Dell PowerConnect 3248 User manual

www.dell.com | support.dell.com
Dell™ PowerConnect™ 3248 and 5224 Network Switches
Addendum to the 3248 and
5224 User’s Guides

Notes, Notices, and Cautions
NOTE: A NOTE indicates important information that helps you make better use of your computer.
NOTICE: A NOTICE indicates either potential damage to hardware or loss of data and tells you
how to avoid the problem.
CAUTION: A CAUTION indicates a potential for property damage, personal injury,
or death.
____________________
Information in this document is subject to change without notice.
© 2003 Dell Computer Corporation. All rights reserved.
Reproduction in any manner whatsoever without the written permission of Dell Computer Corporation is strictly forbidden.
Trademarks used in this text: Dell, the DELL logo, and PowerConnect are trademarks of Dell Computer Corporation;
Microsoft, Windows, and Windows NT are registered trademarks of Microsoft Corporation.
Other trademarks and trade names may be used in this document to refer to either the entities claiming the marks and
names or their products. Dell Computer Corporation disclaims any proprietary interest in trademarks and trade names
other than its own.
January 2003 P/N K0111 Rev. A01

Addendum to the 3248 and 5224 User’s Guides 3
Addendum to the 3248 and 5224
User’s Guides
NOTE: The graphics in
this section may differ
slightly from the graphics
on your computer.
New Features:
• Remote System Logging
• Secure Access — Secure Shell (SSH), Authentication Settings, and
Secure Hypertext Transfer Protocol (HTTPS)
• Increased Port Security
• Spanning Tree Protocol (STP)
• IP Filtering — Simple Network Management Protocol (SNMP)
• Enhanced Statistics Summaries

4Addendum to the 3248 and 5224 User’s Guides
www.dell.com | support.dell.com
System Logs
Remote system logging allows you to configure the logging of system
messages directly from the Web interface and the command line interface
(CLI).
The system log messages are categorized, by severity, into eight levels. The
levels range from 0 for Emergencies to 7 for Debugging. See the following
table for descriptions:
The system allows you to specify which levels are logged to RAM or flash
memory.
To assist in troubleshooting network problems, severe error messages that
are logged to flash memory are permanently stored in the switch. Up to 4 K
log entries can be stored in the flash memory. When the available memory
for logs exceeds 256 KB, the oldest entries are overwritten.
System Logs Configuration
The Switch/General/System Logs page allows you to configure and limit
system messages that are logged to flash or RAM memory. The default is set
for levels 0 to 3 to be logged to flash and levels 0 to 7 to be logged to RAM.
The Switch/General/System Logs page contains the following fields that
can be edited:
•System Log Status — Enables/disables the logging of debug or error
messages to the logging process.
Level Argument Level Description
Emergencies 0 System unusable
Alerts 1 Immediate action needed
Critical 2 Critical conditions
Errors 3 Error conditions
Warnings 4 Warning conditions
Notifications 5 Normal but significant condition
Informational 6 Informational messages only
Debugging 7 Debugging messages

Addendum to the 3248 and 5224 User’s Guides 5
•Flash Level — Limits log messages saved to the switch’s permanent
flash memory for all levels up to the specified level. For example, if
level 3 is specified, all messages from level 0 to level 3 are logged to
flash.
NOTE: The Flash Level
must be equal to or less
than the Ram Level.
•Ram Level — Limits log messages that are saved to the switch’s
temporary RAM memory for all levels up to the specified level. For
example, if level 7 is specified, all messages from level 0 to level 7 are
logged to RAM.
NOTE: System log
messages are logged
every 60 minutes.
To save any changes you make in this page, click Apply Changes. If you do
not want to save the changes, click Refresh.
The following figure is representative of PowerConnect 3248 and 5224.

6Addendum to the 3248 and 5224 User’s Guides
www.dell.com | support.dell.com
CLI Commands
The following table summarizes the equivalent CLI commands for items in
the Switch/General/System Logs page.
Example
Console(config)#logging on
Console(config)#logging history ram 0
Console(config)#
Console#show logging flash
Syslog logging: Disable
History logging in FLASH: level errors
Console#
Remote Logs Configuration
The Switch/General/Remote Logs page allows you to configure the logging
of messages that are sent to syslog servers or other management stations.
You can also limit the error messages sent to messages of a specified level.
Command Usage
logging on Controls the logging of debug or error messages to
a logging process.
The no form command disables the logging
process.
logging history {flash |
ram} level
Limits syslog messages saved to switch memory
based on severity.
The no form command returns the logging of
syslog messages to the default level.
flash — event history stored in flash memory
(permanent memory)
ram — event history stored in temporary RAM
(memory flushed on power reset)
show logging {flash | ram
| trap}
Displays the logging configuration for system and
event messages

Addendum to the 3248 and 5224 User’s Guides 7
The Switch/General/Remote Logs page contains the following fields that
can be edited:
•Remote Log Status — Enables/disables the logging of debug or error
messages to the remote logging process. (Default: Enabled)
•Logging Facility — Sets the facility type for remote logging of syslog
messages. There are eight facility types specified by values of 16 to 23.
The syslog server uses the facility type to dispatch log messages to an
appropriate service. (Default: 23)
•Logging Trap — Limits log messages that are sent to the remote syslog
server for all levels up to the specified level. For example, if level 3 is
specified, all messages from level 0 to level 3 are sent to the remote
server. (Default: 3)
•Host IP List — Displays the list of remote server IP addresses that
receive the syslog messages. The maximum number of host IP
addresses allowed is five.
•Host IP Address — Specifies a new server IP address to add to the
Host IP List.
To add an IP address to the Host IP List, type the new IP address in the
Host IP Address box, and click Add IP Host. To delete an IP address, click
the entry in the Host IP List, and click Remove Host IP.
To save any changes you make in this page, click Apply Changes. If you do
not want to save the changes, click Refresh.

8Addendum to the 3248 and 5224 User’s Guides
www.dell.com | support.dell.com
The following figure is representative of PowerConnect 3248 and 5224.
CLI Commands
The following table summarizes the equivalent CLI commands for items in
the Switch/General/Remote Logs page.
Command Usage
logging host
host_ip_address
Adds a syslog server host IP address that receives
logging messages.
The no form command removes a syslog server
host.
logging facility
facility_type
Sets the facility type for remote logging of syslog
messages.
The no form command returns the facility type to
the default.
logging trap level Limits syslog messages saved to a remote server
based on severity.
The no form command returns the remote logging
of syslog messages to the default level.

Addendum to the 3248 and 5224 User’s Guides 9
Example
Console(config)#logging host 10.1.0.9
Console(config)#logging facility 23
Console(config)#logging trap 4
Console(config)#
Console#show logging trap
Syslog logging: Enable
REMOTELOG status: enable
REMOTELOG facility type: local use 7
REMOTELOG level type: Warning conditions
REMOTELOG server ip address: 10.1.0.9
REMOTELOG server ip address: 0.0.0.0
REMOTELOG server ip address: 0.0.0.0
REMOTELOG server ip address: 0.0.0.0
REMOTELOG server ip address: 0.0.0.0
Console#
Security
The Switch/Security page contains new links to Secure Shell (SSH) and
Secure Hypertext Transfer Protocol (HTTPS) configuration. The RADIUS
Settings page was renamed Authentication Settings and updated to
include Terminal Access Controller Access Control System Plus
(TACACS+).
• SSH
• Authentication Settings
•HTTPS
show logging {flash | ram
| trap}
Displays the logging configuration for system and
event messages
Command Usage

10 Addendum to the 3248 and 5224 User’s Guides
www.dell.com | support.dell.com
Secure Shell
The Secure Shell (SSH) server feature provides remote management access
using encrypted paths between the switch and SSH-enabled management
station clients.
NOTE: There are two
versions of the SSH
protocol currently
available: SSH v1.
x and
SSH v2. x . The switch
supports only SSH v1.5.
•SSH Server Status — Allows you to enable/disable the SSH server
feature on the switch. (Default: Enabled)
•SSH authentication timeout — Specifies the time interval in seconds
that the SSH server waits for a response from a client during an
authentication attempt. (Range: 1 to 120 seconds; Default: 120 seconds)
•SSH authentication retries — Specifies the number of authentication
attempts that a client is allowed before authentication fails and the
client must restart the authentication process. (Range: 1 to 5 times;
Default: 3)
To save any changes you make in this page, click Apply Changes. If you do
not want to save the changes, click Refresh.
The following figure is representative of PowerConnect 3248 and 5224.

Addendum to the 3248 and 5224 User’s Guides 11
CLI Commands
The following table summarizes the equivalent CLI commands for items in
the Switch/Security/SSH page.
Example
Console(config)#ip ssh server
Console(config)#ip ssh timeout 100
Console(config)#ip ssh authentication-retries 5
Console(config)#
Console#show ip ssh
Information of secure shell
SSH status: enable
SSH authentication timeout: 100
SSH authentication retries: 5
Console#show ssh
Information of secure shell
Session Username Version Encrypt method Negotiation
state
Command Usage
ip ssh server Enables the SSH server on the switch.
The no form command disables the SSH server.
ip ssh {[timeout seconds]
| [authentication-retries
integer]}
Specifies the authentication timeout for the SSH
server and the number of retries allowed by a
client.
The no form command resets the values to the
default.
disconnect ssh
connection_id
Terminates an SSH connection. The connection_id
is the session number displayed when using the
show ssh command.
show ip ssh Displays the status of the SSH server and the
configured values for authentication timeout and
retries.
show ssh Displays the status of current SSH sessions.

12 Addendum to the 3248 and 5224 User’s Guides
www.dell.com | support.dell.com
------- -------- ------- -------------- --------------
---
0 admin 1.5 cipher-3des session-
started
Console#
Authentication Settings
Similar to RADIUS, TACACS+ is a system that uses a central server to
control authentication for access to switches on the network. The RADIUS
Settings page was renamed "Authentication Settings" and updated to
include TACACS+.
The RADIUS system uses User Datagram Protocol (UDP) while TACACS+
uses Transmission Control Protocol (TCP). UDP only offers best-effort
delivery, while TCP offers a connection-oriented transport. Also, note that
RADIUS encrypts only the password in the access-request packet from the
client to the server, while TACACS+ encrypts the entire body of the packet.
Both RADIUS and TACACS+ authentication control management access
using the console port, Web browser, or Telnet. These access options must
be configured on the authentication server together with user names,
passwords, and specific privilege levels for each user name/password pair.
NOTICE: If you are using only a RADIUS server for authentication, you must
configure a special user name on the server for the CLI enable command that
allows access to the Privileged Exe level from the Normal Exe level. The user
name to configure on the RADIUS server for this command is $Enable.
NOTE:
When you are
setting up privilege levels
on a RADIUS or
TACACS+ server, level 0
allows Normal Exec
access to the switch, and
level 15 allows Privileged
Exec access.
The Switch/Security/Authentication Settings page contains the following
fields that can be edited:
•Authentication Sequence— Select the authentication, or
authentication sequence, required: (Default: Local)
–Local — The switch authenticates the user.
–RADIUS — A RADIUS server authenticates the user.
–TACACS — A TACACS+ server authenticates the user.
–Local, RADIUS — The switch attempts to authenticate the user
first, and then a RADIUS server attempts to authenticate the user.

Addendum to the 3248 and 5224 User’s Guides 13
–Local, TACACS — The switch attempts to authenticate the user
first, and then a TACACS+ server attempts to authenticate the
user.
–RADIUS, Local — A RADIUS server attempts to authenticate the
user first, and then the switch attempts to authenticate the user.
–RADIUS, TACACS — A RADIUS server attempts to
authenticate the user first, and then a TACACS+ server attempts
to authenticate the user.
–Local, RADIUS, TACACS — The switch attempts to
authenticate the user first, then a RADIUS server, and then a
TACACS+ server.
–Local, TACACS, RADIUS — The switch attempts to
authenticate the user first, then a TACACS+ server, and then a
RADIUS server.
–RADIUS, Local, TACACS — A RADIUS server attempts to
authenticate the user first, then the switch, and then a TACACS+
server.
–RADIUS, TACACS, Local — A RADIUS server attempts to
authenticate the user first, then a TACACS+ server, and then the
switch.
–TACACS, Local, RADIUS — A TACACS+ server attempts to
authenticate the user first, then the switch, and then a RADIUS
server.
–TACACS, RADIUS, Local — A TACACS+ server attempts to
authenticate the user first, then a RADIUS server, and then the
switch.
•RADIUS Server Settings — If using a RADIUS server, specify the
following details:
–Server IP Address — Identifies the IP address of the RADIUS
server.
–Server Port Number — Identifies the User Datagram Protocol
(UDP) port number used by the RADIUS server.
–Secret Text String — Specifies the text string that is shared
between the switch and the RADIUS server. Do not use blank
spaces in the string.
–Number of Server Transmits — Specifies the number of request
transmits to the RADIUS server before failure.

14 Addendum to the 3248 and 5224 User’s Guides
www.dell.com | support.dell.com
–Timeout for a Reply — Specifies the number of seconds the
switch waits for a reply from the RADIUS server before it resends
the request.
NOTE: The local switch
user database must be set
up through the CLI by
manually entering user
names and passwords.
•TACACS+ Server Settings — If using a TACACS+ server, specify the
following details:
–Server IP Address — Identifies the IP address of the TACACS+
server.
–Server Port Number — Identifies the Transmission Control
Protocol (TCP) port number used by the TACACS+ server.
–Secret Text String — Specifies the text string that is shared
between the switch and the TACACS+ server. Do not use blank
spaces in the string.
To save any changes you make in this page, click Apply Changes. If you do
not want to save the changes, click Refresh.
The following figure is representative of PowerConnect 3248 and 5224.

Addendum to the 3248 and 5224 User’s Guides 15
CLI Commands
The following table summarizes the equivalent CLI commands for items in
the Switch/Security/Authentication Settings page.
NOTE: The default
password for the enable
command is super. The
manager must change the
password.
Example
Console(config)#authentication login local radius
tacacs
Console(config)#radius-server host 192.168.1.25
Console(config)#radius-server port 181
Console(config)#radius-server key green
Console(config)#radius-server retransmit 5
Command Usage
authentication login {radius |
local | tacacs} [tacacs | radius |
local] [local | tacacs | radius]
Defines the login authentication method
and precedence.
radius-server host host_ip_address Specifies the RADIUS server IP address.
radius-server port port_number Sets the RADIUS server UDP port number.
radius-server key key_string Sets the RADIUS encryption key (up to
20 characters).
radius-server retransmit
number_of_retries
Sets the number of times the switch
attempts to authenticate logon access
through the RADIUS server. (The range
is 1–30.)
radius-server timeout
number_of_seconds
Sets the number of seconds the switch waits
for a reply before resending a request. (The
range is 1-65535.)
show radius-server Displays the current configuration of the
RADIUS server parameters.
tacacs-server host host_ip_address Specifies the TACACS+ server IP address.
tacacs-server port port_number Sets the TACACS+ server TCP port
number.
tacacs-server key key_string Sets the TACACS+ encryption key (up to
20 characters).
show tacacs-server Displays the current configuration of the
TACACS+ server parameters.

16 Addendum to the 3248 and 5224 User’s Guides
www.dell.com | support.dell.com
Console(config)#radius-server timeout 10
Console(config)#tacacs-server host 192.168.1.19
Console(config)#tacacs-server port 49
Console(config)#tacacs-server key tiger
Console(config)#
Console#show tacacs-server
Remote TACACS server configuration:
Server IP address: 192.168.1.19
Communication key with radius server: tiger
Server port number: 49
Console#
Hypertext Transfer Protocol, Secure
Use the Switch/Security/HTTPS page to enable the Secure Hypertext
Transfer Protocol (HTTPS) over the Secure Socket Layer (SSL), providing
secure access (for example, an encrypted connection) to the switch’s Web
interface.
Both the HTTP and HTTPS service can be enabled independently on the
switch. However, you cannot configure the HTTP and HTTPS servers to
use the same TCP port. If you change the HTTPS port number, clients
attempting to connect to the HTTPS server must specify the port number
in the URL, in this format: https://device:port_number.
NOTE: If you enable
HTTPS, you must indicate
this in the URL. For
example:
https://device
[:port_number]
The following Web browsers and operating systems currently support
HTTPS:
Web Browser Operating System
Microsoft®Internet Explorer 5.0
or later
Windows®98, Windows NT®(with service
pack 6a), Windows 2000
Netscape Navigator 4.76 or later Windows 98, Windows NT (with service
pack 6a), Windows 2000, Solaris 2.6

Addendum to the 3248 and 5224 User’s Guides 17
When you start HTTPS, the client and server establish a secure encrypted
connection. A padlock icon should appear in the status bar for Internet
Explorer 5.x and Netscape Navigator 4.x.
The Switch/Security/HTTPS page contains the following fields that can be
edited:
•HTTPS Status — Allows you to enable/disable the HTTPS server
feature on the switch. (Default: Enabled)
•HTTPS Port — Specifies the UDP port number used for HTTPS/SSL
connection to the switch’s Web interface. (Default: 443).
To save any changes you make in this page, click Apply Changes. If you do
not want to save the changes, click Refresh.
The following figure is representative of PowerConnect 3248 and 5224.

18 Addendum to the 3248 and 5224 User’s Guides
www.dell.com | support.dell.com
CLI Commands
The following table summarizes the equivalent CLI commands for items in
the Switch/Security/HTTPS page.
Example
Console(config)#ip http secure-server
Console(config)#ip http secure-port 441
Console(config)#
Port Security
Port security is a feature that allows you to configure a switch port with one
or more device Media Access Control (MAC) addresses that are authorized
to access the network through that port.
When port security is enabled on a port, the switch stops learning new
MAC addresses on the specified port. Only incoming traffic with source
addresses already stored in the dynamic or static address table are accepted
as authorized to access the network through that port. If a device with an
unauthorized MAC address attempts to use the switch port, the intrusion is
detected and the switch can automatically take action by disabling the port
and sending a trap message.
To use port security, first allow the switch to dynamically learn the <source
MAC address, VLAN> pair for frames received on a port for an initial
period, and then enable port security to stop address learning. Be sure you
enable the learning function long enough to ensure that all valid VLAN
members are registered on the selected port.
Command Usage
ip http secure-server Enables the HTTPS server on the switch.
The no form command disables the HTTPS server.
ip http secure-port
port_number
Specifies the TCP port number used for HTTPS
connection to the switch’s Web interface.
The no form command restores the default port.
copy tftp https-certificate Copies an HTTPS certificate from an TFTP server
to the switch.

Addendum to the 3248 and 5224 User’s Guides 19
Note that a secure port has the following restrictions:
• It should not be connected to a network interconnection device.
• It cannot be configured as a member of a static trunk.
• It can be configured as an LACP trunk port, but the switch does not
allow the LACP trunk to be encabled.
NOTICE: A port that is already configured as a LACP or static trunk port
cannot be enabled as a secure port.
Switch 3248: Port Security Configuration
On the Ports/Port Security page, you can enable/disable security for any
switch port. For each port number listed in the Port column, you can
configure the following parameters listed by column name on the screen:
•Security Status — Enables or disables port security on the port.
(Default: Disabled)
•Intrusion Shutdown and Trap — Indicates the action to be taken
when a port security violation is detected:
–None: Indicates that no action should be taken. (This is the
default.)
–Trap: Indicates that only an SNMP trap message be sent.
–Shutdown: Indicates that only the port should be disabled.
–Trap and Shutdown: Indicates that the port should be disabled
and an SNMP trap message sent.
NOTICE: If a port is disabled due to a security violation, it must be manually
re-enabled from the Ports/Port Configuration page. See "Switch 3248: Re-
Enabling a Shutdown Port" on page 20.
To save any changes you make in this page, click Apply Changes. If you do
not want to save the changes, click Refresh.

20 Addendum to the 3248 and 5224 User’s Guides
www.dell.com | support.dell.com
The following figure is representative of PowerConnect 3248.
Switch 3248: Re-Enabling a Shutdown Port
If security is enabled on a port and the intrusion action set to Shutdown or
Trap and Shutdown, then a security violation will cause the port to be
disabled. To re-enable a shutdown port, follow these steps:
NOTE: To re-enable a
port using the CLI, use
the no shutdown
command in Interface
Configuration mode.
1Click the Ports/Port Configuration page.
2For the port that is disabled, click the check box in the Admin/Oper
column.
3Click Apply Changes to enable the port.
Switch 3248: CLI Commands
The following table summarizes the equivalent CLI commands for items in
the Ports/Port Security page.
Command Usage
port security [action
{shutdown | trap | trap-
and-shutdown}]
Enables and configures port security on a port.
The no form command resets the values to the
defaults.