NetApp CN1610 Service manual
NetApp®CN1610 Switch
Administrator’s Guide
NetApp, Inc.
495 East Java Drive
Sunnyvale, CA 94089 U.S.A.
Telephone: +1 (408) 822-6000
Fax: +1 (408) 822-4501
Support telephone: +1 (888) 4-NETAPP
Information Web: www.netapp.com
Part number: 215-06287_C0
March 2015
ii
Copyright and trademark information
Copyright
information
Copyright © 1994-2015 NetApp, Inc. All rights reserved. Printed in the U.S.A.
Software derived from copyrighted NetApp material is subject to the following license and
disclaimer:
THIS SOFTWARE IS PROVIDED BY NETAPP “AS IS” AND WITHOUT ANY EXPRESS OR
IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE,
WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL NETAPP BE LIABLE FOR ANY
DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
NetApp reserves the right to change any products described herein at any time, and without notice.
NetApp assumes no responsibility or liability arising from the use of products described herein,
except as expressly agreed to in writing by NetApp. The use or purchase of this product does not
convey a license under any patent rights, trademark rights, or any other intellectual property rights of
NetApp.
The product described in this manual may be protected by one or more U.S.A. patents, foreign
patents, or pending applications.
RESTRICTED RIGHTS LEGEND: Use, duplication, or disclosure by the government is subject to
restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer
Software clause at DFARS 252.277-7103 (October 1988) and FAR 52-227-19 (June 1987).
Trademark
information
NetApp, the NetApp logo, Network Appliance, the Network Appliance logo, Akorri,
ApplianceWatch, ASUP, AutoSupport, BalancePoint, BalancePoint Predictor, Bycast, Campaign
Express, ComplianceClock, Cryptainer, CryptoShred, Data ONTAP, DataFabric, DataFort, Decru,
Decru DataFort, FAServer, FilerView, FlexCache, FlexClone, FlexScale, FlexShare, FlexSuite,
FlexVol, FPolicy, GetSuccessful, gFiler, Go further, faster, Imagine Virtually Anything, Lifetime Key
Management, LockVault, Manage ONTAP, MetroCluster, MultiStore, NearStore, NetCache, NOW
(NetApp on the Web), ONTAPI, OpenKey, RAID-DP, ReplicatorX, SANscreen, SecureAdmin,
SecureShare, Select, Shadow Tape, Simulate ONTAP, SnapCopy, SnapDirector, SnapDrive,
SnapFilter, SnapLock, SnapManager, SnapMigrator, SnapMirror, SnapMover, SnapRestore,
Snapshot, SnapSuite, SnapValidator, SnapVault, StorageGRID, StoreVault, the StoreVault logo,
SyncMirror, Tech OnTap, The evolution of storage, Topio, vFiler, VFM, Virtual File Manager,
VPolicy, WAFL, and Web Filer are trademarks or registered trademarks of NetApp, Inc. in the United
States, other countries, or both.
FASTPATH is a trademark of Broadcom Corporation.
IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business
Machines Corporation in the United States, other countries, or both. A complete and current list of
other IBM trademarks is available on the Web at www.ibm.com/legal/copytrade.shtml.
iii
Apple is a registered trademark and QuickTime is a trademark of Apple, Inc. in the U.S.A. and/or
other countries. Microsoft is a registered trademark and Windows Media is a trademark of Microsoft
Corporation in the U.S.A. and/or other countries. RealAudio, RealNetworks, RealPlayer,
RealSystem, RealText, and RealVideo are registered trademarks and RealMedia, RealProxy, and
SureStream are trademarks of RealNetworks, Inc. in the U.S.A. and/or other countries.
All other brands or products are trademarks or registered trademarks of their respective holders and
should be treated as such.
NetApp, Inc. is a licensee of the CompactFlash and CF Logo trademarks. NetApp, Inc. NetCache is
certified RealSystem compatible.
iv
Table of Contents
v
Chapter 1 About This Document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Chapter 2 Switch Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
CLI quick start . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Switch management interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . 6
IPv6 management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Command line logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
File management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Configuration files and scripts . . . . . . . . . . . . . . . . . . . . . . 13
File uploads and downloads . . . . . . . . . . . . . . . . . . . . . . . 19
Dual image support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
User management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Logs and Syslog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
SNTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
DNS client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Environmental status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Outbound Telnet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Chapter 3 Ports and LAGs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Port configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
SFP ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Link aggregation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Chapter 4 Switching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Layer 2 forwarding database . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Layer 2 multicast forwarding database . . . . . . . . . . . . . . . . . . . . . 54
Link Layer Discovery Protocol . . . . . . . . . . . . . . . . . . . . . . . . . 56
Industry Standard Discovery Protocol . . . . . . . . . . . . . . . . . . . . . 60
vi Table of Contents
IGMP snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Jumbo frames . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Port mirroring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Flow-based mirroring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Storm control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Flow control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Chapter 5 Multiple Spanning Tree Protocol. . . . . . . . . . . . . . . . . . . . . . . 77
MSTP overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
MSTP functional description . . . . . . . . . . . . . . . . . . . . . . . . . . 79
MSTP operation in the network . . . . . . . . . . . . . . . . . . . . . . . . 85
MSTP CLI show commands . . . . . . . . . . . . . . . . . . . . . . . . . . 91
MSTP configuration example . . . . . . . . . . . . . . . . . . . . . . . . . 92
Chapter 6 VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Basic VLAN configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Protocol-based VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
MAC-based VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .102
IP subnet-based VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . .104
Double VLAN tagging . . . . . . . . . . . . . . . . . . . . . . . . . . . . .107
Chapter 7 Quality of Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .113
Class of service (CoS) queue mapping . . . . . . . . . . . . . . . . . . . . .114
CoS queue configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . .117
QoS map and queue configuration example . . . . . . . . . . . . . . . . . .118
Differentiated services (DiffServ) . . . . . . . . . . . . . . . . . . . . . . .121
Chapter 8 Security Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .129
Denial of service and other protections. . . . . . . . . . . . . . . . . . . . .130
Access control lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .132
vii
IEEE 802.1X . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .138
SSH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .146
RADIUS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .148
TACACS+ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .152
Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .155
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .159
viii Table of Contents
Chapter 1: About This Document 1
1
About This Document
Purpose This guide provides examples of how to use the NetApp®CN1610 cluster
network switch in a typical network. This document describes the switch features
and includes information about using the command-line interface (CLI) to
configure them.
Additional
documentation
The following documentation provides additional information about the switch
FASTPATH software:
◆The CN1610 Network Switch CLI Command Reference describes the
commands available from the command-line interface (CLI) for managing,
monitoring, and configuring the switch.
◆The 10G Cluster-Mode Switch Installation Guide provides basic information
to install the switch and perform initial configuration.
◆Release notes detail the platform-specific functionality of the software
packages, including known issues and workarounds.
2About This Document
Chapter 2: Switch Administration 3
2
Switch Administration
About this chapter This chapter provides information about administering the switch, including
using the command-line interface (CLI), configuring basic switch settings, and
managing the system configuration files.
Topics in this
chapter
This chapter includes the following topics:
◆“CLI quick start” on page 4
◆“Switch management interfaces” on page 6
◆“IPv6 management” on page 9
◆“SNMP” on page 24
◆“IPv6 management” on page 9
◆“Command line logging” on page 11
◆“File management” on page 12
◆“Configuration files and scripts” on page 13
◆“File uploads and downloads” on page 19
◆“Dual image support” on page 22
◆“User management” on page 26
◆“Logs and Syslog” on page 28
◆“SNTP” on page 33
◆“DNS client” on page 35
◆“Environmental status” on page 37
◆“Outbound Telnet” on page 39
4CLI quick start
CLI quick start
About this section This section provides a brief introduction to using the CLI.
Note
For detailed information about CLI commands, see the CN1610 Network
Switch CLI Command Reference.
Connecting to the
CLI
To begin using the CLI, follow these steps:
1. Connect to the CLI through the serial console or a Telnet/SSH connection, as
described in the 10G Cluster-Mode Switch Installation Guide.
The following prompt displays:
User >
2. Enter
admin
as the default user name.
3. Press Enter when prompted for a password. (There is no password by
default.)
The following prompt displays:
(CN1610) >
The initial command mode is User EXEC mode. Commands are available in
this mode for viewing switch data. These commands are also available,
along with many others, in Privileged EXEC mode.
4. Enter
enable
to enter Privileged EXEC mode. (By default, there is no
password for entering into Privileged EXEC mode; however, one can be
configured.)
The following prompt displays:
(CN1610) #
Command modes Different command modes offer different sets of commands. The prompt changes
to indicate the command mode.
In Privileged EXEC mode, you can enter commands to view switch information,
configure some system-level functions, and enter into other command modes.
Chapter 2: Switch Administration 5
For example, you can enter
vlan database
to enter VLAN Config mode, where
you can create and configure VLANs. The prompt displays as follows:
(CN1610) (Vlan)#
From Privilege Exec mode, you can also enter
configure
(or simply
config
) to
enter Global Config mode. In Global Config mode, you can enter commands to
configure global switch settings and enter into all other configuration modes. For
example, the following command sequence enters Global Config mode (from
Privileged EXEC mode), and then enters Interface Config mode for port 0/5.
(CN1610) #config
(CN1610) (Config)#interface 0/5
(CN1610) <Interface 0/5>#
In Interface Config mode, you can enter commands to configure the specified
interface.
Note
See the CN1610 Network Switch CLI Command Reference for a list of all
command modes and instructions on entering them.
Using the no form
of a command
The
no
keyword is a specific form of an existing command and does not represent
a new or distinct command. Almost every configuration command has a
no
form.
In general, use the
no
form to reverse the action of a command or reset a value
back to the default.
For example, the
no shutdown
configuration command reverses the shutdown of
an interface. Use the command without the keyword
no
to reenable a disabled
feature or to enable a feature that is disabled by default.
Entering commands
and getting help
The CLI automatically finishes spelling a command when you type enough
letters to uniquely identify the command keyword. Once you have entered
enough letters, press the SPACEBAR or TAB key to complete the word.
To view a list of available commands in the current mode, enter a question mark.
To see the available parameters and variables for a command, type in the
command keyword followed by a question mark.
6Switch management interfaces
Switch management interfaces
Overview The switch can be managed by using a command-line interface (CLI) or SNMP.
You can use any of the following methods to access the CLI:
◆A serial connection through the console port using a terminal emulator.
◆An out-of-band connection through the dedicated management port (service
port) using Telnet or SSH. The out-of-band traffic is isolated from ordinary
traffic on the switch ports. You can assign an IP address to the service port,
and configure it to be assigned dynamically through DHCP/BOOTP.
◆An in-band connection through any port using Telnet or SSH. With an in-
band connection, the management data is switched along with ordinary
switch traffic, and is forwarded to the network interface (a logical IP
interface configured on the switch).
A management VLAN is associated with the network interface, enabling
segregating of management traffic and restricting access.
To use Telnet, you must assign a management IP address to the network interface
or the service port. You can assign IP information statically or configure the
switch to obtain it dynamically using DHCP/BOOTP.
Note
See the 10G Cluster-Mode Switch Installation Guide for instructions on
accessing the CLI through the serial port or Telnet/SSH.
You can also access switch information by using SNMP to view items in the
supported MIBs. See “SNMP” on page 24 for more information.
The switch allows multiple concurrent Telnet and SNMP sessions.
All management interfaces are enabled by default. CLI access through IP and
SNMP access can be disabled by the administrator. CLI access through the serial
console is always available.
Note
Management access through IPv6 is also supported. See “IPv6 management” on
page 9 for more information.
Chapter 2: Switch Administration 7
BOOTP/DHCP client
functionality
The BOOTP protocol allows a device to solicit and receive configuration data
and parameters from a suitable server. DHCP is an extension to BOOTP that
enables receiving additional setup parameters from a network server upon system
startup. BOOTP stops operating once an IP address is obtained, but DHCP
continues to operate on an ongoing basis. For example, the IP address assigned to
the system has a lease time that may expire, and can be renewed on-the-fly.
The system incorporates BOOTP and DHCP clients that can solicit an IP address
to use as the system management IP address and service port IP address. The
system uses BOOTP by default; however, the administrator can configure the
switch to use DHCP, or can assign a static IP address to the network interface or
service port.
DHCP/BOOTP requests are broadcast out of all ports that are members of the
management VLAN. The default management VLAN is VLAN 1.
Defaults The BOOTP/DHCP client is enabled by default.
CLI show
commands
You can use the following
show
commands in Privileged EXEC mode to view
information about switch management interfaces:
For more information on the BOOTP/DHCP commands, see the CN1610
Network Switch CLI Command Reference.
Configuration
example
The following commands change the protocol for the network interface from the
default, BOOTP, to none, statically configure the switch IP information, and
change the management VLAN to VLAN 100:
Command Description
show network
Displays configuration settings associated with the
switch's network interface.
show serviceport
Displays IP and other configuration information for
the service port.
(CN1610) # network protocol none
(CN1610) # network parms 10.17.21.4 255.255.255.0 10.17.21.1
(CN1610) # network mgmt_vlan 100
8Switch management interfaces
The following commands change the network protocol for the service port to
none
and configures static IP information for the port:
(CN1610) # serviceport protocol none
(CN1610) # serviceport ip 10.17.21.4 255.255.255.0 10.17.21.1
Chapter 2: Switch Administration 9
IPv6 management
Feature overview IPv6 features can be configured through the CLI and SNMP. The following
management protocols and applications can operate over IPv6:
◆Pingv6
◆Traceroutev6
◆TFTP
◆SSH
◆SSL
◆Telnet
◆SNMP
For ICMPv6, the switch supports error PDU generation, path MTU, echo
request/reply, and redirect.
For SNMP, the switch supports the IPv6 MIB, the ICMPv6 MIB, and private
MIB extensions.
The CN1610 switch supports router advertisement as an integral part of IPv6.
Numerous options are available, including stateless/stateful address
configuration, router and address lifetimes, and neighbor discovery timer control.
The switch also supports Ethernet and tunnel interfaces. For Ethernet, the switch
supports link-local address mapping and multicast address mapping. The tunnel
interface functionality supports link-local address mapping but not general
neighbor discovery, since the interface is not considered to have a link-layer
address. Multiple global addresses can be configured on each interface.
The network ports are logical management interfaces. The IP stack's routing table
contains both IPv6 routes associated with these management interfaces and IPv6
routes associated with routing interfaces. If routes to the same destination (such
as a default route) are learned on both a management interface and a routing
interface, the routing interface route is preferred.
Defaults IPv6 management is enabled by default.
10 IPv6 management
CLI show
commands
You can use the following
show
commands in Privileged EXEC mode to view
information about the IPv6 management features:
For more information on the IPv6 management commands, see the CN1610
Network Switch CLI Command Reference.
Configuration
example
The following example enables IPv6 management and configures the network
port to obtain its IPv6 information through DHCP:
The following example enables IPv6 management on the service port, and
configures a static IP address and gateway:
Command Description
show serviceport
Displays service port configuration information.
show network
Displays configuration settings associated with the
switch's network interface.
show network ndp
Displays NDP cache information for the network
port.
(CN1610) # network ipv6 enable
(CN1610) # network ipv6 address dhcp
(CN1610) # serviceport ipv6 enable
(CN1610) # network ipv6 address 2607:f0d0:2001:000a:0000:0000:0000:0010/64
(CN1610) # network ipv6 gateway 2607:f0d0:2001:000a:0000:0000:0000:0001
Chapter 2: Switch Administration 11
Command line logging
Feature overview You can configure the switch to automatically create a log of configuration
commands as you enter them. A command log can provide the system operators
with a detailed view of the commands executed. The command log file is saved
locally on the switch along with other system logs.
You can enable and disable command logging. By default, it is disabled.
Logging severity The system associates a severity level with system events that are written to the
log. When CLI commands are executed and written to the log, they are assigned a
nonconfigurable severity of SEVERITY_NOTICE.
Defaults Command line logging is disabled by default.
Configuration
example
The following example enables command logging:
The following is an example CLI log message for the user
admin
:
<5> JAN 01 00:01:35 0.0.0.0-1 UNKN[54373024]: cmd_logger_api.c(93)
20 % CLI:<connectionID>:<userID>:show vlan-assist-mac-learn all
If this feature is enabled, commands are logged immediately after the user is
authenticated. After authentication, the CLI generates an explicit message and
invokes the command logger. The format of the message at login is:
<5> JAN 01 00:01:35 0.0.0.0-1 UNKN[54373024]: cmd_logger_api.c(93)
20 % CLI:<connectionID>:<userID>: User <userID> logged in
The CLI command log is also updated when a user logs out. The format of the
log message is:
<5> JAN 01 00:01:35 0.0.0.0-1 UNKN[54373024]: cmd_logger_api.c(93)
20 % CLI:<connectionID>:<userID>:logout
(CN1610) # config
(CN1610) (Config)# logging cli-command
12 File management
File management
Overview The switch FASTPATH software has a user-accessible file system to manage the
various files needed for its operation. The file system contains the application
software files and a configuration file that is restored each time the switch boots.
This section includes the following topics:
◆“Configuration files and scripts” on page 13
◆“File uploads and downloads” on page 19
◆“Dual image support” on page 22
Other manuals for CN1610
2
Table of contents
