced Operations Modifying the Event Log Full Action Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide This procedure explains how to control what an event log does after it has stored its maximum number of events You have two options The first is to have the switch delete the oldest entries in the log as it adds new entries The second is to have the switch stop adding entries so as to preserve the existing log contents Note The switch continues to send events to syslog servers even when the logs are full To configure the event log full action do the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the System option 3 Select the Event Log tab The Event log tab is shown in Figure 37 on page 139 4 Under Current Log Outputs select Output 0 Permanent to configure the log
336. the switch This procedure gives you the option of downloading the image file into the switch s application block or the file system The application block is the portion of flash memory reserved for the active AT S63 image file and is separate from the file system In most cases you will probably want to download a new image file directly into the switch s application block so that the unit immediately begins to use it as its new operating software However there may be occasions when you may want to download the image file to the file system with plans to copy it to the application block at a later date It should be noted however that the only way to copy an image file in the file system to the application block is with the LOAD command in the command line interface Caution Installing a new AT S63 image file into the application block of flash memory will cause a switch reset Some network traffic may be lost If you are downloading a boot configuration file note these additional guidelines o A configuration file should only be downloaded onto the same model of switch from where it originated for example AT 9408LC SP to AT 9408LC SP Undesirable switch behavior may result if you download a configuration file onto a switch of a different model for example AT 9408LC SP to AT 9424T SP A configuration file is downloaded onto the switch without any modifications If the file contains commands for creating routing interf
337. the switch from the menus or command line interface refer to the AT S63 Management Software Menus Interface User s Guide and the AT S63 Management Software Command Line Interface User s Guide The guides are available from the Allied Telesyn web site For background information and guidelines on all the features of the AT 9400 Series switches and the AT S63 management software refer to the appropriate chapter in the AT S63 Management Software Menus Interface User s Guide The Internet Protocol packet routing feature is an exception Background information and guidelines for that feature can be found in the latest version of the AT S63 Management Software Command Line Interface User s Guide This preface contains the following sections How This Guide is Organized on page 18 Document Conventions on page 19 Where to Find Web based Guides on page 20 Contacting Allied Telesyn on page 21 WS WS WS ST History of New Features on page 22 b Caution The software described in this documentation contains certain cryptographic functionality and its export is restricted by U S law As of this writing it has been submitted for review as a retail encryption item in accordance with the Export Administration Regulations 15 C F R Part 730 772 promulgated by the U S Department of Commerce and conditionally may be exported in accordance with the pertinent terms of License Exception ENC described
338. to a compact flash memory card Creating a new switch configuration file Modifying the event log full action Configuring MLD snooping Configuring RRP snooping Creating deleting importing and exporting encryption keys Creating SSL self signed certificates Generating an SSL certificate enrollment request 022 0 02 O0 028 US US WS US US WS OS OQ Copying SSL certificates into the certificate database or modifying certificates Q Formatting flash memory LI Transferring the AT S63 image file or a configuration file from a master switch to a slave switch i e switch to switch upload Adjusting the baud rate on the serial terminal port Configuring the management console timer Forcing a port to renegotiate its settings with a remote node Enabling and disabling the Telnet server Configuring the Telnet NULL character parameter Configuring the console startup mode WS WS WS WS US 0 Configuring the web browser server 41 Chapter 1 Starting a Web Browser Management Session 42 Section Basic Operations Chapter 2 Basic Switch Parameters Section Basic Operations This chapter contains the following sections Configuring the Switch s Name Location and Contact on page 44 Changing the Manager and Operator Passwords on page 46 Setting the System Date and Time on page 48 Rebooting a Switch on page 51 Pinging a Remote System on page 52 WS WS WS WS 0 Returning the
339. toring ccceeceeeeeneeeeeeeeenneeeeeeeaeeeeeeeaaeeeseeeaeeeeeeeenaeeeeenaes 282 SNMPv3 SecurityToGroup Table Tab Monttortmg 283 SNMPv3 Notify Table Tab Monitorning ji isreieritereerriinatienonateniieen intiera RE TEARRE EARE 284 SNMPv3 Target Address Table Tab Monitoring eesesssessisssssrrnssesrrrssrtrrrssrirrrsstrnrnssrenrrssrreen 285 SNMPv3 Target Parameters Table Tab Monttorimng 286 SNMPv3 Community Table Tab Monttonng 287 Chapter 19 Spanning Tree and Rapid Spanning Tree Protocols c c seeeeeeeeeeeeee eee eeeeeeeseeeeneeeeeeees 291 Figure 113 Figure 114 Figure 115 Figure 116 Figure 117 Figure 118 Figure 119 Figure 120 Figure 121 Figure 122 Figure 123 Spanning Tree Tab Confouraton eee eeeeee etre eneeee ee eaeeeeeetaeeeeeetaeeeeeetieeeeene 292 Configure STP Parameters Tab Configuration cccceesceeeeeeeeteeeeeeeeeecneeeeeetaeeeeeetneeeeeeeaa 295 STP Settings Port S Pagnani a a a 297 Spanning Tree Tab Monitoring sesrcsireiisie eee eene eee a e r 299 Monitor STP Parameters Tab Monitoring 299 STP Settings Page sivaserimiriririniiniir i i ee llacdek vacua E A A NNN sees 300 Configure RSTP Parameters Tab Confouraton seseessessersseerreseirrrsstrrrsssttrrrssennnsssrennne 303 RSTP Settings Port S Page cccececceceeteeececeeeeseccdeeeneeeceecanneeceeeeessecesseeeeeceeshesneecedaneneeeedatersne 305 Monitor RSTP Parameters Tab Monttorin
340. tory Default Values on page 53 In the TFTP Server IP Address field enter the IP address of the network node with the TFTP server software Section Il Advanced Operations Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide 4 For the TFTP Operation parameter click Upload 5 Inthe TFTP Remote Filename field enter a name for the file when it is stored on the TFTP server 6 Inthe TFTP Local Filename field enter the name of the file in the switch s file system to be uploaded to the TFTP server 7 In TFTP File Type select File Note If you select Image as the TFTP File Type the switch uploads its active AT S63 image file to the FTP server and stores it under the name specified in step 5 Allied Telesyn does not recommend uploading a switch s image file If you need an AT S63 image file to download onto another switch go to the Allied Telesyn web site for the latest version 8 Click Apply The management software notifies you when the upload is complete 135 Chapter 10 File Downloads and Uploads 136 Section Il Advanced Operations Chapter 11 Event Logs and Syslog Servers Section Il Advanced Operations This chapter describes how to view switch activity by displaying and saving the contents of the event logs It also explains how to send events to syslog servers on your network by creating syslog output definitions Sections in the chapte
341. tput Status option for the definition is enabled and the log feature on the switch is also enabled 149 Chapter 11 Event Logs and Syslog Servers 7 To permanently save your changes select the Save Config option in the Configuration menu Viewing a Syslog To view an existing syslog output definition perform the following Output Definition Procedure 1 From the home page select either Monitoring or Configuration 2 From the Configuration menu select the System option 3 Select the Event Log tab The Event Log tab is shown in Figure 37 on page 139 4 In the Configured Log Outputs section select a syslog output from the list and click View The View Log Output page is shown in Figure 42 Output ID Type 3 Syslog Output Status Syslog Server IP Address Enabled 149 35 8 45 Message Format Facility Level Extended LOCAL1 Severity Selections Module Selections D Debug SYSTEM E Error CLI wW Warning EVTLOG Hnformation ze MAC m Figure 42 View Event Log Output Page For definitions of the parameters refer to Configuring a Syslog Output Definition on page 147 5 When you are done click Close Modifying a To modify a syslog output definition perform the following procedure Syslog Output ee 1 From the home page select Configuration Definition 2 From the Configuration menu select the System option 3 Select the Event Log tab The Event log tab is shown in Figure 37 o
342. ts If the VLAN is unique in your network then the name should be unique as well If the VLAN is part of a larger VLAN that spans multiple switches then the name for the VLAN should be the same on each switch where nodes of the VLAN are connected Note A VLAN must be assigned a name Type Select Port Based as the Type to create a port based or tagged VLAN This is the only option Note You must use the menus or command line interface to create a MAC address based VLAN or protected ports VLAN To select the VLAN ports click on the ports in the switch image Clicking repeatedly on a port toggles it through the following settings Untagged port x Tagged port q ggea p e Not a member of the VLAN Click Apply The new user configured VLAN is now ready for network operations Note Untagged ports assigned to the new VLAN are automatically removed from their current untagged VLAN assignment 339 Chapter 21 Port based and Tagged VLANs 8 To permanently save your changes select the Save Config option in the Configuration menu 340 Secton V Virtual LANs AT S63 Management Software Web Browser Interface User s Guide Modifying a VLAN Secton V Virtual LANs This procedure explains how to add or remove ports from a tagged or untagged VLAN When modifying a VLAN note the following o You cannot change the VID of a VLAN 0 You cannot change the name of a VLAN using the web browser interf
343. u select the Save Config option to permanently save your changes This option is not displayed if there are no changes to save To modify an entry SNMPv3 User Table perform the following procedure 1 From the home page select Configuration The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 In the SNMPv3 section click the button next to Configure User Table and then click Configure The SNMPv3 User Table tab is shown in Figure 80 on page 227 Click the button next to the SNMPv3 user to be changed and then click Modify Section Ill SNMPv3 AT S63 Management Software Web Browser Interface User s Guide The Modify SNMPv3 User page is shown in Figure 82 m tteg OOOO Engine ID 80 00 00 cf03 00 30 84 fd 57 da User Name debashis Authentication Protocol MD5 E Authentication Password Confirm Authentication Password Privacy Protocol DES mi Privacy Password Confirm Privacy Password Storage Type NonYolatile v Row Status Active Figure 82 Modify SNMPv3 User Page 5 In the Authentication Protocol field enter an authentication protocol This is an optional parameter Select one of the following MD5 This value represents the MD5 authentication protocol With this selection users SNMP entities are authenticated with t
344. uide Displaying a List of Multicast Routers To view multicast routers perform the following procedure 1 From the Home page select Monitoring 2 From the Monitoring menu select the Multicast option Section Il Advanced Operations The Multicast page is displayed with the IGMP tab as shown in Figure 77 on page 215 To view the multicast routers click View Multicast Router List and then click View The View Multicast Routers List is shown in Figure 78 T View muticast Routers tst Total Multicast Routers 1 Page 1of1 Port VLAN ID Router IP 1 1 172 16 10 1 Figure 78 View Multicast Routers List Page The View Multicast Routers List page displays a table that contains the following columns of information Port The port on the switch where the multicast router is connected VLAN ID The VID of the VLAN in which the port is an untagged member Router IP The IP address of the port on the router 217 Chapter 17 IGMP Snooping 218 Section Il Advanced Operations Section II SNMPv3 Section Ill SNMPv3 The chapter in this section contains the procedures for configuring SNMPv3 The chapter is O Chapter 18 SNMPv3 on page 221 219 220 Section Ill SNMPv3 Chapter 18 SNMPv3 This chapter provides the following procedures for configuring SNMPv3 parameters using a web browser management session Configuring the SNMPv3 Protocol on page 222 Enabling or
345. uling is set at the switch level You can not set this at the port level To change scheduling perform the following procedure 1 2 From the home page select Configuration From the Configuration menu select the Services option Select the Queuing amp Scheduling tab The Queuing amp Scheduling tab is shown in Figure 56 on page 176 Note The Configure CoS Queues to Egress Queues section in the tab is explained in the previous procedure Mapping CoS Priorities to Egress Queues on page 176 To select a scheduling method click either Strict Priority or Weighted Priority in the Configure Egress Weights section of the tab The default is Strict Priority Skip the next step if you select Strict Priority Queue weights do not apply to Strict Priority scheduling If you selected Weighted Priority use the Queue Weight fields to specify the maximum number of packets a port can transmit from an egress queue before going to the next queue The range for QO to Q6 is 1 to 15 packets The range for Q7 is 0 to 15 packets A setting of 0 of Q7 means that its packets always take priority over the packets in the other queues and that packets are transmitted from the other queues only when Q7 is empty The default setting for all queues is 1 At the default setting all queues have the same weight Click Apply To permanently save your changes select the Save Config option in the Configuration menu Section II Adv
346. ult as shown in Figure 9 on page 57 2 Select the SNMP tab The SNMP tab is shown in Figure 104 on page 279 3 In the SNMPv3 section click the button next to View Access Table and then click View at the bottom of the tab Section Ill SNMPv3 281 Chapter 18 SNMPv3 The SNMPv3 Access Table tab is shown in Figure 107 System Name Marketing MAC Addr 00 30 84 4B EF CD SNMPv3 Access Table Group Name Security Model techpubs v3 Security Level Context Prefix AuthPriv Mgmt Protocols Read View Context Match internett Exact Write View Storage Type internett NonvVolatile Notify View Row Status internett Active Figure 107 SNMPv3 Access Table Tab Monitoring Displaying To display entries in the SNMPv3 SecurityToGroup Table perform the SecurityToGroup following procedure Table Entries 4 From the Home page select Monitoring The Monitoring System page is displayed with the General tab selected by default as shown in Figure 9 on page 57 2 Select the SNMP tab The SNMP tab is shown in Figure 104 on page 279 3 In the SNMPv38 section click the button next to the View SecurityToGroup Table and then click View at the bottom of the tab 282 Section Ill SNMPv3 AT S63 Management Software Web Browser Interface User s Guide The SNMPv3 SecurityToGroup Table tab is shown in Figure 108 System Name Marketing MAC Addr 00 30 84 4B EF CD SNMPv3 SecurityToGroup Ta
347. unit BPDU 304 browser tools 36 Cc ciphers available parameter 403 CIST priority parameter 317 Class of Service CoS configuring 174 mapping to egress queues 176 schedule displaying 181 scheduling configuring 178 settings displaying 179 Common and Internal Spanning Tree CIST configuring 317 community name SNMPv3 protocol 273 276 CoS See Class of Service CoS D data compression parameter 403 daylight savings time DST 50 Denial of Service DoS defense configuring 206 enabling or disabling 208 mirror port 208 settings displaying 209 document conventions 19 DoS See Denial of Service DoS Defense duplex mode configuring 83 E edge port Multiple Spanning Tree Protocol MSTP 325 encryption keys displaying 392 enhanced stacking changing switches 64 configuring 62 setting switch status 62 event log clearing 144 disabling 138 displaying 140 enabling 138 modifying full action 145 saving to a file 146 severity codes 143 software module list 141 425 Index F factory defaults resetting switch 53 flash memory displaying files in 124 flow control configuring 84 flow group configuring 184 deleting 188 displaying 188 modifying 187 force version Multiple Spanning Tree Protocol MSTP 316 Rapid Spanning Tree Protocol RSTP 303 G GARP VLAN Registration Protocol GVRP configuration displaying 353 configuring 350 counters displaying 359 database displaying 355 disabling 352 enabling 352 GIP c
348. uration The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 In the SNMPv3 section click the button next to Configure Target Parameters Table and then click Configure at the bottom of the tab The SNMPv3 Target Parameters Table tab is shown in Figure 98 on page 265 Click the button next to the Target Parameters Table entry to be deleted and then click Remove A warning message is displayed Click OK Section Ill SNMPv3 AT S63 Management Software Web Browser Interface User s Guide 6 To permanently save your changes select the Save Config option in the Configuration menu Modifying a To modify an entry in the SNMPv3 Target Parameters Table perform the Target following procedure Parameters Table 4 From the home page select Configuration Entry l The Configuration System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 2 Select the SNMP tab The SNMP tab is shown in Figure 79 on page 224 3 In the SNMPv3 section click the button next to Configure Target Parameters Table and then click Configure at the bottom of the tab The SNMPv3 Target Parameters Table tab is shown in Figure 98 on page 265 4 Click the button next to the Target Parameters Table entry to be changed and then click Modify The Modify SNMPv3 Target Parameter pag
349. vent log perform the following procedure 1 From the home page select either Monitoring or Configuration 2 From the Configuration menu select the System option 3 Select the Event Log tab The Event log tab is shown in Figure 37 on page 139 4 Configure the parameters in the Display Filter Settings of the tab according to the types of events to be displayed 5 After configuring the parameters click View The parameters in the Display Filter Settings section are defined here Log Location Defines the event log to be viewed Options are Oo Temporary Memory Displays the events from the log stored in temporary memory This log stores approximately 4 000 events Select this option if the switch has been running for some time without a reset or power cycle This is the default O Permanent NVS Displays the events from the log stored in nonvolatile memory which stores up to 2 000 events Select this option to view the events that occurred prior to a recent reset or power cycle Severity Selections Defines the severity of the events to be displayed You can select more than one severity by using the Ctrl key when making your selections The default is error warning and information events Options are o D Debug Debug messages provide detailed high volume information only intended for technical support personnel O E Error Only error messages are displayed Error messages indicate that the switch operation is se
350. verely impaired a W Warning Only warning messages are displayed These messages indicate that an issue may require manager attention o l Information Only informational messages are displayed Informational messages display useful information that you can ignore during normal operation O ALL Messages of all severity levels are displayed Section Il Advanced Operations Section Il Advanced Operations AT S63 Management Software Web Browser Interface User s Guide Display Order Controls the chronological order of the events in the display Options are o Chronological Lists the events starting with the oldest events This is the default o Reverse Chronological Lists the events starting with the most recent events Mode Controls the format of the events in the display Options are O Normal Displays an event s time of occurrence module originator severity and description for each event This is the default An example of Normal mode is shown in Figure 38 on page 143 O Full Displays the same information as Normal plus the file name line number and event ID An example of Full mode is shown in Figure 39 on page 144 Module Selections Specifies the AT S63 software modules whose events will be displayed The modules are listed in Table 2 You can select more than one module by using the Ctrl key as you make your selections The default is All Table 2 AT S63 Software Modules
351. w configuration file from a web browser management session That task must be performed from the menus or command line interface The configuration file must already exist in the switch s file system or on a flash memory card To view the switch s configuration files see Listing the Files in Flash Memory or on a Compact Flash Card on page 124 Configuration files have a cfg extension Specifying a new active boot configuration file does not change the current operating configuration of the switch To reconfigure the switch using the configuration of a different active boot configuration file reset or power cycle the switch at the end of the procedure Selecting Save Config after changing the active configuration file overwrites the settings in the file with the current operating settings of the switch You can specify a configuration file on a flash memory card for those systems that support a flash card However the switch does not copy the configuration file to its file system Instead it uses and updates the file directly on the card If you remove the card the switch will not allow you to save any further configuration changes until you reinsert the flash card or specify another active boot configuration file Furthermore removing a flash card and resetting the switch causes the switch to return to its default settings To change the switch s active configuration file perform the following procedure 1 2
352. when the port logs on to the network The username can be from be from 1 to 16 alphanumeric characters A to Z a to z 1 to 9 Do not use spaces or special characters such as asterisks or exclamation points The username is case sensitive User Password Specifies the password for the switch port The port sends the password to the authentication server for verification when the port logs on to the network The password can be from 1 to 16 alphanumeric characters A to Z a to z 1 to 9 Do not use spaces or special characters such as asterisks or exclamation points The password is case sensitive 7 Click Apply Changes to the supplicant settings are immediately implemented on a port 8 To permanently save your changes select the Save Config option in the Configuration menu 382 Section VI Port Security AT S63 Management Software Web Browser Interface User s Guide Displaying the Port based Network Access Control Parameters You can display information about the port based network access control status and settings of the ports on the switch This section contains the following procedures o Displaying the Port Status next O Displaying the Port Settings on page 385 Displaying the To display the port based network access control port status perform the Port Status following procedure 1 2 From the Home page select Monitoring From the Monitoring menu select Network Security Select
353. witch 4 To permanently save your changes select the Save Config option in the Configuration menu Section Basic Operations 45 Chapter 2 Basic Switch Parameters Changing the Manager and Operator Passwords 46 There are two levels of management access on an AT 9400 Series switch manager and operator When you log in as a manager you can view and configure all of a switch s operating parameters When you log in as an operator you can only view the operating parameters you cannot change any values You log in as a manager or an operator by entering the appropriate username and password when you start an AT S63 management session The default password for manager access is friend The default password for operator access is operator Passwords are case sensitive To change the manager or operator password perform the following procedure 1 From the home page select Configuration The System page is displayed with the General tab selected by default as shown in Figure 5 on page 44 In the Passwords section enter the new values The parameters are described below Manager Password Confirm Manager Password You use these parameters to change the manager s login password for the switch The password can be from 0 to 16 characters in length The same password is used for both local and remote management sessions To create a new password enter the new password into both fields The default passw
354. y Table Entry on page 253 Enter a Tag List of up to 256 alphanumeric characters Use a space to separate entries for example hwengtag swengtag testengtag In the Target Parameters field enter a Target Parameters name This name can consist of up to 32 alphanumeric characters The value configured here must match the value configured with the Target Parameters Name parameter in the Target Parameters Table In the Storage Type field enter one of the following storage types for this table entry Volatile Select this storage type if you do not want the ability to save an entry in the Target Address Table After making changes to a Target Address Table entry with a Volatile storage type the Save Config option is not displayed on the Configuration menu NonVolatile Select this storage type if you want the ability to save an entry in the Target Address Table After making changes to an Target Address Table entry with a NonVolatile storage type the Save Config option is displayed on the Configuration menu Allied Telesyn recommends this storage type 263 Chapter 18 SNMPv3 264 13 Click Apply to update the SNMPv3 Target Address Table 14 To permanently save your changes select the Save Config option in the Configuration menu Section Ill SNMPv3 AT S63 Management Software Web Browser Interface User s Guide Configuring the SNMPv3 Target Parameters Table Creating a Target Parameters Table Section Ill SNMPv3
355. y manage a slave switch start the session on the master switch by specifying the IP address of the local interface on the master switch and then transition to the slave switch using the enhanced stacking feature in the AT S63 management software Although the AT 9408LC SP AT 9424T GB and AT 9424T SP switches do not support Layer 3 routing they do allow you to create one interface and designate it as the local interface to support those management functions that require an IP address such as remote management The web browser interface of the AT S63 management software does not support routing interfaces To configure routing interfaces you must use the menus interface or the command line interface For instructions refer to the AT S63 Management Software Menus Interface User s Guide and the AT S63 Management Software Command Line Interface User s Guide For background information on routing interfaces static routes and RIP refer to the AT S63 Management Software Command Line Interface User s Guide For background information on enhanced stacking and virtual LANs refer to the AT S63 Management Software Menus Interface User s Guide Section Basic Operations AT S63 Management Software Web Browser Interface User s Guide Starting a Web Browser Management Session To start a web browser management session on an isolated switch i e not part of an enhanced stack or on a master switch of an enhanced stack perform the fo
356. y remote management workstation can access the switch Note Do not activate the management ACL until after you have specified the access control entries ACEs Otherwise the switch will discard all remote management packets making it impossible for you to remotely manage the unit from a Telnet or web browser management session For instructions on how to add ACEs refer to Creating an ACE on page 420 To enable or disable the management ACL perform the following procedure 1 From the home page select Configuration 2 From the Configuration menu select the Mgmt Security option 3 Select the Mgmt ACL tab Section VII Management Security AT S63 Management Software Web Browser Interface User s Guide The tab is shown in Figure 168 System Name Marketing dr 00 30 84 AB EF CD Mgmt ACL Configure Mgmt ACL Disable Mgmt ACL Enable Mgmt ACL Mgmt Security Total Mgmt ACLS 2 Page 1of1 Management ACL List i D IP address IP Mask Application Type Gi 144 144 144 111 255 255 255 255 ALL 0 2 144 144 142 0 255 255 255 0 WEB MACL ID Mgmt ACL Entry IP Address L 0 256 Ju Jlo fo Application Type Mgmt ACL Entry IP Mask nn fir Figure 168 Mgmt ACL Tab Configuration The table in Management ACL List lists the existing ACEs on the switch The bottom portion is used to add entries as explained in Creating an ACE on p

Web Browser Interface User's Guide

Contents

Download Pdf Manuals

Related Search

Related Contents