Enterasys SmartSwitch 2200 Owner's manual

802.1Q VLAN User’s Guide
Local Management Supplement
9033135-02

NOTICE
Enterasys Networks reserves the right to make changes in specifications and other information contained in this
document and its web site without prior notice. The reader should in all cases consult Enterasys Networks to determine
whether any such changes have been made.
The hardware, firmware, or software described in this document is subject to change without notice.
IN NO EVENT SHALL Enterasys Networks BE LIABLE FOR ANY INCIDENTAL, INDIRECT, SPECIAL, OR
CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING BUT NOT LIMITED TO LOST PROFITS)
ARISING OUT OF OR RELATED TO THIS DOCUMENT, WEB SITE, OR THE INFORMATION CONTAINED IN
THEM, EVEN IF Enterasys Networks HAS BEEN ADVISED OF, KNEW OF, OR SHOULD HAVE KNOWN OF,
THE POSSIBILITY OF SUCH DAMAGES.
Enterasys Networks, Inc.
35 Industrial Way
Rochester, NH 03867
© 2003 Enterasys Networks, Inc. All rights reserved.
Printed in the United States of America.
Order Number: 9033135-02 January 2003
LANVIEW is a registered trademark and Enterasys Networks, NETSIGHT, MATRIX, WEBVIEW, and any logos
associated therewith, are trademarks of Enterasys Networks, Inc. in the United States and other countries.
All other product names mentioned in this manual may be trademarks or registered trademarks of their respective
companies.
Version: Information in this guide refers to firmware version 3.x and 4.x only.
It does not refer to firmware version 5.x.
This guide applies to 2X2XX, 6X2XX, and 6X3XX Ethernet switch
devices only.

Contents iii
Contents
1INTRODUCTION
1.1 Using This Supplement ................................................................................... 1-2
1.2 Structure of This Document ............................................................................ 1-2
1.3 Overview of the Revision ................................................................................ 1-2
2LOCAL MANAGEMENT SCREENS
2.1 Revised Hierarchy........................................................................................... 2-1
2.2 Screen Format ................................................................................................ 2-1
2.3 VLAN Classification Configuration Screen...................................................... 2-2
2.3.1 Classification Precedence Rules .................................................... 2-8
2.3.2 Displaying the Current VID/Classification Assignments................ 2-11
2.3.3 Assigning a Classification to a VID ............................................... 2-11
2.3.4 Deleting Line Items ....................................................................... 2-12
2.4 Protocol Port Configuration Screen............................................................... 2-13
2.4.1 Assigning Ports to a Classification Rule ....................................... 2-15
3CONFIGURATION EXAMPLES
3.1 Example 4, Isolating Network Traffic According to Protocol ........................... 3-1
3.1.1 Solving the Problem........................................................................ 3-2
3.2 Example 5, Filtering Traffic According to a Layer 4 Classification Rule.......... 3-5
3.2.1 Solving the Problem........................................................................ 3-6
3.3 Example 6, Securing Sensitive Information According to Subnet ................... 3-6
3.3.1 Solving the Problem........................................................................ 3-7
INDEX

iv Figures
Figure Page
Figures
2-1 802.1Q VLAN Screen Hierarchy..................................................................................... 2-1
2-2 Example of a Local Management Screen ....................................................................... 2-2
2-3 VLAN Classification Configuration Screen...................................................................... 2-3
2-4 Protocol Port Configuration Screen .............................................................................. 2-13
3-1 Example 4, Isolating Traffic According to Protocol ......................................................... 3-2
3-2 Example 5, Filtering Traffic According to a Classification ............................................... 3-5
3-3 Example 6, Securing Traffic to One Subnet.................................................................... 3-7

Ta bl e s vTa bl e s v
Tabl e Page
Tables
2-1 Classification List..........................................................................................................2-4
2-2 Classification Precedence ............................................................................................2-9

Introduction 1-1
1
Introduction
The firmware in the SmartSwitch 2200 standalone devices and SmartSwitch 6000 modules has
been revised up to 3.10.xx and 3.11.xx. This document provides the following changes and
additions to the 802.1Q VLAN User’s Guide (9032599-03) as a result of both firmware revisions.
Changes Due to Revision 3.10.xx
•A replacement drawing for the 802.1Q VLAN Screen Hierarchy in the user’s guide that shows
the screens of the hierarchy that were affected.
•Descriptions of the new VLAN Classification Configuration screen and the Protocol Port
Configuration screen, which replace the current descriptions of the Protocol VLAN
Configuration screen and the Protocol Port Configuration screen, respectively. Also included is
information about protocol Classification Preference Rules.
•A revised Example 4 and two new examples (5 and 6), which show how the new screens can be
applied to configure a network.
Change Due to Revision 3.11.xx
The procedure was changed to mark and delete one or more line items in the VLAN Classification
Configuration screen.
IMPORTANT NOTICE
Information in this guide refers to firmware version 3.x and 4.x only. It does not refer to firmware
version 5.x.
This guide applies to 2X2XX, 6X2XX, and 6X3XX Ethernet switch devices only.

Using This Supplement
1-2 Introduction
1.1 USING THIS SUPPLEMENT
Read through this supplement completely to gain an understanding of the new capabilities
introduced by the new firmware and how to take full advantage of them when configuring your
SmartSwitch device.
1.2 STRUCTURE OF THIS DOCUMENT
This document is organized as follows:
Chapter 1, Introduction – Describes the scope of this supplement and identifies the user’s guides
that are affected. Provides an overview of the new functions introduced by the 03.10.xx and
03.11.xx firmware revisions and an overview of what an administrator should consider when
configuring SmartSwitch devices in the network.
Chapter 2, Local Management Screens – Describes the new VLAN Classification Configuration
screen, the replacement Protocol Port Configuration screen, and the Classification Preference
Rules, which must be considered before configuring the SmartSwitch device.
Chapter 3, Configuration Examples – Provides three examples of how to contain, filter, and
secure traffic in a network using the new screens.
1.3 OVERVIEW OF THE REVISION
Firmware revisions for the SmartSwitch 2200/6000 series devices allow network administrators to
classify frames received by the switch based on specific Layer 2, 3, and 4 information. The
classification is used for two independent functions:
•Create 802.1Q VLANs based on information contained in Layers 2 through 4 of the received
frames.
•Prioritize traffic throughout the network using the 802.1p frame tagging method.
These new functions translate into the following four key features:
Traffic Containment
Broadcast intensive protocols such as IPX and AppleTalk can be confined to the intended users,
servers, and segments by creating VLANs specifically for that purpose.
NOTE: Since this document applies to several SmartSwitch models, the term
SmartSwitch device is used in the following text instead of a particular model number.

Overview of the Revision
Introduction 1-3
Traffic Filtering
Any unwanted protocol types, possibly originating from a shared segment, can be filtered-out of
the switched network altogether by disallowing that protocol at the ingress switch port (port
receiving the frames).
Traffic Security
Any well-known or proprietary protocol can be confined to authorized switched ports/users.
Traffic Prioritization
Business-critical services can be given priority over lower priority applications such as email. For
information on how to set priorities, refer to the Local Management Guide for your device.

Local Management Screens 2-1
2
Local Management Screens
This chapter describes the new VLAN Classification Configuration screen and the revised Port
Protocol Configuration screen that replace the Protocol VLAN Configuration and Protocol Port
Configuration screens, respectively, in the 802.1Q VLAN User’s Guide (PN 9032599-03).
2.1 REVISED HIERARCHY
The 802.1Q VLAN Configuration Menu screen hierarchy has changed as shown in Figure 2-1.
Figure 2-1 802.1Q VLAN Screen Hierarchy
2.2 SCREEN FORMAT
Since the top part of the screen contains the same type of information (the name of the screen, the
SmartSwitch model number, the firmware revision, and the BOOT PROM revision), it is not
shown in the following descriptions of the screens. The name of the screen is in the figure title for
each screen. Figure 2-2 shows an example of the fields in a screen.
802.1Q VLAN
Configuration Menu
Device VLAN Configuration
Port Assignment Configuration
VLAN Forwar ing Configuration
25995_03
Port Filtering Configuration
Protocol Port Configuration
Note:
In icates area of change.
VLAN Classification Configuration

VLAN Classification Configuration Screen
2-2 Local Management Screens
Figure 2-2 Example of a Local Management Screen
2.3 VLAN CLASSIFICATION CONFIGURATION SCREEN
The VLAN Classification Configuration screen, Figure 2-3, is used to do the following:
•Display the VLAN ID (VID), Protocol Classification, and Description of each classification of
the current entries
•Assign VLANs according to Classification rules
•Add/delete a VID and associated classification entry
•Access the Protocol Port Configuration screen
Firmware Revision: XX.XX.XX
General Configuration
29711_14
BOOTPROM Revision: XX.XX.XX
MAC A ress:
IP A ress:
Subnet Mask:
Default Gateway:
TFTP Gateway IP A r:
Device Date:
Device Time:
Screen Refresh Time:
Screen Lockout Time:
Clear NVRAM [NO]
Device Uptime XX D XX H XX M
Device Type: xxxxx-xx
IP Fragmentation [ENABLED]
Operational Mo e: [802.1Q SWITCHING]
Event Message Fiel Display Fiel
Input Fiel s
Selection Fiel
Comman Fiel s
Display Fiel s
xxxxx-xx LOCAL MANAGEMENT
Event Message Line
RETURNSAVE
03/15/1999
14 23 00
30 sec.
15 min.
EXIT
00-00-ID-00-00-00
0.0.0.0
255.255.0.0
NONE DEFINED
0.0.0.0
See
Note
Note:
This shows the location of the cutaway that is use in most of the screen graphics in this
ocument. The top portion of the screen is cut away to eliminate repeating the same
information in each graphic.The screen title is containe in the figure title for each screen.

VLAN Classification Configuration Screen
Local Management Screens 2-3
When a frame is received that already contains an 802.1Q frame tag, frame classification is not
implemented. Instead, the frame is processed by the SmartSwitch device according to the
information contained in the 802.1Q frame tag.
To access the VLAN Classification Configuration screen from the 802.1Q VLAN Configuration
Menu screen, use the arrow keys to highlight the VLAN CLASSIFICATION
CONFIGURATION menu item and press ENTER. The VLAN Classification Configuration
screen displays.
Figure 2-3 VLAN Classification Configuration Screen
The following describes the fields of the VLAN Classification Configuration screen:
VID (Selectable) - Top of Screen
VLAN Identification (VID) – Displays the VIDs currently associated with a protocol
classification. To see which ports are assigned to a VID/Classification, or to add/remove a port
from a VID/Classification, use the Protocol Port Configuration screen. For details, refer to
Section 2.3.2.
NOTE: The VLAN Classification Configuration screen does not display when the
operational mode of the device is set to SECURE FAST VLAN.
The user’s guide provides instructions for setting the operational mode.
3135_97w
RETURN
EXIT
Description

ADD
IP: 123.123.030.006 Mask: 255.255.255.255.255
IP: 123.123.030.007 Mask: 255.255.255.255.255
0x8137
0x0800
0x9999
VID Classification
 
7 Bilateral IP A ress
6 Dest IP A ress
1 Ethernet II Type
1 Ethernet II Type
5 802.3 SAP
PREVIOUS NEXT
VID: CLASSIFICATION: IP A ress: MASK:
5 [Bil IP A ress] 123.123.030.006 255.255.255.255.255
DEL ALL

VLAN Classification Configuration Screen
2-4 Local Management Screens
Classification (Selectable) - Top of Screen
Displays the classification associated with the VLAN in the VID column and may be selected to
call up the Protocol Port Configuration screen.
Description (Selectable) - Top of Screen
Provides the description of the classification.
VID (Modifiable)
Used to enter the VID of a VLAN to be associated with the classification selected in the
Classification field. For details on how to enter the VID/Classification, refer to Section 2.3.3.
Classification (Selectable)
Used to select the classification method that will be associated with the VLAN entered in the VID
field. There can be up to three fields involved, depending on the classification selected. At the time
of this printing, the selections available in each field are listed in Table 2-1.
For details on how to use the VLAN Classification Configuration screen to select the classification
rule, refer to Section 2.3.3.
NOTE: Besides the VID selected, the order in which a frame is transmitted also
depends on the Classification Precedence Rules discussed in Section 2.3.1. These
rules come into effect when there are multiple classifications configured in the
SmartSwitch.
Table 2-1 Classification List
Classification Subclassification and Options Custom or Mask Value
Ethernet II Type> Ethernet II Type:
-IPX
- DOD IP
-ARP
-RARP
- AppleTalk
- Banyan Vines
- DECNET
- CUSTOM > Type Value: 0x00001

VLAN Classification Configuration Screen
Local Management Screens 2-5
802.3 SAP> SSAP/DSAP (803.2):
-IP
-IPX
- IPX RAW
- NETBIOS
- BANYAN
-SNA
- CUSTOM > DSAP/SSAP Type: 0x0000
IP TOS Type of Service:
0x0000
IP Protocol Type IP Protocol Type:
-TCP
-UDP
-ICMP
- IGMP
- OSPF
- CUSTOM > Protocol Type: 000
IPX COS IPX Class Of Service:
000
IPX Packet Type IPX Packet Type
- Hello or SAP
-RIP
- Echo Packet
- Error Packet
- NetWare 386/SAP
- Seq. Pkt Protocol
-NetWare286
- CUSTOM > IPX Packet Type: 00
Src IP Address IP Address:
000.000.000.000
Mask:
000.000.000.000
Dest IP Address IP Address:
000.000.000.000
Mask:
000.000.000.000
Bil IP Address IP Address:
000.000.000.000
Mask:
000.000.000.000
Src IPX Network IPX Network Num:
0x00000000
Table 2-1 Classification List (Continued)
Classification Subclassification and Options Custom or Mask Value

VLAN Classification Configuration Screen
2-6 Local Management Screens
Dest IPX Network IPX Network Num:
0x00000000
Bil IPX Network IPX Network Num:
0x00000000
Src UDP Port IP UDP Port:
- FTP Data
-FTP
-BOOTPServer
- BOOTP Client
-RIP
- Telnet
-TFTP
-HTTP
- DNS
-SMTP
-POP3
- IMAP2
- IMAP3
- NETBIOS Name Serv
- NETBIOS Datagram
- NETBIOS Sess Serv
- CUSTOM > UDP Port Number: 00000
Dest UDP Port IP UDP Port:
- Same selection as for Scr UDP Port
Classification
UDP Port Number: 00000
Bil UDP Port IP UDP Port:
- Same selection as for Scr UDP Port
Classification
UDP Port Number: 00000
Table 2-1 Classification List (Continued)
Classification Subclassification and Options Custom or Mask Value

VLAN Classification Configuration Screen
Local Management Screens 2-7
Src TCP Port TCP Port:
-FTPData
-FTP
-BOOTPServer
- BOOTP Client
-RIP
-Telnet
-TFTP
- HTTP
-DNS
-SMTP
-POP3
- IMAP2
- IMAP3
- NETBIOS Name Serv
- NETBIOS Datagram
- NETBIOS Sess Serv
- CUSTOM > TCP Port Number: 00000
Dest TCP Port TCP Port:
- Same selection as for Scr TCP Port
Classification
TCP Port Number: 00000
Bil TCP Port TCP Port:
- Same selection as for Scr TCP Port
Classification
TCP Port Number: 00000
Src IPX Socket IPX Socket:
-NCP
- SAP
-RIP
- NETBIOS
- Diagnostics
- NLSP
- IPX WAN
- CUSTOM> IPX Socket Type: 00000
Dest IPX Socket IPX Socket:
- Same selection as for Scr IPX
Socket Classification
IPX Socket Type: 00000
Table 2-1 Classification List (Continued)
Classification Subclassification and Options Custom or Mask Value

VLAN Classification Configuration Screen
2-8 Local Management Screens
ADD (Command)
Used to add the current VID and Classification selections to the screen. For details about how to
add an entry, refer to Section 2.3.3.
DEL ALL/DEL MARKED (Command)
Used to delete all or one or more marked entries. The DEL ALL command is the default and it is
used to simultaneously delete all the configured information (VID, Classification, and
Destination). The DEL MARKED command appears in place of the DEL ALL command when
one or more lines are marked for deletion. For details on using the two commands and marking
lines, refer to Section 2.3.4.
2.3.1 Classification Precedence Rules
¬
When there are multiple classifications assigned to a SmartSwitch device, the SmartSwitch device
must determine which classification takes precedence according to the Classification Preference
Rules. The order of precedence is predefined in the SmartSwitch device and cannot be changed.
Table 2-2 lists the ISO Layer, associated classification and precedence levels.
Bil IPX Socket IPX Socket:
- Same selection as for Scr IPX
Socket Classification
IPX Socket Type: 00000
1. Bold type indicates a user entry.
NOTE: It is important that you have a comprehensive understanding of the precedence
concept before configuring the SmartSwitch device, as these rules can have a
significant impact on network operation.
NOTE: In Table 2-2, the following applies:
– Highest precedence is 1a.
– Lowest precedence is 4.
– Exact Match indicates a match of an explicitly defined address.
– Best Match indicates a match of an entire subnet, or range of addresses within a
subnet.
Table 2-1 Classification List (Continued)
Classification Subclassification and Options Custom or Mask Value