Application Guide
 Alteon OS Application Guide
 Contents
 Port-based Network Access Control
 Rapid Spanning Tree Protocol/Multiple Spanning Tree Protocol
 Part 2 IP Routing
 Border Gateway Protocol
 Part 3 High Availability Fundamentals
 Part 4 Appendices
 Alteon OS Application Guide
 Figures
 3Two trunks, one Failover Trigger
 Tables
 Alteon OS Application Guide
 Who Should Use This Guide
Preface
 What You’ll Find in This Guide
Part 1 Basic Switching
 Part 3 High Availability Fundamentals
 AaBbCc123
Typographic Conventions
 How to Get Help
 Alteon OS Application Guide 20  Preface
 Part 1 Basic Switching
 Alteon OS Application Guide
 Accessing the Switch
 Factory-Default vs. MM assigned IP Addresses
Management module setup
 Configuring management module for switch access
Default Gateway
 1Switch management on the BladeCenter management module
 Alteon OS Application Guide
 Configuring the external management interface
External management port setup
Enable port EXT7
 Connect to the Switch via SSH
Using Telnet
Bootp Relay Agent
Telnet switch IP address -m-mgt-e-ext7-d-data
 # /cfg/l3/bootp
Configuring the Bootp Relay Agent
# /cfg/l3/if interface number/relay ena
 Dhcp Relay Agent
Dhcp Relay Agent Configuration
 32  Accessing the Switch
 Configuring BBI Access via Http
Using the Browser-Based Interface
Configuring BBI Access via Https
  TACACS+  Ldap  NTP
Cfg/sys/access/https/generate
  FDB
 Snmp
Using Snmp
Cfg/sys/ssnmp/rcomm Cfg/sys/ssnmp/wcomm
Cfg/sys/ssnmp/trsrc
 User Configuration
Default configuration
 CLI User equivalent
View based Configurations
 Configure a user with no authentication and password
Configuring Snmp Trap Hosts
SNMPv1 trap host
 Sys/ssnmp/snmpv3/tparam x/uname
Configure an entry in the notify table
 SNMPv3 trap host configuration
SNMPv2 trap host configuration
 42  Accessing the Switch
 Securing Access to the Switch
 How Radius Authentication Works
Radius Authentication and Authorization
Configuring Radius on the Switch
 Main# /cfg/sys/radius
Configure the Radius secret
Prisrv
Secsrv
 Radius Authentication Features in Alteon OS
 Radius Attributes for Alteon OS User Privileges
Switch User Accounts
 How TACACS+ Authentication Works
TACACS+ Authentication
TACACS+ Authentication Features in Alteon OS
 4Default TACACS+ Authorization Levels
Authorization
 Accounting
Command Authorization and Logging
 Cfg/sys/tacacs/chpasss
Cfg/sys/tacacs/chpassp
 Configure the TACACS+ secret and second secret
Configuring TACACS+ Authentication on the Switch
Apply and save the configuration
Main# /cfg/sys/tacacs+
 Configuring the Ldap Server
Ldap Authentication and Authorization
 Configure the domain name
Configuring Ldap Authentication on the Switch
Main# /cfg/sys/ldap
 Secure Shell and Secure Copy
 # /cfg/sys/sshd/on
Configuring SSH/SCP features on the switch
# /cfg/sys/sshd/off
# /cfg/sys/sshd/dis
 Using SSH and SCP Client Commands
Configuring the SCP Administrator Password
Ssh 205.178.15.157 Login-name
# scp scpadmin@205.178.15.157getcfg ad4.cfg
 # scp ad4.cfg scpadmin@205.178.15.157putcfg
To apply and save the configuration
SSH and SCP Encryption of Management Messages
 Cfg/sys/sshd/hkeygen
Generating RSA Host and Server Keys for SSH Access
Cfg/sys/sshd/skeygen
 SSH/SCP Integration with TACACS+ Authentication
SSH/SCP Integration with Radius Authentication
 Considerations for Configuring End User Accounts
End User Access Control
 User Access Control Menu
Strong Passwords
# /cfg/sys/access/user
# /cfg/sys/access/user/uid
 Passwd
Name user1
# cur
 Listing Current Users
# /cfg/sys/access/user/cur
Logging into an End User Account
 Alteon OS Application Guide 42C4911, January
 Alteon OS Application Guide 66  Accessing the Switch
 Port-based Network Access Control
 Extensible Authentication Protocol over LAN
 Port Unauthorized
802.1x Authentication Process
 EAPoL Message Exchange
  Unauthorized
802.1x Port States
 Authorized
 Force Unauthorized
 Support for Radius Attributes
Supported Radius Attributes
 Configuration Guidelines
 42C4911, January
 VLANs
 Overview
 Vlan Numbers
VLANs and Port Vlan ID Numbers
Pvid Numbers
Viewing VLANs
 Cfg/port INT7/pvid
Viewing and Configuring PVIDs
 Alteon OS Application Guide
 Vlan Tagging
 1Default Vlan settings
 2Port-based Vlan assignment
 4802.1Q tag assignment
 Vlan Topologies and Design Considerations
Vlan configuration rules
 Component Description
Example 1 Multiple VLANs with Tagging Adapters
 86  VLANs
 Protocol-based VLANs
 Pvlan Priority Levels
Port-based vs. Protocol-based VLANs
Pvlan Tagging
 Configuring Pvlan
Pvlan Configuration Guidelines
Configure the priority value for the protocol
Cfg/l2/vlan
 Enable the Pvlan
Configure Vlan tagging for ports
Add member ports for this Pvlan
 Info/l2/vlan
Verify Pvlan operation
 Alteon OS Application Guide 92  VLANs
 Ports and Trunking
 1Port Trunk Group
 Before you configure static trunks
Built-In Fault Tolerance
Statistical Load Distribution
 Trunk group configuration rules
 Port Trunking Example
Example below, three ports are trunked between two switches
 Repeat the process on the other switch
 Info/l2/trunk
Examine the trunking information on each switch
 Configurable Trunk Hash Algorithm
 Link Aggregation Control Protocol
Admin key
 102  Ports and Trunking
 Configuring Lacp
 Alteon OS Application Guide 104  Ports and Trunking
 Spanning Tree Group
 1Ports, Trunk Groups, and VLANs
 Determining the Path for Forwarding BPDUs
Bridge Protocol Data Units BPDUs
Bridge Priority
Port Priority
 Port Path Cost
Spanning Tree Group configuration guidelines
Adding a Vlan to a Spanning Tree Group
Creating a Vlan
 Adding and removing ports from STGs
Rules for Vlan Tagged ports
 Multiple Spanning Trees
Default Spanning Tree configuration
 Switch-Centric Spanning Tree Group
Why Do We Need Multiple Spanning Trees?
 2Implementing Multiple Spanning Tree Groups
Vlan Participation in Spanning Tree Groups
 Configure the following on application switch a
Configuring Multiple Spanning Tree Groups
Configure the following on GbE Switch Module B
# /cfg/l2/vlan2
 # /cfg/l2/vlan3
Configure the following on application switch C
 Port Fast Forwarding
Configuring Port Fast Forwarding
# /cfg/port ext1
Fastfwd ena
 Fast Uplink Convergence
Configuring Fast Uplink Convergence
# /cfg/l2/upfast ena
# apply
 Rapid Spanning Tree Protocol/Multiple Spanning Tree Protocol
 Port State Changes
Rapid Spanning Tree Protocol
 Port Type and Link Type
Rstp Configuration Guidelines
Edge Port
Link Type
 Configure Rapid Spanning Tree
Rstp Configuration Example
Set the Spanning Tree mode to Rapid Spanning Tree
Configure STP Group 1 parameters
 Mstp Region
Multiple Spanning Tree Protocol
Common Internal Spanning Tree
 Mstp Configuration Example
Mstp Configuration Guidelines
Configure Multiple Spanning Tree Protocol
Assign VLANs to Spanning Tree Groups
 Quality of Service
 ACL
 Quality of Service 
 Summary of packet classifiers
Using ACL Filters
 2Well-Known Application Ports
 Understanding ACL Precedence
Summary of ACL Actions
  Access Control Lists
Using ACL Groups
 ACL Metering and Re-marking
 Access Control Groups
 Metering
Viewing ACL Statistics
Re-Marking
 Configure an Access Control List
ACL Configuration Examples
Example
Add ACL 1 to port EXT1
 ACL 3# ipv4/sip 100.10.1.0
Add ACL 3 to port EXT1
ACL 3# action deny
 Differentiated Services Concepts
Using Dscp Values to Provide QoS
Per Hop Behavior
 Dscp
 QoS Levels
Default QoS Service Levels
 Dscp Re-marking and Mapping
 Enable Dscp re-marking on a port
Dscp Re-marking Configuration Example
Main# cfg/qos/dscp/on
Main# cfg/port EXT1
 3Layer 2 802.1q/802.1p Vlan tagged packet
Using 802.1p Priorities to Provide QoS
 Configure a port’s default 802.1p priority
802.1p Configuration Example
Queuing and Scheduling
Port EXT1# 8021ppri
 Part 2 IP Routing
 142 42C4911, January
 Basic IP Routing
 IP Routing Benefits
 1The Router Legacy Network
Routing Between IP Subnets
 2Switch-Based Routing Topology
 Alteon OS Application Guide
 1Subnet Routing Example IP Address Assignments
Example of Subnet Routing
 # addr
# /cfg/l3/if
# ../if
 Add the switch ports to their respective VLANs
Using VLANs to Segregate Broadcast Domains
 Vlan 3# /cfg/l3/if
Add each IP interface to the appropriate Vlan
Vlan
# /info/vlan
 Dynamic Host Configuration Protocol
 Dhcp Relay Agent
 Dhcp Relay Agent Configuration
 Distance Vector Protocol
Routing Information Protocol
Stability
 RIPv1
Routing Updates
RIPv2
 RIP Features
RIPv2 in RIPv1 compatibility mode
Triggered updates
Poison
 Default
RIP Configuration Example
Authentication
Metric
 Add VLANs for routing interfaces
Turn on RIP globally and enable RIP for each interface
Add IP interfaces to VLANs
 42C4911, January
 Igmp
 Igmp Snooping
 Configure Igmp Snooping
Igmp Snooping Configuration Example
Add VLANs to Igmp Snooping and enable the feature
View dynamic Igmp information
 Apply, verify, and save the configuration
Configure a Static Multicast Router
Static Multicast Router
Cfg/l3/igmp/mrouter
 Igmp Relay
 Configure an IP interface and assign VLANs
Configure Igmp Relay
Enable Igmp Relay and add VLANs to the downstream network
Configure the upstream Mrouters
 Multicast Router Apply
 Configuring the Range
Additional Igmp Features
FastLeave
Igmp Filtering
 Configure Igmp Filtering
Configuring the Action
Enable Igmp Filtering on the switch
Define an Igmp filter
 Filt ena
Assign the Igmp filter to a port
 Border Gateway Protocol
 1iBGP and eBGP
Internal Routing Versus External Routing
 Forming BGP Peer Routers
 # /cfg/l3/rmap
What is a Route Map?
 Incoming and Outgoing Route Maps
2Distributing Network Filters in Access Lists and Route Maps
 Precedence
Configuration Overview
Define network filter
 Set up the BGP attributes
Optional Configure the attributes in the AS filter menu
Enable the route map
Assign the route map to a peer router
 Aggregating Routes
 Redistributing Routes
 Local Preference Attribute
BGP Attributes
Metric Multi-Exit Discriminator Attribute
 Selecting Route Paths in BGP
 3BGP Failover Configuration Example
BGP Failover Configuration
 Define the VLANs
Enable IP forwarding
Define the IP interfaces
 On the switch, apply and save your configuration changes
Configure BGP peer router 1
 # /cfg/l3/bgp
Default Redistribution and Route Aggregation Example
 Configure redistribution for Peer
Configure internal peer router 1 and external peer router
Configure aggregation policy control
 Ospf
 Types of Ospf Areas
Ospf Overview
 Nssa
 2OSPF Domain and an Autonomous System
Types of Ospf Routing Devices
 Link-State Database
Neighbors and Adjacencies
 Internal Versus External Routing
Shortest Path First Tree
 Ospf Implementation in Alteon OS
Configurable Parameters
 Assigning the Area Index
Defining Areas
 Attaching an Area to a Network
Using the Area ID to Assign the Ospf Area Number
 Interface Cost
Electing the Designated Router and Backup
Summarizing Routes
 # /cfg/l3/ospf/default metric value metric type 1 or
Default Routes
 # /cfg/l3/ospf/aindex area index/type transit
Virtual Links
 Router ID
Authentication
 # /cfg/l3/ospf/if
Enable Ospf authentication for Area 0 on switches 1, 2,
 Enable Ospf MD5 authentication for Area 0 on switches 1, 2,
Enable Ospf authentication for Area 2 on switch
Configure MD5 key ID for Area 0 on switches 1, 2,
Assign MD5 key ID to Ospf interfaces on switches 1, 2,
 Host Routes for Load Balancing
Assign MD5 key ID to Ospf virtual link on switches 2
 Ospf Features Not Supported in This Release
 Configure IP interfaces
Ospf Configuration Examples
Optional Configure the router ID
 # enable
Enable Ospf
Example 1 Simple Ospf Domain
# /cfg/l3/if # addr
 Define the backbone
Apply and save the configuration changes
Define the stub area
Attach the network interface to the backbone
 Configure the router ID
Configuring Ospf for a Virtual Link on Switch #1
Example 2 Virtual Links
IP # /cfg/l3/ospf/on
 Define the transit area
Configure the virtual link
Attach the network interface to the transit area
 # ../aindex
Configuring Ospf for a Virtual Link on Switch #2
 Other Virtual Link Options
 7Summarizing Routes
Example 3 Summarizing Routes
 # ena
 36.128.192.0
Verifying Ospf Configuration
36.128.200.0
 Alteon OS Application Guide 214  Ospf
 Part 3 High Availability Fundamentals
 216 42C4911, January
 High Availability
 Vlan Monitor
Layer 2 Failover
 L2 Failover with Other Features
Setting the Failover Limit
Spanning Tree Protocol
 InternetI t t
L2 Failover Configurations
 2Two trunks, each in a different Failover Trigger
 3Two trunks, one Failover Trigger
 Configure Failover parameters
Configuring Trunk Failover
# /cfg/failovr/on
 Vrrp Components
Vrrp Overview
Virtual Router
Virtual Router MAC Address
 Virtual Interface Router
Master and Backup Virtual Router
 Selecting the Master Vrrp Router
Vrrp Operation
 Failover Methods
4A Non-VRRP, Hot-Standby Configuration
 5Active-Active Redundancy
Active-Active Redundancy
 Virtual Router Group
Hot-Standby Redundancy
 Tracking Vrrp Router Priority
Alteon OS extensions to Vrrp
 Virtual Router Deployment Considerations
Configuring the Switch for Tracking
Assigning Vrrp Virtual Router ID
 232  High Availability
 Active-Active Configuration
High Availability Configurations
 Configure client and server interfaces
Task 1 Configure GbESM
 Configure ports
Turn on Vrrp and configure two Virtual Interface Routers
Turn off Spanning Tree Protocol globally
 Task 2 Configure GbESM
 Cfg/l3/vrrp/vr
 Hot-Standby Configuration
 8Hot-Standby Configuration
 Enable Vrrp Hot Standby
Configure Virtual Interface Routers
 Router Group# track/ports enaEnable tracking on ports
 242  High Availability
 Part 4 Appendices
 244 42C4911, January
 Troubleshooting
 Figure A-1Monitoring Ports
Monitoring Ports
 Layer 2 Port Mirroring
Port Mirroring behavior
 248  Appendix a Troubleshooting
 Layer 3 Port Mirroring Both Ports in Different GEAs
 /info/geaport command
 Enable port mirroring
Configuring Port Mirroring
Specify the monitoring port
Select the ports that you want to mirror
 PortMirroring # cur
View the current configuration
 Radius Server Configuration Notes
  @alteon.dct
 Translation
Glossary
 Vrid Virtual Router
 Numerics
Index
 Icmp
 188
 Snmp