Asante IntraCore 35516 Series User manual

IntraCore®35516 Series
Layer 2/3/4 Gigabit Switches
Configuration Guide

2
IntraCore 35516 Series
Layer 2/3/4 Gigabit Switches
Configuration Guide
Asanté Technologies, Inc.
2223 Old Oakland Road
San Jose, CA 95131
USA
SALES
800-662-9686 Home/Office Solutions
800-303-9121 Enterprise Solutions
408-435-8388
TECHNICAL SUPPORT
801-566-8991: Worldwide
www.asante.com/support
Copyright © 2003-2004 Asanté Technologies, Inc. All rights reserved. No part of this document, or any associated
artwork, product design, or design concept may be copied or reproduced in whole or in part by any means without the
express written consent of Asanté Technologies, Inc. Asanté and IntraCore are registered trademarks and the Asanté
logo, AsantéCare, Auto-Uplink, and IntraCare are trademarks of Asanté Technologies, Inc. All other brand names or
product names are trademarks or registered trademarks of their respective holders. All features and specifications are
subject to change without prior notice.
Rev. B 09/01/04

3
Introduction
Thank you for purchasing the IntraCore 35516 Layer 2/3/4 Gigabit Switch. This configuration guide is
intended to provide you with a configuration example to help you with a basic network configuration. Refer to
the Setup Guide, Command Line Reference, and User’s Manual for information on hardware installation and
available configuration commands.
Configuring Two Interfaces
In this example, we will step through configuring the switch with two virtual interfaces, enable routing, and
change some default settings in order to prevent unauthorized access to the switch.
In our example, we will have the default interface and a second interface for an engineering network.
By default, the all the switchports (Ethernet interfaces, eth1 to eth16) on the unit are bound to VLAN 1,
which is, in turn, bound to virtual interface 1, or veth1. Veth1, by default, has an IP address of
192.168.0.1/24. The following two screens show the default VLAN and virtual interface. Remember, you
cannot delete the default VLAN (VLAN 1) or veth1 (although you can change the IP address of veth1).
Router> enable
Router# show vlan
VLAN Name Status Ports
---- ---- ------ -----
1 Default VLAN active eth1, eth2, eth3, eth4
eth5, eth6, eth7, eth8
eth9, eth10, eth11, eth12
eth13, eth14, eth15, eth16
Router#
Router# show interface virtual
Interface VLAN Pri IP Address SwitchPort Members
--------- ---- ------------------ ------------------
veth1 1 192.168.0.1/24 eth1, eth2, eth3, eth4
eth5, eth6, eth7, eth8
eth9, eth10, eth11, eth12
eth13, eth14, eth15, eth16
Router#
Complete the following steps to configure two interfaces on the switch.
1. First, we need to create another VLAN. We’ll use a VLAN ID (VID) of 2, and we’ll name it
engineering. Use a space and a question mark (?) to list the possible arguments for a command.
Router# configure terminal
Router(config)# vlan ?
<1-4094> Identifier (ID) of the VLAN to be added and configured
dot1q IEEE 802.1q global setup
Router(config)# vlan 2
Router(config-vlan)#
Router(config-vlan)# name engineering
Router(config-vlan)# end
IC35516
Default Interface
192.168.0.1/24
Engineering Interface
192.0.2.199/24

4
Router# show vlan
VLAN Name Status Ports
---- ---- ------ -----
1 Default VLAN active eth1, eth2, eth3, eth4
eth5, eth6, eth7, eth8
eth9, eth10, eth11, eth12
eth13, eth14, eth15, eth16
2 engineering inactive
2. Next, decide which switchports you want to bind to VLAN 2. In this example, we’ll bind eth13 and
eth14.
Router(config)# interface eth13
Router(config-if-eth13)# switchport ?
access Configure port as an access port
mode VLAN membership mode of this port
priority Set Class of Service (CoS) Priority
trunk Set trunk characteristics
Router(config-if-eth13)# switchport access ?
vlan VLAN
Router(config-if-eth13)# switchport access vlan ?
<1-4094> Specify VLAN Identifier
Router(config-if-eth13)# switchport access vlan 2
Router(config-if-eth13)# exit
Router(config)# interface eth14
Router(config-if-eth14)# switchport access vlan 2
Router(config-if-eth14)# end
Router# show vlan
VLAN Name Status Ports
---- ---- ------ -----
1 Default VLAN active eth1, eth2, eth3, eth4
eth5, eth6, eth7, eth8
eth9, eth10, eth11, eth12
eth15, eth16
2 engineering active eth13, eth14
Router#
3. Note that we’ve created the engineering VLAN, but it is not yet bound to a virtual interface. We’re
going to bind VLAN 2 to virtual interface 2, or veth2.
Router(config)# interface ?
IFNAME Interface name
Router(config)# interface veth2 ?
vlan (Only for virtual interface) Bind virtual interface to VLAN
<cr>
Router(config)# interface veth2 vlan ?
<1-4094> Specify VLAN Identifier
Router(config)# interface veth2 vlan 2
Router(config-if-veth2)# end
Router# show interface virtual
Interface VLAN Pri IP Address SwitchPort Members
--------- ---- ------------------ ------------------
veth1 1 192.168.0.1/24 eth1, eth2, eth3, eth4
eth5, eth6, eth7, eth8
eth9, eth10, eth11, eth12
eth15, eth16
veth2 2 ---- eth13, eth14
Router#

5
4. Now it’s time to assign IP addresses. Veth1 will be changed from the default IP address to
192.0.2.199/24. Veth2 will be assigned 192.168.100.1/24.
Router(config)# interface veth1
Router(config-if-veth1)# ?
arp Set arp timeout
description Interface specific description
end End current mode and change to enable mode
exit Exit current mode and down to previous mode
help Description of the interactive help system
ip Interface Internet Protocol config commands
no Negate a command or set its defaults
quit Exit current mode and down to previous mode
shutdown Shutdown the selected interface
Router(config-if-veth1)# ip ?
address Set the IP address of an interface
dvmrp DVMRP interface command
helper-address Specify a destination address for UDP broadcasts
igmp IGMP interface commands
irdp ICMP Router Discovery Protocol
multicast IP multicast interface commands
ospf OSPF interface commands
redirects Enable sending ICMP Redirect messages
rip Routing Information Protocol
unreachables Enable sending ICMP Unreachable messages
vrrp Interface VRRP config commands
Router(config-if-veth1)# ip address 192.0.2.199/24
Router(config-if-veth1)# exit
Router(config)# interface veth2
Router(config-if-veth2)# ip address 192.168.100.1/24
Router(config-if-veth2)# end
Router# show interface virtual
Interface VLAN Pri IP Address SwitchPort Members
--------- ---- ------------------ ------------------
veth1 1 192.0.2.199/24 eth1, eth2, eth3, eth4
eth5, eth6, eth7, eth8
eth9, eth10, eth11, eth12
eth15, eth16
veth2 2 192.168.100.1/24 eth13, eth14
Router#
5. Now each sub-network has an IP address. In order to connect to other routers on the network, you
must turn on a routing protocol. Here, we enable the Routing Information Protocol (RIP) so that
routing updates can be sent to a connected network once the switch starts sending RIP packets.
Then RIP (both version 1 and version 2) will be enabled.
Router(config)# router rip
Router(config-rip-router)# network ?
A.B.C.D/M IP prefix <network>/<length>, e.g., 35.0.0.0/8
Router(config-rip-router)# network 192.0.2.0/24
Router(config-rip-router)#
Router(config-rip-router)# redistribute ?
bgp Border Gateway Protocol (BGP)
connected Connected
kernel Kernel routes
ospf Open Shortest Path First (OSPF)
static Static routes
rip Routing Information Protocol (RIP)
Router(config-rip-router)# redistribute connected

6
Router(config-rip-router)# exit
Router(config)# interface veth1
Router(config-if-veth1)# ip rip ?
authentication Authentication control
poison Enable split horizon with poison reverse
receive Advertisement reception
send Advertisement transmission
Router(config-if-veth1)# ip rip send ?
version Version control
Router(config-if-veth1)# ip rip send version ?
1 RIP version 1
2 RIP version 2
Router(config-if-veth1)# ip rip send version 1 2
Router(config-if-veth1)# ip rip receive version 1 2
Router(config-if-veth1)# exit
Router(config)# interface veth2
Router(config-if-veth2)# ip rip send version 1 2
Router(config-if-veth2)# ip rip receive version 1 2
Router(config-if-veth2)# exit
Router(config)#
You can see this configuration listed with the Router# show running-config command. Scroll down to
the virtual interface entries, using the space bar when you see the --More-- prompt.
interface veth1 vlan 1
ip address 192.0.2.199/24
ip rip send version 1 2
ip rip receive version 1 2
!
interface veth2 vlan 2
ip address 192.168.100.1/24
ip rip send version 1 2
ip rip receive version 1 2
!
!
router rip
redistribute connected
network 192.0.2.0/24
!
!
line console 0
password Asante
line vty 0
password Asante
line vty 1
line vty 2
line vty 3
!
!
end
Router#
6. Save your configurations by using the following command in privileged mode:
Router# write file

7
Now we have our connected networks functioning. All that is left is changing a few default settings to secure
access to the switch.
7. The default password of Asante is used on both the console line and the primary telnet line. Follow
the steps in the next screen to encrypt the password.
Router(config)# service ?
password-encryption Encrypt system passwords
Router(config)# service password-encryption ?
<cr>
Router(config)# service password-encryption
Router(config)# end
Router# show running-config
!
!
line console 0
password 7 xuVvcBXXySlLY
line vty 0
password 7 NeT0FbtV6Ax3c
line vty 1
line vty 2
line vty 3
!
!
end
Router#
8. Now the password Asante is encrypted. To change the password, follow the steps in the following
screen. For our example, the new password will be admin. Choose a unique password that you
can remember. You can use a different password for each line.
Router(config)# line ?
console Primary terminal line
vty Virtual terminal
Router(config)# line console 0
Router(config-line)# ?
end End current mode and change to enable mode
exec-timeout Set timeout value
exit Exit current mode and down to previous mode
help Description of the interactive help system
no Negate a command or set its defaults
password Set a password
quit Exit current mode and down to previous mode
Router(config-line)# password ?
LINE The UNENCRYPTED (cleartext) line password
0 Specifies an UNENCRYPTED line password will follow
7 Specifies a HIDDEN line password will follow
Router(config-line)# password 7 admin
Router(config-line)# exit
Router(config)# line vty 0
Router(config-line)# password 7 admin
Important! Once you’ve designated a password as encrypted (level 7), keep the password(s) in a safe
place. You cannot retrieve a forgotten password, unless you reset the switch to factory defaults.

8
9. Next, set an enable password to prevent unauthorized access to the privileged level configuration
modes. Network users can then be kept in the top mode (designated by the Router> prompt),
where they are unable to affect your configurations. The default is no password.
Router(config)# enable ?
password Assign the privileged level password
Router(config)# enable password ?
0 Specifies an UNENCRYPTED password will follow
7 Specifies a HIDDEN password will follow
LINE The UNENCRYPTED (cleartext) 'enable' password
Router(config)# enable password 7 admin
Router(config)#
10. Before ending this basic configuration, it is highly recommended that you change the SNMP
community strings. A community string (for read-only access or read-write access) acts like a
password and permits access to the SNMP protocol. Follow the commands in the screen below to
set community strings. For our example, the new read-only (ro) string will be user, and the read-
write (rw) string will be manager.
Router(config)# snmp-server ?
community Specify a string that acts like a password and permit access to
SNMP Protocol
contact Set system contact information
enable Enable SNMP Traps or Informs
host Host to receive the SNMP trap
location Set system location
Router(config)# snmp-server community ?
COMMUNITY_STRING Community string
Router(config)# snmp-server community admin ?
ro Read-Only community string
rw Read-Write community string
<cr>
Router(config)# snmp-server community user ro
Router(config)# snmp-server community manager rw
11. Use the Router# write file command to save your configuration. Then, use the Router#
show running-configuration command to view all your configurations (you can also use the
Router# copy command to copy the configuration to a TFTP server, and print the file from there).
The following is the entire running configuration:
Current configuration: 821 Bytes
!
!
!
!
vlan 2
name engineering
hostname Router
service password-encryption
!
interface eth1
!
interface eth2
!
interface eth3
!
interface eth4
!
interface eth5
!
interface eth6

9
!
interface eth7
!
interface eth8
!
interface eth9
!
interface eth10
!
interface eth11
!
interface eth12
!
interface eth13
switchport access vlan 2
!
interface eth14
switchport access vlan 2
!
interface eth15
!
interface eth16
!
interface veth1 vlan 1
ip address 192.0.2.199/24
ip rip send version 1 2
ip rip receive version 1 2
!
interface veth2 vlan 2
ip address 192.168.100.1/24
ip rip send version 1 2
ip rip receive version 1 2
!
!
router rip
redistribute connected
network 192.0.2.0/24
!
!
!
!
!
line console 0
password 7 c.dZubltqPAh2
line vty 0
password 7 kNzLKehTWpv9g
line vty 1
line vty 2
line vty 3
!
!
end