ZyXEL Communications MES-2110 Manual

MES-2110
Managed 8-port 10/100 Mbps
plus 2-port Gigabit Dual Personality
Access Switch
Support Note
Version V1.0
2009.9

MANAGED 8-PORT 10/100 + 2 G DUAL PERSONALITY SWITCH
2
TABLE OF CONTENTS
Support Note......................................................................1
1 CONFIGURATION.............................................................................4
1.1 Overview of configuration options................................................................4
1.2 External SNMP-based network management application ...........................4
2 MANAGEMENT VIA INTERNET BROWSER INTERFACE...............5
2.1 Overview ..........................................................................................................5
2.2 System Details.................................................................................................5
2.2.1 Homepage (System Details/System Info)........................................................................6
2.2.2 Board Info...........................................................................................................................7
2.2.3 DHCP Configuration..........................................................................................................7
2.3 Configuration...................................................................................................7
2.3.1 Port Configuration.............................................................................................................8
2.3.2 Port Status..........................................................................................................................9
2.3.3 RMON Status......................................................................................................................9
2.3.4 Ethernet Loop Detection.................................................................................................10
2.3.5 Jumbo Frame ...................................................................................................................10
2.4 802.1x.............................................................................................................11
2.4.1 Global Configuration.......................................................................................................11
2.4.2 Radius Server Configuration..........................................................................................11
2.4.3 Port Configuration...........................................................................................................12
2.4.4 801.x Status......................................................................................................................13
2.5 Bridge Menu ..................................................................................................14
2.5.1 Bridge Configuration (Enable / Disable RSTP).............................................................14
2.5.2 RSTP System Configuration...........................................................................................15
2.5.3 RSTP Per-Port Configuration .........................................................................................15
2.6 VLAN Menu....................................................................................................16
2.6.1 VLAN Type (VLAN Configuration)..................................................................................17
2.6.2 VLAN Configuration (Port-based) ..................................................................................18
2.6.3 QinQ Configuration (VLAN stacking).............................................................................18
2.6.4 Tag-based VLAN Port Configuration (Port Info)...........................................................20
2.6.5 Tag-based Info (VLAN Table)..........................................................................................20
2.6.6 Management VLAN ..........................................................................................................22
2.7 Bandwidth Control........................................................................................23
2.8 Storm Control................................................................................................24
2.9 Port Mirroring ................................................................................................25
2.10 Trunk Configuration..................................................................................26
2.10.1 Aggregator Setting ..........................................................................................................26
2.10.2 LACP Configuration.........................................................................................................26
2.10.3 LACP Link Status.............................................................................................................27
2.11 IGMP Menu.................................................................................................27
2.11.1 IGMP Configuration.........................................................................................................27
2.11.2 IGMP Groups Status........................................................................................................28
2.11.3 IGMP Snooping Configuration Example............................................................................28
2.11.4 MVR Configuration ..........................................................................................................30
2.11.5 MVR Group Configuration ..............................................................................................31
2.12 DHCP Snooping.........................................................................................33
2.12.1 DHCP Snooping Configuration ......................................................................................33

MANAGED 8-PORT 10/100 + 2 G DUAL PERSONALITY SWITCH
3
2.12.2 DHCP Binding Configuration..........................................................................................34
2.13 ARP Configuration.....................................................................................36
2.14 MAC Menu..................................................................................................37
2.14.1 MAC Table Status ............................................................................................................37
2.14.2 Lock MAC Address Learning..........................................................................................37
2.14.3 Mac Filter Configuration .................................................................................................38
2.14.4 MAC Limit Configuration ................................................................................................40
2.15 QoS Menu...................................................................................................41
2.15.1 QoS Base Configuration .................................................................................................41
2.15.2 802.1P Priority Table........................................................................................................42
2.15.3 Tag Priority.......................................................................................................................43
2.15.4 IP DSCP Priority...............................................................................................................43
2.15.5 Priority Override Configuration......................................................................................43
2.16 Management Configuration ......................................................................45
2.16.1 Serial Port Configuration ................................................................................................45
2.17 SNMP Configuration..................................................................................45
2.17.1 SNMP Communities.........................................................................................................45
2.17.2 IP Trap Manager...............................................................................................................46
2.18 SNTP...........................................................................................................47
2.19 E-mail Alarm Configuration & SYSLog Config........................................47
2.20 User Configuration....................................................................................48
2.21 Cable Test ..................................................................................................49
2.22 Host Denial-of-Service Protection............................................................49
2.23 Port Abnormal Traffic Detection...............................................................51
2.24 Firmware Download (Upgrade System)...................................................52
2.25 Configuration File (System Backup)........................................................52
2.26 System Restart Menu – Restart Option ...................................................53
2.27 Save Settings.............................................................................................53

MANAGED 8-PORT 10/100 + 2 G DUAL PERSONALITY SWITCH
4
1 Configuration
1.1 Overview of configuration options
For advanced management capabilities, the onboard management agent provides CLI
and menu-driven interface configuration programs. These programs can be accessed
by a direct or modem connection to the console port on the front panel (out-of-band), or
by a Telnet connection over the network (in-band).
The management agent is based on SNMP (Simple Network Management Protocol).
This SNMP agent permits the switch to be managed from any PC in the network by
using in-band management software.
The management agent also includes an embedded HTTP Web agent. This Web agent
can be accessed using a standard Web browser from any computer attached to the
network.
The switch gives you the flexibility to access and manage it by using any or all of the
methods described. The administration console and web browser interfaces are
embedded in the Switch software and can be used immediately after setup.
1.2 External SNMP-based network management application
Advantages
• Communicates with Switch functions at the MIB level
• Based on open standards
The three methods for configuring the Switch management agent are explained in the
following chapters.
The first method – Command Line Interface (CLI) via the Console Port to initially set IP
parameters.
The second is Menu Driven configurations via Telnet.
The third is the use of an Internet Browser Interface to configure the Switch.

MANAGED 8-PORT 10/100 + 2 G DUAL PERSONALITY SWITCH
5
2 Management via Internet Browser Interface
2.1 Overview
This section gives a step-by-step guide to configuring the Switch’s management
functions. A series of screen shots and instructions illustrate the main menu structure
and how it works.
Firstly, open a web browser and key in the Switch’s IP address – then press Enter. A
Web Manager page like this will pop up on your screen:
Log in
The default username is: admin
The default password is: 1234
2.2 System Details
When your Web browser connects with the Switch’s Web agent, the home page is
displayed as shown below. The home page displays the Main Menu on the left side of
the screen and System Information as the main page. The Main Menu links are used to
navigate to other menus and display configuration parameters and statistics.

MANAGED 8-PORT 10/100 + 2 G DUAL PERSONALITY SWITCH
6
2.2.1 Homepage (System Details/System Info)
Click on each parameter field to modify the specific settings, click Undo to restore
previously saved configurations or click Apply to retain newly entered information. See
description below:
Parameter
Description
Description
Object ID
Up Time
System Name
Provides description of the Switch
ID or Serial number
Provides information on up time, or the time that the system has
been operating
Modify the name of the Switch here
Contact
Location
DHCP Client
IP Address
Subnet Mask
Gateway
Enter a contact name
Enter the location of Switch
Disabled or client’s name
Default: 192.168.1.1
Default: 255.255.255.0
Default: 192.168.0.1
NOTE:
The above are factory defaults used as an example only. A new address is important. Choose
numbers between 0 and 254 in each sub-address field. Make a note of them and keep the details

MANAGED 8-PORT 10/100 + 2 G DUAL PERSONALITY SWITCH
7
in a safe place. In writing this manual we used IP address 192.168.1.1 and Subnet Mask
(255.255.255.0).
2.2.2 Board Info
Parameter
Description
Hardware Version
Firmware Version
Port Number
Provides information on the hardware version
Provides information on the firmware version
Provides information on
the number of ports available
2.2.3 DHCP Configuration
Disable or enable the DHCP Client of the Switch. Once the DHCP Client is enabled, the
IP address of the Switch is obtained from DHCP Server and the Switch will reboot.
Users can check the new IP address from serial Console.
2.3 Configuration
Port Configuration
This section allows you to view and change the parameter settings for the individual
ports on the Switch. See screen shot and table below for adjustable parameters.

MANAGED 8-PORT 10/100 + 2 G DUAL PERSONALITY SWITCH
8
2.3.1 Port Configuration
Click on each parameter field to modify the desired setting, then click on Undo to
restore previously saved configurations or click on Apply to retain newly entered
information. See description below:
Parameter
Description
Port
Name
Type
Admin
Speed: Status
Speed: Setting
Duplex: Status
Duplex: Setting
Port types and numbers
Assign a name to each port to keep record of your connections
Type of connector for each port (auto-detects fiber and RJ-45)
Enable or disable admin configurations
Provides information on speed at which ports are currently operating
Set speed for RJ-45 ports. (The speed for fiber ports is fixed)
Provides information on Duplex Status
Select half / full duplex modes
Link
Auto
Flow Control
Provides information on link status
Enable / Disable Auto-negotiation on copper ports
Enable / Disable flow control for each port
NOTE: Disable the Auto (Auto-negotiation) function to configure Speed and Duplex.
Click on Undo to restore previously saved configurations or click on Apply to retain
newly entered information.

MANAGED 8-PORT 10/100 + 2 G DUAL PERSONALITY SWITCH
9
2.3.2 Port Status
This window offers at-a-glance status reporting for Switch operations. Click on the Port
Configurations button to return to the Port Configurations window if you need to change
a setting.
2.3.3 RMON Status
The RMON Status menu provides updates on RMON data. The user can display
statistics from any port, and can clear (i.e. reset) the statistics to zero if desired.

MANAGED 8-PORT 10/100 + 2 G DUAL PERSONALITY SWITCH
10
2.3.4 Ethernet Loop Detection
Ethernet Loop Detection is used to detect Ethernet Loop conditions on active ports.
Ethernet Loops cause broadcast storms and crash the whole network. Set “Protection”
to enable or disable the Ethernet Loop Detection function of the Switch, and enable or
disable it on the specific port. For MAC Address, users can use the default one as the
destination MAC address for Ethernet Loop Detection. The default MAC Address is a
multicast address. Some network switches do not forward packets with unrecognized
multicast MAC address and discard those test packets sent out by the Switch for
Ethernet Loop Detection. In this situation, the function cannot be correctly executed.
Users can set another unicast MAC Address to cope with this condition. If the port is
blocked by Switch for detected loop, it needs to be enabled manually after the
Ethernet Loop is removed.
2.3.5 Jumbo Frame
The normal Ethernet frame size can not exceed the boundary of 1522 bytes; any packet
more than this value will be fragmented into smaller datagrams. Jumbo frames extend
this maximum frame size of the Ethernet from 1522 up to 1632 bytes (including Ethernet
headers).
The more the frames that the network device has to handle, the less the TCP
throughput and the more the CPU overhead. By allowing the frame to extend in size
from 1522 to 1632 bytes jumbo frames, the Switch will handle lower number of frames
or datagram’s.

MANAGED 8-PORT 10/100 + 2 G DUAL PERSONALITY SWITCH
11
2.4 802.1x
IEEE 802.1x is a standard for port-based network access control, part of the IEEE 802
(802.1) group of protocols. It provides authentication to devices attached to a LAN port,
establishing a point-to-point connection or preventing access from that port if
authentication fails. It is often used for wireless access points, and is based on the EAP,
Extensible Authentication Protocol.
2.4.1 Global Configuration
This screen is for 802.1x global configuration. You have to enable the function in this
page first, and then go to Port Configuration (6.4.3) to enable the function on the port
basis.
To use the 802.1x authentication, you have to enable this function first in this screen.
Reauth-Max is used to determine the number of re-authentication attempts that are
permitted before the specific port becomes unauthorized (Default value is 2 times. This
means the Switch will ask for re-authentication for 2 more times, totaling 3 times of
inquires of authentication avaible.)
Guest VLAN is intended for deployment in conference rooms, building lobbies, and
other areas where visitors frequently require network access. It is deployed to provide
Internet access to users not equipped with an 802.1x supplicant on their machine and
hence not able to reply to the identity request messages received from the switch. The
ports that do not pass the authentication will be forced to be members of guest VLAN.
Members of guest VLAN can only access limited services.
To set a guest VLAN, a tag-based VLAN must be assigned first. Please refer to 6.6
VLAN menu for the configuration of tag-based VLAN. After a tag-based VLAN is
assigned, enable Guest VLAN in this page. This will enable the Guest VLAN function in
the Switch. After that, you still have to set per-port Guest VLAN in Port Configuration
(6.4.3).
2.4.2 Radius Server Configuration
Remote Authentication Dial In User Service (RADIUS) is a networking protocol that
provides centralized Authentication, Authorization and Accounting (AAA) management
for computers to connect and use a network service.

MANAGED 8-PORT 10/100 + 2 G DUAL PERSONALITY SWITCH
12
Parameter
Description
Server IP address Enter the IP address of the authentication server.
Server Shared Key Enter the key shared between the Switch and authentication server.
Server UDP Port
Number Enter the UDP port number used by the authentication server to authenticate.
Server Accounting
Port Number Enter the UDP port number used by the authentication server to retrieve accounting information.
Server Time-Out Determine timeout conditions in the exchange between the
authenticator and authentication server (Default value is 30 seconds).
2.4.3 Port Configuration

MANAGED 8-PORT 10/100 + 2 G DUAL PERSONALITY SWITCH
13
This screen is for 802.1x configuration on the port basis. Before you take steps to
enable 802.1x and Guest VLAN function, please make sure the two are enabled in
Global Configuration (6.4.1).
Parameter
Description
Active Enable or disable 802.1x on each port.
Guest VLAN Enable or disable Guest VLAN on each port.
Reauthentication Enable or disable Reauthentication on each port.
Reauth-Period Enter non-zero number of seconds between every periodic re-
authentication of the supplications (Default value is 3600 seconds. This
means the authentication will be asked every one hour.)
2.4.4 801.x Status
This screen provides you with an at-a-glance status of 802.1 configurations.

MANAGED 8-PORT 10/100 + 2 G DUAL PERSONALITY SWITCH
14
2.5 Bridge Menu
Using the Bridge Menu
The Bridge menu is used for configuring the Spanning Tree Algorithm as well as the
traffic class priority threshold and the address aging time.
The Spanning Tree Algorithm is used for detecting and disabling network loops, and to
provide backup links between switches, bridges or routers. This allows the switch to
communicate and interact with other bridging devices (i.e. STA-compliant devices) in a
network to ensure that only one route exists between any two stations, and it provides
redundant or backup links that automatically take over when a primary link goes down.
2.5.1 Bridge Configuration (Enable / Disable RSTP)
Select the appropriate mode as per the network needs, then click on Apply to retain
newly entered information or click on Undo to restore previously saved configurations.
Parameter
Description
Disabled
RSTP (802.1W)
STP Port 1~10
Disable redundancy function
Redundant link via Rapid Spanning Tree Protocol
Enable (V): This port participates in the STP/RSTP algorithm execution
of the Switch if STP (802.1D) is selected.
Disable (_): This port doesn't participate in the STP/RSTP algorithm
execution of the Switch if STP (802.1D) is selected.

MANAGED 8-PORT 10/100 + 2 G DUAL PERSONALITY SWITCH
15
2.5.2 RSTP System Configuration
This screen allows the user to enter the RSTP parameters for the Switch. Please note:
users must select “RSTP (802.1W)” under Bridge Configuration to perform this
configuration. Otherwise, this option will not be accessible.
Enter the appropriate values, then click on Apply to retain newly entered information or
click on Undo to restore previously saved configurations.
Parameter
Description
Bridge Priority
Hello Time
Forward Delay
Maximum age
Set the bridge priority. The limit is given between 0 (the highest priority)
and 65535 (the lowest priority).
Bridge priority is used in selecting the root device, root port, and
designated port. The device with the highest priority becomes the STA
root device. However, if all devices have the same priority, the device
with the lowest MAC address will then become the root device.
Time interval (in seconds) at which the root device transmits a
configuration message.
The limit given is from 1 – 10 seconds.
Set Forward Delay. The limit given is from 4~30 seconds. This is the
maximum time (in seconds) the root device will wait before changing
states (i.e., listening to learning to forwarding).
Set the (maximum age) waiting time for receiving packets before
attempting to reconfigure the link. The limit given is from 6 – 40
seconds.
2.5.3 RSTP Per-Port Configuration
STP/RSTP allows the Switch to assign a priority status to each of its ports, with respect
to other networking nodes in the network. In other words, STP/RSTP determines the
best route for data to flow, given the priority level of each node on the network. Ensure
that this function is activated to avoid collisions and when setting up backup links.

MANAGED 8-PORT 10/100 + 2 G DUAL PERSONALITY SWITCH
16
Click on each parameter field to modify the desired setting, then click on Undo to restore
previously saved configurations or click on Apply to retain newly entered information.
See the descriptions below:
Parameter
Description
Port Type Priority
Cost
Edge
P2P
Set the priority of each port. The limit given is from 1 – 255. The
lowest number means highest priority. The default priority is set to
128 – the midpoint of this limit
Set the cost assigned to each port. This will determine the route of
information flow. The higher the cost the less suitable the port is to be
a node for the STP.
On: the port is connected to an end node, e.g., a network card
installed in a PC
Off: the port is connected to a bridged node
On: the link type of the port is Point-to-Point, connecting to one Bridge
Off: the link type of the port is Shared Medium, connecting to multiple
Bridges
Auto: the link type is automatically determined
2.6 VLAN Menu
A VLAN is a network of computers behaving as though they are connected to the same
segment, even though their physical location may be on a different segment of a LAN
altogether. VLANs are configured through software rather than hardware, which makes
them extremely flexible.
Some of the advantages of VLANs are:
•When a computer is physically moved to another location, it can stay on the same
VLAN without any hardware reconfiguration because VLANs are not limited by
hardware constraints.

MANAGED 8-PORT 10/100 + 2 G DUAL PERSONALITY SWITCH
17
•VLANs can be configured to define a network into various logical configurations. For
example, VLANs can define a network by application. In this scenario, a company
might create one VLAN for multimedia users and another for e-mail users.
•VLANs can also define a network by department. For example, a company might
have one VLAN for its Engineering Department, another for its Marketing
Department, and another for its Sales Department.
•VLANs can also be set up according to the organization’s internal structure. For
example, the company president might have his/her own VLAN, the executive staff
might have a different VLAN, and the remaining employees might have yet a
different VLAN.
As these examples show, VLANs offer incomparable flexibility. The following section
describes how VLANs can be deployed using the Switch.
2.6.1 VLAN Type (VLAN Configuration)
The “VLAN Type” menu let users select the VLAN type of the Switch.
Parameter
Description
Port-Based
Tag-Based
The VLAN function is enabled for Port-based VLANs.
The VLAN function is enabled for IEEE802.1Q VLANs

MANAGED 8-PORT 10/100 + 2 G DUAL PERSONALITY SWITCH
18
2.6.2 VLAN Configuration (Port-based)
The Menu “Port-Based” is for configuration of Port-Based VLAN. It is enabled only when
the VLAN Type is set as “Port-Based”.
At each port the user must click on the checkboxes of the ports to which the port is
allowed to switch frames from the configured port. And then click on Apply to retain
newly entered information. The status “Y” shows that the two ports can switch frames
with each other, while the status “-” means no connection is allowed.
Enable / Disable Switch Management:
Enable: The user can manage the Switch as Web/Telnet Client or SNMP Manager via
this port.
Disable: The Switch is not manageable from Web/Telnet Client or SNMP Manager via
this port.
2.6.3 QinQ Configuration (VLAN stacking)
QinQ is intended for service provider to distinguish multiple customers’ VLANs. By using
VLAN stacking to add another tag to tagged frames, which then becomes double-
tagged frames, a service provider can manage up to 4,094 VLAN groups with each
group containing up to 4,094 customer VLANs. This function allows a service provider to
provide different services, based on specific VLANs, for many different customers.
A service provider's customers may require a range of VLANs for multiple applications.
The service provider can assign inner VLAN tags on ports for different applications, as
well as an outer VLAN tag for each customer. Therefore, there is no VLAN tag
overlapping among customers, so traffic from different customers is kept separate.

MANAGED 8-PORT 10/100 + 2 G DUAL PERSONALITY SWITCH
19
Parameter
Description
SP TPID
Role
Priority
Set the service provider tag protocol identifier, 0x8100 or 0x9100. Or choose
“others” to set a four digit hexadecimal code from 0000 to ffff
Normal: non-VLAN stacking IEEE 802.1Q frame switching
Access: The incoming frame is treated as "untagged". The switch adds
the SP TPID tag to all incoming frames on the service provider's edge
devices
Tunnel: (available for Gigabit ports only) the Switch only adds the SP
TPID tag to all incoming frames on the service provider's edge devices
that have an SP TPID different to the one configured on the switch
Set VLAN Priority. The limit given is between 0 – 7. 0 is the lowest priority and
7 is the highest priority.
NOTE:
Static VLAN Tx Tagging MUST be disabled on a port where you choose Normal or
Access Port.
Static VLAN Tx Tagging MUST be enabled on a port where you choose Tunnel Port.

MANAGED 8-PORT 10/100 + 2 G DUAL PERSONALITY SWITCH
20
2.6.4 Tag-based VLAN Port Configuration (Port Info)
This menu allows the user to set the configuration of tag-based VLAN variables in a
more detailed way. The menu “Tag-Based” is for configuration of Tag-Based VLAN. It is
enabled only when the VLAN Type is set as “Tag-Based”. The sub-menu “Port Info” lets
users configure the way in which each port treats the incoming frames that are marked
for Tag-based VLANs.
Parameter
Description
PVID
Ingress Filter 1
(Non-Member)
and Filter 2
(Untagged)
Isolation
Set the VLAN ID. The limit is 1 to 4095. The VLAN ID is assigned to all
untagged frames received on this port.
Non-Member (1): Forward Untagged (2): Forward
Forward the VLAN-tagged frames that are not members of any VLAN
in which the port is participating, and forward all untagged frames.
Non-Member (1): Drop Untagged (2): Forward
Drop the VLAN-tagged frames which are not members of any VLAN
of which the port is participating, and forward all untagged frames.
Non-Member (1): Drop Untagged (2): Drop
Drop the VLAN-tagged frames which are not members of any VLAN
of which the port is participating, and drop all untagged frames.
Enable – The port is isolated. Isolated ports belonging to the same VLAN do
not communicate with each other – this is generally set for security
reasons. The isolated ports communicate only with the trunk ports,
which should NOT be set as “isolated”.
Disable – The port is not isolated and can communicate with all ports of the
VLANs.
2.6.5 Tag-based Info (VLAN Table)