Application Guide
 Alteon OS Application Guide
 Contents
 Port-based Network Access Control
 Rapid Spanning Tree Protocol/Multiple Spanning Tree Protocol
 Part 2 IP Routing
 Border Gateway Protocol
 Part 3 High Availability Fundamentals
 Part 4 Appendices
 Alteon OS Application Guide
 Figures
 3Two trunks, one Failover Trigger
 Tables
 Alteon OS Application Guide
 Preface
Who Should Use This Guide
 Part 1 Basic Switching
What You’ll Find in This Guide
 Part 3 High Availability Fundamentals
 Typographic Conventions
AaBbCc123
 How to Get Help
 Alteon OS Application Guide 20  Preface
 Part 1 Basic Switching
 Alteon OS Application Guide
 Accessing the Switch
 Management module setup
Factory-Default vs. MM assigned IP Addresses
 Default Gateway
Configuring management module for switch access
 1Switch management on the BladeCenter management module
 Alteon OS Application Guide
 Configuring the external management interface
External management port setup
Enable port EXT7
 Bootp Relay Agent
Using Telnet
Connect to the Switch via SSH
Telnet switch IP address -m-mgt-e-ext7-d-data
 # /cfg/l3/bootp
Configuring the Bootp Relay Agent
# /cfg/l3/if interface number/relay ena
 Dhcp Relay Agent Configuration
Dhcp Relay Agent
 32  Accessing the Switch
 Configuring BBI Access via Http
Using the Browser-Based Interface
Configuring BBI Access via Https
 Cfg/sys/access/https/generate
 TACACS+  Ldap  NTP
  FDB
 Cfg/sys/ssnmp/rcomm Cfg/sys/ssnmp/wcomm
Using Snmp
Snmp
Cfg/sys/ssnmp/trsrc
 Default configuration
User Configuration
 View based Configurations
CLI User equivalent
 Configure a user with no authentication and password
Configuring Snmp Trap Hosts
SNMPv1 trap host
 Configure an entry in the notify table
Sys/ssnmp/snmpv3/tparam x/uname
 SNMPv2 trap host configuration
SNMPv3 trap host configuration
 42  Accessing the Switch
 Securing Access to the Switch
 How Radius Authentication Works
Radius Authentication and Authorization
Configuring Radius on the Switch
 Prisrv
Configure the Radius secret
Main# /cfg/sys/radius
Secsrv
 Radius Authentication Features in Alteon OS
 Switch User Accounts
Radius Attributes for Alteon OS User Privileges
 How TACACS+ Authentication Works
TACACS+ Authentication
TACACS+ Authentication Features in Alteon OS
 Authorization
4Default TACACS+ Authorization Levels
 Command Authorization and Logging
Accounting
 Cfg/sys/tacacs/chpassp
Cfg/sys/tacacs/chpasss
 Apply and save the configuration
Configuring TACACS+ Authentication on the Switch
Configure the TACACS+ secret and second secret
Main# /cfg/sys/tacacs+
 Ldap Authentication and Authorization
Configuring the Ldap Server
 Configure the domain name
Configuring Ldap Authentication on the Switch
Main# /cfg/sys/ldap
 Secure Shell and Secure Copy
 # /cfg/sys/sshd/off
Configuring SSH/SCP features on the switch
# /cfg/sys/sshd/on
# /cfg/sys/sshd/dis
 Ssh 205.178.15.157 Login-name
Configuring the SCP Administrator Password
Using SSH and SCP Client Commands
# scp scpadmin@205.178.15.157getcfg ad4.cfg
 # scp ad4.cfg scpadmin@205.178.15.157putcfg
To apply and save the configuration
SSH and SCP Encryption of Management Messages
 Cfg/sys/sshd/hkeygen
Generating RSA Host and Server Keys for SSH Access
Cfg/sys/sshd/skeygen
 SSH/SCP Integration with Radius Authentication
SSH/SCP Integration with TACACS+ Authentication
 End User Access Control
Considerations for Configuring End User Accounts
 # /cfg/sys/access/user
Strong Passwords
User Access Control Menu
# /cfg/sys/access/user/uid
 Passwd
Name user1
# cur
 Listing Current Users
# /cfg/sys/access/user/cur
Logging into an End User Account
 Alteon OS Application Guide 42C4911, January
 Alteon OS Application Guide 66  Accessing the Switch
 Port-based Network Access Control
 Extensible Authentication Protocol over LAN
 802.1x Authentication Process
Port Unauthorized
 EAPoL Message Exchange
  Authorized
802.1x Port States
 Unauthorized
 Force Unauthorized
 Supported Radius Attributes
Support for Radius Attributes
 Configuration Guidelines
 42C4911, January
 VLANs
 Overview
 Pvid Numbers
VLANs and Port Vlan ID Numbers
Vlan Numbers
Viewing VLANs
 Viewing and Configuring PVIDs
Cfg/port INT7/pvid
 Alteon OS Application Guide
 Vlan Tagging
 1Default Vlan settings
 2Port-based Vlan assignment
 4802.1Q tag assignment
 Vlan configuration rules
Vlan Topologies and Design Considerations
 Example 1 Multiple VLANs with Tagging Adapters
Component Description
 86  VLANs
 Protocol-based VLANs
 Pvlan Priority Levels
Port-based vs. Protocol-based VLANs
Pvlan Tagging
 Configure the priority value for the protocol
Pvlan Configuration Guidelines
Configuring Pvlan
Cfg/l2/vlan
 Enable the Pvlan
Configure Vlan tagging for ports
Add member ports for this Pvlan
 Verify Pvlan operation
Info/l2/vlan
 Alteon OS Application Guide 92  VLANs
 Ports and Trunking
 1Port Trunk Group
 Before you configure static trunks
Built-In Fault Tolerance
Statistical Load Distribution
 Trunk group configuration rules
 Example below, three ports are trunked between two switches
Port Trunking Example
 Repeat the process on the other switch
 Examine the trunking information on each switch
Info/l2/trunk
 Configurable Trunk Hash Algorithm
 Admin key
Link Aggregation Control Protocol
 102  Ports and Trunking
 Configuring Lacp
 Alteon OS Application Guide 104  Ports and Trunking
 Spanning Tree Group
 1Ports, Trunk Groups, and VLANs
 Bridge Priority
Bridge Protocol Data Units BPDUs
Determining the Path for Forwarding BPDUs
Port Priority
 Adding a Vlan to a Spanning Tree Group
Spanning Tree Group configuration guidelines
Port Path Cost
Creating a Vlan
 Rules for Vlan Tagged ports
Adding and removing ports from STGs
 Default Spanning Tree configuration
Multiple Spanning Trees
 Why Do We Need Multiple Spanning Trees?
Switch-Centric Spanning Tree Group
 Vlan Participation in Spanning Tree Groups
2Implementing Multiple Spanning Tree Groups
 Configure the following on GbE Switch Module B
Configuring Multiple Spanning Tree Groups
Configure the following on application switch a
# /cfg/l2/vlan2
 Configure the following on application switch C
# /cfg/l2/vlan3
 # /cfg/port ext1
Configuring Port Fast Forwarding
Port Fast Forwarding
Fastfwd ena
 # /cfg/l2/upfast ena
Configuring Fast Uplink Convergence
Fast Uplink Convergence
# apply
 Rapid Spanning Tree Protocol/Multiple Spanning Tree Protocol
 Rapid Spanning Tree Protocol
Port State Changes
 Edge Port
Rstp Configuration Guidelines
Port Type and Link Type
Link Type
 Set the Spanning Tree mode to Rapid Spanning Tree
Rstp Configuration Example
Configure Rapid Spanning Tree
Configure STP Group 1 parameters
 Mstp Region
Multiple Spanning Tree Protocol
Common Internal Spanning Tree
 Configure Multiple Spanning Tree Protocol
Mstp Configuration Guidelines
Mstp Configuration Example
Assign VLANs to Spanning Tree Groups
 Quality of Service
 ACL
 Quality of Service 
 Using ACL Filters
Summary of packet classifiers
 2Well-Known Application Ports
 Summary of ACL Actions
Understanding ACL Precedence
 Using ACL Groups
 Access Control Lists
  Access Control Groups
ACL Metering and Re-marking
 Metering
Viewing ACL Statistics
Re-Marking
 Example
ACL Configuration Examples
Configure an Access Control List
Add ACL 1 to port EXT1
 ACL 3# ipv4/sip 100.10.1.0
Add ACL 3 to port EXT1
ACL 3# action deny
 Differentiated Services Concepts
Using Dscp Values to Provide QoS
Per Hop Behavior
 Dscp
 Default QoS Service Levels
QoS Levels
 Dscp Re-marking and Mapping
 Main# cfg/qos/dscp/on
Dscp Re-marking Configuration Example
Enable Dscp re-marking on a port
Main# cfg/port EXT1
 Using 802.1p Priorities to Provide QoS
3Layer 2 802.1q/802.1p Vlan tagged packet
 Queuing and Scheduling
802.1p Configuration Example
Configure a port’s default 802.1p priority
Port EXT1# 8021ppri
 Part 2 IP Routing
 142 42C4911, January
 Basic IP Routing
 IP Routing Benefits
 Routing Between IP Subnets
1The Router Legacy Network
 2Switch-Based Routing Topology
 Alteon OS Application Guide
 Example of Subnet Routing
1Subnet Routing Example IP Address Assignments
 # addr
# /cfg/l3/if
# ../if
 Using VLANs to Segregate Broadcast Domains
Add the switch ports to their respective VLANs
 Vlan
Add each IP interface to the appropriate Vlan
Vlan 3# /cfg/l3/if
# /info/vlan
 Dynamic Host Configuration Protocol
 Dhcp Relay Agent
 Dhcp Relay Agent Configuration
 Distance Vector Protocol
Routing Information Protocol
Stability
 RIPv1
Routing Updates
RIPv2
 Triggered updates
RIPv2 in RIPv1 compatibility mode
RIP Features
Poison
 Authentication
RIP Configuration Example
Default
Metric
 Add VLANs for routing interfaces
Turn on RIP globally and enable RIP for each interface
Add IP interfaces to VLANs
 42C4911, January
 Igmp
 Igmp Snooping
 Add VLANs to Igmp Snooping and enable the feature
Igmp Snooping Configuration Example
Configure Igmp Snooping
View dynamic Igmp information
 Static Multicast Router
Configure a Static Multicast Router
Apply, verify, and save the configuration
Cfg/l3/igmp/mrouter
 Igmp Relay
 Enable Igmp Relay and add VLANs to the downstream network
Configure Igmp Relay
Configure an IP interface and assign VLANs
Configure the upstream Mrouters
 Multicast Router Apply
 FastLeave
Additional Igmp Features
Configuring the Range
Igmp Filtering
 Enable Igmp Filtering on the switch
Configuring the Action
Configure Igmp Filtering
Define an Igmp filter
 Assign the Igmp filter to a port
Filt ena
 Border Gateway Protocol
 Internal Routing Versus External Routing
1iBGP and eBGP
 Forming BGP Peer Routers
 What is a Route Map?
# /cfg/l3/rmap
 2Distributing Network Filters in Access Lists and Route Maps
Incoming and Outgoing Route Maps
 Precedence
Configuration Overview
Define network filter
 Enable the route map
Optional Configure the attributes in the AS filter menu
Set up the BGP attributes
Assign the route map to a peer router
 Aggregating Routes
 Redistributing Routes
 Local Preference Attribute
BGP Attributes
Metric Multi-Exit Discriminator Attribute
 Selecting Route Paths in BGP
 BGP Failover Configuration
3BGP Failover Configuration Example
 Define the VLANs
Enable IP forwarding
Define the IP interfaces
 Configure BGP peer router 1
On the switch, apply and save your configuration changes
 Default Redistribution and Route Aggregation Example
# /cfg/l3/bgp
 Configure redistribution for Peer
Configure internal peer router 1 and external peer router
Configure aggregation policy control
 Ospf
 Ospf Overview
Types of Ospf Areas
 Nssa
 Types of Ospf Routing Devices
2OSPF Domain and an Autonomous System
 Neighbors and Adjacencies
Link-State Database
 Shortest Path First Tree
Internal Versus External Routing
 Configurable Parameters
Ospf Implementation in Alteon OS
 Defining Areas
Assigning the Area Index
 Using the Area ID to Assign the Ospf Area Number
Attaching an Area to a Network
 Interface Cost
Electing the Designated Router and Backup
Summarizing Routes
 Default Routes
# /cfg/l3/ospf/default metric value metric type 1 or
 Virtual Links
# /cfg/l3/ospf/aindex area index/type transit
 Authentication
Router ID
 Enable Ospf authentication for Area 0 on switches 1, 2,
# /cfg/l3/ospf/if
 Configure MD5 key ID for Area 0 on switches 1, 2,
Enable Ospf authentication for Area 2 on switch
Enable Ospf MD5 authentication for Area 0 on switches 1, 2,
Assign MD5 key ID to Ospf interfaces on switches 1, 2,
 Assign MD5 key ID to Ospf virtual link on switches 2
Host Routes for Load Balancing
 Ospf Features Not Supported in This Release
 Configure IP interfaces
Ospf Configuration Examples
Optional Configure the router ID
 Example 1 Simple Ospf Domain
Enable Ospf
# enable
# /cfg/l3/if # addr
 Define the stub area
Apply and save the configuration changes
Define the backbone
Attach the network interface to the backbone
 Example 2 Virtual Links
Configuring Ospf for a Virtual Link on Switch #1
Configure the router ID
IP # /cfg/l3/ospf/on
 Define the transit area
Configure the virtual link
Attach the network interface to the transit area
 Configuring Ospf for a Virtual Link on Switch #2
# ../aindex
 Other Virtual Link Options
 Example 3 Summarizing Routes
7Summarizing Routes
 # ena
 36.128.192.0
Verifying Ospf Configuration
36.128.200.0
 Alteon OS Application Guide 214  Ospf
 Part 3 High Availability Fundamentals
 216 42C4911, January
 High Availability
 Layer 2 Failover
Vlan Monitor
 L2 Failover with Other Features
Setting the Failover Limit
Spanning Tree Protocol
 L2 Failover Configurations
InternetI t t
 2Two trunks, each in a different Failover Trigger
 3Two trunks, one Failover Trigger
 Configure Failover parameters
Configuring Trunk Failover
# /cfg/failovr/on
 Virtual Router
Vrrp Overview
Vrrp Components
Virtual Router MAC Address
 Master and Backup Virtual Router
Virtual Interface Router
 Vrrp Operation
Selecting the Master Vrrp Router
 4A Non-VRRP, Hot-Standby Configuration
Failover Methods
 Active-Active Redundancy
5Active-Active Redundancy
 Hot-Standby Redundancy
Virtual Router Group
 Alteon OS extensions to Vrrp
Tracking Vrrp Router Priority
 Virtual Router Deployment Considerations
Configuring the Switch for Tracking
Assigning Vrrp Virtual Router ID
 232  High Availability
 High Availability Configurations
Active-Active Configuration
 Task 1 Configure GbESM
Configure client and server interfaces
 Configure ports
Turn on Vrrp and configure two Virtual Interface Routers
Turn off Spanning Tree Protocol globally
 Task 2 Configure GbESM
 Cfg/l3/vrrp/vr
 Hot-Standby Configuration
 8Hot-Standby Configuration
 Configure Virtual Interface Routers
Enable Vrrp Hot Standby
 Router Group# track/ports enaEnable tracking on ports
 242  High Availability
 Part 4 Appendices
 244 42C4911, January
 Troubleshooting
 Monitoring Ports
Figure A-1Monitoring Ports
 Port Mirroring behavior
Layer 2 Port Mirroring
 248  Appendix a Troubleshooting
 Layer 3 Port Mirroring Both Ports in Different GEAs
 /info/geaport command
 Specify the monitoring port
Configuring Port Mirroring
Enable port mirroring
Select the ports that you want to mirror
 View the current configuration
PortMirroring # cur
 Radius Server Configuration Notes
  @alteon.dct
 Glossary
Translation
 Vrid Virtual Router
 Index
Numerics
 Icmp
 188
 Snmp