NETGEAR ProSAFE GS724Tv4 User manual

Netgear GS724Tv4
Smart switch
A Tutorial on Use
Ross Maloney
by
4 October 2015

Contents
1 First steps 1
1.1 Necessary networking background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2 Switchhardware .......................................... 2
1.3 Buttonstoresettheswitch..................................... 2
1.4 Environment used in switch configuration examples . . . . . . . . . . . . . . . . . . . . . . 4
1.5 Basic control of the switch itself . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.5.1 Accesstotheswitch .................................... 5
1.5.2 VLAN ............................................ 5
1.6 Initialswitchconfiguration .................................... 6
1.7 Gateway from a simple network on the switch . . . . . . . . . . . . . . . . . . . . . . . . . 6
1.7.1 Implementation....................................... 7
1.8 Warnings............................................... 7
2 Layer 2 8
2.1 All devices on the default VLAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.1.1 Implementation....................................... 9
2.1.2 Resultsfromtesting .................................... 9
2.2 A new VLAN holding all devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.2.1 Implementation....................................... 10
2.2.2 Resultsfromtesting .................................... 10
2.3 TwoisolatedLANs ......................................... 10
2.3.1 Implementation....................................... 11
2.3.2 Resultsfromtesting .................................... 12
2.4 DividingaLAN........................................... 12
2.4.1 Asinglenetwork ...................................... 13
2.4.2 Dividing the network into two parts . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
i

CONTENTS
2.5 Divided LAN sharing one Internet connection . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.6 Ensuring only known devices can use a network . . . . . . . . . . . . . . . . . . . . . . . . 15
2.6.1 Security designed to give specific devices access to given devices . . . . . . . . . . 16
2.6.2 Aspects common to each implementation alternative . . . . . . . . . . . . . . . . . 16
2.6.3 Implementation Alternative 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2.6.4 Implementation Alternative 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2.6.5 Testing............................................ 19
3 Layer 3 20
3.1 Routing between LANs and to the Internet . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
3.1.1 Implementation....................................... 21
3.1.2 Testing............................................ 22
3.1.3 Removing Internet access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
3.1.4 Important to note from this example . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
3.2 Securingthenetwork........................................ 23
3.2.1 Implementation overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
3.2.2 WirelessandInternet.................................... 23
3.2.3 Allowing PC 1 access but with limitation . . . . . . . . . . . . . . . . . . . . . . . . 24
3.2.4 AllowPC2toaccessPC1................................. 25
ii

Chapter 1
First steps
This document is not a definative User Guide for the Netgear GS724Tv4 smart switch. It grow out of
the observed lack of a User Guide as opposed to a number of good Reference Manuals. Those manuals
showed how to perform operations on the switch but not the reason why they could be performed. The
why is approached here by posing a problem, or an example situation, and then configuring the switch
to provide a solution. Further detail of the how can be obtained from a Reference Manual.
The application examples used have resulted from need. As the need to know more has grown so too
this User Guide has evolved. This evolution is expected to continue resulting also in this document
evolving. The examples are set up to show the switch setting used and the consequence of such setting
on the behaviour of the network containing the switch. Not having knowledge of the consequence of a
setting can make an appropriate switch selection setting time consuming.
Emphasis is placed on the GS724Tv4 switch as a network element. Testing of the network resulting from
each switch setting is described together briefly with how the switch can be configured to produce such
a setting. Further detail of the mechanics of performing setting of this switch is contained in the switch’s
manual.
The majority of the information contained here should also apply to the GS716Tv3 smart switch, and
maybe the GS748T5, although this has not been verified.
The reader is assumed to have access to the Netgear GS716Tv3, GS724Tv4, and GS748Tv5 Smart
Switches Sofware Adminstration Manual available from www.downloads.netgear.com/files/
GDC/GS716TV3/GS716Tv3_GS724Tv4_GS748Tv5_SWA_25Sept2013.pdf for information to sup-
pliment that given here.
1.1 Necessary networking background
The Open Systems Interconnection (OSI) model is a means of describing networks. That description
is divided into 7 layers: physical, data link, network, transport, session, presentation, and application.
The physical layer is layer 1, the application layer is layer 7, and the others are consecutively ordered
between.
For a device to take part in a network it must have an address on that network. This is its physical
address and is considered part of layer 2 of the OSI model. This address is 6 bytes, or 48 bits, or 12 hex
digits, in length. It is known as the Media Access Control, or MAC, address. Each network device in the
world has at least one MAC address and that MAC address is unique no matter whether the device is a
hardwired or wireless network component.
Ethernet and WiFi operate at layer 2. Each uses MAC addressing, only.
1

1.3. Buttons to reset the switch
Networking protocols are layer 3. TCP/IP is an example of a networking protocol. Each such protocol
has its own addressing scheme. For example IPv4 uses a 24 bit address expressed by 4 decimal digit
separated by a dot, for example 192.14.134.231. By constrast IPv6 uses a 128 bit address expressed
as eight 16 bit blocks, each block expressed as 4 hex digits with blocks separated by a colon, an example
being FE80:0000:0000:0000:0202:B3FF:FE1E:8329. These addressing schemes are different de-
spite IPv4 and IPv6 both being TCP/IP protocols. Other networking protocols use different addressing
schemes. But each network protocol addressing scheme needs to be converted to, and from, a MAC
address.
The GS724Tv4 switch uses TCP/IP network addressing. In this work IPv4 network addressing only will
be used. The same techniques shown here also apply to IPv6.
Each network element has fixed and changable addesss assignments. The MAC address is fixed in the
hardware. The changable parts are in the software which implements the network protocol such as
TCP/IP. These parts are the address of the device, its network mask, and the gateway to be used by data
to get off the device. Some software implementations require the broadcast address and network ad-
dress to be defined, but these can be calculated from the device address and network mask. The network
address is calculated by applying the AND operation to the address and the netmask combination. The
broadcast address is calculated by applying the OR operation to the combination of the network address
with the bit inverse of the network mask. But contrast, the gateway address must be specified and is to
where a TCP/IP packet is to be sent if the destination to which the packet is addressed cannot be found.
1.2 Switch hardware
The small brown coloured Philips head machine screws supplied with the switch are for attaching the
supplied mounting brackets to the switch housing. Four screw holes threaded for those screws are
provided at both ends of the switch housing.
The larger, chrome plated screws are for attaching the mounting bracket to a mounting frame supplied
by others.
Two mounting brackets in the form of drilled right-angled brackets in a blue colour to match the switch
housing are supplied with the switch.
Power to the switch is through the socket on the back of the switch. A power cable is provided with the
switch for that purpose. No isolating switch for that supply is provided on the switch.
The factory reset button is located on the bottom right of the front housing of the switch. It is recessed
from the surface. Use a straighted paper clip to depress this switch.
1.3 Buttons to reset the switch
There are two reset buttons on the switch. The Reset button is on the far left-hand side of the face
of the switch while the Factory Defaults button is on the right-hand side of the switch. Both buttons
are resessed from the surface requiring them to be pressed using a straightened paper clip. The switch
acknowledges the button as having been pressed by turning on all of the System LEDs. The reset process
takes two or more minutes to complete. Upon completion of the reset process, the System LEDs are
resturned to indicating the port usage.
The switch documentation states pressing the Factory Defaults button removes any configuration on
the switch and sets the address of the switch to 192.168.0.239. This proved untrue.
2

1.3. Buttons to reset the switch
To determine the actual behaviour of the Reset and Factory Defaults buttons, a series of trials were
performed. The results of those trial are contained in Table 1.1.
Important to note: The address of the switch does not answer a ping.
Trials were performed with firmware version 6.3.1.9on the switch. To determine the address of the
switch, version 1.1.3.2 of the Smart Control Center software running on a Windows 8.1 PC plugged into
socket 11 of the switch was used. Switch ports 7 and 19 only were used in the trials. To each of those
ports a PC running Linux was connected. Each trial consisted of exchanging ping packets between those
PCs and observing the results produced. Between trials, the network addresses of each PC was changed.
Table 1.1: Effects of switch reset buttons on switch content
Addresses Before Button Addresses After
gateway switch Pressed gateway switch Result
gateway device 192.168.23.244 connected
.23.244 static .23.105 reset .23.244 dynamic .23.105 I
.23.244 static .23.105 factory .23.244 dynamic .23.105 R
.8.254 static .8.78 reset .8.254 static .8.78 I
.8.254 static .8.78 factory .23.244 dynamic .23.105 R
.23.244 dynamic .23.105 reset .23.244 dynamic .23.105 I
.23.244 dynamic .23.105 factory .23.244 dynamic .23.105 R
.23.244 static .23.78 reset .23.244 static .23.78 I
.23.244 static .23.78 factory .23.244 dynamic .23.105 R
.23.2 static .23.78 reset .23.2 static .23.78 I
.23.2 static .23.78 factory .23.244 dynamic .23.105 R
gateway device 192.168.23.244 removed
.23.2 static .23.78 reset 23.3 static .23.78 I
.23.2 static .23.78 factory 0.0.0.0 dynamic .0.239 R
.0.244 dynamic .0.239 reset 0.0.0.0 dynamic .0.239 I
.0.244 dynamic .0.239 factory 0.0.0.0 dynamic .0.239 R
0.0.0.0 dynamic .0.239 reset 0.0.0.0 dynamic .23.105 I
0.0.0.0 dynamic .0.239 factory 0.0.0.0 dynamic .0.239 R
gateway device 192.168.23.244 connected
0.0.0.0 dynamic .0.239 reset .23.244 dynamic .23.105 I
0.0.0.0 dynamic .0.239 factory .23.244 dynamic .23.105 R
With respect to the trials data reported in Table 1.1, Note:
•all addresses shown are prefixed by 192.168, execpt 0.0.0.0
•no device corresponding to the switch gateway address 192.168.8.254 was attached
•switch firmware required its gateway and its address be set on same network
•only in static address mode could the switch address be set manually
•gateway and switch before addresses were those set using the Smart Control Center software
•the Result column shows results produced relative to the prior port configuration setting
•Result indicators: I means intact (no change); R means reset(change)
Behaviour patterns appear in Table 1.1. When the Factory reset button was applied:
•removes all port behaviour configuration
3

1.4. Environment used in switch configuration examples
•switch address set to dynamic 192.168.239 only if no gateway device was connected
•switch gateway address before does not effect outcome gateway address
When the Reset button was applied:
•always leaves port behaviour configuration unchanged
1.4 Environment used in switch configuration examples
Two networks were used; a hardwired network and a wireless network. The network address of the
hardwired network was 192.168.14.0 and 192.168.8.0 for the wireless network.
Table 1.2: Summary of devices connected to switch of the examples
Port Description of device IP address assigned MAC address
g1 HP Color Laserjet Pro M252dw printer 192.168.14.31 d0:bf:9c:bd:4b:4d
g2 Netgear ReadyNAS 316 192.168.14.107 28:c6:8e:d5:ed:08
g7 Mac Pro server Linux 192.168.14.9 00:3e:e1:c1:74:b3
g19 Mac mini server Linux 192.168.8.7 c8:2a:14:56:3c:a2
g23 D-Link DAP-1650 wireless extender 192.168.8.240 c0:a0:bb:f7:44:c0
Table 1.2 shows the details of the devices used in the examples. The switch was set with address 192.
168.14.155, placing it on the hardwired ethernet. The netmask for each device was set to 255.255.
0.0. That mask enabled devices on both networks to communicate. This enabled that Mac mini with
address 192.168.8.7 to act as controller for the switch.
switch
wireless network
Internet
gateway
Figure 1.1: Model of the network visualizations used here
Figure 1.1 shows the style of diagram used to depict the network of each example. In Figure 1.1 the
switch is configured to have two networks with one device connected to the switch and the configured
network. An internet gateway on a separated wireless network is also shown.
A D-Link ASL-2900AL Viper wireless router with IP address on the wireless network of 192.168.
8.244 with corresponding MAC address e8:cc:18:f1:79:6f provided a link between the wireless
network and the Internet. The D-Link DAP-1680 wireless extender provided the link between the hard-
wired and wireless networks.
4

1.5. Basic control of the switch itself
The devices shown in Table 1.2 on the two networks are divided into two groups. The computers were
used to configure the switch and test the behaviour of the resulting network. The printer and NAS
acted as target addresses for testing the network. The wireless extender was used as an additional target
address together with providing hardware coupling of the hardwired ethernet to the wireless network
containing the Internet interface, which also provided additional address targets. The DSL-2900AL
Viper router was part of the wireless network and not directly connected to the switch.
The examples will show the usefulness of the switch comes from it being able to change relationships be-
tween connected devices without physically changing the connections. For example, without changing
the physical connections to the network, the behaviour of this hardwired/wireless network is changed
by re-configuring the switch.
1.5 Basic control of the switch itself
The Netgear GS724Tv4 switch has network parameters which can be reset from their default values.
Values selected for these parameters influence access to the switch and behaviour of the network formed
using the switch. The network devices plugged into the switch ports form the network elements, but
the switch is an active media connecting those devices.
1.5.1 Access to the switch
Control of the switch is menu base accessed through a web browser. This menu system is only accessible
after logging into the switch.
The menu sequence
System →IP Configuration
enables the address of the switch, its network mask, and gateway can be reset. Assume the network
address was assigned here to 192.168.8.155, replacing the default switch address. The network
mask assigned here appeared not to have any effect.
In a LAN-based network, the switch can only be logged into from a device having the same network
component of its address as the address of the switch. For example, a device with address 192.168.8,
7can log into the switch with address 192.168.8.155, but a device with address 192.168.14.10
cannot.
1.5.2 VLAN
A basic unit for the switch is a Virtual LAN or VLAN. Devices connected to the ports on the switch
are assigned to one or more VLANs. This port/VLAN correspondence can be configured. A device
assigned to a VLAN behaves within the behaviour characteristics configured for that VLAN.
All ethernet ports of the switch are Untagged (U) members of VLAN 1 by default. However only devices
with the same network component of their address can communicate. For example address 192.168.
14.9 can ping address 192.168.14.107 but not 192.168.8.7.
The menu command sequence
Switching →VLAN →Advanced →VLAN Membership
accesses the port connections on a VLAN. Clicking the box under a particular port number through the
sequence U→blank →Tchanges the type of connection between the VLAN and the port. The blank
5

1.7. Gateway from a simple network on the switch
removes the connection. Once the connection type is selected, the Apply button in the bottom right
hand corner of the screen is clicked to have the switch perform the change.
The port to VLAN connection types are:
T trunk carrying traffic for more than one VLAN
U untagged
blank not connected
When a port box is shown as blank, the device connected to that port is no longer accessible from other
devices on the VLAN having the same network address.
1.6 Initial switch configuration
Default address of the switch was 192.168.0.239 and default switch gateway address 192.168.0.
254. These defaults were changed by logging into the switch using a PC whose ethernet address is
192.168.0.x where x is a value in the range 1 to 253, excluding 239 (which would give a conflict with
the default network address of the switch). The value of x chosen was 7. This PC was connected to the
switch via any of the RJ45 ethernet ports on the switch. Putting the address 192.168.0.239 into the
address field of a web broswer running on the PC opened the login page of the switch. Using the default
password password enabled logging into the switch and enabling the PC’s web browser to be used to
set up the switch.
The address of the switch is required to configure the switch. It is a good idea to have the switch address
laying on one of the LANs the switch is handling. To change the switch address, log into the switch, and
then use the switch command sequence
System >Management >IP Configuration
to bring up the page containing the current network settings of the switch. It is a good idea to have the
switch of a fixed address. So set the Current Network Configuration Protocol radio button
Static IP Address to on. Then assigned an address to the switch by changing the IP Address
field on the page to contain that selection. Then press the Apply button in the bottom right of the
command screen.
The switch address should not be on a VLAN to be handled by the switch. This is particularly true if
VLANs are to be routed. The address 192.168.10.60 and default gateway 192.168.10.244 were
assigned to the switch for this work.
1.7 Gateway from a simple network on the switch
A LAN was created by plugging network components into the switch. This LAN is shown in Figure 1.2
as containing a PC and a wireless extenter which were physically plugged into the switch. The switch
thus became an active part of the LAN. The LAN required a gateway to access the Internet and this
was to be provided by the wireless extender which had been configured to route any data sent to it out
onto the wireless network. Without changing the addresses of the LAN devices, the gateway was to be
produced.
6

1.8. Warnings
wireless extender
switch
PC
192.168.8.240192.168.8.7
Figure 1.2: Switch forming a LAN with an internet gateway
1.7.1 Implementation
Only a standard network is required with the switch only performing the function of a plug-board into
which the network components are physically connected.
The simple rule (which cna be broken as shown in Section!2.1.2) is on a LAN, the network address of
all connected devices should be the same. The wireless extender was configured to act as a repeater;
the hardwired and wireless LANs had the same network address. It provided connection between the
hardwired LAN contained by the switch to the wireless network which contained the Internet connec-
tion. The Internet connection had the address 192.168.8.244. In the /etc/network/interfaces
file on the PC, the gateway address was set as 192.168.8.244 and then the PC restarted. From the
PC, Internet connection could be demonstrated.
An alternate to the above procedure might be to change the gateway address of the switch and leave the
gateway address of the PC pointing somewhere else. The switch gateway was set to 192.168.8.244
using the System >Management >IP Configuration command menu sequence on the switch.
When this gateway address was filled in, and pressing the Apply button on the switch command page,
the PC could not access the Internet.
1.8 Warnings
•Don’t remove the control port from VLAN 1. If you do, then use the Reset button on the switch
to restore the switch. So never use the Remove All option in the Group Operation of the VLAN
Configuration for VLAN 1.
•Dynamic address assignment using DHCP (Dynamic Host Configuration Protocol) is not used.
Only static/direct address assignment is used in all the work here.
•The address of the switch must not be on a VLAN which is to be routed.
7