NEC N8406-022A User guide

N8406-022A 1Gb Intelligent L2 Switch
Application Guide
Part number: 856-126757-106-00
First edition: July 2008

2
Legal notices
© 2008 NEC Corporation.
The information contained herein is subject to change without notice. The only warranties for NEC products and services are set forth in the
express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional
warranty. NEC shall not be liable for technical or editorial errors or omissions contained herein.
Microsoft®, Windows®, and Windows NT® are U.S. registered trademarks of Microsoft Corporation.
SunOS™ and Solaris™ are trademarks of Sun Microsystems, Inc. in the U.S. and other countries.
Cisco® is a registered trademark of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries.
Part number: 856-126757-106-00
First edition: July 2008

Accessing the switch 3
Contents
Accessing the switch
Introduction.............................................................................................................................................................6
Additional references..............................................................................................................................................6
Typographical conventions.....................................................................................................................................6
Management Network ............................................................................................................................................7
Connecting through the console port................................................................................................................7
Connecting through Telnet................................................................................................................................7
Connecting through Secure Shell .....................................................................................................................7
Using the command line interfaces ........................................................................................................................8
Configuring an IP interface................................................................................................................................8
Using the Browser-based Interface........................................................................................................................9
Using Simple Network Management Protocol........................................................................................................9
SNMP v1.0........................................................................................................................................................9
SNMP v3.0......................................................................................................................................................10
Default configuration.......................................................................................................................................10
User configuration...........................................................................................................................................10
View based configurations..............................................................................................................................11
Configuring SNMP trap hosts..........................................................................................................................12
Secure access to the switch.................................................................................................................................14
Setting allowable source IP address ranges...................................................................................................14
RADIUS authentication and authorization.......................................................................................................14
TACACS+ authentication................................................................................................................................18
Secure Shell and Secure Copy.......................................................................................................................23
User access control..............................................................................................................................................27
Setting up user IDs..........................................................................................................................................27
Ports and trunking
Introduction...........................................................................................................................................................28
Ports on the switch...............................................................................................................................................28
Port trunk groups..................................................................................................................................................28
Statistical load distribution...............................................................................................................................29
Built-in fault tolerance......................................................................................................................................29
Before you configure trunks..................................................................................................................................29
Trunk group configuration rules............................................................................................................................29
Port trunking example...........................................................................................................................................30
Configuring trunk groups (AOS CLI example).................................................................................................31
Configuring trunk groups (BBI example).........................................................................................................32
Configurable Trunk Hash algorithm......................................................................................................................34
Link Aggregation Control Protocol........................................................................................................................35
Configuring LACP ...........................................................................................................................................36
VLANs
Introduction...........................................................................................................................................................37
Overview...............................................................................................................................................................37
VLANs and port VLAN ID numbers......................................................................................................................37
VLAN numbers................................................................................................................................................37
PVID numbers.................................................................................................................................................37
Viewing and configuring PVIDs.......................................................................................................................38
VLAN tagging .......................................................................................................................................................38
VLANs and IP interfaces ......................................................................................................................................41
VLAN topologies and design considerations........................................................................................................41
VLAN configuration rules ................................................................................................................................41
Multiple VLANS with tagging................................................................................................................................42
Configuring the example network....................................................................................................................43
FDB static entries.................................................................................................................................................48
Trunking support for FDB static entries...........................................................................................................48
Configuring a static FDB entry........................................................................................................................48
Spanning Tree Protocol
Introduction...........................................................................................................................................................49
Overview...............................................................................................................................................................49

Accessing the switch 4
Bridge Protocol Data Units...................................................................................................................................49
Determining the path for forwarding BPDUs...................................................................................................49
Spanning Tree Group configuration guidelines....................................................................................................50
Default Spanning Tree configuration...............................................................................................................50
Adding a VLAN to a Spanning Tree Group.....................................................................................................50
Creating a VLAN.............................................................................................................................................50
Rules for VLAN tagged ports ..........................................................................................................................50
Adding and removing ports from STGs...........................................................................................................51
Assigning cost to ports and trunk groups........................................................................................................51
Multiple Spanning Trees.......................................................................................................................................51
Why do we need Multiple Spanning Trees?....................................................................................................51
VLAN participation in Spanning Tree Groups.................................................................................................52
Configuring Multiple Spanning Tree Groups...................................................................................................52
Port Fast Forwarding............................................................................................................................................54
Configuring Port Fast Forwarding...................................................................................................................55
Fast Uplink Convergence.....................................................................................................................................55
Configuration guidelines..................................................................................................................................55
Configuring Fast Uplink Convergence ............................................................................................................55
RSTP and MSTP
Introduction...........................................................................................................................................................56
Rapid Spanning Tree Protocol .............................................................................................................................56
Port state changes..........................................................................................................................................56
Port type and link type.....................................................................................................................................56
RSTP configuration guidelines........................................................................................................................57
RSTP configuration example ..........................................................................................................................57
Multiple Spanning Tree Protocol ..........................................................................................................................59
MSTP region...................................................................................................................................................59
Common Internal Spanning Tree....................................................................................................................59
MSTP configuration guidelines .......................................................................................................................59
MSTP configuration example..........................................................................................................................59
IGMP Snooping
Introduction...........................................................................................................................................................64
Overview...............................................................................................................................................................64
FastLeave .......................................................................................................................................................64
IGMP Filtering.................................................................................................................................................65
Static multicast router......................................................................................................................................65
IGMP Snooping configuration example...........................................................................................................65
Remote monitoring
Introduction...........................................................................................................................................................74
Overview...............................................................................................................................................................74
RMON group 1 — statistics.............................................................................................................................74
RMON group 2 — history................................................................................................................................77
RMON group 3 — alarms................................................................................................................................79
RMON group 9 — events................................................................................................................................83
High availability
Introduction...........................................................................................................................................................85
Uplink Failure Detection .......................................................................................................................................85
Failure Detection Pair......................................................................................................................................86
Spanning Tree Protocol with UFD...................................................................................................................86
Configuration guidelines..................................................................................................................................86
Monitoring Uplink Failure Detection................................................................................................................87
Configuring Uplink Failure Detection...............................................................................................................87
Troubleshooting tools
Introduction...........................................................................................................................................................90
Port Mirroring........................................................................................................................................................90
Configuring Port Mirroring (AOS CLI example)...............................................................................................91
Configuring Port Mirroring (BBI example).......................................................................................................92
Other network troubleshooting techniques...........................................................................................................94
Console and Syslog messages.......................................................................................................................94
Ping.................................................................................................................................................................94
Trace route......................................................................................................................................................94
Statistics and state information.......................................................................................................................94

Accessing the switch 5
Customer support tools...................................................................................................................................94

Accessing the switch 6
Accessing the switch
Introduction
This guide describes how to use and configure the switch on the Layer2 switch mode. For the information of how to
use on the SmartPanel mode, see the SmartPanel Reference Guide. For the information of SSH, RADIUS, and
TACACS+ on the SmartPanel mode, this guide will help you.
This guide will help you plan, implement, and administer the switch software. Where possible, each section
provides feature overviews, usage examples, and configuration instructions.
•“Accessing the switch” describes how to configure and view information and statistics on the switch over an IP
network. This chapter also discusses different methods to manage the switch for remote administrators, such
as setting specific IP addresses and using Remote Authentication Dial-in User Service (RADIUS)
authentication, Secure Shell (SSH), and Secure Copy (SCP) for secure access to the switch.
•“Ports and port trunking” describes how to group multiple physical ports together to aggregate the bandwidth
between large-scale network devices.
•“VLANs” describes how to configure Virtual Local Area Networks (VLANs) for creating separate network
segments, including how to use VLAN tagging for devices that use multiple VLANs.
•“Spanning Tree Protocol” discusses how spanning trees configure the network so that the switch uses the
most efficient path when multiple paths exist.
•“Rapid Spanning Tree Protocol/Multiple Spanning Tree Protocol” describes extensions to the Spanning Tree
Protocol that provide rapid convergence of spanning trees for fast reconfiguration of the network.
•“IGMP Snooping” describes how to use IGMP to conserve bandwidth in a multicast-switching environment.
•“Remote Monitoring” describes how to configure the RMON agent on the switch, so the switch can exchange
network monitoring data.
•“High Availability” describes how the switch supports high-availability network topologies. This release
provides Uplink Failure Detection.
•“Troubleshooting tools” describes Port Mirroring and other troubleshooting techniques.
Additional references
Additional information about installing and configuring the switch is available in the following guides.
•N8406-022A 1Gb Intelligent L2 Switch User’s Guide
•N8406-022A 1Gb Intelligent L2 Switch Command Reference Guide (AOS)
•N8406-022A 1Gb Intelligent L2 Switch Command Reference Guide (ISCLI)
•N8406-022A 1Gb Intelligent L2 Switch Browser-based Interface Reference Guide
•N8406-022A 1Gb Intelligent L2 Switch SmartPanel Reference Guide
Typographical conventions
The following table describes the typographic styles used in this guide:
Table 1 Typographic conventions
Typeface or symbol Meaning Example
AaBbCc123 This type depicts onscreen computer output and
prompts. Main#
AaBbCc123 This type displays in command examples and
shows text that must be typed in exactly as
shown.
Main# sys
<AaBbCc123> This bracketed type displays in command
examples as a parameter placeholder. Replace
the indicated text with the appropriate real name
or value when using the command. Do not type
the brackets.
This also shows guide titles, special terms, or
words to be emphasized.
To establish a Telnet session, enter:
host# telnet <IP address>
Read your user guide thoroughly.
[ ] Command items shown inside brackets are
optional and can be used or excluded as the
situation demands. Do not type the brackets.
host# ls [-a]

Accessing the switch 7
Management Network
The 1Gb Intelligent L2 Switch is a Switch Module within the Blade Enclosure. The Blade Enclosure includes an
Enclosure Manager Card which manages the modules and CPU Blades in the enclosure.
The 1Gb Intelligent L2 Switch communicates with the Enclosure Manager Card through its internal management
port (port 19). The factory default settings permit management and control access to the switch through the 10/100
Mbps Ethernet port on the Blade Enclosure, or the built-in console port. You also can use the external Ethernet
ports to manage and control this switch.
The switch management network has the following characteristics:
•Port 19 — Management port 19 has the following configuration:
•Flow control: both
•Auto-negotiation
•Untagged
•Port VLAN ID (PVID): 4095
•VLAN 4095 — Management VLAN 4095 isolates management traffic within the switch. VLAN 4095 contains
only one member port (port 19). No other ports can be members of VLAN 4095.
•Interface 256 — Management interface 256 is associated with VLAN 4095. No other interfaces can be
associated with VLAN 4095. You can configure the IP address of the management interface manually or
through Dynamic Host Control Protocol (DHCP).
•Gateway 4 — This gateway is the default gateway for the management interface.
•STG 32 — If the switch is configured to use multiple spanning trees, spanning tree group 32 (STG 32)
contains management VLAN 4095, and no other VLANS are allowed in STG 32. The default status of STG 32
is off.
If the switch is configured to use Rapid Spanning Tree Protocol, STG 1 contains management VLAN 4095.
To access the switch management interface:
•Use the Enclosure Manager Card internal DHCP server, through Enclosure-Based IP Addressing
•Assign a static IP interface to the switch management interface
(interface 256).
Connecting through the console port
Using a null modem cable, you can directly connect to the switch through the console port. A console connection is
required in order to configure Telnet or other remote access applications. For more information on establishing
console connectivity to the switch, see the User’s Guide.
Connecting through Telnet
By default, Telnet is enabled on the switch. Once the IP parameters are configured, you can access the CLI from
any workstation connected to the network using a Telnet connection. Telnet access provides the same options for a
user and an administrator as those available through the console port, minus certain commands. The switch
supports four concurrent Telnet connections.
To establish a Telnet connection with the switch, run the Telnet program on your workstation and issue the telnet
command, followed by the switch IP address:
telnet <switch IP address>
Connecting through Secure Shell
By default, the Secure Shell (SSH) protocol is disabled on the switch. SSH enables you to securely log into another
computer over a network to execute commands remotely. As a secure alternative to using Telnet to manage switch
configuration, SSH ensures that all data sent over the network is encrypted and secure. For more information, see
the “Secure Shell and Secure Copy” section later in this chapter. For additional information on the CLI, see the
Command Reference Guide.

Accessing the switch 8
Using the command line interfaces
The command line interface (CLI) can be accessed via local terminal connection or a remote session using Telnet
or SSH. The CLI is the most direct method for collecting switch information and performing switch configuration.
The switch provides two CLI modes: The menu-based AOS CLI, and the tree-based ISCLI. You can set the switch
to use either CLI mode.
The Main Menu of the AOS CLI, with administrator privileges, is displayed below:
[Main Menu]
info - Information Menu
stats - Statistics Menu
cfg - Configuration Menu
oper - Operations Command Menu
boot - Boot Options Menu
maint - Maintenance Menu
diff - Show pending config changes [global command]
apply - Apply pending config changes [global command]
save - Save updated config to FLASH [global command]
revert - Revert pending or applied changes [global command]
exit - Exit [global command, always available]
For complete information about the AOS CLI, refer to the Command Reference Guide (AOS).
The ISCLI provides a tree-based command structure, for users familiar with similar products.
An example of a typical ISCLI command is displayed below:
Switch(config)# spanning-tree stp 1 enable
For complete information about the ISCLI, refer to the Command Reference Guide (ISCLI).
Configuring an IP interface
An IP interface address must be set on the switch to provide management access to the switch over an IP network.
By default, the management interface is set up to request its IP address from a DHCP server on the Enclosure
Manager Card.
If you configure an IP address manually, the following example shows how to manually configure an IP address on
the switch:
1. Configure an IP interface for the Telnet connection, using the sample IP address of 205.21.17.3.
2. The pending subnet mask address and broadcast address are automatically calculated.
>> # /cfg/l3/if 256 (Select IP interface 256)
>> IP Interface 256# addr 205.21.17.3(Assign IP address for the interface)
Current IP address: 0.0.0.0
New pending IP address: 205.21.17.3
Pending new subnet mask: 255.255.255.0
. . . . . . . . . . . .
>> IP Interface 256# ena (Enable IP interface 256)
3. If necessary, configure default gateway.

Accessing the switch 9
4. Configuring the default gateways allows the switch to send outbound traffic to the routers.
>> IP Interface 256# ../gw 4 (Select default gateway 4)
>> Default gateway 4# addr 205.21.17.1 (Assign IP address for a router)
>> Default gateway 4# ena (Enable default gateway 4)
5. Apply, verify, and save the configuration.
>> Default gateway 4# apply (Apply the configuration)
>> Default gateway 4# save (Save the configuration)
>> # /cfg/dump (Verify the configuration)
NOTE: When the dhcp function on this switch is enabled, the IP address obtained from the DHCP
server overrides the static IP address configured manually.
Using the Browser-based Interface
By default, the Browser-based Interface (BBI) protocol is enabled on the switch. The Browser-based Interface (BBI)
provides access to the common configuration, management and operation features of the switch through your Web
browser. For more information, see the Browser-based Interface Reference Guide.
The BBI is organized at a high level as follows:
•Configuration — These menus provide access to the configuration elements for the entire switch.
•System — Configure general switch configuration elements.
•Switch ports — Configure switch ports and related features.
•Port-based port mirroring — Configure mirrored ports and monitoring ports.
•Layer 2 — Configure Layer 2 features, including trunk groups, VLANs, and Spanning Tree Protocol.
•RMON menu — Configure Remote Monitoring (RMON) functions.
•Layer 3 — Configure all of the IP related information, including IGMP Snooping.
•Uplink Failure Detection — Configure a Failover Pair of Links to Monitor and Links to Disable.
•Statistics — These menus provide access to the switch statistics and state information.
•Dashboard — These menus display settings and operating status of a variety of switch features.
Using Simple Network Management Protocol
The switch software provides SNMP v1.0 and SNMP v3.0 support for access through any network management
software.
SNMP v1.0
To access the SNMP agent on the switch, the read and write community strings on the SNMP manager should be
configured to match those on the switch. The default read community string on the switch is public and the
default write community string is private.
The read and write community strings on the switch can be changed using the following commands on the CLI.
>> /cfg/sys/ssnmp/rcomm
and
>> /cfg/sys/ssnmp/wcomm
The SNMP manager should be able to reach the management interface or any one of the IP interfaces on the
switch.
For the SNMP manager to receive the traps sent out by the SNMP agent on the switch, the trap host on the switch
should be configured with the following command:
/cfg/sys/ssnmp/snmpv3/taddr
For more details, see “Configuring SNMP trap hosts”.

Accessing the switch 10
SNMP v3.0
SNMPv3 is an enhanced version of the Simple Network Management Protocol, approved by the Internet
Engineering Steering Group in March, 2002. SNMP v3.0 contains additional security and authentication features
that provide data origin authentication, data integrity checks, timeliness indicators, and encryption to protect against
threats such as masquerade, modification of information, message stream modification, and disclosure.
SNMP v3 ensures that the client can use SNMP v3 to query the MIBs, mainly for security.
To access the SNMP v3.0 menu, enter the following command in the CLI:
>> # /cfg/sys/ssnmp/snmpv3
For more information on SNMP MIBs and the commands used to configure SNMP on the switch, see the
Command Reference Guide.
Default configuration
The switch software has two users by default. Both the users 'adminmd5' and 'adminsha' have access to all the
MIBs supported by the switch.
1. username 1: adminmd5/password adminmd5. Authentication used is MD5.
2. username 2: adminsha/password adminsha. Authentication used is SHA.
3. username 3: v1v2only/password none.
To configure an SNMP user name, enter the following command from the CLI:
>> # /cfg/sys/ssnmp/snmpv3/usm 6
User configuration
Users can be configured to use the authentication/privacy options. Currently we support two authentication
algorithms: MD5 and SHA. These can be specified using the command: /cfg/sys/ssnmp/snmpv3/usm
<x>/auth md5|sha
1. To configure a user with name 'test,' authentication type MD5, and authentication password of 'test,' privacy
option DES with privacy password of 'test,' use the following CLI commands:
>> # /cfg/sys/ssnmp/snmpv3/usm 5
>> SNMPv3 usmUser 5 # name "test"
>> SNMPv3 usmUser 5 # auth md5
>> SNMPv3 usmUser 5 # authpw test
>> SNMPv3 usmUser 5 # priv des
>> SNMPv3 usmUser 5 # privpw test
2. Once a user is configured you need to specify the access level for this user along with the views the user is
allowed access to. This is specified in the access table.
>> # /cfg/sys/ssnmp/snmpv3/access 5
>> SNMPv3 vacmAccess 5 # name "testgrp"
>> SNMPv3 vacmAccess 5 # level authPriv
>> SNMPv3 vacmAccess 5 # rview "iso"
>> SNMPv3 vacmAccess 5 # wview "iso"
>> SNMPv3 vacmAccess 5 # nview "iso"
3. The group table links the user to a particular access group.
>> # /cfg/sys/ssnmp/snmpv3/group 5
>> SNMPv3 vacmSecurityToGroup 5 # uname test
>> SNMPv3 vacmSecurityToGroup 5 # gname testgrp
If you want to allow user access only to certain MIBs, see the “View based configurations” section.