Manuals / Brands / Computer Equipment / Switch / HP / Computer Equipment / Switch

HP ProCurve 2610-PWR Figure 2-27.Example of Potential Security Breaches

1 364

Download 364 pages, 5.01 Mb

Static Virtual LANs (VLANs)

Port-Based Virtual LANs (Static VLANs)

• Switches “A”, “B”, and

Server

“C” are connected by

Switch B

Switch A

ports belonging to the

management VLAN.

• Hub “X” is connected

to a switch port that

Hub X

Y

belongs to the

Hub

management VLAN. As

a result, the devices

connected to Hub X are

included in the

management VLAN.

Switch C

• Other devices

connected to the

switches through ports

Management Workstations

that are not in the

Links with Ports Belonging to the Management VLAN and other VLANs

management VLAN are

excluded from

Links Between Ports on a Hub and Ports belonging to the Management VLAN

management traffic.

Links Not Belonging to the Management VLAN

Links to Other Devices

Figure 2-27. Example of Potential Security Breaches

In figure 2-28,Workstation 1 has management access to all three switches through the Management VLAN, while the PCs do not. This is because config uring a switch to recognize a Management VLAN automatically excludes attempts to send management traffic from any other VLAN.

Links with Ports Configured as Members of the Management VLAN and other VLANs

Links Not Belonging to the Management VLAN

System

Management

Workstation

Switch

Switch

Switch

A

B

C

3

Port A1

Port B2

Port C2

Port A3

Port B4

Port C3

4

Port A6

Port B5

Port C6

Port B9

Port A7

Port C8

1

Server

Server

Shipping

Server

System Server

2

(on the

Marketing

DEFAULT_VLAN)

2-35

Contents

ProCurve Switches Page ProCurve Switch 2610 Series Switch 2610-PWRSeries Advanced Traffic Management Guide Page Product Documentation 1 Getting Started 2 Static Virtual LANs (VLANs) 3 GVRP 4 Multimedia Traffic Control with IP Multicast (IGMP) 5 Spanning-TreeOperation 6Quality of Service (QoS): Managing Bandwidth More Effectively Page 7 IP Routing Features 8 ProCurve Stack Management Index Page Product Documentation Software Feature Index Page Page Page Page Getting Started Conventions bold italics Series 2610 Switches copy tftp hostname Figure 1-1.Example of a Figure Showing a Simulated Screen Sources for More Information www.procurve.com Technical support, and then click on Product manuals Figure 1-2.Getting Help in the Menu Interface Need Only a Quick Start setup 8.Run Setup Important Static Virtual LANs (VLANs) Page Page Port-BasedVirtual LANs (Static VLANs) N o t e Table 2-1.VLANMaximums Figure 2-1.Example of Routing Between VLANs via an External Router Figure 2-2.Example of Overlapping VLANs Using the Same Server Figure 2-3.Example of Connecting Multiple VLANs Through the Same Link Introducing Tagged VLAN Technology into Networks Running Legacy (Untagged) VLANs Figure 2-4.Example of Tagged and Untagged VLAN Technology in the Same Network show vlan Figure 2-5.Comparing Per-PortVLAN Options With and Without GVRP Table 2-2. Per-PortVLAN Configuration Options Forbid Page Table 2-6.Example of Forwarding Database Content Table 2-7.Forwarding Database Structure for Managed ProCurve Switches Page Page The Solution 2.Switch Configuration 8.VLAN Menu 1.VLAN Support Figure 2-11.The Default VLAN Support Screen GVRP Enabled [S] Maximum VLANs to support Figure 2-12.VLAN Menu Screen Indicating the Need To Reboot the Switch [0] 2.VLAN Names Figure 2-13.The Default VLAN Names Screen [A] Name : Name Figure 2-14.Example of VLAN Names Screen with a New VLAN Added 2. Switch Configuration 3.VLAN Port Assignment Figure 2-15.Example of VLAN Port Assignment Screen Untagged, or Forbid) For GVRP Operation: Figure 2-16.Example of VLAN Assignments for Specific Ports VLAN Commands Used in this Section Figure 2-17.Example of “Show VLAN” Listing (GVRP Enabled) Syntax Figure 2-18.Example of “Show VLAN” for a Specific Static VLAN Figure 2-19.Example of “Show VLAN” for a Specific Dynamic VLAN show vlan ports detail a1-a16 all detail Port name: Figure 2-20.Example of “Show VLAN Ports” Cumulative Listing Figure 2-21.Example of “Show VLAN Ports” Detailed Listing Figure 2-22.Example of Command Sequence for Changing the Number of VLANs Figure 2-23.Example of Creating a New Static VLAN Auto VLAN already exists 2.Click on VLAN Configuration 3.Click on Add/Remove VLANs Figure 2-24.Example of Tagged and Untagged VLAN Port Assignments Figure 2-25.Example of VLAN ID Numbers Assigned in the VLAN Names Screen Figure 2-26.Example of Networked 802.1Q-CompliantDevices with Multiple VLANs on Some Ports Switch Switch Y Page Figure 2-27.Example of Potential Security Breaches Figure 2-28.Example of Management VLAN Control in a LAN Table 2-3.VLAN Membership in Figure DHCP/Bootp Manual write memory Default: Disabled running-config Figure 2-29.Illustration of Configuration Example write-memory Implementing Spanning Tree Page Page GVRP Page Page Figure 3-1.Example of Forwarding Advertisements and Dynamic Joining Figure 3-2.Example of GVRP Operation IP Addressing Table 3-1.Options for Handling “Unknown VLAN” Advertisements: show gvrp Figure 3-3.Example of GVRP Unknown VLAN Settings Page Table 3-2.Controlling VLAN Behavior on Ports with Static VLANs Page Page 2.Switch Configuration Figure 3-4.The VLAN Support Screen (Default Configuration) Unknown VLAN Figure 3-5.Example Showing Default Settings for Handling Advertisements GVRP Commands Used in This Section Figure 3-6.Example of “Show GVRP” Listing with GVRP Disabled Figure 3-7.Example of Show GVRP Listing with GVRP Enabled Enabling and Disabling GVRP on the Switch. This command enables Syntax: gvrp Figure 3-8.Example of Preventing Specific Ports from Joining Dynamic VLANs Figure 3-9.Example of Switches Operating with GVRP Enabled show vlans Figure 3-10.Example of Listing Showing Dynamic VLANs VLAN Configuration GVRP Security Apply Page Page Multimedia Traffic Control with IP Multicast (IGMP) Page General Operation and Features IGMP Device: IGMP Host: Forward with High Priority Auto/Blocked/Forward: Auto Blocked: Forward: CLI: Configuring and Displaying IGMP Figure 4-1.Example Listing of IGMP Configuration for All VLANs in the Switch show ip igmp Figure 4-2.Example Listing of IGMP Configuration for A Specific VLAN ip igmp Page Web: Enabling or Disabling IGMP Device Features Apply Changes How IGMP Operates querier Report (Join): Leave Group: Page Table 4-1.Comparisonof IGMP Operation With and Without IP Addressing Fast-Leave IGMP 4-2.SwitchesSupported for IGMP Features Automatic Fast-LeaveOperation. If a switch port is: Figure 4-3.Example of Automatic Fast-LeaveIGMP Criteria Page show configuration N o t e o n V L A N N u m b e r s walkmib setmib To List the Forced Fast-LeaveState for a Single Port. (See the “Note getmib VLAN Figure 4-6.Example of Changing the Forced Fast-LeaveConfiguration on Port Using the Switch as Querier Excluding Multicast Addresses from IP Multicast Filtering 4-3.IPMulticast Address Groups Excluded from IGMP Filtering Reserved Addresses Excluded from IP Multicast (IGMP) Filtering Page Spanning-TreeOperation Page Table 5-1.STP Support Table 5-3.802.1w RSTP Features Table 5-4.802.1s Features Page Figure 5-1.Example of a Multiple Spanning-TreeApplication Note for 802.1D and 802.1w Spanning-TreeOperation C a u t i o n The RSTP (802.1w) and STP (802.1D) Spanning Tree Options Page Figure 5-2.General Example of Redundant Paths Between Two Nodes Figure 5-3.Example of Using a Trunked Link with STP and VLANs Configuring Rapid Reconfiguration Spanning Tree (RSTP) Force Version on page Menu CLI: Menu: Viewing the Current Spanning Tree Configuration. Use this command sho span config Figure 5-4.Example of the Spanning Tree Configuration Display Enabling or Disabling RSTP Abbreviation: [no] span Enabling STP Instead of RSTP Abbreviation: span prot stp Reconfiguring Whole-SwitchSpanning Tree Values. You can configure Table 5-1. Whole-SwitchRSTP Parameters Abbreviations: Per-PortRSTP Parameters Abbreviations: Note on Path Cost menu 2.Switch Configuration … 4.Spanning Tree Operation Protocol Version RSTP or STP Figure 5-5.Example of the RSTP Configuration Screen Actions elp 6. Reboot Switch Page 802.1D Spanning-TreeProtocol (STP) Figure 5-6.The Default “Spanning Tree Operation” Screen Figure 5-7.Enabling Spanning-TreeOperation Actions line Page Viewing the Current STP Configuration Figure 5-10.Example of the Default STP Configuration Listing with 802.1D STP Configured at the Protocol Version stp Figure 5-11.Steps for Changing Spanning-TreeOperation to the 802.1D Protocol Enabling (or Disabling) Spanning Tree Operation on the Switch Table 5-3.General STP Operating Parameters Reconfiguring Per-PortSTP Operation on the Switch fast Page Figure 5-12.Example of How To Implement Fast-UplinkSTP Page Table 5-5.STP Parameter Settings for Figure Scenario 1: Scenario 2: Figure 5-14.Example of a Disallowed Connection Between Edge Switches STP Priority Page [E] Figure 5-16.Changing from RSTP to STP Requires a System Reboot STP Figure 5-17.The Spanning Tree Operation Screen To View STP Status 1.Status and Counters … 7.Spanning Tree Information Page Figure 5-21.Example Topology for the Listing Shown in Figure Page Page Page Norm Web: Enabling or Disabling STP 2.Click on [Device Features] [Apply Changes] 802.1s Multiple Spanning Tree Protocol (MSTP) Figure 5-25.Example of MSTP Network with Legacy STP and RSTP Devices Connected Internal Page Figure 5-26.Active Topologies Built by Three Independent MST Instances Page Connectivity within the Same MST Instance Bridge: Common Spanning Tree (CST): Internal Spanning Tree (IST): MST Region: Page STP-compatible force version Page Spanning Tree protocol-version < stp | rstp | mstp Region Name: spanning-tree config-name Region Revision Number: spanning-treeconfig revision spanning-tree forward-delay max-age spanning-treepriority spanning-treeinstance < 1 - 16 > vlan < vid no spanning- tree instance Page spanning-tree pending stp-compatible: rstp-operation: mstp-operation: mstp force-version Page The no spanning-tree< port-list > mcheck ] command disables mcheck Force-True default) Force-False Auto: tcn-guard Switch Priority Page Page show running Priority instance ist > instance ist Page config-revision show spanning- tree pending a20-trk1 Figure 5-28.Example of Common Spanning Tree Status on an MSTP Switch Displaying Switch Statistics for a Specific MST Instance Page show spanning-tree a20-trk1config instance Figure 5-31.Example of the Configuration Listing for a Specific Instance Figure 5-32.Example of a Region-LevelConfiguration Display Figure 5-33.Example of Displaying a Pending Configuration Duplicate packets on a VLAN, or packets not arriving on a LAN at all A Switch Intended To Operate Within a Region Does Not Receive Page Quality of Service (QoS): Managing Bandwidth More Effectively Page Page Honor Priority Honor New Priority Set Priority Set Policy Honor Policy 802.1p prioritization: Type-of-Service (ToS): Page Table 6-1.PortQueue Exit Priorities Table 6-2.QoS Priority Settings and Operation Table 6-3.MappingSwitch QoS Priority Settings to Device Queues M u l t i p l e C r i t e r i a Table 6-4.Switch Classifier Search Order and Precedence Table 6-5.PrecedenceCriteria for QoS Classifiers Page Preparation for Configuring QoS Table 6-6.Summary of QoS Capabilities Table 6-7.Applying QoS Options to Traffic Types Defined by QoS Classifiers Table 6-8.QoS Rule Resource Usage Page Configuring a Policy When There Are Not Enough Rules Available Adding a Port to a QoS-ConfiguredVLAN Without Enough Rules show qos resources Figure 6-3.Example of Inspecting Available Rule Resources Demonstrating Differing Resource Usage on Different Ports Figure 6-4.Example of QoS Resource Usage with Device-Priorityand VLAN QoS Page Using QoS Classifiers To Configure QoS for Outbound Traffic Figure 6-5.Example of the Show QoS Output for VLAN Priority QoS Classifier Precedence: Options for Assigning Priority TCP/UDP Port Number Ranges. There are three ranges: www.iana.org Protocol Number Assignment Services Port Numbers Page N o t e o n P o l i c y Ty p e s Steps for Creating a DSCP Policy Based on TCP/UDP Port Number Classifiers Page Figure 6-7.Display the Current DSCP-MapConfiguration Figure 6-8.Assign Priorities to the Selected DSCPs Page Page Page Page Figure 6-11.Display the Current DSCP-MapConfiguration Figure 6-12.Assigning 802.1p Priorities to the Selected DSCPs Figure 6-13.The Completed Device-Priority/CodepointConfiguration ■ ToS Differentiated Services (Diffserv) Mode: This mode requires • Assign a New Prioritization Policy: A “policy” includes both a Assign an 802.1p Priority: Figure 6-14.Example of Enabling ToS IP-PrecedencePrioritization diff services 4.Enable diff-services diff-services Page incoming-DSCP outgoing- DSCP Page Figure 6-18.Display the Current DSCP-MapConfiguration qos dscp map N o t e s Figure 6-21.The ToS Codepoint and Precedence Bits Table 6-9.How the Switch Uses the ToS Configuration Table 6-10.ToS IP-PrecedenceBit Mappings to 802.1p Priorities Page Figure 6-22.Example of a List of VLANs Available for QoS Prioritization Figure 6-23.Configuring and Displaying QoS Priorities on VLANs Figure 6-24.Returning a QoS-PrioritizedVLAN to “No-override”Status Steps for Creating a Policy Based on VLAN-IDClassifier Figure 6-25.Display the Current Configuration in the DSCP Policy Table Figure 6-26.Assign Priorities to the Selected DSCPs Figure 6-27.The Completed VID-DSCPPriority Configuration Page Figure 6-28.Configuring and Displaying Source-PortQoS Priorities Figure 6-29.Returning a QoS-PrioritizedVLAN to “No-override”Status Page Page Figure 6-30.Display the Current Configuration in the DSCP Policy Table Figure 6-31.Assign Priorities to the Selected DSCPs Figure 6-32.The Completed Source-Port DSCP-PriorityConfiguration No- override Table 6-11.TheDefault DSCP Policy Table > priority < 0 - 7 >) Page Cannot modify DSCP Policy < codepoint > - in use by other qos rules show qos classifier Figure 6-34.Example of Trying To Change the Priority on a Policy In Use by a Classifier device-priority port-priority udp-port IP Multicast (IGMP) Interaction with QoS QoS Messages in the CLI QoS Operating Notes and Restrictions Table 6-12.Details of Packet Criteria and Restrictions for QoS Support All Switches: For Devices that Do Not Support 802.1Q Port Tagging Rules: Maximum QoS Configuration Entries: All Switches—Not Supported: Page IP Routing Features Page Overview of IP Routing Figure 7-1.Example of a Dynamic Entry show ip route Figure 7-2.Example of IP Route Table Entry Table 7-1.IP Global Parameters for Routing Switches Table 7-2.IP Interface Parameters – Routing Switches Configuring IP Parameters for Routing Switches Page infinite arp-age Default Figure 7-3.Example of Setting the ARP Age Timeout to 1000 Minutes show ip Figure 7-4.Example of show ip Command Displaying Arp Age Figure 7-5.Example Showing ip arp-ageValue in the Running Config File Figure 7-6.Example of the Menu Interface Displaying the Arp Age Value clear arp Page Burst-Normal Reply Limit Echo messages Address Mask replies Administration Fragmentation-needed Host Network Port Configuring Static IP Routes Directly-connected Statically configured route Null (reject) reject Page Page Figure 7-7.Example of a Routed Network Figure 7-8.Examples of the Show IP Route Command Configuring IRDP Packet type Hold time Page broadcast Figure 7-9.Example of Displaying IRDP Information Configuring DHCP Relay Page Page Figure 7-10.Example of a DHCP Option 82 Application DHCP Policy Boundary: DHCP relay agent: See Relay Agent Primary Relay Agent: Relay Agent: Secondary Relay Agent: Page Remote ID: system-information Figure 7-12.Usingthe CLI To View the Switch MAC Address Circuit ID: walkmib ifname append replace drop Configuration Options for Managing DHCP Client Request Packets Page Page Table 7-4.Relay Agent Management of DHCP Server Response Packets append: replace: keep: ip: Page Page UDP Broadcast Forwarding Page ip forward protocol udp forward-protocol udp dns: ntp: netbios-ns: netbios-dgm: radius: Figure 7-17.Displaying Global IP Forward-ProtocolStatus and Configuration Figure 7-18.Displaying IP Forward-ProtocolStatus and Per-VLANConfiguration Page Page ProCurve Stack Management Page Page Operation Page Table 8-1.Stacking Definitions Figure 8-1.Illustration of a Switch Moving from Candidate to Member Network Interface Options Figure 8-3.Example of a Non-StackingDevice Used in a Stacking Environment Table 8-2.Specific Rules for Commander, Candidate, and Member Switch Page Configuring Stack Management N/A Stack State Candidate General Steps for Creating a Stack Figure 8-4.Using the System Name to Help Identify Individual Switches Stacking Figure 8-5.The Default Stacking Menu Stack Configuration Figure 8-6.The Default Stack Configuration Screen Edit Yes Save Table 8-4.Candidate Configuration Options in the Menu Interface Transmission Interval Using the Menu To “Push” a Switch Into a Stack, Modify the Switch’s Figure 8-8.The Default Stack Configuration Screen Transmission Interval Using the Commander’s Menu To Manually Add a Candidate to a Stack 9.Stacking 4.Stack Management Figure 8-9.Example of the Stack Management Screen Add Figure 8-10.Example of Candidate List in Stack Management Screen Figure 8-11.Example of Stack Management Screen After New Member Added Using the Commander’s Menu To Move a Member From One Stack to 2.Stacking Status (All) Back Page Figure 8-13.Example of Stack Management Screen with Stack Members Listed Figure 8-14.Example of Selecting a Member for Removal from the Stack Delete Figure 8-15.The Prompt for Completing the Deletion of a Member from the Stack 5.Stack Access Figure 8-16.Example of the Stack Access Screen eXecute 9.Stacking ack 3.Stack Configuration Member Com mander MAC Address Table 8-5.Stack Status Environments Viewing Commander Status 1.Stacking Status (This Switch) Figure 8-19.Example of the Commander’s Stacking Status Screen Figure 8-20.Example of a Member’s Stacking Status Screen Viewing Candidate Status Figure 8-21.Example of a Candidate’s Stacking Screen Table 8-6.CLI Commands for Configuring Stacking on a Switch Page Viewing the Status of Candidates the Commander Has Detected Figure 8-23.Example of Using the Show Stack Candidates Command To List Candidates Viewing the Status of all Stack-EnabledSwitches Discovered in the IP Viewing the Status of the Commander and Current Members of the Commander’s Stack Page Using a Member’s CLI to Convert the Member to the Commander of a Page Using the Commander’s CLI To Manually Add a Candidate to the show stack view show stack candidates Figure 8-28.Example of How To Determine Available Switch Numbers (SNs) Figure 8-29.Example of How To Determine MAC Addresses of Discovered Candidates Figure 8-30.Example Showing the Stack After Adding a New Member Status: [no] stack auto-join Status: Using a Candidate CLI To Manually “Push” the Candidate Into a Stack mac-addr Figure 8-31.Example of “Pushing” a Candidate Into a Stack Using the Destination Commander CLI To “Pull” a Member from Figure 8-32.Example of Stack Listing with Two Stacks in the Subnet show stack all Figure 8-33.Example of Command Sequence for Converting a Commander to a Member Figure 8-34.Example of a Commander and Three Switches in a Stack Using the Member’s CLI To Remove the Member from a Stack 1 - 15) Figure 8-36.Example of a Stack Showing Switch Number (SN) Assignments Figure 8-37.Example of SNMP Community Operation with Stacking SNMP Management Station Access to Members Via the Commander @sw<switch number Disabling a Candidate: Figure 8-38.Example of the Web Browser Interface for a Commander Stack Closeup Page Page Numerics