Manuals / D-Link / Computer Equipment / Switch

D-Link DGS-3100 user manual Security Features

Models: DGS-3100

1 209

Download 209 pages 46.85 Kb

Page 106

Image 106

DGS-3100 Series Gigabit Stackable Managed Switch User Manual

SECURITY FEATURES

This section contains information for enabling and configuring device security including user accounts.

•Configuring Safeguard Engine

•Configuring Trust Host

•Configuring Port Security

•Configuring Guest VLANs

•Configuring Port Authentication 802.1X

•Configuring Secure Socket Layer Security

•Configuring Secure Shell Security

•Defining Application Authentication Settings

Page 106

Image 106

D-Link DGS-3100 user manual Security Features

Contents

User Manual D-Link DGS-3100 SERIES GIGABIT STACKABLE MANAGED SWITCHV2.20 Warnung FCC WarningCE Mark Warning PrecauciónTable of Contents Defining SNMP Host Table Configuring Port Security Safety Cautions General Precautions for Rack-Mountable Products PrefaceDGS-3100 Series Gigabit Stackable Managed Switch User Manual System Overview Viewing the Device Device Management MethodsDGS-3100 Series Front Panel System OverviewViewing the Device DGS-3100 Series Front PanelWeb Based Management Interface Device Management MethodsCommand Line Console SNMP-Based ManagementNotes, Notices, and Cautions Safety CautionsUser Guide Overview User Guide OverviewUnplug the power cable before removing the power supply DGS-3100 Series Gigabit Stackable Managed Switch User ManualThe power cable, extension cable, or plug is damaged An object has fallen into the productGeneral Precautions for Rack-Mountable Products Battery Handling Reminder Protecting Against Electrostatic DischargeUnderstanding the D-Link Embedded Web Interface Using the Web-Based User InterfaceGETTING STARTED ViewDescription Figure 1-1. Device Information PageView 1. Tree ViewLocating Devices Using the Tool MenuDisplaying the Stack Status 1. Click Device Locator. The Device Locator Page opensField Http TFTP Backing up and Restoring Configuration FilesFigure 1-3 Config Backup and Restore Page Description1. Click Reset. The Factory Reset Page opens Resetting the DeviceFigure 1-4 Factory Reset Page 1. Click Firmware Download. The Firmware Download Page opens Downloading the FirmwareFigure 1-5 Firmware Download Page Field HTTP Download TFTP Download DescriptionFigure 1-6 System Reboot Page Rebooting the System1. Click System Reboot. The System Reboot Page opens 2. Define the Select Unit to Reboot fieldName Using the Web System ComponentsComponent DescriptionCONFIGURING BASIC CONFIGURATION Field Device Type System Contact System Name System Location Viewing Device InformationFigure 2-1 Device Information Page Firmware Version Hardware Version System Time System Up TimeSafeguard Engine SNMP Trap SSL GVRP Setting Jumbo Frames Field Boot Version MAC Address IP Address Subnet Mask Default GatewayLogin Timeout minutes Time Source 802.1D Spanning Tree DHCP Client BPDU Forwarding IGMP Snooping Broadcast Storm Control 802.1X Status3. Define the System Location and Login Timeout minutes fields Defining System InformationSystem Contact System Name System Location Login Timeout minutes Figure 2-2 System Information PageFigure 2-3 IP Address Page Defining IP Addresses1. Click Configuration IP Address. The IP Address Page opens FieldAdvanced Stacking Managing StackingManaging Stacking Modes Allocating Unit IDsDefining a Stacking Master Master Enabled Stacking MembersAssigning Unit IDs Defining a Stacking Back Up MasterDiscovering the Stacking Master Stack Startup ProcessElecting a Stacking Master Unit and Stacking Port Configuration Allocating Unit IDs/Resolving Unit ID ConflictsManaging a Self-Ordered Stack Building Stacks - Quick StartStack Resiliency Managing a New Manually Ordered StackBuilding New Manually Ordered Stacks Stack Management ExamplesReplacing Failed Stacking-Members in a Running Stack Adding Stacking Members to an Existing Manually Ordered StackReplacing a Failed Stack Master Dividing Stacks Page Stacking Cable Failure Merging StacksInserting Excess Stacking Members When switches are added to a running stack, the Unit ID Allocation and Duplicate ID Conflict Resolution process detects an error if too many switches are present in the stack, and no changes are to stacking members that originally belonged to the group managed by the newly elected master. The original switches retain their ID assignments and configurations. The stacking members that originally belonged to the group managed by the Stack Master that lost the Master Election process are shut down Field Stacking Master Current Stack ID New Stack ID after reset Configuring StackingFigure 2-4 Stacking Settings Page DescriptionFigure 2-5 Port Setting Page Configuring Port PropertiesDefining Ports Field Unit From Port To Port State SpeedField Flow Control Learning DescriptionField Viewing Port PropertiesFigure 2-6 Port Description Page DescriptionFigure 2-7 ARP Settings Page ARP Settings1. Click Configuration ARP Settings. The ARP Settings Page opens Static ARP SettingsField User Name New Password Access Right Confirm New Password Configuring User Accounts1. Click Configuration User Accounts. The User Accounts Page opens Figure 2-8 User Accounts PageTo edit the User Accounts Page 1. Select a name on the User List DGS-3100 Series Gigabit Stackable Managed Switch User Manual2. Click . The user account is deleted, and the device is updated 2. Click 3. Define the valueField Managing System LogsFigure 2-9 System Log Host Page DescriptionExample Configuring SNTPStratum Stratum Stratum Stratum Time level T1 T2 T3 T4Field Figure 2-10 Time Settings PageField Time Setting Time in HH MM SS DescriptionConfiguring Daylight Savings Time Figure 2-11 TimeZone Settings Page Daylight Saving Time Offset in Minutes Time Zone Offsetfrom GMT DST Repeating Settings SectionsField Daylight Savings Time State DescriptionField FromMonth FromDay FromTime ToMonth ToDay ToTime DST Annual Settings SectionDescription Parameters Authentication Privacy Key Management Configuring SNMPDescription Field View Name Subtree OID View Type Defining SNMP ViewsFigure 2-12 SNMP View Table Page DescriptionField Group Name Read View Name Write View Name Defining SNMP GroupsFigure 2-13 SNMP Group Table Page DescriptionDescription Field Notify View Name Security Model Security LevelCommunity/View TestReadView PWriteView PrivateView Figure 2-14 SNMP User Table Page Defining SNMP UsersAuth-Protocol by Password Password Confirm Password Field User Name Group Name SNMP V3 EncryptionAuth-Protocol by Key FieldDescription Confirm Key2. Define the Community Name, and View Name, Access Right fields Defining SNMP CommunitiesAccess Rights Figure 2-15 SNMP Community Table PageTo define the SNMP Host Table Page Defining SNMP Host TableFigure 2-16 SNMP Host Table Page Host IP Address FieldDescription SNMP VersionFigure 2-17 SNMP Engine ID Page Defining SNMP Engine IDField Engine ID Use Default DescriptionField SNMP Traps SNMP Authentication Traps Enabling SNMP TrapsFigure 2-18 SNMP Configuration Trap Page DescriptionField DHCP Auto Configuration DHCP Auto ConfigurationFigure 2-19 DHCP Auto Configuration Page DescriptionField Unit Image Version Update Time Dual Image ServicesFirmware Information Figure 2-20 Firmware Information PageDefines the image file used for reboot. The possible values are Config Firmware ImageFigure 2-21 Config Firmware Image Page FieldCONFIGURING L2 FEATURES Figure 3-1. Jumbo Frame Page Enabling Jumbo Frames1. Click L2 Features Jumbo Frame. The Jumbo Frame Page opens Field Jumbo FrameVLAN Description Configuring VLANsUnderstanding IEEE 802.1p Priority Notes about VLANs on the DGS-3100 SeriesDescription Term Untagging Ingress port Egress portFigure 3-2. IEEE 802.1Q Packet Forwarding Figure 3-3. IEEE 802.1Q Tag 802.1Q VLAN TagsFigure 3-4. Adding an IEEE 802.1Q Tag Tagging and Untagging Port VLAN IDIngress Filtering VLAN Status Default VLANsVLAN and Trunk Groups Switch PortsFigure 3-5. VLAN Configuration Page Defining VLAN Properties1. Click L2 Features 802.1Q VLAN. The VLAN Configuration Page opens Field VID VLAN Name Untag VLAN Ports Tag VLAN PortsFigure 3-6. Add/Edit VLAN Information Page 1. Click L2 Features 802.1Q VLAN. The VLAN Configuration Page opensDescription 1. Click L2 Features GVRP Settings. The GVRP Setting Page opens Configuring GVRPFigure 3-7. GVRP Setting Page Description Field GRVP Global Setting Unit From Port To Port PVID GVRP IngressAcceptable Frame Type 4. Define the PVID, GVRP, Ingress, and Acceptable Frame Type fieldsFigure 3-8. Trunking Configuration Page Defining Trunking1. Click L2 Features Trunking. The Trunking Configuration Page opens Field Unit Group ID Type PortsNotes about Trunking on the DGS-3100 Series Field Traffic SegmentationFigure 3-9. Traffic Segmentation Page DescriptionTimeout Configuring LACPFigure 3-10. LACP Port Settings Page 4. Define the Port-Priority and LACP Timeout fieldsLeave Timer Defining IGMP Snooping1. Click L2 Features IGMP Snooping. The IGMP Snooping Page opens Figure 3-11. IGMP Snooping PageStatic Router Port Setting Edit button Host TimeoutRouter Timeout 2. Click . The Static Router Ports Settings Page opensField Host TimeoutRouter Timeout DescriptionFigure 3-13. Port Mirroring Page Configuring Port Mirroring1. Click L2 Features Port Mirroring. The Port Mirroring Page opens Field Status Unit Target Port Source PortField None DGS-3100 Series Gigabit Stackable Managed Switch User Manual4. Define the Unit, Tx, and Rx. fields under Source Port Setting DescriptionVersion Classic STP Rapid STP Multiple STP Configuring Spanning TreeDescription Field Defining Spanning Tree Global ParametersFigure 3-14. STP Bridge Global Settings Page DescriptionDescription Bridge Forward DelayField Bridge Priority 0Field Unit From Port To Port Cost 0=Auto Defining STP Port SettingsFigure 3-15. STP Port Settings Page DescriptionField Edge Forwarding BPDU P2P State DescriptionConfiguration Name Defining Multiple Spanning Tree Configuration IdentificationFigure 3-16. MST Configuration Identification Page FieldField Unit Port Instance ID Internal Path Cost Priority Status Defining MSTP Port InformationFigure 3-17. MSTI Config Information Page DescriptionDescription Field Role4. Define the Internal Path Cost and Priority fields Figure 3-18. Unicast Forwarding Page Defining Forwarding and FilteringDefining Unicast Forwarding Field Aging Time VID MAC Address Unit PortField Defining Multicast ForwardingFigure 3-19. Multicast Forwarding Page DescriptionThe default settings are restored DGS-3100 Series Gigabit Stackable Managed Switch User Manual4. Click To restore the default settings 1. Click The entry is deleted, and the device is updatedCONFIGURING QUALITY OF SERVICE Configuring 1pFigure 4-1. Mapping QoS on the Switch Understanding QoS Figure 4-2. Bandwidth Control Page Defining Bandwidth Settings1. Click QoS Bandwidth Control. The Bandwidth Control Page opens FieldField Unit From Port To Port Storm Control Type State Threshold 3500 Configuring Storm ControlFigure 4-3. Traffic Control Settings Page DescriptionDescription Mapping Ports to Packet PrioritiesFigure 4-4. 802.1P Default Priority Page 2. Define the Unit, From Port, To Port, Prioirity fieldsField Priority Class ID Mapping Priority to Classes QueuesFigure 4-5. 802.1P User Priority Page DescriptionFigure 4-6. QoS Scheduling Mechanism Page Configuring QoS Scheduling MechanismField Class ID Mechanism Weight DescriptionDefining Multi-Layer CoS Settings Figure 4-7. Multi-Layer CoS Setting PageSECURITY FEATURES Figure 5-8. Safeguard Engine Page Configuring Safeguard Engine1. Click Security Safeguard Engine. The Safeguard Engine Page opens Field Safeguard Engine1. Click Security Trusted Host. The Trusted Host Page opens Configuring Trust HostField IP1 Access to Switch IP2 Access to Switch IP3 Access to Switch Figure 5-9.Trusted Host Page1. Click Security Port Security. The Port Security Page opens Configuring Port SecurityField Unit From Port To Port Admin State Max Address0-64 Port Figure 5-10. Port Security PageDescription Configuring Guest VLANsField Max Learning Addr 1. Click Security Guest Vlan. The Guest VLAN Page opensState Controlled Access Uncontrolled Access Configuring Port AuthenticationComponent Authenticators Supplicants/Clients Authentication Server DescriptionSuppTimeout 1-65535 sec 1. Click Security 802.1X Setting. The 802.1X Setting Page opensFigure 5-12. 802.1X Setting Page ServerTimeout 1-65535 secControl FieldDescription UnitServerTimeout 1-65535 sec 1. Click Security 802.1X Setting. The 802.1X Setting Page opensSuppTimeout 1-65535 sec ReAuthEnabledControl FieldDescription UnitPage DGS-3100 Series Gigabit Stackable Managed Switch User Manual DGS-3100 Series Gigabit Stackable Managed Switch User Manual Field Succession RADIUS Server Authentic Port Accounting Port Key Defining RADIUS SettingsFigure 5-13. Authentic RADIUS Server Page Confirm KeyConfiguring Secure Socket Layer Security 1. Click Security SSL. The SSL Configuration Settings Page opensField SSL Status Ciphersuite Status Figure 5-14. SSL Configuration Settings PageDescription Field SSH Server Status Port Configuring Secure Shell SecurityFigure 5 -15. SSH Configuration Page DescriptionDefining SSH Algorithm Settings Description Figure 5-16. SSH Algorithm Settings PageField Public keyField Application Login Method List Enable Method List Defining Application Authentication SettingsFigure 5-17. Application Authentication Settings Page DescriptionTimeout 1-30secs Configuring Authentication Server HostsFigure 5-18. Authentication Server Host Page FieldField Method List Name Method Method Defining Login MethodsFigure 5-19. Login Method Lists Page DescriptionField Method Method Description areField Method List Name Method Defining Enable MethodsFigure 5-20. Enable Method Lists Page DescriptionField Method Method Method DescriptionOld Local Enable Password Configuring Local Enable PasswordFigure 5-21. Configure Local Enable Password Page Provide the current network Enable passwordMONITORING THE DEVICE Figure 6-1 Stacking Information Page Viewing Stacking InformationField Master ID Backup ID Box ID Runtime version H/W version DescriptionFigure 6-2. CPU Utilization Page Viewing CPU Utilization1. Click Monitoring CPU Utilization. The CPU Utilization Page opens Field Utilization Time Interval Record Number Show/HideField Unit Port Utilization Time Interval Record Number Show/Hide Viewing Port UtilizationFigure 6-3. Port Utilization Page DescriptionFigure 6-4. Packet Size Page Viewing Packet Size Information1. Click Monitoring Packet Size. The Packet Size Page opens Field Unit Port Packet Size Analysis - Selected Port NumberFigure 6-5. ReceivedRX Page Viewing Received Packet Statistics1. Click Monitoring Packets ReceivedRX. The ReceivedRX Page opens Field Unit Port Bytes Packets Time Interval Record Number Show/HideFigure 6-6. UMBcastRX Page Viewing UMBcast Packet Statistics1. Click Monitoring Packets UMBcastRX. The UMBcastRX Page opens Field Unit Port Unicast Multicast Broadcast Time IntervalDescription Viewing Transmitted Packet StatisticsField Figure 6-7. TransmittedTX PageField Record Number Show/Hide DescriptionField Time Interval Server UDP Port Timeouts Requests Challenges Viewing RADIUS Authenticated Session StatisticsFigure 6-8. RADIUS Authentication Page Accepts RejectsField VLAN Name IP Address Total Entries MAC Address Type Viewing ARP TableFigure 6-9 Browse ARP Table Page DescriptionField VID Unit Port Viewing Router PortsFigure 6-10 Browse Router Port Page DescriptionField ID From User Privilege Name Viewing Session TableFigure 6-11 Browse Session Table Page DescriptionField VID VLAN Name VLAN Name Multicast Group MAC Address Port Viewing IGMP Group InformationFigure 6-12 IGMP Snooping Group Page DescriptionField Unit Port VLAN Name MAC Address VID Type Defining Dynamic and Static MAC AddressesFigure 6-13 MAC Address Table Page Description3. Define the Port, VLAN Name, and MAC Address fields 4. Click DGS-3100 Series Gigabit Stackable Managed Switch User Manual2. Select the Stacking member in the Unit field To view all entries, click To clear static entries, clickFigure 6-14 System Log Page Viewing System Log1. Click Monitoring System Log. The System Log Page opens Field ID Time Log Description SeverityMANAGING POWER OVER ETHERNET DEVICES Figure 7-1 PoE Port Setting Page Defining PoE System Information1. Click PoE PoE Port Setting. The PoE Port Setting Page opens PoE EnableNormal - Indicates that the power supply unit is functioning Indicates the power consumption is 7WIndicates the power consumption is 15.4W Off - Indicates that the power supply unit is not functioningFigure 7-2 PoE System Setting Page Displaying and Editing PoE System Information1. Click PoE PoE System Setting. The PoE System Setting Page opens System Power ThresholdDEFINING ACCESS PROFILE LISTS Service Type ACL Configuration WizardFigure 8-1 ACL Configuration Wizard Page FieldsTCP Source Port - Matches the packet to the TCP Source Port FieldsDescription TCP Destination Port - Matches the packet to the TCP Destination PortDisplays the access rule Defining Access Profile Lists1. Click ACL Access Profile List. The ACL Profile List Page opens Adding ACL ProfilesDescription Figure 8-3 Add ACL Profile PageField L2 ACLTo define L2 MAC Address ACL profile Defining Level 2 ACLFigure 8-4 ACL Profile L2 ACL Tagged Page Figure 8-5 ACL Profile L2 ACL Tagged MAC Address PageSource MAC Mask FieldDescription Destination MAC MaskTo define L2 Ether Type ACL profile Figure 8-7 ACL Profile L2 ACL Tagged Ether Type PageFigure 8-8 ACL Profile L2 ACL Untagged Page Defining Level 3 ACLFigure 8-9 Add ACL Profile L3 Page To define L3 IPv4 Address ACL profile To define L3 IPv4 DSCP ACL profileFigure 8-10 ACL Profile L3 ACL ICMP IPv4 DSCP Page Figure 8-11 ACL Profile L3 ACL ICMP IPv4 Address PageFigure 8-12 ACL Profile L3 ACL ICMP Page DescriptionTo define L3 ICMP ACL profile FieldFigure 8-13 ACL Profile L3 IGMP Page To define L3 IGMP ACL profileFigure 8-14 ACL Profile L3 IGMP Selected Page To define L3 TCP Port ACL profile Figure 8-15 ACL Profile L3 TCP PageFigure 8-16 ACL Profile L3 TCP Port Page To define L3 TCP Flag ACL Profile DescriptionFigure 8-17 ACL Profile L3 TCP Flag Page Figure 8-18 ACL Profile L3 UDP Page DGS-3100 Series Gigabit Stackable Managed Switch User ManualIf L3 ACL UDP is selected, the page updates as follows Figure 8-19 ACL Profile L3 UDP Port PageDescription Figure 8-20 Access Profile List Page Defining Access Rules ListsClick ACL Access Profile List The Access Profile List Page opens FilterAccess ID 1. Click . The Add Access Rule Page opensFigure 8-21 Add Access Rule Page IP based ACL Field3. Click . The rule is changed, and the device is updated DGS-3100 Series Gigabit Stackable Managed Switch User Manual2. Define the Rule Detail fields 1. Click ACL ACL Finder The ACL Finder Page opens Finding ACL RulesAccess ID Figure 8-22 ACL Finder PageField Access IDFigure 8-23 Rule Detail Page DescriptionNotes about ‘IP’ and ‘MAC’ Based ACLs in the DGS-3100 Series Notes about ACLs capacity in the DGS-3100 Series Limited Lifetime Warranty for the product is defined as follows Reorient or relocate the receiving antenna Product Registration Warranty Period LIMITED WARRANTYProduct Type What You Must Do For Warranty Service What Is Not Coveredis not contemplated in the documentation for the product, or if the model or serial number has been altered, tampered with, defaced or removed Trademarks FCC WarningCopyright Statement Tech Support for customers within the United States TECHNICAL SUPPORTTechnical Support Tech Support for customers within CanadaTechnical Support For Customers within The United Kingdom & IrelandFor Customers within Canada D-Link UK & Ireland Technical Support over the InternetTechnische Unterstützung Support technique destiné aux clients établis au Canada Assistance techniqueSupport technique destiné aux clients établis en France LinkAsistencia Técnica de D-Link por teléfono Asistencia TécnicaAsistencia Técnica de D-Link a través de Internet D-Link Mediterraneo S.r.L Supporto tecnicoSupporto tecnico per i clienti residenti in Italia Gli ultimi aggiornamenti e la documentazione sonoTech Support for customers within Belgium Technical SupportTech Support for customers within the Netherlands Tech Support for customers within LuxemburgPomoc techniczna webové stránce firmy D-Link Technická podporaAktualizované verze software a uživatelských příruček najdete na D-Link poskytuje svým zákazníkům bezplatnou technickou podporuTechnikai Támogatás D-Link MagyarországD-Link Teknisk telefon Support Teknisk SupportTeknisk Support Du kan finne programvare oppdateringer og brukerD-Link teknisk support over telefonen Teknisk SupportD-Link teknisk support på Internettet Tlf. 7026Tuotteen takuun voimassaoloajan Tekninen tuki palvelee seuraavasti Teknistä tukea asiakkaille SuomessaD-Link tarjoaa teknistä tukea asiakkailleen Arkisin klo. 9 - 21 numerostaPå vår hemsida kan du hitta mer information om mjukvaru Teknisk Support för kunder i SverigeTeknisk Support uppdateringar och annan användarinformationVocê pode encontrar atualizações de software e documentação de Suporte TécnicoSuporte Técnico para clientes no Portugal Assistência TécnicaΤηλεφωνική υποστήριξη D-Link Τεχνική ΥποστήριξηΓια πελάτες εντός του Ελλαδικού χώρου Τηλ 210 86 11 Φαξ 210 86 53 Δευτέρα-ΠαρασκευήAustralia Technical SupportTech Support for customers in Indiahttp//support.dlink-me.com Technical SupportTech Support for customers in http//support.dlink-me.comдоступны на Интернет-сайте D-Link Техническая поддержкаОбновления программного обеспечения и документация D-Link предоставляет бесплатную поддержку для клиентовAsistencia Técnica Telefone Suporte TécnicoSuporte Técnico para clientes no Brasil São Paulo +11-2185-9301 Segunda à sexta Das 8h30 às 18h30D-Link 免付費技術諮詢專線 D-Link 友訊科技台灣分公司技術支援資訊電子郵件：dssqaservice@dlink.com.tw 0800-002-615Update perangkat lunak dan dokumentasi pengguna dapat Dukungan TeknisDukungan Teknis untuk pelanggan diperoleh pada situs web D-Link办公地址：北京市东城区北三环东路 36 号环球贸易中心 B 座 26F 02-05 室邮编技术支持您可以在 D-Link 的官方網站找到產品的軟件升級和使用手冊技术支持中心电话：8008296688 技术支持中心传真：02885176948International Offices Product Model Product installed in type of computerRegistration Card All Countries and Regions Excluding USA Product Serial No