Instruction/ maintenance manual of the product G8000 Blade ICE
Go to page of 145
2350 Mission College Blvd . Suite 600 Santa Clara, CA 95054 www.bladenetwork.net RackSwitch G8000 Applica tion Guide V ersion 1.0 TM P art Number : BMD00041, November 2008.
RackSwitch G8000 Application Guide 2 BMD00041, November 2008 Copyright © 2009 Blade Network T echnologies, Inc., 2350 Mission College Blv d., Suite 600, Santa Clara, California, 95054, USA.
BMD00041, Nov ember 2008 3 Co n t e n t s Preface 11 Who Should Use This Guide 11 What You’ll Find in This Guide 12 Typographic Conventions 13 How to Get Help 14 Chapter 1: Accessing the Switch 15 C.
RackSwitch G8000 Application Guide 4 BMD00041, November 2008 Chapter 3: VLANs 47 Overview 48 VLANs and Port VLAN ID Numbers 49 VLAN numbers 49 PVID numbers 50 VLAN Tagging 51 VLAN Topologies and De si.
RackSwitch G8000 Application Guide 5 BMD00041, Nov ember 2008 Why do we need multiple Spanning Trees? 84 PVRST configuration guidelines 85 Configuring PVRST 85 Multiple Spanning Tree Protocol 86 MSTP .
RackSwitch G8000 Application Guide 6 BMD00041, November 2008 Chapter 8: Basic IP Routing 119 IP Routing Benefits 120 Routing Between IP Subnets 121 Example of Subnet Routing 123 Using VLANs to segrega.
BMD00041, Nov ember 2008 7 Fi g u re s Figure 2-1:Authenticating a Port Using EAPoL 41 Figure 3-1:Default VLAN settings 52 Figure 3-2:Port-based VLAN assignment 53 Figure 3-3:802.1Q tagging (aft er port-based VLAN assignment) 53 Figure 3-4:802.1Q tag a ssign ment 54 Figure 3-5:802.
RackSwitch G8000 Application Guide 8 BMD00041, November 2008.
BMD00041, Nov ember 2008 9 Ta b l e s Table 1-1: User Access Levels 29 Table 1-2: Blade OS-prop rieta ry Attributes for RADIUS 29 Table 1-3: Default TACACS+ Authorization Levels 31 Table 1-4: Alternate TACACS+ Authorization Levels 31 Table 4-1: Actor vs .
RackSwitch G8000 Application Guide 10 BMD00041, November 2008.
BMD00041, Nov ember 2008 11 Pref a ce The RackSwitch G8000 Application Guide describ es how to configure and use the software on the RackSwitch G8000 switch. For documentati on about installing the switch physical ly , see the Installation Guide for your switch .
RackSwitch G8000 Application Guide 12 Preface BMD00041, November 2008 What Y ou’ll Find in Thi s G u id e This guide will help you p lan, implement, and administer RS G80 00 software. Where po ssible, each section provides feature overviews, usage examples, and configuration instructions.
RackSwitch G8000 Application Guide Preface 13 BMD00041, Nov ember 2008 T ypographic C on v entions The following table describes th e typog raphic styles used in this book.
RackSwitch G8000 Application Guide 14 Preface BMD00041, November 2008 How to Get Help If you need help, service, or technical assis tance, call Blade Network T echnologies T echnical Support: US toll free calls: 1-800 -414-5268 International calls: 1-408-83 4-7871 Y ou also can visit our websit e at the following address: http://www.
BMD00041, Nov ember 2008 15 C HAPTER 1 A cc essing the S witch The Blade OS software provides means for acces sing, configuring, and viewing information and statistics about the RackSwitch G8000.
RackSwitch G8000 Application Guide 16 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 C onfiguring an IP Inter face T o mana ge the swit ch using T elnet, SNMP , or a W eb browser , you must configure an IP inter- face. Configure the follo wing IP parameters: IP address Subnet mask Default gateway address 1.
RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch 17 BMD00041, No vember 2008 Us i ng T el n e t A T elnet connection offers th e convenience of accessing the swit ch from any workstation con- nected to the network.
RackSwitch G8000 Application Guide 18 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 Using the Br ow ser-Based Inter face The Browser -Based Interface (BBI) is a W eb- based management interface for interactive switch access through your W eb browser .
RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch 19 BMD00041, No vember 2008 Accessing the BBI via HTTPS requires a SSL certi ficate to be used during the key exchange. A default certificate is created the first time HTTPS is enabled, but you can import a new cer- tificate that defines the informat ion you want to be used.
RackSwitch G8000 Application Guide 20 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 U sing SNMP Blade OS provides SNMP v1.0 and SNMP v3.0 support for access through any network man- agement software, such as IB M Director or HP-OpenV iew .
RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch 21 BMD00041, No vember 2008 T o configure an SNMP user name , enter the followin g comm and: User configura tion: Users can be configured to use the authentication/privacy opti ons.
RackSwitch G8000 Application Guide 22 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 3. Assign the user to the user group. Use the gr oup table to link the user to a particular access group.
RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch 23 BMD00041, No vember 2008 C onfiguring SNMP T rap Hosts SNMPv1 trap host 1. Configure an entry in the notif y table. 2. Specify the IP address and other trap para meters in the targetAddr and targetParam tables.
RackSwitch G8000 Application Guide 24 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 SNMPv3 trap host configuration T o configure a user for SNMPv3 tr aps, you can choose to send the traps with both privacy and authentication, wi th auth entication only , or without privacy or auth enticat ion.
RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch 25 BMD00041, No vember 2008 Securing Ac cess to the S witch Secure switch managem ent is needed for environments that perform si gnificant management functions across the Internet.
RackSwitch G8000 Application Guide 26 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 RADIUS Authentica tion and Authorization Blade OS supports the RADIUS (Remote Authentication Dial -in User Service) method to authenticate and authorize remo te administrators for managing the switch.
RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch 27 BMD00041, No vember 2008 Configuring RADIUS Use the following procedure to configure RADIUS authentication on your switch. 1. Configure the Primary and Secondar y RADIUS servers, and enable RADIUS authentication.
RackSwitch G8000 Application Guide 28 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 RADIUS authentication fe atur es in Blade OS Blade OS supports the followin g RADIUS authentication features: Supports RADIUS client on the switch, ba sed on the protocol definitions in RFC 2138 and RFC 2866.
RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch 29 BMD00041, No vember 2008 Switch User Acco unts The user accounts listed in T able 1 - 1 can be defined in the RADIU S server dictionary file.
RackSwitch G8000 Application Guide 30 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 T A CACS+ A uthentication Blade OS supports authentication and authorization w ith networks using the Ci sco Systems T ACACS+ protocol.
RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch 31 BMD00041, No vember 2008 T ACA CS+ authentication featur es in Blade OS Authentication is the action of determining the iden tit y of a user , and is generally done when the user first attempts to log in to a device or gain access to its serv ices.
RackSwitch G8000 Application Guide 32 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 If the remote user is successfully authenti cated by the authentication server , the switch verifies the privi leges of the remote user and authorizes the appropriate access.
RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch 33 BMD00041, No vember 2008 When T ACACS+ Command Logging is enabled, Blade OS configuration commands are logged on the T ACACS+ server .
RackSwitch G8000 Application Guide 34 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 Secure Shell Secure Shell (SSH) use secure tunnels to en crypt and secure messages between a remote administrator an d the switch. T e lnet does not prov ide this level of security .
RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch 35 BMD00041, No vember 2008 Generating RSA Host and Se r ver Keys for SSH access T o supp ort the SSH server feature, two set s of RSA keys (host and server keys) are required. The host key is 1024 bits and is used to identify the G8000 .
RackSwitch G8000 Application Guide 36 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 End User A cc e ss C ontrol Blade OS allows an administrator to define e nd user accounts that permit end users to perform operation tasks via the switch CLI commands.
RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch 37 BMD00041, No vember 2008 Defining a User ’ s access lev el The end user is by default assigned to the user access level (also known as class of s e rvice, or COS).
RackSwitch G8000 Application Guide 38 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008.
BMD00041, Nov ember 2008 39 C HAPTER 2 P or t-based Network A cc ess Contr ol Port-Based Network Access cont rol provides a means of authenticating and authorizing devices attached to a LAN port that has point-to-point connectio n characteristics. It prevents access to ports that fail authentica tion and authoriza tion.
RackSwitch G8000 Application Guide 40 Chapter 2: Port-based Network Access Control BMD00041, Nov ember 2008 Extensible Authentication P rotocol o ver LAN The G8000 can provide user-level security for its ports using the IEEE 802.1X protocol, whi ch is a more secure alternative to other method s of port-based network access control.
RackSwitch G8000 Application Guide Chapter 2: Port-based Network Access Control 41 BMD00041, No vember 2008 802.1X authentication pr ocess The clients and authenticators communicate using Extensible Authenticati on Protocol (EAP), which was originally designed to run over PPP , and for which the IEEE 802.
RackSwitch G8000 Application Guide 42 Chapter 2: Port-based Network Access Control BMD00041, Nov ember 2008 EAP oL mess age exchange During authentication, EAPOL messages are exchanged be tween the client and the G8000 authenticator , while RADIUS-EAP messages ar e exchanged between th e G8000 authenticator and the RADIUS server .
RackSwitch G8000 Application Guide Chapter 2: Port-based Network Access Control 43 BMD00041, No vember 2008 802.1X por t states The state of the port determines whether the client is granted access to the network, as follows: Unauthorized While in this state the port discards all ingress and egress traf fic except EAP packets.
RackSwitch G8000 Application Guide 44 Chapter 2: Port-based Network Access Control BMD00041, Nov ember 2008 Suppor ted RADIUS attributes The G8000 802.
RackSwitch G8000 Application Guide Chapter 2: Port-based Network Access Control 45 BMD00041, No vember 2008 C onfiguration guidelines When configuring EAPoL, consid er the following guidelines: The 802.
RackSwitch G8000 Application Guide 46 Chapter 2: Port-based Network Access Control BMD00041, Nov ember 2008.
BMD00041, Nov ember 2008 47 C HAPTER 3 VLANs This chapter describes network design and topol o gy considerations for using V i rt ua l Lo ca l Ar ea Ne tw ork s ( VL ANs ).
RackSwitch G8000 Application Guide 48 Chapter 3: VLANs BMD00041, Nov ember 2008 Ov ervi e w Setting up virt ual LANs (VLANs) is a way to segment netwo rks to increase network flex ibility without changing the physical network topology . W ith network segmentation, each switch port connects to a segment that is a single broadcast domain.
RackSwitch G8000 Application Guide Chapter 3: VLANs 49 BMD00041, Nov e mber 2008 VLANs and P or t VL AN ID Numbers VLAN numbers The G8000 supports up to 1024 VLAN s per switch. Ev en though the maximum num ber of VLANs supported at any given time is 1024, each can be identified wi th any number between 1 and 4094.
RackSwitch G8000 Application Guide 50 Chapter 3: VLANs BMD00041, Nov ember 2008 PVID nu mbers Each port in the switch has a configurable default VLAN number, known as its PV ID . By default, the PVID for all ports is set to 1, which correlates to the default VLAN ID .
RackSwitch G8000 Application Guide Chapter 3: VLANs 51 BMD00041, Nov e mber 2008 VLAN T aggi ng Blade OS software supports IEEE 802.1Q VLAN tagging, providing standards-based VLAN support for Ethernet systems. T agging places the VLAN id entifier in the frame header of a packet, allowing each port to belong to multiple VLANs.
RackSwitch G8000 Application Guide 52 Chapter 3: VLANs BMD00041, Nov ember 2008 N OTE – If a 802.1Q tagged frame is received by a port that has VLAN-tagging d isabled and the port VLAN ID (PVID) is di fferent than the VLAN ID of the packet, then the frame is dropped at the ingress port.
RackSwitch G8000 Application Guide Chapter 3: VLANs 53 BMD00041, Nov e mber 2008 Figure 3-2 throu gh Figure 3-5 illu strate generic examples of VLAN tagging.
RackSwitch G8000 Application Guide 54 Chapter 3: VLANs BMD00041, Nov ember 2008 In Figure 3-4 , tagged incoming packets are assigned di rectly to VLAN 2 because of the tag assignment in the packet. Po rt 5 is configured as a tagged member of VLAN 2, and port 7 is configured as an untagged member of VLAN 2.
RackSwitch G8000 Application Guide Chapter 3: VLANs 55 BMD00041, Nov e mber 2008 VLAN T opologies and Design C onsidera tions By default, the G8000 software is configured so that tagging is disabled on all po rts. By default, the G8000 software is configured so that all ports are members of VLAN 1.
RackSwitch G8000 Application Guide 56 Chapter 3: VLANs BMD00041, Nov ember 2008 Multiple VLANs with T agging Adapters Figure 3-6 Example 1: Multiple VLANs with VLAN-T agged Gigabit Adapters The fe.
RackSwitch G8000 Application Guide Chapter 3: VLANs 57 BMD00041, Nov e mber 2008 N OTE – VLAN tagging is required only on ports that are connected to oth er switches or on ports that connect to tag-capable end-stations, such as servers with VLAN-tagging adapters.
RackSwitch G8000 Application Guide 58 Chapter 3: VLANs BMD00041, Nov ember 2008 VLAN configurat ion example Use the following procedure to conf igure the example network show n in Figure 3-6 . 1. Enable VLAN taggi ng on server port s that support multiple VLANs.
RackSwitch G8000 Application Guide Chapter 3: VLANs 59 BMD00041, Nov e mber 2008 Pri vate VL A Ns Private VLANs provide Layer 2 isolation b etween the ports within the same broadcast domain. Private VLANs can contro l traffic within a VLAN domain, a nd provide port-based security fo r host servers.
RackSwitch G8000 Application Guide 60 Chapter 3: VLANs BMD00041, Nov ember 2008 Community—A communi ty po rt is a host port that belongs to a community VLAN. Com- munity ports can co mmunicate with o ther ports in the same community VLAN, and with promiscuous ports.
RackSwitch G8000 Application Guide Chapter 3: VLANs 61 BMD00041, Nov e mber 2008 2. Configure a secondary VLAN and map it to the primary VLAN. 3. V erify the configuration.
RackSwitch G8000 Application Guide 62 Chapter 3: VLANs BMD00041, Nov ember 2008.
BMD00041, Nov ember 2008 63 C HAPTER 4 Po r t s a n d T r u n k i n g T ru nk groups can pro vide super-bandwidth, multi-link connections between swit ches or othe r trunk-capable devices. A trunk g roup is a group of ports that act together , comb ining their bandwidth to create a single, la r ger virtual link.
RackSwitch G8000 Application Guide 64 Chapter 4: Ports and Trunking BMD00041, Nov ember 2008 Ov ervi e w When using port trunk groups betw een two switches, as shown in Figure 4-1 , you can create a virtual link between the switches, operating up to 40 Gb per second, depen ding on how many physical ports are combined.
RackSwitch G8000 Application Guide Chapter 4: Ports and Trunking 65 BMD00041, No vember 2008 Before y ou configure sta tic trunks When you create and enable a static trunk, the trunk members (switch ports) take on certain settings necessary for correct ope ration of the trunking feature.
RackSwitch G8000 Application Guide 66 Chapter 4: Ports and Trunking BMD00041, Nov ember 2008 All trunk members must be in the same Spanning Tree Group (STG) and can belong to only one Spanning Tree Group (STG). However if all ports are tagg ed , then all trunk ports can belong to multiple STGs.
RackSwitch G8000 Application Guide Chapter 4: Ports and Trunking 67 BMD00041, No vember 2008 Po r t T r u n k i n g E x a m p l e In the example below , three ports are trunked between two switches.
RackSwitch G8000 Application Guide 68 Chapter 4: Ports and Trunking BMD00041, Nov ember 2008 2. Repeat the process on the other switch. 3. Connect the switch port s that will be members in the trunk group. T ru nk group 3 (o n the G80 00) is now connected to trunk group 1 (on the other switch).
RackSwitch G8000 Application Guide Chapter 4: Ports and Trunking 69 BMD00041, No vember 2008 C onfigurable T runk Hash Algorithm This feature allows you to configure parameters for the tru nk hash algo rithm, instead of using the default values.
RackSwitch G8000 Application Guide 70 Chapter 4: Ports and Trunking BMD00041, Nov ember 2008 Link Aggr egation Con trol Pr otocol Link Aggregation Control Protocol (LACP) is an IEEE 802.
RackSwitch G8000 Application Guide Chapter 4: Ports and Trunking 71 BMD00041, No vember 2008 LACP automatically determi nes which member lin ks can be aggregated and then aggregates them. It provides for the co ntrolled addition and removal of physical links for the link ag grega- tion.
RackSwitch G8000 Application Guide 72 Chapter 4: Ports and Trunking BMD00041, Nov ember 2008 LA CP configur ation guidelines Consider the following guidelin es when you con figure LACP trunks: When ports become memb ers of a trunk, configuration parameters (except ACL and QoS) are applied per trunk.
BMD00041, Nov ember 2008 73 C HAPTER 5 Spanning T ree When multiple paths exist on a network , Spanni ng Tree Protocol configures the network so that a switch uses only the most ef ficient path.
RackSwitch G8000 Application Guide 74 Chapter 5: Spanning Tree BMD00041, November 2008 Ov ervi e w Spanning Tree Protocol detects and eliminates logi cal loops in a bridged or switched network. When multiple paths exist, Span ning Tr ee configures the network so that a sw itch uses only the most efficient path.
RackSwitch G8000 Application Guide Chapter 5: Spanning Tree 75 BMD00041 , November 2008 Bridge Pr otocol Da ta Units (BPDUs) T o create a Spanning Tr ee, the switch generates a configuration Bridge Protocol Data Unit (BPDU), which it then forwards out of its ports.
RackSwitch G8000 Application Guide 76 Chapter 5: Spanning Tree BMD00041, November 2008 Po r t Pr i o ri t y The port priority helps determine wh ich bri dge po rt beco mes the root/designated port. The case for the root port is when 2 switches ar e connected using a minimum of two links with the same path-cost.
RackSwitch G8000 Application Guide Chapter 5: Spanning Tree 77 BMD00041 , November 2008 Assigning a VLAN to a Spanning T ree Gr oup If no VLANs exist beyond the default VLAN 1 see “Creating a VLAN” on page 78 for information on adding ports to VLANs.
RackSwitch G8000 Application Guide 78 Chapter 5: Spanning Tree BMD00041, November 2008 Creating a VLAN When you create a VLAN, that VLAN automatically belongs to STG 1, the default STG . Y o u can assign the VLAN to another STG . Move a newly created VLAN to an existing STG by following thi s order: Create the VLAN.
RackSwitch G8000 Application Guide Chapter 5: Spanning Tree 79 BMD00041 , November 2008 As an example, assume that port 1 belongs to VLAN 2, and VLAN 2 belongs to STG 2. When you remove port 1 from VLAN 2, port 1 is also removed from STG 2. The port moves to the default VLAN 1.
RackSwitch G8000 Application Guide 80 Chapter 5: Spanning Tree BMD00041, November 2008 Rapid Spanning T ree Pr otocol Rapid Spanning Tree Protocol (RSTP) provides rapid convergence of the spanning tree and provides for fast re-configuration critical for netw orks carrying delay-sensitive traf fic such as voice and video.
RackSwitch G8000 Application Guide Chapter 5: Spanning Tree 81 BMD00041 , November 2008 P or t T ype and Link T ype Spanning Tree configuration includes the following parameters to support RSTP and MSTP: edge port and link type. Edge P or t A port that does not connect to a bridge is called an edge port .
RackSwitch G8000 Application Guide 82 Chapter 5: Spanning Tree BMD00041, November 2008 RSTP configura tion example This section provides steps to configure Ra pid Spanning Tree on the G8000, using th e Command-Line Interface (ISCLI). Rapid Spanning T ree Protocol is the default setting on the G8000.
RackSwitch G8000 Application Guide Chapter 5: Spanning Tree 83 BMD00041 , November 2008 P er VLAN Rapid Spanning T ree Per VLAN Rapid Spanning T ree Plu s Protocol (PVRST+) enhances the RSTP protocol by adding the ability to have multiple spann ing tree groups.
RackSwitch G8000 Application Guide 84 Chapter 5: Spanning Tree BMD00041, November 2008 Wh y do we need multiple Spanning T rees? The following examples describe why we need mult iple spann ing trees. In Figure 5-1 , VLAN 1 an d VLAN 2 pass traffic between switch 1 and switch 2.
RackSwitch G8000 Application Guide Chapter 5: Spanning Tree 85 BMD00041 , November 2008 PVRST co nfigura tion guidelines This section provides important informat ion about configuring Per VLAN Rap.
RackSwitch G8000 Application Guide 86 Chapter 5: Spanning Tree BMD00041, November 2008 Multiple Spanning T ree P rotocol Multiple Spanning Tree extends Rapid Spannin g T ree Protoco l through multip le Spanning T ree Groups, using multiple VLANs in each ST G .
RackSwitch G8000 Application Guide Chapter 5: Spanning Tree 87 BMD00041 , November 2008 MSTP configur ation guidelines This section provides important informat ion about configuring Multiple Span ning T ree Groups: When MSTP is turned on, the switch automatically moves all VLANs to the CIST .
RackSwitch G8000 Application Guide 88 Chapter 5: Spanning Tree BMD00041, November 2008 Figure 5-3 Implementing M ultiple S panning T ree Group s Server 1 VLAN 2 Server 2 VLAN 2 Server 3 VLAN 1 Ser.
RackSwitch G8000 Application Guide Chapter 5: Spanning Tree 89 BMD00041 , November 2008 Configuring Multiple Spanning T ree Groups This configuration shows how to configure MSTP Groups on the switch, as shown in Figure 5-3 . 1. Configure port memb ership and define the Spanning T ree gr oups for VLAN 1.
RackSwitch G8000 Application Guide 90 Chapter 5: Spanning Tree BMD00041, November 2008 3. Configure port memb ership and define the Spanning T ree gr oups for VLAN 2. Add server ports 3, 4, and 5 to VLAN 2. Add uplink po rts 51 and 52 to VLAN 2. Assign VLAN 2 to Spanning T ree G roup 2.
RackSwitch G8000 Application Guide Chapter 5: Spanning Tree 91 BMD00041 , November 2008 Fa s t U p l i n k C o n v e r g e n c e Fast Uplink Conver gence enables the G8000 to r ecover quickly from the failure of the primary link or trunk group in a Layer 2 netwo rk usin g Sp anning T ree Protocol.
RackSwitch G8000 Application Guide 92 Chapter 5: Spanning Tree BMD00041, November 2008.
BMD00041, Nov ember 2008 93 C HAPTER 6 Quality of Ser vice Quality of Service featur es allow you to allocat e network reso urces to mission-critical appli ca- tions at the expense of ap plications that are less sensitive to such factors as time delays or net- work congestion.
RackSwitch G8000 Application Guide 94 Chapter 6: Quality of Service BMD00041, Nov ember 2008 Overview QoS helps you allocate gu aranteed bandwidth to the critical applications, and limit bandwi dth for less critical applications.
RackSwitch G8000 Application Guide Chapter 6: Quality of Service 95 BMD00041, No vember 2008 Us i n g AC L Fi l te r s Access Control Lists are filters that allow you to cl assify dat a packets ac.
RackSwitch G8000 Application Guide 96 Chapter 6: Quality of Service BMD00041, Nov ember 2008 IP Standard A CLs The switch supports up to 127 IP ACLs (standard and extended). IP Standard ACLs are num- bered from 1-1000. Use IP Standard ACLs to filter traffic us ing s ource IP address/network mask and destination IP address/netw ork/mask.
RackSwitch G8000 Application Guide Chapter 6: Quality of Service 97 BMD00041, No vember 2008 T o create an IP Extended ACL: T o delete an IP Extended ACL: T able 6-1 Well-known protocol types Numb.
RackSwitch G8000 Application Guide 98 Chapter 6: Quality of Service BMD00041, Nov ember 2008 Understanding A CL priorit y Each ACL has a unique priority , based on its nu mber . The higher the ACL number , the higher the priority , so ACL 1 has the lowest priority .
RackSwitch G8000 Application Guide Chapter 6: Quality of Service 99 BMD00041, No vember 2008 N OTE – T o ensure your ACLs function properly , do not assign the same ACL to different ports using different filtering directions. It is recommended that you create two ACLs, one for ingress traffic, and one for egres s traffic.
RackSwitch G8000 Application Guide 100 Chapter 6: Quality of Service BMD00041, Nov ember 2008 A CL configura tion examples Example 1 Use this configuration to block traf fic to a speci fic host. All traffic that ingresses port 1 is denied if it is destined for the host at IP address 100.
RackSwitch G8000 Application Guide Chapter 6: Quality of Service 101 BMD00041, No vember 2008 Example 2 Use this configuration to block traffic from a network destined for a specific host address. All traffic that ingresses port 10 with source IP from the class 100.
RackSwitch G8000 Application Guide 102 Chapter 6: Quality of Service BMD00041, Nov ember 2008 Example 3 Use this configuration to block traffic from a netw ork that is destined for a specific egress port. All traffic that egresses port 6 from the network 100.
RackSwitch G8000 Application Guide Chapter 6: Quality of Service 103 BMD00041, No vember 2008 Example 5 Use this configuration to block all traffic exce pt traffic of certain ty pes . HTTP/HTTPS, DHCP , and ARP packets are permitted on the port. All other traffic is denied.
RackSwitch G8000 Application Guide 104 Chapter 6: Quality of Service BMD00041, Nov ember 2008 5. Assign the ACLs to a port. RS G8000 (config)# interface port 7 RS G8000 (config-if)# ip access-grou.
RackSwitch G8000 Application Guide Chapter 6: Quality of Service 105 BMD00041, No vember 2008 U sing Storm C ontrol F ilters The G8000 provides filters th at can limit the number of the following .
RackSwitch G8000 Application Guide 106 Chapter 6: Quality of Service BMD00041, Nov ember 2008 U sing DSCP V alues to Pro vide QoS The switch uses the Differentiated Services (D if fServ) architecture to provide Qo S fu nctions. DiffServ is described in IETF RFCs 2474 and 2475.
RackSwitch G8000 Application Guide Chapter 6: Quality of Service 107 BMD00041, No vember 2008 The switch can perform the following actions to the DSCP: Read the DSCP value of ingress packets. Map the DSCP value to an 802.1p priority . The switch can use the DSCP value to direct traf fic prioritization.
RackSwitch G8000 Application Guide 108 Chapter 6: Quality of Service BMD00041, Nov ember 2008 P er Hop Behavior The DSCP value determines the Per Hop Behavi or (PHB) of each packet. The PHB is the for- warding treatment given to packets at each hop.
RackSwitch G8000 Application Guide Chapter 6: Quality of Service 109 BMD00041, No vember 2008 QoS Lev els T abl e 6-3 shows the default service levels provided by the switch, listed from highest to lowest importance: T able 6-3 Default QoS Service Levels Service Level Default PHB 802.
RackSwitch G8000 Application Guide 110 Chapter 6: Quality of Service BMD00041, Nov ember 2008 DSCP-to-802.1p mapping The switch can use the DSCP value of ingress p ackets to set the 802.1p pr iority value. Use the following command to vi ew the default settings.
RackSwitch G8000 Application Guide Chapter 6: Quality of Service 111 BMD00041, No vember 2008 U sing 802.1p Priority t o Pr ovide QoS The G8000 provides Qual ity of Service functions based on the priority bits in a packet’ s VLAN header . (The priority bits are defined by the 802 .
RackSwitch G8000 Application Guide 112 Chapter 6: Quality of Service BMD00041, Nov ember 2008 802.1p configur ation e xample 1. Configure a port’ s default 802.1p priority value t o 2. 2. Map the 802.1p priority value to a COS queue and set the COS queue scheduling weight.
BMD00041, Nov ember 2008 113 C HAPTER 7 Remote Monitor ing Remote Monitoring (RMON) allows network de vi ces to exchange network monitorin g data. RMON allows the switch to perform the following functio ns: T rack events and trigger alarms when a threshold is reached.
RackSwitch G8000 Application Guide 114 Chapter 7: Remote Monitoring BMD00041, Nov ember 2008 RMON group 1—Sta tistics The switch supports collection of Ethernet statis tics as outlined in the RMON statistics MIB, in reference to etherStatsT able.
RackSwitch G8000 Application Guide Chapter 7: Remote Monitoring 115 BMD00041 , November 2008 RMON group 2—Histor y The RMON History group allows you to samp le an d archive Ethernet statistics for a specific interface during a specific ti me interval.
RackSwitch G8000 Application Guide 116 Chapter 7: Remote Monitoring BMD00041, Nov ember 2008 Configuring RMON History Perform the following steps to configure RMO N History on a port. 1. Enable RMON on a port. 2. Configure the RMON History parameters for a port.
RackSwitch G8000 Application Guide Chapter 7: Remote Monitoring 117 BMD00041 , November 2008 Use one of the following commands to corr elate an Alarm index to an Event index: When the alarm threshold is reached, the corresponding even t is triggered.
RackSwitch G8000 Application Guide 118 Chapter 7: Remote Monitoring BMD00041, Nov ember 2008 Example 2 1. Configure the RMON Alarm parame ters to track ICMP messages. This configuration creates an RMON alarm that checks icmpInEchos on the switch once every minute.
BMD00041, Nov ember 2008 119 C HAPTER 8 Basic IP Routing Th i s ch apt e r provides configuration background and examples for using the G8000 to perform IP routing functions.
RackSwitch G8000 Application Guide 120 Chapter 8: Basic IP Routing BMD00041, Nov ember 2008 IP Routing Benefits The switch uses a combination of configurable IP switch interfaces and IP routing options. The switch IP routing capab ilities provide the foll owing benefits: Connects the server IP subnets to the rest of the backbone network.
RackSwitch G8000 Application Guide Chapter 8: Basic IP Routing 121 BMD00041, Nov ember 2008 Routing Betw een IP Subnets The physical layout o f most corporat e networks has evolved over time. Classic hub/router topologies have given way to faster sw itched topologies, particularly now that switches are increasingly intelligent.
RackSwitch G8000 Application Guide 122 Chapter 8: Basic IP Routing BMD00041, Nov ember 2008 This is a situation that switching alone cannot cure. In st ead, th e router is flooded with cross- subnet communicatio n. This comprom ises efficiency in two ways: Routers can be slower than switches.
RackSwitch G8000 Application Guide Chapter 8: Basic IP Routing 123 BMD00041, Nov ember 2008 Example of Subnet Routing Consider the role of the G8000 in the following configuratio n example: Figure.
RackSwitch G8000 Application Guide 124 Chapter 8: Basic IP Routing BMD00041, Nov ember 2008 Using VLANs t o segregate Br oadcast Domains If you want to control the broadcasts on your ne twork, use VLANs to create distinct bro adcast domains. Create one VLAN for each serv er subnet, and one for the router .
RackSwitch G8000 Application Guide Chapter 8: Basic IP Routing 125 BMD00041, Nov ember 2008 3. Determine which switch ports and IP interf aces belong to which VLANs.
RackSwitch G8000 Application Guide 126 Chapter 8: Basic IP Routing BMD00041, Nov ember 2008 5. Assign a VLAN to each IP interface. Now that the ports are separate d int o VLANs, the VLANs are a ssigned to the appropriate IP interface for each subnet.
RackSwitch G8000 Application Guide Chapter 8: Basic IP Routing 127 BMD00041, Nov ember 2008 Dynamic Host C onfigura tion Prot ocol Dynamic Host Configuration Protocol (D HCP) is a transport protoc.
RackSwitch G8000 Application Guide 128 Chapter 8: Basic IP Routing BMD00041, Nov ember 2008.
BMD00041, Nov ember 2008 129 C HAPTER 9 IGMP Internet Group Management Protocol (IGMP) is used by IP Multicast routers to learn abo ut the existence of host group members on their direct ly attached subnet (see RFC 2236).
RackSwitch G8000 Application Guide 130 Chapter 9: IGMP BMD 00041, November 20 08 IGMP Snooping IGMP Snooping allows the switch to fo rward mu lticast traffic only to those ports that request it. IGMP Snooping prevents multicast traffic from being flooded to all ports.
RackSwitch G8000 Application Guide Chapter 9: IGMP 131 BMD00041, No vember 2008 Fa s t L e a v e In normal IGMP operation, when the switch receives an IGMP v2 Leave message, it sends a Group-Specific Query to determine if any other devices in the same group (and on the same port) are still interested in the specified multicast group traffic.
RackSwitch G8000 Application Guide 132 Chapter 9: IGMP BMD 00041, November 20 08 The switch supports the following IG MPv 3 filter modes: INCLUDE mode: T he host requests membership to a multicast group and provides a list of IP addresses from which it wants to receive traffic.
RackSwitch G8000 Application Guide Chapter 9: IGMP 133 BMD00041, No vember 2008 5. V iew dynamic IGMP information. These commands display information about IGMP Gro ups and Mrouters learned by the switch. RS G8000# show ip igmp groups Note: Local groups (224.
RackSwitch G8000 Application Guide 134 Chapter 9: IGMP BMD 00041, November 20 08 Static Multicast Router A static multicast router (Mrou t er) can be configured for a par ticular port on a particular VLAN. A static Mrouter does no t have to be learned thro ugh IGMP Snooping.
BMD00041, Nov ember 2008 135 C HAPTER 10 High A vailability The RackSwitch G8000 supports high-availabi lity network topolo gies. The following topics are discussed in this chapter: “Uplink Failure Detect ion” on page 136 .
RackSwitch G8000 Application Guide 136 Chapter 10: High Availability BMD00041, Nov ember 2008 Uplink F ailure Detec tion Uplink Failure Detection (UFD) is designed to suppo rt Net work Adapter T eaming. Network Adapter T eaming allows all the NICs on each serv er to share the same IP address.
RackSwitch G8000 Application Guide Chapter 10: High Availability 1 37 BMD00041, November 2008 F ailure Detection Pair T o use UFD , yo u must confi gure a Failure Detectio n Pai r and then turn UFD on.
RackSwitch G8000 Application Guide 138 Chapter 10: High Availability BMD00041, Nov ember 2008 C onfiguring UFD Figure 10-1 shows a basic UFD configurat ion. In this example, NIC 1 is the primary network adapter; NIC 2 is a non-primary adapter . NIC 1 is connected to port 16 and NIC 2 is connected to port 17.
BMD00041, Nov ember 2008 139 A PPENDIX A T roubleshooting This section discusses some tools to help you troubleshoo t common problems on the RackSwitch G8000: “Monitoring Ports” on page 140.
RackSwitch G8000 Application Guide 140 Appendix A: Troubles hooting BMD00041, November 20 08 Monitoring P or ts The port mirroring feature in the G8000 allows you to attach a sniffer to a monitoring port that is configured to receive a copy of all packets that are forwarded from the mirrored port.
RackSwitch G8000 Application Guide Appendix A: Troubleshooting 141 BMD00041, Nov e mber 2008 P or t Mirroring beha vior This section describes the composition of mo nitored packets in the switch, based on the configuration of the ports. The following port-mirroring cases app ly to th e G 8000 : Ingress mirrored packet s are not modified.
RackSwitch G8000 Application Guide 142 Appendix A: Troubles hooting BMD00041, November 20 08.
BMD00041, Nov ember 2008 143 Inde x Symbols ............. ........... .............. ............... .............. ..... 129 [ ] ........................ .......................... ..................... 13 Numerics 802.1p .................... .......
RackSwitch G8000 Application Guide 144 Index BMD00041, November 2008 I IBM Director .......................... ........... .............. ....20 ICMP ........... .............. .............. ............ .............. .97 IEEE standards 802.1D .
RackSwitch G8000 Application Guide Index 145 BMD00041, Nov e mber 2008 RSA keys ............ ........... ............... .............. ....... 35 RSTP ............. ......................... ........... .............. .. 80 S security port mirroring .
An important point after buying a device Blade ICE G8000 (or even before the purchase) is to read its user manual. We should do this for several simple reasons:
If you have not bought Blade ICE G8000 yet, this is a good time to familiarize yourself with the basic data on the product. First of all view first pages of the manual, you can find above. You should find there the most important technical data Blade ICE G8000 - thus you can check whether the hardware meets your expectations. When delving into next pages of the user manual, Blade ICE G8000 you will learn all the available features of the product, as well as information on its operation. The information that you get Blade ICE G8000 will certainly help you make a decision on the purchase.
If you already are a holder of Blade ICE G8000, but have not read the manual yet, you should do it for the reasons described above. You will learn then if you properly used the available features, and whether you have not made any mistakes, which can shorten the lifetime Blade ICE G8000.
However, one of the most important roles played by the user manual is to help in solving problems with Blade ICE G8000. Almost always you will find there Troubleshooting, which are the most frequently occurring failures and malfunctions of the device Blade ICE G8000 along with tips on how to solve them. Even if you fail to solve the problem, the manual will show you a further procedure – contact to the customer service center or the nearest service center
