Edge-Core ECS4660-28F Programming manual

Management Guide
www.edge-core.com
ECS4660-28F Layer 3
Gigabit Ethernet Switch

M ANAGEMENT G UIDE
ECS4660-28F GIGABIT ETHERNET SWITCH
Layer 3 Switch
with 24 Gigabit Ethernet Ports (SFP),
2 10G Ethernet Ports (XSFP), and
2 Slots for Optional 10G Modules
ECS4660-28F
E102013/ST-R03
149100000140A

– 5 –
ABOUT THIS GUIDE
PURPOSE This guide gives specific information on how to operate and use the
management functions of the switch.
AUDIENCE The guide is intended for use by network administrators who are
responsible for operating and maintaining network equipment;
consequently, it assumes a basic working knowledge of general switch
functions, the Internet Protocol (IP), and Simple Network Management
Protocol (SNMP).
CONVENTIONS The following conventions are used throughout this guide to show
information:
N OTE : Emphasizes important information or calls your attention to related
features or instructions.
C AUTION : Alerts you to a potential hazard that could cause loss of data, or
damage the system or equipment.
W ARNING : Alerts you to a potential hazard that could cause personal injury.
RELATED PUBLICATIONS The following publication details the hardware features of the switch,
including the physical and performance-related characteristics, and how to
install the switch:
The Installation Guide
Also, as part of the switch’s software, there is an online web-based help
that describes all management related features.

A BOUT T HIS G UIDE
– 6 –
REVISION HISTORY This section summarizes the changes in each revision of this guide.
OCTOBER 2013 REVISION
This is the third release of this guide. This guide is valid for software
release V1.2.2.0. It includes information on the following changes:
◆Updated information in Parameters section under "Configuring the
Console Port" on page 172.
◆Updated information in Parameters section under "Configuring Telnet
Settings" on page 174.
◆Updated Command Usage and Parameters sections under "Configuring
by Port List" on page 182.
◆Updated descriptive text under "Configuring by Port Range" on
page 184.
◆Added "Configuring History Sampling" on page 196.
◆Temporarily removed “Sampling Traffic Flows.”
◆Updated Parameters section under "Enabling QinQ Tunneling on the
Switch" on page 247.
◆Added "Creating CVLAN to SPVLAN Mapping Entries" on page 248.
◆Added "Mapping Ingress DSCP Values to Internal DSCP Values" on
page 314.
◆Updated Command Usage and Parameters sections under "Attaching a
Policy Map to a Port" on page 339.
◆Updated Parameters section under "Binding a Port to an Access Control
List" on page 408.
◆Updated Parameters section under "Configuring Global Settings for ARP
Inspection" on page 411.
◆Added "DoS Protection" on page 431.
◆Added "IPv6 Source Guard" on page 438.
◆Updated Table 34, "Supported Notification Messages," on page 490.
◆Updated Parameters section under "Configuring IGMP Snooping and
Query Parameters" on page 613.
◆Updated Parameters section under "Configuring MVR Domain Settings"
on page 660.
◆Updated Parameters section under "Configuring MVR6 Domain
Settings" on page 677.

A BOUT T HIS G UIDE
– 7 –
◆Updated Parameters section under "Using the Trace Route Function" on
page 746.
◆Added commands "show watchdog" on page 909 and "watchdog
software" on page 909.
◆Updated syntax for command "delete" on page 917.
◆Updated range for command "exec-timeout" on page 925.
◆Added the commands "clock summer-time (date)" on page 951, "clock
summer-time (predefined)" on page 953, and "clock summer-time
(recurring)" on page 954.
◆Updated displayed data for the command "show snmp" on page 999.
◆Updated syntax for "snmp-server enable traps" on page 1000.
◆Added the command "snmp-server enable port-traps mac-notification"
on page 1003 and "show snmp-server enable port-traps" on
page 1004.
◆Updated the command under "Flow Sampling Commands" on
page 1025.
◆Updated syntax for the command "ip source-guard binding" on
page 1134, "ip source-guard max-binding" on page 1137, and "show ip
source-guard binding" on page 1139.
◆Added the commands "ip source-guard mode" on page 1138 and "clear
ip source-guard binding blocked" on page 1138.
◆Updated syntax for the command "ip arp inspection validate" on
page 1149.
◆Updated syntax for the command "traffic-segmentation uplink/
downlink" on page 1159.
◆Updated syntax for the command "ip access-group" on page 1168,
"ipv6 access-group" on page 1174, and "mac access-group" on
page 1179.
◆Added the command "clear access-list hardware counters" on
page 1184.
◆Updated syntax for the command "show access-list" on page 1185.
◆Updated syntax and command usage sections for the command
"capabilities" on page 1189.
◆Added the command "discard" on page 1191 and "show discard" on
page 1197.
◆Updated information for the command "media-type" on page 1193.

A BOUT T HIS G UIDE
– 8 –
◆Updated command usage section for the command "negotiation" on
page 1194.
◆Removed the command “speed-duplex.”
◆Moved the switchport packet-rate command from Interface Commands
chapter to Congestion Control Commands on page 1241.
◆Added the commands "transceiver-threshold-auto" on page 1205, and
"transceiver-threshold-monitor" on page 1206.
◆Updated description of all other transceiver threshold command from
page 1206 to page 1212.
◆Added "Loopback Detection Commands" on page 1259.
◆Added the command "spanning-tree tc-prop-stop" on page 1300.
◆Updated introductory text and command usage section for the
command "interface vlan" on page 1345.
◆Updated syntax for the command "show queue mode" on page 1391.
◆Updated syntax for the command "show qos map ip-port-dscp" on
page 1403.
◆Added the command "ip igmp snooping priority" on page 1428.
◆Added the commands "ip igmp authentication" on page 1451 and
"show ip igmp authentication" on page 1456.
◆Added "MLD Filtering and Throttling" on page 1469.
◆Added the command "mvr priority" on page 1482.
◆Added the commands "clear mvr6 groups" on page 1506 and "clear
mvr6 statistics" on page 1507.
◆Updated TTL range for the command "ethernet cfm linktrace" on
page 1592.
◆Added command "clear efm oam event-log" on page 1608.
◆Added information about configuring an address for tunnels in the
command "ipv6 address" on page 1665, and "ipv6 address eui-64" on
page 1667.
◆Updated syntax for the command "traceroute6" on page 1681.
◆Added the commands "ipv6 nd managed-config-flag" on page 1685,
"ipv6 nd other-config-flag" on page 1686, "ipv6 nd prefix" on
page 1690, "ipv6 nd ra interval" on page 1691, "ipv6 nd ra lifetime" on
page 1692, "ipv6 nd ra router-preference" on page 1692, and "ipv6 nd
ra suppress" on page 1693.

A BOUT T HIS G UIDE
– 9 –
NOVEMBER 2012 REVISION
This is the second release of this guide. This guide is valid for software
release V1.2.0.0. It includes information on the following changes:
◆Removed information on Option 43 in "Downloading a Configuration File
Referenced by a DHCP Server" on page 115.
◆Updated parameter description in "Displaying Hardware/Software
Versions" on page 151.
◆Updated web page for "Setting the Time Zone" on page 171.
◆Updated parameter description in "Resetting the System" on page 177.
◆Added "Configuring Remote Port Mirroring" on page 188.
◆Added “Timeout Mode” under "Configuring a Dynamic Trunk" on
page 207.
◆Updated parameter list under "Configuring VLAN Groups" on page 228.
◆Added "Configuring VLAN Translation" on page 259.
◆Added parameters under "Configuring Loopback Detection" on
page 274.
◆Added parameters under "Configuring a Class Map" on page 326.
◆Updated parameters under "Configuring AAA Authorization" on
page 360.
◆Added parameters under "DHCP Snooping Configuration" on page 446.
◆Added parameter under "Configuring Ports for DHCP Snooping" on
page 449.
◆Added parameters under "Configuring LLDP Interface Attributes" on
page 461.
◆Added parameters under "Displaying LLDP Remote Device Information"
on page 470.
◆Added sfpThresholdAlarmWarnTrap to Table 34, "Supported Notification
Messages," on page 490.
◆Updated description for ERPS version 2 under "Ethernet Ring Protection
Switching" on page 523.
◆Added "PTP Configuration" on page 594.
◆Added parameters under "Configuring MVR Global Settings" on
page 658.

A BOUT T HIS G UIDE
– 10 –
◆Added parameters under "Configuring MVR6 Global Settings" on
page 675.
◆Added RA Mode under "Configuring IPv6 Interface Settings" on
page 697.
◆Updated Command Usage section under "Specifying a DHCP Client
Identifier" on page 720.
◆Added "Configuring the PPPoE Intermediate Agent" on page 735.
◆Added IPv6 information under "Enabling Multicast Routing Globally" on
page 828 and "Displaying the Multicast Routing Table" on page 829.
◆Added information on PIM6-SM under "Configuring PIMv6 for IPv6" on
page 849.
◆Added information on PIM6-SM "Configuring PIMv6 Interface Settings"
on page 850.
◆Added "Configuring Global PIM6-SM Settings" on page 856.
◆Added "Configuring a PIM6 BSR Candidate" on page 858.
◆Added "Configuring a PIM6 Static Rendezvous Point" on page 859.
◆Added "Configuring a PIM6 RP Candidate" on page 861.
◆Added "Displaying the PIM6 BSR Router" on page 863.
◆Added "Displaying RP Mapping" on page 865.
◆Added "ptp e-latency" on page 962.
◆Added "ptp in-latency" on page 963.
◆Added "Synchronous Ethernet" on page 979.
◆Added "DHCPv6 Snooping" on page 1126.
◆Added "IPv6 Source Guard" on page 1140.
◆Added "lacp timeout" on page 1223.
◆Added "RSPAN Mirroring Commands" on page 1231.
◆Updated command set for ERPS under "ERPS Commands" on
page 1305.
◆Added RSPAN parameter to "vlan" on page 1344.
◆Added "Configuring VLAN Translation" on page 1364.

A BOUT T HIS G UIDE
– 11 –
◆Updated parameter description for "ethernet cfm cc ma interval" on
page 1581.
◆Updated Command Usage section for "ip dhcp client class-id" on
page 1625.
◆Added "ipv6 nd raguard" on page 1688.
◆Added "IPv6 to IPv4 Tunnels" on page 1696.
◆Updated parameter description for "show ip route" on page 1726.
◆Added “tunnel” parameter to "ipv6 route" on page 1730.
◆Added "Border Gateway Protocol (BGPv4)" on page 1818.
◆Added "Policy-based Routing for BGP" on page 1897.
◆Updated Command Usage section under "router pim6" on page 1951.
◆Updated Command Usage section under "ipv6 pim" on page 1951.
MARCH 2012 REVISION
This is the first version of this guide. This guide is valid for software release
V1.0.0.0.

A BOUT T HIS G UIDE
– 12 –

– 13 –
CONTENTS
ABOUT THIS GUIDE 5
CONTENTS 13
FIGURES 65
TABLES 81
SECTION I GETTING STARTED 91
1INTRODUCTION 93
Key Features 93
Description of Software Features 95
IP Routing 99
Equal-cost Multipath Load Balancing 100
Address Resolution Protocol 100
System Defaults 102
2INITIAL SWITCH CONFIGURATION 105
Connecting to the Switch 105
Configuration Options 105
Required Connections 106
Remote Connections 107
Basic Configuration 108
Console Connection 108
Setting Passwords 108
Setting an IP Address 109
Downloading a Configuration File Referenced by a DHCP Server 115
Enabling SNMP Management Access 116
Managing System Files 119
Saving or Restoring Configuration Settings 119

C ONTENTS
– 14 –
SECTION II WEB CONFIGURATION 121
3USING THE WEB INTERFACE 123
Connecting to the Web Interface 123
Navigating the Web Browser Interface 124
Home Page 124
Configuration Options 125
Panel Display 125
Main Menu 126
4BASIC MANAGEMENT TASKS 149
Displaying System Information 149
Displaying Hardware/Software Versions 151
Configuring Support for Jumbo Frames 152
Displaying Bridge Extension Capabilities 153
Managing System Files 155
Copying Files via FTP/TFTP or HTTP 155
Saving the Running Configuration to a Local File 157
Setting The Start-Up File 158
Showing System Files 159
Automatic Operation Code Upgrade 160
Setting the System Clock 164
Setting the Time Manually 164
Setting the SNTP Polling Interval 165
Configuring NTP 166
Configuring Time Servers 167
Setting the Time Zone 171
Configuring the Console Port 172
Configuring Telnet Settings 174
Displaying CPU Utilization 175
Displaying Memory Utilization 176
Resetting the System 177
5INTERFACE CONFIGURATION 181
Port Configuration 182
Configuring by Port List 182
Configuring by Port Range 184
Displaying Connection Status 185

C ONTENTS
– 15 –
Configuring Local Port Mirroring 186
Configuring Remote Port Mirroring 188
Showing Port or Trunk Statistics 192
Configuring History Sampling 196
Displaying Transceiver Data 200
Configuring Transceiver Thresholds 201
Trunk Configuration 204
Configuring a Static Trunk 205
Configuring a Dynamic Trunk 207
Displaying LACP Port Counters 213
Displaying LACP Settings and Status for the Local Side 214
Displaying LACP Settings and Status for the Remote Side 216
Configuring Load Balancing 217
Traffic Segmentation 219
Enabling Traffic Segmentation 219
Configuring Uplink and Downlink Ports 220
VLAN Trunking 222
6 VLAN CONFIGURATION 225
IEEE 802.1Q VLANs 225
Configuring VLAN Groups 228
Adding Static Members to VLANs 231
Configuring Dynamic VLAN Registration 235
Private VLANs 238
Creating Private VLANs 239
Associating Private VLANs 240
Configuring Private VLAN Interfaces 242
IEEE 802.1Q Tunneling 243
Enabling QinQ Tunneling on the Switch 247
Creating CVLAN to SPVLAN Mapping Entries 248
Adding an Interface to a QinQ Tunnel 250
Protocol VLANs 251
Configuring Protocol VLAN Groups 252
Mapping Protocol Groups to Interfaces 253
Configuring IP Subnet VLANs 256
Configuring MAC-based VLANs 258
Configuring VLAN Translation 259

C ONTENTS
– 16 –
7ADDRESS TABLE SETTINGS 263
Configuring MAC Address Learning 263
Setting Static Addresses 265
Changing the Aging Time 267
Displaying the Dynamic Address Table 268
Clearing the Dynamic Address Table 269
8SPANNING TREE ALGORITHM 271
Overview 271
Configuring Loopback Detection 274
Configuring Global Settings for STA 276
Displaying Global Settings for STA 281
Configuring Interface Settings for STA 282
Displaying Interface Settings for STA 286
Configuring Multiple Spanning Trees 289
Configuring Interface Settings for MSTP 293
9CONGESTION CONTROL 295
Rate Limiting 295
Storm Control 296
Automatic Traffic Control 298
Setting the ATC Timers 300
Configuring ATC Thresholds and Responses 301
10 CLASS OF SERVICE 305
Layer 2 Queue Settings 305
Setting the Default Priority for Interfaces 305
Selecting the Queue Mode 306
Mapping CoS Values to Egress Queues 309
Layer 3/4 Priority Settings 312
Setting Priority Processing to IP Precedence/DSCP or CoS 312
Mapping Ingress DSCP Values to Internal DSCP Values 314
Mapping CoS Priorities to Internal DSCP Values 316
Mapping Internal DSCP Values to Egress CoS Values 318
Mapping IP Precedence Values to Internal DSCP Values 320
Mapping IP Port Priority to Internal DSCP Values 323
11 QUALITY OF SERVICE 325
Overview 325
Configuring a Class Map 326

C ONTENTS
– 17 –
Creating QoS Policies 329
Attaching a Policy Map to a Port 339
12 VOIP TRAFFIC CONFIGURATION 341
Overview 341
Configuring VoIP Traffic 342
Configuring Telephony OUI 343
Configuring VoIP Traffic Ports 345
13 SECURITY MEASURES 347
AAA Authorization and Accounting 348
Configuring Local/Remote Logon Authentication 349
Configuring Remote Logon Authentication Servers 350
Configuring AAA Accounting 355
Configuring AAA Authorization 360
Configuring User Accounts 363
Web Authentication 365
Configuring Global Settings for Web Authentication 366
Configuring Interface Settings for Web Authentication 367
Network Access (MAC Address Authentication) 368
Configuring Global Settings for Network Access 371
Configuring Network Access for Ports 372
Configuring Port Link Detection 374
Configuring a MAC Address Filter 375
Displaying Secure MAC Address Information 377
Configuring HTTPS 378
Configuring Global Settings for HTTPS 378
Replacing the Default Secure-site Certificate 380
Configuring the Secure Shell 381
Configuring the SSH Server 384
Generating the Host Key Pair 385
Importing User Public Keys 387
Access Control Lists 389
Setting a Time Range 391
Showing TCAM Utilization 394
Setting the ACL Name and Type 395
Configuring a Standard IPv4 ACL 397
Configuring an Extended IPv4 ACL 398

C ONTENTS
– 18 –
Configuring a Standard IPv6 ACL 400
Configuring an Extended IPv6 ACL 402
Configuring a MAC ACL 404
Configuring an ARP ACL 406
Binding a Port to an Access Control List 408
Showing ACL Hardware Counters 409
ARP Inspection 410
Configuring Global Settings for ARP Inspection 411
Configuring VLAN Settings for ARP Inspection 413
Configuring Interface Settings for ARP Inspection 415
Displaying ARP Inspection Statistics 416
Displaying the ARP Inspection Log 417
Filtering IP Addresses for Management Access 418
Configuring Port Security 420
Configuring 802.1X Port Authentication 423
Configuring 802.1X Global Settings 424
Configuring Port Authenticator Settings for 802.1X 425
Displaying 802.1X Statistics 429
DoS Protection 431
IPv4 Source Guard 432
Configuring Ports for IP Source Guard 433
Configuring Static Bindings for IP Source Guard 435
Displaying Information for Dynamic IPv4 Source Guard Bindings 437
IPv6 Source Guard 438
Configuring Ports for IPv6 Source Guard 438
Configuring Static Bindings for IPv6 Source Guard 440
Displaying Information for Dynamic IPv6 Source Guard Bindings 443
DHCP Snooping 444
DHCP Snooping Configuration 446
DHCP Snooping VLAN Configuration 448
Configuring Ports for DHCP Snooping 449
Displaying DHCP Snooping Binding Information 450
14 BASIC ADMINISTRATION PROTOCOLS 453
Configuring Event Logging 454
System Log Configuration 454
Remote Log Configuration 456

C ONTENTS
– 19 –
Sending Simple Mail Transfer Protocol Alerts 457
Link Layer Discovery Protocol 458
Setting LLDP Timing Attributes 459
Configuring LLDP Interface Attributes 461
Configuring LLDP Interface Civic-Address 464
Displaying LLDP Local Device Information 466
Displaying LLDP Remote Device Information 470
Displaying Device Statistics 478
Simple Network Management Protocol 480
Configuring Global Settings for SNMP 482
Setting the Local Engine ID 483
Specifying a Remote Engine ID 484
Setting SNMPv3 Views 486
Configuring SNMPv3 Groups 489
Setting Community Access Strings 494
Configuring Local SNMPv3 Users 495
Configuring Remote SNMPv3 Users 497
Specifying Trap Managers 500
Creating SNMP Notification Logs 504
Showing SNMP Statistics 506
Remote Monitoring 508
Configuring RMON Alarms 509
Configuring RMON Events 511
Configuring RMON History Samples 513
Configuring RMON Statistical Samples 516
Switch Clustering 518
Configuring General Settings for Clusters 519
Cluster Member Configuration 520
Managing Cluster Members 522
Ethernet Ring Protection Switching 523
ERPS Global Configuration 527
ERPS Ring Configuration 528
ERPS Forced and Manual Mode Operations 544
Connectivity Fault Management 548
Configuring Global Settings for CFM 551
Configuring Interfaces for CFM 555

C ONTENTS
– 20 –
Configuring CFM Maintenance Domains 555
Configuring CFM Maintenance Associations 560
Configuring Maintenance End Points 565
Configuring Remote Maintenance End Points 567
Transmitting Link Trace Messages 569
Transmitting Loop Back Messages 571
Transmitting Delay-Measure Requests 572
Displaying Local MEPs 574
Displaying Details for Local MEPs 575
Displaying Local MIPs 577
Displaying Remote MEPs 578
Displaying Details for Remote MEPs 579
Displaying the Link Trace Cache 581
Displaying Fault Notification Settings 583
Displaying Continuity Check Errors 584
OAM Configuration 585
Enabling OAM on Local Ports 585
Displaying Statistics for OAM Messages 588
Displaying the OAM Event Log 589
Displaying the Status of Remote Interfaces 590
Configuring a Remote Loop Back Test 591
Displaying Results of Remote Loop Back Testing 593
PTP Configuration 594
Configuring Global Settings for PTP 595
Configuring Interface Settings for PTP 598
Showing PTP Information 602
Showing PTP Foreign Master 607
15 MULTICAST FILTERING 609
Overview 609
IGMP Protocol 611
Layer 2 IGMP (Snooping and Query for IPv4) 611
Configuring IGMP Snooping and Query Parameters 613
Specifying Static Interfaces for an IPv4 Multicast Router 617
Assigning Interfaces to IPv4 Multicast Services 619
Setting IGMP Snooping Status per Interface 621
Filtering IGMP Query Packets and Multicast Data 627