Vlan tagging | HP 445946-001 manual

VLANs

VLAN tagging

The switch supports IEEE 802.1Q VLAN tagging, providing standards-based VLAN support for Ethernet systems.

Tagging places the VLAN identifier in the frame header, allowing each port to belong to multiple VLANs. When you configure multiple VLANs on a port, you must also enable tagging on that port.

Since tagging fundamentally changes the format of frames transmitted on a tagged port, you must carefully plan network designs to prevent tagged frames from being transmitted to devices that do not support 802.1Q VLAN tags, or devices where tagging is not enabled.

Important terms used with the 802.1Q tagging feature are:

•VLAN identifier (VID)—the 12-bit portion of the VLAN tag in the frame header that identifies an explicit VLAN.

•Port VLAN identifier (PVID)—a classification mechanism that associates a port with a specific VLAN. For example, a port with a PVID of 3 (PVID = 3) assigns all untagged frames received on this port to VLAN 3.

•Tagged frame—a frame that carries VLAN tagging information in the header. The VLAN tagging information is a 32-bit field (VLAN tag) in the frame header that identifies the frame as belonging to a specific VLAN. Untagged frames are marked (tagged) with this classification as they leave the switch through a port that is configured as a tagged port.

•Untagged frame—a frame that does not carry any VLAN tagging information in the frame header.

•Untagged member—a port that has been configured as an untagged member of a specific VLAN. When an untagged frame exits the switch through an untagged member port, the frame header remains unchanged. When a tagged frame exits the switch through an untagged member port, the tag is stripped and the tagged frame is changed to an untagged frame.

•Tagged member—a port that has been configured as a tagged member of a specific VLAN. When an untagged frame exits the switch through a tagged member port, the frame header is modified to include the 32-bit tag associated with the PVID. When a tagged frame exits the switch through a tagged member port, the frame header remains unchanged (original VID remains).

NOTE: If an 802.1Q tagged frame is sent to a port that has VLAN-tagging disabled, then the frames are forwarded based on their port-VLAN ID (PVID).

55

Image 55

HP 445946-001 manual Vlan tagging

Contents

Part number First edition June HP 10Gb Ethernet BL-c Switch Legal notices Contents 802.1x port states Configuring Lacp802.1x authentication process Configuring port-based traffic control Edge port Link type Configuration guidelinesBridge priority Port priority Port path cost Adding a Vlan to a Spanning Tree Group Creating a Vlan 109 100105 106 155 131Internal versus external routing 134 141 175 Configuring the switch for tracking 177167 173 Accessing the switch Accessing the switchIntroduction Management Network Typeface or Meaning Example SymbolAdditional references Typographical conventions Connecting through Telnet Connecting through the console portConnecting through Secure Shell Configuring an IP interface Using the command line interfaces Apply, verify, and save the configuration Using the Browser-based Interface Snmp Using Simple Network Management ProtocolDefault configuration For more details, see Configuring Snmp trap hosts Cfg/sys/ssnmp/snmpv3/usm x/auth md5sha User configuration CLI user equivalent View based configurations SNMPv1 trap host Configuring Snmp trap hostsConfigure a user with no authentication or password CLI oper equivalent Sys/ssnmp/snmpv3/tparam x/uname Accessing the switch Configure an entry in the notify table SNMPv3 trap host configuration SNMPv2 trap host configuration Setting allowable source IP address ranges Secure access to the switch Configuring an IP address range for the management network Radius authentication and authorizationHow Radius authentication works Apply and save the configuration Configuring Radius on the switch CLI example Click Submit Configuring Radius on the switch BBI example Description and tasks performed Radius authentication featuresUser accounts for Radius users User account Radius attributes for user privileges TACACS+ authenticationAccessing the switch User access levels User name/access User service type Value User access level TACACS+ level How TACACS+ authentication worksTACACS+ authentication features Authorization Accounting Configure custom privilege-level mapping optional Configure the TACACS+ secret and second secret Configuring TACACS+ authentication on the switch BBI example Secure Shell and Secure Copy Enabling or disabling SSH Configuring SSH and SCP features CLI example For example Using SSH and SCP client commandsEnter the following command to log in to the switch Switch prompts you for the scpadmin password SSH and SCP encryption of management messages Generating RSA host and server keys for SSH access SSH/SCP integration with Radius and TACACS+ authentication User access controlUser account Description Password Define the user name and password Setting up user IDsEnable the user ID Port number Port alias Ports on the switchPorts and trunking Ports and trunking Port trunk groups Before you configure trunksBuilt-in fault tolerance Ports and trunking Ethernet switch port names Cfg/port x/cur Trunk group configuration rules Port trunking example On Switch 1, configure trunk groups 5 Configuring trunk groups CLI exampleOn Switch 2, configure trunk groups 4 Configuring trunk groups BBI example Click Submit Page Actor Switch Partner Switch Configurable Trunk Hash algorithmLink Aggregation Control Protocol Page Save your new configuration changes Configuring LacpDefine the admin key on port Apply and verify the configuration Port-based Network Access and traffic control Port-based Network Access and traffic controlPort-based Network Access control Extensible authentication protocol over LAN EAPoL Message Exchange 802.1x authentication process 802.1x port states Attribute Attribute Value Supported Radius attributes Port-based traffic control EAPoL configuration guidelines Configuring port-based traffic control Vlan numbers VLANsOverview VLANs and port Vlan ID numbers Viewing VLANs Viewing and configuring PVIDsPort configuration Pvid numbers Vlan tagging VLANs VLANs Vlan topologies and design considerations VLANs and IP interfaces Vlan configuration rules Component Description Multiple Vlans with tagging Configuring ports and VLANs on Switch 1 CLI example Configuring the example networkVLANs Multiple VLANs with tagging # add Add port 18 to Vlan Current Ports for Configuring ports and VLANs on Switch 2 CLI example Configuring ports and VLANs on Switch 1 BBI example VLANs Enable the port and enable Vlan tagging Cfg/l2/fdb/static FDB static entries Trunking support for FDB static entries Configuring a static FDB entry Bridge Protocol Data Units Spanning Tree ProtocolSpanning Tree Protocol Default Spanning Tree configuration Spanning Tree Group configuration guidelinesDetermining the path for forwarding BPDUs Adding and removing ports from STGs Adding a Vlan to a Spanning Tree GroupCreating a Vlan Rules for Vlan tagged ports Assigning cost to ports and trunk groups Why do we need Multiple Spanning Trees?Switch element Belongs to Multiple Spanning Trees Two VLANs on separate instances of Spanning Tree Protocol Vlan participation in Spanning Tree Groups Configuring Switch 1 CLI example Configuring Multiple Spanning Tree GroupsConfiguring Switch 2 CLI example Configuring Switch 1 BBI example Page Port Fast Forwarding Configuring Port Fast ForwardingConfiguration guidelines Configuring Fast Uplink Convergence Rstp and Mstp Rstp and MstpRapid Spanning Tree Protocol Port state changes Rstp configuration example Rstp configuration guidelinesPort type and link type Configuring Rapid Spanning Tree Protocol BBI example Common Internal Spanning Tree Rstp and Mstp Apply, verify, and save the configurationMultiple Spanning Tree Protocol Mstp region Assign VLANs to Spanning Tree Groups Mstp configuration guidelinesMstp configuration example Configuring Multiple Spanning Tree Protocol CLI example Configuring Multiple Spanning Tree Protocol BBI example Click Submit Page Apply, verify, and save the configuration Quality of Service Quality of Service Summary of packet classifiers Using ACL filtersNumber Protocol Name Well-krown TCP flag values Quality of Service Well-known protocol typesNumber Application Understanding ACL precedence Summary of ACL actionsPrecedence Group ACLs Precedence Level Using ACL Groups Re-marking ACL Metering and Re-markingViewing ACL statistics Metering Configure Access Control Lists CLI example ACL configuration examples Configure Access Control Lists and Groups BBI example Click Submit Page Quality of Service Add the ACL to the port Drop Precedence Class Using Dscp values to provide QoSDifferentiated Services concepts Per Hop Behavior Class selector priority classes Using 802.1p priorities to provide QoSService Level Default PHB 802.1p Priority QoS levelsPage 802.1p configuration BBI example 802.1p configuration CLI exampleConfigure a port’s default 802.1 priority Quality of Service Select a port 101 102 Quality of Service Set the 802.1p priority value 103 Page Queuing and scheduling Basic IP routing Basic IP routingIP routing benefits Routing between IP subnetsPage Page Subnet Devices IP Addresses Example of subnet routingInterface Devices IP Interface Address Add the switch ports to their respective VLANs 110 Using VLANs to segregate broadcast domainsEnable, apply, and verify the configuration Devices IP Interface Switch Port 111 Dhcp relay agent Dynamic Host Configuration Protocol Dhcp relay agent configuration Stability Routing updatesRouting Information Protocol Distance vector protocol RIPv2 RIPv2 in RIPv1 compatibility modeRIP Features RIPv1 Metric DefaultAuthentication Multicast Cfg/l3/frwd/on before you turn RIP on RIP configuration exampleAdd VLANs for routing interfaces Add IP interfaces to VLANs Igmp Snooping Igmp Snooping FastLeave IGMPv3 Configuring the action Configuring the rangeIgmp Filtering Static multicast router Igmp Snooping configuration exampleConfiguring Igmp Snooping CLI example Enable IGMPv3 Snooping optional Define an Igmp Filter Configuring Igmp Filtering CLI exampleConfiguring a Static Mrouter CLI example Enable Igmp Filtering on the switch Configuring Igmp Snooping BBI example Apply, verify, and save the configuration 124 Igmp Snooping Enable Igmp Snooping Configuring Igmp Filtering BBI example Select Layer 3 Igmp Igmp Filters Add Filter Igmp Snooping Define the Igmp Filter126 Page Apply, verify, and save the configuration 128 Configure Static Mrouter Click the Configure context button Configuring a Static Multicast Router BBI example Apply, verify, and save the configuration Igmp Snooping 130 Types of Ospf areas Ospf overview Ospf area types Types of Ospf routing devices Link-State Database Neighbors and adjacenciesShortest Path First Tree Configurable parameters Ospf implementation in HP 10GbE switch softwareInternal versus external routing Assigning the area index Defining areasArea index set to an arbitrary value Interface cost Using the area ID to assign the Ospf area numberAttaching an area to a network Electing the designated router and backup Default routesSummarizing routes Router ID Virtual links Enable Ospf authentication for Area 2 on switch Assign MD5 key ID to Ospf virtual link on switches 2 Configure MD5 key ID for Area 0 on switches 1, 2,Assign MD5 key ID to Ospf interfaces on switches 1, 2, Enable Ospf MD5 authentication for Area 2 on switch Ospf features not supported in this release Ospf configuration examplesExample 1 Simple Ospf domain CLI example Example 1 Simple Ospf domain BBI example Apply, verify, and save the configuration 143 Ospf Click Submit Click Submit Select Add Ospf Area Configure the Ospf area146 Ospf 148 Click Submit Select Add Ospf Interface Apply, verify, and save the configuration 149 Example 2 Virtual links Configuring Ospf for a virtual link on Switch aDefine the backbone Attach the network interface to the transit area Configuring Ospf for a virtual link on Switch BConfigure the virtual link Switch B in step Other Virtual Link Options Example 3 Summarizing routesDefine the transit area 153 Verifying Ospf configuration Rmon group 1-statistics Remote monitoringRemote monitoring Configuring Rmon Statistics BBI example Configuring Rmon Statistics CLI exampleView Rmon statistics for the port Remote monitoring Select a port 157 Rmon group 2-history Remote monitoring Enable Rmon on the port History MIB objects Configure the Rmon History parameters Apply, verify, and save the configuration 160 Configure Rmon History BBI example Alarm MIB objects Rmon group 3-alarms Configure the Rmon Alarm parameters to track Icmp messages Configure Rmon Alarms BBI example Apply, verify, and save the configuration 163 164 Rmon group 9-events Configuring Rmon Events CLI exampleRemote monitoring Apply, verify, and save the configuration Configure the Rmon Event parameters Apply, verify, and save the configuration 166 Configuring Rmon Events BBI example Uplink Failure Detection High availabilityHigh availability Spanning Tree Protocol with UFD Failure Detection Pair Monitoring Uplink Failure Detection Configuring Uplink Failure Detection Create a trunk group of uplink ports 18-21 to monitor Configuring UFD on Switch 1 CLI exampleConfiguring UFD on Switch 2 CLI example Turn UFD on Configuring Uplink Failure Detection BBI example Apply, verify, and save the configuration 172 Virtual router MAC address Vrrp overviewVrrp components Virtual router Virtual Interface Router Master and backup virtual routerVrrp operation Selecting the master Vrrp router Active-Active redundancy Failover methods Tracking Vrrp router priority HP 10GbE switch extensions to VrrpParameter Virtual router deployment considerations Configuring the switch for trackingAssigning Vrrp virtual router ID Configure ports High availability configurationsActive-Active configuration Task 1 Configure Switch a 179 High availability Configure client and server interfacesTurn on Vrrp and configure two Virtual Interface Routers Turn off Spanning Tree Protocol globally Task 2 Configure Switch B Vrrp Virtual Router 1# Task 1 Configure Switch a BBI example Click Submit 183 184 Page High availability Enable Vrrp processing 187 Click Submit Select Add Virtual Router Click Submit High availability 189 Apply, verify, and save the configuration 190 Troubleshooting tools Troubleshooting toolsPort Mirroring Select the ports that you want to mirror Configuring Port Mirroring CLI exampleEnable Port Mirroring View the current configuration Configuring Port Mirroring BBI example Click Add Mirrored Port Other network troubleshooting techniques Page Index Index197 198