Cisco Sx350 Instruction Manual

Cisco Sx350, SG350X, SG350XG, Sx550X & SG550XG
Series Managed Switches, Firmware Release 2.2.5.x
ADMINISTRATION
GUIDE

Cisco Sx350, SG350X, SG350XG, Sx550X & SG550XG Series Managed Switches, Firmware Release 2.2.5.x 1
Contents
Chapter 1: Getting Started 10
Starting the Web-based Configuration Utility 10
Out-Of-Band Port 13
USB Port 15
Basic or Advanced Display Mode 16
Quick Start Device Configuration 17
Interface Naming Conventions 18
Window Navigation 19
Search Facility 22
Chapter 2: Dashboard 23
Grid Management 23
System Health 24
Resource Utilization 25
Identification 26
Port Utilization 27
PoE Utilization 27
Latest Logs 28
Suspended Interfaces 28
Stack Topology 29
Traffic Errors 30
Chapter 3: Configuration Wizards 31
Getting Started Wizard 31
VLAN Configuration Wizard 33
ACL Wizard 34
Chapter 4: Status and Statistics 37
System Summary 38
CPU Utilization 40

Cisco Sx350, SG350X, SG350XG, Sx550X & SG550XG Series Managed Switches, Firmware Release 2.2.5.x 2
Contents
Interface 40
Etherlike 42
Port Utilization 43
GVRP 43
802.1X EAP 44
ACL 45
TCAM Utilization 46
Health and Power 48
Switched Port Analyzer (SPAN and RSPAN) 54
Diagnostics 57
RMON 61
sFlow 69
View Logs 72
Chapter 5: Administration 74
Device Models 74
System Settings 77
Console Settings (Autobaud Rate Support) 77
User Accounts 78
Idle Session Timeout 79
System Log 80
Reboot 84
Routing Resources 85
Ping 89
Traceroute 91
Chapter 6: Administration: File Management 92
System Files 92
Firmware Operations 94
File Operations 98

Cisco Sx350, SG350X, SG350XG, Sx550X & SG550XG Series Managed Switches, Firmware Release 2.2.5.x 3
Contents
File Directory 105
DHCP Auto Configuration/Image Update 106
Chapter 7: Administration: Stack Management 116
Overview 116
Types of Units in Stack 117
Stack Topology 118
Unit ID Assignment 119
Master Selection Process 120
Stack Changes 120
Unit Failure in Stack 121
Stack Ports 123
Software Auto Synchronization in Stack 126
Stack Management 130
Chapter 8: Administration: Time Settings 132
System Time Configuration 133
SNTP Modes 134
System Time 135
SNTP Unicast 137
SNTP Multicast/Anycast 139
SNTP Authentication 140
Time Range 141
Recurring Time Range 143
Chapter 9: Administration: Discovery 144
Bonjour 144
LLDP and CDP 145
Discover - LLDP 147
Discovery - CDP 167

Cisco Sx350, SG350X, SG350XG, Sx550X & SG550XG Series Managed Switches, Firmware Release 2.2.5.x 4
Contents
Chapter 10: Port Management 178
Workflow 178
Port Settings 179
Error Recovery Settings 183
Loopback Detection Settings 184
Link Aggregation 186
UDLD 193
PoE 201
Green Ethernet 212
Chapter 11: Smartport 219
Overview 219
How the Smartport Feature Works 224
Auto Smartport 225
Error Handling 228
Default Configuration 228
Relationships with Other Features 229
Common Smartport Tasks 229
Configuring Smartport Using The Web-based Interface 231
Built-in Smartport Macros 236
Chapter 12: VLAN Management 247
Overview 247
Regular VLANs 254
Private VLAN Settings 262
GVRP Settings 262
VLAN Groups 263
Voice VLAN 269
Access Port Multicast TV VLAN 282
Customer Port Multicast TV VLAN 285

Cisco Sx350, SG350X, SG350XG, Sx550X & SG550XG Series Managed Switches, Firmware Release 2.2.5.x 5
Contents
Chapter 13: Spanning Tree 289
STP Flavors 289
STP Status and Global Settings 290
STP Interface Settings 292
RSTP Interface Settings 295
Multiple Spanning Tree Overview 297
MSTP Properties 297
VLANs to a MSTP Instance 298
MSTP Instance Settings 299
MSTP Interface Settings 300
Chapter 14: Managing MAC Address Tables 303
Static Addresses 304
Dynamic Addresses 305
Reserved MAC Addresses 306
Chapter 15: Multicast 308
Multicast Forwarding Overview 308
Properties 314
MAC Group Address 315
IP Multicast Group Address 316
IPv4 Multicast Configuration 318
IPv6 Multicast Configuration 324
IGMP/MLD Snooping IP Multicast Group 330
Multicast Router Port 331
Forward All 331
Unregistered Multicast 332
Chapter 16: IP Configuration 334
Overview 334

Cisco Sx350, SG350X, SG350XG, Sx550X & SG550XG Series Managed Switches, Firmware Release 2.2.5.x 6
Contents
IPv4 Management and Interfaces 337
IPv6 Management and Interfaces 364
Policy-Based Routing 388
Domain Name System 391
Chapter 17: IP Configuration: RIPv2 396
Overview 396
How Rip Operates on the Device 397
Configuring RIP 400
Access Lists 405
Chapter 18: IP Configuration: VRRP 408
Overview 408
VRRP Topology 409
Configurable Elements of VRRP 410
Configuring VRRP 413
Chapter 19: IP Configuration: SLA 417
Overview 417
Using SLA 419
Chapter 20: Security 424
Configuring TACACS+ 425
RADIUS 429
Password Strength 440
Key Management 442
Management Access Method 445
Management Access Authentication 450
SSL Server 451
TCP/UDP Services 454

Cisco Sx350, SG350X, SG350XG, Sx550X & SG550XG Series Managed Switches, Firmware Release 2.2.5.x 7
Contents
Storm Control 455
Port Security 458
IP Source Guard 460
ARP Inspection 464
Denial of Service Prevention 469
Chapter 21: Security: 802.1X Authentication 480
Overview 480
Properties 493
Port Authentication 495
Host and Session Authentication 498
Authenticated Hosts 499
Locked Clients 499
Web Authentication Customization 500
Chapter 22: Security: Secure Sensitive Data Management 504
Introduction 504
SSD Management 505
SSD Rules 505
SSD Properties 510
Configuration Files 513
SSD Management Channels 517
Menu CLI and Password Recovery 518
Configuring SSD 518
Chapter 23: Security: SSH Server 522
Overview 522
Common Tasks 523
SSH User Authentication 524
SSH Server Authentication 525

Cisco Sx350, SG350X, SG350XG, Sx550X & SG550XG Series Managed Switches, Firmware Release 2.2.5.x 8
Contents
Chapter 24: Security: SSH Client 527
Overview 527
SSH User Authentication 533
SSH Server Authentication 534
Change User Password on the SSH Server 536
Chapter 25: Security: IPv6 First Hop Security 537
IPv6 First Hop Security Overview 537
Router Advertisement Guard 540
Neighbor Discovery Inspection 541
DHCPv6 Guard 541
Neighbor Binding Integrity 542
IPv6 Source Guard 544
Attack Protection 545
Policies, Global Parameters and System Defaults 547
Common Tasks 549
Default Settings and Configuration 551
Configuring IPv6 First Hop Security through Web GUI 552
Chapter 26: Access Control 571
Overview 571
MAC-Based ACLs Creation 575
IPv4-based ACL Creation 577
IPv6-Based ACL Creation 582
ACL Binding 585
Chapter 27: Quality of Service 588
QoS Features and Components 589
General 591
QoS Basic Mode 603

Cisco Sx350, SG350X, SG350XG, Sx550X & SG550XG Series Managed Switches, Firmware Release 2.2.5.x 9
Contents
QoS Advanced Mode 605
QoS Statistics 618
Chapter 28: SNMP 622
Overview 622
Engine ID 627
Views 629
Groups 630
Users 631
Communities 633
Trap Settings 635
Notification Recipients 636
Notification Filter 640
Chapter 29: Smart Network Application (SNA) 642
SNA Sessions 643
SNA Graphics 644
Top Right-Hand Menu 646
Topology View 647
Right-Hand Information Panel 654
Operations 667
Overlays 672
Tags 676
Search 680
Notifications 682
Device Authorization Control (DAC) 685
DAC Workflow 685
Services 693
Saving SNA Settings 709
Technical Details 710

1
Cisco Sx350, SG350X, SG350XG, Sx550X & SG550XG Series Managed Switches, Firmware Release 2.2.5.x 8
Getting Started
This section provides an introduction to the web-based configuration utility, and covers the
following topics:
• Starting the Web-based Configuration Utility
• Out-Of-Band Port
• USB Port
• Basic or Advanced Display Mode
• Quick Start Device Configuration
• Interface Naming Conventions
• Window Navigation
• Search Facility
Starting the Web-based Configuration Utility
This section describes how to navigate the web-based switch configuration utility.
If you are using a pop-up blocker, make sure it is disabled.
Browser Restrictions
If you are using IPv6 interfaces on your management station, use the IPv6 global address and
not the IPv6 link local address to access the device from your browser.

Getting Started
Starting the Web-based Configuration Utility
1
Cisco Sx350, SG350X, SG350XG, Sx550X & SG550XG Series Managed Switches, Firmware Release 2.2.5.x 9
Launching the Configuration Utility
To open the web-based configuration utility:
STEP 1 Open a Web browser.
STEP 2 Enter the IP address of the device you are configuring in the address bar on the browser, and
then press Enter.
NOTE When the device is using the factory default IP address of 192.168.1.254, its system LED
flashes continuously. When the device is using a DHCP-assigned IP address or an
administrator-configured static IP address, the system LED is on solid.
On the SG350XG and the SG550XG, the default IP address 192.168.1.254 is configured to the
OOB port of the device, while on the other devices it is configured on the default VLAN (Vlan
1). To access the device with the IP address configured on the OOB port, make sure the OOB
port is connected to your network or PC.
Logging In
The default username/password is cisco/cisco. The first time that you log in with the default
username and password, you are required to enter a new password.
NOTE If you have not previously selected a language for the GUI, the language of the Login page is
determined by the language(s) requested byyour browserand the languages configuredon your
device. If your browser requests Chinese, for example, and Chinese has been loaded into your
device, the Login page is automatically displayed in Chinese. If Chinese has not been loaded
into your device, the Login page appears in English.
The languages loaded into the device have a language and country code (en-US, en-GB and so
on). For the Login page to be automatically displayed in a particular language, based on the
browser request, both the language and country code of the browser request must match those
of the language loaded on the device. If the browser request contains only the language code
without a country code (for example: fr). The first embedded language with a matching
language code is taken (without matching the country code, for example: fr_CA).

Getting Started
Starting the Web-based Configuration Utility
Cisco Sx350, SG350X, SG350XG, Sx550X & SG550XG Series Managed Switches, Firmware Release 2.2.5.x 10
1
To log in to the device configuration utility:
STEP 1 Enter the username/password. The password can contain up to 64 ASCII characters.
Password-complexity rules are described in Password Strength.
STEP 2 If you are not using English, select the desired language from the Language drop-down menu.
To add a new language to the device or update a current one, see the description of the
Language Menu described in Application Header.
STEP 3 If this is the first time that you logged on with the default user ID (cisco) and the default
password (cisco) or your password has expired, the Change Password Page appears. See
Password Expiration for additional information.
STEP 4 Choose whether to select Password Complexity Settings in the Password Strength page.
STEP 5 Enter the new password and click Apply.
When the login attempt is successful, the Getting Started page appears.
If you entered an incorrect username or password, an error message appears and the Login
page remains displayed on the window.
Select Don't show this page on startup to prevent the Getting Started page from being
displayed each time that you log on to the system. If you select this option, the System
Summary page is opened instead of the Getting Started page.
HTTP/HTTPS
You can either open an HTTP session (not secured) by clicking Log In, or you can open an
HTTPS (secured) session, by clicking Secure Browsing (HTTPS). You are asked to approve
the logon with a default RSA key, and an HTTPS session is opened.
NOTE There is no need to input the username/password prior to clicking the Secure Browsing
(HTTPS) button.
For information on how to configure HTTPS, see SSL Server.
Password Expiration
The New Password page is displayed in the following cases:
•The first time that you access the device with the default username cisco and password
cisco. This page forces you to replace the factory default password.

Getting Started
Out-Of-Band Port
1
Cisco Sx350, SG350X, SG350XG, Sx550X & SG550XG Series Managed Switches, Firmware Release 2.2.5.x 11
•When the password expires, this page forces you to select a new password.
Logging Out
By default, the application logs out after ten minutes of inactivity. You can change this default
value as described in the Defining Idle Session Timeout section.
!
CAUTION Unless the Running Configuration is copied to the Startup Configuration, rebooting the device
removes all changes made since the last time the file was saved. Save the Running
Configuration to the Startup Configuration before logging off to preserve any changes you
made during this session.
A flashing red X icon to the left of the Save application link indicates that Running
Configuration changes have not yet been saved to the Startup Configuration file. The flashing
can be disabled by clicking on the Disable Save Icon Blinking button on the Copy/Save
Configuration page
When the device auto-discovers a connected device, such as an IP phone (see What is a
Smartport), and it configures the port appropriately for the device. These configuration
commands are written to the Running Configuration file. This causes the Save icon to begin
blinking when the you log on, even though you did not make any configuration changes.
When you click Save, the Copy/Save Configuration page appears. Save the Running
Configuration file by copying it to the Startup Configuration file.After this save, the red X icon
and the Save application link are no longer displayed.
To logout, click Logout in the top right corner of any page. The system logs out of the device.
When a timeout occurs or you intentionally log out of the system, a message is displayed and
the Login page appears, with a message indicating the logged-out state. After you log in, the
application returns to the initial page.
The initial page displayed depends on the “Do not show this page on startup” option in the
Getting Started page. If you did not select this option, the initial page is the Getting Started
page. If you did select this option, the initial page is the System Summary page.
Out-Of-Band Port
NOTE OOB is only supported on SG350XG and SG550XG devices.

Getting Started
Out-Of-Band Port
Cisco Sx350, SG350X, SG350XG, Sx550X & SG550XG Series Managed Switches, Firmware Release 2.2.5.x 12
1
The switch supports an Out-of-Band (OOB) port. This port is used for the management
network. The out-of-band and the in-band ports share the same IP routing table, therefore you
cannot use the same subnet on both in-band and out-of-band interfaces.
The OOB port is assigned an MAC address which is different from the base MAC
address and the addresses of the in-band ports. This MAC address is used as the
source MAC address in all frames (including IP frames) sent by the switch on the
OOB port.
The IP address assigned to this port cannot be assigned to the in-band ports at the same time.
In addition, the IP address assigned to the OOB port must not belong to any IP subnet
configured at the in-band interfaces of the devices.
By default, the OOB port is configured with the default IP address 192.168.1.254. This default
IPaddress is used when no other address was assigned (dynamically or statically). This sub net
is a reserved one and cannot be assigned on the in-band interfaces.
Bridging
Bridging between the OOB port and the in-band Layer 2 interfaces is not
supported. The OOB port cannot be a member of VLAN or LAG, and the bridge’s
protocols (for example, STP, GVRP, etc.) cannot be enabled on the OOB port.
Only untagged traffic is supported on the OOB port.
Port Configuration
The following Ethernet configuration is supported for the OOB port:
•Speed (10/100/1000)
•Duplex
•Auto-negotiation
DHCP Client
DHCP client (IPv4 and IPv6) is enabled by default on the OOB port and on the default VLAN.
Static route on OOB port
Static routes are supported on the OOB port.

Getting Started
USB Port
1
Cisco Sx350, SG350X, SG350XG, Sx550X & SG550XG Series Managed Switches, Firmware Release 2.2.5.x 13
IPv4 Address on OOB port
Only one IPv4 address can be defined on the OOB port.
The default static IP address is set only on the OOB.
IPApplications
All IP applications, such as telnet, SSH, except for the following ones are supported on the
OOB port:
•ARP Proxy
•Routing protocols
•Relay applications (DHCP, DHCPv6 and UDP)
QoS & ACL
QoS and ACL are not supported on the OOB port (so all TCAM-based features like DOS
Attack Prevention are also not supported).
Only Management ACLs are supported.
Stack Support
The OOB port name is always mapped to the physical OOB port of master unit. The physical
OOB ports of slaves are not functional and will not establish a link when connected to a
neighbor device or PC.
USB Port
The USB port can be used for connecting external storage (disk-on-key) devices. It can hold
configuration, SYSLOG and image files. In a stack, only the master’s USB port is active. The
USB port fully supports the FAT32 file system, and provides partial support (read only) for the
NTFS file system.
Both relative path or fully qualified paths can be used.
The system supports the following user actions on the USB port through the GUI:
•Display the USB contents

Getting Started
Basic or Advanced Display Mode
Cisco Sx350, SG350X, SG350XG, Sx550X & SG550XG Series Managed Switches, Firmware Release 2.2.5.x 14
1
•Copy files to/from USB (the same as with TFTP)
•Delete, rename and display the contents of USB files
Basic or Advanced Display Mode
The product supports many features, and therefore the WEB GUI includes hundreds of
configuration and display pages. These pages are divided into the following display modes:
•Basic—Basic subset of configuration options are available. If you are missing some
configuration option, select the Advanced mode in the device header.
•Advanced—Full set of configuration options are available.
Navigate from one mode to another, as shown below:
When the user switches from basic to advanced, the browser reloads the page. However, after
reload, the user stays on the same page.
When the user switches from advanced to basic, the browser reloads the page. If the page
exists also on the basic mode, the user stays on the same page. If the page does not exist in the
basic mode, the browser will load the first page of the folder which was used by the user. If the
folder does not exist, the Getting Started page will be displayed.
If there is advanced configuration, and the page is loaded in basic mode, a page-level message
will be displayed to the user (e.g. there are 2 radius server configured but in basic mode only a
single server can be displayed, or there is 802.1X port authentication with time range
configured but time range is not visible in basic mode).
When switching from one mode to another, any configuration which was made on the page
(without Apply) is deleted.

Getting Started
Quick Start Device Configuration
1
Cisco Sx350, SG350X, SG350XG, Sx550X & SG550XG Series Managed Switches, Firmware Release 2.2.5.x 15
Quick Start Device Configuration
For quick initial setup, you can use the configuration wizards described in VLAN
Configuration Wizard or use the links on the Getting Started page, as described below:
There are two hot links on the Getting Started page that take you to Cisco web pages for more
information. Clicking on the Support link takes you to the device product support page, and
clicking on the Forums link takes you to the Support Community page.
Category Link Name (on the Page) Linked Page
Initial Setup Manage Stack Administration: Stack
Management
Change ManagementApplications
and Services TCP/UDP Services
Change Device IPAddress IPv4 Interface
Create VLAN VLAN Settings
Configure Port Settings Port Settings
Device Status System Summary System Summary
Port Statistics Interface
RMON Statistics Statistics
View Log RAM Memory
Quick Access Change Device Password User Accounts
Upgrade Device Software Firmware Operations
Backup Device Configuration File Operations
Create MAC-Based ACL MAC-Based ACLs Creation
Create IP-Based ACL IPv4-based ACL Creation
Configure QoS QoS Properties
Configure SPAN Switched Port Analyzer (SPAN)

Getting Started
Interface Naming Conventions
Cisco Sx350, SG350X, SG350XG, Sx550X & SG550XG Series Managed Switches, Firmware Release 2.2.5.x 16
1
Interface Naming Conventions
Within the GUI, interfaces are denoted by concatenating the following elements:
•Type of interface: The following types of interfaces are found on the various types of
devices:
-Fast Ethernet (10/100 bits)—These are displayed as FE. Supported only on the
350 family.
-Gigabit Ethernet ports (10/100/1000 bits)—These are displayed as GE.
Supported only on the 350 family
-Ten Gigabit Ethernet ports (1000/10,000 Mbps)—These are displayed as XG.
-Out-of-Band Port—This is displayed as OOB.
-LAG (Port Channel)—These are displayed as LAG.
-VLAN—These are displayed as VLAN.
-Tunnel —These are displayed as Tunnel.
•Unit Number—Number of the unit in the stack. The unit number together with the
interface number completely identifies the port. For example, GE1/0/4 is port number
4 on the first unit of the stack.
•Slot Number—The slot number is always 0.
•Interface Number: Port, LAG, Tunnel, or VLAN ID.

Getting Started
Window Navigation
1
Cisco Sx350, SG350X, SG350XG, Sx550X & SG550XG Series Managed Switches, Firmware Release 2.2.5.x 17
Window Navigation
This section describes the features of the web-based switch configuration utility.
Application Header
The Application Header appears on every page. It provides the following application links:
Application Link
Name Description
A flashing red X icon displayed to the left of the Save application
link indicates that Running Configuration changes have been made
that have not yet been saved to the Startup Configuration file. The
flashing of the red X can be disabled on the Copy/Save
Configuration page.
Click Save to display the Copy/Save Configuration page. Save the
Running Configuration file by copying it to the Startup
Configuration file type on the device. After this save, the red X
icon and the Save application link are no longer displayed. When
the device is rebooted, it copies the Startup Configuration file type
to the Running Configuration and sets the device parameters
according to the data in the Running Configuration.
Username Displays the name of the user logged on to the device. The default
username is cisco. (The default password is cisco).