Manuel d'utilisation / d'entretien du produit G8000 du fabricant Blade Network Technologies
Aller à la page of 145
2350 Mission College Blvd . Suite 600 Santa Clara, CA 95054 www.bladenetwork.net RackSwit ch G8000 A p plica tion Guide V ersion 1.0 TM P art Number: BMD00041, Nove mber 2008.
RackSwitch G8000 Application Guide 2 BMD00041, November 2008 Copyright © 2009 Blade Network T echnologies, Inc., 2350 Mission College Blv d., Suite 600, Santa Clara, California, 95054, USA.
BMD00041, Nov ember 2008 3 Co n t e n t s Preface 11 Who Should Use This Guide 11 What You’ll Find in This Guide 12 Typographic Conventions 13 How to Get Help 14 Chapter 1: Accessing the Switch 15 C.
RackSwitch G8000 Application Guide 4 BMD00041, November 2008 Chapter 3: VLANs 4 7 Overview 48 VLANs and Port VLAN ID Numbers 49 VLAN numbers 49 PVID numbers 50 VLAN Tagging 51 VLAN Topologies and De s.
RackSwitch G8000 Application Guide 5 BMD00041, Nov ember 2008 Why do we need multiple Spanning Trees? 84 PVRST configuration guidelines 85 Configuring PVRST 85 Multiple Spanning Tree Protocol 86 MSTP .
RackSwitch G8000 Application Guide 6 BMD00041, November 2008 Chapter 8: Basic IP Routing 119 IP Routing Benefits 120 Routing Between IP Subnets 121 Example of Subnet Routing 123 Using VLANs to segrega.
BMD00041, Nov ember 2008 7 Fi g u r e s Figure 2-1:Authenticating a Port Using EAPoL 41 Figure 3-1:Default VLAN settings 52 Figure 3-2:Port-based VLAN assignment 53 Figure 3-3:802.1Q tagging (aft er port-based VLAN assignment) 53 Figure 3-4:802.1Q tag a ssignment 54 Figure 3-5:802.
RackSwitch G8000 Application Guide 8 BMD00041, November 2008.
BMD00041, Nov ember 2008 9 Ta b l e s Table 1-1: User Access Levels 29 Table 1-2: Blade OS-p roprieta ry Attributes for RADIUS 29 Table 1-3: Default TACACS+ Authorization Levels 31 Table 1-4: Alternate TACACS+ Authorization Levels 31 Table 4-1: Actor v s.
RackSwitch G8000 Application Guide 10 BMD00041, November 2008.
BMD00041, Nov ember 2008 11 Pref a ce The RackSwitch G8000 Application Guide describ es how to configure and use the software on the RackSwitch G8000 switch. For documentati on about installing the switch physically , see the Installation Guide for your sw itch .
RackSwitch G8000 Application Guide 12 Pref ace BMD00041, November 2008 What Y ou’ll Find i n Th is G ui de This guide will help yo u plan, implement, and admi nister RS G8000 software. Wh ere possible, each section provides feature overviews , usage examples, and configuration instructions.
RackSwitch G8000 Application Guide Preface 13 BMD00041, Nov ember 2008 T ypographic C onv entions The following table describe s th e typog raphic styles used in this book.
RackSwitch G8000 Application Guide 14 Pref ace BMD00041, November 2008 How to Get Help If you need help, service, or technical as sistance, call Blade Network T echnologies T echnical Support: US toll free calls: 1-800 -414-5268 International calls: 1-408 -83 4-7871 Y ou also can visit our websit e at the following address: http://www.
BMD00041, Nov ember 2008 15 C HAPTER 1 A c c essing the S wit ch The Blade OS software provides means for acces sing, configuring, and viewing information and statistics about the RackSwitch G8000.
RackSwitch G8000 Application Guide 16 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 C onfiguring an IP Int er fac e T o man a ge the swit ch using T eln et, SNMP , or a W eb browser , you must configure an IP inter- face. Configure the follo wing IP parameters: IP address Subnet mask Default gateway address 1.
RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch 17 BMD00041 , November 2008 Us i n g T e l n e t A T elnet connection offers th e convenience of accessing the swit ch from any workstation con- nected to the network.
RackSwitch G8000 Application Guide 18 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 Using the Br ow ser-Based Inter fac e The Browser -Based Interface (BBI) is a W eb- bas ed management interface for interactive switch access through your W eb browser .
RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch 19 BMD00041 , November 2008 Accessing the BBI via HTTPS requires a SSL certi ficate to be used during the key exchange. A default certificate is created the first time HTTPS is enabled, but you can import a new cer- tificate that defines the informat ion you want to be used.
RackSwitch G8000 Application Guide 20 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 U sing SNMP Blade OS provides SNMP v1.0 and SNMP v3.0 support for access through any network man- agement software, such as IB M Director or HP-OpenV iew .
RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch 21 BMD00041 , November 2008 T o configure an SNMP user name , enter the followin g command: User configur ation: Users can be configured to use the authentication/privacy opti ons.
RackSwitch G8000 Application Guide 22 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 3. Assign the user to the user group. Use the gr oup table to link the user to a particular access group.
RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch 23 BMD00041 , November 2008 C onfiguring SNMP T rap Hosts SNMPv1 trap host 1. Configur e an entry in the not ify table. 2. Specify the IP address and other trap para meters in the targetAddr and targetParam tables.
RackSwitch G8000 Application Guide 24 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 SNMPv3 trap host configuration T o configure a user for SNMPv3 tr aps, you can choose to send the traps with both privacy and authentication, wi th authentication only , or without privacy or authentication.
RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch 25 BMD00041 , November 2008 Securing Ac c ess to the S witch Secure switch ma nagement is needed for environm ents that perform significant management functions across the Internet.
RackSwitch G8000 Application Guide 26 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 RADIUS Authentica tion and A uthorization Blade OS supports the RADIUS (Remote Authentication Dial -in User Service) method to authenticate and authorize remo te administrators for managing the switch.
RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch 27 BMD00041 , November 2008 Configuring RADIUS Use the following procedure to configure RADIUS authentication on your switch. 1. Configur e the Primary and Second ary RADIUS servers, and enable RADIUS authentication.
RackSwitch G8000 Application Guide 28 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 RADIUS authentication f eatur es in Blade OS Blade OS supports the follo win g RADIUS authentication features: Supports RADIUS client on the swit ch, based on the protocol definitions in RFC 2138 and RFC 2866.
RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch 29 BMD00041 , November 2008 Switch User Acco unt s The user accounts listed in T abl e 1- 1 can be defined in the RADIUS server dictionary file.
RackSwitch G8000 Application Guide 30 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 T ACA CS+ A uthentica tion Blade OS supports authentication and authorization w ith networks using th e Cisco Systems T ACACS+ protocol.
RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch 31 BMD00041 , November 2008 T ACA CS+ authentication featur es in Blade OS Authentication is the action of determining the iden tity of a user , and is general ly do ne when the user first attempts to log in to a device or gain access to its serv ices.
RackSwitch G8000 Application Guide 32 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 If the remote user is successfully authenti cated by the authentication server , the switch verifies the privi leges of the remote user and authorizes the appropriate access.
RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch 33 BMD00041 , November 2008 When T ACACS+ Command Logging is enabled, Blade OS configuration commands are logged on the T ACACS+ server .
RackSwitch G8000 Application Guide 34 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 Secure Shell Secure Shell (SSH) use secure tunnels to en crypt and secure messages between a remote administrator an d the switch. T elnet does not p rov ide this level of security .
RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch 35 BMD00041 , November 2008 Generating RSA Host and Se r ver Keys for SSH access T o support the SSH server feature, tw o sets of RSA keys (host and server keys) are required. The host key is 1024 bits and is used to identify the G8000 .
RackSwitch G8000 Application Guide 36 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008 End User A cc ess C ontrol Blade OS allows an administrator to define e nd user accounts that permit end users to perform operation tasks via the switch CLI commands.
RackSwitch G8000 Application Guide Chapter 1: Accessing the Switch 37 BMD00041 , November 2008 Defining a User ’ s acc ess lev el The end user is by default assigned to the user access level (also known as class of service, or COS).
RackSwitch G8000 Application Guide 38 Chapter 1: Accessing the Switch BMD00041, Nov ember 2008.
BMD00041, Nov ember 2008 39 C HAPTER 2 P or t-based Netw ork A c c ess C ontr ol Port-Based Network Access cont rol provides a means of authenticating and authorizing devices attached to a LAN port that has point-to-point connectio n characteristics. It prevents access to ports that fail authentica tion and authoriza tion.
RackSwitch G8000 Application Guide 40 Chapter 2: Port-based Network Access Control BMD00041, Nov ember 2008 Extensible Authentica tion Prot oc ol ov er LAN The G8000 can provide user-level security for its ports using the IEEE 802.1X protoco l, which is a more secure alternative to other method s of port-based network access control.
RackSwitch G8000 Application Guide Chapter 2: Port-based Network Access Control 41 BMD00041, No vember 2008 802.1X authentication pr ocess The clients and authenticators communicate using Extensible Authen tication Protocol (EAP), which was originally designed to run over PPP , and for which the I EEE 802.
RackSwitch G8000 Application Guide 42 Chapter 2: Port-based Network Access Control BMD00041, Nov ember 2008 EAP oL message exchange During authentication, EAPOL messages are exchanged be tween the client and the G8000 authenticator , while R ADIUS-EAP messages ar e exchanged between th e G8000 authenticator and the RADIUS server .
RackSwitch G8000 Application Guide Chapter 2: Port-based Network Access Control 43 BMD00041, No vember 2008 802.1X por t states The state of the port determines whether the client is granted access to the network, as follows: Unauthorized While in this state the port discards all ingress and egress traf fic except EAP packets.
RackSwitch G8000 Application Guide 44 Chapter 2: Port-based Network Access Control BMD00041, Nov ember 2008 Suppor ted RA DIUS attributes The G8000 802.
RackSwitch G8000 Application Guide Chapter 2: Port-based Network Access Control 45 BMD00041, No vember 2008 C onfigurat ion guidelines When configuring EAPoL, consid er the following guidelines: The 802.
RackSwitch G8000 Application Guide 46 Chapter 2: Port-based Network Access Control BMD00041, Nov ember 2008.
BMD00041, Nov ember 2008 47 C HAPTER 3 VLANs This chapter describes network design and topol o gy considerations for using V ir tu al L oc al A r ea Ne tw or ks ( VL A Ns ).
RackSwitch G8000 Application Guide 48 Chapter 3: VLA Ns BMD00041, Nov ember 2008 Ov ervie w Setting up virt ual LANs (VLANs) i s a way to segment ne tworks to increase network flexibility without changing the physical network topology . W ith network segmentation, each switch port connects to a segment that is a single broadcast domain.
RackSwitch G8000 Application Guide Chapter 3: VLANs 49 BMD00041, Nov ember 2008 VLANs and P or t VL AN ID Numb ers VLAN numbers The G8000 supports up to 1024 VLAN s per switch. Even though the maximum number of VLANs supported at any given time is 1024, each can be identified wi th any number between 1 and 4094.
RackSwitch G8000 Application Guide 50 Chapter 3: VLA Ns BMD00041, Nov ember 2008 PVID nu mbers Each port in the switch has a configurable default VLAN number , known as its PV ID . By default, the PVID for all po rts is set to 1, which correlates to the default VLAN ID .
RackSwitch G8000 Application Guide Chapter 3: VLANs 51 BMD00041, Nov ember 2008 VLAN T aggi ng Blade OS software supports I EEE 802.1Q VLAN tagging, providing standard s-based VLAN support for Ethernet systems. T agging places the VLAN id entifier in the frame header of a packet, allowing each port to belong to multiple VLANs.
RackSwitch G8000 Application Guide 52 Chapter 3: VLA Ns BMD00041, Nov ember 2008 N OTE – If a 802.1Q tagged frame is received by a port that has VLAN-tagging d isabled and the port VLAN ID (PVID) is di fferent than the VLAN ID of the packet, then the frame is dropped at the ingress port.
RackSwitch G8000 Application Guide Chapter 3: VLANs 53 BMD00041, Nov ember 2008 Figure 3-2 throu gh Figure 3-5 illustrate generic examples of VLAN taggi ng.
RackSwitch G8000 Application Guide 54 Chapter 3: VLA Ns BMD00041, Nov ember 2008 In Figure 3-4 , tagged incoming packets are assigned di rectly to VLAN 2 because of the tag assignment in the packet. Po rt 5 is configured as a tagged member of VLAN 2, and port 7 is configured as an untagged member of VLAN 2.
RackSwitch G8000 Application Guide Chapter 3: VLANs 55 BMD00041, Nov ember 2008 VLAN T opologies and Design C onsider ations By default, the G8000 software is configured so that tagging is disabled on all po rts. By default, the G8000 software is configured so that all ports are members of VLA N 1.
RackSwitch G8000 Application Guide 56 Chapter 3: VLA Ns BMD00041, Nov ember 2008 Multiple VLANs with T agging Adapters Figure 3-6 Example 1: Multip le VLANs with VLAN-T agged Gigabit Adapters The .
RackSwitch G8000 Application Guide Chapter 3: VLANs 57 BMD00041, Nov ember 2008 N OTE – VLAN tagging is required only on ports that are connect ed to other switches or on port s that connect to tag-capable end-stations, such as servers with VLAN-tagging adapters.
RackSwitch G8000 Application Guide 58 Chapter 3: VLA Ns BMD00041, Nov ember 2008 VLAN configura tion example Use the following procedure to conf igure the example network show n in Figure 3-6 . 1. Enable VLAN ta gging on server port s that support multiple VLANs.
RackSwitch G8000 Application Guide Chapter 3: VLANs 59 BMD00041, Nov ember 2008 Pri vate VL A Ns Private VLANs provide Layer 2 isolat ion between the ports within the same broadcast domain. Private VLANs can contro l traffic within a VLAN domain, a nd provide port-based securi ty for host servers.
RackSwitch G8000 Application Guide 60 Chapter 3: VLA Ns BMD00041, Nov ember 2008 Community—A comm uni ty po rt is a host port that belongs to a community VLAN. Com- munity ports can communicate with other ports in t he same commun ity VLAN, and with promiscuous ports.
RackSwitch G8000 Application Guide Chapter 3: VLANs 61 BMD00041, Nov ember 2008 2. Configur e a secondary VLAN and map it to the primary VLAN. 3. V erify the configurat ion.
RackSwitch G8000 Application Guide 62 Chapter 3: VLA Ns BMD00041, Nov ember 2008.
BMD00041, Nov ember 2008 63 C HAPTER 4 Po r t s a n d T r u n k i n g T runk groups can provide super-bandwidth, multi-link connectio ns between switches or other trunk-capable devices. A trunk group is a group of ports that act together , combining their bandwidth to create a single, la r ger virtual link.
RackSwitch G8000 Application Guide 64 Chapter 4: Ports and Trunking BMD00041, Nov ember 2008 Ov ervie w When using port trunk groups betw een two switches, as shown in Fi gure 4-1 , you can create a virtual link between the switches, operating up to 40 Gb per second, depending on how many physical ports are combined.
RackSwitch G8000 Application Guide Chapter 4: Ports and Trunking 65 BMD00041, No vember 2008 Befor e you c onfigure sta tic trunks When you create and enable a static trunk, the trunk me mbers (switch ports) take on certain settings necessary for correct ope ration of the trunking feature.
RackSwitch G8000 Application Guide 66 Chapter 4: Ports and Trunking BMD00041, Nov ember 2008 All trunk members must be in the same Spanning Tree Group (STG) and can belong to only one Spanning Tree Group (STG). However if all ports are tagg ed , then all trunk ports can belong to multiple STGs .
RackSwitch G8000 Application Guide Chapter 4: Ports and Trunking 67 BMD00041, No vember 2008 Po r t T r u n k i n g E x a m p l e In the example below , three ports are trunked between two switches.
RackSwitch G8000 Application Guide 68 Chapter 4: Ports and Trunking BMD00041, Nov ember 2008 2. Repeat the proces s on the other switch. 3. Connect the switch port s that will be members in the tru nk group. T runk group 3 (on the G8000) is now connected to trunk grou p 1 (on the other switch).
RackSwitch G8000 Application Guide Chapter 4: Ports and Trunking 69 BMD00041, No vember 2008 C onfigurable T runk Hash Algorithm This feature allows you to configure paramete rs for the tru nk hash algo rithm, instead of using the default values.
RackSwitch G8000 Application Guide 70 Chapter 4: Ports and Trunking BMD00041, Nov ember 2008 Link A ggregation C ontrol P rotoc ol Link Aggregation Control Protocol (LACP) is an IEEE 802.
RackSwitch G8000 Application Guide Chapter 4: Ports and Trunking 71 BMD00041, No vember 2008 LACP automatically determi nes which member lin ks can be aggregated and then aggregates them. It provides for the co ntrolled addition and rem oval of physical links for the li nk aggrega- tion.
RackSwitch G8000 Application Guide 72 Chapter 4: Ports and Trunking BMD00041, Nov ember 2008 LA CP configur ation guidelines Consider the following guidelin es when you configure LACP trunks: When ports become memb ers of a trunk, configuration parameters (except ACL and QoS) are applied per trunk.
BMD00041, Nov ember 2008 73 C HAPTER 5 Spanning T ree When multiple paths exist on a network , Spanning T ree Protocol configures the network so that a switch uses only the most ef ficient path.
RackSwitch G8000 Application Guide 74 Chapter 5: Spanning Tree BMD00041, November 2008 Ov ervie w Spanning T ree Protocol detects and eliminates logi cal loops i n a bridged or switched network. When multiple paths exist, Span ning T ree confi gures the network so that a sw itch uses only the most efficient path.
RackSwitch G8000 Application Guide Chapter 5: Spanning Tree 75 BMD00041, Nov ember 2008 Bridge Pr otocol Da ta Units (BPDU s) T o create a Spanning Tr ee, the switch generates a configuration Bridge Protocol Data Unit (BPDU), which it then forwards out of its ports.
RackSwitch G8000 Application Guide 76 Chapter 5: Spanning Tree BMD00041, November 2008 Po r t P ri o r i t y The port priority helps determine wh ich bri dge port becomes the root/designate d port. The case for the root port is when 2 switches ar e connected using a minimum of two links with the same path-cost.
RackSwitch G8000 Application Guide Chapter 5: Spanning Tree 77 BMD00041, Nov ember 2008 Assigning a VLAN to a Spanning T ree Gr oup If no VLANs exist beyond the default VLAN 1 see “Creating a VLAN” on page 78 for information on ad ding ports to V LANs.
RackSwitch G8000 Application Guide 78 Chapter 5: Spanning Tree BMD00041, November 2008 Creating a VLAN When you create a VLAN, that VLAN automatically belongs to STG 1, the default STG . Y ou can assign the VLAN to another STG . Move a newly created VLAN to an existing STG by following thi s order: Create the VLAN.
RackSwitch G8000 Application Guide Chapter 5: Spanning Tree 79 BMD00041, Nov ember 2008 As an example, assume that port 1 belongs to VLAN 2, and VLAN 2 bel ongs to STG 2. When you remove port 1 from VLAN 2, port 1 is also remove d from STG 2. The port moves to the default VLAN 1.
RackSwitch G8000 Application Guide 80 Chapter 5: Spanning Tree BMD00041, November 2008 Rapid Spanning T ree Pr otoc ol Rapid Spanning Tree Protocol (RSTP) provides rapid convergence of the spanning tree and provides for fast re-configuration critical for netw orks carrying delay-sensitive traf fic such as voice and video.
RackSwitch G8000 Application Guide Chapter 5: Spanning Tree 81 BMD00041, Nov ember 2008 P ort T ype and Link T ype Spanning T ree configuration includes the follo win g param eters to support RSTP and MSTP: edge port and link type. Edge P or t A port that does not connect to a bridge is called an edge port .
RackSwitch G8000 Application Guide 82 Chapter 5: Spanning Tree BMD00041, November 2008 RSTP configur ation example This section provides steps to configure Ra pid Spanning Tree on the G8000, using th e Command-Line Interface (ISCLI). Rapid Spanning T ree Protocol is the default setting on the G8000.
RackSwitch G8000 Application Guide Chapter 5: Spanning Tree 83 BMD00041, Nov ember 2008 P er VLAN R apid Spanning T ree Per VLAN Rapid Spanning T ree Plus Protocol (PVRST+) enh ances the RSTP protocol by adding the ability to have mult iple spann ing tree groups.
RackSwitch G8000 Application Guide 84 Chapter 5: Spanning Tree BMD00041, November 2008 Wh y do w e need multiple Spanning T rees? The following examples describe why we need mult iple spanning trees. In Figure 5- 1 , VLAN 1 and VLAN 2 pass traffic between switch 1 and switch 2.
RackSwitch G8000 Application Guide Chapter 5: Spanning Tree 85 BMD00041, Nov ember 2008 PVRST c onfigura tion guidelines This section provides important in format ion about configuring Per VLAN Ra.
RackSwitch G8000 Application Guide 86 Chapter 5: Spanning Tree BMD00041, November 2008 Multiple Spanning T ree P r otocol Multiple Spanning T ree extends Rapid Spannin g T ree Protocol through mul tiple Spannin g T ree Groups, using multiple VLANs in each ST G .
RackSwitch G8000 Application Guide Chapter 5: Spanning Tree 87 BMD00041, Nov ember 2008 MSTP configur ation guidelines This section provides important in format ion about configuring Multiple Span ning T ree Groups: When MSTP is turned on, the switch automati cally moves all VLANs to the CIST .
RackSwitch G8000 Application Guide 88 Chapter 5: Spanning Tree BMD00041, November 2008 Figure 5-3 Implementing Multiple S panning T ree Group s Server 1 VLAN 2 Server 2 VLAN 2 Server 3 VLAN 1 Serv.
RackSwitch G8000 Application Guide Chapter 5: Spanning Tree 89 BMD00041, Nov ember 2008 Configuring Multiple Spanning T ree Gr oups This configuration shows how to configure MSTP Groups on the switch, as shown in Figure 5-3 . 1. Configur e port memb ership and define the Spanning T ree gr oups for VLAN 1.
RackSwitch G8000 Application Guide 90 Chapter 5: Spanning Tree BMD00041, November 2008 3. Configur e port memb ership and define the Spanning T ree gr oups for VLAN 2. Add server ports 3, 4, and 5 to VLAN 2. Add uplink po rts 51 and 52 to VLAN 2. Assign VLAN 2 to Spann ing T ree Group 2.
RackSwitch G8000 Application Guide Chapter 5: Spanning Tree 91 BMD00041, Nov ember 2008 Fa s t U p l i n k C o n v e r g e n c e Fast Uplink Conver gence enables the G8000 to r ecover quickly from the failure of the primary link or trunk group in a Layer 2 netwo rk using Spanning Tree Protocol.
RackSwitch G8000 Application Guide 92 Chapter 5: Spanning Tree BMD00041, November 2008.
BMD00041, Nov ember 2008 93 C HAPTER 6 Quality of Ser vice Quality of Service featur es allow you to allocat e n etwork resources to mission-critical ap plica- tions at the expense of ap plications that are less sensitive to such fact ors as time del ays or net- work congestion.
RackSwitch G8000 Application Guide 94 Chapter 6: Quality of Service BMD00041, Nov ember 2008 Overview QoS helps you allocate gu aranteed bandwidth to the critical applications, and limit bandwidth for less critical applications.
RackSwitch G8000 Application Guide Chapter 6: Quality of Service 95 BMD00041, No vember 2008 Us i n g AC L Fi l t e r s Access Control Lists are filters that allow you to cl assify dat a packets a.
RackSwitch G8000 Application Guide 96 Chapter 6: Quality of Service BMD00041, Nov ember 2008 IP Standard A C Ls The switch supports up to 127 IP ACLs (standard and extended ). IP Standard ACLs are num- bered from 1-1000. Use IP S tandard A CLs to filter traffic using s ource IP address/network mask and destination IP address/netw ork/mask.
RackSwitch G8000 Application Guide Chapter 6: Quality of Service 97 BMD00041, No vember 2008 T o create an IP Extended ACL: T o delet e an IP Extended ACL: T able 6-1 Well-known protocol typ es Nu.
RackSwitch G8000 Application Guide 98 Chapter 6: Quality of Service BMD00041, Nov ember 2008 Understanding A CL priority Each ACL has a unique priority , based on it s nu mber . The higher the ACL number , the higher the priority , so ACL 1 has the lowest priority .
RackSwitch G8000 Application Guide Chapter 6: Quality of Service 99 BMD00041, No vember 2008 N OTE – T o ensure your ACLs function properl y , do not assign the sam e ACL to different ports using different filtering directions. It is recommended that you create tw o ACLs, one for ingress traffic, and one for egres s traffic.
RackSwitch G8000 Application Guide 100 Chapter 6: Quality of Service BMD00041, Nov ember 2008 A CL co nfigura tion examples Example 1 Use this configuration to block traf fic to a speci fic host. All traffic that ingresses port 1 is denied if it is destined for the host at IP address 100.
RackSwitch G8000 Application Guide Chapter 6: Quality of Service 101 BMD00041, No vember 2008 Example 2 Use this configuration to block traffic from a network destined for a specific host address. All traffic that ingresses port 10 with source IP from the class 100.
RackSwitch G8000 Application Guide 102 Chapter 6: Quality of Service BMD00041, Nov ember 2008 Example 3 Use this configuration to block t raf fic from a netw ork that is destined for a specific egress port. All traffic that egresses port 6 from the network 100.
RackSwitch G8000 Application Guide Chapter 6: Quality of Service 103 BMD00041, No vember 2008 Example 5 Use this configuration to block all traffic exce pt traffic of certain ty pes . HTTP/HTTPS, DHCP , and ARP packets are permitted on the port. All other traffic is denied.
RackSwitch G8000 Application Guide 104 Chapter 6: Quality of Service BMD00041, Nov ember 2008 5. Assign the ACLs to a port. RS G8000 (config)# interface port 7 RS G8000 (config-if)# ip access-grou.
RackSwitch G8000 Application Guide Chapter 6: Quality of Service 105 BMD00041, No vember 2008 U sing Storm C ontrol F ilters The G8000 provides filters th at can limit the n umber of the follow in.
RackSwitch G8000 Application Guide 106 Chapter 6: Quality of Service BMD00041, Nov ember 2008 U sing DSCP V alues to Pr ovide QoS The switch uses the Differentiated Services (D if fServ) architecture to provide QoS functions. DiffServ is described in IETF RFCs 2474 and 2475.
RackSwitch G8000 Application Guide Chapter 6: Quality of Service 107 BMD00041, No vember 2008 The switch can perform the following actions to the DSCP: Read the DSCP value of ingress packets . Map the DSCP value to an 802.1p priori ty . The switch can use the DSCP value to direct traf fic prioritization.
RackSwitch G8000 Application Guide 108 Chapter 6: Quality of Service BMD00041, Nov ember 2008 P er Hop Beha vior The DSCP value determines the Per Hop Behavi or (PHB) of each packet. The PHB is the for- warding treatment given to packets at each hop.
RackSwitch G8000 Application Guide Chapter 6: Quality of Service 109 BMD00041, No vember 2008 QoS Lev els T a bl e 6-3 shows the default service levels provided by the switch, listed from highest to lowest importance: T able 6-3 Default QoS Service Levels Serv ice Lev el Default PHB 802.
RackSwitch G8000 Application Guide 110 Chapter 6: Quality of Service BMD00041, Nov ember 2008 DSCP-to-802.1p map ping The switch can use the DSCP value of ingress p ackets to set the 802.1p pr iority value. Use the following comm and to vi ew the default settings.
RackSwitch G8000 Application Guide Chapter 6: Quality of Service 111 BMD00041, No vember 2008 U sing 802.1p Priority t o Pr o vide QoS The G8000 provides Qu al ity of Service functions based on the priority bits in a packet’ s VLAN header . (The priorit y bit s are defined by the 802.
RackSwitch G8000 Application Guide 112 Chapter 6: Quality of Service BMD00041, Nov ember 2008 802.1p configur ation e xample 1. Configur e a port’ s default 802.1p priority value to 2. 2. Map the 802.1p priority value to a COS queue and set the COS queue scheduling weight.
BMD00041, Nov ember 2008 113 C HAPTER 7 Remote Monitor ing Remote Monitoring (RMON) allows network de vices to exchange network mon ito ring data. RMON allows the switch to perform the following fu nctio ns: T rack events and trigger alarms when a threshold is reached.
RackSwitch G8000 Application Guide 114 Chapter 7: Remote Monitoring BMD00041, Nov ember 2008 RMON group 1—S tatistics The switch supports collection of Ethernet statis tics as outlined in the RMON statistics MIB, in reference to etherStatsT able.
RackSwitch G8000 Application Guide Chapter 7: Remote Monitoring 11 5 BMD00041, Novem ber 2008 RMON group 2—Histor y The RMON History group allows you to samp le an d archive Ethernet statistics for a specific interface during a specific ti me interval.
RackSwitch G8000 Application Guide 116 Chapter 7: Remote Monitoring BMD00041, Nov ember 2008 Configuring RMON History Perform the following steps to config ure RMO N History on a port. 1. Enable RMON on a port. 2. Configur e the RMON History parameters for a port.
RackSwitch G8000 Application Guide Chapter 7: Remote Monitoring 11 7 BMD00041, Novem ber 2008 Use one of the following commands to corr elate an Alarm index to an Event index: When the alarm threshold is reached, the corresponding even t is triggered.
RackSwitch G8000 Application Guide 118 Chapter 7: Remote Monitoring BMD00041, Nov ember 2008 Example 2 1. Configure the RMON Alarm parame ters to track ICMP messages. This configuration creates an RMON alarm that checks icmpInEchos on the switch once every minute.
BMD00041, Nov ember 2008 119 C HAPTER 8 Basic IP Routing Th i s c h a pt e r provides configuration background and examples for using the G8000 to perform IP routing functions.
RackSwitch G8000 Application Guide 120 Chapter 8: Basic IP Routing BMD00041, Nov ember 2008 IP Routing Benefits The switch uses a combination of configurable IP switch interfaces and IP routing options. The switch IP routing capab ilities provide th e following benefits: Connects the server IP subnets to the rest of the backbone network.
RackSwitch G8000 Application Guide Chapter 8: Basic IP Routing 121 BMD00041, No vember 2008 Routing Betw een IP Subnets The physical layout o f most corp orate networks has evolved o ver time. Classic h ub/router topologies have given way to fast er sw itched topologies, particularly now that switches are increasingly intelligent.
RackSwitch G8000 Application Guide 122 Chapter 8: Basic IP Routing BMD00041, Nov ember 2008 This is a situation that switching alone cannot cure. In stead, the router is flooded with cro ss- subnet communicatio n. This compromises efficiency in two ways: Routers can be slower than switches.
RackSwitch G8000 Application Guide Chapter 8: Basic IP Routing 123 BMD00041, No vember 2008 Example of Subnet Routing Consider the role of the G8000 in the following co nfiguratio n example: Figur.
RackSwitch G8000 Application Guide 124 Chapter 8: Basic IP Routing BMD00041, Nov ember 2008 Using VLANs t o segregat e Broadcast Domains If you want to control the broadcasts on your ne t work, use VLANs to create distinct broadcast domains. Create one VLAN for each serv er subnet, and one for the router .
RackSwitch G8000 Application Guide Chapter 8: Basic IP Routing 125 BMD00041, No vember 2008 3. Determine which swit ch ports and IP in terfaces belong to which VLANs.
RackSwitch G8000 Application Guide 126 Chapter 8: Basic IP Routing BMD00041, Nov ember 2008 5. Assign a VLAN to each IP interface. Now that the ports are separate d in t o VLANs, the VLANs are a ssigned to the appropriate IP interface for each subnet.
RackSwitch G8000 Application Guide Chapter 8: Basic IP Routing 127 BMD00041, No vember 2008 Dynamic Host C onfigur ation P rot ocol Dynamic Host Configuration Prot ocol (D HCP) is a transport prot.
RackSwitch G8000 Application Guide 128 Chapter 8: Basic IP Routing BMD00041, Nov ember 2008.
BMD00041, Nov ember 2008 129 C HAPTER 9 IGMP Internet Group Manageme nt Protocol (IGMP) is used by IP Multicast routers to learn about the existence of host group members on thei r direct ly attached subnet (see RFC 2236).
RackSwitch G8000 Application Guide 130 Chapter 9: IGMP BMD00041, Nov ember 2008 IGMP Snooping IGMP Snooping allows the switch to fo rward multicast traffic only to those ports that request it. IGMP Snooping prevents mul ticast traf fic from being flooded to all ports.
RackSwitch G8000 Application Guide Chapter 9: IGMP 131 BMD00041 , November 2008 Fa s t L e a v e In normal IGMP operation, when the switch receives an IGMP v2 Leave message, it sends a Group-Specific Query to determine if any other devices in the same group (and on the same port) are still interested in the specified multicast group traffic.
RackSwitch G8000 Application Guide 132 Chapter 9: IGMP BMD00041, Nov ember 2008 The switch supports the following IG MPv3 filter modes: INCLUDE mode: T he host reques ts membership to a multicast group and provides a list of IP addresses from which it wants to receive traffic.
RackSwitch G8000 Application Guide Chapter 9: IGMP 133 BMD00041 , November 2008 5. V iew dynamic IGMP information. These commands display information abou t IGMP Gro ups and Mrouters learned by the switch. RS G8000# show ip igmp groups Note: Local groups (224.
RackSwitch G8000 Application Guide 134 Chapter 9: IGMP BMD00041, Nov ember 2008 Static Multicast Router A static multicast router (M rou t er) can be configured for a par ticular port on a particular VLAN. A static Mrouter does no t have to be learned t hrough IGMP Snooping.
BMD00041, Nov ember 2008 135 C HAPTER 10 High A vailability The RackSwitch G 8000 supports high-avai lability network to pologies. The following topics are discussed in this chapter: “Uplink Failure Detect ion” on page 136 .
RackSwitch G8000 Application Guide 136 Chapter 10: High Availability BMD00041, Nov ember 2008 Uplink F a ilure Det ec tion Uplink Failure Detection (UFD) is design ed to suppo rt Net work Adapter T eaming. Network Adapter T eaming allows all the NICs on each serv er to share the same IP address.
RackSwitch G8000 Application Guide Chapter 10: High Availability 137 BMD00041, Nov ember 2008 F ailure Detec tion P air T o use UFD , you must configure a Failure Detection Pair and then turn UFD on.
RackSwitch G8000 Application Guide 138 Chapter 10: High Availability BMD00041, Nov ember 2008 C onfiguring UFD Figure 10-1 shows a basic UFD config urat ion. In this example, NIC 1 is the primary network adapter; NIC 2 is a non-primary adapter . NIC 1 is connected to port 16 and NIC 2 is connected to port 17.
BMD00041, Nov ember 2008 139 A PPENDIX A T roubleshooting This section discusses some tools to help you troub leshoo t common problems on the RackSwitch G8000: “Monitoring Ports” on page 140.
RackSwitch G8000 Application Guide 140 Appendix A: Troubles hooting BMD00041, Nov ember 2008 Monitoring P or ts The port mirroring feature in the G8000 allows you to attach a sniffer to a monitoring port that is configured to receive a copy of all packets that are forwarded from the mirrored port.
RackSwitch G8000 Application Guide Appendix A: Troubleshooting 141 BMD00041, Nov ember 2008 P ort Mirroring beha vior This section describes the composition of mo nitored packets in the switch, based on the configuration of the ports. The following port-mirroring cases app ly to the G8000: Ingress mirrored packet s are not modified.
RackSwitch G8000 Application Guide 142 Appendix A: Troubles hooting BMD00041, Nov ember 2008.
BMD00041, Nov ember 2008 143 Inde x Symbols .......... .............. .............. ............ .............. ........ 129 [ ] ....... .............. .............. ............ .............. .......... 13 Numerics 802.1p .............. ..........
RackSwitch G8000 Application Guide 144 Index BMD00041, November 2008 I IBM Director .................... ........... .............. ..........20 ICMP ................. .............. .............. ........... ..........97 IEEE standards 802.1D ..
RackSwitch G8000 Application Guide Index 145 BMD00041, Nov ember 2008 RSA keys ....... .............. .............. ........... ............. 35 RSTP .......... .............. ........... .............. .............. .. 80 S security port mirroring .
Un point important après l'achat de l'appareil (ou même avant l'achat) est de lire le manuel d'utilisation. Nous devons le faire pour quelques raisons simples:
Si vous n'avez pas encore acheté Blade Network Technologies G8000 c'est un bon moment pour vous familiariser avec les données de base sur le produit. Consulter d'abord les pages initiales du manuel d'utilisation, que vous trouverez ci-dessus. Vous devriez y trouver les données techniques les plus importants du Blade Network Technologies G8000 - de cette manière, vous pouvez vérifier si l'équipement répond à vos besoins. Explorant les pages suivantes du manuel d'utilisation Blade Network Technologies G8000, vous apprendrez toutes les caractéristiques du produit et des informations sur son fonctionnement. Les informations sur le Blade Network Technologies G8000 va certainement vous aider à prendre une décision concernant l'achat.
Dans une situation où vous avez déjà le Blade Network Technologies G8000, mais vous avez pas encore lu le manuel d'utilisation, vous devez le faire pour les raisons décrites ci-dessus,. Vous saurez alors si vous avez correctement utilisé les fonctions disponibles, et si vous avez commis des erreurs qui peuvent réduire la durée de vie du Blade Network Technologies G8000.
Cependant, l'un des rôles les plus importants pour l'utilisateur joués par les manuels d'utilisateur est d'aider à résoudre les problèmes concernant le Blade Network Technologies G8000. Presque toujours, vous y trouverez Troubleshooting, soit les pannes et les défaillances les plus fréquentes de l'apparei Blade Network Technologies G8000 ainsi que les instructions sur la façon de les résoudre. Même si vous ne parvenez pas à résoudre le problème, le manuel d‘utilisation va vous montrer le chemin d'une nouvelle procédure – le contact avec le centre de service à la clientèle ou le service le plus proche.
