Application Guide
Alteon OS Application Guide
Contents
Port-based Network Access Control
Rapid Spanning Tree Protocol/Multiple Spanning Tree Protocol
Part 2 IP Routing
Border Gateway Protocol
Part 3 High Availability Fundamentals
Part 4 Appendices
Alteon OS Application Guide
Figures
3Two trunks, one Failover Trigger
Tables
Alteon OS Application Guide
Who Should Use This Guide
Preface
What You’ll Find in This Guide
Part 1 Basic Switching
Part 3 High Availability Fundamentals
AaBbCc123
Typographic Conventions
How to Get Help
Alteon OS Application Guide 20 Preface
Part 1 Basic Switching
Alteon OS Application Guide
Accessing the Switch
Factory-Default vs. MM assigned IP Addresses
Management module setup
Configuring management module for switch access
Default Gateway
1Switch management on the BladeCenter management module
Alteon OS Application Guide
External management port setup
Configuring the external management interface
Enable port EXT7
Telnet switch IP address -m-mgt-e-ext7-d-data
Using Telnet
Connect to the Switch via SSH
Bootp Relay Agent
Configuring the Bootp Relay Agent
# /cfg/l3/bootp
# /cfg/l3/if interface number/relay ena
Dhcp Relay Agent
Dhcp Relay Agent Configuration
32 Accessing the Switch
Using the Browser-Based Interface
Configuring BBI Access via Http
Configuring BBI Access via Https
TACACS+ Ldap NTP
Cfg/sys/access/https/generate
FDB
Cfg/sys/ssnmp/trsrc
Using Snmp
Snmp
Cfg/sys/ssnmp/rcomm Cfg/sys/ssnmp/wcomm
User Configuration
Default configuration
CLI User equivalent
View based Configurations
Configuring Snmp Trap Hosts
Configure a user with no authentication and password
SNMPv1 trap host
Sys/ssnmp/snmpv3/tparam x/uname
Configure an entry in the notify table
SNMPv3 trap host configuration
SNMPv2 trap host configuration
42 Accessing the Switch
Securing Access to the Switch
Radius Authentication and Authorization
How Radius Authentication Works
Configuring Radius on the Switch
Secsrv
Configure the Radius secret
Main# /cfg/sys/radius
Prisrv
Radius Authentication Features in Alteon OS
Radius Attributes for Alteon OS User Privileges
Switch User Accounts
TACACS+ Authentication
How TACACS+ Authentication Works
TACACS+ Authentication Features in Alteon OS
4Default TACACS+ Authorization Levels
Authorization
Accounting
Command Authorization and Logging
Cfg/sys/tacacs/chpasss
Cfg/sys/tacacs/chpassp
Main# /cfg/sys/tacacs+
Configuring TACACS+ Authentication on the Switch
Configure the TACACS+ secret and second secret
Apply and save the configuration
Configuring the Ldap Server
Ldap Authentication and Authorization
Configuring Ldap Authentication on the Switch
Configure the domain name
Main# /cfg/sys/ldap
Secure Shell and Secure Copy
# /cfg/sys/sshd/dis
Configuring SSH/SCP features on the switch
# /cfg/sys/sshd/on
# /cfg/sys/sshd/off
# scp scpadmin@205.178.15.157getcfg ad4.cfg
Configuring the SCP Administrator Password
Using SSH and SCP Client Commands
Ssh 205.178.15.157 Login-name
To apply and save the configuration
# scp ad4.cfg scpadmin@205.178.15.157putcfg
SSH and SCP Encryption of Management Messages
Generating RSA Host and Server Keys for SSH Access
Cfg/sys/sshd/hkeygen
Cfg/sys/sshd/skeygen
SSH/SCP Integration with TACACS+ Authentication
SSH/SCP Integration with Radius Authentication
Considerations for Configuring End User Accounts
End User Access Control
# /cfg/sys/access/user/uid
Strong Passwords
User Access Control Menu
# /cfg/sys/access/user
Name user1
Passwd
# cur
# /cfg/sys/access/user/cur
Listing Current Users
Logging into an End User Account
Alteon OS Application Guide 42C4911, January
Alteon OS Application Guide 66 Accessing the Switch
Port-based Network Access Control
Extensible Authentication Protocol over LAN
Port Unauthorized
802.1x Authentication Process
EAPoL Message Exchange
Force Unauthorized
802.1x Port States
Unauthorized
Authorized
Support for Radius Attributes
Supported Radius Attributes
Configuration Guidelines
42C4911, January
VLANs
Overview
Viewing VLANs
VLANs and Port Vlan ID Numbers
Vlan Numbers
Pvid Numbers
Cfg/port INT7/pvid
Viewing and Configuring PVIDs
Alteon OS Application Guide
Vlan Tagging
1Default Vlan settings
2Port-based Vlan assignment
4802.1Q tag assignment
Vlan Topologies and Design Considerations
Vlan configuration rules
Component Description
Example 1 Multiple VLANs with Tagging Adapters
86 VLANs
Protocol-based VLANs
Port-based vs. Protocol-based VLANs
Pvlan Priority Levels
Pvlan Tagging
Cfg/l2/vlan
Pvlan Configuration Guidelines
Configuring Pvlan
Configure the priority value for the protocol
Configure Vlan tagging for ports
Enable the Pvlan
Add member ports for this Pvlan
Info/l2/vlan
Verify Pvlan operation
Alteon OS Application Guide 92 VLANs
Ports and Trunking
1Port Trunk Group
Built-In Fault Tolerance
Before you configure static trunks
Statistical Load Distribution
Trunk group configuration rules
Port Trunking Example
Example below, three ports are trunked between two switches
Repeat the process on the other switch
Info/l2/trunk
Examine the trunking information on each switch
Configurable Trunk Hash Algorithm
Link Aggregation Control Protocol
Admin key
102 Ports and Trunking
Configuring Lacp
Alteon OS Application Guide 104 Ports and Trunking
Spanning Tree Group
1Ports, Trunk Groups, and VLANs
Port Priority
Bridge Protocol Data Units BPDUs
Determining the Path for Forwarding BPDUs
Bridge Priority
Creating a Vlan
Spanning Tree Group configuration guidelines
Port Path Cost
Adding a Vlan to a Spanning Tree Group
Adding and removing ports from STGs
Rules for Vlan Tagged ports
Multiple Spanning Trees
Default Spanning Tree configuration
Switch-Centric Spanning Tree Group
Why Do We Need Multiple Spanning Trees?
2Implementing Multiple Spanning Tree Groups
Vlan Participation in Spanning Tree Groups
# /cfg/l2/vlan2
Configuring Multiple Spanning Tree Groups
Configure the following on application switch a
Configure the following on GbE Switch Module B
# /cfg/l2/vlan3
Configure the following on application switch C
Fastfwd ena
Configuring Port Fast Forwarding
Port Fast Forwarding
# /cfg/port ext1
# apply
Configuring Fast Uplink Convergence
Fast Uplink Convergence
# /cfg/l2/upfast ena
Rapid Spanning Tree Protocol/Multiple Spanning Tree Protocol
Port State Changes
Rapid Spanning Tree Protocol
Link Type
Rstp Configuration Guidelines
Port Type and Link Type
Edge Port
Configure STP Group 1 parameters
Rstp Configuration Example
Configure Rapid Spanning Tree
Set the Spanning Tree mode to Rapid Spanning Tree
Multiple Spanning Tree Protocol
Mstp Region
Common Internal Spanning Tree
Assign VLANs to Spanning Tree Groups
Mstp Configuration Guidelines
Mstp Configuration Example
Configure Multiple Spanning Tree Protocol
Quality of Service
ACL
Quality of Service
Summary of packet classifiers
Using ACL Filters
2Well-Known Application Ports
Understanding ACL Precedence
Summary of ACL Actions
Access Control Lists
Using ACL Groups
ACL Metering and Re-marking
Access Control Groups
Viewing ACL Statistics
Metering
Re-Marking
Add ACL 1 to port EXT1
ACL Configuration Examples
Configure an Access Control List
Example
Add ACL 3 to port EXT1
ACL 3# ipv4/sip 100.10.1.0
ACL 3# action deny
Using Dscp Values to Provide QoS
Differentiated Services Concepts
Per Hop Behavior
Dscp
QoS Levels
Default QoS Service Levels
Dscp Re-marking and Mapping
Main# cfg/port EXT1
Dscp Re-marking Configuration Example
Enable Dscp re-marking on a port
Main# cfg/qos/dscp/on
3Layer 2 802.1q/802.1p Vlan tagged packet
Using 802.1p Priorities to Provide QoS
Port EXT1# 8021ppri
802.1p Configuration Example
Configure a port’s default 802.1p priority
Queuing and Scheduling
Part 2 IP Routing
142 42C4911, January
Basic IP Routing
IP Routing Benefits
1The Router Legacy Network
Routing Between IP Subnets
2Switch-Based Routing Topology
Alteon OS Application Guide
1Subnet Routing Example IP Address Assignments
Example of Subnet Routing
# /cfg/l3/if
# addr
# ../if
Add the switch ports to their respective VLANs
Using VLANs to Segregate Broadcast Domains
# /info/vlan
Add each IP interface to the appropriate Vlan
Vlan 3# /cfg/l3/if
Vlan
Dynamic Host Configuration Protocol
Dhcp Relay Agent
Dhcp Relay Agent Configuration
Routing Information Protocol
Distance Vector Protocol
Stability
Routing Updates
RIPv1
RIPv2
Poison
RIPv2 in RIPv1 compatibility mode
RIP Features
Triggered updates
Metric
RIP Configuration Example
Default
Authentication
Turn on RIP globally and enable RIP for each interface
Add VLANs for routing interfaces
Add IP interfaces to VLANs
42C4911, January
Igmp
Igmp Snooping
View dynamic Igmp information
Igmp Snooping Configuration Example
Configure Igmp Snooping
Add VLANs to Igmp Snooping and enable the feature
Cfg/l3/igmp/mrouter
Configure a Static Multicast Router
Apply, verify, and save the configuration
Static Multicast Router
Igmp Relay
Configure the upstream Mrouters
Configure Igmp Relay
Configure an IP interface and assign VLANs
Enable Igmp Relay and add VLANs to the downstream network
Multicast Router Apply
Igmp Filtering
Additional Igmp Features
Configuring the Range
FastLeave
Define an Igmp filter
Configuring the Action
Configure Igmp Filtering
Enable Igmp Filtering on the switch
Filt ena
Assign the Igmp filter to a port
Border Gateway Protocol
1iBGP and eBGP
Internal Routing Versus External Routing
Forming BGP Peer Routers
# /cfg/l3/rmap
What is a Route Map?
Incoming and Outgoing Route Maps
2Distributing Network Filters in Access Lists and Route Maps
Configuration Overview
Precedence
Define network filter
Assign the route map to a peer router
Optional Configure the attributes in the AS filter menu
Set up the BGP attributes
Enable the route map
Aggregating Routes
Redistributing Routes
BGP Attributes
Local Preference Attribute
Metric Multi-Exit Discriminator Attribute
Selecting Route Paths in BGP
3BGP Failover Configuration Example
BGP Failover Configuration
Enable IP forwarding
Define the VLANs
Define the IP interfaces
On the switch, apply and save your configuration changes
Configure BGP peer router 1
# /cfg/l3/bgp
Default Redistribution and Route Aggregation Example
Configure internal peer router 1 and external peer router
Configure redistribution for Peer
Configure aggregation policy control
Ospf
Types of Ospf Areas
Ospf Overview
Nssa
2OSPF Domain and an Autonomous System
Types of Ospf Routing Devices
Link-State Database
Neighbors and Adjacencies
Internal Versus External Routing
Shortest Path First Tree
Ospf Implementation in Alteon OS
Configurable Parameters
Assigning the Area Index
Defining Areas
Attaching an Area to a Network
Using the Area ID to Assign the Ospf Area Number
Electing the Designated Router and Backup
Interface Cost
Summarizing Routes
# /cfg/l3/ospf/default metric value metric type 1 or
Default Routes
# /cfg/l3/ospf/aindex area index/type transit
Virtual Links
Router ID
Authentication
# /cfg/l3/ospf/if
Enable Ospf authentication for Area 0 on switches 1, 2,
Assign MD5 key ID to Ospf interfaces on switches 1, 2,
Enable Ospf authentication for Area 2 on switch
Enable Ospf MD5 authentication for Area 0 on switches 1, 2,
Configure MD5 key ID for Area 0 on switches 1, 2,
Host Routes for Load Balancing
Assign MD5 key ID to Ospf virtual link on switches 2
Ospf Features Not Supported in This Release
Ospf Configuration Examples
Configure IP interfaces
Optional Configure the router ID
# /cfg/l3/if # addr
Enable Ospf
# enable
Example 1 Simple Ospf Domain
Attach the network interface to the backbone
Apply and save the configuration changes
Define the backbone
Define the stub area
IP # /cfg/l3/ospf/on
Configuring Ospf for a Virtual Link on Switch #1
Configure the router ID
Example 2 Virtual Links
Configure the virtual link
Define the transit area
Attach the network interface to the transit area
# ../aindex
Configuring Ospf for a Virtual Link on Switch #2
Other Virtual Link Options
7Summarizing Routes
Example 3 Summarizing Routes
# ena
Verifying Ospf Configuration
36.128.192.0
36.128.200.0
Alteon OS Application Guide 214 Ospf
Part 3 High Availability Fundamentals
216 42C4911, January
High Availability
Vlan Monitor
Layer 2 Failover
Setting the Failover Limit
L2 Failover with Other Features
Spanning Tree Protocol
InternetI t t
L2 Failover Configurations
2Two trunks, each in a different Failover Trigger
3Two trunks, one Failover Trigger
Configuring Trunk Failover
Configure Failover parameters
# /cfg/failovr/on
Virtual Router MAC Address
Vrrp Overview
Vrrp Components
Virtual Router
Virtual Interface Router
Master and Backup Virtual Router
Selecting the Master Vrrp Router
Vrrp Operation
Failover Methods
4A Non-VRRP, Hot-Standby Configuration
5Active-Active Redundancy
Active-Active Redundancy
Virtual Router Group
Hot-Standby Redundancy
Tracking Vrrp Router Priority
Alteon OS extensions to Vrrp
Configuring the Switch for Tracking
Virtual Router Deployment Considerations
Assigning Vrrp Virtual Router ID
232 High Availability
Active-Active Configuration
High Availability Configurations
Configure client and server interfaces
Task 1 Configure GbESM
Turn on Vrrp and configure two Virtual Interface Routers
Configure ports
Turn off Spanning Tree Protocol globally
Task 2 Configure GbESM
Cfg/l3/vrrp/vr
Hot-Standby Configuration
8Hot-Standby Configuration
Enable Vrrp Hot Standby
Configure Virtual Interface Routers
Router Group# track/ports enaEnable tracking on ports
242 High Availability
Part 4 Appendices
244 42C4911, January
Troubleshooting
Figure A-1Monitoring Ports
Monitoring Ports
Layer 2 Port Mirroring
Port Mirroring behavior
248 Appendix a Troubleshooting
Layer 3 Port Mirroring Both Ports in Different GEAs
/info/geaport command
Select the ports that you want to mirror
Configuring Port Mirroring
Enable port mirroring
Specify the monitoring port
PortMirroring # cur
View the current configuration
Radius Server Configuration Notes
@alteon.dct
Translation
Glossary
Vrid Virtual Router
Numerics
Index
Icmp
188
Snmp