Allied Telesis x900 Advanced Gigabit Layer 3+ Expandable Switches manual 8000S Configuration

NETWORK RESILIENCY SOLUTIONS VCStack + Link aggregation

8000S Configuration

Broadcast and multicast limiting prevent downstream loops from affecting the inner layers of the network

The client-facing ports are configured as portfast so there is no delay in connectivity when client devices attach. Root guard protects against STP spoofing attacks

Port security guards against MAC spoofing attacks, and limits the ability for intruders to connect to the network

By default, all ports are put into VLAN 170

Two gigabit ports, one from each stack member, are aggregated together to create a resilient link to the network core

802.1x authentication is enabled on all the client-facing ports. Clients cannot access the network without being authenticated

DHCP snooping guards against rogue server and server exhaustion attacks

Attach a management IP address to VLAN170, and provide a default gateway

interface range ethernet 1/e(1-24),2/e(1-24) port storm-control broadcast enable

port storm-control include-multicast exit

interface range ethernet 1/e(1-24),2/e(1-24) spanning-tree portfast

spanning-tree guard root exit

interface range ethernet 1/e(1-24),2/e(1-24) port security mode max-addresses

port security max 3

port security discard trap 60 exit

vlan database default-vlan vlan 170 exit

interface range ethernet 1/g1,2/g1 channel-group 1 mode on

exit

dot1x system-auth-control

interface range ethernet 1/e(1-24),2/e(1-14) dot1x single-host-violation discard trap 30 dot1x re-authentication

dot1x port-control auto exit

ip dhcp snooping

ip dhcp snooping vlan 170 interface port-channel 1 ip dhcp snooping trust exit

interface vlan 170

ip address 192.168.170.45 255.255.0.0 exit

ip default-gateway 192.168.170.1

Allied Telesis www.alliedtelesis.com