Edge-Core ECS4110-28T Programming manual

Management Guide
www.edge-core.com
ECS4110-28T/28P/52T/52P
28/52-Port Gigabit Ethernet
Layer 2+ Switch

M ANAGEMENT G UIDE
ECS4110-28T GIGABIT ETHERNET SWITCH
Layer 2+ Managed Switch
with 24 10/100/1000BASE-T (RJ-45) Ports,
and 4 Gigabit SFP Ports
ECS4110-28P GIGABIT ETHERNET POE SWITCH
Layer 2+ Managed Switch
with 24 10/100/1000BASE-T (RJ-45) PoE Ports,
and 4 Gigabit SFP Ports
ECS4110-52T GIGABIT ETHERNET SWITCH
Layer 2+ Managed Switch
with 48 10/100/1000BASE-T (RJ-45) Ports,
and 4 Gigabit SFP Ports
ECS4110-52P GIGABIT ETHERNET POE SWITCH
Layer 2+ Managed Switch
with 48 10/100/1000BASE-T (RJ-45) PoE Ports,
and 4 Gigabit SFP Ports
E072014/ST-R02
150200000929A

– 5 –
ABOUT THIS GUIDE
PURPOSE This guide gives specific information on how to operate and use the
management functions of the switch.
AUDIENCE The guide is intended for use by network administrators who are
responsible for operating and maintaining network equipment;
consequently, it assumes a basic working knowledge of general switch
functions, the Internet Protocol (IP), and Simple Network Management
Protocol (SNMP).
CONVENTIONS The following conventions are used throughout this guide to show
information:
N OTE : Emphasizes important information or calls your attention to related
features or instructions.
C AUTION : Alerts you to a potential hazard that could cause loss of data, or
damage the system or equipment.
W ARNING : Alerts you to a potential hazard that could cause personal injury.
RELATED PUBLICATIONS The following publication details the hardware features of the switch,
including the physical and performance-related characteristics, and how to
install the switch:
The Installation Guide
Also, as part of the switch’s software, there is an online web-based help
that describes all management related features.

A BOUT T HIS G UIDE
– 6 –
REVISION HISTORY This section summarizes the changes in each revision of this guide.
JULY 2014 RELEASE
This is the second version of this guide. This guide is valid for software
release v1.1.2.0. It includes information on the following changes:
◆Adds information for the ECS4110-28T and ECS4110-28P.
◆Updated information in Table 1, "Key Features," on page 75.
◆Updated information under "Description of Software Features" on
page 76.
◆Updated information in Table 2, "System Defaults," on page 82.
◆Updated information in Table 6, "Switch Main Menu," on page 106.
◆Added the section "Configuring NTP" on page 139.
◆Added the section "Configuring Time Servers" on page 140.
◆Updated description of Media Type under "Configuring by Port List" on
page 156.
◆Added the section "Displaying Transceiver Data" on page 170.
◆Added Timout Mode under "Configuring a Dynamic Trunk" on page 179.
◆Added the section "Configuring Load Balancing" on page 189.
◆Updated information under "Traffic Segmentation" on page 193.
◆Added description of L3 Interface parameter under "Configuring
VLAN Groups" on page 202.
◆Added description of Mask parameter under "Configuring MAC-based
VLANs" on page 227.
◆Added the section "Configuring MAC Address Learning" on page 231.
◆Updated the parameter list under "Configuring Loopback Detection" on
page 242.
◆Added description of BPDU Flooding and Cisco Prestandard Status
parameters under "Configuring Global Settings for STA" on page 243.
◆Added description of BPDU Flooding and Admin Edge Port parameters
under "Configuring Interface Settings for STA" on page 250.
◆Updated the parameter list under "Configuring a Class Map" on
page 288.
◆Updated the paramter list under "Configuring Local/Remote Logon
Authentication" on page 311.

A BOUT T HIS G UIDE
– 7 –
◆Updated the parameter list under "Configuring AAA Accounting" on
page 317.
◆Updated the parameter list under "Configuring AAA Authorization" on
page 323.
◆Updated description of the Access Level parameter under "Configuring
User Accounts" on page 326.
◆Added the section "Setting a Time Range" on page 353.
◆Updated description of Source Address Type and Destination Address
Type parameters under "Configuring an Extended IPv6 ACL" on
page 365.
◆Added Internet Protocol parameter under "Configuring a MAC ACL" on
page 367.
◆Added the section "Configuring ACL Mirroring" on page 372.
◆Added the section "Showing ACL Hardware Counters" on page 374.
◆Added the parameter Allow Zeros under "Configuring Global Settings
for ARP Inspection" on page 376.
◆Updated parameter list under "Configuring Port Security" on page 385.
◆Added the parameter Re-authentication Max Retries under "Configuring
Port Authenticator Settings for 802.1X" on page 390.
◆Updated the parameter list for "DoS Protection" on page 399.
◆Added the section "IPv6 Source Guard" on page 406.
◆Updated the parameter list for "DHCP Snooping Global Configuration"
on page 415.
◆Added the Circuit ID parameter under "Configuring Ports for DHCP
Snooping" on page 417.
◆Added description of time range parameters under "Setting the Port
PoE Power Budget" on page 450.
◆Updated Table 34, "Supported Notification Messages," on page 462.
◆Added the section "Creating SNMP Notification Logs" on page 476 and
"Showing SNMP Statistics" on page 478.
◆Added the sections "Ethernet Ring Protection Switching" on page 495,
"Connectivity Fault Management" on page 520, and "OAM
Configuration" on page 556.
◆Added the Forwarding Priority parameter under "Configuring IGMP
Snooping and Query Parameters" on page 570.

A BOUT T HIS G UIDE
– 8 –
◆Added the sections "Filtering IGMP Query Packets and Multicast Data"
on page 584 and "Displaying IGMP Snooping Statistics" on page 586.
◆Added the section "MLD Snooping (Snooping and Query for IPv6)" on
page 595.
◆Added the section "Configuring MVR Global Settings" on page 605.
◆Updated the parameter list under "Configuring MVR Domain Settings"
on page 607.
◆Added the section "Configuring MVR Group Address Profiles" on
page 608.
◆Updated the parameter list under "Configuring MVR Interface Status"
on page 611.
◆Updated the parameter list under "Displaying MVR Receiver Groups" on
page 616.
◆Added the section "Displaying MVR Statistics" on page 617.
◆Added the section "Multicast VLAN Registration for IPv6" on page 621.
◆Added new parameters under "Configuring IPv6 Interface Settings" on
page 644.
◆Added the section "Specifying a DHCP Client Identifier" on page 669.
◆Added the section "Configuring DHCP Relay Service" on page 671.
◆Added the section "Using the Trace Route Function" on page 684.
◆Added the sections "Configuring Static Routes" on page 691 and
"Displaying the Routing Table" on page 693.
◆Updated syntax for the command "show running-config" on page 729.
◆Added the commands "show watchdog" on page 734 and "watchdog
software" on page 735.
◆Updated syntax for the command "copy" on page 738.
◆Updated syntax for the command "delete" on page 741.
◆Added the command "upgrade opcode reload" on page 745.
◆Added "TFTP Configuration Commands" on page 746.
◆Updated syntax for the command "logging host" on page 761
◆Added "NTP Commands" on page 773.

A BOUT T HIS G UIDE
– 9 –
◆Added the commands "clock summer-time (date)" on page 777, "clock
summer-time (predefined)" on page 778, and "clock summer-time
(recurring)" on page 779.
◆Updated syntax for the command "snmp-server enable traps" on
page 798.
◆Added the commands "snmp-server enable port-traps mac-notification"
on page 801 and "show snmp-server enable port-traps" on page 802.
◆Updated description of syntax for the commands "enable password" on
page 824 and "username" on page 825.
◆Added commands "privilege" on page 827 and "show privilege" on
page 827.
◆Added the commands "tacacs-server retransmit" on page 836 and
"tacacs-server timeout" on page 837.
◆Added the command "accounting commands" on page 844.
◆Updated syntax for the command "show accounting" on page 846
◆Added the command "dot1x max-reauth-req" on page 866.
◆Added the section "PPPoE Intermediate Agent" on page 880.
◆Added the commands "mac-learning" on page 890, "port security
mac-address-as-permanent" on page 893, and ."show port security" on
page 893.
◆Updated syntax and description for the command "ip dhcp snooping
information option" on page 918.
◆Added the command "ip dhcp snooping limit rate" on page 920.
◆Added the command "ip dhcp snooping information option circuit-id" on
page 922.
◆Added the command "clear ip dhcp snooping binding" on page 924.
◆Added the section "DHCPv6 Snooping" on page 926.
◆Updated syntax for "ip source-guard binding" on page 936 and "ip
source-guard max-binding" on page 939.
◆Added the command "ip source-guard mode" on page 940.
◆Added the command "clear ip source-guard binding blocked" on
page 941.
◆Updated syntax for "show ip source-guard binding" on page 942.
◆Added the section "IPv6 Source Guard" on page 943.

A BOUT T HIS G UIDE
– 10 –
◆Added allow-zeros parameter to the command "ip arp inspection
validate" on page 952.
◆Added new commands under the section "Denial of Service Protection"
on page 957.
◆Added new commands under the section "Port-based Traffic
Segmentation" on page 963.
◆Added counter parameter to the commands "ip access-group" on
page 975, "ipv6 access-group" on page 981, and "mac access-group"
on page 987.
◆Updated syntax for the command "permit, deny (MAC ACL)" on
page 984.
◆Updated syntax for the command "show access-group" on page 992.
◆Added the commands "discard" on page 999 and "show discard" on
page 1004.
◆Updated syntax for the command "media-type" on page 1001.
◆Added commands under "Transceiver Threshold Configuration" on
page 1009.
◆Added the commands "port channel load-balance" on page 1022, "lacp
timeout" on page 1029, and "show port-channel load-balance" on
page 1033.
◆Added the commands "power mainpower maximum allocation" on
page 1036 and "show power mainpower" on page 1042.
◆Added access-list parameter to the command "port monitor" on
page 1045.
◆Added the command "spanning-tree system-bpdu-flooding" on
page 1099.
◆Updated description for the command "spanning-tree bpdu-filter" on
page 1103.
◆Updated description for the command "spanning-tree bpdu-guard" on
page 1104.
◆Added block parameter to the command "spanning-tree
loopback-detection action" on page 1108.
◆Added the command "spanning-tree port-bpdu-flooding" on page 1112
and "spanning-tree tc-prop-stop" on page 1114.
◆Updated syntax for the command "show spanning-tree" on page 1116.
◆Added the chapter "ERPS Commands" on page 1119.

A BOUT T HIS G UIDE
– 11 –
◆Included information for configuring a Layer 3 interface with the
command "interface vlan" on page 1157.
◆Added the command "switchport dot1q-tunnel service match cvid" on
page 1168.
◆Updated syntax for the command "show dot1q-tunnel" on page 1171.
◆Added the section "Configuring L2CP Tunneling" on page 1172.
◆Added the section "Configuring VLAN Translation" on page 1176.
◆Added prioirty parameter to the command "protocol-vlan
protocol-group (Configuring Interfaces)" on page 1180.
◆Added mask parameter to the command "mac-vlan" on page 1185.
◆Changed command mode to Global Configuration for the commands
"qos map cos-dscp" on page 1200, "qos map dscp-mutation" on
page 1202, and "qos map phb-queue" on page 1203.
◆Updated syntax for the command "show qos map cos-dscp" on
page 1205, "show qos map dscp-mutation" on page 1205, and "show
qos map phb-queue" on page 1206.
◆Updated syntax for the commands "class-map" on page 1208 and
"match" on page 1210.
◆Added the commands "ip igmp snooping priority" on page 1228, "clear
ip igmp snooping groups dynamic" on page 1242, "clear ip igmp
snooping statistics" on page 1243, "show ip igmp snooping group" on
page 1244, and "show ip igmp snooping statistics" on page 1246.
◆Added the commands "ip igmp authentication" on page 1253, "show ip
igmp authentication" on page 1258, "ip igmp query-drop" on
page 1257, "show ip igmp query-drop" on page 1260, "ip
multicast-data-drop" on page 1257, and "show ip multicast-data-drop"
on page 1261.
◆Added the sections "MLD Snooping" on page 1262, and "MLD Filtering
and Throttling" on page 1272.
◆Modified command set under "MVR for IPv4" on page 1281.
◆Added the section "MVR for IPv6" on page 1303.
◆Added the commands "lldp dot3-tlv mac-phy" on page 1335, "lldp
dot3-tlv poe" on page 1336, and "lldp med-tlv ext-poe" on page 1339.
◆Updated syntax for the command "ip address" on page 1422,
◆Added the commands "ipv6 mtu" on page 1441 and "show ipv6 mtu"
on page 1444.

A BOUT T HIS G UIDE
– 12 –
◆Added the command "traceroute6" on page 1450.
◆Added the commands "ipv6 nd dad attempts" on page 1452, "ipv6 nd
raguard" on page 1454, "show ipv6 nd raguard" on page 1456, and
"ipv6 nd reachable-time" on page 1455.
◆Added the section "ND Snooping" on page 1458.
◆Added the chapter "IP Routing Commands" on page 1467.
JANUARY 2013 RELEASE
This is the first version of this guide. This guide is valid for software release
v1.0.0.0.

– 13 –
CONTENTS
ABOUT THIS GUIDE 5
CONTENTS 13
FIGURES 51
TABLES 65
SECTION I GETTING STARTED 73
1INTRODUCTION 75
Key Features 75
Description of Software Features 76
System Defaults 82
2INITIAL SWITCH CONFIGURATION 85
Connecting to the Switch 85
Configuration Options 85
Required Connections 86
Remote Connections 87
Basic Configuration 87
Console Connection 87
Setting Passwords 88
Setting an IP Address 89
Downloading a Configuration File Referenced by a DHCP Server 95
Enabling SNMP Management Access 96
Managing System Files 99
Saving or Restoring Configuration Settings 99
SECTION II WEB CONFIGURATION 101
3USING THE WEB INTERFACE 103
Connecting to the Web Interface 103

C ONTENTS
– 14 –
Navigating the Web Browser Interface 104
Home Page 104
Configuration Options 105
Panel Display 105
Main Menu 106
4BASIC MANAGEMENT TASKS 123
Displaying System Information 123
Displaying Hardware/Software Versions 125
Configuring Support for Jumbo Frames 126
Displaying Bridge Extension Capabilities 127
Managing System Files 129
Copying Files via FTP/TFTP or HTTP 129
Saving the Running Configuration to a Local File 131
Setting the Start-Up File 132
Showing System Files 132
Automatic Operation Code Upgrade 133
Setting the System Clock 137
Setting the Time Manually 137
Setting the SNTP Polling Interval 138
Configuring NTP 139
Configuring Time Servers 140
Setting the Time Zone 144
Configuring the Console Port 145
Configuring Telnet Settings 146
Displaying CPU Utilization 148
Displaying Memory Utilization 149
Resetting the System 150
5INTERFACE CONFIGURATION 155
Port Configuration 156
Configuring by Port List 156
Configuring by Port Range 158
Displaying Connection Status 159
Configuring Local Port Mirroring 160
Configuring Remote Port Mirroring 162
Showing Port or Trunk Statistics 166
Displaying Transceiver Data 170

C ONTENTS
– 15 –
Configuring Transceiver Thresholds 172
Performing Cable Diagnostics 174
Trunk Configuration 176
Configuring a Static Trunk 177
Configuring a Dynamic Trunk 179
Displaying LACP Port Counters 185
Displaying LACP Settings and Status for the Local Side 187
Displaying LACP Settings and Status for the Remote Side 188
Configuring Load Balancing 189
Saving Power 191
Traffic Segmentation 193
Enabling Traffic Segmentation 193
Configuring Uplink and Downlink Ports 194
VLAN Trunking 196
6 VLAN CONFIGURATION 199
IEEE 802.1Q VLANs 199
Configuring VLAN Groups 202
Adding Static Members to VLANs 205
Configuring Dynamic VLAN Registration 209
IEEE 802.1Q Tunneling 212
Enabling QinQ Tunneling on the Switch 216
Creating CVLAN to SPVLAN Mapping Entries 217
Adding an Interface to a QinQ Tunnel 219
Protocol VLANs 220
Configuring Protocol VLAN Groups 221
Mapping Protocol Groups to Interfaces 222
Configuring IP Subnet VLANs 225
Configuring MAC-based VLANs 227
Configuring VLAN Mirroring 229
7ADDRESS TABLE SETTINGS 231
Configuring MAC Address Learning 231
Setting Static Addresses 233
Changing the Aging Time 234
Displaying the Dynamic Address Table 235
Clearing the Dynamic Address Table 236
Configuring MAC Address Mirroring 237

C ONTENTS
– 16 –
8SPANNING TREE ALGORITHM 239
Overview 239
Configuring Loopback Detection 242
Configuring Global Settings for STA 243
Displaying Global Settings for STA 249
Configuring Interface Settings for STA 250
Displaying Interface Settings for STA 254
Configuring Multiple Spanning Trees 257
Configuring Interface Settings for MSTP 261
9CONGESTION CONTROL 263
Rate Limiting 263
Storm Control 264
Automatic Traffic Control 266
Setting the ATC Timers 268
Configuring ATC Thresholds and Responses 269
10 CLASS OF SERVICE 273
Layer 2 Queue Settings 273
Setting the Default Priority for Interfaces 273
Selecting the Queue Mode 274
Mapping CoS Values to Egress Queues 277
Layer 3/4 Priority Settings 279
Setting Priority Processing to DSCP or CoS 280
Mapping Ingress DSCP Values to Internal DSCP Values 281
Mapping CoS Priorities to Internal DSCP Values 283
11 QUALITY OF SERVICE 287
Overview 287
Configuring a Class Map 288
Creating QoS Policies 291
Attaching a Policy Map to a Port 301
12 VOIP TRAFFIC CONFIGURATION 303
Overview 303
Configuring VoIP Traffic 304
Configuring Telephony OUI 305
Configuring VoIP Traffic Ports 306

C ONTENTS
– 17 –
13 SECURITY MEASURES 309
AAA Authentication, Authorization and Accounting 310
Configuring Local/Remote Logon Authentication 311
Configuring Remote Logon Authentication Servers 312
Configuring AAA Accounting 317
Configuring AAA Authorization 323
Configuring User Accounts 326
Web Authentication 328
Configuring Global Settings for Web Authentication 329
Configuring Interface Settings for Web Authentication 330
Network Access (MAC Address Authentication) 331
Configuring Global Settings for Network Access 333
Configuring Network Access for Ports 334
Configuring Port Link Detection 336
Configuring a MAC Address Filter 337
Displaying Secure MAC Address Information 339
Configuring HTTPS 341
Configuring Global Settings for HTTPS 341
Replacing the Default Secure-site Certificate 342
Configuring the Secure Shell 344
Configuring the SSH Server 347
Generating the Host Key Pair 348
Importing User Public Keys 350
Access Control Lists 352
Setting a Time Range 353
Showing TCAM Utilization 356
Setting the ACL Name and Type 357
Configuring a Standard IPv4 ACL 359
Configuring an Extended IPv4 ACL 360
Configuring a Standard IPv6 ACL 363
Configuring an Extended IPv6 ACL 365
Configuring a MAC ACL 367
Configuring an ARP ACL 369
Binding a Port to an Access Control List 371
Configuring ACL Mirroring 372
Showing ACL Hardware Counters 374

C ONTENTS
– 18 –
ARP Inspection 375
Configuring Global Settings for ARP Inspection 376
Configuring VLAN Settings for ARP Inspection 378
Configuring Interface Settings for ARP Inspection 380
Displaying ARP Inspection Statistics 381
Displaying the ARP Inspection Log 382
Filtering IP Addresses for Management Access 383
Configuring Port Security 385
Configuring 802.1X Port Authentication 387
Configuring 802.1X Global Settings 389
Configuring Port Authenticator Settings for 802.1X 390
Configuring Port Supplicant Settings for 802.1X 394
Displaying 802.1X Statistics 396
DoS Protection 399
IPv4 Source Guard 401
Configuring Ports for IPv4 Source Guard 401
Configuring Static Bindings for IPv4 Source Guard 403
Displaying Information for Dynamic IPv4 Source Guard Bindings 405
IPv6 Source Guard 406
Configuring Ports for IPv6 Source Guard 406
Configuring Static Bindings for IPv6 Source Guard 409
Displaying Information for Dynamic IPv6 Source Guard Bindings 411
DHCP Snooping 412
DHCP Snooping Global Configuration 415
DHCP Snooping VLAN Configuration 416
Configuring Ports for DHCP Snooping 417
Displaying DHCP Snooping Binding Information 418
14 BASIC ADMINISTRATION PROTOCOLS 421
Configuring Event Logging 422
System Log Configuration 422
Remote Log Configuration 424
Sending Simple Mail Transfer Protocol Alerts 425
Link Layer Discovery Protocol 427
Setting LLDP Timing Attributes 427
Configuring LLDP Interface Attributes 429
Configuring LLDP Interface Civic-Address 433

C ONTENTS
– 19 –
Displaying LLDP Local Device Information 435
Displaying LLDP Remote Device Information 438
Displaying Device Statistics 446
Power over Ethernet 448
Setting the Switch’s Overall PoE Power Budget 449
Setting the Port PoE Power Budget 450
Simple Network Management Protocol 452
Configuring Global Settings for SNMP 454
Setting the Local Engine ID 456
Specifying a Remote Engine ID 457
Setting SNMPv3 Views 458
Configuring SNMPv3 Groups 461
Setting Community Access Strings 466
Configuring Local SNMPv3 Users 467
Configuring Remote SNMPv3 Users 469
Specifying Trap Managers 472
Creating SNMP Notification Logs 476
Showing SNMP Statistics 478
Remote Monitoring 480
Configuring RMON Alarms 481
Configuring RMON Events 483
Configuring RMON History Samples 485
Configuring RMON Statistical Samples 488
Switch Clustering 490
Configuring General Settings for Clusters 491
Cluster Member Configuration 492
Managing Cluster Members 494
Ethernet Ring Protection Switching 495
ERPS Global Configuration 499
ERPS Ring Configuration 500
ERPS Forced and Manual Mode Operations 516
Connectivity Fault Management 520
Configuring Global Settings for CFM 523
Configuring Interfaces for CFM 527
Configuring CFM Maintenance Domains 527
Configuring CFM Maintenance Associations 532

C ONTENTS
– 20 –
Configuring Maintenance End Points 537
Configuring Remote Maintenance End Points 538
Transmitting Link Trace Messages 540
Transmitting Loop Back Messages 542
Transmitting Delay-Measure Requests 544
Displaying Local MEPs 546
Displaying Details for Local MEPs 547
Displaying Local MIPs 548
Displaying Remote MEPs 549
Displaying Details for Remote MEPs 550
Displaying the Link Trace Cache 552
Displaying Fault Notification Settings 554
Displaying Continuity Check Errors 555
OAM Configuration 556
Enabling OAM on Local Ports 556
Displaying Statistics for OAM Messages 559
Displaying the OAM Event Log 560
Displaying the Status of Remote Interfaces 561
Configuring a Remote Loop Back Test 562
Displaying Results of Remote Loop Back Testing 564
15 MULTICAST FILTERING 567
Overview 567
Layer 2 IGMP (Snooping and Query for IPv4) 568
Configuring IGMP Snooping and Query Parameters 570
Specifying Static Interfaces for a Multicast Router 574
Assigning Interfaces to Multicast Services 576
Setting IGMP Snooping Status per Interface 578
Filtering IGMP Query Packets and Multicast Data 584
Displaying Multicast Groups Discovered by IGMP Snooping 585
Displaying IGMP Snooping Statistics 586
Filtering and Throttling IGMP Groups 590
Enabling IGMP Filtering and Throttling 590
Configuring IGMP Filter Profiles 591
Configuring IGMP Filtering and Throttling for Interfaces 593
MLD Snooping (Snooping and Query for IPv6) 595
Configuring MLD Snooping and Query Parameters 595