Home

Netgear GS724TS-100NAS User's Manual

1. NETGEAR oteect with lanovotion System Switching Security Monitoring Maintenance Help Ports LAG VLAN Voice VIAN Auto Melncost Address Table gt Basic MST Port Configuration v Advanced STP Stotus Configuration Select MST 1 CST Configuration CST Port MST Port Configuration Configuration PORTS LAGS as CST Port Status RSTP Auto Port Up Time Since MST Port Port Path Calculated Port A Port Interface Counters Last onfiguration Priority Cost Port Path ID Pi Mode MST Port EA KL M Configuration a STP Statist sees Oo lo 128 o Enable 32769 Oday OhrO min 9 sec Disabled g g2 128 o Enable 32770 0 day 0 r 0 min 59sec Disabled Ds 128 o Enable 32771 Oday 0 hr O0 min 39 sec Disabled p oO 921 128 o Enable 2789 Oday O0 1 min 1 sec Disabled C 922 128 o Enable 32790 OdeyOhrimini sec Disabled C 923 128 Enable 32791 Oday 0 hr 1 min 1 sec Disabled g 128 o Enable 32792 OdeyOhriminisec Disabled Po GS724T 24 Port Gigabit Smart Switch Port Forwarding State Port De ted D ted Designated Root signatec Designated Bridge Role Cost Port Disabled Disabled 580 01 00 00 00 01 1 8 0 80 01 00 00 00 01 19 0 Oisabled Disabled 80 01 00 00 00 01 15 O 80 01 00 00 00 01 15 4 0 c 1009 00 01 80 01 00 00 00 01 1 3 ff Orsa died 80101100 00 00101 15 Owabled Disabled 00 01 00 00 00 01 13 ff Orsabled Disabled 80 01 00 00 00 01 12S f Ovsabled Disabl
2. llle 124 Static MAC Addiess ere iii eiwede bev d ero E E deer 125 Chapter 4 Configuring Quality of Service Class of Service uuo o dorso ee oko dpe see weed e d 128 Basic CoS ConfIguratloni zx d peptide eer coh RO dont denis 128 CoS Interface Configuration os cet mmm me 129 Interface Queue Configuration 22 0c ee ee 131 802 1p to Queue Mapping 202 eee eee 132 4 Table of Contents GS716Tv2 and GS724Tv3 Software Administration Manual DSCP to Queue Mapping 002 0c eee eee eee 133 Differentiated Services 2 cos baee Sane E Roe dosi uei eo 135 Defining DiSSIVisi 410038684 pe She dabei elimi beaded 135 Diffserv Configuration 3 2 2 ss0 0444244 40g hee dtre tdtas 136 Class COMNQUIALION 9 532 59 4 inir Dex Urt dra aera lo e RU TR Staa as 137 Policy Configuration 240 2410 8854 8 riatta se ESEC TREE 140 Service Configuration s cu dc cain dar Sido AER aed RORCROR todo ol 145 Service Statisties scenic canes reas RE ES REA RE ry pas 146 Chapter 5 Managing Device Security Management Security Settings 0 22 4 5685 ee ene e s 150 Change PassWOG yanari raritne anA ax s nata d aes anc 150 RADIUS Configuration 24 02 2004 0 0580 00 eR Rey Rye emere 151 Contiguring DAGOAGST u s saei d dE dere eee acest du 156 Authentication List Configuration llis eese 159 Configuring Management Access illii lessen 161 HTTP Cornflgitator 2 nac e p Y aper EHE ER E
3. Admin Mode Select the interface mode for the selected interface for IGMP Snooping for the switch from the menu The default is Disable Host Timeout Specify the amount of time you want the switch to wait for a report for a particular group on a particular interface before it deletes that interface from the group Enter a value between 2 and 3600 seconds The default is 260 seconds e Max Response Time Specify the amount of time you want the switch to wait after sending a query on an interface because it did not receive a report for a particular group on that interface Enter a value greater or equal to 1 and less than the Host Timeout in seconds The default is 10 seconds e MRouter Timeout Specify the amount of time you want the switch to wait to receive a query on an interface before removing it from the list of interfaces with multicast routers attached Enter a value between 0 and 3600 seconds The default is 0 seconds A value of zero indicates an infinite timeout no expiration Chapter 3 Configuring Switching Information 113 GS716Tv2 and GS724Tv3 Software Administration Manual Fast Leave Admin Mode Select the Fast Leave mode for a particular interface from the menu The default is Disable 6 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 7 If you make any configuration changes click Apply to apply the new settings to the switch Con
4. 198 Chapter 5 Managing Device Security Monitoring the System Use the features available from the Monitoring tab to view a variety of information about the switch and its ports and to configure how the switch monitors events The Monitoring tab contains links to the following features e Ports on page 200 e System Logs on page 213 e Port Mirroring on page 222 Chapter 6 Monitoringthe System 199 GS716Tv2 and GS724Tv3 Software Administration Manual Ports The pages available from the Ports link contain a variety of information about the number and type of traffic transmitted from and received on the switch From the Ports link you can access the following pages e Switch Statistics on page 201 e Port Statistics on page 203 e Port Detailed Statistics on page 205 e EAP Statistics on page 211 200 Chapter6 Monitoring the System GS716Tv2 and GS724Tv3 Software Administration Manual Switch Statistics The Switch Statistics page displays detailed statistical information about the traffic the switch handles To access the Switch Statistics page click Monitoring Ports Switch Statistics NETGEAR System Switchir v Switch Statistics gt Port Statistics gt Port Detailed Statistics gt EAP Statistics Switch Statistics Statistics index Octets Received Packets Received Without Error Unicast Packets Received Multicast Packets Received Broadcast Packets Received Receive Packets D
5. GS724T 24 Port Gigabit Smart Switch Help tocour MFDB Table MFDB Table Search by MAC Address Forwarding Type Description Interface Interfaces The following table describes the fields in the MFDB Table Chapter 3 Configuring Switching Information 115 GS716Tv2 and GS724Tv3 Software Administration Manual Field Description MAC Address The MAC Address to which the multicast MAC address is related To search by MAC address enter the address with the MFDB table entry you want displayed Enter six two digit hexadecimal numbers separated by colons for example 00 0f 43 67 89 AB and then click Go If the address exists that entry will be displayed An exact match is required VLAN ID The VLAN ID to which the multicast MAC address is related Component This is the component that is responsible for this entry in the Multicast Forwarding Database Possible values are IGMP Snooping or Static Filtering Type This displays the type of the entry Static entries are those that are configured by the end user Dynamic entries are added to the table as a result of a learning process or protocol Description The text description of this multicast table entry Possible values are Management Configured Network Configured and Network Assisted Interface The list of interfaces that are designated for forwarding Fwd and filtering Fit for the selected address Forwarding Interfaces The resu
6. NETGEAR GS716T and GS724T Smart Switches Software Administration Manual GS716Tv2 and GS724Tv3 Software Administration Manual 2012 NETGEAR Inc All rights reserved No part of this publication may be reproduced transmitted transcribed stored in a retrieval system or translated into any language in any form or by any means without the written permission of NETGEAR Inc Technical Support Thank you for choosing NETGEAR To register your product get the latest product updates or get support online visit us at http support netgear com Phone US amp Canada only 1 888 NETGEAR Phone Other Countries See Support information card Trademarks NETGEAR the NETGEAR logo ReadyNAS ProSafe Smart Control Center Auto Uplink X RAID2 and NeoTV are trademarks or registered trademarks of NETGEAR Inc Microsoft Windows Windows NT and Vista are registered trademarks of Microsoft Corporation Other brand and product names are registered trademarks or trademarks of their respective holders Statement of Conditions To improve internal design operational function and or reliability NETGEAR reserves the right to make changes to the products described in this document without notice NETGEAR does not assume any liability that may occur due to the use or application of the product s or circuit layout s described herein Revision History Publication Part Number Version Publish Date Comments 202 10484 04 v1 0
7. 001110 o v Om DSCP AF 21 010010 AF 22 010100 AF 23 010110 Expedited Forwarding EF PHB DScCP EF 101110 Other DSCP Values Local Experimental Use DSCP Queue 1 000001 iv s 00101 v 11 001011 19 010011 27 011011 35 100011 42 101010 o lt 47 101111 2 110100 57 111001 1 111101 w w w N N N o amma DSCP 2 000010 6 000110 13 001101 21 010101 29 011101 37 100101 43 101011 49 110001 3 110101 8 111010 62 111110 To map DSCP values to queues 1 3 Queue DSO Queue DSCP 011100 AF 33 011110 3 009011 7 000111 15 001111 23 010111 31 011111 39 100111 44 101100 0 110010 4 110110 9 111011 63 111111 Queue Queue cs3 011000 cs7 111000 AF 41 100010 AF 42 100100 AF 43 100110 4 000100 9 001001 17 010001 25 011001 33 100001 41 101001 45 101101 1 110011 3 110111 60 111100 Queue For each DSCP value select a hardware queue to associate with the value The traffic class is the hardware queue for a port Higher traffic class values indicate a higher queue position Before traffic in a lower queue is sent it must wait for traffic in higher queues to be sent Valid range is 0 3 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of t
8. 2 2 60s005 e0 en eee nn 46 Eicernse KG Y Ls sons dixe xS Sale kee eke E deg Was means weer dea di 0s 47 SNMP 042244 ek eroded nab oe Rem hx e RE Reed eee e 47 SNMPV TIN 4i sancti m bg hulp nO o dan Aceto dod RS Pd dod s 47 Trap Plage de desee ache eere qe P ES dp ER PEE eA qug 50 SNMP v3 User Configuration s s nr bp ERE VP pm 51 LLDP I m 52 LLDP Gonflgurallgh crean ccnnpRe EROR ARR Enr ER ETORRERA 52 LEDF Forn SCuUNOS 4 dotati od boi ne HO P ps Ran NES 53 LLDP MED Network Policy s e seris iisrri kesekian t RR 55 LLDP MED Port Settings xor RR rrF ERET ARRERA ELERA 56 l ocalInfOrmallOD aude emo ROPPR SUPR PERO POP URS POOR 57 Neighbors Information sasasi asiani adr rian RR RR Rx RO 60 Table of Contents 3 GS716Tv2 and GS724Tv3 Software Administration Manual services DACP Filtering 22mm o RIED peer es 65 DHCP Filtering Configuration ete ee cheb REY RE 65 Interface Configuration s s occse trueia Rari ert cio deese tea debs 66 Chapter 3 Configuring Switching Information POMS PDC nad ces sence wee reed E eee RR 70 Port Configuration x22 uoc RPBRCCLbRT 49 ariens ea ir EDERE p E ep 70 Flow COnWGl 5 db ox Ea a o i roh xa d RO RD Ri Rd Gana yias T3 Link Aggregation Groups siue hk d n e pn 74 LAG Configurator us xinsac5 bg qx OR teet RU Ede ak ANKERRENA 75 LAG Membership sardo rrr SOS PE ober PebPESZ CO E OP ET 76 LAGP COBIGUESDOD carena ridn xai UR C Sateen UR Cad 77
9. Current active Image Description Activate Image Delete Image To configure Dual Image settings 1 Select the image to configure The Current active field displays the name of the active image 2 To configure a descriptive name for the selected software image type the name in the Image Description field 3 To set the selected image as the active image select the Active Image check box 234 Chapter7 Maintenance GS716Tv2 and GS724Tv3 Software Administration Manual Note After activating an image you must perform a system reset of the switch in order to run the new code 4 To remove the selected image from permanent storage on the switch select the Delete Image check box You cannot delete the active image 5 Click Cancel to cancel the operation on the screen and reset the data on the screen to the latest value of the switch 6 Click Apply to apply the settings to the switch Dual Image Status You can use the Dual Image Status page to view information about the system images on the device To display the Dual Image Status page click Maintenance gt File Management gt Dual Image Dual Image Status 24 Port Gigabit Smart Switch NETGEAR GS724T System Switching QoS Security Monitoring Maintenance Help 1660v1 J T Uplood Downlood Trovbleshooting v Dual Image Dual Image Status Dual Image Configuration Dual Image Status Dus Image Unit Imagei Ver Image Ver Current active Next ac
10. Enable DoS Configuration Denial of Service First Fragment Disable Enable gt DNS Denial of Service Min TCP Hdr Siz 20 0 to 255 Green Ethernet Configuration px ui ates Denial of Service TCP Fragment Disable Enable Denial of Service TCP Flag Disable Enable Disable Enable Denial of Service L4 Port D D Denial of Service ICMP Disable Enable Denial of Service Max ICMP Size 512 0 to 1023 To configure individual DoS settings 1 Select the types of DoS attacks for the switch to monitor and block and configure any associated values as the following list describes Denial of Service SIP DIP Enable or disable this option by selecting the appropriate radio button Enabling SIPZDIP DoS prevention causes the switch to drop packets that have a source IP address equal to the destination IP address The factory default is Disable Denial of Service First Fragment Enable or disable this option by selecting the appropriate radio button Enabling First Fragment DoS prevention causes the switch 42 Chapter2 Configuring System Information GS716Tv2 and GS724Tv3 Software Administration Manual to drop packets that have a TCP header smaller than the configured Min TCP Hdr Size The factory default is Disable Denial of Service Min TCP Hdr Size Specify the Min TCP Har Size allowed If First Fragment DoS prevention is enabled the switch will drop packets that have a TCP header smaller t
11. In the Secret field type the shared secret text string used for authenticating and encrypting all RADIUS communications between the switch and the RADIUS server This secret must match the RADIUS encryption From the Active menu specify whether the server is a Primary or Secondary server From the Message Authenticator menu enable or disable the message authenticator attribute for the selected server 2 To modify settings for a RADIUS server that is already configured on the switch select the check box next to the server address update the desired fields and click Apply 3 Click Refresh to update the page with the most current information 4 To delete a configured RADIUS server select the check box next to the server address and then click Delete 5 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch The following table describes the RADIUS server statistics available on the page Field Description Server Address This displays all configured RADIUS servers Round Trip Time The time interval in hundredths of a second between the most recent Access Reply Access Challenge and the Access Request that matched it from this RADIUS authentication server Chapter 5 Managing Device Security 153 GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Access Requests The number of RADIUS Access Request
12. Ports tab and then click Port Detailed Statistics The Port Detailed Statistics figure shows some but not all of the fields on the page NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help tooovT gt Switch Statistics Port Detailed Statistics gt Port Statistics Port Detailed Statistics Detailed Statistics gt EAP Statistics Interface MST ID ifindex Port Type Port Channel 10 Disable Port Role Disabled STP Mode STP State Disabled Adnwn Mode Enable LACP Mode Enable Physical Mode Auto Physical Status v gt CLEAR RURLSH The following table describes the detailed port information displayed on the screen To view information about a different port select the port number from the Interface menu Field Description Interface Use the drop down menu to select the interface for which data is to be displayed or configured MST ID Displays the created or existing MSTs ifIndex This field indicates the iflndex of the interface table entry associated with this port on an adapter Port Type For most ports this field is blank Otherwise the possible values are Mirrored Indicates that the port has been configured as a monitoring port and is the source port in a port mirroring session For additional information about port monitoring and probe ports see Multiple Port Mirroring on page 222 e Probe Indicates that the port has been
13. RSTP BPDUs Received Number of RSTP BPDUs received at the selected port RSTP BPDUs Transmitted Number of RSTP BPDUs transmitted from the selected port MSTP BPDUs Received Number of MSTP BPDUs received at the selected port MSTP BPDUs Transmitted Number of MSTP BPDUs transmitted from the selected port Click Refresh to update the screen with the latest STP statistics information 108 Chapter3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual Multicast Multicast IP traffic is traffic that is destined to a host group Host groups are identified by class D IP addresses which range from 224 0 0 0 to 239 255 255 255 From the Multicast link you can access the following pages e Auto Video Configuration on page 109 e IGMP Snooping on page 110 e IGMP Snooping on page 110 e IGMP Snooping Querier on page 119 Auto Video Configuration The Auto Video feature simplifies IGMP Snooping Querier configuration if the switch supports devices or applications running multicast traffic such as video surveillance cameras To access the Auto Video Configuration page click Switching gt Multicast gt Auto Video NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS ecurity Monitoring Maintenonce Help tocou Auto Video Auto Video Configuration gt IGMP Snooping IGMP Snooping Auto Video Configuration Querier Auto Video Status Auto Vedeo VLAN
14. The Monitoring Logs tab contains links to the following folders e Memory Logs on page 214 e FLASH Log Configuration on page 215 e Server Log Configuration on page 217 e Trap Logs on page 219 e Event Logs on page 220 Chapter 6 Monitoring the System 213 GS716Tv2 and GS724Tv3 Software Administration Manual Memory Logs The in memory log stores messages in memory based upon the settings for message component and severity Use the Memory Logs page to set the administrative status and behavior of logs in the system buffer These log messages are cleared when the switch reboots To access the Memory Log page click the Monitoring Logs tab and then click the Memory Log link NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching gt Security Monitoring Maintenance Help to00vr J Memory Log Memory Log gt FLASH Log gt Server Log Memory Log Configuration gt Trap Logs Admin Status Dissble tna Event Logs Beh Wrap Memory Log Total eumber of Messages 133 displaying only the last 64 messages 57 10 131 12 162 1 UNQI 2183274908 72 HTTP Session 19 ended for user admin connected 14 Jan 14 07 28 04 10 131 12 162 1 UNKN 2183274908 main login c 179 73 HTTP Session 19 initiated for user admin connected from 10 14 16 241 CLEAR REFRESH T o configure the Memory Log settings 1 Use the radio buttons in the Admin Status field to determine whether to log messages e En
15. To display the Rapid STP page click Switching gt STP gt Advanced gt RSTP NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help LOGOUT J VIAN Voice VIAN Avto VolP Multicost Address Toble gt Basic Rapid STP v Advanced STP Rapid STP Configuration PORTS LAGS AB CST Configuration CST Port gi Disabled False Disabled Interface Fast Link Status Configuration 92 Disabled False Disabled CST Port Status 93 Disabled False Disabled RSTP MST Configuration 93 Disabled False Disabled MST Port 6 Disabled False Oisadled Configuration E Disabled False Disabled STP Statistics 94 Disabled False Disabled gt Disabled 3 false Cisabled 9 Disabled False Manual forwarding False Disabled gi Disabled False Disabled 12 Disabled False Disabled 13 Disabled False Disabled 14 Disabled Disabled eis Disabled Disabled 16 Disabled Disabled 917 Disabled Disabled 18 Disabled Disabled 919 Disabled Disabled 920 Disabled Disabled 921 Disabled Disabled 922 Disabled Disabled 923 Disabled Disabled 924 Disabled Disabled PORTS LAGS al v gt REFRESH The following table describes the Rapid STP Status information displayed on the screen Field Description Interface The physical or port channel interfaces associated with VLANs associated with the CST Role Each MST Bridge Port that is enabled is assigned a Port Role for each spann
16. 24 Port Gigabit Smart Switch Security Monitoring Maintenance Hel LOGOuT Access Port Authentication Troff amp Control User Configuration TACACS Configuration RADIUS Y TACACS TACACS Configuration TACACS Key String DIDI Connguraton Connection Timeout Server Corfiguration gt Authentication List lt To configure global TACACS settings 1 In the Key String field specify the authentication and encryption key for TACACS communications between the GS716T or GS724T and the TACACS server The valid range is 0 128 characters The key must match the key configured on the TACACS server 2 In the Connection Timeout field specify the maximum number of seconds allowed to establish a TCP connection between the GS716T or GS724T and the TACACS server The valid range is 1 30 seconds 3 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 4 f you make any changes to the page click Apply to apply the new settings to the system TACACS Server Configuration Use the TACACS Server Configuration page to configure up to five TACACS servers with which the switch can communicate To display the TACACS Server Configuration page click Security gt Management Security and then click the TACACS gt Server Configuration link Chapter 5 Managing Device Security 157 GS716Tv2 and GS724Tv3 Software Administration Manual
17. Capabilities Supported Capabilities Network Policy Inventory Current Capabilities Capabilities Network Policy Inventory Device Class Network Connectivity PoE Device Type N A PoE Power Source PoE Power Priority PoE Power Value Hardware Revision Firmware Revision Software Revision Serial Number 15D35B4U00224 Model Name FSM7352S Port ID 00 14 6C 34 5F 51 Port Description System Name System Description FSM7352S 48 4 L3 Stackable Switch System Capabilities bridge router Managed Address Unknown Address Aia Interface Interface SubType SubType Number MAC PHY Details Auto Negotiation Supported True Auto Negotiation Enabled True Auto Negotiation Advertised Capabilities Operational MAU Type Unknown Asset ID Location Information Civic Coordinates 0 ECS ELIN Network Policies 9 Application User VLAN ID VLAN T DSCP Type ves Priority LLDP Unknown TLVs Field Description Port Details Local Port Displays the interface on the local system that received LLDP information from a remote system MSAP Entry Displays the Media Service Access Point MSAP entry number for the remote device Basic Details Chassis ID Subtype Identifies the type of data displayed in the Chassis ID field on the remote system Chassis ID Identifies the remote 802 LAN device s chassis Port ID Subtype Identifies the type of data displayed in the remote system s Port ID
18. GS716Tv2 and GS724Tv3 Software Administration Manual Ports e1 e5 Ports e1 e5 Connected to Hosts Connected to Hosts T Ports e6 e8 S Connected to Switch 2 and 3 Switch 1 Root Bridge Switch 2 Ports e6 e8 Connected to Switch 1 and 2 Switch 3 Ports e1 e5 Connected to Hosts Perform the following procedures on each switch to configure MSTP 1 2 Use the VLAN Configuration screen to create VLANs 300 and 500 see VLAN Configuration on page 80 Use the VLAN Membership screen to include ports g1 g8 as tagged T or untagged U members of VLAN 300 and VLAN 500 see VLAN Membership Configuration on page 81 From the STP Configuration screen enable the Spanning Tree State option see STP Switch Configuration on page 93 Use the default values for the rest of the STP configuration settings By default the STP Operation Mode is MSTP and the Configuration Name is the switch MAC address From the CST Configuration screen set the Bridge Priority value for each of the three switches to force Switch 1 to be the root bridge e Switch 1 4096 e Switch 2 12288 e Switch 3 20480 Note Bridge priority values are multiples of 4096 If you do not specify a root bridge and all switches have the same Bridge Priority value the switch with the lowest MAC address is elected as the root bridge see CST Configuration on page 95 From the CST Port Configuration screen select ports g1 98 and select
19. Managing Device Security 197 GS716Tv2 and GS724Tv3 Software Administration Manual IP Binding Table Use the IP Binding Table page to view or delete the IP ACL bindings To display the IP Binding Table click Security gt ACL then click the Advanced gt Binding Table link z GS724T N E TG A R 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help 1000u1 Manegement Security Access Port Authentication Traffic Control gt ACL Wizard IP Binding Table gt Basic v Advanced IP Binding Table IP ACL IP Rules IP Extended Rules gt IP Binding Configuration Banding Table d Interface Direction ACL Type The following table describes the information displayed in the MAC Binding Table Field Description Interface Displays the interface to which the IP ACL is bound Direction Specifies the packet filtering direction for ACL The only valid direction is Inbound which means the IP ACL rules are applied to traffic entering the port ACL Type Displays the type of ACL assigned to selected interface and direction ACL ID Displays the ACL Number identifying the ACL assigned to selected interface and direction Seq No Displays the Sequence Number signifying the order of specified ACL relative to other ACLs assigned to selected interface and direction To delete an IP ACL to interface binding select the check box next to the interface and click Delete
20. System Information IP Configuration v IP Configuration gt Time IP Configuration gt Denial of Service S Oynamic IP Address OHCP gt DNS Oynamic IP Address BOOTP gt Green Ethernet Configuration O Static IP Address IP Address 10 131 12 162 Subnet Mask 255 255 255 0 Default Gateway 10 131 12 1 Management VLAN Management VLAN ID To configure the network information for the management interface 1 Select the appropriate radio button to determine how to configure the network information for the switch management interface e Dynamic IP Address DHCP Specifies that the switch must obtain the IP address through a DHCP server Dynamic IP Address BOOTP Specifies that the switch must obtain the IP address through a BootP server e Static IP Address Specifies that the IP address subnet mask and default gateway must be manually configured Enter this information in the fields below this radio button 2 If you selected the Static IP Address option configure the following network information e IP Address The IP address of the network interface The factory default value is 192 168 0 239 Each part of the IP address must start with a number other than zero For example IP addresses 001 100 192 6 and 192 001 10 3 are not valid e Subnet Mask The IP subnet mask for the interface The factory default value is 255 255 255 0 e Default Gateway The default gateway for the IP interface The factory default v
21. eoceoeseoeovoeseeeseesesecseeoeoesesesetcseeetesso E m LI m LI m Ll m o m o m o m o m o m o m o o o m o E UE H mi o e o o o H NN 3 a 5 B To configure PVID information 1 To configure PVID settings for a physical port click PORTS To configure PVID settings for a Link Aggregation Group LAG click LAGS To configure PVID settings for both physical ports and LAGs click ALL B oe Select the check box next to the interfaces to configure You can select multiple interfaces to apply the same setting to the selected interfaces Select the check box in the heading row to apply the same settings to all interfaces 5 Configure the PVID to assign to untagged or priority tagged frames received on this port 84 Chapter3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual 6 Specify how you want the port to handle untagged and priority tagged frames Whichever you select VLAN tagged frames will be forwarded in accordance with the IEEE 802 1Q VLAN standard The factory default is Admit All e VLAN Only The port will discard any untagged or priority tagged frames it receives e Admit All Untagged and priority tagged frames received on the port will be accepted and assigned the value of the Port VLAN ID for this port 7 Specify how you want the port to handle tagged frames e Enable A tagged frame will be discarded if this port is not a member of the VLAN ide
22. gt Troubleshooting gt Ping NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Maintenance 1000uT J Reset Upload Download File Management v Ping Ping gt Traceroute Ping Details Hostname IP Address Count Interval Size To configure the settings and ping a host on the network 1 In the Hostname IP Address field specify the IP address or the hostname of the station you want the switch to ping The initial value is blank This information is not retained across a power cycle 2 Optionally configure the following settings e Count Specify the number of pings to send The valid range is 1 15 e Interval Specify the number of seconds between pings sent The valid range is 1 60 e Size Specify the size of the ping ICMP packet to send The valid range is 0 65507 3 Click Cancel to cancel the operation on the screen and reset the data on the screen to the latest value of the switch 4 Click Apply to send the ping The switch sends the number of pings specified in the Count field and the results are displayed below the configurable data in the Ping area Chapter 7 Maintenance 237 GS716Tv2 and GS724Tv3 Software Administration Manual e If successful you will see Reply From IP Host icmp seq 0 time xx usec Tx x Rx x Min Max Avg RTT x x x msec e Ifa reply to the ping is not received you will see Reply From IP Host Destination Unreachable Tx
23. handles tagged and untagged traffic In this example you create two new VLANs change the port membership for default VLAN 1 and assign port members to the two new VLANs 1 4 In the Basic VLAN Configuration screen see VLAN Configuration on page 80 create the following VLANs e AVLAN with VLAN ID 10 e AVLAN with VLAN ID 20 In the VLAN Membership screen see VLAN Membership Configuration on page 81 specify the VLAN membership as follows e For the default VLAN with VLAN ID 1 specify the following members port 7 U and port 8 U e For the VLAN with VLAN ID 10 specify the following members port 1 U port 2 U and port 3 T e For the VLAN with VLAN ID 20 specify the following members port 4 U port 5 T and port 6 U In the Port PVID Configuration screen see Port VLAN ID Configuration on page 83 specify the PVID for ports e1 and e4 so that packets entering these ports are tagged with the port VLAN ID e Porte PVID 10 e Port e4 PVID 20 With the VLAN configuration that you set up the following situations produce results as described e If an untagged packet enters port 1 the switch tags it with VLAN ID 10 The packet has access to port 2 and port 3 The outgoing packet is stripped of its tag to leave port 2 as an untagged packet For port 3 the outgoing packet leaves as a tagged packet with VLAN ID 10 e If a tagged packet with VLAN ID 10 enters port 3 the packet has access to port 1 and
24. rat e s Configuration ID Queve Id Every Address lt To configure rules for an IP ACL T To add an IP ACL rule select the ACL ID to add the rule to complete the fields described in the following list and click Add e Rule ID Specify a number from 1 10 to identify the IP ACL rule You can create up to 10 rules for each ACL e Action Selects the ACL forwarding action which is one of the following e Permit Forwards packets which meet the ACL criteria e Deny Drops packets which meet the ACL criteria e Assign Queue ID Specifies the hardware egress queue identifier used to handle all packets matching this ACL rule Enter an identifying number from 0 3 in the appropriate field e Match Every Requires a packet to match the criteria of this ACL Select True or False from the drop down menu Match Every is exclusive to the other filtering rules so if Match Every is True the other rules on the screen are not available e CPU Notification Mode This field is configurable only when the action is denied e Enable The switch to turn off PoE power to the port if the user is rejected by ACL When the rule is hit and the PoE component receives this notification the PoE component turns off PoE power for the port To turn on the port power you must manually enable the PoE port Admin Mode e Disable When a packet matches the ACL rule the CPU is not notified and the port continues to provide power e Source IP Address
25. this IP ACL is bound on the inbound direction so it examines traffic as it enters the switch 7 Click Apply 8 Use the IP Binding Table screen to view the interfaces and IP ACL binding information See IP Binding Table on page 198 The IP ACL in this example matches all packets with the source IP address and subnet mask of the Finance department s network and deny it on the Ethernet interfaces 2 3 and 4 of the switch The second rule permits all non Finance traffic on the ports The second rule is required because there is an explicit deny all rule as the lowest priority rule 254 Appendix B Configuration Examples GS716Tv2 and GS724Tv3 Software Administration Manual Differentiated Services DiffServ Standard IP based networks are designed to provide best effort data delivery service Best effort service implies that the network deliver the data in a timely fashion although there is no guarantee that it will During times of congestion packets may be delayed sent sporadically or dropped For typical Internet applications such as e mail and file transfer a slight degradation in service is acceptable and in many cases unnoticeable However any degradation of service has undesirable effects on applications with strict timing requirements such as voice or multimedia Quality of Service QoS can provide consistent predictable data delivery by distinguishing between packets that have strict timing requirements from those t
26. 0 106 191 12 1 9 9 11 1 Browse For Folder F5728TPw2 39 44 92 Hf fbi Enabled 255 255 255 0 10 131 12 11 N A F5728TP 00 02 48 21 02 4 Select a folder to store the configuration fie Enabled 255 255 255 0 19 131 12 1 N A E Desktop amp My Documents 4 My Computer amp V My Network Places D Downloads New Folder snartwzerd 2 05 05 MAC 00 00 00 0 tri Sift D P voa Chen v Make New Foider Cancel 4 Click OK 5 Enter the switch password and click Apply The file is uploaded to the administrative computer as a cfg file You can open it and view the contents with a text editor To restore the configuration to a previously saved version 1 Click the Maintenance tab and select the device with the configuration to restore 2 Click Download Configuration 3 From the Select a Configuration window that appears navigate to and select the configuration file to download to the switch Click Open Enter the switch password and click Apply to begin the download process m Note Click the Tasks tab to view status information about the configuration download 20 Chapter 1 Getting Started GS716Tv2 and GS724Tv3 Software Administration Manual Firmware Upgrade The application software for the GS716T and GS724T Smart Switches is upgradeable enabling your switch to take advantage of improvements and additional features as they become available The upgrade procedure and the required equipment are
27. 1 300 The default value is 90 Periodic Reauthentication Use this field to enable or disable reauthentication of the supplicant for the specified port Select Enable and Disable If the value is Enable reauthentication will occur Otherwise reauthentication will not be allowed The default value is Disable Changing the selection will not change the configuration until the Apply button is pressed Reauthentication Period Indicates the time span in which the selected port is reauthenticated The field value is in seconds The range is 1 65535 and the field default is 3600 seconds Quiet Period Defines the amount of time that the switch remains in the quiet state following a failed authentication exchange The possible field range is 0 65535 The field value is in seconds The field default is 60 seconds Resending EAP This input field allows you to configure the transmit period for the selected port The transmit period is the value in seconds of the timer used by the authenticator state machine on the specified port to determine when to send an EAPOL EAP Request Identify frame to the supplicant The transmit period must be a number in the range of 1 65535 The default value is 30 Changing the value will not change the configuration until you click the Apply button Max EAP Requests This input field allows you to enter the maximum requests for the selected port The maximum requests value is the maximum number of times the aut
28. ACL Use the MAC Binding Configuration page to assign the ACL by its ID number to a port 4 Optionally use the MAC Binding Table page to view the configurations To display the MAC ACL page click Security gt ACL The MAC ACL page is under the Basic link p m NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help tocour Management Security Access Port Authentication Troffic Control gt ACL Wizard MAC ACL Basic MAC ACL MAC ACL MAC Rules Current Number of ACL MAC Binding Configuration Binding Table gt Advanced MAC ACL Table Maximum ACL Name Rules Direction 4 The MAC ACL table displays the number of ACLs currently configured in the switch and the maximum number of ACLs that can be configured The current size is equal to the number of configured IPv4 ACLs plus the number of configured MAC ACLs To configure a MAC ACL 1 To add a MAC ACL specify a name for the MAC ACL in the Name field and click Add The name string may include alphabetic numeric dash underscore or space characters only The name must start with an alphabetic character Each configured ACL displays the following information e Rules Displays the number of rules currently configured for the MAC ACL e Direction Displays the direction of packet traffic affected by the MAC ACL which can be Inbound or blank 2 To delete a MAC ACL select the check box next t
29. Administration Manual e Simple Policy Use this attribute to establish the traffic policing style for the specified class The simple form of the policy command uses a single data rate and burst size resulting in two outcomes confirm and violate 4 f you select the Simple Policy attribute you can configure the following fields e Color Mode Color Aware mode requires the existence of one or more color classes that are valid for use with this policy instance otherwise the color mode is color blind which is the default e Color Conform Class A valid color class contains a single non excluded match criterion for one of the following fields provided the field does not conflict with the classifier of the policy instance itself e Color Conform Mode The match criteria of the color Conform class e Committed Rate The committed rate is specified in kilobits per second Kbps and is an integer from 1 4294967295 e Committed Burst Size The committed burst size is specified in kilobytes KB and is an integer from 1 128 e Conform Action Determines what happens to packets that are considered conforming below the police rate Select one of the following actions e Send default These packets are presented unmodified by DiffServ to the system forwarding element e Drop These packets are immediately dropped e Mark CoS These packets are marked by DiffServ with the specified CoS value before being presented to the system f
30. Enable from the STP Status menu see CST Port Configuration on page 97 Click Apply Select ports g1 g5 edge ports and select Enable from the Fast Link menu Appendix B Configuration Examples 265 GS716Tv2 and GS724Tv3 Software Administration Manual Since the edge ports are not at risk for network loops ports with Fast Link enabled transition directly to the Forwarding state 8 Click Apply You can use the CST Port Status screen to view spanning tree information about each port 9 From the MST Configuration screen create a MST instances with the following settings e MST ID 1 e Priority Use the default 32768 e VLAN ID 300 For more information see MST Configuration on page 103 10 Click Add 11 Create a second MST instance with the following settings e MST ID 2 Priority 49152 e VLAN ID 500 12 Click Add In this example assume that Switch 1 has become the Root bridge for the MST instance 1 and Switch 2 has become the Root bridge for MST instance 2 Switch 3 has hosts in the Sales department ports e1 e2 and e3 and in the HR department ports e4 and e5 Switches 1 and 2 also have hosts in the Sales and Human Resources departments The hosts connected from Switch 2 use VLAN 500 MST instance 2 to communicate with the hosts on Switch 3 directly Likewise hosts of Switch 1 use VLAN 300 MST instance 1 to communicate with the hosts on Switch 3 directly The hosts use different instances of MSTP
31. LLDP Configuration on page 52 e LLDP Port Settings on page 53 e LLDP MED Network Policy on page 55 e LLDP MED Port Settings on page 56 e Local Information on page 57 e Neighbors Information on page 60 LLDP is a one way protocol there are no request response sequences Information is advertised by stations implementing the transmit function and is received and processed by stations implementing the receive function The transmit and receive functions can be enabled disabled separately per port By default both transmit and receive are disabled on all ports The application is responsible for starting each transmit and receive state machine appropriately based on the configured status and operational state of the port The Link Layer Discovery Protocol Media Endpoint Discovery LLDP MED is an enhancement to LLDP with the following features e Auto discovery of LAN policies such as VLAN Layer 2 Priority and DiffServ settings enabling plug and play networking e Device location discovery for creation of location databases e Extended and automated power management of Power over Ethernet endpoints e Inventory management enabling network administrators to track their network devices and determine their characteristics manufacturer software and hardware versions serial asset number LLDP Configuration Use the LLDP Configuration page to specify LLDP and LLDP MED parameters that are applied to the switch To display the
32. Line The line number within the source file of the code that detected the event Task ID The OS assigned ID of the task reporting the event 220 Chapter6 Monitoring the System GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Code The event code passed to the event log handler by the code reporting the event Time The time the event occurred measured from the previous reset Use the buttons at the bottom of the page to perform the following actions e Click Clear to clear the messages out of the Event Log Click Refresh to refresh the data on the screen and display the most current information Chapter 6 Monitoring the System 221 GS716Tv2 and GS724Tv3 Software Administration Manual Port Mirroring The page under the Mirroring link allows you to view and configure port mirroring on the system Multiple Port Mirroring Port mirroring selects the network traffic for analysis by a network analyzer This is done for specific ports of the switch As such many switch ports are configured as source ports and one switch port is configured as a destination port You have the ability to configure how traffic is mirrored on a source port Packets that are received on the source port that are transmitted on a port or are both received and transmitted can be mirrored to the destination port The packet that is copied to the destination port is in the same format as the origi
33. MAC Filter e MAC Filter Configuration on page 175 e MAC Filter Summary on page 176 e Storm Control on page 177 e Port Security e Port Security Configuration on page 178 e Port Security Interface Configuration on page 179 174 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual e Security MAC Address on page 181 e Protected Ports Membership on page 181 MAC Filter Configuration Use the MAC Filter Configuration page to create MAC filters that limit the traffic allowed into and out of specified ports on the system To display the MAC Filter Configuration page click Security gt Traffic Control and then click the MAC Filter gt MAC Filter Configuration link NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help 690v J Monogemen Security Accon Port Authentication v MAC Filter MAC Filter Configuration MAC Filter Configuration MAC Filter Configuration MAC Filter MAC Filter VLAN ID Eurer MAC Address aaa gt Storm Control Source Port Members gt Port Security Protected Ports Destination Port Members To configure MAC filter settings 1 To configure a new MAC filter a Select Create Filter from the MAC Filter menu If no filters have been configured this is the only option available b From the VLAN ID menu select the VLAN to use with the MAC address to fully identify packets you want filtered Yo
34. MST values and click Add e MST ID Specify the ID of the MST to create Valid values for this are between 1 and 4094 Priority Specifies the bridge priority value for the MST When switches or bridges are running STP each is assigned a priority After exchanging BPDUS the switch with the lowest priority value becomes the root bridge The bridge priority is a multiple of 4096 If you specify a priority that is not a multiple of 4096 the priority is automatically set to the next lowest priority that is a multiple of 4096 For example if the priority is attempted to be set to any value between 0 and 4095 it will be set to O The default priority is 32768 The valid range is 0 61440 Chapter 3 Configuring Switching Information 103 GS716Tv2 and GS724Tv3 Software Administration Manual e VLAN ID The menu contains all VLANs configured on the switch Select a VLAN to associate with the MST instance 2 To delete an MST instance select the check box next to the instance and click Delete 3 To modify an MST instance select the check box next to the instance to configure update the values and click Apply You can select multiple check boxes to apply the same setting to all selected ports 4 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch For each configured instance the information described in the following table displays on the page Field
35. Number 1234512329 System Name System Object 1D 1 3 6 1 4 1 4326 100 4 17 Date amp Time Jan 19 1970 09 21 39 System Up Time 18 days 9 hours 21 mins 39 secs Base MAC Address 00 00 00 01 13 f Versions E Model Name Boot Version Software Version Status and Options ar 83 1 1 1 5 0 2 3 lt ALI RLS Figure 1 Administrative Page Layout Navigation Tabs Feature Links and Page Menu The navigation tabs along the top of the Web interface give you quick access to the various switch functions The tabs are always available and remain constant regardless of which feature you configure When you select a tab the features for that tab appear as links directly under the tabs The feature links in the blue bar change according to the navigation tab that is selected The configuration pages for each feature are available as links in the page menu on the left side of the page Some items in the menu expand to reveal multiple configuration pages as Figure 2 on page 25 shows When you click a menu item that includes multiple configuration pages the item becomes preceded by a down arrow symbol and expands to display the additional pages gt System Information gt IP Configuration Time Selected Option mm 8 Ciosi 0s SNTP Server Configuration gt Denial of Service gt ONS gt Green Ethernet Configuration a Page Menu Figure 2 Menu Hierarchy Chapter 1 Getting Started 25 GS716Tv2 and GS724Tv3 Software Admi
36. Port access control provides a means of preventing unauthorized access by supplicants to the services offered by a system Control over the access to a switch and the LAN to which it is connected can be desirable in order to restrict access to publicly accessible bridge ports or to restrict access to departmental LANs Access control is achieved by enforcing authentication of supplicants that are attached to an authenticator s controlled ports The result of the authentication process determines whether the supplicant is authorized to access services on that controlled port 260 Appendix B Configuration Examples GS716Tv2 and GS724Tv3 Software Administration Manual A Port Access Entity PAE is able to adopt one of two distinct roles within an access control interaction 1 Authenticator A Port that enforces authentication before allowing access to services available via that Port 2 Supplicant A Port that attempts to access services offered by the Authenticator Additionally there exists a third role 3 Authentication server Performs the authentication function necessary to check the credentials of the Supplicant on behalf of the Authenticator All three roles are required in order to complete an authentication exchange switch switches support the Authenticator role only in which the PAE is responsible for communicating with the Supplicant The Authenticator PAE is also responsible for submitting the information received fr
37. QoS Security Monitoring Maintenance Help scour j Wt gt System Information Auto DoS Configuration IP Configuration gt Time Auto DoS Configuration SNTP Global Configuration SNTP Server Configuration v Denial of Service Auto DoS Configuration DoS Configuration gt ONS gt Green Ethernet Configuration Auto DoS Mode Disable Enable lt Chapter 2 Configuring System Information 41 GS716Tv2 and GS724Tv3 Software Administration Manual To configure the Auto DoS feature 1 Select a radio button to enable or disable Auto DoS e Disable Auto DoS is disabled default e Enable Auto DoS is enabled 2 Click Apply to send the updated configuration to the switch Configuration changes occur immediately 3 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch DoS Configuration The DoS Configuration page lets you to select which types of DoS attacks for the switch to monitor and block To access the DoS Configuration page click System gt Management gt Denial of Service gt DoS Configuration NETGEAR GS7241 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help socour j gt System Information Denial of Service Configuration gt IP Configuration gt Time Denial of Service Configuration v Denial of Service S A Auto DoS Configuration Denial of Service SIP DIP Owable
38. Requires a packet s source IP address to match the address listed here Type an IP Address in the appropriate field using dotted decimal notation The address you enter is compared to a packet s source IP Address e Source IP Mask Specifies the source IP address wildcard mask Wild card masks determines which bits are used and which bits are ignored A wild card mask of 255 255 255 255 indicates that no bit is important A wildcard of 0 0 0 0 indicates that all of the bits are important Wildcard masking for ACLs operates differently from a 192 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual subnet mask A wildcard mask is in essence the inverse of a subnet mask For example to apply the rule to all hosts in the 192 168 1 0 24 subnet you type 0 0 0 255 in the Source IP Mask field This field is required when you configure a source IP address 2 To delete an IP ACL rule select the check box associated with the rule and then click Delete 3 To update an IP ACL rule select the check box associated with the rule update the desired fields and then click Apply You cannot modify the Rule ID of an existing IP rule 4 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 5 If you change any of the settings on the page click Apply to send the updated configuration to the switch Configuration changes take effect immediat
39. System Information GS716Tv2 and GS724Tv3 Software Administration Manual Click Refresh to refresh the page with the most current data from the switch Denial of Service Use the Denial of Service DoS page to configure DoS control The switch software provides support for classifying and blocking specific types of DoS attacks You can configure your system to monitor and block six types of attacks e SIP DIP Source IP address Destination IP address First Fragment TCP Header size is smaller than the configured value e TCP Fragment IP Fragment Offset 1 e TCP Flag TCP Flag SYN set and Source Port lt 1024 or TCP Control Flags 0 and TCP Sequence Number 0 or TCP Flags FIN URG and PSH set and TCP Sequence Number 0 or TCP Flags SYN and FIN set e L4 Port Source TCP UDP Port Destination TCP UDP Port e ICMP Limiting the size of ICMP Ping packets Auto DoS Configuration The Auto DoS Configuration page lets you automatically enable all the DoS features available on the switch except for the L4 Port attack See the previous section for information about the types of DoS attacks the switch can monitor and block Note When Auto DoS is enabled a port that is under attack is automatically shut down and does not forward traffic To access the Auto DoS Configuration page click System gt Management gt Denial of Service gt Auto DoS Configuration NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching
40. TLV value field 64 Chapter 2 Configuring System Information GS716Tv2 and GS724Tv3 Software Administration Manual Services DHCP Filtering DHCP Filtering is a useful feature that can be employed as a security measure against unauthorized DHCP servers A known attack is when an unauthorized DHCP server responds to a client that is requesting an IP address The server configures the gateway for the client to be equal to the IP address of the server At that point the client sends all of its IP traffic destined to other networks to the unauthorized machine This gives the attacker the possibility of snooping traffic for passwords or employing a man in the middle attack DHCP Filtering works by allowing the administrator to configure each port as either a trusted port or an untrusted port The port that has the authorized DHCP server should be configured as a trusted port Any DHCP responses received on a trusted port are forwarded All other ports should be configured as untrusted Any DHCP or BootP responses received are discarded From the Services link you can access the following pages e DHCP Filtering Configuration on page 65 e Interface Configuration on page 66 DHCP Filtering Configuration Use the DHCP Filtering Configuration page to enable or disable the DHCP Filtering feature on the switch To access the DHCP Filter Configuration page click System gt Services gt DHCP Filtering gt Configuration NETG
41. The ACL Wizard simplifies the ACL rule configuration process The Wizard contains a short list of access criteria that you can either permit or deny When you select the permit or deny link associated with the access criteria you are redirected to a page that is automatically configured with several of the settings Note Before you use the ACL Wizard to configure rules you must create either a MAC ACL Standard IP ACL or Extended IP ACL that will contain the rules To create a MAC ACL see MAC ACL on page 184 To create a standard or extended IP ACL see P ACL on page 190 To display the ACL Wizard page click Security ACL Chapter 5 Managing Device Security 183 GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR GS724T 24 Port Gigabit Smart Switch soGour Management Security Access Port Authentication Traffic Control v ACL Wizard ACL Wizard gt Basic Advanced ACL Wizard To use Select Devices Based on Source MAC Address Select Devices Based on Destination MAC Address Select Devices Based on Source IP Address Select Devices Based on Destination IP Address Select Devices Based on TCP UDP Source Port ID Select Devices Based on TCP UDP Destination Port ID the ACL Wizard 1 Determine the type of ACL to configure and create a MAC ACL standard IP ACL or extended IP ACL To permit or deny traffic based on the Source MAC Address create a MAC ACL To permit or deny traffic based on t
42. Time UTC time zone in which the switch is located expressed as the number of hours 3 Click Apply to send the updated configuration to the switch Configuration changes take effect immediately 4 Use the SNTP Server Configuration page to configure the SNTP server settings as described in SNTP Server Configuration on page 39 5 Click Refresh to refresh the page with the most current data from the switch 6 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch The SNTP Global Status table on the Time Configuration page displays information about the system s SNTP client The following table describes the SNTP Global Status fields Field Description Version Specifies the SNTP Version the client supports Supported Mode Specifies the SNTP modes the client supports Multiple modes may be supported by a client Last Update Time Specifies the local date and time UTC the SNTP client last updated the system clock Last Attempt Time Specifies the local date and time UTC of the last SNTP request or receipt of an unsolicited message Last Attempt Status Specifies the status of the last SNTP request or unsolicited message for both unicast mode If no message has been received from a server a status of Other is displayed These values are appropriate for all operational modes e Other None of the following enumeration values Success The SNTP
43. To configure the Auto Video feature 1 Enable or disable the Auto Video feature e Enable The IGMP Snooping Querier is automatically configured with the default VLAN ID for the Auto Video VLAN e Disable IGMP Snooping settings must be manually configured 2 Click Apply to send the updated configuration to the switch Configuration changes take effect immediately 3 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch Chapter 3 Configuring Switching Information 109 GS716Tv2 and GS724Tv3 Software Administration Manual IGMP Snooping Internet Group Management Protocol IGMP Snooping is a feature that allows a switch to forward multicast traffic intelligently on the switch Multicast IP traffic is traffic that is destined to a host group Host groups are identified by class D IP addresses which range from 224 0 0 0 to 239 255 255 255 Based on the IGMP query and report messages the switch forwards traffic only to the ports that request the multicast traffic This prevents the switch from broadcasting the traffic to all ports and possibly affecting network performance A traditional Ethernet network may be separated into different network segments to prevent placing too many devices onto the same shared media Bridges and switches connect these segments When a packet with a broadcast or multicast destination address is received the switch will forward a copy
44. Upload page to upload configuration ASCII log ASCII and image binary files from the switch to an TFTP server on the network To display the File Upload page click Maintenance Upload File Upload NETGEAR GS724T 24 Port Gigabit Smart Switch Switching QoS Security Monitoring Maintenance _togour Dewnloed File Management Trovbleshooting v File Upload File Upload File Upload Pile Type Transfer Mode Server Address Type Server Address Transfer File Path Transfer File Name C Start File Transfer To upload a file from the switch to the TFTP server 1 Use the File Type menu to specify the type of file you want to upload e Code Uploads a stored code image e Text Configuration Uploads the text configuration file which can be used as a backup copy or to download and apply to another switch e Error Log Uploads the system error persistent log sometimes referred to as the event log e Buffered Log Uploads the system buffered in memory log e Trap Log Uploads the system trap records 2 Ifthe file type is Code specify whether to upload image1 or image2 This field is only visible when Code is selected as the File Type 3 From the Server Address Type filed specify the format to use for the address you type in the TFTP Server Address field e Pv4 Indicates the TFTP server address is an IP address in dotted decimal format e DNS Indicates the TFTP server address is a hostname 4 Inthe
45. VLAN Last Querier Version Displays the IGMP protocol version of the last querier from which a query was snooped on the VLAN Operational Max Response Displays the maximum response time to be used in the queries that are sent Time by the snooping querier Click Refresh to redisplay the page with the latest information from the switch Forwarding Database The forwarding database maintains a list of MAC addresses after having received a packet from this MAC address The transparent bridging function uses the forwarding database entries to determine how to forward a received frame The Address Table folder contains links to the following features e MAC Address Table on page 122 e Dynamic Address Configuration on page 124 e Static MAC Address on page 125 MAC Address Table The MAC Address Table contains information about unicast entries for which the switch has forwarding and or filtering information This information is used by the transparent bridging function in determining how to propagate a received frame Use the search function of the MAC Address Table page to display information about the entries in the table 122 Chapter 3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual To access this page click Switching gt Address Table gt Basic gt Address Table NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenanc
46. a user defined Port ID by which packets are matched to the rule Chapter 4 Configuring Quality of Service 139 GS716Tv2 and GS724Tv3 Software Administration Manual e Destination IP Address Requires a packet s destination port IP address to match the address listed here In the IP Address field enter a valid destination IP address in dotted decimal format Destination Mask Enter a valid subnet mask to determine which bits in the IP address are significant This is not a wildcard mask Destination L4 Port Requires a packet s TCP UDP destination port to match the port you select Select the desired L4 keyword from the list on which the rule can be based If you select Other the screen refreshes and a Port ID field appears Enter a user defined Port ID by which packets are matched to the rule e IP DSCP Matches the packet s DSCP to the class criteria s when selected Select the DSCP type from the menu or enter a DSCP value to match If you select Other enter a custom value in the DSCP Value field that appears e IP Precedence Matches the packet s IP Precedence value to the class criteria s when Enter a value in the range of 0 7 e IP ToS Matches the packet s Type of Service bits in the IP header to the class criteria s when selected and a value is entered In the ToS Bits field enter a two digit hexadecimal number to match the bits in a packet s ToS field In the ToS Mask field specify the bit positions that are used for c
47. action is denied e Enable The switch to turn off PoE power to the port if the user is rejected by ACL When the rule is hit and the PoE component receives this notification the PoE component turns off PoE power for the port To turn on the port power you must manually enable the PoE port Admin Mode e Disable When a packet matches the ACL rule the CPU is not notified and the port continues to provide power e Destination MAC Requires an Ethernet frame s destination port MAC address to match the address listed here Enter a MAC address in this field The valid format is XXOCXX20CXX XX e Destination MAC Mask If desired enter the MAC Mask associated with the Destination MAC to match The MAC address mask specifies which bits in the destination MAC to compare against an Ethernet frame Use Fs and zeros in the MAC mask which is in a wildcard format An F means that the bit is not checked and a zero in a bit position means that the data must equal the value given for that bit For example if the MAC address is aa bb cc dd ee ff and the mask is 00 00 ff ff ff ff all MAC addresses with aa bb xx xx xx xx result in a match where x is any hexadecimal number A MAC mask of 00 00 00 00 00 00 matches a single MAC address e EtherType Key Requires a packets EtherType to match the EtherType you select Select the EtherType value from the drop down menu If you select User Value you can enter a custom EtherType value e EtherType User Va
48. action is performed and subsequent rules below are ignored For example if a Source IP 10 10 10 10 is configured with priority 1 to permit and Source IP 10 10 10 10 is configured with priority 2 to Deny then access is permitted if the profile is active and the second rule is ignored To modify an access rule select the check box next to the Rule Type update the desired settings and click Apply To delete an access rule select the check box next to the Rule Type and click Delete Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch Chapter 5 Managing Device Security 167 GS716Tv2 and GS724Tv3 Software Administration Manual Port Authentication In port based authentication mode when 802 1X is enabled globally and on the port successful authentication of any one supplicant attached to the port results in all users being able to use the port without restrictions At any given time only one supplicant is allowed to attempt authentication on a port in this mode Ports in this mode are under bidirectional control This is the default authentication mode The 802 1X network has three components e Authenticators Specifies the port that is authenticated before permitting system access e Supplicants Specifies the host connected to the authenticated port requesting access to the system services e Authentication Server Specifies the external server for e
49. activation of link status traps by selecting the corresponding button The factory default is Enable 3 From the Spanning Tree field enable or disable activation of spanning tree traps by selecting the corresponding button The factory default is Enable 4 If you make any changes to this page click Apply to send the updated configuration to the switch Configuration changes take effect immediately 5 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 50 Chapter2 Configuring System Information GS716Tv2 and GS724Tv3 Software Administration Manual SNMP v3 User Configuration This is the configuration for SNMP v3 To access this page click System gt SNMP gt SNMP V3 gt User Configuration NETGEAR Gs724T ll 24 Port Gigabit Smart Switch System witchir QoS ity Monitoring Maintenance Help LOGOUT LLDP Services gt SNMP V1 V2 User Configuration v SNMP V3 User User Configuration Configuration SNMP v3 Access Mode Authentication Protocol Encryption Protocol Encryption Key The SNMPv3 Access Mode is a read only field that shows the access privileges for the user account The admin account always has Read Write access and all other accounts have Read Only access To configure SNMPv3 settings for the user account 1 In the Authentication Protocol field specify the SNMPv3 Authentication Protocol setting for the select
50. address to match the address listed here Type an IP Address in the appropriate field using dotted decimal notation The address you enter is compared to a packet s source IP Address e Src IP Mask Specifies the source IP address wildcard mask Wild card masks determines which bits are used and which bits are ignored A wild card mask of 255 255 255 255 indicates that no bit is important A wildcard of 0 0 0 0 indicates that all of the bits are important Wildcard masking for ACLs operates differently from a subnet mask A wildcard mask is in essence the inverse of a subnet mask For example to apply the rule to all hosts in the 192 168 1 0 24 subnet you type 0 0 0 255 in the Source IP Mask field This field is required when you configure a source IP address e Src L4 Port Requires a packets TCP UDP source port to match the port listed here Click Complete one of the following fields e Source L4 Keyword Select the desired L4 keyword from a list of source ports on which the rule can be based e Source L4 Port Number If the source L4 keyword is Other enter a user defined Port ID by which packets are matched to the rule e DstIP Address Requires a packet s destination port IP address to match the address listed here Enter an IP Address in the appropriate field using dotted decimal notation The address you enter is compared to a packet s destination IP Address e Dst IP Mask Specifies the destination IP address wildcard mask Wild card
51. box next to the port or LAG to configure You can select multiple ports and LAGs to apply the same setting to the selected interfaces Select the check box in the heading row to apply the same settings to all interfaces 5 To activate a policy for the selected interface s select the policy from the Policy In menu and then click Apply 6 To remove a policy from the selected interface s select None from the Policy In menu and then click Apply 7T Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch Service Statistics Use the Service Statistics page to display service level statistical information about all interfaces that have DiffServ policies attached To display the page click the QoS DiffServ tab and then click the Advanced Service Statistics link NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help LOGOUT J Basic Service Statistics v Advanced DiffServ Service Statistics aq Configuration Operational Discarded Member Status Packets Classes Interface Direction Policy Name Class Configuration Pobcy Configuration Service Configuration Service Statistics e gt v REFRESH The following table describes the information available on the Service Statistics page Field Description Interface Displays the interface for which service stat
52. buffer space Most Address Entries Ever Used The highest number of Forwarding Database Address Table entries that have been learned by this switch since the most recent reboot Address Entries in Use The number of Learned and static entries in the Forwarding Database Address Table for this switch Maximum VLAN Entries The maximum number of Virtual LANs VLANs allowed on this switch Most VLAN Entries Ever Used The largest number of VLANs that have been active on this switch since the last reboot Static VLAN Entries The number of presently active VLAN entries on this switch that have been created statically Dynamic VLAN Entries The number of presently active VLAN entries on this switch VLAN Deletes The number of VLANs on this switch that have been created and then deleted since the last reboot Time Since Counters Last Cleared The elapsed time in days hours minutes and seconds since the statistics for this switch were last cleared 202 Chapter6 Monitoring the System GS716Tv2 and GS724Tv3 Software Administration Manual Use the buttons at the bottom of the page to perform the following actions e Click Clear to clear all the statistics counters resetting all switch summary and detailed statistics to default values The discarded packets count cannot be cleared e Click Refresh to refresh the page with the most current data from the switch Port Stat
53. check box beside the Class Name then click Delete 4 Click Refresh to refresh the page with the most current data from the switch 5 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch After creating a Class click the class link to the Class page Chapter 4 Configuring Quality of Service 137 GS716Tv2 and GS724Tv3 Software Administration Manual To configure the class match criteria 1 Click the class name for an existing class NE TG E A R GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help ocour gt Basic Class Configuration Advanced DiffServ Class Configuration Configuration Class Configuration Policy Configuration Service Class Name Class Type 4 t Configuration Service Statistics REFRESH The class name is a hyperlink The following figure shows the configuration fields for the class 138 Chapter 4 Configuring Quality of Service GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR GS724T 24 Port Gigabit Smart Switch Switchian QoS Security Monderiag Maintenonce Help rosou Basic Class Configuration v Advanced OfServ Class Information Configuration Class Class Name NewClass Configuration Class Type AN Policy Configuration Diffserv Class Configuration Service Configuration Reference Class Service Statist
54. connected to a single network segment even though they might not be For example all marketing personnel might be spread throughout a building Yet if they are all assigned to a single VLAN they can share resources and bandwidth as if they were connected to the same segment The resources of other departments can be invisible to the marketing VLAN members accessible to all or accessible only to specified individuals depending on how the IT manager has set up the VLANs VLANs have a number of advantages e Itis easy to do network segmentation Users that communicate most frequently with each other can be grouped into common VLANs regardless of physical location Each group s traffic is contained largely within the VLAN reducing extraneous traffic and improving the efficiency of the whole network e They are easy to manage The addition of nodes as well as moves and other changes can be dealt with quickly and conveniently from a management interface rather than from the wiring closet e They provide increased performance VLANs free up bandwidth by limiting node to node and broadcast traffic throughout the network e They ensure enhanced network security VLANs create virtual boundaries that can be crossed only through a router So standard router based security measures can be used to restrict access to each VLAN Packets received by the switch are treated in the following way e When an untagged packet enters a port it is automa
55. create access rules make sure e Anaccess profile exists e The access profile is deactivated 166 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual To configure access profile rules 1 To add an access profile rule configure the following settings and click Add Rule Type Specify whether the rule permits or denies access to the GS716T or GS724T management interface e Select Permit to allow access to the management interface for traffic that meets the criteria you configure for the rule Any traffic that does not meet the rules is denied e Select Deny to prohibit access to the management interface for traffic that meets the criteria you configure for the rule Any traffic that does not meet the rules is allowed access to the switch Unlike MAC ACLs and IP ACLs there is no implied deny all rule at the end of the rule list Service Type Select the type of service to allow or prohibit from accessing the switch management interface e SNMP HTTP HTTPS Source IP Address Specify the IP Address of the client originating the management traffic Mask Specify the subnet mask associated with the IP address The subnet mask is a standard subnet mask and not an inverse wildcard mask that you use with IP ACLs Priority Configure priority to the rule The rules are validated against the incoming management request in the ascending order of their priorities If a rule matches
56. e Tf Time at which the original request was sent by the client T2 Time at which the original request was received by the server e T3 Time at which the server sent a reply e T4 Time at which the client received the server s reply The device can poll Unicast server types for the server time Polling for Unicast information is used for polling a server for which the IP address is known SNTP servers that have been configured on the device are the only ones that are polled for synchronization information T1 through T4 are used to determine server time This is the preferred method for synchronizing device time because it is the most secure method If this method is selected SNTP information is accepted only from SNTP servers defined on the device using the SNTP Server Configuration page The device retrieves synchronization information either by actively requesting information or at every poll interval Time Configuration Use the Time Configuration page to view and adjust date and time settings To display the Time Configuration page click System Management Time SNTP Global Configuration 36 Chapter2 Configuring System Information GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help 1060vr gt System Information Time Configuration gt IP Configuration Time Time Configuration SNTP Global Conf
57. field Port ID Identifies the physical address of the port on the remote system from which the data was sent Port Description System Name Identifies the user defined description of the port Identifies the system name associated with the remote device System Description Specifies the description of the selected port associated with the remote system System Capabilities Specifies the system capabilities of the remote system Managed Addresses Address SubType Specifies the type of the management address 62 Chapter 2 Configuring System Information GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Address Interface SubType Specifies the advertised management address of the remote system Specifies the port subtype Interface Number Identifies the port on the remote device that sent the information MAC PHY Details Auto Negotiation Supported Specifies whether the remote device supports port speed auto negotiation The possible values are True or False Auto Negotiation Enabled Displays the port speed auto negotiation support status The possible values are True or False Auto Negotiation Advertised Capabilities Displays the port speed auto negotiation capabilities Operational MAU Type Displays the Medium Attachment Unit MAU type The MAU performs physical layer functions including digital da
58. file transfer is done Chapter7 Maintenance 233 GS716Tv2 and GS724Tv3 Software Administration Manual File Management The system maintains two versions of the GS716T or GS724T software in permanent storage One image is the active image and the second image is the backup image The active image is loaded during subsequent switch restarts This feature reduces switch down time when upgrading or downgrading the GS716T or GS724T software The File Management menu contains links to the following options e Dual Image Configuration on page 234 e Dual Image Status on page 235 Dual Image Configuration The system running a legacy software version will ignore not load a configuration file created by the newer software version When a configuration file created by the newer software version is discovered by the system running an older version of the software the system will display an appropriate warning to the user Use the Dual Image Configuration page to set the boot image configure an image description or delete an image To display the Dual Image Configuration page click Maintenance File Management Dual Image gt Dual Image Configuration NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help toGovr J Reset Upload Downlood Dual Image Dual Image Configuration Dual Image Configuration Dual Image Configuration Dual Image Image N Status E sas
59. for an interface 1 To configure CoS settings for a physical port click PORTS 2 To configure CoS settings for a Link Aggregation Group LAG click LAGS 3 To configure CoS settings for both physical ports and LAGs click ALL 4 Select the check box next to the port or LAG to configure You can select multiple ports and LAGs to apply the same setting to the selected interfaces 5 From the Interface Trust Mode field specify whether or not the selected interface s trust a particular packet marking when the packet enters the port e Untrusted Do not trust any CoS packet marking at ingress e 802 1p The eight priority tags that are specified in IEEE 802 1p are pO to p7 The QoS setting lets you map each of the eight priority levels to one of four internal hardware priority queues High Normal Low and Lowest e DSCP The six most significant bits of the DiffServ field are called the Differentiated Services Code Point DSCP bits 6 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 7 f you make changes to the page click Apply to apply the changes to the system 130 Chapter4 Configuring Quality of Service GS716Tv2 and GS724Tv3 Software Administration Manual Interface Queue Configuration Use the Interface Queue Configuration page to define what a particular queue does by configuring switch egress queues User configurable parameters control
60. forwarding element This selection requires that the DSCP value field be set 5 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 6 If you change any of the settings on the page click Apply to send the updated configuration to the switch Configuration changes take effect immediately 7 Click Refresh to refresh the page with the most current data from the switch Service Configuration Use the Service Configuration page to activate a policy on an interface To display the page click QoS gt DiffServ gt Advanced gt Service Configuration NETGEAR GS724T System gt Basic v Advanced DiffServ Configuration Class Configuration Policy Configuration Service Configuration Service Statisbcs 24 Port Gigabit Smart Switch Monitoring Maintenance Help Logot Service Configuration Service Configuration PORTS 5 All GO TO INTERFACE Operational Status Interface Policy In Direction To configure DiffServ policy settings on an interface 1 To configure DiffServ policy settings for a physical port click PORTS 2 To configure DiffServ policy settings for a Link Aggregation Group LAG click LAGS 3 To configure DiffServ policy settings for both physical ports and LAGs click ALL Chapter 4 Configuring Quality of Service 145 GS716Tv2 and GS724Tv3 Software Administration Manual 4 Select the check
61. interface is active or not active Voice VLAN OUI The Organizational Unique Identifier OUI identifies the IP phone manufacturer The switch comes preconfigured with the following OUls 00 01 E3 SIEMENS 00 03 6B CISCO1 00 12 43 CISCO2 00 0F E2 H3C 00 60 B9 NITSUKO 00 DO 1E PINTEL 00 E0 75 VERILINK 00 E0 BB 3COM 00 04 0D AVAYA1 00 1B 4F AVAYA2 You can select an existing OUI or add a new OUI and description to identify the IP phones on the network To display the Voice VLAN OUI page click Switching gt Voice VLAN gt Advanced gt OUI 88 Chapter 3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR GS724T 24 Port Gigabit Smart Switch Connect with Inovofica System Switching QoS Security Monitoring Maintenance Help VIAN STP Multicast Address Table Basic vAdvenced Properbes Port Setting Select Telephony OUI s Description OUI E EL o as 00101 E3 SIEMENS 00 03 68 09 12 43 00 0f t2 00 60 89 NITSUXO 00 D0 1E PINTEL 00 60 75 VERILINK 00 60 88 3COM 00 04 00 AVAYAL o o D LI D B o D D LJ 00 10 4F AVAYAZ gt APPLY RESTORE DEFALATS Chapter 3 Configuring Switching Information 89 GS716Tv2 and GS724Tv3 Software Administration Manual Auto VolP The Auto VoIP automatically makes sure that time sensitive voice traffic is given priority over data traffic on ports that have this feature enabled Au
62. into each of the remaining network segments in accordance with the IEEE MAC Bridge standard Eventually the packet is made accessible to all nodes connected to the network This approach works well for broadcast packets that are intended to be seen or processed by all connected nodes In the case of multicast packets however this approach could lead to less efficient use of network bandwidth particularly when the packet is intended for only a small number of nodes Packets will be flooded into network segments where no node has any interest in receiving the packet While nodes will rarely incur any processing overhead to filter packets addressed to unrequested group addresses they are unable to transmit new packets onto the shared media for the period of time that the multicast packet is flooded The problem of wasting bandwidth is even worse when the LAN segment is not shared for example in full duplex links Allowing switches to snoop IGMP packets is a creative effort to solve this problem The switch uses the information in the IGMP packets as they are being forwarded throughout the network to determine which segments should receive packets directed to the group address IGMP Snooping Configuration Use the IGMP Snooping Configuration page to configure the parameters for IGMP snooping which is used to build forwarding lists for multicast traffic To access the IGMP Snooping Configuration page click Switching Multicast IGMP Snoopin
63. is enabled lower speed switches can communicate with higher speed switches by requesting that the higher speed switch refrains from sending packets Transmissions are temporarily halted to prevent buffer overflows To display the Flow Control page click Switching Ports and then click the Flow Control link NETGEAR GS724T 24 Port Gigabit Smert Switch vo6our Switching LAG VLAN Voice VIAN Auto VolP STP Multicost gt Port Configuration Flow Control v Flow Control Flow Control Global Flow Control IEEE 802 3x Mode To configure global flow control settings 1 From the Global Flow Control IEEE 802 3x Mode field enable or disable IEEE 802 3x flow control on the system The factory default is Disable e Enable The switch sends pause packets if the port buffers become full e Disable The switch does not send pause packets if the port buffers become full 2 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 3 If you change the mode click Apply to apply the changes to the system Chapter 3 Configuring Switching Information 73 GS716Tv2 and GS724Tv3 Software Administration Manual Link Aggregation Groups Link aggregation groups LAGs which are also known as port channels allow you to combine multiple full duplex Ethernet links into a single logical link Network devices treat the aggregation as if it were a single link whi
64. masks determines which bits are used and which bits are ignored A wild card mask of 255 255 255 255 indicates that no bit is important A wildcard of 0 0 0 0 indicates that all of the bits are important Wildcard masking for ACLs operates differently from a subnet mask A wildcard mask is in essence the inverse of a subnet mask For example to apply the rule to all hosts in the 192 168 1 0 24 subnet you type 0 0 0 255 in the Source IP Mask field This field is required when you configure a source IP address e DstL4 Port Requires a packets TCP UDP destination port to match the port listed here Complete one of the following fields Destination L4 Keyword Select the desired L4 keyword from a list of destination ports on which the rule can be based e Destination L4 Port Number If the destination L4 keyword is Other enter a user defined Port ID by which packets are matched to the rule e Service Type Choose one of the Service Type match conditions for the extended IP ACL rule The possible values are IP DSCP IP precedence and IP TOS which are alternative ways of specifying a match criterion for the same Service Type field in the IP header however each uses a different user notation After you select the service type specify the value associated with the type e IP DSCP Specify the IP DiffServ Code Point DSCP value The DSCP is defined as the high order six bits of the Service Type octet in the IP header Select an IP Chapter 5
65. network by a single port Forwarded message responses can overload network resources and or cause the network to time out The switch measures the incoming broadcast multicast unknown unicast packet rate per port and discards packets when the rate exceeds the defined value Storm control is enabled per interface by defining the packet type and the rate at which the packets are transmitted To display the Storm Control page click Security gt Traffic Control and then click the Storm Control link NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help 1000vr J Management Security Access Port Authentication gt MAC Filter Storm Control v Storm Control Port Security Storm Control gt Protected Ports Ingress Control Mode Disabie T l Status Threshold Port Settings GO TO INTERFACE Threshold To configure storm control settings 1 Select the check box next to the port to configure Select multiple check boxes to apply the same setting to all selected ports Select the check box in the heading row to apply the same settings to all ports 2 From the Ingress Control Mode menu select the mode of broadcast affected by storm control Chapter 5 Managing Device Security 177 GS716Tv2 and GS724Tv3 Software Administration Manual e Disable Do not use storm control e Unknown Unicast If the rate of unknown L2 unicast destination lookup failur
66. octets This object can be used as a reasonable estimate of ethernet utilization If greater precision is desired the etherStatsPkts and etherStatsOctets objects should be sampled before and after a common interval Packets Received 64 Octets The total number of packets including bad packets received that were 64 octets in length excluding framing bits but including FCS octets Packets Received 65 127 Octets The total number of packets including bad packets received that were between 65 and 127 octets in length inclusive excluding framing bits but including FCS octets Packets Received 128 255 Octets The total number of packets including bad packets received that were between 128 and 255 octets in length inclusive excluding framing bits but including FCS octets Packets Received 256 511 Octets The total number of packets including bad packets received that were between 256 and 511 octets in length inclusive excluding framing bits but including FCS octets Packets Received 512 1023 Octets The total number of packets including bad packets received that were between 512 and 1023 octets in length inclusive excluding framing bits but including FCS octets Packets Received 1024 1518 Octets The total number of packets including bad packets received that were between 1024 and 1518 octets in length inclusive excluding framing bits but including FCS octets Packets Received 152
67. of the CST last changed The number of times the topology has changed for the CST Topology Change The value of the topology change parameter for the switch indicating if a topology change is in progress on any port assigned to the CST The value is either True or False Designated Root The bridge identifier of the root bridge It is made up from the bridge priority and the base MAC address of the bridge Root Path Cost Path cost to the Designated Root for the CST Root Port Port to access the Designated Root for the CST Max Age secs Specifies the bridge maximum age for CST The value must be less than or equal to 2 X Bridge Forward Delay 1 and greater than or equal to 2 X Bridge Hello Time 1 Forward Delay secs Derived value of the Root Port Bridge Forward Delay parameter Hold Time secs Minimum time between transmission of Configuration BPDUs CST Regional Root Priority and base MAC address of the CST Regional Root CST Path Cost Path Cost to the CST tree Regional Root Click Refresh to update the information on the screen with the most current data CST Configuration Use the Spanning Tree CST Configuration page to configure Common Spanning Tree CST and Internal Spanning Tree on the switch To display the Spanning Tree CST Configuration page click Switching gt STP gt Advanced gt CST Configuration Chapter 3 Configuring Switchi
68. or download a switch configuration file and upgrade the switch firmware Configuration Upload and Download When you make changes to the switch the configuration information is stored in a file on the switch You can backup the configuration by uploading the configuration file from the switch to an administrative system You can download a saved configuration file from the administrative system to the switch The configuration file you download to the switch overwrites the running configuration on the switch Configuration upload and download is useful if you want to save a copy of the current switch configuration Upload Configuration before you make changes If you do not like the changes you can use the Download Configuration option to restore the switch to the settings in the saved configuration file To save a copy of the current switch configuration on your administrative system 1 Click the Maintenance tab and select the device with the configuration to save 2 Click Upload Configuration 3 From the Browse for Folder window that appears navigate to and select the folder where you want to store the configuration file Chapter 1 Getting Started 19 GS716Tv2 and GS724Tv3 Software Administration Manual Bj SmartControlCenter NETGEAR Network Maintenance Tasks QUIT I Firmware Device Maintenance Product MAC Address IP Address System Location once Subnet Mask Fem Ww 51098Tv2 00 24 b 2 53 96 Inabled 255 255 255
69. other reason Use the buttons at the bottom of the page to perform the following actions e Click Clear Counters to reset all statistics to their default value e Click Refresh to update the page with the most current information Configuring TACACS TACACS provides a centralized user management system while still retaining consistency with RADIUS and other authentication processes TACACS provides the following services e Authentication Provides authentication during login and via user names and user defined passwords e Authorization Performed at login When the authentication session is completed an authorization session starts using the authenticated user name The TACACS server checks the user privileges 156 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual The TACACS protocol ensures network security through encrypted protocol exchanges between the device and TACACS server The TACACS folder contains links to the following features e Configuring TACACS on page 156 e TACACS Server Configuration on page 157 TACACS Configuration The TACACS Configuration page contains the TACACS settings for communication between the switch and the TACACS server you configure via the inband management port To display the TACACS Configuration page click Security gt Management Security and then click the TACACS gt TACACS Configuration link NETGEAR GS724T
70. packets sent to this server This number does not include retransmissions Access Retransmissions The number of RADIUS Access Request packets retransmitted to this server Access Accepts The number of RADIUS Access Accept packets including both valid and invalid packets that were received from this server Access Rejects The number of RADIUS Access Reject packets including both valid and invalid packets that were received from this server Access Challenges The number of RADIUS Access Challenge packets including both valid and invalid packets that were received from this server Malformed Access Responses The number of malformed RADIUS Access Response packets received from this server Malformed packets include packets with an invalid length Bad authenticators or signature attributes or unknown types are not included as malformed access responses Bad Authenticators The number of RADIUS Access Response packets containing invalid authenticators or signature attributes received from this server Pending Requests The number of RADIUS Access Request packets destined for this server that have not yet timed out or received a response Timeouts The number of authentication timeouts to this server Unknown Types The number of RADIUS packets of unknown type which were received from this server on the authentication port Packets Dropped The number of RADIUS packets recei
71. port 2 If the packet leaves port 1 or port 2 it is stripped of its tag to leave the switch as an untagged packet e Ifan untagged packet enters port 4 the switch tags it with VLAN ID 20 The packet has access to port 5 and port 6 The outgoing packet is stripped of its tag to become an untagged packet as it leaves port 6 For port 5 the outgoing packet leaves as a tagged packet with VLAN ID 20 Appendix B Configuration Examples 251 GS716Tv2 and GS724Tv3 Software Administration Manual Access Control Lists ACLs ACLs ensure that only authorized users have access to specific resources while blocking off any unwarranted attempts to reach network resources ACLs are used to provide traffic flow control restrict contents of routing updates decide which types of traffic are forwarded or blocked and provide security for the network ACLs are normally used in firewall routers that are positioned between the internal network and an external network such as the Internet They can also be used on a router positioned between two parts of the network to control the traffic entering or exiting a specific part of the internal network The added packet processing required by the ACL feature does not affect switch performance That is ACL processing occurs at wire speed Access lists are a sequential collection of permit and deny conditions This collection of conditions known as the filtering criteria is applied to each packet that is proces
72. port default priority value instead All packets arriving at the ingress of an untrusted port are directed to a specific CoS queue on the appropriate egress port s in accordance with the configured default priority of the ingress port This process is also used for cases where a trusted port mapping is unable to be honored such as when a non IP packet arrives at a port configured to trust the IP DSCP value To display the Basic CoS Configuration page click QoS Basic CoS Configuration 128 Chapter4 Configuring Quality of Service GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR GS724T 24 Port Gigabit Smart Switch GoS c ty Monitoring Maintenance Helg Logout v Basic CoS Configuration Cos Configuration CoS Configuration gt Advanced Global Interface gi Untrusted To configure global CoS settings 1 2 3 4 Select the Global radio button to configure the trust mode settings that apply to all interfaces Alternatively you can select the Interface radio button to apply trust mode settings to individual interfaces The per interface setting overrides the global settings Select the trust mode for all interfaces Global Trust Mode or the selected interface Interface Trust Mode This setting determines the type of CoS marking to trust when the frame enters the port e Untrusted Do not trust any CoS packet marking at ingress e 802 1p The eight priority tags that are speci
73. s 2 2 3 103 oo axo ss RO Eria nan a aed 196 IP Binding Table esos aer PRG ORPd bte ache ib CX REA 198 Table of Contents 5 GS716Tv2 and GS724Tv3 Software Administration Manual Chapter 6 Monitoring the System gc CH wae 200 Swich SfatlstiCs cue px dais dire hera E mediae em bd d Rage 201 Port Statistics 1 2 re d d e du aom vr he eq hg V Xp d du 203 Port Detailed Statisll68 4o coste pee edv 205 ui C 211 System LOQS i273 opIIRPe3vpPewebnprerbbhedadbag ped aegdndede 213 Memory LOGS c 29 2 5 oct aid ede REA HOD dde RU et a Ru o tard 214 FLASH Log Conligurationiae ic s siete eae E e tue dd 215 Server Log Configuration c lt x06 acca es hada Reda em ROR dc Rn 217 Wap LOGS cms 219 EVentlbo9S us s timid dcus ard Rea Rio Roa Das abusi iR CA dita abd te Rua eens 220 Port MINONNG und rere E er Sud er PEE ee ede be ese 222 Multiple Port MIFEOBIIL5 diss icd e ace e Baan RR dedos 222 Chapter 7 Maintenance PCI TERRENI TE EE DU EUREN 226 D vice Reboot osse pereo d OR I eA gears 226 Factory Default ieu cexie dee a dE a eoo GR nd ide So dodid 226 Upload File From SWIC oed eR DE E RODA TS IRR Ia 228 Download File TO SWIIGB 5 xa bend 6 5 baa Seba aes WR CASS d due 230 TFTP File Download xh ribama RERO etn SUR dre he 230 ATTA File Dowhload 2232 aarre eiaa UR ehe 444 RP E PP ESSA 232 File Managemmeljt civic ons rarita ATENE Ge PPAR ai I CUR URS ahaa 234 Dual
74. successful login displays the information you need to configure an SNMP manager to access the switch Any user can connect to the switch using the SNMPv3 protocol but for authentication and encryption the switch supports only one user which is admin therefore there is only one profile that can be created or modified To configure authentication and encryption settings for the SNMPv3 admin profile by using the Web interface 1 Navigate to the System gt SNMP gt SNMPv3 gt User Configuration page 2 To enable authentication select an Authentication Protocol option which is either MD5 or SHA 3 To enable encryption select the DES option in the Encryption Protocol field Then enter an encryption code of eight or more alphanumeric characters in the Encryption Key field 4 Click Apply To access configuration information for SNMPv1 or SNMPv2 click System gt SNMP gt SNMPv1 v2 and click the page that contains the information to configure 28 Chapter 1 Getting Started GS716Tv2 and GS724Tv3 Software Administration Manual Interface Naming Convention The switch supports physical and logical interfaces Interfaces are identified by their type and the interface number The physical ports are gigabit interfaces and are numbered on the front panel You configure the logical interfaces by using the software The following table describes the naming convention for all interfaces available on the switch Interfa
75. the LAG as if it were a single link To access the LAG Configuration page click Switching gt LAG gt Basic gt LAG Configuration NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help t690u VLAN Voice VLAN Auto VolP 114 Multcast Address Tobie Basic LAG Configuration LAG Configuration LAG Configuration LAG Membership Active Lag Name Description Link Trap Admin Mode STP Mode LAG Type LAG state gt Advanced Ports To configure LAG settings 1 Select the check box next to the LAG to configure You can select multiple LAGs to apply the same setting to the selected interfaces Select the check box in the heading row to apply the same settings to all interfaces 2 Configure or view the following settings e LAG Name Specify the name you want assigned to the LAG You may enter any string of up to 15 alphanumeric characters A valid name has to be specified in order to create the LAG e Description Specify the Description string to be attached to a LAG It can be up to 64 characters in length e LAG ID Displays the number assigned to the LAG This field is read only e Link Trap Specify whether you want to have a trap sent when link status changes The factory default is Disable which will cause the trap to be sent e Admin Mode Select Enable or Disable from the menu When the LAG port channel is disabled no traffic will flow and LAC
76. the popup message to confirm If the Management VLAN is set to a non default VLAN VLAN 1 it is automatically set to 1 after a Reset Configuration VLAN Membership Configuration Use this page to configure VLAN Port Membership for a particular VLAN You can select the Group operation through this page Chapter 3 Configuring Switching Information 81 GS716Tv2 and GS724Tv3 Software Administration Manual To display the VLAN Membership Configuration page click Switching gt VLAN gt Advanced gt VLAN Membership NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching Securit Monitoring Maintenance Help tocouT Voice VLAN Avto VolP STP Multicos Address Toble gt Basic VLAN Membership v Advanced VLAN VLAN Membership Configuration METER x Croup Operation gt V E VLAN VLAN Name UNTAGGED PORT MEMBERS Membership gt Port PVID VLAN Type AGGED PORT MEMBERS Configuration Pot i 2 3 4 5 6 7 8 9 1011 12 13 14 15 16 17 18 19 20 21 22 23 24 To configure VLAN membership 1 From the VLAN ID field select the VLAN to which you want to add ports 2 Click the orange bar below the VLAN Type field to display the physical ports on the switch 3 Click the lower orange bar to display the LAGs on the switch 4 To select the port s or LAG s to add to the VLAN click the square below each port or LAG You can add each interface as a tagged T or untagged U VLAN member A blank square means that
77. the product unless expressly approved by NETGEAR Inc could void the user s right to operate the equipment Canadian Department of Communications Radio Interference Regulations This digital apparatus ProSafe GS716T and 724T Gigabit Smart Switches does not exceed the Class B limits for radio noise emissions from digital apparatus as set out in the Radio Interference Regulations of the Canadian Department of Communications Canada ID 4054A FVX538 Appendix C Notification of Compliance 271 Index Numerics 802 1X 151 168 example configuration 260 A access control ACL example configuration 252 ACLs 183 management interface 161 authentication 802 1X 168 260 enable 28 list 159 port based 168 RADIUS 151 153 SNMP 28 50 51 TACACS 156 Auto Video 109 C certificate 163 changing the password 19 150 Configuration 802 1X 168 Access Control Lists 183 Access Profile 165 Access Rule 166 Authentication List 159 Class 137 Community 48 CoS 128 DHCP Filtering 65 Differentiated Services 135 Diffserv 136 DNS 43 Dual Image 234 Dynamic Address 124 Dynamic Host 45 Global 110 Green Ethernet 46 HTTP 161 IGMP Snooping 110 LACP 77 LACP Port 78 LAG 75 LLDP 52 MAC Filter 175 Management Access 161 MST Port 104 Network Settings on the Administrative System 16 password 150 Policy 140 Port Security 178 Port VLAN ID 83 RADIUS 151 Global 151 Secure HTTP 162 SNMP v3 User 51 SNTP Server 39 Sta
78. to effectively use the links across the switch The same concept can be extended to other switches and more instances of MSTP 266 Appendix B Configuration Examples GS716Tv2 and GS724Tv3 Software Administration Manual Appendix B Configuration Examples 267 Notification of Compliance NETGEAR Wired Products Certificate of the Manufacturer Importer It is hereby certified that the ProSafe GS716T and 724T Gigabit Smart Switches has been suppressed in accordance with the conditions set out in the BMPT AmtsblVfg 243 1991 and Vfg 46 1992 The operation of some equipment for example test transmitters in accordance with the regulations may however be subject to certain restrictions Please refer to the notes in the operating instructions The Federal Office for Telecommunications Approvals has been notified of the placing of this equipment on the market and has been granted the right to test the series for compliance with the regulations Best tigung des Herstellers Importeurs Es wird hiermit best tigt daR das ProSafe GS716T and 724T Gigabit Smart Switches gem der im BMPT AmtsblVfg 243 1991 und Vfg 46 1992 aufgef hrten Bestimmungen entst rt ist Das vorschriftsmakige Betreiben einiger Ger te z B Testsender kann jedoch gewissen Beschrankungen unterliegen Lesen Sie dazu bitte die Anmerkungen in der Betriebsanleitung Das Bundesamt f r Zulassungen in der Telekommunikation wurde davon unterrichtet da dies
79. to view information about the SNMP traps generated on the switch To access the Trap Logs page click the Monitoring Logs tab and then click the Trap Logs link NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help Logout gt Memory Log Trap Logs gt FLASH Log gt Server Log Trap Logs v Trap Logs Number of Traps Since Last Reset gt Event Logs Trap Log Capacity 256 Number of Traps Since Log Last Viewed 2 Trap Logs Log System Up Time Trap 0 days 00 00 35 Cold Start Unt 0 1 0 days 00 00 23 Link Up g9 lt gt CLEAR REFRESH The following table describes the Trap Log information displayed on the screen Field Description Number of Traps Since The number of traps that have occurred since the switch last reboot Last Reset Trap Log Capacity The maximum number of traps stored in the log If the number of traps exceeds the capacity the entries will overwrite the oldest entries Number of Traps Since The number of traps that have occurred since the traps were last displayed Log Last Viewed Displaying the traps by any method such as terminal interface display Web display or upload file from switch will cause this counter to be cleared to 0 The page also displays information about the traps that were sent Chapter 6 Monitoring the System 219 GS716Tv2 and GS724Tv3 Software Administration Manual Field D
80. to which the rule will apply To set up a new MAC ACL use the MAC ACL page 2 To add a new rule enter an ID for the rule configure the following settings and click Add e Action Specify what action should be taken if a packet matches the rule s criteria e Permit Forwards packets that meet the ACL criteria 186 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual e Deny Drops packets that meet the ACL criteria e Assign Queue Specifies the hardware egress queue identifier used to handle all packets matching this ACL rule Enter an identifying number from 0 3 in this field e Redirect Interface Specifies the specific egress interface where the matching traffic stream is forced bypassing any forwarding decision normally performed by the device e Match Every Requires a packet to match the criteria of this ACL Select True or False from the drop down menu Match Every is exclusive to the other filtering rules so if Match Every is True the other rules on the screen are not available e CoS Requires a packet s class of service CoS to match the CoS value listed here Enter a CoS value between 0 7 to apply this criteria e Secondary CoS Requires a packet s secondary 802 1p priority value which is the dot1p value in the secondary i e inner tag of a double tagged packet to match the value specified in this field e CPU Notification Mode This field is configurable only when the
81. using best effort Traffic with a higher priority such as 3 might be time sensitive traffic such as voice or video The values in each drop down menu represent the traffic class The traffic class is the hardware queue for a port Higher traffic class values indicate a higher queue position Before traffic in a lower queue is sent it must wait for traffic in higher queues to be sent Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch If you make changes to the page click Apply to apply the changes to the system DSCP to Queue Mapping Use the DSCP to Queue Mapping page to specify which internal traffic class to map the corresponding DSCP value To display the IP DSCP Mapping page click QoS gt CoS gt Advanced gt DSCP to Queue Mapping Chapter 4 Configuring Quality of Service 133 GS716Tv2 and GS724Tv3 Software Administration Manual GS724T 24 Port Gigabit Smart Switch NETGEAR onnect ww banc System Switching QoS Security Monitoring Maintenonce Help gt Basic DSCP to Queue Mapping v Advanced CoS Configuration CoS Interface Configuartion Interface Queue Configuration 802 1p to Queue Mapping DSCP to Queue DSCP to Queue Mapping Glass Selector CS PHB DscP cso 000000 Queve DSCP csi 001000 css 101000 Assured Forwarding AF PHB DSCP Queue 001010 AF 12 001100 AF 13
82. value in the range of 0 240 e Port Path Cost Set the Path Cost to a new value for the specified port in the selected MST instance It takes a value in the range of 1 200000000 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch If you make any configuration changes click Apply to send the updated configuration to the switch Configuration changes take place immediately The following table describes the read only MST port configuration information displayed on the Spanning Tree CST Configuration page Field Description Auto calculated Port Path Displays whether the path cost is automatically calculated Enabled or not Cost Disabled Path cost is calculated based on the link speed of the port if the configured value for Port Path Cost is zero Port ID The port identifier for the specified port within the selected MST instance It is made up from the port priority and the interface number of the port Port Up Time Since Counters Time since the counters were last cleared displayed in Days Hours Last Cleared Minutes and Seconds 106 Chapter3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Port Mode Spanning Tree Protocol Administrative Mode associated with the port or port channel Possible values are Enable or Disable Port Forwarding State Indi
83. with Read Write privileges and status set to Enable e Public with Read Only privileges and status set to Enable These are well known communities Use this page to change the defaults or to add other communities Only the communities that you define using this page will have access to the switch using the SNMPv1 and SNMPv2c protocols Only those communities with read write level access can be used to change the configuration using SNMP Use this page when you are using the SNMPv1 and SNMPv2c protocol NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help i Logout v SNMP V1 V2 Community Configuration Community Configuration Community Configuration Trap Management Management Access Configuration Station IP Station IP Mask Mode 0 0 0 0 0 0 0 0 Status gt SNMP V3 ReadOnly Enable ReadWrte Enable To configure SNMP communities 1 To add a new SNMP community enter community information in the available fields described below and then click Add Management Station IP Specify the IP address of the management station Together the Management Station IP and the Management Station IP Mask denote a range of IP addresses from which SNMP clients may use that community to access this device If either Management Station IP or Management Station IP Mask value is 0 0 0 0 access is allowed from any IP address Otherwise every client s address is ANDed with th
84. x Rx 0 Min Max Avg RTT 0 0 0 msec Traceroute Use the Traceroute utility to discover the paths that a packet takes to a remote destination To display this page click Maintenance Troubleshooting Traceroute NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS jecurity Monitoring Maintenance Help soGour Rosat Uplood Downlood File Monogement TraceRoute Traceroute Mostname raid Address Probes Per Hop Max TTL Test TTL Maxfail Interval Port Size To configure the Traceroute settings and send probe packets to discover the route to a host on the network 1 In the Hostname IP Address field specify the IP address or the hostname of the station you want the switch to ping The initial value is blank This information is not retained across a power cycle 2 Optionally configure the following settings e Probes Per Hop Specify the number of times each hop should be probed The valid range is 1 10 e MaxTTL Specify the maximum time to live for a packet in number of hops The valid range is 1 255 e nitTTL Specify the initial time to live for a packet in number of hops The valid range is 0 255 238 Chapter7 Maintenance GS716Tv2 and GS724Tv3 Software Administration Manual e MaxFail Specify the maximum number of failures allowed in the session The valid range is 0 255 e Interval Specify the time between probes in seconds The valid range is 1 60 e Port Sp
85. 0 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual 7 f you make changes to the page click Apply to apply the changes to the system Security MAC Address Use the Security MAC Address page to convert a dynamically learned MAC address to a statically locked address To display the Security MAC Address page click Security Traffic Control and then click the Port Security gt Security MAC Address link 24 Port Gigabit Smart Switch NETGEAR GS724T System Switching QoS Securit Monitoring Maintenance Help tocour y Y 8 F Baattin Management Security Access Port Authentication ge Y gt MAC Filter Security MAC Address gt Storm Control v Port Security Port Security Settings Port Security Convert Dynamic Address to Static o Configurabon Number of Dynamic MAC Addresses Learned Interface Configuration Security MAC Address Poet List gi Dynamic MAC Address Table AIRES To convert learned MAC addresses 1 Select the Convert Dynamic Address to Static check box 2 Click Apply The Dynamic MAC Address entries are converted to Static MAC address entries in a numerically ascending order until the Static limit is reached The Dynamic MAC Address Table shows the MAC addresses and their associated VLANs learned on the selected port Use the Port List menu to select the interface for which you want to display data Field Description VLAN I
86. 2 Enter the DNS default domain name to include in DNS queries When the system is performing a lookup on an unqualified hostname this field is provided as the domain name for example if default domain name is netgear com and the user enters test then test is changed to test netgear com to resolve the name 3 To specify the DNS server to which the switch sends DNS queries enter an IP address in standard IPv4 dot notation in the DNS Server Address and click Add The server appears in the list below You can specify up to eight DNS servers The precedence is set in the order created 4 To remove a DNS server from the list select the check box next to the server you want to remove and click Delete If no DNS server is specified the check box is global and will delete all the DNS servers listed 5 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 6 Click Apply to send the updated configuration to the switch Configuration changes take effect immediately Host Configuration Use this page to manually map host names to IP addresses or to view dynamic DNS mappings To access this page click System gt Management gt DNS gt Host Configuration 44 Chapter2 Configuring System Information GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help t
87. 2 Octets The total number of packets received that were in excess of 1522 octets excluding framing bits but including FCS octets and were otherwise well formed Total Packets Received Without Errors The total number of packets received that were without errors Chapter 6 Monitoring the System 207 GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Unicast Packets Received The number of subnetwork unicast packets delivered to a higher layer protocol Multicast Packets Received The total number of good packets received that were directed to a multicast address This number does not include packets directed to the broadcast address Broadcast Packets Received The total number of good packets received that were directed to the broadcast address This does not include multicast packets Total Packets Received with MAC Errors The total number of inbound packets that contained errors preventing them from being deliverable to a higher layer protocol Jabbers Received The total number of packets received that were longer than 1518 octets excluding framing bits but including FCS octets and had either a bad Frame Check Sequence FCS with an integral number of octets FCS Error or a bad FCS with a non integral number of octets Alignment Error This definition of jabber is different than the definition in IEEE 802 3 section 8 2 1 5 10BASE5 and sectio
88. 2 0 network with an IP source address from the 192 12 1 0 network that have a Layer 4 Source port of 4567 and Destination port of 4568 from this switch on ports 7 and 8 are assigned to hardware queue 3 On this network traffic from streaming applications uses UDP port 4567 as the source and 4568 as the destination This real time traffic is time sensitive so it is assigned to a high priority hardware queue By default data traffic uses hardware queue 0 which is designated as a best effort queue Also the confirmed action on this flow is to send the packets with a committed rate of 1000000 Kbps and burst size of 128 KB Packets that violate the committed rate and burst size are dropped Appendix B Configuration Examples 259 GS716Tv2 and GS724Tv3 Software Administration Manual 802 1X Local Area Networks LANs are often deployed in environments that permit unauthorized devices to be physically attached to the LAN infrastructure or permit unauthorized users to attempt to access the LAN through equipment already attached In such environments it may be desirable to restrict access to the services offered by the LAN to those users and devices that are permitted to use those services Port based network access control makes use of the physical characteristics of LAN infrastructures in order to provide a means of authenticating and authorizing devices attached to a LAN port that has point to point connection characteristics and of preven
89. 2 1X settings for the port 170 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual 1 Select the check box next to the port to configure You can also select multiple check boxes to apply the same settings to the select ports or select the check box in the heading row to apply the same settings to all ports 2 For the selected port s specify the following settings Port Control Defines the port authorization state The control mode is only set if the link status of the port is link up The possible field values are e Auto Automatically detects the mode of the interface e Authorized Places the interface into an authorized state without being authenticated The interface sends and receives normal traffic without client port based authentication e Unauthorized Denies the selected interface system access by moving the interface into unauthorized state The switch cannot provide authentication services to the client through the interface Guest VLAN ID This field allows the user to configure the Guest VLAN ID on the interface The valid range is 0 4093 The default value is 0 Enter 0 to reset the Guest VLAN ID on the interface Guest VLAN Period This input field allows the user to enter the Guest VLAN period for the selected port The Guest VLAN period is the value in seconds of the timer used by the Guest VLAN Authentication The Guest VLAN timeout must be a value in the range of
90. 5 multicast destination 115 rules 186 searching address table 122 Static Address 125 MD5 36 MIBs 28 N navigation 25 O OUI 88 P password change 19 150 login 150 Ping 237 port authentication 168 summary 173 Q QoS 127 802 1p to Queue Mapping 132 Index 273 R RADIUS 150 server 151 statistics 153 reboot 19 226 reset button 151 configuration to defaults 226 switch 226 RSTP 93 S Security MAC Address 181 server HTTP 161 severity log message 216 Simple Network Time Protocol 35 SNMP traps 49 using 28 v1 v2 47 v3 51 SNTP 35 Global Status 38 global status 38 server configuration 39 server status 40 specifications 244 SSL 162 storm control 177 STP 93 example configuration 263 Status 93 Stratum 0 35 135 235 T T1 36 T2 36 T3 36 T4 36 TACACS folder 157 settings 157 technical support 2 Time configure through SNTP 37 UTC 38 time 35 GS716Tv2 and GS724Tv3 Software Administration Manual clock source 37 levels 35 local 37 zone 37 TraceRoute 238 trademarks 2 traffic control 174 trap flags 50 manager 50 U Unicast 36 upload configuration 228 V VLAN 80 example configuration 250 guest 169 171 260 ID 80 management 34 managing 80 Port VLAN ID 83 PVID 83 voice 86 Voice VLAN OUI 88 VoIP 90 92 W Web interface panel 24 274 Index GS716Tv2 and GS724Tv3 Software Administration Manual Index 275
91. 6Tv2 and GS724Tv3 Software Administration Manual 3 In the Guest VLAN field for ports e1 e8 enter 150 to assign these ports to the guest VLAN You can configure additional settings to control access to the network through the ports See Port Security Interface Configuration on page 179 for information about the settings 4 Click Apply 5 From the 802 1X Configuration screen set the Port Based Authentication State and Guest VLAN Mode to Enable and then click Apply See Port Security Configuration on page 178 This example uses the default values for the port authentication settings but there are several additional settings that you can configure For example the EAPOL Flood Mode field allows you to enable the forwarding of EAPoL frames when 802 1X is disabled on the device 6 From the RADIUS Server Configuration screen configure a RADIUS server with the following settings e Server Address 192 168 10 23 e Secret Configured Yes e Secret secret123 e Active Primary For more information see RADIUS Configuration on page 151 7T Click Add 8 From the Authentication List screen configure the default List to use RADIUS as the first authentication method See Authentication List Configuration on page 159 This example enables 802 1X based port security on the GS716T or GS724T switch and prompts the hosts connected on ports e1 e8 for an 802 1X based authentication The switch passes the authentication information to the
92. 9 and 1522 octets in length inclusive excluding framing bits but including FCS octets Total Packets Transmitted Successfully The number of frames that have been transmitted by this port to its segment Unicast Packets Transmitted The total number of packets that higher level protocols requested be transmitted to a subnetwork unicast address including those that were discarded or not sent Multicast Packets Transmitted The total number of packets that higher level protocols requested be transmitted to a Multicast address including those that were discarded or not sent Chapter 6 Monitoring the System 209 GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Broadcast Packets Transmitted The total number of packets that higher level protocols requested be transmitted to the Broadcast address including those that were discarded or not sent Total Transmit Errors The sum of Single Multiple and Excessive Collisions Tx FCS Errors The total number of packets transmitted that had a length excluding framing bits but including FCS octets of between 64 and 1518 octets inclusive but had a bad Frame Check Sequence FCS with an integral number of octets Tx Oversized The total number of frames that exceeded the max permitted frame size This counter has a max increment rate of 815 counts per second at 10 Mb s Underrun Errors The total num
93. 97 e CST Port Status on page 99 e Rapid STP on page 102 e MST Configuration on page 103 e MST Port Configuration on page 104 e STP Statistics on page 107 STP Switch Configuration The Spanning Tree Switch Configuration Status page contains fields for enabling STP on the switch To display the Spanning Tree Switch Configuration Status page click Switching STP Basic STP Configuration Chapter 3 Configuring Switching Information 93 NETGEAR Switching VLAN Voice VIAN v Basic STP Configuration STP Configuration gt Advanced Global Settings Spanning Tree State STP Operation Mode Configuration Name Configuration Revision Level Configuration Digest Key BPDU Flooding Auto VolP Multicast GS716Tv2 and GS724Tv3 Software Administration Manual GS724T 24 Port Gigabit Smart Switch Maintenance LOGOUT Address Table Disable Enable Ose Oaste 00 00 00 01 15 FF 0 0xac36177150283c44b58382148ab26de62 All x Disable Enable STP Status Bridge Identifier Time Since Topology Change Topology Change Count Topology Change Designated Root Root Path Cost Root Port Max Age secs Forward Delay secs Hold Time secs CST Regional Root CST Path Cost REFRESH To configure STP settings on the switch 1 2 From the Spanning Tree State field specify whether to enable or disable Spanning Tree operation on the switch From the STP Operation Mode field Specifies th
94. ACP Configuration LACP Configuration Configuration z LACP System Priority LAG Membership LACP Configuration LACP Port Configuration REFRESH To configure LACP 1 From the LACP System Priority field specify the device s link aggregation priority relative to the devices at the other ends of the links on which link aggregation is enabled A higher value indicates a lower priority You can change the value of the parameter globally by specifying a priority from 0 65535 The default value is 32768 2 Click Refresh to reload the page and display the most current information Chapter 3 Configuring Switching Information 77 GS716Tv2 and GS724Tv3 Software Administration Manual 3 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 4 If you make any changes to this page click Apply to send the updated configuration to the switch Configuration changes take effect immediately LACP Port Configuration To display the LACP Port Configuration page click Switching LAG Advanced LACP Port Configuration NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help tocour VLAN Voice VLAN Avto VolP 5 LEE T Address Table LACP Port Configuration LACP Port Priority Configurabon LAG Membership LACP Interface LACP Priority Timeout GO TO INTERFACE Configuration LAC
95. C Address 00 00 00 01 16 01 Osadle MAC Address 00 00 00 01 16 01 Cable MAC Address 00 00 00 01 16 01 Owadle MAC Address 00 00 00 01 16 01 Disable MAC Address 00 00 00 01 16 01 Disable gt REFRESH The following table describes the LLDP local information that displays for each port Field Description Interface Select the interface with the information to display Port ID Subtype Identifies the type of data displayed in the Port ID field Port ID Identifies the physical address of the port Port Description Identifies the user defined description of the port To configure the Port Description see Ports on page 70 Advertisement Displays the advertisement status of the port 58 Chapter 2 Configuring System Information GS716Tv2 and GS724Tv3 Software Administration Manual Click Refresh to refresh the page with the most current data from the switch To view additional details about a port click the name of the port in the Interface column of the Port Information table A popup window displays information for the selected port Port Information Managed Address Address SubType Address Interface SubType Interface Number MAC PHY Details Auto Negotiation Supported True Auto Negotiation Enabled True Auto Negotiation Advertised Capabilities Operational MAU Type Unkno other MED Details Capabilities Supported Capabilities Network Current Capabilities Capabilties Network Devic
96. Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch Trap Configuration This page displays an entry for every active Trap Receiver To access this page click System SNMP SNMP V1 V2 Trap Configuration NETGEAR GS724T 24 Port Gigabit Senart Switch Monitoring Maintenance gt l Logout v SNMP V1 V2 Trap Configuration Community Configuration Trap Configuration Trap Recipients IP Version Community String Status i 4 Configuration T c d Trap flags gt SNMP V3 To configure SNMP trap settings 1 To add a host that will receive SNMP traps enter trap configuration information in the available fields described below and then click Add Recipients IP The address in x x x x format to receive SNMP traps from this device Version The trap version to be used by the receiver from the menu e SNMP v1 Uses SNMP v1 to send traps to the receiver SNMP v2 Uses SNMP v2 to send traps to the receiver Community String The community string for the SNMP trap packet to be sent to the trap manager This may be up to 16 characters and is case sensitive Status Select the receiver s status from the menu e Enable Send traps to the receiver e Disable Do not send traps to the receiver Chapter 2 Configuring System Information 49 GS716Tv2 and GS724Tv3 Software Administration Manual 2 To modify information about an existing SN
97. Configuration Configuration HTTPS Admin Mode Certificate Download gt Access Control SSL Version 3 TLS Version 1 HTTPS Port HTTPS Session Soft Timeout Minutes HTTPS Session Hard Timeout Hours 24 Maximum Number of HTTPS Sessions 2 To configure HTTPS settings 1 Use the radio buttons in the HTTPS Admin Mode field to enable or disable the Administrative Mode of Secure HTTP 162 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual The currently configured value is shown when the Web page is displayed The default value is Disable You can only download SSL certificates when the HTTPS Admin mode is disabled 2 Usethe radio buttons in the SSL Version 3 field to enable or disable Secure Sockets Layer Version 3 0 The currently configured value is shown when the Web page is displayed The default value is Enable 3 Use the radio buttons in the TLS Version 1 field to enable or disable Transport Layer Security Version 1 0 The currently configured value is shown when the Web page is displayed The default value is Enable 4 Inthe HTTPS Port field specify the TCP port to use for HTTPS data The value must be in the range of 1 65535 Port 443 is the default value The currently configured value is shown when the Web page is displayed 5 In the HTTPS Session Soft Timeout field specify the number of minutes an HTTPS session can be idle before a timeout occurs After the s
98. D Displays the VLAN ID corresponding to the Last Violation MAC address MAC Address Displays the MAC addresses learned on a specific port Click Refresh to refresh the page with the most current data from the switch Protected Ports Membership If a port is configured as protected it does not forward traffic to any other protected port on the switch but it will forward traffic to unprotected ports Use the Protected Ports Membership page to configure the ports as protected or unprotected Chapter 5 Managing Device Security 181 GS716Tv2 and GS724Tv3 Software Administration Manual To display the Protected Ports Membership page click the Security gt Traffic Control gt Protected Ports link NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help 1000ur J Management Security Access Port Authentication ge y gt MAC Filter Protected Ports gt Storm Control gt Port Security Protected Ports Membership v Protected Ports Port 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 RURALI CANCEL To configure protected ports 1 Click the orange bar to display the available ports 2 Click the box below each port to configure as a protected port Protected ports are marked with an X No traffic forwarding is possible between two protected ports 3 Click Refresh to refresh the page with the most current data from the switch 4 Click Cancel to cancel t
99. D capabilities enabled on the port Current Capabilities Displays the TLVs advertised by the port Device Class Network Connectivity indicates the device is a network connectivity device Network Policies Application Type Specifies the media application type associated with the policy VLAN ID Specifies the VLAN ID associated with the policy VLAN Type Specifies whether the VLAN associated with the policy is tagged or untagged User Priority Specifies the priority associated with the policy DSCP Specifies the DSCP associated with a particular policy type Neighbors Information Use the LLDP Neighbors Information page to view the data that a specified interface has received from other LLDP enabled systems To display the LLDP Neighbors Information page click System LLDP Advanced Neighbors Information 60 Chapter2 Configuring System Information GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR System Switching Menogement Device View QoS Security GS724T 24 Port Gigabit Smart Switch Monitoring Maintenance Help gt Basic Neighbors Information Advanced LLOP Configuration LLDP Port Settings LLDP MED Network Policy LLDP MED Port Settings Local Information Newhdors Information Neighbors Information Local Chassis ID Chassis Port ID Port System Port Subtype Ip Subtype ID Name RE
100. Description Bridge Identifier The bridge identifier for the selected MST instance It is made up using the bridge priority and the base MAC address of the bridge Time Since Displays the total amount of time since the topology of the selected MST instance last Topology changed The time is displayed in hour minute second format for example 5 hours 10 Change minutes and 4 seconds Topology Displays the total number of times topology has changed for the selected MST instance Change Count Topology Indicates whether a topology change is in progress on any port assigned to the selected Change MST instance The possible values are True or False Designated Root Displays the bridge identifier of the root bridge which is made up from the bridge priority and the base MAC address of the bridge Root Path Cost Displays the path cost to the Designated Root for this MST instance Root Port Indicates the port to access the Designated Root for this MST instance MST Port Configuration Use the Spanning Tree MST Port Configuration page to configure and display Multiple Spanning Tree MST settings on a specific port on the switch To display the Spanning Tree MST Port Status page click Switching gt STP gt Advanced gt MST Port Configuration The following figure shows the Web page 104 Chapter3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual
101. EAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help socourt Manogement Device View License v DHCP Filtering Configuration Configuration Interface Configuration Configuration Admin Mode Disable C Enable To configure global DHCP filtering settings 1 In the Admin Mode field select Enable or Disable to turn the DHCP Filtering feature on or off 2 Click Apply to apply the change to the system Configuration changes take effect immediately 3 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch Chapter 2 Configuring System Information 65 GS716Tv2 and GS724Tv3 Software Administration Manual Interface Configuration Use the DHCP Filtering Interface Configuration page to view and configure each port as a trusted or untrusted port Any DHCP responses received on a trusted port are forwarded If a port is configured as untrusted any DHCP or BootP responses received on that port are discarded To access the DHCP Filtering Interface Configuration page click System Services DHCP Filtering gt Interface Configuration 24 Port Gigabit Smart Switch NETGEAR GS724T System Switching QoS Security Monitoring Maintenance Help 1060vr Management Device View v DHCP Filtering Interface Configuration Configuration Interface Interface Configuration Configuration PORTS
102. EU p hin uetele ja nimetatud direktiivist tulenevatele teistele asjakohastele s tetele English Hereby NETGEAR Inc declares that this Radiolan is in compliance with the essential requirements and other relevant provisions of Directive 1999 5 EC Espa ol Por medio de la presente NETGEAR Inc declara que el Radiolan cumple con los Spanish requisitos esenciales y cualesquiera otras disposiciones aplicables o exigibles de la Directiva 1999 5 CE EAAnviKh ME THN MAPOY2A NETGEAR Inc AHAONEI OTI Radiolan 2YMMOP ONETAI Greek NPOZ TIZ OYZIOAEIZ ANAITHZEIZ KAI TIZ AOINES ZXETIKEZ AIATA EIZ TH OAHTIAZ 1999 5 EK Fran ais Par la pr sente NETGEAR Inc d clare que l appareil Radiolan est conforme aux French exigences essentielles et aux autres dispositions pertinentes de la directive 1999 5 CE Italiano Italian Con la presente NETGEAR Inc dichiara che questo Radiolan conforme ai requisiti essenziali ed alle altre disposizioni pertinenti stabilite dalla direttiva 1999 5 CE Latviski Ar o NETGEAR Inc deklar ka Radiolan atbilst Direkt vas 1999 5 EK b tiskaj m Latvian pras b m un citiem ar to saist tajiem noteikumiem Lietuvi iuo NETGEAR Inc deklaruoja kad is Radiolan atitinka esminius reikalavimus ir Lithuanian kitas 1999 5 EB Direktyvos nuostatas Nederlands Hierbij verklaart NETGEAR Inc dat het toestel Radiolan in overeenstemming is Dutch met de essenti le eisen en de andere relevante bepalingen van r
103. FRESH 10c0v w The following table describes the information that displays for all LLDP neighbors that have been discovered Field Description MSAP Entry Displays the Media Service Access Point MSAP entry number for the remote device Local Port Displays the interface on the local system that received LLDP information from a remote system Chassis ID Subtype Chassis ID Identifies the type of data displayed in the Chassis ID field on the remote system Identifies the remote 802 LAN device s chassis Port ID Subtype Identifies the type of data displayed in the remote system s Port ID field Port ID Identifies the physical address of the port on the remote system from which the data was sent System Name Identifies the system name associated with the remote device If the field is blank the name might not be configured on the remote system Click Refresh to update the information on the screen with the most current data To view additional information about the remote device click the link in the MSAP Entry field A popup window displays information for the selected port Chapter 2 Configuring System Information 61 Neighbors Information Port Details Local Port MSAP Entry Basic Details Chassis ID SubType MAC Address Chassis ID 00 14 6C 34 5F 4F Port ID SubType MAC Address GS716Tv2 and GS724Tv3 Software Administration Manual MED Details
104. February 2012 Changed Appendix A Port Trunking specification 2 for GS716T 4 for GS724T Table of Contents Chapter 1 Getting Started Getting Started with the GS716T and GS724T Gigabit Smart Switches 10 Switch Management Interface llli eese 11 Connecting the Switch to the Network lslsselseeeseeeese 12 Switch Discovery in a Network with a DHCP Server 13 Switch Discovery in a Network without a DHCP Server 15 Configuring the Network Settings on the Administrative System 16 WED ACCESS serea sa dreeooeo4RRS CERO RR eh qu er aep pp 18 Smart Control Center Utilities ossium meme 19 Network DU TtIOS 222 rieres unt COE nthe een ERU UR d 19 Configuration Upload and Download 22 200000 19 Firmware Upgrade 25 rem tte ee qs 21 Viewing and Managing Tasks lisse 23 Understanding the User Interfaces 0 000 cee eee 24 Using the Web Interface oc ete oer eR bh cee 24 Using SNMP i isod enm Gaede oo EE der rete dete eed 28 Interface Naming Convention cssc ehe Rm bear ER 29 Chapter 2 Configuring System Information Management 2222s pube re rer rer PRESA I PAP sei EP dq 32 System literatura cu as cio og Rb eU rt ew Gini RERO RR Rhea dg ui E 32 IP COPTIG Fat lol cssc aiuto ro aa eas tae Rod e pe ci obo 33 WMC ea ccr 35 Denial Ol SCVICE nosioo ho ROI DP RIE POR POP DR pP OPER 41 Blcferc c UTITUR 43 Green Ethernet Configuration
105. Filter Summary Use the MAC Filter Summary page to view the MAC filters that are configured on the system To display the MAC Filter Summary page click Security gt Traffic Control and then click the MAC Filter gt MAC Filter Summary link NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help 10G0v1 Monogement Security Access Port Authentication MAC Filter MAC Filter Summary MAC Filter Configuration MAC Filter Summary MAC Fiker MAC Address VLAN ID Source Port Members Destination Port Members Summary Storm Control Port Security Protected Ports lt gt REFRESH The following table describes the information displayed on the page Field Description MAC Address Identifies the MAC address that is filtered VLAN ID The VLAN ID used with the MAC address to fully identify packets you want filtered You can only change this field when you have selected the Create Filter option Source Port Members Displays the ports included in the inbound filter Destination Port Displays the ports included in the outbound filter Members Click Refresh to update the page with the most current information 176 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual Storm Control A broadcast storm is the result of an excessive number of broadcast messages simultaneously transmitted across a
106. GEAR Website To access the User Guide page click Help User Guide NETGEAR OPE Los System Switching QoS Security Monitoring Maintenance Help rosour User Guide User Guide Please cick APPLY below to view the Online User Guide To access to the User Guide that is available online click Apply 242 Chapter8 Help GS716Tv2 and GS724Tv3 Software Administration Manual Chapter8 Help 243 Hardware Specifications and Default Values GS716T and GS724T Gigabit Smart Switches Specifications The GS716T and GS724T Gigabit Smart Switches conform to the TCP IP UDP HTTP ICMP TFTP DHCP IEEE 802 1D IEEE 802 1p and IEEE 802 1Q standards GS716T Specifications Feature Value Interfaces 16 10 100 1000 Ethernet ports Flash memory size 16 MB SRAM size and type 64 MB DDR GS724AT Specifications Feature Value Interfaces 24 10 100 1000 Ethernet ports Two 1000M SFP Gigabit Ethernet ports Flash memory size 16 MB SRAM size and type 64 MB DDR Appendix A Hardware Specifications and Default Values 244 GS716Tv2 and GS724Tv3 Software Administration Manual GS716T and GS724T Switch Performance Feature Value Switching capacity Non Blocking Full WireSpeed on all packet sizes Forwarding method Store and Forward Packet forwarding rate 10M 14 880 pps 100M 148 810 pps 1G 1 488 000 pps MAC addresses 4K Green Ethernet Power c
107. GS716Tv2 and GS724Tv3 Software Administration Manual e Disabled Upon seeing another querier of the same version in the VLAN the snooping querier moves to the non querier state e Enabled The snooping querier participates in querier election in which the least IP address operates as the querier in that VLAN The other querier moves to non querier state e Snooping Querier VLAN Address Specify the Snooping Querier IP Address to be used as the source address in periodic IGMP queries sent on the specified VLAN 2 Click Apply to apply the new settings to the switch Configuration changes take effect immediately 3 To disable Snooping Querier on a VLAN select the VLAN ID and click Delete 4 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 5 Click Refresh to update the page with the latest information from the switch IGMP Snooping Querier VLAN Status Use this page to view the operational state and other information for IGMP snooping queriers for VLANs on the network To access this page click Switching Multicast IGMP Snooping Querier Querier VLAN Status NETGEAR GS724T 24 Port Gigabt Smart Switch System Switching QoS Security Monitoring Maintenance Help sogour Auto Video Querier VLAN Status IGMP Snooping IGMP Snooping Querier VLAN Status Querier Quener Last Last Operational Configuration Operational State Querter Q
108. H 161 Secure HTTP Configuration s lt aes ee he dene teh oni eps 162 Certificate Download 125 een proe krike ICA RR de 163 Access Profile Configuration 1 n n da 165 Access Rule Configuration x 9 3 sae Gia eod oe HER tt AEE Daa 166 Port Authentication s aduer avs seas irit tienen hat rU dod 168 802 TX Configura aa sirenes erit Enr Eoo d Paca SC Race aides 168 Port Autlientl glo 2 23 2 23 12991 212 ppp ren aneka i dd pravi 169 Port SUMMA rees qe dace ck e ioa Fade Ree PE Rcs dedo duds 173 Ti amp ffic Cono noit Lure RUP Y ER oe beste Hohe pede s 174 MAC Filter Configuration 3222 chases ee cone Oe T deeds 175 MAC Fiker SUMMEN n2 eodem Sect he tO heit teet 176 SOM COMMON acuta reda rae ce eoa o e ra dio ce oaa 177 Port Security Configuration ou aeo qo arro oer c ded qa 178 Port Security Interface Configuration llle 179 Security MAC Address RR ARR RR RA 181 Protected Ports Membership 20000 eee eeeee 181 Configuring Access Control Lists llli 183 ACLEWizand yasida tto antt eh ce cant Dee ae tee at rat o debe 183 MAGAGL c 184 MAC RUGS six idet D Door oe cech vb tee deoa 186 MAC Binding Configuration 22x RR RE REEF 188 MAC Binding Table 2 2322 rrr m RE ireke etd de Reina 189 IP AC 1e dude t deut ob Gane uU E e diuum etes ded oboe 190 IP RUGS i osito ehem bte tetto Ree eese Mei 191 IP Extended RUle uiu orae rie RE Re al sede pb dap 193 IP Binding Configuration
109. ID Frames Received Displays the number of EAP Respond ID frames that have been received on the port Response Frames Received Displays the number of valid EAP Response frames received on the port Request ID Frames Displays the number of EAP Requested ID frames transmitted through the Transmitted port Request Frames Transmitted Displays the number of EAP Request frames transmitted through the port Use the buttons at the bottom of the page to perform the following actions e To clear all the EAP counters for all ports on the switch select the check box in the row heading and click Clear The button resets all statistics for all ports to default values e Toclear the counters for a specific port select the check box associated with the port and click Clear e Click Refresh to refresh the data on the screen and display the most current statistics 212 Chapter6 Monitoring the System GS716Tv2 and GS724Tv3 Software Administration Manual System Logs The switch may generate messages in response to events faults or errors occurring on the platform as well as changes in configuration or other occurrences These messages are stored locally and can be forwarded to one or more centralized points of collection for monitoring purposes or long term archival storage Local and remote configuration of the logging capability includes filtering of messages logged or forwarded based on severity and generating component
110. Image Configuration 2 isses m n mh 234 BIIMIIEIPASCU de E ETT 235 MOUDIESHOOUNG errre esner toy bre pr RE REOR PER ege d d 237 PUNO TP T TT 237 TIaCerOUte ur duree Rd ane OH ERE hone RCRTER ICE E 238 Online FIelp uoce ri dest che PU benie ei E PP I MR De 241 SUDDOTL cca Sotto Ro Sepe du dd aue uade eio pl uis Aca d didus 241 User GUuIde s seh acte ea bons Eee Hh ee ecd amden 242 Appendix A Hardware Specifications and Default Values GS716T and GS724T Gigabit Smart Switches Specifications 244 GO9716T Specifications so iacu uit ox eris RC Rb dk Reis e eld didis 244 GS 24T Specifications veo a d RP FER CRY 244 GS716T and GS724T Switch Performance 005 245 GS716T and GS724T Switch Features and Defaults 245 Port Characteristics as 0 4s lt 4 4 06 o 0aad trenit DR PE EUG 245 Witte COMMONS rosa es pnm x a aon SU ata e E et ae a UR Ble shes 246 Quality Of Service coner tiovr ee pecu eRESUE E d 246 6 Table of Contents GS716Tv2 and GS724Tv3 Software Administration Manual SECU es hp E YF PW oer T d System Setup 493 9 we aed es dh Rost Management o 2 ciete A844 oe ER DER RS Other Features i eoreeieRrRRPERDRRE REY Appendix B Configuration Examples Virtual Local Area Networks VLANs VLAN Example Configuration Access Control Lists ACLS 0000 MAC ACL Example Configuration Standard IP ACL Example Configurati
111. Interface The list of interfaces that are designated for forwarding Fwd and filtering FIt for the associated address Use the buttons at the bottom of the page to perform the following actions e Click Clear to clear one or all of the IGMP Snooping entries e Click Refresh to reload the page and display the most current information Multicast Forwarding Database Table The Layer 2 Multicast Forwarding Database MFDB is used by the switch to make forwarding decisions for packets that arrive with a multicast destination MAC address By limiting multicasts to only certain ports in the switch traffic is prevented from going to parts of the network where that traffic is unnecessary When a packet enters the switch the destination MAC address is combined with the VLAN ID and a search is performed in the Layer 2 Multicast Forwarding Database If no match is found then the packet is either flooded to all ports in the VLAN or discarded depending on the switch configuration If a match is found then the packet is forwarded only to the ports that are members of that multicast group Use the MFDB Table page to view the port membership information for all active multicast address entries The key for an entry consists of a MAC address Entries may contain data for more than one protocol To access the MFDB Table page click Switching gt Multicast gt IGMP Snooping gt MFDB Table NETGEAR onfiguraton gt IGMP Sno Querier
112. L Rule Configuration fields NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help Locout J gt ACL Wizard Extended ACL Rule Configuration gt Basic Y Advanced Extended ACL Rule Configuration 100 199 IP ACL IP Rules IP Extended Rule 10 1 to 10 AO 1D Res Acton IP Bending Corfiguraton gt Bending Table 2 Configure the new rule Rule ID Specify a number from 1 10 to identify the IP ACL rule You can create up to 10 rules for each ACL Action Selects the ACL forwarding action which is one of the following e Permit Forwards packets which meet the ACL criteria e Deny Drops packets which meet the ACL criteria Egress Queue Specifies the hardware egress queue identifier used to handle all packets matching this ACL rule Enter an identifying number from 0 3 in the appropriate field Match Every Requires a packet to match the criteria of this ACL Select True or False from the drop down menu Match Every is exclusive to the other filtering rules so if Match Every is True the other rules on the screen are not available 194 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual e Protocol Type Requires a packet s protocol to match the protocol listed here Select a type from the drop down menu or enter the protocol number in the available field e Src IP Address Requires a packet s source IP
113. LACE Port Configuration x 2 2 ep E sirske bbirr Mq epp 78 MEANS ecoute o exque deatur arse A tee ey Mt aeu ded eae 80 VLAN COnflguEattOli 3 2 itore Ett trier reete teens 80 VLAN Membership Configuration l llle 81 Port VLAN ID Configuration 6 024 065 e orem dete PRSE GLR 83 VOICE VLAN ios irte aoe ieee koe be dete qubun Bee qeu 86 Voice VLAN Properties 00000 0c eee eee 86 Voice VLAN Port Setting 2 2 5 noz pr ERE RERO RERX REP TR IRAM ERR 87 Voice VLAN OU saiaren acad ded dn qt ied Iun agin RUE pa goa e uin 88 Tomo EU E 90 Spanning Tree Protocol uuu a aha se ba Run ARRIRA ERE 93 SIP Switch ConflguratiQfi 4 222 120103 renunte i DERRE PS 93 CST GConflgurator 22 3 2222 armat ded dae pases RS Re eR De dd s 95 CST Port Configuration xz cou ete her Rau ERR ESQ KR red rag 97 CST Pom Status x ER E RERO Seon wed dppdum exiens duas 99 ntlenk lj CC C tre 102 MST GOBfIQuEatloni uiu ache aeos di Act di ce bos aoa 103 MST Port Configuration 24 1204 9 t rt oett E ped 104 STE StallSlCs x 356 pod s DEEP Ia de bed dated dus 107 MUNICASL sa T LPS 109 Auto Video Configuration sees eos e mne 109 IGMP SHOOPING sadnite iawo edo Sarg Ici un dU itta ak opta a d 110 IGMP Snooping QUEFTIGI 2 6 cse euh Renew ace E ew e en 119 Forwarding Database eers uh a Rak P PR RURAL Ro RR me BBR HK en 122 MAC Address Table 552 s enam Eee bte ted teras 122 Dynamic Address Configuration
114. LAGS AM GO TO INTERFACE Interface Trust Mode L Disabled Disabled Disabled Disabled Disabled Disabled Disabled Disabled Disabled Disabled IgoooaoeooRooo Disabled Disabled Disabled Disabled Disabled Disabled Disabled Disabled gi Disabled 920 Disabled g21 Disabled g22 Disabled 23 Disabled 024 Disabled D D 7 PORTS LAGS All GO TO INTERFACE To configure DHCP filtering settings for an interface 1 To configure DHCP filtering settings for a physical port click PORTS 2 To configure DHCP filtering settings for a Link Aggregation Group LAG click LAGS 66 Chapter2 Configuring System Information GS716Tv2 and GS724Tv3 Software Administration Manual 3 To configure DHCP filtering settings for both physical ports and LAGs click ALL 4 Select the check box next to the port or LAG to configure You can select multiple ports and LAGs to apply the same setting to the selected interfaces Select the check box in the heading row to apply the same settings to all interfaces 5 Choose the trust mode for the selected port s or LAG s e Enable Any DHCP responses received on this port are forwarded e Disable Any DHCP or BootP responses received on this port are discarded 6 Click Apply to apply the change to the system Configuration changes take effect immediately 7T Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of
115. LANs electronically separate ports on the same switch into separate broadcast domains so that broadcast packets are not sent to all the ports on a single switch When you use a VLAN users can be grouped by logical function instead of physical location Each VLAN in a network has an associated VLAN ID which appears in the IEEE 802 1Q tag in the Layer 2 header of packets transmitted on a VLAN An end station may omit the tag or the VLAN portion of the tag in which case the first switch port to receive the packet may either reject it or insert a tag using its default VLAN ID A given port may handle traffic for more than one VLAN but it can only support one default VLAN ID From the VLAN link you can access the following pages e VLAN Configuration on page 80 e VLAN Membership Configuration on page 81 e Port VLAN ID Configuration on page 83 VLAN Configuration Use the VLAN Configuration page to define VLAN groups stored in the VLAN membership table The GS716T and GS724T support up to 64 VLANs VLAN 1 is created by default and all ports are untagged members To display the VLAN Configuration page lick Switching gt VLAN gt Basic gt VLAN Configuration 80 Chapter 3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual 24 Port Gigabit Smart Switch NETGEAR GS724T System Switching QoS Security Monitoring Maintenance Help 1osourt Voice VLAN Auto VolP STP Multicast Address Toble vB
116. LLDP Configuration page click System LLDP Basic LLDP Configuration Note You can also access the LLDP Configuration page by clicking System LLDP Advanced LLDP Configuration 52 Chapter2 Configuring System Information GS716Tv2 and GS724Tv3 Software Administration Manual 24 Port Gigabit Smart Switch NETGEAR Gs724T ll quM System Switching QoS Security Monitoring Maintenance Help vocor Management Device View License SNMP LLDP Configuration Configuration LLDP Properties Advanced TLV Advertised Interval Hold Multiplier Reinitializing Delay Transmit Delay LLDP MED Properties Fast Start Duration REFRESH To configure global LLDP settings 1 Configure the following LLDP properties e TLV Advertised Interval Specify the interval at which frames are transmitted The default is 30 seconds and the valid range is 1 32768 seconds e Hold Multiplier Specify multiplier on the transmit interval to assign to Time to Live TTL The default is 4 seconds and the range is 2 10 e hReinitializing Delay Specify the delay before a reinitialization The default is 2 seconds and the range is 1 10 seconds e Transmit Delay Specify the interval for the transmission of notifications The default is 5 seconds and the range is 5 3600 seconds 2 Tochange the LLDP MED properties in the Fast Start Duration field specify the number of LLDP packets sent when the LLDP MED Fast Start mec
117. MP recipient select the check box next to the recipient change the desired fields and then click Apply Configuration changes take effect immediately 3 To delete a recipient select the check box next to the recipient and click Delete Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch Trap Flags The pages in the Trap Manager folder allow you to view and configure information about SNMP traps the system generates Use the Trap Flags page to enable or disable traps the switch can send to an SNMP manager When the condition identified by an active trap is encountered by the switch a trap message is sent to any enabled SNMP Trap Receivers and a message is written to the trap log To access the Trap Flags page click System gt SNMP gt SNMP V1 V2 gt Trap Flags NETGEAR GS724T 24 Port Gigabit Smart Switch System witching QoS ecurity Monitoring Maintenance Help tosour Management Device View License v SNMP V1 V2 Trap Flags Community Configuration Trap Flags Trap Authentication C Oisable Enable Configuration Link Up Down Enable Trap Flags gt SNMP V3 Spanning Tree Oo Enable To configure the trap flags 1 From the Authentication field enable or disable activation of authentication failure traps by selecting the corresponding button The factory default is Enable 2 From the Link Up Down field enable or disable
118. Managing Device Security 195 GS716Tv2 and GS724Tv3 Software Administration Manual DSCP value from the menu To specify a numeric value in the available field select Other from the menu and type an integer from 0 to 63 in the field e P Precedence The IP Precedence field in a packet is defined as the high order three bits of the Service Type octet in the IP header This is an optional configuration Enter an integer from O to 7 e IP TOS Bits Matches on the Type of Service bits in the IP header when checked In the first TOS field specify the two digit hexadecimal TOS number The second field is for the TOS Mask which specifies the bit positions that are used for comparison against the IP TOS field in a packet The TOS Mask value is a two digit hexadecimal number from 00 to ff representing an inverted i e wildcard mask The zero valued bits in the TOS Mask denote the bit positions in the TOS Bits value that are used for comparison against the IP TOS field of a packet For example to check for an IP TOS value having bits 7 and 5 set and bit 1 clear where bit 7 is most significant use a TOS Bits value of a0 anda TOS Mask of 00 3 To delete an IP ACL rule select the check box associated with the rule and then click Delete 4 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 5 To modify an existing IP Extended ACL rule click the Rule ID The number is a
119. N Port Setting page click Switching gt Voice VLAN gt Advanced gt Port Setting NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help tOGOUT J VLAN Multicost Address Toble Port Setting Port Setting GO TO INTERFACE Voi VLAN Select Interface aes Membership Mode C aable Disable Ouable Ouwable Ouable Owable Ouable Owable Ovsable Ovsable Cable Ousable Ousable Ousable Ousable Cable Cable Cable Cusable Cisable Cable Disable Ouable Cuable d o o o o a a o a a z B m B o 0 o o o o o Chapter 3 Configuring Switching Information 87 GS716Tv2 and GS724Tv3 Software Administration Manual To configure Voice VLAN port settings 1 2 Select the check box next to the port to configure You can select multiple check boxes to apply the same setting to all selected ports From the Voice VLAN Mode menu specify whether to enable or disable Voice VLAN on the selected port From the Voice VLAN Security menu specify whether to enable or disable Voice VLAN security on the selected port Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch If you make any changes to this page click Apply to send the updated configuration to the switch Note The Membership field displays whether the current operational status of the voice VLAN on the
120. NETGEAR GS724T li 24 Port Gigabit Smart Switch 1000vr gt User Configuration Server Configuration gt RADIUS Y TACACS Server Configuration TACACS TACACS Server Configuration Server Configuration gt Authentication List Server Address To configure TACACS server settings 1 To add a new TACACS server select Add from the TACACS Server field enter the IP address of the server to add and click Apply Note The Add option is available if fewer than five TACACS servers are configured on the system and the Server Address field is only available when Add is selected in the TACACS Server IP Address field After you add one or more TACACS servers additional fields appear on the TACACS Server Configuration page Server Configuration TACACS Server 192 168 2 3 w Priority Port 45 0 15 65335 Key String t Oto 128 characters Connection Timeout iw 30 In the Priority field specify the order in which the TACACS servers are used A value of 0 is the highest priority In the Port field specify the authentication port number through which the TACACS session occurs The default is port 49 and the range is 0 65535 In the Key String field specify the authentication and encryption key for TACACS communications between the GS716T or GS724T and the TACACS server This key must match the encryption used on the TACACS server The valid range is 0 128 characters In the Connection Timeout
121. No SNTP server exists flashes on the screen Last Update Time Specifies the local date and time UTC that the response from this server was used to update the system clock Last Attempt Time Specifies the local date and time UTC that this SNTP server was last queried Last Attempt Status Specifies the status of the last SNTP request to this server If no packet has been received from this server a status of Other is displayed e Other None of the following enumeration values e Success The SNTP operation was successful and the system time was updated Request Timed Out A directed SNTP request timed out without receiving a response from the SNTP server e Bad Date Encoded The time provided by the SNTP server is not valid e Version Not Supported The SNTP version supported by the server is not compatible with the version supported by the client e Server Unsynchronized The SNTP server is not synchronized with its peers This is indicated via the leap indicator field on the SNTP message e Server Kiss Of Death The SNTP server indicated that no further queries were to be sent to this server This is indicated by a stratum field equal to 0 in a message received from a server Requests Specifies the number of SNTP requests made to this server since last agent reboot Failed Requests Specifies the number of failed SNTP requests made to this server since last reboot 40 Chapter2 Configuring
122. P Port Configuration GO TO INTERFACE To configure LACP port priority settings 1 Select the check box next to the port to configure You can select multiple ports to apply the same setting to all selected ports 78 Chapter3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual Note You cannot select ports that are not participating in a LAG 2 Configure the LACP Priority value for the selected port The field range is 0 255 The default value is 128 3 Configure the administrative LACP Timeout value e Long Specifies a long timeout value e Short Specifies a short timeout value 4 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 5 If you make any changes to this page click Apply to send the updated configuration to the switch Configuration changes take effect immediately Chapter 3 Configuring Switching Information 79 GS716Tv2 and GS724Tv3 Software Administration Manual VLANs Adding Virtual LAN VLAN support to a Layer 2 switch offers some of the benefits of both bridging and routing Like a bridge a VLAN switch forwards traffic based on the Layer 2 header which is fast and like a router it partitions the network into logical segments which provides better administration security and management of multicast traffic By default all ports on the switch are in the same broadcast domain V
123. PDUs will be dropped but the links that form the LAG port channel will not be released The factory default is Enable e STP Mode Select the Spanning Tree Protocol Administrative Mode associated with the LAG e LAG Type Specifies whether the LAG is configured as a Static or LACP port When the LAG is static it does not transmit or process received LACPDUS for example the member ports do not transmit LACPDUs and all the LACPDUS it may receive are dropped The default is Static Chapter 3 Configuring Switching Information 75 GS716Tv2 and GS724Tv3 Software Administration Manual e Active Ports A listing of the ports that are actively participating members of this Port Channel A maximum of 4 ports can be assigned to a port channel e LAG State Indicates whether the link is Up or Down 3 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 4 If you make any changes to this page click Apply to send the updated configuration to the switch Configuration changes take effect immediately LAG Membership Use the LAG Membership page to select two or more full duplex Ethernet links to be aggregated together to form a link aggregation group LAG which is also known as a port channel The switch can treat the port channel as if it were a single link To access the LAG Membership page click Switching LAG Basic LAG Membership LAG Membership Memb
124. Port Identifier on the Designated Bridge that offers the lowest cost to the LAN It is made up from the port priority and the interface number of the port Click Refresh to update the screen with the latest MST information STP Statistics Use the Spanning Tree Statistics page to view information about the number and type of bridge protocol data units BPDUs transmitted and received on each port To display the Spanning Tree Statistics page click Switching STP Advanced STP Statistics Chapter 3 Configuring Switching Information 107 GS716Tv2 and GS724Tv3 Software Administration Manual 24 Port Gigabit Smart Switei NETGEAR GS724T 10009T Switching VIAN Voice VIAN Asto VolP Mulscoat Address Table gt Basic STP Statistics v Advanced STP Configuration STP Statistics CST Configuration PORTS LAGS gt CST Port STP BPDUs STP BPDUs RSTP BPDUs RSTP BPDUS MSTP BPOUs MSTP BPDUs Configuration Interface received Transmitted Received Transmitted Received Transmitted CST Port Status RSTP MST Configuration MST Port Configuration STP Statistics The following table describes the information available on the STP Statistics page Field Description Interface Select a physical or port channel interface to view its statistics STP BPDUs Received Number of STP BPDUs received at the selected port STP BPDUs Transmitted Number of STP BPDUs transmitted from the selected port
125. Server Address field specify the IP address or hostname of the TFTP server The address you type must be in the format indicated by the TFTP Server Address Type 228 Chapter 7 Maintenance GS716Tv2 and GS724Tv3 Software Administration Manual 5 In the Transfer File Path field specify the path on the TFTP server where you want to put the file You may enter up to 32 characters Include the backslash at the end of the path A path name with a space is not accepted Leave this field blank to save the file to the root TFTP directory 6 In the Transfer File Name field specify a destination file name for the file to upload You may enter up to 32 characters The transfer fails if you do not specify a file name For a code transfer use an stk file extension 7 Select the Start File Transfer check box to initiate the file upload 8 Click Apply to begin the file transfer The last row of the table displays information about the progress of the file transfer The page refreshes automatically until the file transfer completes or fails Chapter 7 Maintenance 229 GS716Tv2 and GS724Tv3 Software Administration Manual Download File To Switch The switch supports system file downloads from a remote system to the switch by using either TFTP or HTTP The Download menu contains links to the following options e TFTP File Download on page 230 e HTTP File Download on page 232 TFTP File Download Use the Download File to Switch pa
126. Services and Class of Service features Chapter 5 Managing Device Security contains information about configuring switch security information such as port access control and RADIUS server settings Chapter 6 Monitoring the System describes how to view a variety of information about the switch and its ports and to configure how the switch monitors events Chapter 7 Maintenance describes features to help you manage the switch Chapter 8 Help describes how to access Online Help resources for the switch Appendix A Hardware Specifications and Default Values contains hardware specifications and default values on the GS716T and GS724T Smart Switches Appendix B Configuration Examples contains examples of how to configure various features on the GS716T and GS724T Smart Switches such as VLANs and ACLs Note Refer to the release notes for the GS716T and GS724T Gigabit Smart Switches for information about issues and workarounds Chapter 1 Getting Started 9 GS716Tv2 and GS724Tv3 Software Administration Manual Getting Started with the GS716T and GS724T Gigabit Smart Switches This chapter provides an overview of starting your NETGEAR GS716T or GS724T Smart Switch and accessing the user interface It also leads you through the steps to use the Smart Control Center utility This chapter contains the following sections Switch Management Interface on page 11 Connecting the Switch to the Network on page 12 Switch Discovery
127. The highest level warning level If the device is down or not functioning properly an emergency log is saved to the device e Alert 1 The second highest warning level An alert log is saved if there is a serious device malfunction such as all device features being down e Critical 2 The third highest warning level A critical log is saved if a critical device malfunction occurs for example two device ports are not functioning while the rest of the device ports remain functional e Error 3 A device error has occurred such as if a port is offline e Warning 4 The lowest level of a device warning e Notice 5 Provides the network administrators with device information e Informational 6 Provides device information e Debug 7 Provides detailed information about the log Debugging should only be entered by qualified support personnel 2 To delete an existing host select the check box next to the host and click Delete 218 Chapter6 Monitoring the System GS716Tv2 and GS724Tv3 Software Administration Manual 3 To modify the settings for an existing host select the check box next to the host change the desired information and click Apply 4 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch The Status field in the Server Configuration table shows whether the remote logging host is currently active Trap Logs Use the Trap Logs page
128. This log always has the log full operation attribute set to stop on full and can store up to 32 messages Chapter 6 Monitoring the System 215 GS716Tv2 and GS724Tv3 Software Administration Manual e The second log type is the system operation log The system operation log stores the last N messages received during system operation This log always has the log full operation attribute set to overwrite This log can store up to 1000 messages Either the system startup log or the system operation log stores a message received by the log subsystem that meets the storage criteria but not both On system startup if the startup log is configured it stores messages up to its limit The operation log if configured then begins to store the messages Use the FLASH Log Configuration page to enable or disable persistent logging and to set the severity filter To access the FLASH Log Configuration page click the Monitoring Logs tab and then click the FLASH Log link NETGEAR GS724T 24 Port Gigabit Smart Switch Monitoring p 1060uT J gt Memory Log FLASH Log v FLASH Log gt Server Log FLASH Log Configuration Trap Logs Admin Status Disable Enable gt Event Logs Severity Filter Alert Y FLASH Logs Number of FLASH Messages lt To configure the FLASH Log settings 1 Use the radio buttons in the Admin Status field to determine whether to log messages to persistent storage e Enable Enables persisten
129. able Enables system logging e Disable Prevents the system from logging messages 2 From the Behavior menu specify the behavior of the log when it is full Wrap When the buffer is full the oldest log messages are deleted as the system logs new messages e Stop on Full When the buffer is full the system stops logging new messages and preserves all existing log messages 3 If you change the buffered log settings click Apply to apply the changes to the system and the changes will be saved 214 Chapter 6 Monitoring the System GS716Tv2 and GS724Tv3 Software Administration Manual The Memory Log table also appears on the Memory Log page Field Description Total Number of Messages Displays the number of messages the system has logged in memory Only the 64 most recent entries are displayed on the page The rest of the page displays the Memory Log messages The format of the log message is the same for messages that are displayed for the message log persistent log or console log Messages logged to a collector or relay via syslog have the same format as well The following example shows the standard format for a log message 14 Mar 24 05 34 05 10 131 12 183 1 UNKN 2176789276 main login c 179 3855 HTTP Session 19 initiated for user admin connected from 10 27 64 122 The number contained in the angle brackets represents the message priority which is derived from the following valu
130. ach port advertises through LLDP To display the LLDP Local Device Information page click System gt Advanced gt LLDP gt Local Information Chapter 2 Configuring System Information 57 GS716Tv2 and GS724Tv3 Software Administration Manual NETG EAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help rosou Management gt Basic Local Information v Advanced LLOP Device Information Configuration No local interfaces are enabled to transmit LLOP data LLDP Port Settings LLDP MED Port Information o Network Policy LLDP MED Port Settings Local 2 MAC Address 00 00 00 01 16 01 sddsdfsdfdf Disable Information MAC Address 00 00 00 01 16 01 Disable Neighbors MAC Address 00 00 00 01 16 01 Disable Information Interface Port ID Subtype Port ID Port Description Advertisement MAC Address 00 00 00 01 16 01 Disable MAC Address 00 00 00 01 16 01 Disable MAC Address 00 00 00 01 16 01 C sable MAC Address 00 00 00 01 16 01 O sable MAC Address 00 00 00 01 16 01 Cisable MAC Address 00 00 00 01 16 01 dfdfsdsf Cable MAC Address 00 00 00 01 16 01 Cisable MAC Address 00 00 00 01 16 01 Ca25le MAC Address 00 00 00 01 16 01 MAC Address 00 00 00 01 16 01 MAC Address 00 00 00 01 16 01 MAC Address 00 00 00 01 16 01 Orsadle MAC Address 00 00 00 01 16 01 Disable MAC Address 00 00 00 01 16 01 O sable MAC Address 00 00 00 01 16 01 O sable MAC Address 00 00 00 01 16 01 O sable MA
131. alue is 192 168 0 254 3 Specify the VLAN ID for the management VLAN The management VLAN is used to establish an IP connection to the switch from a workstation that is connected to a port in the same VLAN If not specified the active management VLAN ID is 1 default which allows an IP connection to be established through any port When the management VLAN is set to a different value an IP connection can be made only through a port that is part of the management VLAN It is also mandatory that the 34 Chapter2 Configuring System Information GS716Tv2 and GS724Tv3 Software Administration Manual port VLAN ID PVID of the port to be connected in that management VLAN be the same as the management VLAN ID The management VLAN has the following requirements e Only one management VLAN can be active at a time e When a new management VLAN is configured connectivity through the existing management VLAN is lost e The management station should be reconnected to the port in the new management VLAN Note Make sure that the VLAN to be configured as the management VLAN exists And make sure that the PVID of at least one port that is a port of the VLAN is the same as the management VLAN ID For information about creating VLANs and configuring the PVID for a port see VLANs on page 80 4 f you change any of the network connection parameters click Apply to apply the changes to the system 5 Click Cancel to cancel the configura
132. an authorized state without being authenticated The interface sends and receives normal traffic without client port based authentication e Force Unauthorized Denies the selected interface system access by moving the interface into unauthorized state The switch cannot provide authentication services to the client through the interface Operating Control Mode This field indicates the control mode under which the port is actually operating Possible values are e ForceUnauthorized e ForceAuthorized e Auto e N A If the port is in detached state it cannot participate in port access control Reauthentication Enabled Displays if reauthentication is enabled on the selected port This is a configurable field The possible values are true and false If the value is true reauthentication will occur Otherwise reauthentication will not be allowed Port Status This field displays the authorization status of the specified port The possible values are Authorized Unauthorized and N A If the port is in detached state the value will be N A since the port cannot participate in port access control Click Refresh to update the information on the screen Traffic Control From the Traffic Control link you can configure MAC Filters Storm Control Port Security and Protected Port settings To display the page click the Security Traffic Control tab The Traffic Control folder contains links to the following features e
133. an opcode indicating the PAUSE operation This counter does not increment when the interface is operating in half duplex mode EAPOL Frames Received The number of valid EAPOL frames of any type that have been received by this authenticator EAPOL Frames Transmitted The number of EAPOL frames of any type that have been transmitted by this authenticator Time Since Counters Last Cleared The elapsed time in days hours minutes and seconds since the statistics for this port were last cleared 210 Chapter6 Monitoring the System GS716Tv2 and GS724Tv3 Software Administration Manual Use the buttons at the bottom of the page to perform the following actions e Click Clear to clear all the counters This resets all statistics for this port to the default values e Click Refresh to refresh the data on the screen and display the most current statistics EAP Statistics Use the EAP Statistics page to display information about EAP packets received on a specific port To display the EAP Statistics page click the Monitoring Ports tab and then click the EAP Statistics link NETGEAR System Switching QoS Security Monitoring Maintenance Help gt Switch Statistics EAP Statistics gt Port Statistics gt Port Detailed Statistics EAP Statistics v EAP Statistics tAPOL Logoft Last Invalid Frames Frames Last Frame Frames Frame Frames Received Transmitted Source Rec
134. and reset the data on the screen to the latest value of the switch 4 If you make any changes to this page click Apply to send the updated configuration to the Switch Chapter 3 Configuring Switching Information 91 GS716Tv2 and GS724Tv3 Software Administration Manual To configure OUI settings 1 To add a new OUI prefix type the VOIP OUI prefix in the Telephony OUl s field provide a description of the prefix and click Add The OUI prefix must be in the format AA BB CC 2 To delete an OUI prefix from the list select the check box next to the OUI prefix and click Delete 3 Tomodify information for an entry in the OUI list select the check box next to the OUI prefix update the OUI prefix or description and then click Apply 4 Click Cancelto cancel the configuration on the screen and reset the data on the screen to the latest valueof the switch 5 Click Restore Defaults to restore the list to the preconfigured OUls 92 Chapter3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual Spanning Tree Protocol The Spanning Tree Protocol STP provides a tree topology for any arrangement of bridges STP also provides one path between end stations on a network eliminating loops Spanning tree versions supported include Common STP Multiple STP and Rapid STP Classic STP provides a single path between end stations avoiding and eliminating loops For information on configuring C
135. ared with MACACL All IP addresses allowed Password control access 1 Idle timeout 5 mins Password password Management security 1 profile with 20 rules for HTTP HTTPS SNMP access to allow deny an IP address subnet All IP addresses allowed Port MAC lock down All ports Disabled 246 Appendix A Hardware Specifications and Default Values System Setup GS716Tv2 and GS724Tv3 Software Administration Manual Feature Sets Supported Default Boot code update 1 N A DHCP manual IP 1 DHCP enabled 192 168 0 239 Default gateway 192 168 0 254 System name configuration 1 NULL Configuration save restore 1 N A Firmware upgrade 1 N A Restore defaults 1 Web and front panel button N A Dual image support 1 Enabled Factory reset 1 N A Management Feature Sets Supported Default Multi session Web connections 16 Enabled SNMPv1 V2c Max 5 community entries Enabled read read write SNMP v3 communities Time control 1 Local or SNTP Local Time enabled LLDP LLDP MED All ports Disabled Logging 3 Memory Flash Server Memory Log enabled MIB support 1 Disabled Smart Control Center N A Enabled Statistics N A N A Appendix A Hardware Specifications and Default Values 247 GS716Tv2 and GS724Tv3 Software Administration Manual Other Features Feature Sets S
136. asic gt Monitoring Auto VoIP Advanced gt Maintenance Voice VLAN Help gt STP eo Multicast Address Table gt REFRESH Chapter 1 Getting Started 27 GS716Tv2 and GS724Tv3 Software Administration Manual Help Page Access Every page contains a link to the online help 3 Which contains information to assist in configuring and managing the switch The online help pages are context sensitive For example if the IP Addressing page is open the help topic for that page displays if you click Help Figure 1 shows the location of the Help link on the Web interface User Defined Fields User defined fields can contain 1 to 159 characters unless otherwise noted on the configuration Web page All characters may be used except for the following unless specifically noted in for that feature lt gt i Using SNMP The switch software supports the configuration of SNMP groups and users that can manage traps that the SNMP agent generates switch switches use both standard public MIBs for standard functionality and private MIBs that support additional switch functionality All private MIBs begin with a prefix The main object for interface configuration is in SWITCHING MIB which is a private MIB Some interface configurations also involve objects in the public MIB IF MIB SNMP is enabled by default The System gt Management gt System Information Web page which is the page that displays after a
137. asic VLAN Configuration Advanced VLAN Configuration VLAN Type 4 b l JL A 1 r Default VLAN 1D VLAN Name 2 Voice VLAN 3 Auto Video C 4s 5454546565 Reset Reset Configuration To configure VLANs 1 To add a VLAN configure the VLAN ID name and type and then click Add e VLAN ID Specify the VLAN Identifier for the new VLAN You can enter data in this field only when you are creating a new VLAN The range of the VLAN ID is 14093 e VLAN Name Use this optional field to specify a name for the VLAN It can be up to 32 alphanumeric characters long including blanks The default is blank VLAN ID 1 is always named Default e VLAN Type This field identifies the type of the VLAN you are configuring You cannot change the type of the default VLAN VLAN ID 1 because the type is always Default When you create a VLAN on this page its type will always be Static 2 To delete a VLAN select the check box next to the VLAN ID and click Delete You cannot delete the default VLAN 3 To modify settings for a VLAN select the check box next to the VLAN ID change the desired information and then click Apply Configuration changes occur immediately 4 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 5 To reset the VLAN settings on the switch to the factory defaults select the Reset Configuration check box and click OK in
138. at have a size greater then this configured Max ICMP packet size The factory default is Disable 2 If you change any of the DoS settings click Apply to apply the changes to the switch 3 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch DNS You can use these pages to configure information about DNS servers the network uses and how the switch operates as a DNS client DNS Configuration Use this page to configure global DNS settings and DNS server information To access this page click System gt Management gt DNS gt DNS Configuration Chapter 2 Configuring System Information 43 GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help 1000vt gt System Information DNS Configuration IP Configuration gt Time DNS Configuration gt Denial of Service Vv DNS ONS Configuration Host Configuration gt Green Ethernet Configuration DNS Status Disable 9 Enable ONS Default Name 0 to 255 characters DNS Server Configuration x 10 130 138 21 To configure the global DNS settings 1 Specify whether to enable or disable the administrative status of the DNS Client e Enable Allow the switch to send DNS queries to a DNS server to resolve a DNS domain name e Disable Prevent the switch from sending DNS queries
139. ation Use the RADIUS Configuration page to add information about one or more RADIUS servers on the network To access the RADIUS Configuration page click Security gt Management Security gt RADIUS gt Global Configuration NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help 1090v1 gt User Configuration Global Configuration v RADIUS Global RADIUS Configuration Configuration Current Server IP Address Server Number of Configured Servers Con r n Configuratio Max Number of Retransmits Accounting Server Timeout Duration secs Configuration gt TACACS Accounting Mode gt Authentication List lt The Current Server IP Address field is blank if no servers are configured see RADIUS Server Configuration on page 152 The switch supports up to three configured RADIUS servers If more than one RADIUS servers are configured the current server is the server Chapter 5 Managing Device Security 151 GS716Tv2 and GS724Tv3 Software Administration Manual configured as the primary server If no servers are configured as the primary server the current server is the most recently added RADIUS server To configure global RADIUS server settings 1 In the Max Number of Retransmits field specify the value of the maximum number of times a request packet is retransmitted to the RADIUS server Consideration to maximum delay time should be given when co
140. ation criteria is defined by a class The processing is defined by a policy s attributes Policy attributes may be defined on a per class instance basis and it is these attributes that are applied when a match occurs A policy can contain multiples classes When the policy is active the actions taken depend on which class matches the packet Packet processing begins by testing the class match criteria for a packet A policy is applied to a packet when a class match within that policy is found The Differentiated Services menu page contains links to the various Diffserv configuration and display features To display the page click QoS DiffServ The Differentiated Services menu page contains links to the following features e Diffserv Configuration e Class Configuration e Policy Configuration e Service Configuration e Service Statistics Chapter 4 Configuring Quality of Service 135 GS716Tv2 and GS724Tv3 Software Administration Manual Diffserv Configuration Use the Diffserv Configuration page to display DiffServ General Status Group information which includes the current administrative mode setting as well as the current and maximum number of rows in each of the main DiffServ private MIB tables To display the page click QoS gt DiffServ gt Advanced gt Diffserv Configuration NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help tocovr v Basic DiffServ Co
141. ation on the screen and reset the data on the screen to the latest value of the switch 7 If you make any configuration changes click Apply to send the updated configuration to the switch Configuration changes take place immediately 8 Click Refresh to update the information on the screen with the most current data CST Port Status Use the Spanning Tree CST Port Status page to display Common Spanning Tree CST and Internal Spanning Tree on a specific port on the switch To display the Spanning Tree CST Port Status page click Switching gt STP gt Advanced gt CST Port Status Chapter 3 Configuring Switching Information 99 GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR System Switching QoS Security Monitoring Maintenance Help Pors LAG VIAN Voice VIAN Auto VolP Melticast Address Table Basic CST Port Status v Advanced STP CST Port Status Configuration PORTS LAGS al ARI Topol x opology Conf tic D ted D ted shoe tlt Interface Designated Root ne Designated Bridge menm Change CST Port Cost Acknowledge Configuration 1 gi Disabled 0 00 00 00 00 01 13 5f CST Port Status o 0 00 00 00 00 01 19 8 false False RSTP g2 Disabled 80 00 00 00 00 01 1S O 80 00 00 00 00 01 18 0 False False MST g Disabled 0 00 00 00 00 01 1 6 0 0 00 00 00 00 01 15 6 O False False Configuration c4 Disabled 80 00 00 00 00 01 15 fF 0 80 00 00 00 00 01 15 0 False False 20 T Bc TM 921 Di
142. attributes table Service Table Displays the current and maximum number of rows of the service table Class Configuration Use the Class Configuration page to add a new DiffServ class name or to rename or delete an existing class The page also allows you to define the criteria to associate with a DiffServ class As packets are received these DiffServ classes are used to prioritize packets You can have multiple match criteria in a class The logic is a Boolean logical and for this criteria After creating a Class click the class link to the Class page To display the page click QoS DiffServ Advanced Class Configuration NETGEAR GS724T f 24 Port Gigabit Smart Switch are Monitoring Maintenance Help LOGOUT j gt Basic Class Configuration v Advanced DiffServ Class Configuration Configuration Class Name Class Type Class Configuration LIE 2 B Policy Configuration Service Configuration Service Statistics To configure a DiffServ class 1 To create a new class enter a class name select the class type and click Add The switch supports only the Class Type value All which means all the various match criteria defined for the class should be satisfied for a packet match All signifies the logical AND of all the match criteria 2 To rename an existing class select the check box next to the configured class update the name and click Apply 3 To remove a class click the
143. aximum number of unicast server entries that can be configured on this client Unicast Server Current Specifies the number of current valid unicast server entries configured for Entries this client Click Refresh to refresh the page with the most current data from the switch SNTP Server Configuration Use the SNTP Server Configuration page to view and modify information for adding and modifying Simple Network Time Protocol SNTP servers To display the SNTP Server Configuration page click System gt Management gt Time gt SNTP Server Configuration NETGEAR SEE 7 ll System Switching QoS Security Monitoring Maintenance Help 106ovr Device View license SNMP Lt gt System Information SNTP Server Configuration gt IP Configuration v Time SNTP Server Configuration SNTP Global Configuration Server Port Priority Version Address SNTP Server Configuration Type 1 65535 1 3 1 4 Denial of Service dL Ead gt DNS gt Green Ethernet Configuration SNTP Server Status Last Last Last Address Update Attempt Attempt Requests Time Time Status Requests REFRESH To configure a new SNTP Server 1 Enter the appropriate SNTP server information in the available fields e Server Type Specifies whether the address for the SNTP server is an IP address IPv4 or hostname DNS e Address Enter the IP address or the hostname of the SNTP server e Port Enter a port num
144. ber of frames discarded because the transmit FIFO buffer became empty during frame transmission Total Transmit Packets Discarded The sum of single collision frames discarded multiple collision frames discarded and excessive frames discarded Single Collision Frames A count of the number of successfully transmitted frames on a particular interface for which transmission is inhibited by exactly one collision Multiple Collision Frames A count of the number of successfully transmitted frames on a particular interface for which transmission is inhibited by more than one collision Excessive Collision Frames A count of frames for which transmission on a particular interface fails due to excessive collisions Port Membership Discards The number of frames discarded on egress for this port due to egress filtering being enabled STP BPDUS Received Number of STP BPDUs received at the selected port STP BPDUS Transmitted Number of STP BPDUs transmitted from the selected port RSTP BPDUS Received Number of RSTP BPDUS received at the selected port RSTP BPDUS Transmitted Number of RSTP BPDUS transmitted from the selected port MSTP BPDUS Received Number of MSTP BPDUS received at the selected port MSTP BPDUS Transmitted Number of MSTP BPDUS transmitted from the selected port 802 3x Pause Frames Transmitted A count of MAC Control frames transmitted on this interface with
145. ber on the SNTP server to which SNTP requests are sent The valid range is 1 65535 The default is 123 Chapter 2 Configuring System Information 39 GS716Tv2 and GS724Tv3 Software Administration Manual e Priority Specifies the priority of this server entry in determining the sequence of servers to which SNTP requests are sent Enter a priority from 1 3 with 1 being the default and the highest priority Servers with lowest numbers have priority e Version Enter the protocol version number The range is 1 4 2 Click Add 3 Repeat the previous steps to add additional SNTP servers You can configure up to three SNTP servers 4 To removing an SNTP server select the check box next to the configured server to remove and then click Delete The entry is removed and the device is updated 5 To change the settings for an existing SNTP server select the check box next to the configured server and enter new values in the available fields and then click Apply Configuration changes take effect immediately 6 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch The SNTP Server Status table displays status information about the SNTP servers configured on your switch The following table describes the SNTP Global Status fields Field Description Address Specifies all the existing Server Addresses If no Server configuration exists a message saying
146. bridge has to be configured with an unambiguous assignment of VLAN IDs VIDs to spanning trees This is achieved by 1 Ensuring that the allocation of VIDs to FIDs is unambiguous 2 Ensuring that each FID supported by the Bridge is allocated to exactly one Spanning Tree Instance The combination of VID to FID and then FID to MSTI allocation defines a mapping of VIDs to spanning tree instances represented by the MST Configuration Table With this allocation we ensure that every VLAN is assigned to one and only one MSTI The CIST is also an instance of spanning tree with a MSTID of O An instance may occur that has no VIDs allocated to it but every VLAN must be allocated to one of the other instances of spanning tree The portion of the active topology of the network that connects any two bridges in the same MST Region traverses only MST bridges and LANs in that region and never Bridges of any kind outside the Region in other words connectivity within the region is independent of external connectivity MSTP Example Configuration This example shows how to create an MSTP instance from the GS716T or GS724T switch The example network has three different GS716T or GS724T switches that serve different locations in the network In this example ports e1 e5 are connected to host stations so those links are not subject to network loops Ports e6 e8 are connected across switches 1 2 and 3 264 Appendix B Configuration Examples
147. cates the current STP state of a port If enabled the port state determines what forwarding action is taken on traffic Possible port states are Disabled STP is currently disabled on the port The port forwards traffic while learning MAC addresses e Blocking The port is currently blocked and cannot be used to forward traffic or learn MAC addresses Listening The port is currently in the listening mode The port cannot forward traffic nor can it learn MAC addresses e Learning The port is currently in the learning mode The port cannot forward traffic however it can learn new MAC addresses Forwarding The port is currently in the forwarding mode The port can forward traffic and learn new MAC addresses Port Role Each MST Bridge Port that is enabled is assigned a Port Role for each spanning tree The port role will be one of the following values Root Port Designated Port Alternate Port Backup Port Master Port or Disabled Port Designated Root Root Bridge for the selected MST instance It is made up using the bridge priority and the base MAC address of the bridge Designated Cost Designated Bridge Displays cost of the port participating in the STP topology Ports with a lower cost are less likely to be blocked if STP detects loops Bridge Identifier of the bridge with the Designated Port It is made up using the bridge priority and the base MAC address of the bridge Designated Port
148. cators Pending Requests Timeouts Unknown Types Packets Dropped CULAR COUNTERS RLIRE SM pL To configure the RADIUS accounting server 1 In the Accounting Server Address field specify the IP address of the RADIUS accounting server to add 2 In the Port field specify the UDP port number the server uses to verify the RADIUS accounting server authentication The valid range is 0 65535 3 From the Secret Configured menu select Yes to add a RADIUS secret in the next field You must select Yes before you can configure the RADIUS secret After you add the RADIUS accounting server this field indicates whether the shared secret for this server has been configured In the Secret field type the shared secret to use with the specified accounting server From the Accounting Mode menu enable or disable the RADIUS accounting mode Click Apply to update the switch with the RADIUS Accounting server settings To delete a configured RADIUS Accounting server click Delete co N mu 0r um Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch Chapter 5 Managing Device Security 155 GS716Tv2 and GS724Tv3 Software Administration Manual The following table describes RADIUS accounting server statistics available on the page Field Description Accounting Server Address Displays the IP address of the supported RADIUS accounting server Round Trip Tim
149. ce Description Example Physical The physical ports are gigabit Ethernet interfaces and g1 g2 g3 are numbered sequentially starting from one Link Aggregation Group LAG LAG interfaces are logical interfaces that are only 1 I2 I3 used for bridging functions LAG1 LAG2 CPU Management Interface This is the internal switch interface responsible for the c1 Switch base MAC address This interface is not configurable and is always listed in the MAC Address Table Chapter 1 Getting Started 29 GS716Tv2 and GS724Tv3 Software Administration Manual 30 Chapter 1 Getting Started Configuring System Information Use the features in the System tab to define the switch s relationship to its environment The System tab contains links to the following features e Management on page 32 e License Key on page 47 e SNMP on page 47 e LLDP on page 52 e Services DHCP Filtering on page 65 Chapter 2 Configuring System Information 31 GS716Tv2 and GS724Tv3 Software Administration Manual Management This section describes how to display the switch status and specify some basic switch information such as the management interface IP address system clock settings and DNS information From the Management link you can access the following pages e System Information on page 32 e IP Configuration on page 33 e Time on page 35 Denial of Service on page 41 e DNS on page 43 e Green Ethernet Configurat
150. ch increases fault tolerance and provides load sharing You assign the LAG VLAN membership after you create a LAG The LAG by default becomes a member of the management VLAN A LAG interface can be either static or dynamic but not both All members of a LAG must participate in the same protocols A static port channel interface does not require a partner system to be able to aggregate its member ports Dynamic LAGs use Link Aggregation Control Protocol LACP Protocol Data Units PDUs to exchange information with their link partners to help maintain the link state Static LAGs are also supported When a port is added to a LAG as a static member it neither transmits nor receives LACP PDUs The GS510TP and GS110T Smart Switches each support four LAGs Static LAGs are supported When a port is added to a LAG as a static member it neither transmits nor receives LACP PDUs GS716T supports 2 LAGs and the GS724T supports 4 LAGs From the LAGs link you can access the following pages e LAG Configuration on page 75 e LAG Membership on page 76 e LACP Configuration on page 77 e LACP Port Configuration on page 78 74 Chapter3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual LAG Configuration Use the LAG Port Channel Configuration page to group one or more full duplex Ethernet links to be aggregated together to form a link aggregation group which is also known as a port channel The switch treats
151. configured RADIUS server 262 Appendix B Configuration Examples GS716Tv2 and GS724Tv3 Software Administration Manual MSTP Spanning Tree Protocol STP runs on bridged networks to help eliminate loops If a bridge loop occurs the network can become flooded with traffic IEEE 802 1s Multiple Spanning Tree Protocol MSTP supports multiple instances of Spanning Tree to efficiently channel VLAN traffic over different interfaces Each instance of the Spanning Tree behaves in the manner specified in IEEE 802 1w Rapid Spanning Tree with slight modifications in the working but not the end effect chief among the effects is the rapid transitioning of the port to the Forwarding state The difference between the RSTP and the traditional STP IEEE 802 1D is the ability to configure and recognize full duplex connectivity and ports that are connected to end stations resulting in rapid transitioning of the port to the Forwarding state and the suppression of Topology Change Notification These features are represented by the parameters pointtopoint and edgeport MSTP is compatible to both RSTP and STP It behaves appropriately to STP and RSTP bridges A MSTP bridge can be configured to behave entirely as a RSTP bridge or a STP bridge So an IEEE 802 1s bridge inherently also supports IEEE 802 1w and IEEE 802 1D The MSTP algorithm and protocol provides simple and full connectivity for frames assigned to any given VLAN throughout a Bridged LAN co
152. configured as a monitoring port and is the destination port in a port mirroring session For additional information about port monitoring and probe ports see Multiple Port Mirroring on page 222 e Port Channel Indicates that the port has been configured as a member of a port channel which is also known as a link Aggregation Group LAG Chapter 6 Monitoring the System 205 GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Port Channel ID If the port is a member of a port channel the port channel s interface ID and name are shown Otherwise Disable is shown Port Role Each MST Bridge Port that is enabled is assigned a Port Role for each spanning tree The port role will be one of the following values Root Port Designated Port Alternate Port Backup Port Master Port or Disabled Port STP Mode Displays the Spanning Tree Protocol STP Administrative Mode for the port or LAG The possible values for this field are e Enable Enables the Spanning Tree Protocol for this port e Disable Disables the Spanning Tree Protocol for this port STP State Displays the port s current state Spanning Tree state This state controls what action a port takes on receipt of a frame If the bridge detects a malfunctioning port it will place that port into the broken state The other five states are defined in IEEE 802 1D e Disabled e Blocking e Listening e Learning e Forwa
153. count of MAC Control frames received on this interface with an opcode indicating the PAUSE operation This counter does not increment when the interface is operating in half duplex mode Unacceptable Frame Type The number of frames discarded from this port due to being an unacceptable frame type Multicast Tree Viable Discards The number of frames discarded when a lookup in the multicast tree for a VLAN occurs while that tree is being modified 208 Chapter6 Monitoring the System GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Reserved Address Discards The number of frames discarded that are destined to an IEEE 802 1 reserved address and are not supported by the system Broadcast Storm Recovery CFI Discards The number of frames discarded that are destined for FF FF FF FF FF FF when Broadcast Storm Recovery is enabled The number of frames discarded that have CFI bit set and the addresses in RIF are in non canonical format Upstream Threshold The number of frames discarded due to lack of cell descriptors available for that packet s priority level Total Packets Transmitted Octets Packets Transmitted 64 Octets The total number of octets of data including those in bad packets transmitted on the network excluding framing bits but including FCS octets This object can be used as a reasonable estimate of ethernet utilization If greater precis
154. current IP address of the device as the management IP address Notification When notifications are enabled LLDP interacts with the Trap Manager to notify subscribers of remote data change statistics The default is Disabled Optional TLV s Enable or disable the transmission of optional type length value TLV information from the interface The TLV information includes the system name system description system capabilities and port description To configure the System Name see Management on page 32 To configure the Port Description see Ports on page 70 2 f you make any changes to the page click Apply to apply the new settings to the system 3 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch LLDP MED Network Policy This page displays information about the LLPD MED network policy TLV transmitted in the LLDP frames on the selected local interface To display this page click System gt LLDP gt Advanced gt LLDP MED Network Policy NETGEAR GS724T E System Switching QoS Security Monitoring Maintenance Help t000ur J gt Basic v Advanced LLOP Configuration LLOP Port Settings LLDP MED Network Policies Information Network Policy Network VLAN VLAN LLOP MED Port Policy Application d oso ID Type Priority Settings Number Local Information Neighbors Information 24 Port Gigabit Smart Switch LLDP MED Network P
155. ddress of the router to perform the querying and configure the related parameters To access this page click Switching gt Multicast gt IGMP Snooping Querier gt IGMP Snooping gt Querier Configuration NETGEAR GS724T 24 Port Gigabit Smart Switch sooour gt Auto Video Querier Configuration gt IGMP Snooping IGMP Smooping Querier Configuration Querter Querier Ade Mode Querer Snooping Querier Address Configuration ICME Version Quener VLAN Configuration Query Interval secs Querier VLAN Querier Expiry Interval secs Status REFRESH To configure IGMP Snooping Querier settings Chapter 3 Configuring Switching Information 119 GS716Tv2 and GS724Tv3 Software Administration Manual 1 From the Querier Admin Mode field enable or disable the administrative mode for IGMP Snooping Querier 2 In the Snooping Querier Address field specify the IP address to be used as source address in periodic IGMP queries This address is used when no address is configured on the VLAN on which the query is being sent 3 In the IGMP Version field specify the IGMP protocol version used in periodic IGMP queries In the Query Interval field specify the time interval in seconds between periodic queries sent by the snooping querier The Query Interval must be a value in the range of 1 1800 seconds The default value is 60 5 n the Querier Expiry Interval field specify the time interval in seconds after which
156. de associated with the port or port channel 98 Chapter3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual e Fast Link Specifies if the specified port is an Edge Port with the CST Possible values are Enable or Disable The default is Disable e Port State The Forwarding state of this port This field is read only e Path Cost Set the Path Cost to a new value for the specified port in the common and internal spanning tree It takes a value in the range of 1 200000000 e Priority The priority for a particular port within the CST The port priority is set in multiples of 16 If you specify a value that is not a multiple of 16 the priority is set to the priority is automatically set to the next lowest priority that is a multiple of 16 For example if you set a value between 0 and 15 the priority is set to 0 If you specify a number between 16 and 31 the priority is set to 16 e External Port Path Cost Set the External Path Cost to a new value for the specified port in the spanning tree It takes a value in the range of 1 200000000 e Port ID The port identifier for the specified port within the CST It is made up from the port priority and the interface number of the port e Hello Timer Specifies the switch Hello time which indicates the amount of time in seconds a port waits between configuration messages The value is fixed at 2 seconds 6 Click Cancel to cancel the configur
157. described in this section This procedure assumes that you have downloaded or otherwise obtained the firmware upgrade and that you have it available as a binary file on your computer This procedure uses the TFTP protocol to implement the transfer from computer to switch Note You can also upgrade the firmware using the TFTP Download and HTTP Download features mentioned in this book To upgrade your firmware 1 Click the Maintenance tab and then click the Firmware link directly below the tabs see Figure on page 13 2 Select the switch to upgrade and click Download Firmware By default the firmware is downloaded to primary storage and will be become the active image after the download completes and the switch reboots To download firmware to use as a backup image select the Secondary Storage option To prevent the switch from using the downloaded firmware as the active image make sure the Run this FW after download option is clear 3 From the Select new firmware window that appears navigate to and select the firmware image to download to the switch 4 Click Open You can choose to schedule a later time to complete the download and installation by clearing the Run Now option and selecting a date and time to perform the firmware download and installation The scheduled firmware download appears in the Tasks list Date 9 9 2010 ad Time 11 20 pm C Documents and Settings Administrator Desktop NG CS709TRre3v6mb i L
158. display this page click Maintenance Download HTTP File Download 24 Port Gigabit Smart Switch Systen Switching QoS Se ty Monitoring Maintenance elp togouT J Reset Upload File Management Trovbleshooting NETGEAR GS724T gt TFTP File Download HTTP File Download v HTTP File Download HTTP File Download File Type Code Image Name mage w Select File Browse NOTE After a File transfer is started please wait till the page refreshes When the page refreshes the Select file option will be blanked This indicates that the file transfer is done To download a file to the switch from by using HTTP 1 From the File Type menu Specify what type of file you want to download to the switch e Code The code is the system software image which is saved in one of two flash sectors called images image1 and image2 The active image stores the active copy while the other image stores a second copy The device boots and runs from the active image If the active image is corrupt the system automatically boots from the non active image This is a safety feature for faults occurring during the boot upgrade process e Text Configuration A text based configuration file enables you to edit a configured text file startup config offline as needed without having to translate the contents for the switch to understand The most common usage of text based configuration is to upload a working configuration from a device edit it o
159. e traffic ingressing on an interface increases beyond the configured threshold the traffic will be dropped e Multicast If the rate of L2 multicast traffic ingressing on an interface increases beyond the configured threshold the traffic will be dropped e Broadcast If the rate of L2 broadcast traffic ingressing on an interface increases beyond the configured threshold the traffic will be dropped 3 When the selected Ingress Control Mode is an option other than Disable select Enable or Disable from the Status menu to specify the administrative status of the mode 4 In the Threshold field specify the maximum rate at which unknown packets are forwarded The range is a percent of the total threshold between 0 1009 6 The default is 5 5 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 6 If you make changes to the page click Apply to apply the changes to the system Port Security Configuration Use the Port Security feature to lock one or more ports on the system When a port is locked only packets with an allowable source MAC addresses can be forwarded All other packets are discarded To display the Port Security Configuration page click Security gt Traffic Control and then click the Port Security gt Port Security Configuration link NETGEAR GS724T fj 24 Port Gigabit Smart Switch System witching QoS Security Monitoring Maintenance Help LOG
160. e secs Displays the time interval in hundredths of a second between the most recent Accounting Response and the Accounting Request that matched it from this RADIUS accounting server Accounting Requests The number of RADIUS Accounting Request packets sent to this server This number does not include retransmissions Accounting Retransmissions The number of RADIUS Accounting Request packets retransmitted to this server Accounting Responses Displays the number of RADIUS packets received on the accounting port from this server Malformed Accounting Responses Displays the number of malformed RADIUS Accounting Response packets received from this server Malformed packets include packets with an invalid length Bad authenticators and unknown types are not included as malformed accounting responses Bad Authenticators Displays the number of RADIUS Accounting Response packets that contained invalid authenticators received from this accounting server Pending Requests The number of RADIUS Accounting Request packets destined for this server that have not yet timed out or received a response Timeouts The number of accounting timeouts to this server Unknown Types The number of RADIUS packets of unknown type which were received from this server on the accounting port Packets Dropped The number of RADIUS packets received from this server on the accounting port and dropped for some
161. e Administration Manual Management Security Settings From the Management Security Settings page you can configure the login password Remote Authorization Dial In User Service RADIUS settings Terminal Access Controller Access Control System TACACS settings and authentication lists To display the page click the Security gt Management Security tab The Management Security folder contains links to the following features e Change Password on page 150 e RADIUS Configuration on page 151 e Configuring TACACS on page 156 e Authentication List Configuration on page 159 Change Password Use the page to change the login password To display the page click Security gt Management Security gt User Configuration gt Change Password NETGEAR GS724T 24 Port Gigabit Smart Switch Security Monitoring Maintenance Help ioo0vr Access Port Authentication Traffic Control ACL v User Configuration Change Password Change Password gt RADIUS Change Password gt TACACS Old Password DTI gt Authentication List New Password Confirm Password Reset Password REFRESH CANCEL To change the login password for the management interface 1 Specify the current password in the Old Password The entered password will be displayed in asterisks Passwords are 1 20 alphanumeric characters in length and are case sensitive 2 Enter the new password It will not display as it is typed and only asterisks will sho
162. e Class Network Network Policies Application User tm VLAN ID VLAN Type DSCP Type Priority Youre o Untagged The following table describes the detailed local information that displays for the selected port Field Description Managed Address Address SubType Displays the type of address the management interface uses such as an IPv4 address Address Displays the address used to manage the device Interface SubType Displays the port subtype Interface Number Displays the number that identifies the port MAC PHY Details Auto Negotiation Supported Specifies whether the interface supports port speed auto negotiation The possible values are True or False Chapter 2 Configuring System Information 59 GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Auto Negotiation Enabled Displays the port speed auto negotiation support status The possible values are True enabled or False disabled Auto Negotiation Advertised Capabilities Displays the port speed auto negotiation capabilities such as 1000BASE T half duplex mode or 100BASE TX full duplex mode Operational MAU Type Displays the Medium Attachment Unit MAU type The MAU performs physical layer functions including digital data conversion from the Ethernet interface collision detection and bit injection into the network MED Details Capabilities Supported Displays the ME
163. e Force Protocol Version parameter for the switch Options are e STP Spanning Tree Protocol IEEE 802 1D e RSTP Rapid Spanning Tree Protocol IEEE 802 1w e MSTP Multiple Spanning Tree Protocol IEEE 802 1s Specify the configuration name and revision level e Configuration Name Name used to identify the configuration currently being used It may be up to 32 alphanumeric characters e Configuration Revision Level Number used to identify the configuration currently being used The values allowed are between 0 and 65535 The default value is 0 Specify the BPDU Flooding status for all ports or for individual ports When this feature is enabled BPDU packets arriving at this port are flooded to other ports if STP is disabled Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 94 Chapter3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual 6 If you make any configuration changes click Apply to send the updated configuration to the switch Configuration changes occur immediately The following table describes the STP Status information displayed on the screen Field Description Bridge Identifier The bridge identifier for the CST It is made up using the bridge priority and the base MAC address of the bridge Time Since Topology Change Topology Change Count The time in seconds since the topology
164. e Help tocout Address Table MAC Address Table Advanced Search By VLAN ID Total MAC Addresses 22 MAC Address Status 00 0 01 15 F9 00 0F 83 96 A 3F F FE 32 A9 12 00 10 18 48 F8 3 00 11 88 99 453 3 00 11 88 39 43 76 00 11 88 99 453 77 00 14 2A 14 8F BA 00 14 2A 16 00 C5 00 14 2A4026 33 C1 00 14 2A 2C 53 C4 00 14 2A 2C 83 C8 00 14 24 38 00 83 00 14 5 04 91 31 00 19 20 24 79 2 00 19 89 3 17 70 00 18 90 59 C 00 00 1E C9 AA AC OA 00 20 4A 82 00 72 00 26 92 f6 82 DA 00 26 52 F6182 DC 30 46 9A 9F fC 05 CLEAR REFRESH To search for an entry in the MAC Address Table 1 Use the Search By field to search for MAC Addresses by MAC Address VLAN ID or Interface e MAC Address Select MAC Address from the menu and enter a six byte hexadecimal MAC address in two digit groups separated by colons then click Go If the address exists that entry will be displayed An exact match is required e VLAN ID Select VLAN ID from the menu enter the VLAN ID for example 100 Then click Go If any entries with that VLAN ID exist they are displayed e Interface Select Interface from the menu enter the interface ID in g1 g2 format then click Go If any entries learned on that interface exist they are displayed 2 Click Clear to clear Dynamic MAC Addresses in the table 3 Click Refresh to redisplay the page to show the latest MAC Addresses 4 Click Cancel to cancel the configuration on the screen a
165. e check box associated with the rule change the desired fields and click Apply MAC Binding Configuration When an ACL is bound to an interface all the rules that have been defined are applied to the selected interface Use the MAC Binding Configuration page to assign MAC ACL lists to ACL Priorities and Interfaces To display the MAC Binding Configuration page click Security gt ACL then click the Basic gt MAC Binding Configuration link NETGEAR GS724T 24 Port Gigabit Smart Switch Security aintenonc 1060ur Management Security Access Port Authentication Troff amp Control ACL Wizard MAC Binding Configuration Basic MAC ACL Binding Configuration MAC Rules Direction MAC Binding Configuration Binding Table gt Advanced 1 to 4294967295 Interface Binding Status Interface Direction ACL Type ACL ID Seq No lt To configure MAC ACL interface bindings 1 Select an existing MAC ACL from the ACL ID menu The packet filtering direction for ACL is Inbound which means the MAC ACL rules are applied to traffic entering the port 2 Specify an optional sequence number to indicate the order of this access list relative to other access lists already assigned to this interface and direction 188 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual 4 5 A low number indicates high precedence order If a sequence number is already in use for this int
166. e check box on the page 2 Click Apply The switch resets immediately The management interface is not available until the switch completes the boot cycle After the switch resets the login screen appears Factory Default Use the Factory Default page to reset the system configuration to the factory default values Note If you reset the switch to the default configuration the IP address is reset to 192 168 0 239 and the DHCP client is enabled If you loose network connectivity after you reset the switch to the factory defaults see Connecting the Switch to the Network on page 12 To access the Factory Defaults page click Maintenance Reset Factory Default 226 Chapter7 Maintenance GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help 1060w Uplod Download File Management Trowbleshooting gt Device Reboot Factory Default v Factory Default Factory Default Check this box and click APPLY below to retwrn all configuration settings to default values To reset the switch to the factory default settings 1 Select the check box on the page 2 Click Apply The switch resets immediately Chapter 7 Maintenance 227 GS716Tv2 and GS724Tv3 Software Administration Manual Upload File From Switch The switch supports system file uploads from the switch to a remote system by using TFTP Use the File
167. e first only 802 1p header to a specified value when packets are transmitted for the traffic class An 802 1p header is inserted if it does not already exist This is useful for assigning a layer 2 priority level based on a DiffServ forwarding class i e DSCP or IP Precedence value definition to convey some QoS characteristics to downstream switches which do not routinely look at the DSCP value in the IP header e Policing a method of constraining incoming traffic associated with a particular class so that it conforms to the terms of the TCS Special treatment can be applied to out of profile packets that are either in excess of the conformance specification or are non conformant The DiffServ feature supports the following types of traffic policing treatments actions e drop the packet is dropped e mark cos the 802 1p user priority bits are re marked and forwarded e mark dscp the packet DSCP is re marked and forwarded e mark prec the packet IP Precedence is re marked and forwarded e send the packet is forwarded without DiffServ modification Color Mode Awareness Policing in the DiffServ feature uses either color blind or color aware mode Color blind mode ignores the coloration marking of the incoming packet Color aware mode takes into consideration the current packet marking when determining the policing outcome An auxiliary traffic class is used in conjunction with the policing definition to specify a value for one of the 802 1
168. e mask as is the Management Station IP Address and if the values are equal access is allowed For example if the Management Station IP and Management Station IP Mask parameters are 192 168 1 0 255 255 255 0 then any client whose address is 192 168 1 0 through 192 168 1 255 inclusive will be allowed access To allow access from only one station use a Management Station IP Mask value of 255 255 255 255 and use that machine s IP address for Client Address e Management Station IP Mask Specify the subnet mask to associate with the management station IP address 48 Chapter 2 Configuring System Information GS716Tv2 and GS724Tv3 Software Administration Manual Community String Specify a community name A valid entry is a case sensitive string of up to 16 characters Access Mode Specify the access level for this community by selecting Read Write or Read Only from the menu Status Specify the status of this community by selecting Enable or Disable from the pull down menu If you select Enable the Community Name must be unique among all valid Community Names or the set request will be rejected If you select Disable the Community Name will become invalid 2 To modify an existing community select the check box next to the community change the desired fields and then click Apply Configuration changes take effect immediately 3 To delete a community select the check box next to the community and click Delete 4 Click
169. eb user interface e Simple Network Management Protocol SNMP Each of the standards based management methods allows you to configure and monitor the components of the switch software The method you use to manage the system depends on your network size and requirements and on your preference This manual describes how to use the Web based interface to manage and monitor the system Using the Web Interface To access the switch by using a Web browser the browser must meet the following software requirements e HTML version 4 0 or later e HTTP version 1 1 or later e Java Runtime Environment 1 6 or later Use the following procedures to log on to the Web interface 1 Open a Web browser and enter the IP address of the switch in the Web browser address field 2 The factory default password is password Type the password into the field on the login screen and then click Login Passwords are case sensitive 3 After the system authenticates you the System Information page displays Figure 1 on page 25 shows the layout of the Smart Switch Web interface 24 Chapter 1 Getting Started GS716Tv2 and GS724Tv3 Software Administration Manual 24 Port Gigabit Smart Switch NETGEAR GS724T v System Information System Information Online Help Context Sensitive Help gt IP Configuration E gt Time System Information gt Denial of Service gt DNS gt Green Ethernet Configuration 9rstem Location System Contact Senal
170. ecify the UDP destination port in probe packets The valid range is 1 65535 e Size Specify the size of probe packets The valid range is 0 65507 3 Click Cancel to cancel the operation on the screen and reset the data on the screen to the latest value of the switch 4 Click Apply to initiate the traceroute The results display in the TraceRoute area Chapter 7 Maintenance 239 GS716Tv2 and GS724Tv3 Software Administration Manual 240 Chapter7 Maintenance Help Use the features available from the Help tab to connect to online resources for assistance The Help tab contains a link to Online Help Online Help The Online Help includes the following pages e Support on page 241 e User Guide on page 242 Support Use the Support page to connect to the Online Support site at netgear com To access the Support page click Help Support NETGEAR GS724T edt with lnovehon 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance v Support Support User Guide Support Please cick APPLY below to be taken to the Online Support site at netgear com To connect to the NETGEAR support site for the GS716T or GS724T click Apply Chapter 8 Help 241 GS716Tv2 and GS724Tv3 Software Administration Manual User Guide Use the User Guide page to access the GS716Tv2 and GS724Tv3 Software Administration Manual the guide you are now reading that is available on the NET
171. ed DiffServ Class Information Configuration Polcy Name NewPolicyName Class Policy Type In Configuration Policy Configuration acces Policy Attribute Configuration Service Statistics Assign Quewe Member Class Name NewClass Policy O o Attribute Mark COS Mark IP Precedence Mark IP DSCP Simple Policy Color Mode Color Coeform Class Color Coatorm Mode Committed Rate Committed Burst Sire Send Send Drop Drop Mark CoS 0 Mark CoS o Mark IP Precedence 0 Mark IP Precedence O Mark IP DSCP afii Mark IP DSCP afit ALIAE SM 2 Select the queue to which packets will of this policy class will be assigned 3 Configure the policy attributes e Drop Select this option to drop packets for this policy class Mark CoS Enter the specified Class of Service queue number to mark all packets for the associated traffic stream with the specified class of service value in the priority field of the 802 1p header If the packet does not already contain this header one is inserted The CoS value is an integer from 0 7 e Mark IP Precedence Use this attribute to mark all packets for the associated traffic stream with the IP Precedence value you enter in the IP Precedence Value field e Mark IP DSCP Use this attribute to mark all packets for the associated traffic stream with IP DSCP value you choose from the menu Chapter 4 Configuring Quality of Service 143 GS716Tv2 and GS724Tv3 Software
172. ed 80 01 00 00 00 01 15 86 80102 100100100101 125i 80 01 00 00 00 01 13 f 80 01 00 00 00 01 15 80 01 100 00 00 01 13 f8 Disabled oo 00 o o0 o ALIRESM 7C ANCIL APPLY Chapter 3 Configuring Switching Information 105 GS716Tv2 and GS724Tv3 Software Administration Manual Note If no MST instances have been configured on the switch the page displays a No MSTs Available message MST Port Configuration Status No MSTs Available To configure MST port settings aU N To configure MST settings for a physical port click PORTS To configure MST settings for a Link Aggregation Group LAG click LAGS To configure MST settings for both physical ports and LAGs click ALL Select the check box next to the port or LAG to configure You can select multiple ports and LAGs to apply the same setting to the selected interfaces Select the check box in the heading row to apply the same settings to all interfaces Configure the MST values for the selected port s or LAG s e Port Priority The priority for a particular port within the selected MST instance The port priority is set in multiples of 16 If you specify a value that is not a multiple of 16 the priority is set to the priority is automatically set to the next lowest priority that is a multiple of 16 For example if you set a value between 0 and 15 the priority is set to 0 If you specify a number between 16 and 31 the priority is set to 16 It takes a
173. ed or disabled on the current server 4 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 5 f you make changes to the page click Apply to apply the changes to the system RADIUS Server Configuration Use the RADIUS Server Configuration page to view and configure various settings for the current RADIUS server configured on the system To access the RADIUS Server Configuration page click Security gt Management Security and then click the RADIUS gt Server Configuration link 152 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR GS724T 24 Port Gagabt Sman Serch Uwer Configuration Server Configuration Authentication Port Secret Configured Secret Authentication List To configure a RADIUS server 1 To add a RADIUS server specify the settings the following list describes and click Add In the Server Address field specify the IP address of the RADIUS server to add In the Authentication Port field specify the UDP port number the server uses to verify the RADIUS server authentication The valid range is 0 65535 From the Secret Configured menu select Yes to add a RADIUS secret in the next field You must select Yes before you can configure the RADIUS secret After you add the RADIUS server this field indicates whether the shared secret for this server has been configured
174. ed user account The valid Authentication Protocols are None MD5 or SHA If you select e None The user will be unable to access the SNMP data from an SNMP browser e MD5 or SHA The user login password will be used as SNMPv3 authentication password and you must therefore specify a password The password must be eight characters in length 2 In the Encryption Protocol field choose whether to encrypt SNMPv3 packets transmitted by the switch e None Do not encrypt the contents of SNMPv3 packets transmitted from the switch e DES Encrypt SNMPv3 packets using the DES encryption protocol 3 If you selected DES in the Encryption Protocol field enter the SNMPv3 Encryption Key here Otherwise this field is ignored Valid keys are 0 to 15 characters long 4 Click Apply to send the updated configuration to the switch Configuration changes take effect immediately 5 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch Chapter 2 Configuring System Information 51 GS716Tv2 and GS724Tv3 Software Administration Manual LLDP The IEEE 802 1AB defined standard Link Layer Discovery Protocol LLDP allows stations on an 802 LAN to advertise major capabilities and physical descriptions This information is viewed by a network manager to identify system topology and detect bad configurations on the LAN From the LLDP link you can access the following pages e
175. efault those License Keys are not available If License Key for feature is not available the user will not be allowed to configure this functionality Available License Key allows the user to configure functionality Non Configurable Data e License date The date the license is purchased e License copy The information about the number of license e License Status Show whether License is Active Inactive Inactive means that user should download a license file and reboot a system e Description Show status of License Key NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help 1000ur Management Device View License Key License Key License date License copy License Status Inactive Description License key is nct present SNMP From SNMP link under the System tab you can configure SNMP settings for SNMP V1 V2 and SNMPv3 From the SNMP link you can access the following pages e SNMPV1 V2 on page 47 e Trap Flags on page 50 e SNMP v3 User Configuration on page 51 SNMPV1 V2 The pages under the SNMPV1 V2 menu allow you to configure SNMP community information traps and trap flags Chapter 2 Configuring System Information 47 GS716Tv2 and GS724Tv3 Software Administration Manual Community Configuration To display this page click System gt SNMP gt SNMP V1 V2 gt Community Configuration By default two SNMP Communities exist e Private
176. efault IP address on the switch For most networks this means you must change the IP address of the administrative system to be on the same subnet as the default IP address of the switch 192 168 0 239 To change the IP address on an administrative system running a Microsoft Windows operating system open the Internet Protocol TCP IP properties screen that you access from the Local Area Connection properties as shown in the following figure You need Windows Administrator privileges to change these settings Internet Protocol TCP IP Properties a t3 Generi You can get IP settings assigned automatically f your netwodk supports Fus capeb ty Othenw se you need to ask your network adrnistrator for fe aporopeate IP semeos Obtain an IP address actomatcaly 9 Use the following IP address P address Surat mask Def sut gateway Upe the following DNS server addresses Posterred DNS server Akemate ONS server Advanced A WARNING When you change the IP address of your administrative system you will loose your connection to the rest of the network Be sure to write down your current network address settings before you change them 16 Chapter 1 Getting Started GS716Tv2 and GS724Tv3 Software Administration Manual To modify the network settings on your administrative system 1 On your PC access the MS Windows operating system TCP IP Properties 2 Setthe IP address of the administrative system to an addre
177. eived Version Received o o o o o o s o o o 00 00 00 00 00 00 0 o 3 o 0 o o o 00 00 00 00 00 00 0 o s o o o o o 00 00 00 09 00 00 0 e o o o o o o o c o 00 00 00 00 00 00 GS724T 24 Port Gigabit Smart Switch EAP Response ID Response Request ID Request trames Frames Frames trames Received Received Transmitted Transmitted Chapter 6 Monitoring the System 211 GS716Tv2 and GS724Tv3 Software Administration Manual The following table describes the EAP statistics displayed on the screen Field Description Ports Specifies the interface which is polled for statistics Frames Received Displays the number of valid EAPOL frames received on the port Frames Transmitted Displays the number of EAPOL frames transmitted through the port Start Frames Received Displays the number of EAPOL Start frames received on the port Logoff Frames Received Displays the number of EAPOL Log off frames that have been received on the port Last Frame Version Displays the protocol version number attached to the most recently received EAPOL frame Last Frame Source Displays the source MAC Address attached to the most recently received EAPOL frame Invalid Frames Received Displays the number of unrecognized EAPOL frames received on this port Length Error Frames Received Displays the number of EAPOL frames with an invalid Packet Body Length received on this port Response
178. ely IP Extended Rule Use the IP Extended Rules page to define rules for IP based extended ACLs The access list definition includes rules that specify whether traffic matching the criteria is forwarded normally or discarded Note There is an implicit deny all rule at the end of an ACL list This means that if an ACL is applied to a packet and if none of the explicit rules match then the final implicit deny all rule applies and the packet is dropped To display the IP extended Rules page click Security gt ACL then click the Advanced gt IP Extended Rules link In the following figure an extended IP ACL exists and one rule has been configured NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help tocour Manegement Security Access Port Authentication Traffic Control gt ACL Wizard IP ACL gt Basic v Advanced IP ACL IP ACL Current Number of ACL IP Rules IP Extended Rules IP Binding IP ACL Table Configuration Maximum ACL IP ACL ID Binding Table Pu Chapter 5 Managing Device Security 193 GS716Tv2 and GS724Tv3 Software Administration Manual To configure rules for an IP ACL 1 To add an IP ACL rule to an extended IP ACL select the ACL ID to add the rule to select the check box in the Extended ACL Rule table and click Add Note The ACL you select must have an ACL ID between 100 and 199 The page displays the extended AC
179. ements for a PVID e All ports must have a defined PVID e If no other value is specified the default VLAN PVID is used e Ifyou want to change the port s default PVID you must first create a VLAN that includes the port as a member e Use the Port VLAN ID PVID Configuration page to configure a virtual LAN on a port To access the Port PVID Configuration page click Switching gt VLAN gt Advanced gt Port PVID Configuration Chapter 3 Configuring Switching Information 83 GS716Tv2 and GS724Tv3 Software Administration Manual NE TG E A R GS724T 24 Port Gigabit Smart Switch System Switching Security Monitoring Maintenonce Help tocour Voice VLAN Auto VolP STP Multicost Address Toble gt Basic Port PVID Configuration v Advanced VLAN PVID Configuration Configuration PORTS LAGS AN GO TO INTERFACE VLAN PVID 1 Port Membersh o IR Acceptable Ingress 3 n i ace r r Port PVIO Frame Types Filtering SN 4 0 to 7 IL a mmm Admit All Disable Admit All Disable Admit All Disable Admit All Disable Admit All Disable Admit All Oisable Admit All Oisable Admit All Disable Admit All Oisable Admit All Oisable Admit All Oisable Admit All Oisable Admit All Disable Admit All Disable Admit All Disable Admit All Disable Admit All Oisable Admit All Disable Admit All Oisable Admit All Oisable Admit All Disable Admit All Disable Admit All Disable Admit All Oisable GO TO INTERFACE
180. er of packets received that were directed to the broadcast address This does not include multicast packets Receive Packets Discarded The number of inbound packets which were chosen to be discarded even though no errors had been detected in order to prevent their being delivered to a higher layer protocol A possible reason for discarding a packet could be to free up buffer space Octets Transmitted The total number of octets transmitted out of the interface including framing characters Packets Transmitted Without Errors The total number of packets transmitted out of the interface Unicast Packets Transmitted The total number of packets that higher level protocols requested be transmitted to a subnetwork unicast address including those that were discarded or not sent Multicast Packets Transmitted The total number of packets that higher level protocols requested be transmitted to a Multicast address including those that were discarded or not sent Broadcast Packets Transmitted The total number of packets that higher level protocols requested be transmitted to the Broadcast address including those that were discarded or not sent Transmit Packets Discarded The number of outbound packets which were chosen to be discarded even though no errors had been detected in order to prevent their being delivered to a higher layer protocol A possible reason for discarding a packet could be to free up
181. erface and direction the specified access list replaces the currently attached access list using that sequence number If the sequence number is not specified by the user a sequence number that is one greater than the highest sequence number currently in use for this interface and direction will be used The valid range is 14294967295 Click the appropriate orange bar to expose the available ports or LAGs e To add the selected ACL to a port or LAG click the box directly below the port or LAG number so that an X appears in the box e Toremove the selected ACL from a port or LAG click the box directly below the port or LAG number to clear the selection An X in the box indicates that the ACL is applied to the interface Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch Click Apply to save any changes to the running configuration MAC Binding Table Use the MAC Binding Table page to view or delete the MAC ACL bindings To display the MAC Binding Table click Security gt ACL then click the Basic gt Binding Table link NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help tooour Manegesent Security Access Port Authentication Traffic Control gt ACL Wizard MAC Binding Table Basic MAC ACL MAC Binding Table MAC Rules MAC Ginding Interface Direction ACL Type Configuration Bi
182. ership a 12 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 X X X X To create a LAG 1 From the LAG ID field select the LAG to configure 2 In the LAG Name field enter the name you want assigned to the LAG You may enter any string of up to 15 alphanumeric characters A valid name has to be specified to create the LAG 3 Click the orange bar to display the ports 76 Chapter3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual 4 Click the box below each port to include in the LAG The following figure shows an example of how to configure LAG1 with ports e1 e4 as members LAG Membership 5 Membership IT eee Pott 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 X XXX 25 26 27 28 5 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 6 If you make any changes to this page click Apply to send the updated configuration to the switch Configuration changes take effect immediately 7 To view the ports that are members of the selected LAG click Current Members LACP Configuration To display the LACP Configuration page click Switching gt LAG gt Advanced gt LACP Configuration NE TG E A R GS724T 24 Port Gigabit Smaart Switch System Switching QoS T Monitoring Maintenance Help Logout VLAN Voice VLAN Auto VolP STP Multicost Address Table L
183. es Priority facility value x 8 severity level The facility value is usually one which means it is a user level message Therefore to determine the severity level of the message subtract eight from the number in the angle brackets The example log message has a severity level of 6 informational For more information about the severity of a log message see the Severity Filter description on page 218 The message was generated on March 24 at 5 34 05 a m by the switch with an IP address of 10 131 12 183 The component that generated the message is unknown but it came from line 179 of the main login c file This is the 3 855 message logged since the switch was last booted The message indicates that the administrator logged onto the HTTP management interface from a host with an IP address of 10 27 64 122 Use the buttons at the bottom of the page to perform the following actions e Click Clear to clear the messages out of the buffered log in the memory e Click Refresh to update the page with the latest messages in the log e Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch FLASH Log Configuration The FLASH log is a log that is stored in persistent storage which means that the log messages are retained across a switch reboot e The first log type is the system startup log The system startup log stores the first N messages received after system reboot
184. es Ger t auf den Markt gebracht wurde und es ist berechtigt die Serie auf die Erf llung der Vorschriften hin zu berpr fen Voluntary Control Council for Interference VCCI Statement This equipment is in the Class B category information equipment to be used in a residential area or an adjacent area thereto and conforms to the standards set by the Voluntary Control Council for Interference by Data Processing Equipment and Electronic Office Machines aimed at preventing radio interference in such residential areas When used near a radio or TV receiver it may become the cause of radio interference Read instructions for correct handling FCC Caution Any changes or modifications not expressly approved by the party responsible for compliance could void the user s authority to operate this equipment This device complies with Part 15 of the FCC Rules Operation is subject to the following two conditions 1 This device may not cause harmful interference and 2 this device must accept any interference received including interference that may cause undesired operation Regulatory Compliance Information This section includes user requirements for operating this product in accordance with National laws for usage of radio spectrum and operation of radio devices Failure of the end user to comply with the applicable requirements may result in unlawful operation and adverse action against the end user by the applicable National regulatory auth
185. escription Log The sequence number of this trap System Up Time The time at which this trap occurred expressed in days hours minutes and seconds since the last reboot of the switch Trap Information identifying the trap Click Clear Counters to clear all the counters This resets all statistics for the trap logs to the default values Event Logs Use the Event Log page to display the event log which is used to hold error messages for catastrophic events After the event is logged and the updated log is saved in flash memory the switch will be reset The log can hold at least 2 000 entries and is erased when an attempt is made to add an entry after it is full The event log is preserved across system resets To access the Event Log page click the Monitoring Logs tab and then click the Event Logs link NETGEAR System Memory Log gt FLASH Log gt Server Log gt Trap Logs v Event Logs GS724T 24 Port Gigabit Smart Switch _tocour Monitoring Maintenonce Event Logs Event Logs Type Filename Line Task ID gt RURALS The following table describes the Event Log information displayed on the screen Field Description Entry The number of the entry within the event log The most recent entry is first Type Specifies the type of entry Filename The GS716T or GS724T source code filename identifying the code that detected the event
186. ess and then click the HTTP gt HTTP Configuration link NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security 1 Logout Management Security Port Authentication Trofi Control ACL v HTTP HTTP Configuration HTTP Configuration HTTP Configuration gt HTTPS gt Access Control Java Mode HTTP Session Soft Timeout Minutes 5 HTTP Session Hard Timecet Mours 24 Maximum Number of HTTP Sessions 16 To configure the HTTP server settings 1 Enable or disable the Web Java Mode This applies to both secure and un secure HTTP connections The currently configured value is shown when the Web page is displayed The default value is Enable 2 In the HTTP Session Soft Timeout field specify the number of minutes an HTTP session can be idle before a timeout occurs After the session is inactive for the configured amount of time the administrator is automatically logged out and must re enter the password to access the management interface A value of zero corresponds to an infinite timeout The default value is 5 minutes The currently configured value is shown when the Web page is displayed 3 In the HTTP Session Hard Timeout field specify the hard timeout for HTTP sessions Chapter 5 Managing Device Security 161 GS716Tv2 and GS724Tv3 Software Administration Manual This timeout is unaffected by the activity level of the session The value must be in the range of 0 168 hours A value of ze
187. ess can be an IP address in standard x x x x format or a hostname The hostname must start with a letter of the alphabet Make sure that the software image or other file to be downloaded is available on the TFTP server N 3 In the Remote File Name field specify the name of the file to download including the path You may enter up to 32 characters Select the Start File Transfer check box Click Apply to start the transfer A status message displays during the transfer and upon successful completion of the transfer m o 6 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 164 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual Access Profile Configuration Use the Access Profile Configuration page to configure settings that control management access to the switch Access profile configuration requires three steps 1 Use the Access Profile Configuration page to create an access profile To add rules to the profile the access profile must be deactivated which is the default setting 2 Use the Access Rule Configuration page to add one or more access rules to the profile 3 Return to the Access Profile Configuration page to activate the profile To access the Access Profile Configuration page click Security Access and then click the Access Control gt Access Profile Configuration link NETGEAR GS724T
188. ession is inactive for the configured amount of time the administrator is automatically logged out and must re enter the password to access the management interface A value of zero corresponds to an infinite timeout The default value is 5 minutes The currently configured value is shown when the Web page is displayed 6 In the HTTPS Session Hard Timeout field specify the number of hours an HTTPS session can remain active regardless of session activity The value must be in the range of 1 168 hours The default value is 24 hours The currently configured value is shown when the Web page is displayed 7 In the Maximum Number of HTTPS Sessions field specify the maximum number of HTTPS sessions that can be open at the same time The value must be in the range of 0 2 The default value is 2 The currently configured value is shown when the Web page is displayed 8 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 9 If you make changes to the page click Apply to apply the changes to the system Certificate Download For the Web server on the switch to accept HTTPS connections from a management station the Web server needs a public key certificate You can generate a certificate externally for example off line and download it to the switch To display the Certificate Download page click Security Access and then click the HTTPS Certificate Download
189. eth Tho task schedule is displayed Cancel Apply 5 Enter the switch password to continue downloading the firmware 6 Click Apply to download the firmware and upgrade the switch with the new image Chapter 1 Getting Started 21 GS716Tv2 and GS724Tv3 Software Administration Manual smartControicenter NETGEAR Connect with Innovation Network Maintenance Tasks Configuration Device Maintenance Product MAC Address a IP Address 10 131 12 79 10 131 12 164 GS724Tv3 00 00 00 29 29 29 FS728TP 00 11 45 13 22 67 Download to primary or secondary storage 2 Primary Storage vi his FW after d ile Secondary Storage lij Run this ESROS The current device has MAC 00 00 00 12 33 aa One device is selected Enabled Enabled 255 255 255 0 255 255 255 0 10 131 12 1 7 16 10 16 Download Firmware Discover 7 When the process is complete the switch automatically reboots Note Click the Tasks tab to view status information about the firmware upgrade WARNING It is important that you do not power off the administrative system or the switch while the firmware upgrade is in progress 22 Chapter 1 Getting Started GS716Tv2 and GS724Tv3 Software Administration Manual Viewing and Managing Tasks From the Tasks tab you can view information about configuration downloads and firmware upgrades that have already occurred are in progress or are scheduled to take place at a later time You ca
190. etwork with a DHCP server use the following steps 1 Connect the switch to a network with a DHCP server o gt NM Power on the switch by connecting its AC DC power adapter Install the Smart Control Center on your computer Start the Smart Control Center Click Discover for the Smart Control Center to find your switch You should see a screen similar to the one shown in the following figure a GD SmartControlCenter NETGEAR Network Mainte Device List Product MAC Address 65108Tv2 09 244b2 5ci94 49 6CS724Tv 3 OOOO TT STEET 57281Pv2 30 46 9a Hf fb F5729TP 0 92 48 21 02 6 2 nance Help 1P Address stem Subnet Mask 10 131 12 106 255 255 255 0 10 134 12 162 255 255 255 0 10 131 12 170 255 255 255 0 10 131 12 109 255 255 255 0 Gateway 19 121 12 1 19 131 12 1 19 131 12 1 19 121 12 1 QUIT femw 9 9 11 1 5 0 2 5 N A N A 6 Make a note of the displayed IP address assigned by the DHCP server You will need this value to access the switch directly from a Web browser without using the Smart Control Center Device List Product MAC Address 65108Tv2 09 245b2 5ci94 49 65724Tv3 CUE LIE LTE ETE ETLI F57281Pv2 30 46 9a ff fb ff 1P Address System Loc 19 78 7 Select your switch by clicking the line that displays the switch then click the Web Browser Access button The Smart Control Center displays a login window similar to the following figure Chapter 1 Getting Star
191. factory default is blank 3 Click Apply The system parameters are applied and the device is updated The following table describes the status information the System Page displays Field Description Serial Number The serial number of the switch System Object ID The base object ID for the switch s enterprise MIB Date amp Time The current date and time System Up Time Displays the number of days hours and minutes since the last system restart Base MAC Address The universally assigned network address Model Name The model name of the switch Boot Version The boot code version of the switch Software Version The software version of the switch IP Configuration Use the IP Configuration page to configure network information for the management interface which is the logical interface used for in band connectivity with the switch through any of the switch s front panel ports The configuration parameters associated with the switch s network interface do not affect the configuration of the front panel ports through which traffic is switched or routed To access the page click System gt Management gt IP Configuration A screen similar to the following displays Chapter 2 Configuring System Information 33 GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR GS724T 24 Port Gigabit Smart Switch System ywitching QoS Security Monitoring Maintenance Help wogout gt
192. ffline to personalize it for another similar device for example change the device name serial number IP address and download it to that device e Boot Code The boot code used to automatically boot the system e SSL Trusted Root Certificate PEM File SSL Trusted Root Certificate File PEM Encoded e SSL Server Certificate PEM File SSL Server Certificate File PEM Encoded e SSL DH Weak Encryption Parameter PEM File SSL Diffie Hellman Weak Encryption Parameter File PEM Encoded 232 Chapter 7 Maintenance GS716Tv2 and GS724Tv3 Software Administration Manual e SSL DH Strong Encryption Parameter PEM File SSL Diffie Hellman Strong Encryption Parameter File PEM Encoded 2 If you are downloading an GS716T or GS724T image Code select the image on the switch to overwrite This field is only visible when Code is selected as the File Type Note It is recommended that you not overwrite the active image The system will display a warning that you are trying to overwrite the active image 3 Click Browse to open a file upload window to locate the file you want to download 4 Click Cancel to cancel the operation on the screen and reset the data on the screen to the latest value of the switch 5 Click the Apply button to initiate the file download Note After a file transfer is started please wait until the page refreshes When the page refreshes the Select File option will be blanked out This indicates that the
193. fied in IEEE 802 1p are pO to p7 The QoS setting lets you map each of the eight priority levels to one of four internal hardware priority queues High Normal Low and Lowest e DSCP The six most significant bits of the DiffServ field are called the Differentiated Services Code Point DSCP bits Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch If you change any of the settings on the page click Apply to send the updated configuration to the switch CoS Interface Configuration Use the CoS Interface Configuration page to apply an interface shaping rate to all interfaces or to a specific interface To display the CoS Interface Configuration page click the QoS CoS tab and then click the Advanced gt CoS Interface Configuration link Chapter 4 Configuring Quality of Service 129 GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help 1000vr gt Basic CoS Interface Configuration v Advanced CoS CoS Interface Configuration Configuration PORTS Lacs al GO TO INTERFACE CoS Interface Corfiguartion Interface Interface Trust Mode to 16384 T T L Interface Queue Configuration 802 1p to Queve Mapping DSCP to Queue Mapping ul O e L C o O e g D o o o GO TO INTERFACE To configure CoS settings
194. field specify the amount of time that passes before the connection between the device and the TACACS server times out The field range is from 1 to 30 seconds If you make changes to the page or add a new entry click Apply to apply the changes to the system To delete a configured TACACS server select the IP address of the server from the TACACS Server drop down menu and then click Delete 158 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual Authentication List Configuration Use the Authentication List page to configure the default login list A login list specifies one or more authentication methods to validate switch or port access for the admin user Note Admin is the only user on the system and is assigned to a preconfigured list named defaultList which you cannot delete To access the Authentication List page click Security gt Management Security and then click the Authentication List link NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help Logout Access Port Authentication Trattic Control ACL gt User Configuration Authentication List gt RADIUS gt TACACS Authentication List v Authentication List List Name 1 3 ao None To change the authentication method for the defaultList 1 Select the check box next to the defaultList name 2 Use the drop down menu in the 1 column to se
195. fies the action the rule takes which is either Permit or Deny Service Type Displays the type of service to allow or prohibit from accessing the switch management interface e SNMP e HTTP e HTTPS Source IP Address Displays the IP Address of the client that may or may not originate management traffic Mask Displays the subnet mask associated with the IP address Priority Displays the priority of the rule The rules are validated against the incoming management request in the ascending order of their priorities If a rule matches action is performed and subsequent rules below are ignored Click Refresh to update the page with the most current information Access Rule Configuration Use the Access Rule Configuration page to configure the rules about what systems can access the GS716T or GS724T Web interface and what protocols are allowed To access the Access Rule Configuration page click Security gt Access and then click the Access Control gt Access Rule Configuration link NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help scour J Monogement Security Port Authentication Troffic Control ACI gt HTTP Access Rule Configuration gt HTTPS v Access Control Access Rule Configuration Access Profile Rule Type Service Type Source IP Address Mask Priority t Configuration T i Access Rule LIE Lit Oe ee Configuration Before you
196. figuration changes take effect immediately IGMP Snooping Table Use the IGMP Snooping Table page to view all of the entries in the Multicast Forwarding Database that were created for IGMP snooping To access the IGMP Snooping Table page click Switching gt Multicast gt IGMP Snooping gt IGMP Snooping Table NETGEAR MFD8 Table MFOS fishes Querier GS724T 24 Port Gigabit Smart Switch tocour Address table IGMP Snooping Table IGMP Snooping Table Search by MAC Address MAC VLAN ID Type Description Interface Address LEAR REFRESH The following table describes the fields in the IGMP Snooping Table Field Description MAC Address A multicast MAC address for which the switch has forwarding and or filtering information The format is 6 two digit hexadecimal numbers that are separated by colons for example 01 00 5e 45 67 89 VLAN ID A VLAN ID for which the switch has forwarding and filtering information Type This displays the type of the entry Static entries are those that are configured by the end user Dynamic entries are added to the table as a result of a learning process or protocol 114 Chapter3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Description The text description of this multicast table entry Possible values are Management Configured Network Configured and Network Assisted
197. formation displayed on the Spanning Tree CST Configuration page Field Description MST ID Table consisting of the MST instances including the CST and the corresponding VLAN IDs associated with each of them VID Table consisting of the VLAN IDs and the corresponding FID associated with each of them FID Table consisting of the FIDs and the corresponding VLAN IDs associated with each of them Click Refresh to update the information on the screen with the most current data CST Port Configuration Use the Spanning Tree CST Port Configuration page to configure Common Spanning Tree CST and Internal Spanning Tree on a specific port on the switch To display the Spanning Tree CST Port Configuration page click Switching STP Advanced gt CST Port Configuration Chapter 3 Configuring Switching Information 97 GS716Tv2 and GS724Tv3 Software Administration Manual NETG E A R GS724T 24 Port Gigabit Smart Switeh Switching Monitoring Maintenonce Help Ports LAG VLAN Voice VIAN Auto VolP Multicost Address Toble gt Basic CST Port Configuration v Advanced STP Port Configuration Configuration PORTS LAGS aa GO TO INTERFACE CST Configuration Interface STP Status Fast Link Port State CST Port erae r mo LS oxi Configuration Ouable Disabled CST Port Status RSTP Disable Disabled MST Configuration MST Port Configuration STP Statistics External Por
198. formation in configuration messages via Bridge Protocol Data Units BPDUs to assign port roles that determine each port s participation in a fully and simply connected active topology based on one or more spanning trees The information communicated is known as the spanning tree priority vector The BPDU structure for each of these different protocols is different A MSTP bridge will transmit the appropriate BPDU depending on the received type of BPDU from a particular port Appendix B Configuration Examples 263 GS716Tv2 and GS724Tv3 Software Administration Manual An MST Region comprises of one or more MSTP Bridges with the same MST Configuration Identifier using the same MSTIs and which have no Bridges attached that cannot receive and transmit MSTP BPDUs The MST Configuration Identifier has the following components 1 Configuration Identifier Format Selector 2 Configuration Name 3 Configuration Revision Level 4 Configuration Digest 16 byte signature of type HMAC MD5 created from the MST Configuration Table a VLAN ID to MSTID mapping As there are Multiple Instances of Spanning Tree there is a MSTP state maintained on a per port per instance basis or on a per port per VLAN basis as any VLAN can be in one and only one MSTI or CIST For example port A can be forwarding for instance 1 while discarding for instance 2 The port states have changed since IEEE 802 1D specification To support multiple spanning trees a MSTP
199. g IGMP Snooping Configuration 110 Chapter3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR Gs724T ll 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help tocourt gt Auto Video IGMP Snooping Configuration v IGMP Snooping IGMP Snooping IGMP Snooping Configuration Configuration IGMP Snooping Interface Configuration Block Unknown Multicast Address Disable Enable IGMP Snooping Status Disable Enable Validate IGMP IP header CQ Osable Enable IGMP Snooping Table MFDB Table MFDB Statistics Multicast Control Frame Count IGMP Snooping VLAN Configuration gt IGMP Snooping Querter VLAN Ids Enabled for IGMP Snooping IGMP Statistics Interfaces Enabled for IGMP Snooping Data Frames Forwarded by the CPU VLAN Ids Enabled for IGMP Snooping Querier To configure IGMP Snooping 1 Enable or disable IGMP Snooping on the switch Enable The switch snoops all IGMP packets it receives to determine which segments should receive packets directed to the group address e Disable The switch does not snoop IGMP packets Choose whether to validate the IGMP IP header e Enable The switch checks the IP header of all IGMP messages for the Router Alert option If the option is not present the packet is dropped e Disable The IGMP IP header is not checked for Router Alert option Choose whether to b
200. g Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual 3 To disable IGMP snooping on a VLAN and remove it from the list select the check box next to the VLAN ID and click Delete 4 To modify IGMP snooping settings for a VLAN select the check box next to the VLAN ID update the desired values and click Apply 5 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch IGMP Snooping Querier IGMP snooping requires that one central switch or router periodically query all end devices on the network to announce their multicast memberships This central device is the IGMP querier The IGMP query responses known as IGMP reports keep the switch updated with the current multicast group membership on a port by port basis If the switch does not receive updated membership information in a timely fashion it will stop forwarding multicasts to the port where the end device is located These pages enable you to configure and display information on IGMP snooping queriers on the network and separately on VLANs The IGMP Snooping Querier feature contains links to the following pages IGMP Snooping Querier Configuration on page 119 IGMP Snooping Querier VLAN Configuration on page 120 IGMP Snooping Querier VLAN Status on page 121 IGMP Snooping Querier Configuration Use this page to enable or disable the IGMP Snooping Querier feature specify the IP a
201. ge to download device software the image file the configuration files and SSL files from a TFTP server to the switch You can also download files via HTTP See HTTP File Download on page 232 for additional information To access the TFTP File Download page click Maintenance gt Download gt TFTP File Download NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintencnce Help l Logout Reset Uplood File Manogement Trovblesheoting TFTP Pile Download TFTP File Download gt HTTP File Download TFTP File Download Pile Type Image Name Serwer Address Type TFTP Server IP Transfer File Path Remote File Name Start File Transfer Before you download a file to the switch the following conditions must be true e The file to download from the TFTP server is on the server in the appropriate directory e The file is in the correct format e The switch has a path to the TFTP server To download a file to the switch from a TFTP server 1 From the File Type menu Specify what type of file you want to download to the switch e Code The code is the system software image which is saved in one of two flash sectors called images image1 and image2 The active image stores the active copy 230 Chapter7 Maintenance GS716Tv2 and GS724Tv3 Software Administration Manual while the other image stores a second copy The device boots and runs from the active image If the active
202. gement Device View gt Basic LLDP MED Port Settings Advanced LLDP LLDP MED Port Settings Configuration Port o1 v LLOP Port Setting LLDP MED Status Settings LLD MED Notification Network Policy Transmit Optional TL s LLOP MED Port Settings Local Information Nesghlers Information RIRES To configure LLDP MED settings for a port 1 From the Port field select the port to configure 2 From the LLDP MED Status field enable or disable the LLDP MED mode for the selected interface 56 Chapter 2 Configuring System Information GS716Tv2 and GS724Tv3 Software Administration Manual 3 From the Notification field specify whether the port should send a topology change notification if a device is connected or removed 4 From the Transmit Optional TLVs field specify whether the port should transmit optional type length values TLVs in the LLDP PDU frames If enabled the followng LLDP MED TLVs are transmitted MED Capabilities e Network Policy e Location Identification e Extended Power via MDI PSE e Extended Power via MDI PD e Inventory 5 Click Apply to send the updated configuration to the switch These changes occur immediately and the configuration will be saved 6 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch Local Information Use the LLDP Local Information page to view the data that e
203. han this configured Min TCP Hdr Size The factory default is 20 bytes e Denial of Service TCP Fragment Enable or disable this option by selecting the appropriate radio button Enabling TCP Fragment DoS prevention causes the switch to drop packets that have an IP fragment offset equal to 1 The factory default is Disable Denial of Service TCP Flag Enable or disable this option by selecting the appropriate radio button Enabling TCP Flag DoS prevention causes the switch to drop packets that have TCP flag SYN set and TCP source port less than 1024 or TCP control flags set to 0 and TCP sequence number set to 0 or TCP flags FIN URG and PSH set and TCP sequence number set to 0 or both TCP flags SYN and FIN set The factory default is Disable e Denial of Service L4 Port Enable or disable this option by selecting the appropriate radio button Enabling L4 Port DoS prevention causes the switch to drop packets that have TCP UDP source port equal to TCP UDP destination port The factory default is Disable e Denial of Service ICMP Enable or disable this option by selecting the appropriate radio button Enabling ICMP DoS prevention causes the switch to drop ICMP packets that have a type set to ECHO REQ ping and a size greater than the configured ICMP packet size The factory default is Disable e Denial of Service Max ICMP Size Specify the Max ICMP packet size allowed If ICMP DoS prevention is enabled the switch will drop ICMP ping packets th
204. hanism is initialized which occurs when a new endpoint device links with the LLDP MED network connectivity device The default value is 3 times and the range is from 1 10 3 Click Apply to apply the new settings to the system 4 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 5 Click Refresh to update the screen with the current information LLDP Port Settings Use the LLDP Port Settings page to specify LLDP parameters that are applied to a specific interface To display the LLDP Port Settings page click System gt LLDP gt Advanced gt LLDP Port Settings Chapter 2 Configuring System Information 53 GS716Tv2 and GS724Tv3 Software Administration Manual e GS724T NE TG EA R 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help osou Mancgemeat Device View Basic LLDP Port Settings Advanced UOP LLDP Port Settings CM GO TO INTERFACE LLDP Port Settings Interface d i Management IP 4 aros Optional LLDP MED Status Address TLVs Network Policy mn Ee eee ee LLDP MEO Port Disables Stop Advertise Disable Disable Settings Local Disabled Stop Advertise Disable Disable Information Neighbors Informabon Disabled Stop Advertise Ouable C 2a5le Disabled Stop Advertise Disable Disable Disabled Stop Advertise Disable Ovsadle Disabled Stop Advertise Disable Ovsadle Disab
205. hat are more tolerant of delay Packets with strict timing requirements are given special treatment in a QoS capable network With this in mind all elements of the network must be QoS capable If one node is unable to meet the necessary timing requirements this creates a deficiency in the network path and the performance of the entire packet flow is compromised There are two basic types of QoS e Integrated Services network resources are apportioned based on request and are reserved resource reservation according to network management policy RSVP for example e Differentiated Services network resources are apportioned based on traffic classification and priority giving preferential treatment to data with strict timing requirements switch switches support DiffServ The DiffServ feature contains a number of conceptual QoS building blocks you can use to construct a differentiated service network Use these same blocks in different ways to build other types of QoS architectures There are 3 key QoS building blocks needed to configure DiffServ e Class e Policy e Service i e the assignment of a policy to a directional interface Class You can classify incoming packets at layers 2 3 and 4 by inspecting the following information for a packet e Source destination MAC address e EtherType e Class of Service 802 1p priority value first only VLAN tag e VLAN ID range first only VLAN tag e Secondary 802 1p priority val
206. he selected port Possible values are Authenticator or Supplicant This field is not configurable e Authenticator PAE State This field displays the current state of the authenticator PAE state machine Possible values are as follows e Initialize e Disconnected e Connecting e Authenticating e Authenticated e Aborting e Held e ForceAuthorized e ForceUnauthorized e Backend State This field displays the current state of the backend authentication state machine Possible values are as follows e Request e Response e Success e Fail e Timeout e Initialize e idle e EAPOL Flood Mode This field is used to enable or disable the EAPOL Flood mode per Interface The default value is Disable Click Apply to send the updated screen to the switch and cause the changes to occur on the switch and the changes will be saved 172 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual 4 Click Initialize to begin the initialization sequence on the selected port s This button is only selectable if the control mode is auto If the button is not selectable it will be grayed out When this button is clicked the action is immediate It is not required to click Apply for the action to occur 5 Click Reauthenticate to begin the reauthentication sequence on the selected port This button is only selectable if the control mode is auto If the button is not selectable it will be grayed ou
207. he Destination MAC Address create a MAC ACL To permit or deny traffic based on the Source IP Address create a Standard ACL To permit or deny traffic based on the Destination IP Address create an Extended ACL To permit or deny traffic based on the TCP or UDP Source Port ID create an Extended ACL To permit or deny traffic based on the TCP or UDP Destination Port ID create an Extended ACL 2 Click the Permit or Deny link associated with the access criteria on the ACL Wizard page The switch redirects you to a page that contains the fields to configure the ACL rule and several of the fields are preconfigured For example if you select the Permit link associated with the Select Devices Based on Source IP Address option the Source IP Address Rules page displays and the only information you must provide is the source IP address and source mask 3 Configure the desired rule Click Apply to save the rule MAC ACL A MAC ACL consists of a set of rules which are matched sequentially against a packet When a packet meets the match criteria of a rule the specified rule action Permit Deny is taken and the additional rules are not checked for a match There are multiple steps involved in defining a MAC ACL and applying it to the switch 184 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual Use the MAC ACL page to create the ACL ID Use the MAC Rules page to create rules for the
208. he address you type in the TFTP Server Address field e Pv4 Indicates the TFTP server address is an IP address in dotted decimal format e DNS Indicates the TFTP server address is a hostname 4 n the Server Address field specify the IP address or hostname of the TFTP server The address you type must be in the format indicated by the TFTP Server Address Type 5 Inthe Transfer File Path field specify the path on the TFTP server where the file is located You may enter up to 32 characters Include the backslash at the end of the path A path name with a space is not accepted Leave this field blank to save the file to the root TFTP directory 6 In the Remote File Name field specify the name of the file to download from the TFTP server You may enter up to 32 characters A file name with a space is not accepted 7 Select the Start File Transfer check box to initiate the file upload 8 Click Apply to begin the file transfer The last row of the table displays information about the progress of the file transfer The page refreshes automatically until the file transfer completes or fails Chapter 7 Maintenance 231 GS716Tv2 and GS724Tv3 Software Administration Manual To activate a software image that you download to the switch see File Management on page 234 HTTP File Download Use the HTTP File Download page to download files of various types to the switch using an HTTP session for example via your Web browser To
209. he configuration on the screen and reset the data on the screen to the latest value of the switch 5 f you make changes to the page click Apply to apply the changes to the system Configuration changes take effect immediately 182 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual Configuring Access Control Lists Access Control Lists ACLs ensure that only authorized users have access to specific resources while blocking off any unwarranted attempts to reach network resources ACLs are used to provide traffic flow control restrict contents of routing updates decide which types of traffic are forwarded or blocked and above all provide security for the network switch software supports IPv4 and MAC ACLs To configure an ACL first create an IPv4 based or MAC based ACL ID Then create a rule and assign it to a unique ACL ID Next define the rules which can identify protocols source and destination IP and MAC addresses and other packet matching criteria Finally use the ID number to assign the ACL to a port or to a LAG The Security ACL folder contains links to the following features Basic e MAC ACL on page 184 e MAC Rules on page 186 e MAC Binding Configuration on page 188 e MAC Binding Table on page 189 e Advanced e IP ACL on page 190 e IP Rules on page 191 e P Extended Rule on page 193 e IP Binding Configuration on page 196 e IP Binding Table on page 198 ACL Wizard
210. he switch If you make changes to the page click Apply to apply the changes to the system 134 Chapter4 Configuring Quality of Service GS716Tv2 and GS724Tv3 Software Administration Manual Differentiated Services The QoS feature contains Differentiated Services DiffServ support that allows traffic to be classified into streams and given certain QoS treatment in accordance with defined per hop behaviors Standard IP based networks are designed to provide best effort data delivery service Best effort service implies that the network delivers the data in a timely fashion although there is no guarantee that it will During times of congestion packets may be delayed sent sporadically or dropped For typical Internet applications such as e mail and file transfer a slight degradation in service is acceptable and in many cases unnoticeable Conversely any degradation of service has undesirable effects on applications with strict timing requirements such as voice or multimedia Defining DiffServ To use DiffServ for QoS the Web pages accessible from the Differentiated Services menu page must first be used to define the following categories and their criteria 1 Class Create classes and define class criteria 2 Policy Create policies associate classes with policies and define policy statements 3 Service Add a policy to an inbound interface Packets are classified and processed based on defined criteria The classific
211. hen a packet is queued for transmission in a port the rate at which it is serviced depends on how the queue is configured and possibly the amount of traffic present in the other queues of the port If a delay is necessary packets get held in the queue until the scheduler authorizes the queue for transmission As queues become full packets have no place to be held for transmission and get dropped by the switch QoS is a means of providing consistent predictable data delivery by distinguishing between packets that have strict timing requirements from those that are more tolerant of delay Packets with strict timing requirements are given special treatment in a QoS capable network With this in mind all elements of the network must be QoS capable The presence of at least one node which is not QoS capable creates a deficiency in the network path and the performance of the entire packet flow is compromised Chapter 4 Configuring Quality of Service 127 GS716Tv2 and GS724Tv3 Software Administration Manual Class of Service The Class of Service CoS queueing feature lets you directly configure certain aspects of switch queueing This provides the desired QoS behavior for different types of network traffic when the complexities of DiffServ are not required The priority of a packet arriving at an interface can be used to steer the packet to the appropriate outbound CoS queue through a mapping table CoS queue characteristics that affect queue
212. henticator state machine on this port will retransmit an EAPOL EAP Request Identity before timing out the supplicant The maximum requests value must be in the range of 1 10 The default value is 2 Changing the value will not change the configuration until you click the Apply button Chapter 5 Managing Device Security 171 GS716Tv2 and GS724Tv3 Software Administration Manual e Supplicant Timeout Defines the amount of time that lapses before EAP requests are resent to the user The field value is in seconds The field default is 30 seconds Server Timeout Defines the amount of time that lapses before the switch resends a request to the authentication server The field value is in seconds The range is 1 65535 and the field default is 30 seconds e Control Direction This displays the control direction for the specified port which is always Both The control direction dictates the degree to which protocol exchanges take place between Supplicant and Authenticator The unauthorized controlled port exerts control over communication in both directions disabling both incoming and outgoing frames This field is not configurable e Protocol Version This field displays the protocol version associated with the selected port The only possible value is 1 corresponding to the first version of the 802 1X specification This field is not configurable e PAE Capabilities This field displays the port access entity PAE functionality of t
213. hyperlink to the Extended ACL Rule Configuration page If the rule is Deny you can specify the CPU Notification Mode e Enable The switch to turn off POE power to the port if the user is rejected by ACL When the rule is hit and the PoE component receives this notification the PoE component turns off PoE power for the port To turn on the port power you must manually enable the PoE port Admin Mode e Disable When a packet matches the ACL rule the CPU is not notified and the port continues to provide power 6 If you modify the rule click Apply to submit the changes to the switch IP Binding Configuration When an ACL is bound to an interface all the rules that have been defined are applied to the selected interface Use the IP Binding Configuration page to assign ACL lists to ACL Priorities and Interfaces To display the IP Binding Configuration page click Security ACL then click the Advanced IP Binding Configuration link 196 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help t000uT Manogement Security Access Port Authentication Traffic Control ACL Wizard IP Binding Configuration gt Basic v Advanced Binding Configuration IP ACL Direction IP Rules zz FSR oo IP Extended Rules IP Bending Configuration Binding Table 1 to 4294067295 I
214. ic to inbound traffic This field is not configurable To rename an existing policy or add a new member class to the policy select the check box next to the configured class update the fields and click Apply To remove a policy click the check box beside the policy then click Delete Click Refresh to refresh the page with the most current data from the switch Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch After creating a Class click the class link to the Class page To configure the policy attributes 1 Click the name of the policy Chapter 4 Configuring Quality of Service 141 GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR mE cui LOGOUT System Switching QoS Security Monitoring Maintenance Help gt Basic Policy Configuration Advanced DiffServ Policy Configuration Configurabon Member Class Policy Selector Policy Type Class Y v lyp Configuration Policy Configuration Service Configuration Service Statistics The policy name is a hyperlink The following figure shows the configuration fields for the policy 142 Chapter 4 Configuring Quality of Service GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help 1ocour Basic Policy Class Configuration v Advanc
215. ichtlijn 1999 5 EG Appendix C Notification of Compliance 269 GS716Tv2 and GS724Tv3 Software Administration Manual EDOC in Languages of the European Community Malti Maltese Hawnhekk NETGEAR Inc jiddikjara li dan Radiolan jikkonforma mal htigijiet essenzjali u ma provvedimenti ohrajn relevanti li hemm fid Dirrettiva 1999 5 EC Magyar Alul rott NETGEAR Inc nyilatkozom hogy a Radiolan megfelel a vonatkoz Hungarian alapvet k vetelm nyeknek s az 1999 5 EC ir nyelv egy b el r sainak Polski Polish Niniejezym NETGEAR Inc o wiadcza ze Radiolan jest zgodny z zasadniczymi wymogami oraz pozostalymi stosownymi postanowieniami Dyrektywy 1999 5 EC Portugu s NETGEAR Inc declara que este Radiolan esta conforme com os requisitos Portuguese essenciais e outras disposi es da Directiva 1999 5 CE Slovensko NETGEAR Inc izjavlja da je ta Radiolan v skladu z bistvenimi zahtevami in Slovenian ostalimi relevantnimi dolo ili direktive 1999 5 ES Slovensky NETGEAR Inc t mto vyhlasuje Ze Radiolan sp a z kladn po iadavky a v etky Slovak pr slu n ustanovenia Smernice 1999 5 ES Suomi NETGEAR Inc vakuuttaa t ten ett Radiolan tyyppinen laite on direktiivin Finnish 1999 5 EY oleellisten vaatimusten ja sit koskevien direktiivin muiden ehtojen mukainen Svenska H rmed intygar NETGEAR Inc att denna Radiolan st r verensst mmelse med Swedish de v sentl
216. ics Claes of Service VLAN Ethernet Type Source MAC Source MAC Mask Destination MAC Destination MAC Mask Protocol Type Source IP Address Source Mask Source L4 Port Destination IP Address Destination Mask Destination L4 Port 1P DSCP IP Precedence IP Tos REMESH 2 Define the criteria to associate with a DiffServ class Reference Class Selects a class to start referencing for criteria A specified class can reference at most one other class of the same type Class of Service Select the field and enter a class of service 802 1p user priority value to be matched for the packets The valid range is 0 7 VLAN Select the field and enter a VLAN ID to be matched for packets The VLAN ID range is 1 4093 Protocol Type Requires a packet s layer 4 protocol to match the protocol you select If you select Other enter a protocol number in the field that appears The valid range is 0 255 Source IP Address Requires a packet s source port IP address to match the address listed here In the IP Address field enter a valid source IP address in dotted decimal format Source Mask Enter a valid subnet mask to determine which bits in the IP address are significant Note that this is not a wildcard mask Source L4 Port Requires a packet s TCP UDP source port to match the port you select Select the desired L4 keyword from the list on which the rule can be based If you select Other the screen refreshes and a Port ID field appears Enter
217. iga egenskapskrav och vriga relevanta best mmelser som framg r av direktiv 1999 5 EG slenska H r me l sir NETGEAR Inc yfir pv a Radiolan er samr mi vi grunnkr fur og Icelandic a rar kr fur sem ger ar eru tilskipun 1999 5 EC Norsk NETGEAR Inc erkl rer herved at utstyret Radiolan er i samsvar med de Norwegian grunnleggende krav og vrige relevante krav i direktiv 1999 5 EF FCC Requirements for Operation in the United States FCC Information to User This product does not contain any user serviceable components and is to be used with approved antennas only Any product changes or modifications will invalidate all applicable regulatory certifications and approvals FCC Guidelines for Human Exposure This equipment complies with FCC radiation exposure limits set forth for an uncontrolled environment This equipment should be installed and operated with minimum distance of 20 cm between the radiator and your body This transmitter must not be co located or operating in conjunction with any other antenna or transmitter FCC Declaration Of Conformity We NETGEAR Inc 350 East Plumeria Drive Santa Clara CA 95134 declare under our sole responsibility that the ProSafe GS716T and 724T Gigabit Smart Switches complies with Part 15 of FCC Rules Operation is subject to the following two conditions This device may not cause harmful interference and This device must accept any interference
218. iguration Clock Source Loca O snte SNTP Server Configuration gt Denial of Service Date 00 00 0000 Time 08 48 55 Time Zone UTC 00 00 DNS gt Green Ethernet Configuration SNTP Global Status Version 4 Supported Mode Unicast Last Update Time Jan 01 09 00 00 1970 Last Attempt Time Jan 01 00 00 00 1970 Last Attempt Status Server IP Address Address Type Unknonn Server Stratum O Unspecified Reference Clock Id Server Mode Reserved Unicast Server Max Entries 3 Unicast Server Current Entries REFRESH To configure the time by using the CPU clock cycle as the source 1 From the Clock Source field select Local 2 In the Date field enter the date in the DD MM YYYY format 3 In the Time field enter the time in HH MM SS format Note If you do not enter a date and time the switch will calculate the date and time using the CPU s clock cycle When the Clock Source is set to Local the Time Zone field is grayed out disabled 4 Click Apply to send the updated configuration to the switch Configuration changes occur immediately To configure the time through SNTP 1 From the Clock Source field select SNTP When the Clock Source is set to SNTP the Date and Time fields are grayed out disabled The switch gets the date and time from the network Chapter 2 Configuring System Information 37 GS716Tv2 and GS724Tv3 Software Administration Manual 2 Usethe menu to select the Coordinated Universal
219. image is corrupt the system automatically boots from the non active image This is a safety feature for faults occurring during the boot upgrade process e Text Configuration A text based configuration file enables you to edit a configured text file startup config offline as needed without having to translate the contents for the switch to understand The most common usage of text based configuration is to upload a working configuration from a device edit it offline to personalize it for another similar device for example change the device name serial number IP address and download it to that device e Boot Code The boot code used to automatically boot the system e SSL Trusted Root Certificate PEM File SSL Trusted Root Certificate File PEM Encoded e SSL Server Certificate PEM File SSL Server Certificate File PEM Encoded e SSL DH Weak Encryption Parameter PEM File SSL Diffie Hellman Weak Encryption Parameter File PEM Encoded e SSL DH Strong Encryption Parameter PEM File SSL Diffie Hellman Strong Encryption Parameter File PEM Encoded 2 If you are downloading an GS716T or GS724T image Code select the image on the switch to overwrite This field is visible only when Code is selected as the File Type Note It is recommended that you not overwrite the active image The system will display a warning that you are trying to overwrite the active image 3 From the Server Address Type filed specify the format for t
220. in Green Ethernet mode and provides full power to the port even if there is no link partner Physical Status Indicates the physical port s speed and duplex mode Link Status Indicates whether the Link is up or down Link Trap This object determines whether or not to send a trap when link status changes The factory default is Enable e Enable Specifies that the system sends a trap when the link status changes e Disable Specifies that the system does not send a trap when the link status changes MAC Address Displays the physical address of the specified interface PortList Bit Offset Displays the bit offset value which corresponds to the port when the MIB object type PortList is used to manage in SNMP iflndex The iflndex of the interface table entry associated with this port If the interface field is set to All this field is blank 72 Chapter3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual 6 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 7 If you make any changes to the page click Apply to apply the changes to the system Flow Control IEEE 802 3x flow control works by pausing a port when the port becomes oversubscribed and dropping all traffic for small bursts of time during the congestion condition This can lead to high priority and or network control traffic loss When IEEE 802 3x flow control
221. in a Network with a DHCP Server on page 13 Switch Discovery in a Network without a DHCP Server on page 15 Configuring the Network Settings on the Administrative System on page 16 Web Access on page 18 Smart Control Center Utilities on page 19 Understanding the User Interfaces on page 24 Interface Naming Convention on page 29 10 Chapter 1 Getting Started GS716Tv2 and GS724Tv3 Software Administration Manual Switch Management Interface The NETGEAR GS716T and GS724T Smart Switches contain embedded Web server and management software for managing and monitoring switch functions The switches function as a simple switch without the management software However you can use the management software to configure more advanced features that can improve switch efficiency and overall network performance Web based management lets you monitor configure and control your switch remotely using a standard Web browser instead of using expensive and complicated SNMP software products From your Web browser you can monitor the performance of your switch and optimize its configuration for your network You can configure all switch features such as VLANs QoS and ACLs by using the Web based management interface NETGEAR provides the Smart Control Center utility with this product This program runs under Microsoft Windows XP Windows 2000 or Windows Vista and provides a front end that discovers the switches on your network segment L2 broadcast do
222. in mode only on VLANs where only one host is connected to each layer 2 LAN port This prevents the inadvertent dropping of the other hosts that were connected to the same layer 2 LAN port but were still interested in receiving multicast traffic directed to that group Also fast leave processing is supported only with IGMP version 2 hosts e Host Timeout Sets the value for group membership interval of IGMP snooping for the specified VLAN ID The valid range is Maximum Response Time 1 to 3600 seconds e Maximum Response Time Enter the amount of time in seconds that a switch will wait after sending a query on the VLAN because it did not receive a report for a particular group in that interface value The valid range is 1 to 25 seconds Its value must be less than the Host Timeout value e MRouter Timeout Enter the amount of time that a switch will wait to receive a query on the VLAN before removing it from the list of VLANs with multicast routers attached Enter a value between 0 and 3600 seconds The default is 0 seconds which means there is no expiration e Query Mode Enable or disable the IGMP Querier Mode for the specified VLAN ID e Query Interval Enter the value for IGMP Query Interval for the specified VLAN ID The valid range is 1 1800 seconds The default is 60 seconds 2 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 118 Chapter 3 Configurin
223. in the selected authentication login list This is the method that will be used if the first method times out If you select a method that does not time out as the second method the third method will not be tried This parameter will not appear when you first create a new login list 4 Usethe menu in the 3 column to select the authentication method if any that should appear third in the selected authentication login list This parameter will not appear when you first create a new login list 5 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 6 If you make changes to the page click Apply to apply the changes to the system 160 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual Configuring Management Access From the Access page you can configure HTTP and Secure HTTP access to the GS716T or GS724T management interface You can also configure Access Control Profiles and Access Rules The Security gt Access tab contains the following folders e HTTP Configuration on page 161 e Secure HTTP Configuration on page 162 e Certificate Download on page 163 e Access Profile Configuration on page 165 e Access Rule Configuration on page 166 HTTP Configuration Use the HTTP Configuration page to configure the HTTP server settings on the system To access the HTTP Configuration page click the Security tab then click Acc
224. information For more information see Switch Discovery in a Network with a DHCP Server on page 13 e Static assignment through the Smart Control Center If you connect the switch to a network that does not have a DHCP server you can use the Smart Control Center to assign a static IP address subnet mask and default gateway For more information see Switch Discovery in a Network without a DHCP Server on page 15 e Static assignment by connecting from a local host If you do not want to use the Smart Control Center to assign a static address you can connect to the switch from a host administrative system in the 192 168 0 0 24 network and change the settings by using the Web based management interface on the switch For information about how to set the IP address on the administrative system so it is in the same subnet as the default IP address of the switch see Configuring the Network Settings on the Administrative System on page 16 12 Chapter 1 Getting Started GS716Tv2 and GS724Tv3 Software Administration Manual Switch Discovery in a Network with a DHCP Server This section describes how to set up your switch in a network that has a DHCP server The DHCP client on the switch is enabled by default When you connect it to your network the DHCP server will automatically assign an IP address to your switch Use the Smart Control Center to discover the IP address automatically assigned to the switch To install the switch in a n
225. ing tree The port role will be one of the following values Root Port Designated Port Alternate Port Backup Port Master Port or Disabled Port Mode Specifies the spanning tree operation mode Different modes are STP RSTP and MSTP 102 Chapter 3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Fast Link Indicates whether the port is enabled as an edge port Status The Forwarding State of this port Click Refresh to update the information on the screen with the most current data MST Configuration Use the Spanning Tree MST Configuration page to configure Multiple Spanning Tree MST on the switch To display the Spanning Tree MST Configuration page click Switching gt STP gt Advanced gt MST Configuration NETGEAR Switching LAG VLAN Voice VIAN Auto VolP MST Configuration MST Configuration Configuration CST Configuration MST ID Priority CST Port Configuration CST Port Status RSTP MST Configuration MST Port Configuration STP Statistics lt Monitoring Multicast Vian Bridge id identifier Topology GS724T 24 Port Gigabit Smart Switch Help Maintenance Topolo Root porogy Topology Designated Root Change Path Change Root Port Count Cost Address Table Time Since Change To configure an MST instance 1 To add an MST instance configure the
226. ion is desired the etherStatsPkts and etherStatsOctets objects should be sampled before and after a common interval The total number of packets including bad packets transmitted that were 64 octets in length excluding framing bits but including FCS octets Packets Transmitted 65 127 Octets The total number of packets including bad packets transmitted that were between 65 and 127 octets in length inclusive excluding framing bits but including FCS octets Packets Transmitted 128 255 Octets The total number of packets including bad packets transmitted that were between 128 and 255 octets in length inclusive excluding framing bits but including FCS octets Packets Transmitted 256 511 Octets The total number of packets including bad packets transmitted that were between 256 and 511 octets in length inclusive excluding framing bits but including FCS octets Packets Transmitted 512 1023 Octets The total number of packets including bad packets transmitted that were between 512 and 1023 octets in length inclusive excluding framing bits but including FCS octets Packets Transmitted 1024 1518 Octets The total number of packets including bad packets transmitted that were between 1024 and 1518 octets in length inclusive excluding framing bits but including FCS octets Packets Transmitted 1519 1522 Octets The total number of packets including bad packets transmitted that were between 151
227. ion on page 46 System Information After a successful login the System Information page displays Use this page to configure and view general device information To display the System Information page click System gt Management gt System Information A screen similar to the following displays NETGEAR PEU Lr ul System Switching QoS Security Monitorin Maintenance Hel 10o0vr J y 9 p v System Information System Information gt IP Configuration gt Time System Information gt Denial of Service System Name System Locat on ONS Green Ethernet Configuration System Contact Senal Number 2234522329 System Object ID 1 3 6 1 4 1 4526 100 4 17 Date amp Tene Jen 11 1970 08 37 21 System Up Time 10 days 8 hours 37 ming 21 secs Versions Model Name Boot Version Software Version GS724Tv3 83 1 1 1 3 9 2 5 REFRESH 32 Chapter 2 Configuring System Information GS716Tv2 and GS724Tv3 Software Administration Manual To define system information 1 Open the System Information page 2 Define the following fields e System Name Enter the name you want to use to identify this switch You may use up to 31 alphanumeric characters The factory default is blank e System Location Enter the location of this switch You may use up to 31 alphanumeric characters The factory default is blank e System Contact Enter the contact person for this switch You may use up to 31 alphanumeric characters The
228. iscarded Octets Transmitted Packets Transmitted Withowt Errors Unicast Packets Transmitted Multicast Packets Transmitted Broadcast Packets Transmitted Transmit Packets Discarded Most Address Entries Ever Used Address Entries in Use Maximem VLAN Entries Most VLAN Entries Ever Used Static VLAN Entries VLAN Deletes Time Since Counters Last Cleared Monitoring Mointenonce Help GS724T 24 Port Gigabit Smart Switch CLEAR REPRE SH The following table describes the Switch Statistics displayed on the screen gt Field Description iflndex This object indicates the iflndex of the interface table entry associated with the processor of this switch Octets Received The total number of octets of data received by the processor excluding framing bits but including FCS octets Packets Received Without Errors The total number of packets including broadcast packets and multicast packets received by the processor Unicast Packets Received protocol The number of subnetwork unicast packets delivered to a higher layer 1600vr Chapter 6 Monitoring the System 201 GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Multicast Packets Received The total number of packets received that were directed to a multicast address This number does not include packets directed to the broadcast address Broadcast Packets Received The total numb
229. istics The Port Statistics page displays a summary of per port traffic statistics on the switch To access the Port Summary page click Monitoring Ports and then click the Port Statistics link NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenonce Help 16c0v logs Port Mirroring Switch Statistics Port Statistics Port Statistics gt Port Detailed Statistics Status EAP Statistics PORTS LAGS al Total Packets Packets Packets Broadcast Transmit received transmitted Colliston Time since counters Interface received Packets Packet with without Frames last cleared without received Errors Errors Errors Errors 18 day S he 57 min 8 sec 18 day 3 hv 57 min 39 sec 18 day he S min 9 sec 18 day S hv 57 min 59 sec 18 day 5 he 57 min 39 sec 18 day he 57 min 59 sec 0 o o 0 o 0 18 day 5 hv 57 min 39 sec 18 day 5 hv 58 min O sec 18 day 3 hr 38 min O sec 18 day S hv SB min O sec v gt REFRESH The following table describes the per port statistics displayed on the screen Field Description Interface Lists the ports on the system Total Packets Received The total number of packets received that were without errors Without Errors Packets Received With Error The number of inbound packets that contained errors preventing them from being deliverable to a higher layer protocol Chapter 6 Moni
230. istics are to display Direction Displays the direction of packets for which service statistics display which is always n Policy Name Displays the policy associated with the selected interface Operational Status Displays the operational status of this service interface which is either Up or Down 146 Chapter 4 Configuring Quality of Service GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Discarded Packets Displays the total number of packets discarded for all class instances in this service policy for any reason due to DiffServ treatment This is the overall count per interface per direction Member Classes Selects the member class for which octet statistics are to display Click Refresh to update the page with the most current information Chapter 4 Configuring Quality of Service 147 GS716Tv2 and GS724Tv3 Software Administration Manual 148 Chapter4 Configuring Quality of Service Managing Device Security Use the features available from the Security tab to configure management security settings for port user and server security The Security tab contains links to the following features Management Security Settings on page 150 Configuring Management Access on page 161 Port Authentication on page 168 Traffic Control on page 174 Configuring Access Control Lists on page 183 Chapter 5 Managing Device Security 149 GS716Tv2 and GS724Tv3 Softwar
231. ive excluding framing bits but including FCS octets 206 Chapter 6 Monitoring the System GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Packets RX and TX 128 255 Octets The total number of packets including bad packets received or transmitted that were between 128 and 255 octets in length inclusive excluding framing bits but including FCS octets Packets RX and TX 256 511 Octets The total number of packets including bad packets received or transmitted that were between 256 and 511 octets in length inclusive excluding framing bits but including FCS octets Packets RX and TX 512 1023 Octets The total number of packets including bad packets received or transmitted that were between 512 and 1023 octets in length inclusive excluding framing bits but including FCS octets Packets RX and TX 1024 1518 Octets The total number of packets including bad packets received or transmitted that were between 1024 and 1518 octets in length inclusive excluding framing bits but including FCS octets Packets RX and TX 1522 Octets The total number of packets including bad packets received or transmitted that are in excess of 1522 octets in length inclusive excluding framing bits but including FCS octets Octets Received The total number of octets of data including those in bad packets received on the network excluding framing bits but including FCS
232. lect the authentication method that should appear first in the selected authentication login list If you select a method that does not time out as the first method such as local no other method will be tried even if you have specified more than one method This parameter will not appear when you first create a new login list User authentication occurs in the order the methods are selected Possible methods are as follows e Local The user s locally stored ID and password will be used for authentication Since the local method does not time out if you select this option as the first method no other method will be tried even if you have specified more than one method e RADIUS The user s ID and password will be authenticated using the RADIUS server If you select RADIUS or TACACS as the first method and an error occurs during the authentication the switch uses Method 2 to authenticate the user e TACACS The user s ID and password will be authenticated using the TACACS server If you select RADIUS or TACACS as the first method and an error occurs during the authentication the switch attempts user authentication Method 2 e None The authentication method is unspecified This option is only available for Method 2 and Method 3 Chapter 5 Managing Device Security 159 GS716Tv2 and GS724Tv3 Software Administration Manual 3 Use the menu in the 2 column to select the authentication method if any that should appear second
233. led Stop Advertise Oisable Disabled Stop Advertise Cable Disabled Stop Advertise Oraadle Disabled Stop Advertise Disable Disabled Stop Advertise Cisable Disabled Stop Advertise Cisable Disabled Stop Advertise Owadle Disabled Stop Advertise Oraadle Disabled Stop Advertise Disabled Stop Advertise Disable Disabled Stop Advertise Disable Disabled Stop Advertise Ciaable Disabled Stop Advertise Disable Disabled Stop Advertise Disable z1 o LI D Li o o D LI D Li o o m LI m Li o o D LI D Li m o Disabled Stop Advertise Disable Disable GO TO INTERFACE co To configure LLDP port settings 1 Change the LLDP port settings described below Interface Specifies the port to be affected by these parameters e Admin Status Select the status for transmitting and receiving LLDP packets e Tx Only Enable only transmitting LLDP PDUs on the selected ports e Rx Only Enable only receiving LLDP PDUs on the selected ports 54 Chapter2 Configuring System Information GS716Tv2 and GS724Tv3 Software Administration Manual e Tx and Rx Enable both transmitting and receiving LLDP PDUs on the selected ports e Disabled Do not transmit or receive LLDP PDUs on the selected ports Management IP Address Choose whether to advertise the management IP address from the interface The possible field values are e Stop Advertise Do not advertise the management IP address from the interface e Auto Advertise Advertise the
234. link Downloading SSL Certificates Before you download a file to the switch the following conditions must be true e The file to download from the TFTP server is on the server in the appropriate directory e The file is in the correct format e The switch has a path to the TFTP server Chapter 5 Managing Device Security 163 GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR GS724T 24 Port Gigabit Smart Switch Security Monitoring Maintenance Help tosour o System Switching Monogemen Securit Port Authentication Ie ge Y gt HTTP Certificate Download HTTPS Certificate Download HTTPS Configuration File Type SSL Trusted Root Certificate PEM File Certificats TFTP Server IP 0 0 0 Download Remote File Name Access Control Start File Transfer To configure the certificate download settings for HTTPS sessions 1 From the File Type menu select the type of SSL certificate to download which can be one of the following e SSL Trusted Root Certificate PEM File SSL Trusted Root Certificate File PEM Encoded e SSL Server Certificate PEM File SSL Server Certificate File PEM Encoded e SSL DH Weak Encryption Parameter PEM File SSL Diffie Hellman Weak Encryption Parameter File PEM Encoded e SSL DH Strong Encryption Parameter PEM File SSL Diffie Hellman Strong Encryption Parameter File PEM Encoded In the TFTP Server IP field specify the address of the TFTP server The addr
235. lock unknown multicast addresses e Enable Packets with unknown multicast MAC address in the destination field will be dropped e Disable Packets with unknown destination multicast MAC addresses are processed Click Apply to send the updated configuration to the switch Configuration changes take effect immediately Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch Chapter 3 Configuring Switching Information 111 GS716Tv2 and GS724Tv3 Software Administration Manual The following table displays information about the global IGMP snooping status and statistics on the page Field Description Multicast Control Frame Count Displays the number of multicast control frames that have been processed by the CPU Interfaces Enabled for IGMP Snooping Lists the interfaces currently enabled for IGMP Snooping To enable interfaces for IGMP snooping see GMP Snooping Interface Configuration on page 112 Data Frames Forwarded by the CPU Displays the number of data frames forwarded by the CPU VLAN Ids Enabled For IGMP Snooping Displays VLAN IDs enabled for IGMP snooping To enable VLANs for IGMP snooping see GMP Snooping VLAN Configuration on page 117 VLAN Ids Enabled For IGMP Snooping Querier Displays VLAN IDs enabled for IGMP snooping querier IGMP Snooping Interface Configuration Use the IGMP Snooping Inte
236. log hosts configured on the switch e Enable Messages will be sent to all configured hosts syslog collectors or relays using the values configured for each host Disable Stops logging to all syslog hosts Disable means no messages will be sent to any collector relay 2 In the Local UDP Port field specify the port on the switch from which syslog messages are sent 3 Click Apply to save the settings The Server Log Configuration area also displays the following information e The Messages Relayed field shows the number of messages forwarded by the syslog function to a syslog host Messages forwarded to multiple hosts are counted once for each host e The Messages Ignored field shows the number of messages that were ignored To configure a remote log server 1 To add a remote syslog host log server specify the settings in the following list and click Add e Host Address Specify the IP address or hostname of the host configured for syslog e Port Specify the port on the host to which syslog messages are sent The default port is 514 e Severity Filter Use the menu to select the severity of the logs to send to the logging host Logs with the selected severity level and all logs of greater severity are sent to the host For example if you select Error the logged messages include Error Critical Alert and Emergency The default severity level is Alert 1 The severity can be one of the following levels e Emergency 0
237. lowed Allowed Enable Port Port Security Dynamically Statically Violation Learned Locked Traps MAC MAC Interface Configuration Security MAC Address Protected Ports Disable Disable Disable Disable Disable To configure port security settings 1 2 3 4 To configure port security settings for a physical port click PORTS To configure port security settings for a Link Aggregation Group LAG click LAGS To configure port security settings for both physical ports and LAGs click ALL Select the check box next to the port or LAG to configure Select multiple check boxes to apply the same setting to all selected interfaces Select the check box in the heading row to apply the same settings to all interfaces Specify the following settings e Port Security Enable or Disable the port security feature for the selected port e Max Allowed Dynamically Learned MAC Sets the maximum number of dynamically learned MAC addresses on the selected interface Valid range is 0 600 e Max Allowed Statically Locked MAC Sets the maximum number of statically locked MAC addresses on the selected interface Valid range is 0 20 e Enable Violation Traps Enables or disables the sending of new violation traps designating when a packet with a disallowed MAC address is received on a locked port Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 18
238. ltant forwarding list is derived from combining all the forwarding interfaces and removing the interfaces that are listed as the static filtering interfaces Click Refresh to update the information on the screen with the most current data MFDB Statistics Use the multicast forwarding database Statistics page to view statistical information about the MFDB table To access the MFDB Statistics page click Switching gt Multicast gt IGMP Snooping gt MFDB Statistics 116 Chapter 3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR GS724T 24 Port Gigabit Smart Switch nonce Help Q090u1 VAN Voice VLAN Auto VolP MFDB Statistics MFDB Statistics Max MFOB Table Entries Most MFDB Entries Since Last Reset Current Entrees Configuration IGMP Snocping Table MFD8 Table MFOG Statisbos IGMP Snooping VLAN Comfiguration gt IGMP Snooping Querier The following table describes the information available on the MFDB Statistics page Field Description Max MFDB Table Displays the maximum number of entries that the Multicast Forwarding Database Entries table can hold Most MFDB Entries The largest number of entries that have been present in the Multicast Forwarding Since Last Reset Database table since the system was last reset This value is also known as the MFDB high water mark Current Entries Displays the current number of ent
239. lue This field is configurable if you select User Value from the EtherType drop down menu The value you enter specifies a customized Ethertype to compare against an Ethernet frame The valid range of values is 0x0600 0xFFFF Source MAC Requires a packet s source port MAC address to match the address listed here Enter a MAC address in the this field The valid format is XXIXXIXXIXXIXX XX Source MAC Mask If desired enter the MAC mask for the source MAC address to match Use Fs and zeros in the MAC mask which is in a wildcard format An F means that the bit is not checked and a zero in a bit position means that the data must equal Chapter 5 Managing Device Security 187 GS716Tv2 and GS724Tv3 Software Administration Manual the value given for that bit The valid format is xx xx xx xx xx xx A MAC mask of 00 00 00 00 00 00 matches a single MAC address e VLAN Requires a packet s VLAN ID to match the ID listed here Enter the VLAN ID to apply this criteria The valid range is 1 4093 Secondary VLAN Requires a match on the value of the layer 2 secondary VLAN Identifier field the inner 802 1Q tag of a double VLAN tagged packet Enter the secondary VLAN ID to apply this criteria 3 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 4 To delete a rule select the check box associated with the rule and click Delete 5 To change a rule select th
240. main When you power up your switch for the first time use the Smart Control Center to discover the switch and view the network information that has been automatically assigned to the switch by a DHCP server or if no DHCP server is present on the network use the Smart Control Center to discover the switch and assign static network information In addition to enabling NETGEAR switch discovery the Smart Control Center provides several utilities to help you maintain the NETGEAR switches on your network such as password management firmware upgrade and configuration file backup For more information see Smart Control Center Utilities on page 19 Chapter 1 Getting Started 11 GS716Tv2 and GS724Tv3 Software Administration Manual Connecting the Switch to the Network To enable remote management of the switch through a Web browser or SNMP you must connect the switch to the network and configure it with network information an IP address subnet mask and default gateway The switch has a default IP address of 192 168 0 239 and a default subnet mask of 255 255 255 0 Use one of the following three methods to change the default network information on the switch Dynamic assignment through DHCP DHCP is enabled by default on the switch If you connect the switch to a network with a DHCP server the switch obtains its network information automatically You can use the Smart Control Center to discover the automatically assigned network
241. mapping such as minimum guaranteed bandwidth or transmission rate shaping are user configurable at the queue or port level Four queues per port are supported From the Class of Service link under the QoS tab you can access the following pages e Basic CoS Configuration on page 128 e CoS Interface Configuration on page 129 e Interface Queue Configuration on page 131 e 802 1p to Queue Mapping on page 132 e DSCP to Queue Mapping on page 133 Basic CoS Configuration Use the Trust Mode Configuration page to set the class of service trust mode of an interface Each port in the switch can be configured to trust one of the packet fields 802 1p or IP DSCP or to not trust any packet s priority designation untrusted mode If the port is set to a trusted mode it uses a mapping table appropriate for the trusted field being used This mapping table indicates the CoS queue to which the packet should be forwarded on the appropriate egress port s Of course the trusted field must exist in the packet for the mapping table to be of any use so there are default actions performed when this is not the case These actions involve directing the packet to a specific CoS level configured for the ingress port as a whole based on the existing port default priority as mapped to a traffic class by the current 802 1p mapping table Alternatively when a port is configured as untrusted it does not trust any incoming packet priority designation and uses the
242. mprising arbitrarily interconnected networking devices each operating MSTP STP or RSTP MSTP allows frames assigned to different VLANs to follow separate paths each based on an independent Multiple Spanning Tree Instance MSTI within Multiple Spanning Tree MST Regions composed of LANs and or MSTP Bridges These Regions and the other Bridges and LANs are connected into a single Common Spanning Tree CST IEEE DRAFT P802 1s D13 MSTP connects all Bridges and LANs with a single Common and Internal Spanning Tree CIST The CIST supports the automatic determination of each MST region choosing its maximum possible extent The connectivity calculated for the CIST provides the CST for interconnecting these Regions and an Internal Spanning Tree IST within each Region MSTP ensures that frames with a given VLAN ID are assigned to one and only one of the MSTIS or the IST within the Region that the assignment is consistent among all the networking devices in the Region and that the stable connectivity of each MSTI and IST at the boundary of the Region matches that of the CST The stable active topology of the Bridged LAN with respect to frames consistently classified as belonging to any given VLAN thus simply and fully connects all LANs and networking devices throughout the network though frames belonging to different VLANs can take different paths within any Region per IEEE DRAFT P802 1s D13 All bridges whether they use STP RSTP or MSTP send in
243. n 10 3 1 4 10BASE2 These documents define jabber as the condition where any packet exceeds 20 ms The allowed range to detect jabber is between 20 ms and 150 ms Fragments Received The total number of packets received that were less than 64 octets in length with ERROR CRC excluding framing bits but including FCS octets Undersize Received The total number of packets received that were less than 64 octets in length with GOOD CRC excluding framing bits but including FCS octets Alignment Errors The total number of packets received that had a length excluding framing bits but including FCS octets of between 64 and 1518 octets inclusive but had a bad Frame Check Sequence FCS with a non integral number of octets Rx FCS Errors The total number of packets received that had a length excluding framing bits but including FCS octets of between 64 and 1518 octets inclusive but had a bad Frame Check Sequence FCS with an integral number of octets Overruns The total number of frames discarded as this port was overloaded with incoming packets and could not keep up with the inflow Total Received Packets Not Forwarded A count of valid frames received which were discarded i e filtered by the forwarding process Local Traffic Frames The total number of frames dropped in the forwarding process because the destination address was located off of this port 802 3x Pause Frames Received A
244. n also delete or reschedule selected tasks The following figure shows the Tasks page ic SmartControlCenter NETGEAR Network Maintenance Help QUIT Task Management From 08 15 2010 To 09 12 2010 00 244b2 5c 96 49 09 09 2010 7 22 pm upload configuration Successfully completed OK 0 009 00 00 00 01 02 21 2010 11 17 pm upgrade firmare Completed file transfer however device status sear renee 00 00 00 00 00 01 02 21 2010 11 15 pm upgrade firmare Fide transfer internal Error 0 09 00 00 00 01 02 21 2010 10 22 pm upgrade firmware File transfer internal Error 0 240 b 2063102145 02 21 2010 1 23 pm upgrade fenmare Completed file transfer however device status after reboo 90 240 2063102145 02 21 2010 12 155 pm upgrade fienmane Fle transfer internal Error izj Delete Task MAC 00 242b2 5c 96 49 Task upgrade firmware The following list describes the command buttons that are specific to the Tasks page e Delete Task Remove a completed or schedule task from the list e Reschedule Change the scheduled date and time for a pending firmware upgrade e Select Range Select all tasks that occurred or are scheduled to occur within a certain period of time Chapter 1 Getting Started 23 GS716Tv2 and GS724Tv3 Software Administration Manual Understanding the User Interfaces The switch software includes a set of comprehensive management functions for configuring and monitoring the system by using one of the following methods e W
245. n screen for this class Configure the following settings for Class1 e Protocol Type UDP e Source IP Address 192 12 1 0 e Source Mask 255 255 255 0 e Source L4 Port Other and enter 4567 as the source port value e Destination IP Address 192 12 2 0 e Destination Mask 255 255 255 0 e Destination L4 Port Other and enter 4568 as the destination port value For more information about this screen see Class Configuration on page 137 Click Apply From the Policy Configuration screen create a new policy with the following settings e Policy Selector Policy1 Member Class Class1 For more information about this screen see Policy Configuration on page 140 Click Add to add the new policy Click the Policy1 hyperlink to view the Policy Class Configuration screen for this policy Configure the Policy attributes as follows e Assign Queue 3 e Policy Attribute Simple Policy e Color Mode Color Blind e Committed Rate 1000000 Kbps e Committed Burst Size 128 KB e Confirm Action Send e Violate Action Drop For more information about this screen see Policy Configuration on page 140 From the Service Configuration screen select the check box next to interfaces g7 and g8 to attach the policy to these interfaces and then click Apply See Service Configuration on page 145 258 Appendix B Configuration Examples GS716Tv2 and GS724Tv3 Software Administration Manual All UDP packet flows destined to the 192 12
246. nal packet on the wire This means that if the mirror is copying a received packet the copied packet is VLAN tagged or untagged as it was received on the source port If the mirror is copying a transmitted packet the copied packet is VLAN tagged or untagged as it is being transmitted on the source port Use the Multiple Port Mirroring page to define port mirroring sessions To access the Multiple Port Mirroring page click Monitoring Port Mirroring NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitorin Maintenance Help tocour J y J g P v Port Mirroring Multiple Port Mirroring Status Table GO TO INTERFACE oo Session Mirrorin Source Port Destination Port 9 Orsadle CO TO INTERFACE 222 Chapter 6 Monitoring the System GS716Tv2 and GS724Tv3 Software Administration Manual To configure Port Mirroring 1 2 Select the check box next to a port to configure it as a source port In the Destination Port field specify the port to which port traffic is be copied Use the e1 e2 format to specify the port You can configure only one destination port on the system From the Session Mode menu select the mode for port mirroring on the selected port e Enable Multiple Port Mirroring is active on the selected port e Disable Port mirroring is not active on the selected port but the mirroring information is retained Click Apply to apply the settings to the system If the p
247. nd feature components The Device View is available from the System Device View page The port coloring indicates whether a port is currently active Green indicates that the port is enabled red indicates that an error has occurred on the port or red indicates that the link is disabled The following image shows the Device View of the GS716T and GS724T NETOSAR PESEEREENEUENENESS Click the port you want to view or configure to see a menu that displays statistics and configuration options Click the menu option to access the page that contains the configuration or monitoring options 26 Chapter 1 Getting Started GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR GS724T 24 Port Gigabit Smart Switch cared with innowo System Switching QoS Security Monitoring Maintenance Help tooour Port Configuration Port Detailed Statistics Port Summary Statistics Spanning Tree Port Configuraton Status VLAN Port Configuration Auto VoIP Port Configuration IGMP Snooping Port Security Interface Configuration Port Securty Static Port Security Oynamic If you click the graphic but do not click a specific port the main menu appears as the following figure shows This menu contains the same option as the navigation tabs at the top of the page GS724T NETGEAR aren OU Saen Sut System Switching QoS Security Monitoring Maintenance Help Logout J Wu an System Switching QoS Secunty B
248. nd reset the data on the screen to the latest value of the switch Chapter 3 Configuring Switching Information 123 GS716Tv2 and GS724Tv3 Software Administration Manual The following table describes the information available for each entry in the address table Field Description VLAN ID Specifies the VLAN ID on which the IGMP Snooping Querier is administratively enabled and for which VLAN exists in the VLAN database MAC Address A unicast MAC address for which the switch has forwarding and or filtering information The format is a six byte MAC address with each byte separated by colons For example 00 0F 89 AB CD EF Interface The port where this address was learned that is this field displays the port through which the MAC address can be reached Status The status of this entry The possible values are e Static The entry was added when a static MAC filter was defined e Learned The entry was learned by observing the source MAC addresses of incoming traffic and is currently in use e Management The system MAC address which is identified with interface c1 Dynamic Address Configuration Use the Dynamic Addresses page to set the amount of time to keep a learned MAC address entry in the forwarding database The forwarding database contains static entries which are never aged out and dynamically learned entries which are removed if they are not updated within a given time To access the Co
249. ndard IP ACL Example 253 STP 93 TACACS 156 Time 36 Trap 49 VLAN 80 VLAN example 251 VLAN Port Membership 81 CoS 128 D defaults 244 CoS 253 factory 151 DES 28 Device View 26 DHCP client 12 Filtering 65 Filtering Interface Configuration 66 refreshing the client 19 DiffServ 135 DNS 43 DoS 41 download a file 230 files via HTTP 230 from a remote system 230 software 230 Dual Image Status 235 Index 272 GS716Tv2 and GS724Tv3 Software Administration Manual E EAP 211 EAPOL 212 F file management 234 firmware 21 firmware download 230 G getting started 10 Green Ethernet 46 72 guest VLAN configuration 261 H help HTML based 26 HTTP 161 management interface access 18 secure 161 using to download files 232 HTTPS 162 ICMP 41 IEEE 802 11x 260 IEEE 802 1AB 52 IEEE 802 1D 93 IEEE 802 1Q 80 93 IEEE 802 1s 93 IEEE 802 1w 93 IEEE 802 1X 151 IEEE 802 3 flow control 73 IGMP 110 interface LAG 74 logical 29 naming convention 29 physical 29 queue configuration 131 IP address administrative system 16 static configuration 19 switch 12 33 IP DSCP 128 Mapping 133 L LACP port configuration 78 LAG VLAN 74 LAGPDUS 74 LAGs 74 Membership 76 Static 74 LLDP 52 Local Information 57 neighbors information 60 packets 53 port settings 53 LLDP MED 52 M MAC 33 59 101 110 ACL 184 bridge identifier 104 CPU Management Interface 29 dynamic address 124 filter summary 176 MFDB Table 11
250. ndicates the amount of time in seconds a bridge waits before implementing a topological change The valid range is 6 40 and the value must be less than or equal to 2 Bridge Forward Delay 1 and greater than or equal to 2 Bridge Hello Time 1 The default value is 20 e Bridge Hello Time secs Specifies the switch Hello time for the Common and Internal Spanning Tree CST which indicates the amount of time in seconds a root bridge waits between configuration messages The value is fixed at 2 seconds e Bridge Forward Delay secs Specifies the switch forward delay time which indicates the amount of time in seconds a bridge remains in a listening and learning state before forwarding packets The value must be greater or equal to Bridge Max Age 2 1 The time range is from 4 seconds to 30 seconds The default value is 15 e Spanning Tree Maximum Hops Specifies the maximum number of bridge hops the information for a particular CST instance can travel before being discarded The valid range is 1 127 2 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 96 Chapter 3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual 3 f you make any configuration changes click Apply to send the updated configuration to the switch Configuration changes take place immediately The following table describes the MSTP status in
251. nding Table gt Advanced Chapter 5 Managing Device Security 189 GS716Tv2 and GS724Tv3 Software Administration Manual The following table describes the information displayed in the MAC Binding Table Field Description Interface Displays the interface to which the MAC ACL is bound Direction Specifies the packet filtering direction for ACL The only valid direction is Inbound which means the MAC ACL rules are applied to traffic entering the port ACL Type Displays the type of ACL assigned to selected interface and direction ACL ID Displays the ACL Name identifying the ACL assigned to selected interface and direction Sequence No Displays the Sequence Number signifying the order of specified ACL relative to other ACLs assigned to selected interface and direction To delete a MAC ACL to interface binding select the check box next to the interface and click Delete IP ACL IP ACLs allow network managers to define classification actions and rules for specific ingress ports Packets can be filtered on ingress inbound ports only If the filter rules match then some actions can be taken including dropping the packet or disabling the port For example a network administrator defines an ACL rule that says port number 20 can receive TCP packets However if a UDP packet is received the packet is dropped ACLs are composed of access control entries ACE or rules that consist of the filters tha
252. nfiguration DiffServ Configuration DiffServ Configuration gt Advanced DiffServ Admin Mode Disable Enable Status e 0 32 Class table Class Rule table 0 192 Policy table 0 32 Policy Instance table o 320 Policy Attributes table 0 960 Service table 0 34 REFRESH To configure the global DiffServ mode 1 Select the administrative mode for DiffServ e Enable Differentiated Services are active e Disable The DiffServ configuration is retained and can be changed but it is not active 2 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 3 If you make changes to the page click Apply to apply the changes to the system The following table describes the information displayed in the Status table on the DiffServ Configuration page Field Description Class Table Displays the current and maximum number of rows of the class table Class Rule Table Displays the current and maximum number of rows of the class rule table Policy Table Displays the current and maximum number of rows of the policy table Policy Instance Table Displays the current and maximum number of rows of the policy instance table 136 Chapter 4 Configuring Quality of Service GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Policy Attributes Table Displays the current and maximum number of rows of the policy
253. nfiguration page click Switching Address Table Advanced Dynamic Addresses NETGEAR GS724T 24 Port Gigabit Smart Switch tocout Dynamic Address Dynamic Address Address Aging Address Table gt Static MAC Address To configure the Dynamic Address setting 1 Specify the number of seconds the forwarding database should wait before deleting a learned entry that has not been updated IEEE 802 1D 1990 recommends a default of 300 seconds You may enter any number of seconds between 10 and 1000000 The factory default is 300 124 Chapter3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual Note IEEE 802 1D recommends a default of 300 seconds which is the factory default 2 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 3 Click Apply to apply to send the updated configuration to the switch Configuration changes take effect immediately Static MAC Address Use the Static MAC Address Configuration page to configure and view static MAC addresses on an interface To access the Static MAC Address Configuration page click Switching gt Address Table gt Advanced gt Static MAC Address NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help 1000u gt Basic Static MAC Address v Advanced Dynamic Static MAC Address Addresse
254. nfiguring RADIUS max retransmit and RADIUS timeout If multiple RADIUS servers are configured the max retransmit value on each will be exhausted before the next server is attempted A retransmit will not occur until the configured timeout value on that server has passed without a response from the RADIUS server Therefore the maximum delay in receiving a response from the RADIUS application equals the sum of retransmit times timeout for all configured servers If the RADIUS request was generated by a user login attempt all user interfaces will be blocked until the RADIUS application returns a response 2 In the Timeout Duration field specify the timeout value in seconds for request retransmissions Consideration to maximum delay time should be given when configuring RADIUS max retransmit and RADIUS timeout If multiple RADIUS servers are configured the max retransmit value on each will be exhausted before the next server is attempted A retransmit will not occur until the configured timeout value on that server has passed without a response from the RADIUS server Therefore the maximum delay in receiving a response from the RADIUS application equals the sum of retransmit times timeout for all configured servers If the RADIUS request was generated by a user login attempt all user interfaces will be blocked until the RADIUS application returns a response 3 From the Accounting Mode menu select whether the RADIUS accounting mode is enabl
255. ng Information 95 GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR GS724T 24 Port Gigabit Smart Switch Switching QoS Security Monitoring tocour Ports LAG VLAN Voice VLAN Auto VolP Multicast Address Table Basic CST Configuration Advanced STP CST Configuration Configuration Bridge Priority CST Configuration CST Port Configuration Bridge Max Age secs Bridge Hello Time secs Bridge Forward Delay secs CST Port Status Spanning Tree Maximum Hops RSTP MST Configuration MSTP Status MST Port MST ID VID Le Configuration CST 12345 12345 STP Statistics lt To configure CST settings 1 Specify values for CST in the appropriate fields e Bridge Priority When switches or bridges are running STP each is assigned a priority After exchanging BPDUs the switch with the lowest priority value becomes the root bridge Specifies the bridge priority value for the Common and Internal Spanning Tree CST The valid range is 0 61440 The bridge priority is a multiple of 4096 If you specify a priority that is not a multiple of 4096 the priority is automatically set to the next lowest priority that is a multiple of 4096 For example if the priority is attempted to be set to any value between 0 and 4095 it will be set to 0 The default priority is 32768 e Bridge Max Age secs Specifies the bridge maximum age time for the Common and Internal Spanning Tree CST which i
256. ng Policies Use DiffServ policies to associate a collection of classes that you configure with one or more QoS policy statements The result of this association is referred to as a policy From a DiffServ perspective there are two types of policies e Traffic Conditioning Policy a policy applied to a DiffServ traffic class e Service Provisioning Policy a policy applied to a DiffServ service level You must manually configure the various statements and rules used in the traffic conditioning and service provisioning policies to achieve the desired Traffic Conditioning Specification TCS and the Service Level Specification SLS operation respectively Traffic Conditioning Policy Traffic conditioning pertains to actions performed on incoming traffic There are several distinct QoS actions associated with traffic conditioning 256 Appendix B Configuration Examples GS716Tv2 and GS724Tv3 Software Administration Manual e Dropping drop a packet upon arrival This is useful for emulating access control list operation using DiffServ especially when DiffServ and ACL cannot co exist on the same interface e Marking IP DSCP or IP Precedence marking re marking the DiffServ code point in a packet with the DSCP value representing the service level associated with a particular DiffServ traffic class Alternatively the IP Precedence value of the packet can be marked re marked e Marking CoS 802 1p sets the three bit priority field in th
257. nistration Manual Configuration and Status Options The area directly under the feature links and to the right of the page menu displays the configuration information or status for the page you select On pages that contain configuration options you can input information into fields or select options from drop down menus Each page contains access to the HTML based help that explains the fields and configuration options for the page Each page also contains command buttons The following table shows the command buttons that are used throughout the pages in the Web interface Button Function Add Clicking Add adds the new item configured in the heading row of a table Apply Clicking the Apply button sends the updated configuration to the switch Configuration changes take effect immediately Cancel Clicking Cancel cancels the configuration on the screen and resets the data on the screen to the latest value of the switch Delete Clicking Delete removes the selected item Refresh Clicking the Refresh button refreshes the page with the latest information from the device Logout Clicking the Logout button ends the session Device View The Device View is a Java applet that displays the ports on the switch This graphic provides an alternate way to navigate to configuration and monitoring options The graphic also provides information about device ports current configuration and status table information a
258. nterface Binding Status ACL ID Seq No To configure IP ACL interface bindings 1 Select an existing IP ACL from the ACL ID menu The packet filtering direction for ACL is Inbound which means the IP ACL rules are applied to traffic entering the port 2 Specify an optional sequence number to indicate the order of this access list relative to other access lists already assigned to this interface and direction A low number indicates high precedence order If a sequence number is already in use for this interface and direction the specified access list replaces the currently attached access list using that sequence number If the sequence number is not specified by the user a sequence number that is one greater than the highest sequence number currently in use for this interface and direction will be used The valid range is 14294967295 3 Click the appropriate orange bar to expose the available ports or LAGs e Toadd the selected ACL to a port or LAG click the box directly below the port or LAG number so that an X appears in the box e Toremove the selected ACL from a port or LAG click the box directly below the port or LAG number to clear the selection An X in the box indicates that the ACL is applied to the interface 4 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 5 Click Apply to save any changes to the running configuration Chapter 5
259. ntified by the VLAN ID in the tag In an untagged frame the VLAN is the Port VLAN ID specified for the port that received this frame e Disable All frames are forwarded in accordance with the IEEE 802 1Q VLAN standard The factory default is Disable 8 Specify the default 802 1p priority assigned to untagged packets arriving at the port Possible values are 0 7 9 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 10 If you make any changes to this page click Apply to send the updated configuration to the switch Configuration changes take place immediately Chapter 3 Configuring Switching Information 85 GS716Tv2 and GS724Tv3 Software Administration Manual Voice VLAN Configure the Voice VLAN settings for ports that carry traffic from IP phones The Voice VLAN feature can help ensure that the sound quality of an IP phone is safeguarded from deteriorating when the data traffic on the port is high From the VLAN link you can access the following pages e Voice VLAN Properties on page 86 e Voice VLAN Port Setting on page 87 e Voice VLAN OUI on page 88 Voice VLAN Properties To display the Voice VLAN Properties page click Switching gt Voice VLAN gt Basic gt Properties GS724T N E TG A R 24 Port Gigabit Smert Switch System Switching QoS Security Monitoring Maintenance Help scour VLAN Auto VolP E11 Multicast Address Table vBasic Proper
260. o Port Description Port Type Port Speed D e Enable Auto C sable Disable CO 923 sddsdfsdtdt Enable Auto Disable Disable p 33 Enable 100 Mbps Full Duplex Oaabdle Disable D e Enable 100 Mbps Full Ouplex Disable Disable E Enable Enable 22 Enable Auto Cable Disable 923 E able Auto Osadle Disable Enable GS724T 24 Port Gigabit Smart Switch Maximum Physical Status Link Status Link Trap Frame Size MAC Address 1518 To 9216 Enable vi t Unk Down Enatie 1318 00 00100 03 16 01 1 1 Link Down Enable 13 8 00 00 00 01 16 01 2 2 Unk Down Enable 13518 00 00 100 01 16 101 3 3 Unk Down Enable 13 8 00 00 00 01 1 6 01 4 4 00 00 00 01 16 01 00 00 00 01 16 01 Link Down Enable 1518 00 00 00 01 16 01 22 Unk Down Enable 1318 00 00 00 01 16 01 23 23 Unk Down Enable 1518 00 00 00 01 16 01 24 24 GO TO INTERFACE To configure port settings 1 To configure settings for a physical port click PORTS 2 To configure settings for a Link Aggregation Group LAG click LAGS Chapter 3 Configuring Switching Information 71 GS716Tv2 and GS724Tv3 Software Administration Manual 3 To configure settings for both physical ports and LAGs click ALL Select the check box next to the port or LAG to configure You can select multiple ports and LAGs to apply the same setting to the selected interfaces Select the check box in the heading row to apply the same settings to all interfaces 5 C
261. o the Name field then click Delete 3 To change the name of a MAC ACL select the check box next to the Name field update the name then click Apply 4 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch Chapter 5 Managing Device Security 185 GS716Tv2 and GS724Tv3 Software Administration Manual MAC Rules Use the MAC Rules page to define rules for MAC based ACLs The access list definition includes rules that specify whether traffic matching the criteria is forwarded normally or discarded A default deny all rule is the last rule of every list To display the MAC Rules page click Security ACL then click the Basic MAC Rules link NE TG EAR Security Monitoring Maintenance Help System Switching Port Authentication Access Troffe Control gt ACL Wizard MAC Rules MAC ACL Rules MAC Rules ACL Name al MAC Binding Configuration Binding Table Rule Table gt Advanced ID 1 to Assign Redirect Match Destination MAC Action cos Destination MAC 10 Queue Interface Every Mask L i i 1 i JL L EL E D GS724T 24 Port Gigabit Smart Switch EtherType User Value EtherType Key Source MAC Source MAC Mask VLAN 0600 to FFFF hex i DT L MEN le To configure MAC ACL rules 1 From the ACL Name field specify the existing MAC ACL
262. o to Security gt Management Security gt Authentication List and select RADIUS as method 1 for defaultList For more information see Authentication List Configuration on page 159 e Disable The switch does not check for 802 1X authentication before allowing traffic on any ports even if the ports are configured to allow only authenticated users Select the appropriate radio button in the Guest VLAN field to enable or disable the guest VLAN supplicant mode Enabled When no 802 1X supplicant is authenticated on a port the port still provides limited network access as determined by a guest VLAN configured on the authentication server e Disabled A guest VLAN cannot be used for unauthorized ports Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch If you change the settings click Apply to apply the new settings to the system Port Authentication Use the Port Authentication page to enable and configure port access control on one or more ports To access the Port Authentication page click Security gt Port Authentication and then click the Advanced gt Port Authentication link Note Use the horizontal scroll bar at the bottom of the browser to view all the fields on the Port Authentication page The figures on the following page are both images of the Port Authentication page Chapter 5 Managing Device Security 169 GS716Tv2 and GS724Tv3 Soft
263. ocour gt System Information Host Configuration IP Configuration Time Br Y ONS Host Configuration gt Green Ethernet Configuration Dynamic Host Configuration o Most Total Elapsed CLEAR REFRESH To add a static entry to the local DNS table 1 Specify the static host name to add Enter up to 158 characters 2 Specify the IP address in standard IPv4 dot notation to associate with the hostname 3 Click Add The entry appears in the list below 4 To remove an entry from the static DNS table select the check box next to the entry and click Delete 5 To change the hostname or IP address in an entry select the check box next to the entry and enter the new information in the appropriate field and then click Apply 6 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch The Dynamic Host Configuration table shows host name to IP address entries that the switch has learned The following table describes the dynamic host fields Field Description Host Lists the host name you assign to the specified IP address Total Amount of time since the dynamic entry was first added to the table Elapsed Amount of time since the dynamic entry was last updated Type The type of the dynamic entry Addresses Lists the IP address associated with the host name Click Refresh to refresh the table with the most current data fr
264. od w 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help 1600v Manogement Security Port Authentication Traffic Control ACL gt HTTP Access Profile Configuration gt HTTPS Access Control Access Profile Configuration poro Remove Configuration Access Profile Name Activate Profile Deactivate Profile Profile Access Rule Configuration Profile Summary Source IP Rule Type Service Type ve ve Address Priority RLARESH To configure an Access Profile 1 In the Access Profile Name field specify the name of the access profile to be added The maximum length is 32 characters 2 Toactivate an access profile select the Activate Profile check box You cannot add rules to an active profile 3 To deactivate an access profile select the Deactivate Profile check box 4 To remove an access profile select the Remove Profile check box The access profile should be deactivated before removing the access profile 5 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 6 If you make changes to the page click Apply to apply the changes to the system Chapter 5 Managing Device Security 165 GS716Tv2 and GS724Tv3 Software Administration Manual The Profile Summary table shows the rules that are configured for the profile as the following table describes Field Description Rule Type Identi
265. olicy LLDP MED Network Policy Interface REIFRESH From the Interface menu select the interface with the information to view The following table describes the LLDP MED network policy information that displays on the screen Chapter 2 Configuring System Information 55 GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Network Policy Number Specifies the policy number Application Specifies the media application type associated with the policy Only the Voice application type is supported The application type that is received on the interface has the VLAN ID priority DSCP tagged bit status and unknown bit status This information is displayed only if a network policy TLV has been transmitted VLAN ID Specifies the VLAN ID associated with the policy VLAN Type Specifies whether the VLAN associated with the policy is tagged or untagged User Priority Specifies the priority associated with the policy DSCP Specifies the DSCP associated with a particular policy type Click Refresh to refresh the page with the most current data from the switch LLDP MED Port Settings Use this page to enable LLDP MED mode on an interface and configure its properties To display this page click System gt LLDP gt Advanced gt LLDP MED Port Settings NETGEAR GS724T f 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help Mana
266. om the Supplicant to the Authentication Server in order for the credentials to be checked which will determine the authorization state of the Port The Authenticator PAE controls the authorized unauthorized state of the controlled Port depending on the outcome of the RADIUS based authentication process Supplicant Authenticator Switch 0l Authentication S a Server RADIUS 192 168 10 23 Supplicant 802 1X Example Configuration This example shows how to configure the switch so that 802 1X based authentication is required on the ports in a corporate conference room e1 e8 These ports are available to visitors and need to be authenticated before granting access to the network The authentication is handled by an external RADIUS server When the visitor is successfully authenticated traffic is automatically assigned to the guest VLAN This example assumes that a VLAN has been configured with a VLAN ID of 150 and VLAN Name of Guest 1 From the Port Authentication screen select ports e1 through e8 2 From the Port Control menu select Unauthorized The Port Control setting for all other ports where authentication is not needed should Authorized When the Port Control setting is Authorized the port is unconditionally put in a force Authorized state and does not require any authentication When the Port Control setting is Auto the authenticator PAE sets the controlled port mode Appendix B Configuration Examples 261 GS71
267. om the switch Click Clear to delete Dynamic Host Entries The table will be repopulated with entries as they are learned Chapter 2 Configuring System Information 45 GS716Tv2 and GS724Tv3 Software Administration Manual Green Ethernet Configuration Use this page to configure Green Ethernet features Using the Green Ethernet features allows for power consumption savings To access this page click System Management Green Ethernet Configuration NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help 1060vt gt System Information Green Ethernet Configuration gt IP Configuration gt Time Green Ethernet Configuration gt Denial of Service Short Cable Mode O Enable DNS v Green Ethernet Configuration To configure the Green Ethernet feature 1 Enable or disable the Short Cable Mode e Enable The switch performs a cable test on each cable connect to its ports If the cable is less than 10m in length the port is placed in low power mode nominal power e Disable Full transmit power is provided to all ports regardless of cable length 2 Click Apply to send the updated configuration to the switch Configuration changes take effect immediately 46 Chapter2 Configuring System Information GS716Tv2 and GS724Tv3 Software Administration Manual License Key This page provides information about available License Keys for various features By d
268. ommon STP see CST Port Configuration on page 97 Multiple Spanning Tree Protocol MSTP supports multiple instances of Spanning Tree to efficiently channel VLAN traffic over different interfaces Each instance of the Spanning Tree behaves in the manner specified in IEEE 802 1w Rapid Spanning Tree RSTP with slight modifications in the working but not the end effect chief among the effects is the rapid transitioning of the port to Forwarding The difference between the RSTP and the traditional STP IEEE 802 1D is the ability to configure and recognize full duplex connectivity and ports which are connected to end stations resulting in rapid transitioning of the port to Forwarding state and the suppression of Topology Change Notification These features are represented by the parameters pointtopoint and edgeport MSTP is compatible to both RSTP and STP It behaves appropriately to STP and RSTP bridges A MSTP bridge can be configured to behave entirely as a RSTP bridge or a STP bridge Note For two bridges to be in the same region the force version should be 802 1s and their configuration name digest key and revision level should match For additional information about regions and their effect on network topology refer to the IEEE 802 1Q standard The Spanning Tree folder contains links to the following features e STP Switch Configuration on page 93 e CST Configuration on page 95 e CST Port Configuration on page
269. omparison against the IP ToS field in a packet 3 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 4 If you change any of the settings on the page click Apply to send the updated configuration to the switch Configuration changes occur immediately 5 Click Refresh to refresh the page with the most current data from the switch Policy Configuration Use the Policy Configuration page to associate a collection of classes with one or more policy statements After creating a Policy click the policy link to the Policy page To display the page click QoS gt DiffServ gt Advanced gt Policy Configuration 140 Chapter4 Configuring Quality of Service GS716Tv2 and GS724Tv3 Software Administration Manual NETG E A R GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help 060v gt Basic Policy Configuration v Advanced DiffServ Policy Configuration Configuration Class Configuration Configuration DE rexroicneme S Prewcised h Policy Selector Policy Type Policy Configuration Service Configuration Service Statisbcs lt To configure a DiffServ policy 1 To create a new policy enter a policy name in the Policy Selector field select the existing DiffServ class to associate with the policy and click Add The available policy type is In which indicates the type is specif
270. on Differentiated Services DiffServ sss Creating Policies iii i055 0 orent Ere e rer eg DiffServ Example Configuration B 2 TX aceite Cad pute he ce ee nee eo ed 802 1X Example Configuration DUX esitte rrin EET MSTP Example Configuration Appendix C Notification of Compliance Index Table of Contents 7 GS716Tv2 and GS724Tv3 Software Administration Manual 8 Table of Contents Getting Started The NETGEAR GS716T and GS724T Smart Switch Software Administration Manual describes how to configure and operate the GS716T and GS724T Gigabit Smart Switches by using the Web based graphical user interface GUI This manual describes the software configuration procedures and explains the options available within those procedures Document Organization The GS716Tv2 and GS724Tv3 Software Administration Manual contains the following chapters Chapter 1 Getting Started contains information about performing the initial system configuration and accessing the user interface Chapter 2 Configuring System Information describes how to configure administrative features such as SNMP DHCP and port information Chapter 3 Configuring Switching Information describes how to manage and monitor the layer 2 switching features Chapter 4 Configuring Quality of Service describes how to manage the Access Control Lists ACLs and how to configure Differentiated
271. on A MAC address can be defined as allowable by one of two methods dynamically or statically Both methods are used concurrently when a port is locked Dynamic locking implements a first arrival mechanism for Port Security You specify how many addresses can be learned on the locked port If the limit has not been reached then a packet with an unknown source MAC address is learned and forwarded normally When the limit is reached no more addresses are learned on the port Any packets with source MAC addresses that were not already learned are discarded You can effectively disable dynamic locking by setting the number of allowable dynamic entries to zero Static locking allows you to specify a list of MAC addresses that are allowed on a port The behavior of packets is the same as for dynamic locking only packets with an allowable source MAC address can be forwarded To display the Port Security Interface Configuration page click Security Traffic Control and then click the Port Security gt Interface Configuration link Chapter 5 Managing Device Security 179 GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Mointenonce Help tooour Management Security gt MAC Filter Interface Configuration gt Storm Control Port Security Interface Configuration Port Security PORTS LAGS AM GO TO INTERFACE Configuration Max Max Al
272. onfigure or view the settings Description Enter the description string to be attached to a port The string can be up to 64 characters in length Port Type For most ports this field is blank Otherwise the possible values are e MON Indicates that the port is a monitoring port For additional information about port monitoring see Port Mirroring on page 222 e LAG Indicates that the port is a member of a Link Aggregation trunk For more information see Link Aggregation Groups on page 74 Admin Mode Use the menu to select the port control administration state which can be one of the following e Enable The port can participate in the network default e Disable The port is administratively down and does not participate in the network Port Speed Use the menu to select the port s speed and duplex mode If you select Auto the duplex mode and speed will be set by the auto negotiation process The port s maximum capability full duplex and 1000 Mbps will be advertised Otherwise your selection will determine the port s duplex mode and transmission rate The factory default is Auto Auto Power Down Mode Use the menu to select the port s Green Ethernet mode which can be one of the following e Enable Specifies that if no link partner is present the port can go down for short periods of time to reduce overall power consumption The port wakes up periodically to check for link pulses e Disable The port does not participate
273. onsumption savings by cable length 10m Automatic power down on port when link is down GS716T and GS724T Switch Features and Defaults Port Characteristics Feature Sets Supported Default Auto negotiation static All ports Auto negotiation speed duplex Auto MDI MDIX N A Enabled 802 3x flow control back pressure 1 per system Disabled Port mirroring 1 Disabled Port trunking aggregation 2 for GS716T 4 for GS724T Pre configured 802 1D spanning tree 1 Disabled 802 1w RSTP 1 Disabled 802 1s spanning tree 3 instances Disabled Static 802 1Q tagging 64 VID 1 member ports 16 GS716T member ports 24 GS724T Learning process Supports Static and dynamic MAC Dynamic learning is enabled by entries default Appendix A Hardware Specifications and Default Values 245 Traffic Control GS716Tv2 and GS724Tv3 Software Administration Manual Feature Sets Supported Default Storm control All ports Disabled Jumbo frame All ports Disabled Max 9216 bytes Quality Of Service Feature Sets Supported Default Number of queues 4 N A Port based N A N A 802 1p 1 Enabled DSCP 1 Disabled Rate limiting All ports Disabled Auto QoS All ports Disabled Security Feature Sets Supported Default 802 1X All ports Disabled MAC ACL 100 Shared with IP ACL All MAC addresses allowed IP access list 100 sh
274. operation was successful and the system time was updated e Request Timed Out A directed SNTP request timed out without receiving a response from the SNTP server Bad Date Encoded The time provided by the SNTP server is not valid Version Not Supported The SNTP version supported by the server is not compatible with the version supported by the client Server Unsynchronized The SNTP server is not synchronized with its peers This is indicated via the leap indicator field on the SNTP message e Server Kiss Of Death The SNTP server indicated that no further queries were to be sent to this server This is indicated by a stratum field equal to 0 in a message received from a server Server IP Address Specifies the IP address of the server for the last received valid packet If no message has been received from any server an empty string is shown Address Type Specifies the address type of the SNTP Server address for the last received valid packet Server Stratum Specifies the claimed stratum of the server for the last received valid packet 38 Chapter2 Configuring System Information GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Reference Clock Id Specifies the reference clock identifier of the server for the last received valid packet Server Mode Specifies the mode of the server for the last received valid packet Unicast Sever Max Entries Specifies the m
275. ority Note This product s firmware limits operation to only the channels allowed in a particular Region or Country Therefore all options described in this user s guide may not be available in your version of the product Appendix C Notification of Compliance 268 GS716Tv2 and GS724Tv3 Software Administration Manual Europe EU Declaration of Conformity CE Marking by the above symbol indicates compliance with the Essential Requirements of the R amp TTE Directive of the European Union 1999 5 EC This equipment meets the following conformance standards EN300 328 EN301 489 17 EN60950 For complete DoC please visit the NETGEAR EU Declarations of Conformity website at http kb netgear com app answers detail a_id 11621 EDOC in Languages of the European Community Cesky Czech NETGEAR Inc t mto prohla uje Ze tento Radiolan je ve shode se z kladn mi po adavky a dal mi pr slu n mi ustanoven mi smernice 1999 5 ES Dansk Undertegnede NETGEAR Inc erkl rer herved at f lgende udstyr Radiolan Danish overholder de v sentlige krav og vrige relevante krav i direktiv 1999 5 EF Deutsch Hiermit erkl rt NETGEAR Inc dass sich das Ger t Radiolan in bereinstimmung German mit den grundlegenden Anforderungen und den brigen einschl gigen Bestimmungen der Richtlinie 1999 5 EG befindet Eesti K esolevaga kinnitab NETGEAR Inc seadme Radiolan vastavust direktiivi Estonian 1999 5
276. ort is configured as a source port the Mirroring Port field value is Mirrored To delete a mirrored port select the check box next to the mirrored port and then click Delete Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch Chapter 6 Monitoring the System 223 GS716Tv2 and GS724Tv3 Software Administration Manual 224 Chapter6 Monitoring the System Maintenance Use the features available from the Maintenance tab to help you manage the switch The Maintenance tab contains links to the following features Reset on page 226 Upload File From Switch on page 228 Download File To Switch on page 230 File Management on page 234 Troubleshooting on page 237 Chapter 7 Maintenance 225 GS716Tv2 and GS724Tv3 Software Administration Manual Reset The Reset menu contains links to the following options e Device Reboot on page 226 e Factory Default on page 226 Device Reboot Use the Device Reboot page to reboot the GS716T or GS724T To access the Device Reboot page click Maintenance Reset Device Reboot 24 Port Gigabit Smart Switch NETGEAR GS724T System Switching QoS Security Monitoring Maintenance Help tOGOUT J Upleed Download File Management Troubleshooting v Device Reboot Device Reboot gt Factory Default Device Reboot Check this box and click APPLY below to reboot To reboot the switch 1 Select th
277. orwarding element This selection requires that the Mark CoS value field be set e Mark IP Precedence These packets are marked by DiffServ with the specified IP Precedence value before being presented to the system forwarding element This selection requires that the Mark IP Precedence value field be set e Mark IP DSCP These packets are marked by DiffServ with the specified DSCP value before being presented to the system forwarding element This selection requires that the DSCP value field be set e Violate Action Determines what happens to packets that are considered non conforming above the police rate Select one of the following actions e Send default These packets are presented unmodified by DiffServ to the system forwarding element e Drop default These packets are immediately dropped e Mark CoS These packets are marked by DiffServ with the specified CoS value before being presented to the system forwarding element This selection requires that the Mark CoS value field be set e Mark IP Precedence These packets are marked by DiffServ with the specified IP Precedence value before being presented to the system forwarding element This selection requires that the Mark IP Precedence value field be set 144 Chapter4 Configuring Quality of Service GS716Tv2 and GS724Tv3 Software Administration Manual e Mark IP DSCP These packets are marked by DiffServ with the specified DSCP value before being presented to the system
278. ouT Management Securit Access Port Authentication ge Y gt MAC Filter Port Security Configuration gt Storm Control Y Port Security Port Security Configuration Port Security Port Security Mode DOisable Configuration Interface Configuration Port Security Violations Security MAC Port Last Violation MAC VLAN ID Address gt Protected Ports lt RLIRESM To configure the global port security mode 1 In the Port Security Mode field select the appropriate radio button to enable or disable port security on the switch 2 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 178 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual 3 If you change the mode click Apply to apply the change to the system The Port Security Violation table shows information about violations that occurred on ports that are enabled for port security The following table describes the fields in the Port Security Violation table Field Description Port Identifies the port where a violation occurred Last Violation MAC Displays the source MAC address of the last packet that was discarded at a locked port VLAN ID Displays the VLAN ID corresponding to the Last Violation MAC address Click Refresh to refresh the page with the most current data from the switch Port Security Interface Configurati
279. p Secondary 802 1p IP DSCP or IP Precedence fields designating the incoming color value to be used as the conforming color The color of exceeding traffic may be optionally specified as well e Counting updating octet and packet statistics to keep track of data handling along traffic paths within DiffServ In this DiffServ feature counters are not explicitly configured by the user but are designed into the system based on the DiffServ policy being created See the Statistics section of this document for more details e Assigning QoS Queue directs traffic stream to the specified QoS queue This allows a traffic classifier to specify which one of the supported hardware queues are used for handling packets belonging to the class e Redirecting forces classified traffic stream to a specified egress port physical or LAG This can occur in addition to any marking or policing action It may also be specified along with a QoS queue assignment Appendix B Configuration Examples 257 GS716Tv2 and GS724Tv3 Software Administration Manual DiffServ Example Configuration To create a DiffServ Class Policy and attach it to a switch interface follow these steps 1 From the QoS Class Configuration screen create a new class with the following settings e Class Name Class1 e Class Type All For more information about this screen see Class Configuration on page 137 Click the Class1 hyperlink to view the DiffServ Class Configuratio
280. personnel 3 If you make any changes to the page click Apply to apply the change to the system The rest of the page displays the number of persistent messages the system has logged and the persistent log messages Use the buttons at the bottom of the page to perform the following actions e Click Clear to clear the messages out of the buffered log e Click Refresh to refresh the page with the most current data from the switch e Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch Server Log Configuration Use the Server Log Configuration page to allow the switch to send log messages to the remote logging hosts configured on the system To access the Server Log Configuration page click the Monitoring Logs tab and then click the Server Log link 24 Port Gigabit Smart Switch NETGEAR GS724T System Switching QoS Security Monitoring Maintenonce Help 16o0vr gt Memory Log Server Log gt FLASH Log v Server Log Server Log Configuration gt Trap Logs Admin Status gt Event Logs Local UDP Port Messages Relayed Messages Ignored Server Configuration Host Address Port 1 to 65535 Severity Filter Chapter 6 MonitoringtheSystem 217 GS716Tv2 and GS724Tv3 Software Administration Manual To configure local log server settings 1 Use the radio buttons in the Admin Status field to determine whether to send log messages to the remote sys
281. plays the model name advertised by the remote device Chapter 2 Configuring System Information 63 GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Asset ID Displays the asset ID advertised by the remote device Location Information Civic Displays the physical location such as the street address the remote device has advertised in the location TLV For example 123 45th St E The field value length range is 6 160 characters Coordinates Displays the location map coordinates the remote device has advertised in the location TLV including latitude longitude and altitude ECS ELIN Displays the Emergency Call Service ECS Emergency Location Identification Number ELIN the remote device has advertised in the location TLV The field range is 10 25 Unknown Displays unknown location information for the remote device Network Policies Application Type Specifies the media application type associated with the policy advertised by the remote device VLAN ID Specifies the VLAN ID associated with the policy VLAN Type Specifies whether the VLAN associated with the policy is tagged or untagged User Priority Specifies the priority associated with the policy DSCP Specifies the DSCP associated with a particular policy type LLDP Unknown TLVs Type Displays the unknown TLV type field Value Displays the unknown
282. queue 0 which is the default queue All other traffic is explicitly denied on these interfaces To allow additional traffic to enter these ports you must add a new permit rule with the desired match criteria and bind the rule to interfaces 6 7 and 8 Standard IP ACL Example Configuration The following example shows how to create an IP based ACL that prevents any IP traffic from the Finance department from being allowed on the ports that are associated with other Appendix B ConfigurationExamples 253 GS716Tv2 and GS724Tv3 Software Administration Manual departments Traffic from the Finance department is identified by each packet s network IP address 1 From the IP ACL screen create a new IP ACL with an IP ACL ID of 1 See P ACL on page 190 2 From the IP Rules screen create a rule for IP ACL 1 with the following settings e Rule ID 1 e Action Deny e Assign Queue ID 0 optional O is the default value e Match Every False e Source IP Address 192 168 187 0 e Source IP Mask 255 255 255 0 For additional information about IP ACL rules see P Rules on page 191 3 Click Add From the IP Rules screen create a second rule for IP ACL 1 with the following settings Rule ID 2 e Action Permit e Match Every True 5 Click Add 6 From the IP Binding Configuration page assign ACL ID 1 to the interface gigabit ports 2 3 and 4 and assign a sequence number of 1 See P Binding Configuration on page 196 By default
283. ration Examples GS716Tv2 and GS724Tv3 Software Administration Manual e Destination MAC Mask 00 00 00 00 FF FF e Source MAC 02 02 1A BC DE EF e Source MAC Mask 00 00 00 00 FF FF e VLAN ID 2 For more information about MAC ACL rules see MAC Rules on page 186 3 From the MAC Binding Configuration screen assign the Sales_ACL to Ethernet ports 6 7 and 8 and then click Apply See MAC Binding Configuration on page 188 NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help 100007 J gt ACL Wizard MAC Binding Configuration v Basic MAC ACL Binding Configuration MAC Rules AG 10 MAC Binding Configurabon Ending Table gt Advanced Sequence Number ACL Type ACL ID You can assign an optional sequence number to indicate the order of this access list relative to other access lists if any are already assigned to this interface and direction 4 The MAC Binding Table displays the interface and MAC ACL binding information See MAC Binding Table on page 189 The ACL named Sales_ACL looks for Ethernet frames with destination and source MAC addresses and MAC masks defined in the rule Also the frame must be tagged with VLAN ID 2 which is the Sales department VLAN The CoS value of the frame must be 0 which is the default value for Ethernet frames Frames that match this criteria are permitted on interfaces 6 7 and 8 and are assigned to the hardware egress
284. rding e Broken Admin Mode Displays the port control administration state e Enable The port can participate in the network default Disable The port is administratively down and does not participate in the network LACP Mode Selects the Link Aggregation Control Protocol administration state Enable Specifies that the port is allowed to participate in a port channel LAG which is the default mode Disable Specifies that the port cannot participate in a port channel LAG Physical Mode Indicates the port speed and duplex mode In auto negotiation mode the duplex mode and speed are set from the auto negotiation process Physical Status Indicates the port speed and duplex mode status Link Status Indicates whether the link is up or down Link Trap This object determines whether or not to send a trap when link status changes The factory default is Enable e Enable Specifies that the system sends a trap when the link status changes e Disable Specifies that the system does not send a trap when the link status changes Packets RX and TX 64 Octets The total number of packets including bad packets received or transmitted that were 64 octets in length excluding framing bits but including FCS octets Packets RX and TX 65 127 Octets The total number of packets including bad packets received or transmitted that were between 65 and 127 octets in length inclus
285. received including interference that may cause undesired operation 270 Appendix C Notification of Compliance GS716Tv2 and GS724Tv3 Software Administration Manual FCC Radio Frequency Interference Warnings amp Instructions This equipment has been tested and found to comply with the limits for a Class B digital device pursuant to Part 15 of the FCC Rules These limits are designed to provide reasonable protection against harmful interference in a residential installation This equipment uses and can radiate radio frequency energy and if not installed and used in accordance with the instructions may cause harmful interference to radio communications However there is no guarantee that interference will not occur in a particular installation If this equipment does cause harmful interference to radio or television reception which can be determined by turning the equipment off and on the user is encouraged to try to correct the interference by one or more of the following methods e Reorient or relocate the receiving antenna e Increase the separation between the equipment and the receiver e Connect the equipment into an electrical outlet on a circuit different from that which the radio receiver is connected Consult the dealer or an experienced radio TV technician for help ProSafe GS716T and 724T Gigabit Smart Switches Tested to Comply with FCC Standards FOR HOME OR OFFICE USE PY306100037 Modifications made to
286. rface Configuration page to configure IGMP snooping settings on specific interfaces To access the IGMP Snooping Interface Configuration page click Switching gt Multicast gt IGMP Snooping gt IGMP Snooping Interface Configuration 112 Chapter 3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR GS724T 24 Port Gigab amp Smart Switch System Switching QoS ecurity Monitoring Maintenance Help socour Auto Video IGMP Snooping Interface Configuration IGMP Snooping IGMP Seceeing IGMP Snooping Interface Configuration Configuration PORTS An GO TO INTERFACE IGMP Snooping Interface Max Configuration Interface Response IGMP Snooping Time Table T T r t qm MFD8 Table MfO6 Ratishcs MRouter Timeout GMP coping VLAN Comfiguraton IGMP Snooping Querier To configure IGMP Snooping interface settings 1 To configure IGMP Snooping settings for a physical port click PORTS 2 To configure IGMP Snooping settings for a Link Aggregation Group LAG click LAGS 3 To configure IGMP Snooping settings for both physical ports and LAGs click ALL 4 Select the check box next to the port or LAG to configure You can select multiple ports and LAGs to apply the same setting to the selected interfaces Select the check box in the heading row to apply the same settings to all interfaces 5 Configure the IGMP Snooping values for the selected port s or LAG s
287. ries in the Multicast Forwarding Database table Click Refresh to update the information on the screen with the most current data IGMP Snooping VLAN Configuration Use the IGMP Snooping VLAN Configuration page to configure IGMP snooping settings for VLANs on the system To access the IGMP Snooping VLAN Configuration page click Switching gt Multicast gt IGMP Snooping gt IGMP Snooping VLAN Configuration Chapter 3 Configuring Switching Information 117 GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR GS724T 24 Port Gigabt Smart Switch ocou IGMP Snooping VLAN Configuration IGMP Snooping VLAN Configuration Fast leave Maximum MRouter Query Vien ID Host Timeout wery Interval Admin Response Time Timeout Mode Query Mode 3L Tt tf f 31H MFD8 Table MFOB Statistics IGMP Snooping VLAN Configuration gt IGMP Snooping Querier To configure IGMP snooping settings for VLANs 1 To enable IGMP snooping on a VLAN enter the VLAN ID in the appropriate field and configure the IGMP Snooping values e Fast Leave Admin Mode Enable or disable the IGMP Snooping Fast Leave Mode for the specified VLAN ID Enabling fast leave allows the switch to immediately remove the layer 2 LAN interface from its forwarding table entry upon receiving an IGMP leave message for that multicast group without first sending out MAC based general queries to the interface You should enable fast leave adm
288. riority Mapping table To display the 801 p to Queue Mapping page click QoS gt CoS gt Advanced gt 802 1p to Queue Mapping NETGEAR EE GS724T nari wii 4 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help tocour Basic 802 1p to Queue Mapping v Advanced CoS 802 1p Queue Configuration Configurabon Global Interface g1 CoS Interface Configuartion Interface Queue 802 1p to Queue Mapping a Configuration mm B02 1p to Queue Priority 9 i 2 3 a 5 6 7 Mapping T T T T occ woe ee EE no ao lt Mapping To map 802 1p priorities to queues 1 Select the Global radio button to apply the same 802 1p priority mapping to all CoS configurable interfaces or select the Interface radio button to apply 802 1p priority mapping to on a per interface basis 132 Chapter 4 Configuring Quality of Service GS716Tv2 and GS724Tv3 Software Administration Manual 4 If you map 802 1p priorities to individual interfaces select the Interface radio button and then select the interface from the drop down menu The interface settings override the global settings for 802 1p priority mapping Select the queue to map to the predefined 802 1p priority values The 802 1p Priority row contains traffic class selectors for each of the eight 802 1p priorities to be mapped The priority goes from low 0 to high 3 For example traffic with a priority of 0 is for most data traffic and is sent
289. ro corresponds to an infinite timeout The default value is 24 hours The currently configured value is shown when the Web page is displayed 4 n the Maximum Number of HTTP Sessions field specify the maximum number of HTTP sessions that can exist at the same time The value must be in the range of 0 16 The default value is 16 The currently configured value is shown when the Web page is displayed 5 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 6 If you make changes to the page click Apply to apply the changes to the system Secure HTTP Configuration Secure HTTP enables the transmission of HTTP over an encrypted Secure Sockets Layer SSL or Transport Layer Security TLS connection When you manage the switch by using a Web interface secure HTTP can help ensure that communication between the management system and the switch is protected from eavesdroppers and man in the middle attacks Use the Secure HTTP Configuration page to configure the settings for HTTPS communication between the management station and the switch To display the Secure HTTP Configuration page click Security Access and then click the HTTPS gt HTTPS Configuration link NETGEAR GS724T 24 Port Gigabit Smart Switch Security ng Maintenance Help toGovr Management Security Port Authentication Traffic Control ACL gt HTTP HTTPS Configuration v HTTPS HTTPS HTTPS
290. rom the default value enter 192 168 0 239 into the address field Clicking Web Browser Access on the Smart Control Center or accessing the switch directly from your Web browser displays the login screen shown in the following figure NETGEAR WR GS724T oct w 4 Port Gigabit Smart Switch 18 Chapter 1 Getting Started GS716Tv2 and GS724Tv3 Software Administration Manual Smart Control Center Utilities In addition to device discovery and network address assignment the Smart Control Center includes several maintenance features This section describes the following Smart Control Center utilities e Network Utilities on page 19 e Configuration Upload and Download on page 19 e Firmware Upgrade on page 21 Network Utilities From the Network tab you can perform the following functions e DHCP Refresh Forces the switch to release the current bindings and request new address information from the DHCP server Reboot Device Reboots the selected device e Web Browser Access Launches a Web browser and connects to the management interface for the selected device e Configure Device Allows you to change network information for the switch such as the IP address and DHCP client mode e Change Password Allows you to set a new password for the device In this process you are required to enter the old password and to confirm the new one which can contain up to 20 ASCII characters From the Maintenance tab you can upload
291. rts and LAGs to apply the same setting to the selected interfaces Select the check box in the heading row to apply a trust mode or rate to all interfaces 5 Configure any of the following settings Chapter 4 Configuring Quality of Service 131 GS716Tv2 and GS724Tv3 Software Administration Manual e Queue ID Use the menu to select the queue to be configured Minimum Bandwidth Enter a percentage of the maximum negotiated bandwidth for the selected queue on the interface Specify a percentage from 0 100 in increments of 1 Scheduler Type Selects the type of queue processing from the drop down menu Options are Weighted and Strict Defining on a per queue basis allows the user to create the desired service characteristics for different types of traffic e Weighted Weighted round robin associates a weight to each queue This is the default e Strict Services traffic with the highest priority on a queue first e Queue Management Type Displays the type of packet management used for all packets which is Taildrop All packets on a queue are safe until congestion occurs At this point any additional packets queued are dropped 6 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 7 f you make changes to the page click Apply to apply the changes to the system 802 1p to Queue Mapping The 802 1p to Queue Mapping page also displays the Current 802 1p P
292. s Vian 10 MAC Address Interface Address Table 4 d TNT degener gm Lot v Address To configure a static MAC address 1 To add a static MAC address entry a Select the VLAN ID corresponding to the MAC address to add b Specify the MAC address to add c Specify the interface associated with the MAC address d Click Add 2 To delete a static MAC address select the check box next to the entry and click Delete 3 To modify the settings for a static MAC address select the check box next to the entry update the desired values and click Apply 4 Click Refresh to reload the page and display the latest MAC address learned on a specific port 5 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch Chapter 3 Configuring Switching Information 125 GS716Tv2 and GS724Tv3 Software Administration Manual 126 Chapter3 Configuring Switching Information Configuring Quality of Service Use the features in the QoS tab to configure Quality of Service QoS settings on the switch The QoS tab contains links to the following features e Class of Service on page 128 e Differentiated Services on page 135 In a typical switch each physical port consists of one or more queues for transmitting packets on the attached network Multiple queues per port are often provided to give preference to certain packets over others based on user defined criteria W
293. sabled 80 00 00 00 00 01 18 O 80 00 00 00 00 01 15 O False False 922 Disabled 80 00 00 00 00 01 15 O 80 00 00 00 00 01 1 amp O False False 23 Disabled 80 00 00 00 00 01 1 0 00 00 00 00 01 19 false false 924 Disabled 80 00 00 00100 01 135 O 80100 00 00 00 01 138 O False False PORTS LAGS al GS724T 24 Port Gigabit Smart Switch Point Port to Point CST Regional Root Forwarding MAC State False 80 00 090 00 00 01 1 0 Ousadled false 80 00 00 00 00 01 15 0 Ouabdled False 80 00 100 00 00 01 138 0 Disabled false 80 00 00 00 00 01 2S fF 0 Ouadled false 80 00 00 00 00 01 25 ff 0 Disabled False 80100 00 00 00 01 18 O D sabled False 90 00 00 00 00 01 1 8 0 Disabled False 80 00 00 00 00 01 15 0 D sabled v gt REPRE SH The following table describes the CST Status information displayed on the screen 100 Chapter 3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual Designated Root Field Description Interface Select a physical or port channel interface to configure The port is associated with the VLAN s associated with the CST Port Role Each MST Bridge Port that is enabled is assigned a Port Role for each spanning tree The port role will be one of the following values Root Port Designated Port Alternate Port Backup Port Master Port or Disabled Port Root Bridge for the CST It is made up using the bridge priorit
294. sed by the switch or the router The forwarding or dropping of a packet is based on whether or not the packet matches the specified criteria Traffic filtering requires the following two basic steps 1 Create an access list definition The access list definition includes rules that specify whether traffic matching the criteria is forwarded normally or discarded Additionally you can assign traffic that matches the criteria to a particular queue or redirect the traffic to a particular port A default deny all rule is the last rule of every list 2 Apply the access list to an interface in the inbound direction The GS716T and GS724T Smart Switches allow ACLs to be bound to physical ports and LAGs The switch software supports MAC ACLs and IP ACLs MAC ACL Example Configuration The following example shows how to create a MAC based ACL that permits Ethernet traffic from the Sales department on specified ports and denies all other traffic on those ports 1 From the MAC ACL screen create an ACL with the name Sales ACL for the Sales department of your network See MAC ACL on page 184 By default this ACL will be bound on the inbound direction which means the switch will examine traffic as it enters the port 2 From the MAC Rules screen create a rule for the Sales ACL with the following settings e D 1 e Action Permit e Assign Queue 0 e Match Every False e CoS 0 e Destination MAC 01 02 1A BC DE EF 252 Appendix B Configu
295. ss in the 192 168 0 0 network such as 192 168 0 200 The IP address must be different from that of the switch but within the same subnet 3 Click OK To configure a static address on the switch 1 Use a straight through cable to connect the Ethernet port on the administrative system directly to any port on the GS716T and GS724T 2 Open a Web browser on your PC and connect to the management interface as described in Web Access on page 18 3 Change the network settings on the switch to match those of your network this procedure is described in P Configuration on page 33 After you change the network settings on the switch return the network configuration on your administrative system to the original settings Chapter 1 Getting Started 17 GS716Tv2 and GS724Tv3 Software Administration Manual Web Access To access the GS716T or GS724T management interface use one of the following methods e From the Smart Control Center select the switch and click Web Browser Access e Open a Web browser and enter the IP address of the switch in the address field You must be able to ping the IP address of the GS716T or GS724T management interface from your administrative system for Web access to be available If you used the Smart Control Center to set up the IP address and subnet mask either with or without a DHCP server use that IP address in the address field of your Web browser If you did not change the IP address of the switch f
296. t Port ID Disable Oisable Disabled Disable Disable Disabled Ovsable Owable Disabled Disable Disable Disabled Osabie Ouable Disabled Disable Disable Disabled M MM OM Disabile Ossable Manual forwarding Ovwsable Disable Disabled Ossable Osable Disabled Owabdle Disable Disabled Ovwsable Ouwable C sable Disable Disabled M NNN NH HN OMM OM Ovsadle sable Osabled Ovsable COsable Disabled Ovsable Ousable Osabled Owsadle sable Disabled Osable Osable Cable COssable Disabled Cable Ousable Disabled Disable Osable Disabled Cable Disabled Cable Ousable Disabled GoGo CG o C o C o C o G o G no n no nn no nnno se Sob obb ob ob oo on oo oon oo onoo o M MN NM MOMS OM EI o Li o o D a De LI o LI D LI D LI D LI D LI LI LJ D LI POI GO TO INTERFACE o o REFRESH To configure CST port settings 1 To configure CST settings for a physical port click PORTS To configure CST settings for a Link Aggregation Group LAG click LAGS To configure CST settings for both physical ports and LAGs click ALL mom Select the check box next to the port or LAG to configure You can select multiple ports and LAGs to apply the same setting to the selected interfaces Select the check box in the heading row to apply the same settings to all interfaces 5 Configure the CST values for the selected port s or LAG s e STP Status Enable or disable the Spanning Tree Protocol Administrative Mo
297. t When this button is pressed the action is immediate It is not required to click Apply for the action to occur 6 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch Port Summary Use the Port Summary page to view information about the port access control settings on a specific port To access the Port Summary page click Security gt Port Authentication gt Advanced gt Port Summary GS724T NETGEAR reo reat System Switching QoS Security Monitoring Maintenance Help 16o0u Management Security Access gt Basic Port Summary v Advanced 802 1X Port Summary Configuration Port Authentication Control Operatin ad aks Reauthentication Port Port Control Port Summary Mode Mode Enabled Status gi auto auto false A thonzed g2 false Authorized false Authorized g4 faise Authorized false Authorized false false Chapter 5 Managing Device Security 173 GS716Tv2 and GS724Tv3 Software Administration Manual The following table describes the fields on the Port Summary page Field Description Port The port whose settings are displayed in the current table row Control Mode Defines the port authorization state The control mode is only set if the link status of the port is link up The possible field values are e Auto Automatically detects the mode of the interface Force Authorized Places the interface into
298. t determine traffic classifications Use the IP ACL Configuration page to add or remove IP based ACLs To display the IP ACL page click Security ACL then click the Advanced IP ACL link NETGEAR serene sxocour Security Monitoring Maintenance Help Maeogemen Security Access Port Authentication Trattic Control gt ACL Wizard IP ACL gt Basic Advanced IP ACL IPACL Current Number of ACL IP Rules IP Extended Rules IP Binding IP ACL Table Configuration Binding Table Maximem ACL 190 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual The IP ACL area shows the current size of the ACL table versus the maximum size of the ACL table The current size is equal to the number of configured IPv4 plus the number of configured MAC ACLs The maximum size is 100 To configure an IP ACL 1 In the IP ACL ID field specify the ACL ID The ID is an integer in the following range e 1 99 Creates an IP Standard ACL which allows you to permit or deny traffic from a source IP address e 100 199 Creates an IP Extended ACL which allows you to permit or deny specific types of layer 3 or layer 4 traffic from a source IP address to a destination IP address This type of ACL provides more granularity and filtering capabilities than the standard IP ACL Each configured ACL displays the following information e Rules Displays the number of rules currently config
299. t logging e Disable Prevents the system from logging messages in persistent storage 2 From the Severity Filter field specify the type of log messages to record A log records messages equal to or above a configured severity threshold For example if you select Error the logged messages include Error Critical Alert and Emergency The default severity level is Alert 1 The severity can be one of the following levels e Emergency 0 The highest level warning level If the device is down or not functioning properly an emergency log is saved to the device e Alert 1 The second highest warning level An alert log is saved if there is a serious device malfunction such as all device features being down Action must be taken immediately 216 Chapter6 Monitoring the System GS716Tv2 and GS724Tv3 Software Administration Manual e Critical 2 The third highest warning level A critical log is saved if a critical device malfunction occurs for example two device ports are not functioning while the rest of the device ports remain functional e Error 3 A device error has occurred such as if a port is offline e Warning 4 The lowest level of a device warning e Notice 5 Normal but significant conditions Provides the network administrators with device information e Info 6 Provides device information e Debug 7 Provides detailed information about the log Debugging should only be entered by qualified support
300. ta conversion from the Ethernet interface collision detection and bit injection into the network MED Details Capabilities Supported Current Capabilities Specifies the supported capabilities that were received in MED TLV from the device Specifies the advertised capabilities that were received in MED TLV from the device Device Class Displays the LLDP MED endpoint device class The possible device classes are e Endpoint Class 1 Indicates a generic endpoint class offering basic LLDP services e Endpoint Class 2 Indicates a media endpoint class offering media streaming capabilities as well as all Class 1 features e Endpoint Class 3 Indicates a communications device class offering all Class 1 and Class 2 features plus location 911 Layer 2 switch support and device information management capabilities PoE Device Type Displays the port PoE type For example Powered PoE Power Source Displays the port s power source PoE Power Priority Displays the port s power priority PoE Power Value Displays the port s power value Hardware Revision Displays the hardware version advertised by the remote device Firmware Revision Displays the firmware version advertised by the remote device Software Revision Displays the software version advertised by the remote device Serial Number Displays the serial number advertised by the remote device Model Name Dis
301. ted 13 GS716Tv2 and GS724Tv3 Software Administration Manual NE TGEAR GS724T 24 Port Gigabit Smart Switch login Help Use your Web browser to manage your switch The default password is password Then use this page to proceed to management of the switch covered in Using the Web Interface on page 24 14 Chapter 1 Getting Started GS716Tv2 and GS724Tv3 Software Administration Manual Switch Discovery in a Network without a DHCP Server This section describes how to use the Smart Control Center to set up your switch in a network without a DHCP server If your network has no DHCP service you must assign a static IP address to your switch If you choose you can assign it a static IP address even if your network has DHCP service To assign a static IP address 1 Connect the switch to your existing network Power on the switch by plugging in the AC DC power adapter Install the Smart Control Center on your computer Start the Smart Control Center Click Discover for the Smart Control Center to find your GS716T and GS724T switch The utility broadcasts Layer 2 discovery packets within the broadcast domain to discover the switch You should see a screen similar to Figure on page 13 ao RON 6 Select the switch then click Configure Device The page expands to display additional fields at the bottom of the page as the following figure shows T3 c E SmortControlCenter NETGEAR Network Maintenance QUIT De
302. the amount of bandwidth used by the queue the queue depth during times of congestion and the scheduling of packet transmission from the set of all queues on a port Each port has its own CoS queue related configuration The configuration process is simplified by allowing each CoS queue parameter to be configured globally or per port A global configuration change is automatically applied to all ports in the system To display the Interface Queue Configuration page click the QoS CoS tab and then click the Advanced gt Interface Queue Configuration link NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help to00vr v Advanced CoS CoS Interface Configuration Configuration PORTS LACS An GO TO INTERFACE CoS Interface Interface Trust Interface Shaping Rate 16 Configuartion Interface Mode to 16384 T T Interface Queue Configuration 802 1p to Queue Mapping DSCP to Queue Mapping gt Basic CoS Interface Configuration togo gao go o o POKTS Lacs GO TO INTERFACE To configure CoS queue settings for an interface 1 To configure CoS queue settings for a physical port click PORTS 2 To configure CoS queue settings for a Link Aggregation Group LAG click LAGS 3 To configure CoS queue settings for both physical ports and LAGs click ALL 4 Select the check box next to the port or LAG to configure You can select multiple po
303. the last querier information is removed The Querier Expiry Interval must be a value in the range of 60 300 seconds The default value is 60 6 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 7 Click Apply to apply the new settings to the switch Configuration changes take effect immediately 8 Click Refresh to update the page with the latest information from the switch IGMP Snooping Querier VLAN Configuration Use this page to configure IGMP queriers for use with VLANs on the network To access this page click Switching gt Multicast gt IGMP Snooping Querier gt Querier VLAN Configuration NETGEAR GS724T 24 Port Gigabit Smart Switch Switching Jo rity Monitoring Mointenonce Hel Logout Auto Video Quener VLAN Configuration gt IGMP Snooping IGMP Snooping Querier VLAN Configuration Querier Quener VLAN 1D VLAN 10 Configuration Querier VLAN Querier Election Participate Mode Configuration Seoopeng Querer VLAN Address Quener VLAN Satus To configure Querier VLAN settings 1 To create a new VLAN ID for IGMP Snooping select New Entry from the VLAN ID field and complete the following fields e VLAN ID Specifies the VLAN ID for which the IGMP Snooping Querier is to be enabled e Querier Election Participate Mode Enable or disable Querier Participate Mode 120 Chapter3 Configuring Switching Information
304. the port is not a member of the VLAN e Tagged Frames transmitted from this port are tagged with the port VLAN ID e Untagged Frames transmitted from this port are untagged Each port can be an untagged member of only one VLAN By default all ports are an untagged member of VLAN 1 In the following figure ports e6 e7 and e8 are being added as tagged members to VLAN 2 VLAN Membership aq VLAN ID Untag Tag All IAGGLO PORI MEMBERS Remove All 5 Use the Group Operations field to select all the ports and configure them Possible values are e Untag All Select all the ports on which all frames transmitted from this VLAN will be untagged All the ports will be included in the VLAN 82 Chapter3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual Tag All Select the ports on which all frames transmitted for this VLAN will be tagged All the ports will be included in the VLAN e Remove All This selection has the effect of excluding all ports from the selected VLAN 6 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 7 If you make any changes to this page click Apply to send the updated configuration to the switch Configuration changes take place immediately Port VLAN ID Configuration The Port PVID Configuration screen lets you assign a port VLAN ID PVID to an interface There are certain requir
305. the switch Chapter 2 Configuring System Information 67 GS716Tv2 and GS724Tv3 Software Administration Manual 68 Chapter2 Configuring System Information Configuring Switching Information Use the features in the Switching tab to define Layer 2 features The Switching tab contains links to the following features e Ports on page 70 e Link Aggregation Groups on page 74 e VLANs on page 80 e Voice VLAN on page 86 e Auto VolP on page 90 e Spanning Tree Protocol on page 93 e Multicast on page 109 e Forwarding Database on page 122 Chapter 3 Configuring Switching Information 69 GS716Tv2 and GS724Tv3 Software Administration Manual Ports The pages on the Ports tab allow you to view and monitor the physical port information for the ports available on the switch From the Ports link you can access the following pages e Port Configuration on page 70 e Flow Control on page 73 Port Configuration Use the Port Configuration page to configure the physical interfaces on the switch To access the Port Configuration page click Switching gt Ports gt Port Configuration 70 Chapter3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR Switching Security Monitoring Maintenance Help LAG VLAN Voice VLAN Auto VolP STP Multicast Address Toble v Port Configuration porrs Flow Control Admin Mode I Enable wv Bi Aut
306. tically tagged with the port s default VLAN ID tag number Each port has a default VLAN ID setting that is user configurable the default setting is 1 The default VLAN ID setting for each port can be changed in the Port PVID Configuration screen See Port VLAN ID Configuration on page 83 e When a tagged packet enters a port the tag for that packet is unaffected by the default VLAN ID setting The packet proceeds to the VLAN specified by its VLAN ID tag number e Ifthe port through which the packet entered does not have membership with the VLAN specified by the VLAN ID tag the packet is dropped e If the portis a member of the VLAN specified by the packet s VLAN ID the packet can be sent to other ports with the same VLAN ID 250 Appendix B Configuration Examples GS716Tv2 and GS724Tv3 Software Administration Manual Packets leaving the switch are either tagged or untagged depending on the setting for that ports VLAN membership properties A U for a given port means that packets leaving the switch from that port are untagged Inversely a T for a given port means that packets leaving the switch from that port are tagged with the VLAN ID that is associated with the port The example given in this section comprises numerous steps to illustrate a wide range of configurations to help provide an understanding of tagged VLANs VLAN Example Configuration This example demonstrates several scenarios of VLAN use and describes how the switch
307. ties Properties 3 Advanced Properties Voice VLAN Status S Disable Enable 1 6 Voice VLAN ID Class Of Service Remark CoS Disable Enable Voice VLAN Aging Time 1 Day O Mour O Min i Min 30 Days To configure Voice VLAN 1 From the Voice VLAN Status field enable or disable Voice VLAN on the switch If the Switch does not handle traffic from IP phones the status should be disabled 2 From the Voice VLAN ID field select the VLAN to use for voice traffic on the switch The VLAN must already exist on the switch For information about how to create VLANs see VLAN Configuration on page 80 3 From the Class of Service field set the CoS tag value to be reassigned for packets received on the Voice VLAN when Remark CoS is enabled 4 From the Remark CoS field select Enable or Disable to reassign the CoS tag value to packets received on the Voice VLAN 86 Chapter3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual 5 From the Voice VLAN Aging Time field specify the amount of time after the last IP phone s OUI is aged out for a specific port The port will age out after the bridge and voice aging time 6 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 7 f you make any changes to this page click Apply to send the updated configuration to the Switch Voice VLAN Port Setting To display the Voice VLA
308. ting access to that port in cases in which the authentication and authorization process fails In this context a port is a single point of attachment to the LAN such as ports of MAC bridges and associations between stations or access points in IEEE 802 11 Wireless LANs The IEEE 802 11 standard describes an architectural framework within which authentication and consequent actions take place It also establishes the requirements for a protocol between the authenticator the system that passes an authentication request to the authentication server and the supplicant the system that requests authentication as well as between the authenticator and the authentication server The switch switch supports a guest VLAN which allows unauthenticated users to have limited access to the network resources Note You can use QoS features to provide rate limiting on the guest VLAN to limit the network resources the guest VLAN provides Another 802 1X feature is the ability to configure a port to Enable Disable EAPoL packet forwarding support You can disable or enable the forwarding of EAPoL when 802 1X is disabled on the device The ports of an 802 1X authenticator switch provide the means in which it can offer services to other systems reachable via the LAN Port based network access control allows the operation of a switch s ports to be controlled in order to ensure that access to its services is only permitted by systems that are authorized to do so
309. tion on the screen and reset the data on the screen to the latest value of the switch Time switch software supports the Simple Network Time Protocol SNTP You can also set the system time manually SNTP assures accurate network device clock time synchronization up to the millisecond Time synchronization is performed by a network SNTP server switch software operates only as an SNTP client and cannot provide time services to other systems Time sources are established by Stratums Stratums define the accuracy of the reference clock The higher the stratum where zero is the highest the more accurate the clock The device receives time from stratum 1 and above since it is itself a stratum 2 device The following is an example of stratums e Stratum 0 A real time clock is used as the time source for example a GPS system e Stratum 1 A server that is directly linked to a Stratum O time source is used Stratum 1 time servers provide primary network time standards e Stratum 2 The time source is distanced from the Stratum 1 server over a network path For example a Stratum 2 server receives the time over a network link via NTP from a Stratum 1 server Information received from SNTP servers is evaluated based on the time level and server type Chapter 2 Configuring System Information 35 GS716Tv2 and GS724Tv3 Software Administration Manual SNTP time definitions are assessed and determined by the following time levels
310. tive Status 4 2 1 8 5 0 2 5 image imagez Imagel Description Image Description default image REAE Sn The following table describes the information on the Dual Image Status page Field Description Unit The unit ID of the switch is always 1 Image1 Ver Displays the version of the image1 code file Image2 Ver Displays the version of the image2 code file Chapter 7 Maintenance 235 GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Current active Displays the currently active image on this switch Next active Displays the image to be used on the next restart of this switch Image1 Description Displays the description associated with the image1 code file Image2 Description Displays the description associated with the image2 code file Click Refresh to display the latest information from the switch For information about how to update or change the system images see File Management on page 234 236 Chapter7 Maintenance GS716Tv2 and GS724Tv3 Software Administration Manual Troubleshooting The Troubleshooting menu contains links to the following options e Ping on page 237 e Traceroute on page 238 Ping Use the Ping page to tell the switch to send a Ping request to a specified IP address You can use this feature to check whether the switch can communicate with a particular network host To access the Ping page click Maintenance
311. to VoIP checks for packets carrying the following VoIP protocols e Session Initiation Protocol SIP e H 323 e Signalling Connection Control Part SCCP e Media Gateway Control Protocol MGCP VoIP frames that are received on ports that have the Auto VoIP feature enabled are marked with CoS traffic class 3 To display the Auto VoIP page click Switching gt Auto VoIP 90 Chapter 3 Configuring Switching Information GS716Tv2 and GS724Tv3 Software Administration Manual NE TG E A R GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help wocour Ports LAG VLAN Voice VIAN 5 Multicost Addeoss Table Auto VoIP Configuration Auto VoIP Configuration GO TO INTERFACE eo a gi Enable g2 Enable 93 Enable Cad Enable 5 Enable 6 Enable 97 98 Enable 99 Enable Enable Enable Enable Enable Enable Enable Enable Enable Enable Enable Enable Enable Enable Enable o o o a D a o a o a a o a o o o o a ju B o w w Ww w Ww wu W uo WW uw Ww ww Ww uv W wu W w WW w Ww wu Ww w Enable GO TO INTERFACE To configure Auto VoIP settings 1 Select the check box next to the port to configure You can select multiple check boxes to apply the same setting to all selected ports 2 From the Auto VoIP Mode menu specify whether to enable or disable Auto VoIP on the selected port 3 Click Cancel to cancel the configuration on the screen
312. toring the System 203 GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Broadcast Packets Received The total number of good packets received that were directed to the broadcast address This does not include multicast packets Packets Transmitted Without The number of frames that have been transmitted by this port to its segment Errors Transmit Packet Errors The number of outbound packets that could not be transmitted because of errors Collision Frames The best estimate of the total number of collisions on this Ethernet segment Time Since Counters Last The elapsed time in days hours minutes and seconds since the statistics Cleared for this port were last cleared Use the buttons at the bottom of the page to perform the following actions e To clear all the counters for all ports on the switch select the check box in the row heading and click Clear The button resets all statistics for all ports to default values e To clear the counters for a specific port select the check box associated with the port and click Clear e Click Refresh to refresh the data on the screen and display the most current statistics 204 Chapter6 Monitoring the System GS716Tv2 and GS724Tv3 Software Administration Manual Port Detailed Statistics The Port Detailed Statistics page displays a variety of per port traffic statistics To access the Port Detailed page click the Monitoring
313. u can change this field only when the Create Filter option is selected from the MAC Filter menu c In the MAC Address field specify the MAC address of the filter in the format 00 01 1A B2 53 4D You can change this field when you have selected the Create Filter option You cannot define filters for the following MAC addresses e 00 00 00 00 00 00 e 01 80 C2 00 00 00 to 01 80 C2 00 00 0F e 01 80 C2 00 00 20 to 01 80 C2 00 00 21 e FF FF FF FF FF FF d Click the orange bar under the Source Port Members heading to display the available ports Select the port s to include in the inbound filter If a packet with the MAC address and VLAN ID you specify is received on a port that is not in the list it will be dropped Chapter 5 Managing Device Security 175 GS716Tv2 and GS724Tv3 Software Administration Manual e Click the orange bar under the Destination Port Members heading to display the available ports Select the port s to include in the outbound filter Packets with the MAC address and VLAN ID you selected will be transmitted only out of ports that are in the list Destination ports can be included only in the Multicast filter 2 To delete a configured MAC Filter select it from the menu and then click Delete 3 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch 4 f you make changes to the page click Apply to apply the changes to the system MAC
314. ue second inner VLAN tag e Secondary VLAN ID range second inner VLAN tag Appendix B ConfigurationExamples 255 GS716Tv2 and GS724Tv3 Software Administration Manual e IP Service Type octet also known as ToS bits Precedence value DSCP value e Layer 4 protocol TCP UDP etc e Layer 4 source destination ports e Source destination IP address From a DiffServ point of view there are two types of classes e DiffServ traffic classes e DiffServ service levels forwarding classes DiffServ Traffic Classes With DiffServ you define which traffic classes to track on an ingress interface You can define simple BA classifiers DSCP and a wide variety of multi field MF classifiers e Layer 2 Layers 3 4 IP only e Protocol based e Address based You can combine these classifiers with logical AND or OR operations to build complex MF classifiers by specifying a class type of all or any respectively That is within a single class multiple match criteria are grouped together as an AND expression or a sequential OR expression depending on the defined class type Only classes of the same type can be nested class nesting does not allow for the negation i e exclude option of the referenced class To configure DiffServ you must define service levels namely the forwarding classes PHBs identified by a given DSCP value on the egress interface These service levels are defined by configuring BA classes for each Creati
315. uerier Version Quener VLAN Address Version Configuration Quener VLAN Status RLIRESH The following table describes the information available on the Querier VLAN Status page Chapter 3 Configuring Switching Information 121 GS716Tv2 and GS724Tv3 Software Administration Manual Field Description VLAN ID Specifies the VLAN ID on which the IGMP Snooping Querier is administratively enabled and for which VLAN exists in the VLAN database Operational State Specifies the operational state of the IGMP Snooping Querier on a VLAN e Querier The snooping switch is the querier in the VLAN The snooping Switch will send out periodic queries with a time interval equal to the configured querier query interval If the snooping switch sees a better querier numerically lower in the VLAN it moves to non querier mode e Non Querier The snooping switch is in non querier mode in the VLAN If the querier expiry interval timer expires the snooping switch moves into querier mode e Disabled The snooping querier is not operational on the VLAN The snooping querier moves to disabled mode when IGMP snooping is not operational on the VLAN when the querier address is not configured or the network management address is not configured Operational Version Displays the IGMP protocol version of the operational querier Last Querier Address Displays the IP address of the last querier from which a query was snooped on the
316. upported Default IGMP snooping v1 v2 All ports Disabled Configurations upload download 1 N A EAPoL flooding All ports Disabled BPDU flooding All ports Disabled Static multicast groups 8 Disabled Filter multicast control 1 Disabled 248 Appendix A Hardware Specifications and Default Values Configuration Examples This chapter contains information about how to configure the following features Virtual Local Area Networks VLANs on page 250 Access Control Lists ACLs on page 252 Differentiated Services DiffServ on page 255 802 1X on page 260 MSTP on page 263 Appendix B Configuration Examples 249 GS716Tv2 and GS724Tv3 Software Administration Manual Virtual Local Area Networks VLANs A local area network LAN can generally be defined as a broadcast domain Hubs bridges or switches in the same physical segment or segments connect all end node devices End nodes can communicate with each other without the need for a router Routers connect LANs together routing the traffic to the appropriate port A virtual LAN VLAN is a local area network with a definition that maps workstations on some basis other than geographic location for example by department type of user or primary application To enable traffic to flow between VLANS traffic must go through a router just as if the VLANs were on two separate LANs A VLAN is a group of PCs servers and other network resources that behave as if they were
317. ured for the IP ACL e Type Identifies the ACL as either a standard or extended IP ACL To delete an IP ACL select the check box next to the IP ACL ID field then click Delete To change the name of an IP ACL select the check box next to the IP ACL ID field update the name then click Apply Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch IP Rules Use the IP Rules page to define rules for IP based standard ACLs The access list definition includes rules that specify whether traffic matching the criteria is forwarded normally or discarded Note There is an implicit deny all rule at the end of an ACL list This means that if an ACL is applied to a packet and if none of the explicit rules match then the final implicit deny all rule applies and the packet is dropped To display the IP Rules page click Security gt ACL then click the Advanced gt IP Rules link Chapter 5 Managing Device Security 191 GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help tosour Management Security cass Port Authentication Traffic Control gt ACL Wizard IP Rules gt Basic v Advanced IP Rules IP ACL ACL 1D None v IP Rules IP Extended Rules Basic ACL Rule Table Binding Table IP Binding Rule ru Assign Match Source IP PU pese
318. ved from this server on the authentication port and dropped for some other reason Use the buttons at the bottom of the page to perform the following actions e Click Clear Counters to clear the authentication server and RADIUS statistics to their default values e Click Refresh to refresh the page with the most current data from the switch Accounting Server Configuration Use the RADIUS Accounting Server Configuration page to view and configure various settings for one or more RADIUS accounting servers on the network To access the RADIUS Accounting Server Configuration page click Security gt Management Security gt RADIUS gt Accounting Server Configuration 154 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual NETGEAR GS724T 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help 10001 J Port Authentication Trafte Control ACL gt User Configuration Accounting Server Configuration RADIUS Global Accounting Server Configuration Configuration Accounting Server Server Address Configuration Port Accounting Server Configuration gt TACACS gt Authentication List counting Mode Owsadle 0 0 0 0 18 Secret Configured No Secret Accounting Server Statistics Accounting Server Address Round Trip Time secs Accounting Requests Accounting Retransmissions Accounting Responses Malformed Accounteng Responses Bad Authenti
319. vice List Product MAC Address IP Address Subnet Mask Gateway Fem Ww C 103Tv2 009 244b2 5c i44 49 10 131 12 166 255 255 255 0 19 131 12 1 LEMERE 5724Tv3 00 00 00 01 15 ff 10 131 12 162 255 255 255 0 106 191 12 1 5 0 2 5 FS72t9TP 90 92 48121 02162 10 131 12 168 255 255 255 0 10 131 12 1 N A F57281Pv2 30 46 a H fb iff 10 131 12 178 255 255 255 0 10 131 12 11 N A once 10 131 12 162 Subnet Mask 255 255 255 0 MAC 00 00 00 01 15 ff _ Enabled 109 131 12 1 System Name Disabled Current Password Cancel T Choose the Disabled radio button to disable DHCP 8 Enter the static switch IP address gateway IP address and subnet mask for the switch and then type your password Tip You must enter the current password every time you use the Smart Control Center to update the switch setting The default password is password Chapter 1 Getting Started 15 GS716Tv2 and GS724Tv3 Software Administration Manual 9 Click Apply to configure the switch with the network settings Please ensure that your PC and the switch are in the same subnet Make a note of these settings for later use Configuring the Network Settings on the Administrative System If you choose not to use the Smart Control Center to configure the network information on the switch you can connect directly to the switch from an administrative system such as a PC or laptop computer The IP address of the administrative system must be in the same subnet as the d
320. w on the screen Passwords are 1 20 alphanumeric characters in length and are case sensitive 3 To confirm the password enter it again to make sure you entered it correctly This field will not display but will show asterisks 4 Use the Reset Password field to reset the password to the default value 5 Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch e If you make changes to the page click Apply to apply the changes to the system 150 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual Note In the case of a lost password press the Factory Default Reset button on the front panel for more than one second to restore the factory default The reset button will only reboot the device RADIUS Configuration RADIUS servers provide additional security for networks The RADIUS server maintains a user database which contains per user authentication information The switch passes information to the configured RADIUS server which can authenticate a user name and password before authorizing use of the network RADIUS servers provide a centralized authentication method for e Web Access e Access Control Port 802 1X The RADIUS folder contains links to the following features e Global Configuration on page 151 e RADIUS Server Configuration on page 152 e Accounting Server Configuration on page 154 Global Configur
321. ware Administration Manual NETGEAR System Switching Security Monitoring Maintenance Help Manogenert Security Traffic Control gt Basic Port Authentication v Advanced 802 1X Port Authentication Configuration Authechcabon e porti Periodic Reauthentication Quiet Resending Max EAP ort Contro Port Summary Reauthentication Period Period EAP Requests oO g ARO o 5 Disable 3600 60 30 2 1 9 Auto o Disable 2600 6o 20 2 D 3 Ato o ka Disable 3600 ec 3c 2 g Disable n bo O os Mto o L Disable 3600 60 30 D g 7 Ato o a Dusable 3600 ec ac O os Auto o Disable 3600 60 30 D 9 9 Ato o gt Disable 3600 60 3c O e2 Auto o s Disable 3600 60 30 Q en Ato 0 E Disable 3600 60 30 GS724T 24 Port Gigabt Smart Switch GO TO INTERFACE Supplicant Server Control Protocol PAE Authenticator Backend Timeout Timeout Direction Version Capabilities PAE State State 36 320 Both 1 Authenticatoe Initialize Inmiatze Oisabie 320 20 Both 1 Authenticator Initialize 30 30 Both 1 Authenticater Initialize Inaisize Oisadie Authenticater Initialize initialize Authenticator Initialize 39 29 Both 1 Authenticator Initialize Ingialze Disable 320 20 Both 1 Authenticatce Initialize Intislze Disable x 30 Both 1 Authenticater Initialize Infia ze Oisadie 30 30 Both 1 Authenticatoe Initialize Intiahze Disable Authenticatce initialize To configure 80
322. xample the RADIUS server that performs the authentication on behalf of the authenticator and indicates whether the user is authorized to access system services From the Port Authentication link you can access the following pages e Basic e 802 1X Configuration on page 168 e Advanced e Port Authentication on page 169 e Port Summary on page 173 802 1X Configuration Use the 802 1X Configuration page to enable or disable port access control on the system To display the 802 1X Configuration page click Security gt Port Authentication gt Basic gt 802 1X Configuration NETGEAR Gs724T ll 24 Port Gigabit Smart Switch System Switching QoS Security Monitoring Maintenance Help scour J Monogement Security Accon Troftic Control ACL v Basic 802 1X Configuration 802 1X Configuration 802 1X Configuration gt Advanced Port Based Authentication State G Disable O Enable Guest Vien Oisable Enable 168 Chapter 5 Managing Device Security GS716Tv2 and GS724Tv3 Software Administration Manual To configure global 802 1X settings 1 4 Select the appropriate radio button in the Port Based Authentication State field to enable or disable 802 1X administrative mode on the switch e Enable Port based authentication is permitted on the switch Note If 802 1X is enabled authentication is performed by a RADIUS server This means the primary authentication method must be RADIUS To set the method g
323. y and the base MAC address of the bridge Designated Cost Displays cost of the port participating in the STP topology Ports with a lower cost are less likely to be blocked if STP detects loops Designated Bridge Bridge Identifier of the bridge with the Designated Port It is made up using the bridge priority and the base MAC address of the bridge Designated Port Port Identifier on the Designated Bridge that offers the lowest cost to the LAN It is made up from the port priority and the interface number of the port Topology Change Acknowledge Identifies whether the next BPDU to be transmitted for this port would have the topology change acknowledgement flag set It is either True or False Edge Port Point to point MAC Indicates whether the port is enabled as an edge port Possible values are Enabled or Disabled Derived value of the point to point status CST Regional Root Displays the bridge priority and base MAC address of the CST Regional Root CST Path Cost Displays the path Cost to the CST tree Regional Root Port Forwarding State Displays the Forwarding State of this port Click Refresh to update the information on the screen with the most current data Chapter 3 Configuring Switching Information 101 GS716Tv2 and GS724Tv3 Software Administration Manual Rapid STP Use the Rapid STP page to view information about Rapid Spanning Tree RSTP port status

Netgear GS724TS-100NAS User's Manual

Contents

Download Pdf Manuals

Related Search

Related Contents