HP 10500 series User manual

Product overview
The HP 10500 Switch Series sets a new benchmark for performance, reliability, and scalability
with next-generation Clos architecture. Designed for enterprise campus core networks, the
10500 Switch Series enables a cloud-connected and rich-media-capable infrastructure. The
switch series provides industry-leading 10GbE/40GbE port density, 3-microsecond latency, and
very low energy consumption.
With HP Intelligent Resilient Framework (IRF) technology, the scalability and resiliency of the
10500 switch series can be extended and virtualized across up to four chassis with a single
management interface—enabling atter, more agile networks. This switch series, along with
the entire HP FlexNetwork architecture, can be seamlessly managed through the HP Intelligent
Management Center (IMC), which provides a single-pane-of-glass management view of the
infrastructure.
A summary of the highlights of the 10500 Switch Series:
• Advanced, next-generation Clos architecture
• More than 11 terabits-per-second switching capacity
• Feature-rich switch with IPv6 and MPLS functionality
• HP IRF technology virtualizes up to four chassis
• Ultra-high 1/10/40GbE density; 100GbE readiness
Data sheet
HP 10500 Switch Series

2
Features and benets
Product architecture
Brings native high stability, independent process monitoring, and restart through the modular
design and multiple processes of HP Comware v7 software; allows individual software modules
to be upgraded for higher availability; and supports enhanced serviceability functions
• In-service software upgrade
Provides an upgrade of the entire chassis or an individual task or process, with zero packet
loss
• Distributed architecture with separation of data and control planes
Delivers enhanced fault tolerance and facilitates continuous operation and zero service
disruption during planned or unplanned control-plane events
• NEW Multitenant device context
Virtualizes a physical switch into multiple logical devices, with each logical switch having its
own processes, conguration, and administration
Performance
• High-speed fully distributed architecture
Provides up to 11.52 Tb/s switching capacity with released line cards and up to 13.72 Tb/s
switching fabric capacity with type-D fabric; leverages its modules to provide non-blocking
wire-speed 10GbE/40GbE performance and future 100GbE expansion capability; utilizes four
fabrics to deliver up to 8.571 billion pps throughput; performs all switching and routing in the
I/O modules; and meets the demand of bandwidth-intensive applications today and in the
future
• Scalable system design
Provides investment protection to support future technologies and higher-speed connectivity
with a backplane designed to accommodate bandwidth increases
• Flexible chassis selection
Enables you to tailor product selections to your budget with a choice of four chassis: the
10504 switch (four open module slots), 10508 switch (eight open module slots), 10508-V
switch (eight vertical open module slots), and 10512 switch (12 open module slots)
Connectivity
• High-density port connectivity
Oers up to 12 interface module slots; provides up to 96 40GbE ports, 576 10GbE ports, and
576 gigabit ber/electrical ports per system
• Jumbo frames
Allows high-performance backups and disaster-recovery systems; and provide a maximum
frame size of 9k bytes
• Loopback
Supports internal loopback testing for maintenance purposes and an increase in availability;
loopback detection protects against incorrect cabling or network congurations and can be
enabled on a per-port or per-VLAN basis for added exibility
• Ethernet operations, administration, and maintenance (OAM)
Detects the data link layer problems that occur in the “last mile,” using the IEEE 802.3ah OAM
standard; and monitors the status of the link between two devices
Data sheet | HP 10500 Switch Series

3
• Flexible port selection
Provides a combination of ber and copper interface modules, 100/1000BASE-X auto-speed
selection, and 10/100/1000BASE-T auto-speed detection as well as auto-duplex and MDI/
MDI-X
• Monitor link
Collects statistics on performance and errors on physical links, increasing system availability
(Comware v5 only)
• Dual-personality functionality
Includes four 10/100/1000 ports or SFP slots for optional ber connectivity, such as Gigabit-
SX, -LX, and -LH and 100-FX
• Packet storm protection
Protects against unknown broadcast, unknown multicast, or unicast storms with user-dened
thresholds
• Flow control
Provides back pressure, using standard IEEE 802.3x—reducing congestion in heavy trac
situations
Quality of service (QoS)
• IEEE 802.1p prioritization
Delivers data to devices, based on the priority and type of trac
• Class of service (CoS)
Sets the IEEE 802.1p priority tag based on the IP address, IP type of service (ToS), L3 protocol,
TCP/ user datagram protocol (UDP) port number, source port, and DiServ
• Bandwidth shaping
– Port-based rate limiting
Enabled per-port ingress/egress-enforced bandwidth increase
– Classier-based rate limiting
Uses an access control list (ACL) to enforce increased bandwidth for ingress trac on each
port
– Reduced bandwidth
Provides per-port per-queue egress-based bandwidth reduction
• Trac policing
Supports committed access rate and line rate
• Weighted random early detection (WRED)/random early detection
Delivers congestion avoidance capabilities through the use of queue management algorithms
• Powerful QoS feature
Provides support for these congestion actions: strict priority queuing, weighted round robin,
weighted fair queuing, and WRED
Data sheet | HP 10500 Switch Series

4
Resiliency and high availability
• Redundant/load-sharing fabrics, management, fan assemblies, and power supplies
Increase total performance and power availability, while providing hitless, stateful failovers
• All hot-swappable modules
Allows replacement of modules without any impact on other modules
• Separate data and control paths
Separates control from services and keeps service processing isolated; and increases security
and performance
• Passive design system
Delivers increased system reliability as the backplane has no active components
• IRF
Creates virtual resilient switching fabrics, where two or more switches perform as a single
L2 switch and L3 router; switches don’t have to be co-located and can be part of a disaster-
recovery system; servers or switches can be attached using the standard link-aggregation
control protocol (LACP) for automatic load balancing and high availability; it can help eliminate
the need for complex protocols such as spanning tree protocol (STP), equal-cost multipath
(ECMP), or virtual router redundancy protocol (VRRP)—simplifying network operations
• IRF capability
Provides single IP address management for a resilient virtual switching fabric of up to four
switches
• Ring resiliency protection protocol
Provides standard sub-100 ms recovery for a ring Ethernet-based topology (Comware v5 only)
• VRRP
Allows groups of two routers to dynamically back each other up to create highly available
routed environments
• Device link detection protocol
Monitors link connectivity and shuts down ports at both ends if unidirectional trac is
detected, helping prevent loops in STP-based networks
• Hitless patch upgrades
Allows patches and new service features to be installed without restarting the equipment,
increasing network uptime and facilitating easy maintenance
• IEEE 802.3ad LACP
Supports up to 128 trunks, each with 8 links per trunk; and provides support for static or
dynamic groups and a user-selectable hashing algorithm
• Graceful restart
Supports graceful restart for the open-shortest path rst (OSPF), intermediate system to
intermediate system (IS-IS), border gateway protocol (BGP), LDP, and RSVP; the network
remains stable during the active-standby switchover; after the switchover, the device quickly
learns the network routes by communicating with adjacent routers; and forwarding remains
uninterrupted during the switchover to achieve nonstop forwarding
• Ultrafast protocol convergence (sub-second) with standards-based failure detection—
bidirectional forwarding detection
Enables link connectivity monitoring and reduces network convergence time for the routing
information protocol (RIP), OSPF, BGP, IS-IS, VRRP, MPLS, and IRF
• SmartLink
Allows 100 ms failover between links (Comware v5 only)
• Multiple internal power supplies
Provides high reliability; the 10504 switch provides 3+1 redundancy; and the 10508, 10508-V,
and 10512 switches provide 5+1 redundancy
Data sheet | HP 10500 Switch Series

5
Virtual private network (VPN)
• IPSec
Provides secure tunneling over an untrusted network, such as the Internet or a wireless
network; and oers data condentiality, authenticity, and integrity between two network
endpoints
• Generic routing encapsulation (GRE)
Transports L2 connectivity over an L3 path in a secured way; and enables the segregation of
trac from site to site
• Manual or automatic Internet key exchange (IKE)
Enables the manual or automatic key exchange required for the algorithms used in encryption
or authentication; auto-IKE allows automated management of the public key exchange,
helping ensure the highest levels of encryption
Management
• Management interface control
Enables or disables each of these interfaces, depending on security preferences: console port,
telnet port, or reset button
• Industry-standard CLI with a hierarchical structure
Reduces training time and expenses; and increases productivity in multivendor installations
• Management security
Restricts access to critical conguration commands; oers multiple privilege levels with
password protection; uses ACLs to provide telnet and SNMP access; and allows logging of all
access with local and remote syslog capabilities
• SNMPv1, v2, and v3
Provide complete support of the SNMP and industry-standard management information base
(MIB) as well as private extensions; SNMPv3 supports increased security using encryption
• sFlow (RFC 3176)
Provides scalable ASIC-based wire-speed network monitoring and accounting with no impact
on network performance; this allows network operators to gather a variety of sophisticated
network statistics and information for capacity planning and real-time network monitoring
purposes
• Remote monitoring (RMON)
Uses standard SNMP to monitor essential network functions; and supports events, alarms,
history, and statistics groups as well as a private alarm extension group
• FTP, trivial FTP (TFTP), and secure FTP (SFTP) support
Oers dierent mechanisms for conguration updates; the FTP allows bidirectional transfers
over a TCP/IP network; the TFTP is a simpler method that uses the UDP; and the SFTP runs
over an secure shell (SSH) tunnel to provide additional security
• Debug and sampler utility
Supports ping and trace-route for both IPv4 and IPv6
• Network time protocol (NTP)
Synchronizes timekeeping among distributed time servers and clients; and keeps timekeeping
consistent among all clock-dependent devices within the network, so that the devices can
provide diverse applications, based on the consistent time
• Network quality analyzer
Analyzes network performance and service quality by sending test packets; provides network
performance and service quality parameters such as jitter, TCP, or FTP connection delays
and le transfer rates; and allows a network manager to determine the overall network
performance as well as diagnose and locate network congestion points or failures
Data sheet | HP 10500 Switch Series

6
• Information center
Provides a central repository for system and network information; aggregates all logs, traps,
and debugging information generated by the system and maintains them in the order of
severity; and sends out the network information to multiple channels, based on user-dened
rules
• IEEE 802.1ab link-layer discovery protocol (LLDP)
Advertises and receives management information from adjacent devices on a network,
facilitating easy mapping by network management applications
• Dual ash images
Provides independent primary and secondary operating system les for backup while
upgrading
• Multiple conguration les
Are easily stored with a ash image
L2 switching
• VLAN
Supports up to 4,096 port-based or IEEE 802.1Q-based VLANs; and supports MAC-based
VLANs, protocol-based VLANs, and IP-subnet-based VLANs for added exibility (Comware v7
only supports port-based VLANs)
• Bridge protocol data unit (BPDU) tunneling
Transmits STP BPDUs transparently, allowing correct tree calculations across service
providers, WANs, or MANs
• GARP VLAN registration protocol
Allows automatic learning and dynamic assignment of VLANs (Comware v5 only)
• Port mirroring
Duplicates port trac (ingress and egress) to a local or remote monitoring port; and supports
four mirroring groups, with an unlimited number of ports per group
• STP
Supports the standard IEEE 802.1D STP, IEEE 802.1w rapid STP for faster convergence, and
IEEE 802.1s multiple STP
• Internet-group-management protocol (IGMP) and multicast-listener-discovery (MLD) protocol
snooping
Controls and manages the ooding of multicast packets in an L2 network
• IEEE 802.1ad Q-in-Q and selective Q-in-Q
Increase the scalability of an Ethernet network by providing a hierarchical structure; and
connect multiple LANs on a high-speed campus or metro network
• Per-VLAN spanning tree plus
Allows each VLAN to build a separate spanning tree to improve link bandwidth usage in
network environments with multiple VLANs (Comware v5 only)
• Isolation at data-link layer with private VLANs
Provides—through a two-tier VLAN structure—an additional layer of protection, simplifying
network conguration while saving VLAN resources
Data sheet | HP 10500 Switch Series

7
L3 services
• Address resolution protocol (ARP)
Determines the MAC address of another IP host in the same subnet; includes support for static
ARPs; a gratuitous ARP allows detection of duplicate IP addresses; and a proxy ARP allows
normal ARP operation between subnets or when subnets are separated by an L2 network
• UDP helper
Redirects UDP broadcasts to specic IP subnets to help prevent server spoong
• Dynamic host conguration protocol (DHCP)
Simplies the management of large IP networks and supports both clients and servers; DHCP
relay enables DHCP operation across subnets
• Domain name system (DNS)
Provides a distributed database that translates domain names and IP addresses, simplifying
network design; and supports clients and servers
L3 routing
• Static IPv4 routing
Provides simple manually congured IPv4 routing
• RIP
Uses a distance vector algorithm with UDP packets for route determination; supports RIPv1
and RIPv2 routing; and includes loop protection
• OSPF
Delivers faster convergence; uses this link-state routing interior gateway protocol (IGP), which
supports ECMP, NSSA, and MD5 authentication for increased security and graceful restart for
faster failure recovery
• IS-IS
Uses a path vector IGP, which is dened by the ISO organization for IS-IS routing and extended
by IETF RFC 1195 to operate in both TCP/IP and the OSI reference model (integrated IS-IS)
• BGP-4
Delivers an implementation of the exterior gateway protocol, utilizing path vectors; uses TCP
for enhanced reliability for the route discovery process; reduces bandwidth consumption by
advertising only incremental updates; supports extensive policies for increased exibility; and
scales to very large networks
• Policy-based routing
Makes routing decisions based on policies set by the network administrator
• IP performance optimization
Provides a set of tools to improve the performance of IPv4 networks; and includes directed
broadcasts, customization of TCP parameters, support of ICNP error packets, and extensive
display capabilities
• Unicast reverse path forwarding
Limits erroneous or malicious trac in accordance with RFC 3074
• Static IPv6 routing
Provides simple manually congured IPv6 routing
• Dual IP stack
Maintains separate stacks for IPv4 and IPv6 to ease the transition from an IPv4-only network
design to an IPv6-only network design
Data sheet | HP 10500 Switch Series

8
• RIP next generation (RIPng)
Extends RIPv2 to support IPv6 addressing
• OSPFv3
Provides OSPF support for IPv6
• IS-IS for IPv6
Extends IS-IS to support IPv6 addressing
• BGP+
Extends BGP-4 to support multiprotocol BGP, including support for IPv6 addressing
• MPLS
Uses BGP to advertise routes across label switched paths (LSPs), but uses simple labels
to forward packets from any L2 or L3 protocol—which reduces complexity and increases
performance; supports graceful restart for reduced failure impact; and provides support for
LSP tunneling and multilevel stacks
• MPLS L3 VPN
Allows L3 VPNs across a provider network; uses MP-BGP to establish private routes for
increased security; and supports RFC 2547bis multiple autonomous system VPNs for added
exibility
• MPLS L2 VPN
Establishes simple L2 point-to-point VPNs across a provider network, using only MPLS label
distribution protocol (LDP); requires no routing—which decreases complexity, increases
performance, and allows VPNs of non-routable protocols; uses no routing information for
increased security; and supports circuit cross connect, static virtual circuits, a Martini draft,
and Kompella-draft technologies
• Virtual private LAN service (VPLS)
Establishes point-to-multipoint L2 VPNs across a provider network
• Super VLAN
Saves IP address space, using RFC 3069 standard also called VLAN aggregation
• ECMP
Enables multiple equal-cost links in a routing environment to increase link redundancy and
scale bandwidth
• IPv6 tunneling
Provides an important element for the transition from IPv4 to IPv6; allows IPv6 packets to
traverse IPv4-only networks by encapsulating the IPv6 packet into a standard IPv4 packet;
supports manually congured, 6-to-4, intra-site-automatic-tunnel-addressing-protocol
(ISATAP) tunnels, and IPv6 VPN provider-edge router tunnel
Security
• ACL enablement
Supports powerful ACLs for both IPv4 and IPv6; and helps lter trac to prevent unauthorized
users from accessing the network or control network trac in order to save resources; rules
can either deny or permit trac to be forwarded; rules can be based on an L2 header or an L3
protocol header; and rules can be set to operate on specic dates or times
• Remote authentication dial-in user service (RADIUS)
Eases switch security access administration by using a password authentication server
• Terminal access controller access-control system (TACACS+)
Delivers an authentication tool, using TCP with encryption of the full authentication request,
providing additional security
Data sheet | HP 10500 Switch Series

9
• Switch management logon security
Helps secure switch CLI logon by optionally requiring either RADIUS or TACACS+ authentication
• SSHv2
Uses external servers to securely log in to a remote device; protects against IP spoong and
plain-text password interception, with authentication and encryption; and increases the
security of SFTP transfers
• DHCP snooping
Enables DHCP clients to receive IP addresses from authorized DHCP servers and maintains a
list of DHCP entries for trusted ports; and helps prevent users from receiving fake IP addresses
and reduces ARP attacks, improving security
• IP source guard
Filters packets on a per-port basis to help prevent illegal packets from being forwarded
• ARP attack protection
Protects from attacks using a large number of ARP requests with a host-specic, user-
selectable threshold
• Port security
Allows access only to specied MAC addresses, which can be learned or specied by the
administrator
• IEEE 802.1X support
Provides port-based user authentication, with support for the EAP-MD5, TLS, TTLS, and
PEAP—with choice of AES, TKIP, and static or dynamic WEP encryption for protecting wireless
trac between authenticated clients and the access point
• MAC authentication
Provides simple authentication, based on a user’s MAC address; and supports local or RADIUS-
based authentication
• Multiple user authentication methods
– IEEE 802.1X
Uses an IEEE 802.1X supplicant on the client, in conjunction with a RADIUS server, to
authenticate in accordance with industry standards
– Web-based authentication
Provides a browser-based environment, similar to IEEE 802.1X, to authenticate clients that
do not support the IEEE 802.1X supplicant
– MAC-based authentication
Authenticates the client with a RADIUS server, based on the client’s MAC address
• DHCP protection
Blocks DHCP packets from unauthorized DHCP servers, helping preventing denial-of-service
attacks
• Endpoint admission defense
Assigns security policies to users accessing a network
Data sheet | HP 10500 Switch Series

10
Convergence
• LLDP- media endpoint discovery
Denes a standard extension of LLDP that stores values for parameters such as QoS and VLAN
to automatically congure network devices such as IP phones
• Protocol-independent multicast (PIM)
Denes modes of Internet IPv4 and IPv6 multicasting to allow one-to-many and many-to-
many transmission of information; and supports PIM dense mode, sparse mode, and source-
specic mode
• Multicast source discovery protocol (MSDP)
Allows multiple PIM-SM domains to interoperate; is used for inter-domain multicast
applications (Comware v5 only)
• IGMP
Utilizes any-source multicast (ASM) or SSM to manage IPv4 multicast networks; and supports
IGMPv1, v2, and v3
• Multicast BGP
Allows multicast trac to be forwarded across BGP networks and kept separate from unicast
trac
• MLD protocol
Establishes, maintains, and manages IPv6 multicast groups and networks; supports v1 and
v2; and utilizes ASM or SSM
• Multicast VLAN
Allows multiple VLANs to receive the same IPv4 or IPv6 multicast trac, lessening network
bandwidth demand by reducing or nearly eliminating multiple streams to each VLAN
• Voice VLAN
Assigns VLAN and priority for IP phones automatically, simplifying network conguration and
maintenance (Comware v5 only)
Integration
• Open application architecture
Provides high-performance application-specic modules fully integrated with the switching
architecture; uses the chassis high-speed backplane to access network-related data; and
increases performance, reduces costs, and simplies network management
• VPN rewall module
Provides enhanced stateful packet inspection and ltering; supports exible security
zones and virtual rewall containment; delivers advanced VPN services with 3DES and
AES encryption at high performance and low latency; and oers Web content ltering and
application prioritization and optimization (JD249A Comware v5 only)
• Local and global server load-balancing module
Improves trac distribution using powerful scheduling algorithms, including L4 to L7 services;
and monitors the health status of servers and rewalls (JD252A Comware v5 only)
• NetStream module
Provides trac analysis and statistics capture to allow network administrators to rapidly
identify network anomalies and security threats as well as obtain capacity planning
information; and supports NetFlow v5 and v9 (JD254A Comware v5 only)
Data sheet | HP 10500 Switch Series