3Com SUPERSTACK 3 3226 How to use

Part No. DNA1750-0AAA02
Published April 2004
SUPERSTACK®3 SWITCH 3226 AND SWITCH 3250
SOFTWARE VERSION 1.02 RELEASE NOTES
Related Documentation
Please use these notes in conjunction with the following
documents:
■“SuperStack 3 Switch 3226 and Switch 3250 Getting
Started Guide”
Part number: DUA1750-0AAA01
(supplied with your Switch and in PDF format on the
3Com Web site)
■“SuperStack 3 Switch 3226 and Switch 3250
Implementation Guide”
Part number: DUA1750-0BAA01
(supplied in PDF format on the CD-ROM that
accompanies your Switch and on the 3Com Web
site)
■“SuperStack 3 Switch 3226 and Switch 3250
Management Quick Reference Guide”
Part number: DQA1750-0AAA01
(supplied with your Switch and in PDF format on the
3Com Web site)
■“SuperStack 3 Switch 3226 and Switch 3250
Management Interface Reference Guide”
Part number: DHA1750-0AAA01
(supplied in HTML format on the CD-ROM that
accompanies your Switch and on the 3Com Web
site)
You can obtain the latest technical information for your
Switch, including a list of known problems and
solutions, from the 3Com Knowledgebase:
http://knowledgebase.3com.com
Software License Agreement
Before you use the Switch software, please ensure that
you read the license agreement text. You can find the
license.txt file on the CD-ROM that accompanies your
product, or in the self-extracting exe that you have
downloaded from the 3Com Web site.
About this Software Version
This software provides support for the following:
■Switch 3226 (3CR17500-91)
■Switch 3250 (3CR17501-91)
The software does not operate on any other 3Com
Switch.

2SUPERSTACK®3 SWITCH 3226 AND SWITCH 3250 SOFTWARE VERSION 1.02 RELEASE NOTES
The software is available in two versions:
■s3201_02.bin — Provides normal levels of
encryption with keys of up to 56 bits in length.
■s3201_02s.bin — Provides higher levels of
encryption including 168-bit 3DES and
256-bit AES.
The Switch ships with software providing normal
levels of encryption.
Errors and Omissions
The system console speed command is
available on the unit but has been omitted from the
“SuperStack 3 Switch 3226 and Switch 3250
Management Quick Reference Guide” and the
“SuperStack 3 Switch 3226 and Switch 3250
Management Interface Reference Guide”.
To change the speed of the console port:
1Enter system console speed from the top-level
menu of the Command Line Interface.
2Enter the speed at which you want to set the console
port or ?to see a list of available speeds.
SuperStack 3 Switch 3226 and Switch 3250 Getting
Started Guide
Pages 15 and 16 contain the following statement:
“The console port uses a standard null modem
cable and is set to auto-baud, 8 data bits, no parity
and 1 stop bit.”
This is incorrect. It should read:
“The console port uses a standard null modem
cable and is set to 19200 baud, 8 data bits, no
parity and 1 stop bit.”
If you change the speed, make a note of the new
setting. If you cannot connect using the console port
and do not know the speed at which it is set, connect
using a network port and enter the
system console speed command to check the
speed of the console port.
Enhancements and Fixes for Known Faults
The following features and enhancements are
supported in version 1.02.
Web Interface
The unit only allows printable ASCII characters, with
character codes between 32 and 127, to be used for
strings such as the unit location or VLAN name.
Characters such as those used for accented letters in
non-English languages are rejected. In previous
firmware these characters where rejected with a

Errors and Omissions 3
Data is invalid error with no explanation. The
new firmware returns an error describing the field
containing the error and then returns to the page
allowing the error to be corrected.
Command Line Interface
The output of the bridge port summary CLI
command has been improved:
■The stpState field has been replaced by Link
and Spanning Tree columns to more accurately
report the active port status.
■The fwdTransitions field has been renamed
Forward Trans.
■The LACP PartnerID field now reports
LACP disabled if the protocol is disabled or not
supported on the port.
The output of the bridge port detail CLI
command has been improved:
■The stpState field has been added. This shows if
the Spanning Tree Protocol (STP) has been enabled
on the port. The field will read Enabled if STP is
enabled on the port, even if STP is disabled globally
on the unit.
■The currently active spanning tree state for the
port is reported in the Spanning Tree column
of the VLAN table. Please note that the product
supports a single spanning tree state for all VLANs
as per the 802.1d Spanning Tree specification. It
does not support 802.1s Spanning Tree per VLAN.
■The LACP PartnerID field now reports
LACP disabled if the protocol is disabled or not
supported on the port.
Traffic Prioritization
In previous versions of the software, the DSCP
prioritization of the CS6 code point defaulted to
802.1d priority 7. This has been corrected. The CS6
code point now defaults to 802.1d priority 6.
VLANs
In previous versions of the software, removing a port
from a VLAN left static entries bound to the
port-VLAN. This has been fixed. When you remove a
port from a VLAN all static entries for that port-VLAN
will be deleted.
802.1x Network login authentication:
■In previous versions of the software, authentication
attempts for valid users would occasionally fail.
The bug causing this has been fixed.
■The user name reported in the CLI command
security network access detail was
occasionally displayed with incorrect trailing
characters. This has been fixed. The user names are
now displayed correctly.

4SUPERSTACK®3 SWITCH 3226 AND SWITCH 3250 SOFTWARE VERSION 1.02 RELEASE NOTES
RMON history statistics and Web port history
statistics
A bug in previous software versions prevented
statistics being generated for the first timing interval.
This has now been fixed.
In previous software versions the 1 hour statistics did
not appear until the unit had been running for
2 hours. The statistics would then be correctly
generated on an hourly interval. This has now been
fixed. 1 hour statistics are available after 1 hour.
Similarly the 6 hour statistics would not appear until
the unit had been running for 12 hours and then
update every 6 hours. This has now been fixed.
6 hour statistics are available after 6 hours.
Software Version Number
The software version number reported by the
system control swapSoftware CLI command
is displayed incorrectly in previous versions of the
software. For example, software version 1.01 displays
the version as 1.1.
When running the 1.02 or later software, it displays
all software versions correctly, including 1.00 and
1.01.
The system control swapSoftware command
does not include an indication of the encryption level
supported by the firmware; the firmware supporting
the normal encryption level 1.02, and the strong
encryption firmware 1.02s both appear as 1.02
when using this command. The encryption level of
the current firmware can be verified by running the
system summary command:
Static port security and the bridge MAC address
table
If static port security is enabled on a port with more
than 200 addresses the previous software versions
would report that the command had failed, but
would add the first 200 addresses to the bridge
address table and move the port into the secure state.
In addition, disabling port security would occasionally
fail to flush the secure addresses from the bridge
address table.
The current software correctly rejects the attempt to
move the port into secure mode if there are more
than 200 addresses. When this condition occurs it
does not change the port security mode or make any
of the addresses secure. In addition, disabling port
security always removes all static bridge address
entries from the port.
Binding an ACL to a port fails occasionally
In previous versions of the software, the unit would
incorrectly count the number of ACL rules when
trying to determine whether the ACL could be bound
to the port.
This has been fixed. In the current software version
the software correctly allows for an ACL to be bound
if it is within the limits of the particular port.

Updating the Switch Software 5
See “Access Control Lists” in the “Points to Note
when using the Switch 3226 and Switch 3250”
section of this document for further details.
3Com Network Supervisor Discovery
When using 3Com Network Supervisor with previous
versions of the software, 3Com Network Supervisor
was unable to display the unit on the network
topology. This will prevent you from using 3Com
Network Supervisor to update the software from 1.00
or 1.01.
This has been fixed. The Switch running software
version 1.02 and above can be discovered successfully
using 3Com Network Supervisor and the correct
network topology generated.
Updating the Switch Software
Software Updates are the bug fix and maintenance
releases for the version of software initially purchased
with the product. In order to access these Software
Updates you must first register your product on the
3Com Web site at:
http://eSupport.3com.com/
First time users will need to apply for a user name and
password. A link to software downloads can be found
from this http://eSupport.3com.com/ page, or
located from the www.3Com.com home page.
To update the software on the Switch, do the follow-
ing:
1Locate the software update for the Switch and run
the (filename.exe) executable file.
2If necessary, download the TFTP server applications
into the management station.
3Install the TFTP server (file name 3ts01_04.exe) on
a Microsoft Windows 95, 98, NT, 2000 or XP
machine.
4Launch the TFTP server application.
5Point the Upload/Download default directory on the
TFTP server to the directory where the upgrade file is
located.
6Make sure the Switch being upgraded has an IP
address assigned to it.
7Telnet to the Switch.
aTo Telnet to the Switch, click Start in Microsoft
Windows 95, 98, NT, 2000, or XP machine.
bClick Run.
cIn the text area, type telnet IP address
dClick OK.
8Press Enter to receive a login prompt.
9Log into the Switch management.
aThe default user login is admin.
bThere is no default password for admin (press
Enter).
10 From the main menu, select System, then select
Control.

6SUPERSTACK®3 SWITCH 3226 AND SWITCH 3250 SOFTWARE VERSION 1.02 RELEASE NOTES
11 Select SoftwareUpgrade.
12 Enter the IP address of the TFTP server connected to
the Switch.
13 Enter the upgrade file name.
aThe message will appear, 'Software Upgrade
in progress.....'.
bThe entire time the upgrade is in process, the
Power/Self test LED will flash ON/OFF Green, and a
series of dots will indicate that the upgrade is
progressing successfully.
cWhen the software upgrade is complete, the
Switch will reboot itself.
Points to Note when Upgrading Software
■The Switch ships with a version of software that
supports up to 56-bit encryption for SSH and SSL
(HTTPS). For higher levels of encryption including
168-bit 3DES and 256-bit AES, download the
strong encryption version of the Switch software
from the 3Com Web site and install as detailed in
“Updating the Switch Software” above.
When you have a strong encryption version of the
Switch software loaded, the Software Version field
on the Web interface will show the version
number of the software followed by the words
(Strong encryption).
■When initiating a TFTP upgrade using the Web
interface or CLI, if an incorrect TFTP server IP
address or software upgrade filename is entered
you will not be able to correct the IP address or
filename until the TFTP upgrade operation has
timed out. The default time out period is 1 minute.
■When attempting to upgrade the software on the
unit it may occasionally report the following error:
Error: File service in progress.
If you encounter this error, please wait a minute
and try the command again.
Points to Note when using the Switch 3226
and Switch 3250
Password Recovery
The password recovery feature allows you to reset the
admin user password by logging into the unit via the
console port using the username recover and
password recover. If you power cycle the unit
within 30 seconds then the password will be reset
and you will be prompted to enter a new password
on restart. There is no command to disable the
password recovery feature.
Configuring Link Aggregations
When creating a manual aggregation between two
systems the ports in the aggregation must not be
physically connected together until the aggregation
has been correctly configured at both ends of the
link. Failure to configure the aggregation at both ends
before physically connecting the ports can result in a
number of serious network issues such as lost packets
and network loops.

Points to Note when using the Switch 3226 and Switch 3250 7
3Com recommends that you set individual ports that
are to be members of an aggregated link to the same
VLAN membership. This ensures communication
between all VLANs at all times.
Telnet and HyperTerminal
Accessing the Command Line Interface via Telnet or
Windows HyperTerminal using TCP/IP may not work
correctly on some platforms unless it has been
configured to send line feeds with carriage returns. To
set this for Telnet enter set crlf when in command
mode. To set this for HyperTerminal click on the
Settings tab in the Properties screen, click ASCII Setup
and ensure that Send line ends with line feeds is
checked within the ASCII Sending section.
You should not configure HyperTerminal in the above
way if you are using a console cable to make a direct
connection to the Switch.
Accessing the Command Line Interface is not possible
using the default Telnet program supplied with Win-
dows XP. Use another Telnet program, such as Hyper-
terminal. See the 3Com Knowledgebase for updates
and a solution, when available:
http://knowledgebase.3com.com
Port Security and Authentication
■When enabling the static port security feature on a
port the Switch will report static fail if you exceed
the maximum number of secure addresses (200).
The unit will not move the port into secure mode.
3Com recommends that port security be enabled
on only edge ports which will typically have only a
few addresses.
■If the address of a device is added as a static secure
address on one port and then it is subsequently
moved to a different port with security disabled
then the device may get intermittent network
connectivity. To fix this problem you should remove
the address from the original port and consider
enabling security on the new port.
■When configuring RADIUS using the CLI command
security radius setup you should note that
the wizard does not include a step to configure the
RADIUS shared secret. You will need to configure
the shared secret using the security radius
sharedSecret command before RADIUS will
operate.
■The Switch does not log authentication requests or
support logging to a RADIUS accounting server.
Please use the logs generated on your RADIUS
authentication server instead.
■To create a user with administrator privileges when
using RADIUS device authentication you must
ensure that user has the “Service-Type” attribute
set to 15.
■Some RADIUS servers will not authenticate users
with a blank password, all user accounts should
have a valid password configured.
Link aggregation and Gigabit ports
■When manually configuring an aggregated link the
switch may report the following error message:

8SUPERSTACK®3 SWITCH 3226 AND SWITCH 3250 SOFTWARE VERSION 1.02 RELEASE NOTES
No more ports may be added to aggregated
link.
You should check the configuration of the
following items on the physical port
■port security is disabled on the port.
■The VLAN membership of the port matches that
of the aggregated link
■LACP is disabled.
■No ACL is bound to the port.
■If you attempt to enable LACP on a port which is
currently a manual member of a link aggregation
then the following error will be displayed:
Failed to set port 1:50 lacp status
If you wish the ports to automatically form a trunk
using LACP then the ports must first be removed
from the manual aggregation.
■If a trunk is disabled by using the bridge
linkAggregation modify linkState CLI
command then the physical trunk member ports
for the aggregation will be disabled. A side effect
of the ports being disabled is that they will no
longer negotiate to become LACP-trunk members.
If the trunk was formed by LACP then the trunk
will disappear because it no longer has any
member ports.
If the LACP trunk is disabled as above then
attempting to enable the trunk with the
linkState command will respond with an error
that the trunk can not be configured. In order to
form the LACP trunk you must manually re-enable
the individual trunk member ports using the
physicalInterface ethernet portState
CLI command
SFP Modules
When adding or removing SFP modules the switch
will reset a number of port parameters. 3Com
recommends that you verify the following port
parameters after adding or removing an SFP module:
■Media configuration (auto negotiation, speed and
duplex)
■Link Aggregation membership.
■LACP state.
■Spanning tree port parameters.
■VLAN membership.
IP Configuration and Routing
■The Switch is optimized to operate as an edge
router with a single default gateway acting as the
next hop route to all other subnets.
■In larger networks it may take several minutes for
the unit to learn the correct routing information.
The unit may have to flush and relearn the routing
information if there is a topology change in the
network. During this time the network connectivity
may be intermittent.
■In certain situations, the Switch will be unable to
used hardware routing display the following error
message in the system summary and route table:
Current network configuration requires use of
software routing, resulting in degraded
performance.

Points to Note when using the Switch 3226 and Switch 3250 9
This message can be caused by one of the
following situations:
■if there are more than14 routes whose next hop
is not the default gateway. 3Com recommends
reconfiguring the network so that the uplink
from the Switch goes directly to another layer 3
router which is configured as the default gate-
way.
■if the unit is unable to contact one or more of
its next-hop routers then software routing will
be used. Find the reason why the router cannot
be contacted and correct the problem.
■if there is no default gateway configured. Con-
figure a default gateway and check to see if the
problem is solved.
■when the Switch is learning new routes. The
Switch may take up to a minute to learn new
routes. The above message may be displayed
for a short time while a route is learned. This is
normal behavior.
■When the unit is in the default IP mode of auto it
will attempt to contact a DHCP server on the
network to obtain an IP address. If there is no
DHCP server available on the network then the
unit will not be accessible using TCP/IP.
Please use the console to configure the unit with
an IP address or connect the unit to a network
with a DHCP server. If using DHCP you will need to
use a console connection or log information from
your DHCP server to discover the address which
has been assigned to the unit.
■Reconfiguring an IP interface may cause the RIP
configuration and static routes settings for that
interface to be lost.
■When adding or modifying an IP interface the CLI
and Web interface may appear to hang for up to
30 seconds while the operation takes place.
■When forwarding DHCP and BOOTP requests in a
multinetted environment, the UDP helper will only
use the primary IP interface in the forwarded
requests. This will cause the BOOTP/DHCP server to
allocate all dynamic addresses from the primary
subnet of a multinetted VLAN.
■If the number of multicast traffic groups on your
network exceeds the maximum supported by the
Switch (64) then you may see occasional bursts of
multicast traffic as the Switch updates its internal
configuration.
■Some combinations of IP commands in a
multinetted environment may cause the IP address
of interface 1 to become a secondary address.
Rebooting the unit will reset this interface as the
primary address. There is no other means of
clearing this condition.
Access Control Lists
When trying to bind an Access Control List (ACL) to a
port you may see the following error generated:
Fail to bind port 26 ACL
This error will appear if:

10 SUPERSTACK®3 SWITCH 3226 AND SWITCH 3250 SOFTWARE VERSION 1.02 RELEASE NOTES
■The ACL which is being bound has more rules than
can be accommodated by the hardware. The
number rules available depends on the port type:
■10/100 Ports - At least 15 rules per port
■10/100/1000 Ports - Maximum of 2 rules per
port.
■You try to bind an ACL to a port which forms part
of an aggregated link, or a port that has LACP
enabled.
The Switch supports ACLs based on IP addresses and
port ranges rather than VLAN IDs. To set up ACLs to
restrict routing between VLANs, each VLAN should
comprise a clearly defined subnet.
ACLs should not be used on inter-switch links as they
may interfere with routing messages required for
normal network operation.
Traffic Prioritization
■There is no CLI command available to remove IP
port based traffic prioritizations. If you wish to
remove these entries you must either use the Web
interface or initialize the unit.
■The IP Port traffic prioritization only examines the
destination port number field of TCP and UDP
frames when determining the priority of the
packet. This may result in the request and response
frames being prioritized differently as they traverse
the network.
■The Switch prioritizes traffic internally but does not
mark or remark packets other than NBX packets.
NBX traffic is remarked to DSCP 46 and 802.1d
priority 6.
VLAN Configuration
Every port on the unit must be an untagged member
of a single VLAN. Every port defaults to being an
untagged member of VLAN1. If you add the port as
an untagged member of another VLAN then this will
replace the VLAN1 membership. If the port is an
untagged member of a VLAN other than 1, then
removing membership of this VLAN will cause the
port to return to being an untagged member of
VLAN1. The unit will respond with the following error
if you attempt to remove the untagged membership
of VLAN1:
Failed to delete untagged port 1:2 from VLAN
1
Management via SNMP / MIBs
■Items configured using SNMP/MIB will be lost
when the unit is power cycled. 3Com recommends
that the CLI and Web interfaces are used to
configure the unit instead.
■The counters for the etherStatsPkts(64~1518) MIB
item count traffic which is sent and received by the
unit. This does not conform to the MIB which
states that it should count only received packets.
■Small variations in the sampling of traffic statistics
may cause the unit to incorrectly measure the
traffic rates used for RMON alarms. To minimize
the generation of incorrect alarms 3Com
recommends that they are configured with a