Manuals / Nortel Networks / Computer Equipment / Switch

Nortel Networks 42C4911 manual Alteon OS Application Guide 92 „ VLANs

Models: 42C4911

1 260

Download 260 pages 54.2 Kb

Page 92

Alteon OS Application Guide

92 Chapter 3: VLANs

42C4911, January 2007

Image 92

Nortel Networks 42C4911 manual Alteon OS Application Guide 92 „ VLANs

Contents

Application Guide Alteon OS Application Guide Contents Port-based Network Access Control Rapid Spanning Tree Protocol/Multiple Spanning Tree Protocol Part 2 IP Routing Border Gateway Protocol Part 3 High Availability Fundamentals Part 4 Appendices Alteon OS Application Guide Figures 3Two trunks, one Failover Trigger Tables Alteon OS Application Guide Preface Who Should Use This GuidePart 1 Basic Switching What You’ll Find in This GuidePart 3 High Availability Fundamentals Typographic Conventions AaBbCc123How to Get Help Alteon OS Application Guide 20 „ Preface Part 1 Basic Switching Alteon OS Application Guide Accessing the Switch Management module setup Factory-Default vs. MM assigned IP AddressesDefault Gateway Configuring management module for switch access1Switch management on the BladeCenter management module Alteon OS Application Guide Enable port EXT7 External management port setupConfiguring the external management interface Using Telnet Connect to the Switch via SSHBootp Relay Agent Telnet switch IP address -m-mgt-e-ext7-d-data# /cfg/l3/if interface number/relay ena Configuring the Bootp Relay Agent# /cfg/l3/bootp Dhcp Relay Agent Configuration Dhcp Relay Agent32 „ Accessing the Switch Configuring BBI Access via Https Using the Browser-Based InterfaceConfiguring BBI Access via Http Cfg/sys/access/https/generate † TACACS+ † Ldap † NTP† FDB Using Snmp SnmpCfg/sys/ssnmp/rcomm Cfg/sys/ssnmp/wcomm Cfg/sys/ssnmp/trsrcDefault configuration User ConfigurationView based Configurations CLI User equivalentSNMPv1 trap host Configuring Snmp Trap HostsConfigure a user with no authentication and password Configure an entry in the notify table Sys/ssnmp/snmpv3/tparam x/unameSNMPv2 trap host configuration SNMPv3 trap host configuration42 „ Accessing the Switch Securing Access to the Switch Configuring Radius on the Switch Radius Authentication and AuthorizationHow Radius Authentication Works Configure the Radius secret Main# /cfg/sys/radiusPrisrv SecsrvRadius Authentication Features in Alteon OS Switch User Accounts Radius Attributes for Alteon OS User PrivilegesTACACS+ Authentication Features in Alteon OS TACACS+ AuthenticationHow TACACS+ Authentication Works Authorization 4Default TACACS+ Authorization LevelsCommand Authorization and Logging AccountingCfg/sys/tacacs/chpassp Cfg/sys/tacacs/chpasssConfiguring TACACS+ Authentication on the Switch Configure the TACACS+ secret and second secretApply and save the configuration Main# /cfg/sys/tacacs+Ldap Authentication and Authorization Configuring the Ldap ServerMain# /cfg/sys/ldap Configuring Ldap Authentication on the SwitchConfigure the domain name Secure Shell and Secure Copy Configuring SSH/SCP features on the switch # /cfg/sys/sshd/on# /cfg/sys/sshd/off # /cfg/sys/sshd/disConfiguring the SCP Administrator Password Using SSH and SCP Client CommandsSsh 205.178.15.157 Login-name # scp scpadmin@205.178.15.157getcfg ad4.cfgSSH and SCP Encryption of Management Messages To apply and save the configuration# scp ad4.cfg scpadmin@205.178.15.157putcfg Cfg/sys/sshd/skeygen Generating RSA Host and Server Keys for SSH AccessCfg/sys/sshd/hkeygen SSH/SCP Integration with Radius Authentication SSH/SCP Integration with TACACS+ AuthenticationEnd User Access Control Considerations for Configuring End User AccountsStrong Passwords User Access Control Menu# /cfg/sys/access/user # /cfg/sys/access/user/uid# cur Name user1Passwd Logging into an End User Account # /cfg/sys/access/user/curListing Current Users Alteon OS Application Guide 42C4911, January Alteon OS Application Guide 66 „ Accessing the Switch Port-based Network Access Control Extensible Authentication Protocol over LAN 802.1x Authentication Process Port UnauthorizedEAPoL Message Exchange 802.1x Port States „ Unauthorized„ Authorized „ Force UnauthorizedSupported Radius Attributes Support for Radius AttributesConfiguration Guidelines 42C4911, January VLANs Overview VLANs and Port Vlan ID Numbers Vlan NumbersPvid Numbers Viewing VLANsViewing and Configuring PVIDs Cfg/port INT7/pvidAlteon OS Application Guide Vlan Tagging 1Default Vlan settings 2Port-based Vlan assignment 4802.1Q tag assignment Vlan configuration rules Vlan Topologies and Design ConsiderationsExample 1 Multiple VLANs with Tagging Adapters Component Description86 „ VLANs Protocol-based VLANs Pvlan Tagging Port-based vs. Protocol-based VLANsPvlan Priority Levels Pvlan Configuration Guidelines Configuring PvlanConfigure the priority value for the protocol Cfg/l2/vlanAdd member ports for this Pvlan Configure Vlan tagging for portsEnable the Pvlan Verify Pvlan operation Info/l2/vlanAlteon OS Application Guide 92 „ VLANs Ports and Trunking 1Port Trunk Group Statistical Load Distribution Built-In Fault ToleranceBefore you configure static trunks Trunk group configuration rules Example below, three ports are trunked between two switches Port Trunking ExampleRepeat the process on the other switch Examine the trunking information on each switch Info/l2/trunkConfigurable Trunk Hash Algorithm Admin key Link Aggregation Control Protocol102 „ Ports and Trunking Configuring Lacp Alteon OS Application Guide 104 „ Ports and Trunking Spanning Tree Group 1Ports, Trunk Groups, and VLANs Bridge Protocol Data Units BPDUs Determining the Path for Forwarding BPDUsBridge Priority Port PrioritySpanning Tree Group configuration guidelines Port Path CostAdding a Vlan to a Spanning Tree Group Creating a VlanRules for Vlan Tagged ports Adding and removing ports from STGsDefault Spanning Tree configuration Multiple Spanning TreesWhy Do We Need Multiple Spanning Trees? Switch-Centric Spanning Tree GroupVlan Participation in Spanning Tree Groups 2Implementing Multiple Spanning Tree GroupsConfiguring Multiple Spanning Tree Groups Configure the following on application switch aConfigure the following on GbE Switch Module B # /cfg/l2/vlan2Configure the following on application switch C # /cfg/l2/vlan3Configuring Port Fast Forwarding Port Fast Forwarding# /cfg/port ext1 Fastfwd enaConfiguring Fast Uplink Convergence Fast Uplink Convergence# /cfg/l2/upfast ena # applyRapid Spanning Tree Protocol/Multiple Spanning Tree Protocol Rapid Spanning Tree Protocol Port State ChangesRstp Configuration Guidelines Port Type and Link TypeEdge Port Link TypeRstp Configuration Example Configure Rapid Spanning TreeSet the Spanning Tree mode to Rapid Spanning Tree Configure STP Group 1 parametersCommon Internal Spanning Tree Multiple Spanning Tree ProtocolMstp Region Mstp Configuration Guidelines Mstp Configuration ExampleConfigure Multiple Spanning Tree Protocol Assign VLANs to Spanning Tree GroupsQuality of Service ACL Quality of Service „ Using ACL Filters Summary of packet classifiers2Well-Known Application Ports Summary of ACL Actions Understanding ACL PrecedenceUsing ACL Groups „ Access Control Lists„ Access Control Groups ACL Metering and Re-markingRe-Marking Viewing ACL StatisticsMetering ACL Configuration Examples Configure an Access Control ListExample Add ACL 1 to port EXT1ACL 3# action deny Add ACL 3 to port EXT1ACL 3# ipv4/sip 100.10.1.0 Per Hop Behavior Using Dscp Values to Provide QoSDifferentiated Services Concepts Dscp Default QoS Service Levels QoS LevelsDscp Re-marking and Mapping Dscp Re-marking Configuration Example Enable Dscp re-marking on a portMain# cfg/qos/dscp/on Main# cfg/port EXT1Using 802.1p Priorities to Provide QoS 3Layer 2 802.1q/802.1p Vlan tagged packet802.1p Configuration Example Configure a port’s default 802.1p priorityQueuing and Scheduling Port EXT1# 8021ppriPart 2 IP Routing 142 42C4911, January Basic IP Routing IP Routing Benefits Routing Between IP Subnets 1The Router Legacy Network2Switch-Based Routing Topology Alteon OS Application Guide Example of Subnet Routing 1Subnet Routing Example IP Address Assignments# ../if # /cfg/l3/if# addr Using VLANs to Segregate Broadcast Domains Add the switch ports to their respective VLANsAdd each IP interface to the appropriate Vlan Vlan 3# /cfg/l3/ifVlan # /info/vlanDynamic Host Configuration Protocol Dhcp Relay Agent Dhcp Relay Agent Configuration # /cfg/l3/bootpStability Routing Information ProtocolDistance Vector Protocol RIPv2 Routing UpdatesRIPv1 RIPv2 in RIPv1 compatibility mode RIP FeaturesTriggered updates PoisonRIP Configuration Example DefaultAuthentication MetricAdd IP interfaces to VLANs Turn on RIP globally and enable RIP for each interfaceAdd VLANs for routing interfaces 42C4911, January Igmp Igmp Snooping Igmp Snooping Configuration Example Configure Igmp SnoopingAdd VLANs to Igmp Snooping and enable the feature View dynamic Igmp informationConfigure a Static Multicast Router Apply, verify, and save the configurationStatic Multicast Router Cfg/l3/igmp/mrouterConfiguration Guidelines Igmp RelayConfigure Igmp Relay Configure an IP interface and assign VLANsEnable Igmp Relay and add VLANs to the downstream network Configure the upstream MroutersMulticast Router Apply Additional Igmp Features Configuring the RangeFastLeave Igmp FilteringConfiguring the Action Configure Igmp FilteringEnable Igmp Filtering on the switch Define an Igmp filterAssign the Igmp filter to a port Filt enaBorder Gateway Protocol Internal Routing Versus External Routing 1iBGP and eBGPForming BGP Peer Routers What is a Route Map? # /cfg/l3/rmap2Distributing Network Filters in Access Lists and Route Maps Incoming and Outgoing Route MapsDefine network filter Configuration OverviewPrecedence Optional Configure the attributes in the AS filter menu Set up the BGP attributesEnable the route map Assign the route map to a peer routerAggregating Routes Redistributing Routes Metric Multi-Exit Discriminator Attribute BGP AttributesLocal Preference Attribute Selecting Route Paths in BGP BGP Failover Configuration 3BGP Failover Configuration ExampleDefine the IP interfaces Enable IP forwardingDefine the VLANs Configure BGP peer router 1 On the switch, apply and save your configuration changesDefault Redistribution and Route Aggregation Example # /cfg/l3/bgpConfigure aggregation policy control Configure internal peer router 1 and external peer routerConfigure redistribution for Peer Ospf Ospf Overview Types of Ospf AreasNssa Types of Ospf Routing Devices 2OSPF Domain and an Autonomous SystemNeighbors and Adjacencies Link-State DatabaseShortest Path First Tree Internal Versus External RoutingConfigurable Parameters Ospf Implementation in Alteon OSDefining Areas Assigning the Area IndexUsing the Area ID to Assign the Ospf Area Number Attaching an Area to a NetworkSummarizing Routes Electing the Designated Router and BackupInterface Cost Default Routes # /cfg/l3/ospf/default metric value metric type 1 orVirtual Links # /cfg/l3/ospf/aindex area index/type transitAuthentication Router IDEnable Ospf authentication for Area 0 on switches 1, 2, # /cfg/l3/ospf/ifEnable Ospf authentication for Area 2 on switch Enable Ospf MD5 authentication for Area 0 on switches 1, 2,Configure MD5 key ID for Area 0 on switches 1, 2, Assign MD5 key ID to Ospf interfaces on switches 1, 2,Assign MD5 key ID to Ospf virtual link on switches 2 Host Routes for Load BalancingOspf Features Not Supported in This Release Optional Configure the router ID Ospf Configuration ExamplesConfigure IP interfaces Enable Ospf # enableExample 1 Simple Ospf Domain # /cfg/l3/if # addrApply and save the configuration changes Define the backboneDefine the stub area Attach the network interface to the backboneConfiguring Ospf for a Virtual Link on Switch #1 Configure the router IDExample 2 Virtual Links IP # /cfg/l3/ospf/onAttach the network interface to the transit area Configure the virtual linkDefine the transit area Configuring Ospf for a Virtual Link on Switch #2 # ../aindexOther Virtual Link Options Define the stub areaExample 3 Summarizing Routes 7Summarizing Routes# /cfg/l3/if # addr # ena36.128.200.0 Verifying Ospf Configuration36.128.192.0 Alteon OS Application Guide 214 „ Ospf Part 3 High Availability Fundamentals 216 42C4911, January High Availability Layer 2 Failover Vlan MonitorSpanning Tree Protocol Setting the Failover LimitL2 Failover with Other Features L2 Failover Configurations InternetI t t2Two trunks, each in a different Failover Trigger 3Two trunks, one Failover Trigger # /cfg/failovr/on Configuring Trunk FailoverConfigure Failover parameters Vrrp Overview Vrrp ComponentsVirtual Router Virtual Router MAC AddressMaster and Backup Virtual Router Virtual Interface RouterVrrp Operation Selecting the Master Vrrp Router4A Non-VRRP, Hot-Standby Configuration Failover MethodsActive-Active Redundancy 5Active-Active RedundancyHot-Standby Redundancy Virtual Router GroupAlteon OS extensions to Vrrp Tracking Vrrp Router PriorityAssigning Vrrp Virtual Router ID Configuring the Switch for TrackingVirtual Router Deployment Considerations 232 „ High Availability High Availability Configurations Active-Active ConfigurationTask 1 Configure GbESM Configure client and server interfacesTurn off Spanning Tree Protocol globally Turn on Vrrp and configure two Virtual Interface RoutersConfigure ports Task 2 Configure GbESM Cfg/l3/vrrp/vr Hot-Standby Configuration 8Hot-Standby Configuration Configure Virtual Interface Routers Enable Vrrp Hot StandbyRouter Group# track/ports enaEnable tracking on ports 242 „ High Availability Part 4 Appendices 244 42C4911, January Troubleshooting Monitoring Ports Figure A-1Monitoring PortsPort Mirroring behavior Layer 2 Port Mirroring248 „ Appendix a Troubleshooting Layer 3 Port Mirroring Both Ports in Different GEAs /info/geaport command Configuring Port Mirroring Enable port mirroringSpecify the monitoring port Select the ports that you want to mirrorView the current configuration PortMirroring # curRadius Server Configuration Notes „ @alteon.dct Glossary TranslationVrid Virtual Router Index NumericsIcmp 188 Snmp