GS716T and GS724T Smart Switches Software Administration Manual 350 East Plumeria Drive San Jose, CA 95134 USA February 2012 202-10484-04 v1.
GS716Tv2 and GS724Tv3 Software Administration Manual ©2012 NETGEAR, Inc. All rights reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of NETGEAR, Inc. Technical Support Thank you for choosing NETGEAR. To register your product, get the latest product updates, or get support online, visit us at http://support.netgear.com.
Table of Contents Chapter 1 Getting Started Getting Started with the GS716T and GS724T Gigabit Smart Switches . . Switch Management Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Connecting the Switch to the Network. . . . . . . . . . . . . . . . . . . . . . . . . . . . Switch Discovery in a Network with a DHCP Server . . . . . . . . . . . . . . . . . Switch Discovery in a Network without a DHCP Server . . . . . . . . . . . . . .
GS716Tv2 and GS724Tv3 Software Administration Manual Services — DHCP Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .65 DHCP Filtering Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .65 Interface Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .66 Chapter 3 Configuring Switching Information Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
GS716Tv2 and GS724Tv3 Software Administration Manual DSCP to Queue Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Differentiated Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Defining DiffServ. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Diffserv Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Class Configuration . . . . . . . . . . . . . .
GS716Tv2 and GS724Tv3 Software Administration Manual Chapter 6 Monitoring the System Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .200 Switch Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .201 Port Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .203 Port Detailed Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
GS716Tv2 and GS724Tv3 Software Administration Manual Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246 System Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247 Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247 Other Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
GS716Tv2 and GS724Tv3 Software Administration Manual 8 | Table of Contents
1. 1 Getting Started The NETGEAR® GS716T and GS724T Smart Switch Software Administration Manual describes how to configure and operate the GS716T and GS724T Gigabit Smart Switches by using the Web-based graphical user interface (GUI). This manual describes the software configuration procedures and explains the options available within those procedures.
GS716Tv2 and GS724Tv3 Software Administration Manual Getting Started with the GS716T and GS724T Gigabit Smart Switches This chapter provides an overview of starting your NETGEAR GS716T or GS724T Smart Switch and accessing the user interface. It also leads you through the steps to use the Smart Control Center utility.
GS716Tv2 and GS724Tv3 Software Administration Manual Switch Management Interface The NETGEAR GS716T and GS724T Smart Switches contain embedded Web server and management software for managing and monitoring switch functions. The switches function as a simple switch without the management software. However, you can use the management software to configure more advanced features that can improve switch efficiency and overall network performance.
GS716Tv2 and GS724Tv3 Software Administration Manual Connecting the Switch to the Network To enable remote management of the switch through a Web browser or SNMP, you must connect the switch to the network and configure it with network information (an IP address, subnet mask, and default gateway). The switch has a default IP address of 192.168.0.239 and a default subnet mask of 255.255.255.0.
GS716Tv2 and GS724Tv3 Software Administration Manual Switch Discovery in a Network with a DHCP Server This section describes how to set up your switch in a network that has a DHCP server. The DHCP client on the switch is enabled by default. When you connect it to your network, the DHCP server will automatically assign an IP address to your switch. Use the Smart Control Center to discover the IP address automatically assigned to the switch.
GS716Tv2 and GS724Tv3 Software Administration Manual Use your Web browser to manage your switch. The default password is password. Then use this page to proceed to management of the switch covered in Using the Web Interface on page 24.
GS716Tv2 and GS724Tv3 Software Administration Manual Switch Discovery in a Network without a DHCP Server This section describes how to use the Smart Control Center to set up your switch in a network without a DHCP server. If your network has no DHCP service, you must assign a static IP address to your switch. If you choose, you can assign it a static IP address, even if your network has DHCP service. To assign a static IP address: 1. Connect the switch to your existing network. 2.
GS716Tv2 and GS724Tv3 Software Administration Manual 9. Click Apply to configure the switch with the network settings. Please ensure that your PC and the switch are in the same subnet. Make a note of these settings for later use. Configuring the Network Settings on the Administrative System If you choose not to use the Smart Control Center to configure the network information on the switch, you can connect directly to the switch from an administrative system, such as a PC or laptop computer.
GS716Tv2 and GS724Tv3 Software Administration Manual To modify the network settings on your administrative system: 1. On your PC, access the MS Windows operating system TCP/IP Properties. 2. Set the IP address of the administrative system to an address in the 192.168.0.0 network, such as 192.168.0.200. The IP address must be different from that of the switch but within the same subnet. 3. Click OK. To configure a static address on the switch: 1.
GS716Tv2 and GS724Tv3 Software Administration Manual Web Access To access the GS716T or GS724T management interface, use one of the following methods: • From the Smart Control Center, select the switch and click Web Browser Access. • Open a Web browser and enter the IP address of the switch in the address field. You must be able to ping the IP address of the GS716T or GS724T management interface from your administrative system for Web access to be available.
GS716Tv2 and GS724Tv3 Software Administration Manual Smart Control Center Utilities In addition to device discovery and network address assignment, the Smart Control Center includes several maintenance features.
GS716Tv2 and GS724Tv3 Software Administration Manual 4. Click OK. 5. Enter the switch password and click Apply. The file is uploaded to the administrative computer as a *.cfg file. You can open it and view the contents with a text editor. To restore the configuration to a previously saved version: 1. Click the Maintenance tab and select the device with the configuration to restore. 2. Click Download Configuration. 3.
GS716Tv2 and GS724Tv3 Software Administration Manual Firmware Upgrade The application software for the GS716T and GS724T Smart Switches is upgradeable, enabling your switch to take advantage of improvements and additional features as they become available. The upgrade procedure and the required equipment are described in this section. This procedure assumes that you have downloaded or otherwise obtained the firmware upgrade and that you have it available as a binary file on your computer.
GS716Tv2 and GS724Tv3 Software Administration Manual 7. When the process is complete, the switch automatically reboots. Note: Click the Tasks tab to view status information about the firmware upgrade. WARNING! It is important that you do not power-off the administrative system or the switch while the firmware upgrade is in progress.
GS716Tv2 and GS724Tv3 Software Administration Manual Viewing and Managing Tasks From the Tasks tab, you can view information about configuration downloads and firmware upgrades that have already occurred, are in progress, or are scheduled to take place at a later time. You can also delete or reschedule selected tasks. The following figure shows the Tasks page.
GS716Tv2 and GS724Tv3 Software Administration Manual Understanding the User Interfaces The switch software includes a set of comprehensive management functions for configuring and monitoring the system by using one of the following methods: • Web user interface • Simple Network Management Protocol (SNMP) Each of the standards-based management methods allows you to configure and monitor the components of the switch software.
GS716Tv2 and GS724Tv3 Software Administration Manual Figure 1. Administrative Page Layout Navigation Tabs, Feature Links, and Page Menu The navigation tabs along the top of the Web interface give you quick access to the various switch functions. The tabs are always available and remain constant, regardless of which feature you configure. When you select a tab, the features for that tab appear as links directly under the tabs.
GS716Tv2 and GS724Tv3 Software Administration Manual Configuration and Status Options The area directly under the feature links and to the right of the page menu displays the configuration information or status for the page you select. On pages that contain configuration options, you can input information into fields or select options from drop-down menus. Each page contains access to the HTML-based help that explains the fields and configuration options for the page.
GS716Tv2 and GS724Tv3 Software Administration Manual If you click the graphic, but do not click a specific port, the main menu appears, as the following figure shows. This menu contains the same option as the navigation tabs at the top of the page.
GS716Tv2 and GS724Tv3 Software Administration Manual Help Page Access Every page contains a link to the online help , which contains information to assist in configuring and managing the switch. The online help pages are context sensitive. For example, if the IP Addressing page is open, the help topic for that page displays if you click Help. Figure 1 shows the location of the Help link on the Web interface.
GS716Tv2 and GS724Tv3 Software Administration Manual Interface Naming Convention The switch supports physical and logical interfaces. Interfaces are identified by their type and the interface number. The physical ports are gigabit interfaces and are numbered on the front panel. You configure the logical interfaces by using the software. The following table describes the naming convention for all interfaces available on the switch.
GS716Tv2 and GS724Tv3 Software Administration Manual 30 | Chapter 1: Getting Started
2. 2 Configuring System Information Use the features in the System tab to define the switch’s relationship to its environment.
GS716Tv2 and GS724Tv3 Software Administration Manual Management This section describes how to display the switch status and specify some basic switch information, such as the management interface IP address, system clock settings, and DNS information.
GS716Tv2 and GS724Tv3 Software Administration Manual To define system information: 1. Open the System Information page. 2. Define the following fields: • System Name. Enter the name you want to use to identify this switch. You may use up to 31 alphanumeric characters. The factory default is blank. • System Location. Enter the location of this switch. You may use up to 31 alphanumeric characters. The factory default is blank. • System Contact. Enter the contact person for this switch.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure the network information for the management interface: 1. Select the appropriate radio button to determine how to configure the network information for the switch management interface: • Dynamic IP Address (DHCP). Specifies that the switch must obtain the IP address through a DHCP server. • Dynamic IP Address (BOOTP). Specifies that the switch must obtain the IP address through a BootP server. • Static IP Address.
GS716Tv2 and GS724Tv3 Software Administration Manual port VLAN ID (PVID) of the port to be connected in that management VLAN be the same as the management VLAN ID. The management VLAN has the following requirements: • Only one management VLAN can be active at a time. • When a new management VLAN is configured, connectivity through the existing management VLAN is lost. • The management station should be reconnected to the port in the new management VLAN.
GS716Tv2 and GS724Tv3 Software Administration Manual SNTP time definitions are assessed and determined by the following time levels: • T1: Time at which the original request was sent by the client. • T2: Time at which the original request was received by the server. • T3: Time at which the server sent a reply. • T4: Time at which the client received the server's reply. The device can poll Unicast server types for the server time.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure the time by using the CPU clock cycle as the source: 1. From the Clock Source field, select Local. 2. In the Date field, enter the date in the DD/MM/YYYY format. 3. In the Time field, enter the time in HH:MM:SS format. Note: If you do not enter a date and time, the switch will calculate the date and time using the CPU’s clock cycle. When the Clock Source is set to Local, the Time Zone field is grayed out (disabled): 4.
GS716Tv2 and GS724Tv3 Software Administration Manual 2. Use the menu to select the Coordinated Universal Time (UTC) time zone in which the switch is located, expressed as the number of hours. 3. Click Apply to send the updated configuration to the switch. Configuration changes take effect immediately. 4. Use the SNTP Server Configuration page to configure the SNTP server settings, as described in SNTP Server Configuration on page 39. 5.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Reference Clock Id Specifies the reference clock identifier of the server for the last received valid packet. Server Mode Specifies the mode of the server for the last received valid packet. Unicast Sever Max Entries Specifies the maximum number of unicast server entries that can be configured on this client. Unicast Server Current Entries Specifies the number of current valid unicast server entries configured for this client.
GS716Tv2 and GS724Tv3 Software Administration Manual • Priority . Specifies the priority of this server entry in determining the sequence of servers to which SNTP requests are sent. Enter a priority from 1–3, with 1 being the default and the highest priority. Servers with lowest numbers have priority. • Version. Enter the protocol version number. The range is 1–4. 2. Click Add. 3. Repeat the previous steps to add additional SNTP servers. You can configure up to three SNTP servers. 4.
GS716Tv2 and GS724Tv3 Software Administration Manual Click Refresh to refresh the page with the most current data from the switch. Denial of Service Use the Denial of Service (DoS) page to configure DoS control. The switch software provides support for classifying and blocking specific types of DoS attacks. You can configure your system to monitor and block six types of attacks: • SIP=DIP: Source IP address = Destination IP address.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure the Auto-DoS feature: 1. Select a radio button to enable or disable Auto-DoS: • Disable. Auto-DoS is disabled (default). • Enable. Auto-DoS is enabled. 2. Click Apply to send the updated configuration to the switch. Configuration changes occur immediately. 3. Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch.
GS716Tv2 and GS724Tv3 Software Administration Manual to drop packets that have a TCP header smaller than the configured Min TCP Hdr Size. The factory default is Disable. • Denial of Service Min TCP Hdr Size. Specify the Min TCP Hdr Size allowed. If First Fragment DoS prevention is enabled, the switch will drop packets that have a TCP header smaller than this configured Min TCP Hdr Size. The factory default is 20 bytes. • Denial of Service TCP Fragment.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure the global DNS settings: 1. Specify whether to enable or disable the administrative status of the DNS Client. • Enable. Allow the switch to send DNS queries to a DNS server to resolve a DNS domain name. • Disable. Prevent the switch from sending DNS queries. 2. Enter the DNS default domain name to include in DNS queries.
GS716Tv2 and GS724Tv3 Software Administration Manual To add a static entry to the local DNS table: 1. Specify the static host name to add. Enter up to 158 characters. 2. Specify the IP address in standard IPv4 dot notation to associate with the hostname. 3. Click Add. The entry appears in the list below. 4. To remove an entry from the static DNS table, select the check box next to the entry and click Delete. 5.
GS716Tv2 and GS724Tv3 Software Administration Manual Green Ethernet Configuration Use this page to configure Green Ethernet features. Using the Green Ethernet features allows for power consumption savings. To access this page, click System Management Green Ethernet Configuration. To configure the Green Ethernet feature: 1. Enable or disable the Short Cable Mode. • Enable. The switch performs a cable test on each cable connect to its ports.
GS716Tv2 and GS724Tv3 Software Administration Manual License Key This page provides information about available License Keys for various features. By default those License Keys are not available. If License Key for feature is not available, the user will not be allowed to configure this functionality. Available License Key allows the user to configure functionality. Non Configurable Data • License date - The date the license is purchased. • License copy - The information about the number of license.
GS716Tv2 and GS724Tv3 Software Administration Manual Community Configuration To display this page, click System SNMP SNMP V1/V2 Community Configuration. By default, two SNMP Communities exist: • Private, with Read/Write privileges and status set to Enable. • Public, with Read Only privileges and status set to Enable. These are well-known communities. Use this page to change the defaults or to add other communities.
GS716Tv2 and GS724Tv3 Software Administration Manual • Community String. Specify a community name. A valid entry is a case-sensitive string of up to 16 characters. • Access Mode. Specify the access level for this community by selecting Read/Write or Read Only from the menu. • Status. Specify the status of this community by selecting Enable or Disable from the pull down menu. If you select Enable, the Community Name must be unique among all valid Community Names or the set request will be rejected.
GS716Tv2 and GS724Tv3 Software Administration Manual 2. To modify information about an existing SNMP recipient, select the check box next to the recipient, change the desired fields, and then click Apply. Configuration changes take effect immediately. 3. To delete a recipient, select the check box next to the recipient and click Delete. 4. Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch.
GS716Tv2 and GS724Tv3 Software Administration Manual SNMP v3 User Configuration This is the configuration for SNMP v3. To access this page, click System SNMP SNMP V3 User Configuration. The SNMPv3 Access Mode is a read-only field that shows the access privileges for the user account. The admin account always has Read/Write access, and all other accounts have Read Only access. To configure SNMPv3 settings for the user account: 1.
GS716Tv2 and GS724Tv3 Software Administration Manual LLDP The IEEE 802.1AB-defined standard, Link Layer Discovery Protocol (LLDP), allows stations on an 802 LAN to advertise major capabilities and physical descriptions. This information is viewed by a network manager to identify system topology and detect bad configurations on the LAN.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure global LLDP settings: 1. Configure the following LLDP properties. • TLV Advertised Interval. Specify the interval at which frames are transmitted. The default is 30 seconds, and the valid range is 1–32768 seconds. • Hold Multiplier. Specify multiplier on the transmit interval to assign to Time-to-Live (TTL). The default is 4 seconds, and the range is 2–10. • Reinitializing Delay. Specify the delay before a reinitialization.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure LLDP port settings: 1. Change the LLDP port settings described below: • Interface. Specifies the port to be affected by these parameters. • Admin Status. Select the status for transmitting and receiving LLDP packets: • Tx Only: Enable only transmitting LLDP PDUs on the selected ports. • Rx Only: Enable only receiving LLDP PDUs on the selected ports.
GS716Tv2 and GS724Tv3 Software Administration Manual • • Tx and Rx: Enable both transmitting and receiving LLDP PDUs on the selected ports. • Disabled: Do not transmit or receive LLDP PDUs on the selected ports. Management IP Address. Choose whether to advertise the management IP address from the interface. The possible field values are: • Stop Advertise: Do not advertise the management IP address from the interface.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Network Policy Number Specifies the policy number. Application Specifies the media application type associated with the policy. Only the Voice application type is supported. The application type that is received on the interface has the VLAN ID, priority, DSCP, tagged bit status and unknown bit status. This information is displayed only if a network policy TLV has been transmitted.
GS716Tv2 and GS724Tv3 Software Administration Manual 3. From the Notification field, specify whether the port should send a topology change notification if a device is connected or removed. 4. From the Transmit Optional TLVs field, specify whether the port should transmit optional type length values (TLVs) in the LLDP PDU frames.
GS716Tv2 and GS724Tv3 Software Administration Manual The following table describes the LLDP local information that displays for each port. Field Description Interface Select the interface with the information to display. Port ID Subtype Identifies the type of data displayed in the Port ID field. Port ID Identifies the physical address of the port. Port Description Identifies the user-defined description of the port. To configure the Port Description, see Ports on page 70.
GS716Tv2 and GS724Tv3 Software Administration Manual Click Refresh to refresh the page with the most current data from the switch. To view additional details about a port, click the name of the port in the Interface column of the Port Information table. A popup window displays information for the selected port. The following table describes the detailed local information that displays for the selected port.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Auto-Negotiation Enabled Displays the port speed auto-negotiation support status. The possible values are True (enabled) or False (disabled). Auto Negotiation Advertised Displays the port speed auto-negotiation capabilities such as 1000BASE-T Capabilities half-duplex mode or 100BASE-TX full-duplex mode. Operational MAU Type Displays the Medium Attachment Unit (MAU) type.
GS716Tv2 and GS724Tv3 Software Administration Manual The following table describes the information that displays for all LLDP neighbors that have been discovered. Field Description MSAP Entry Displays the Media Service Access Point (MSAP) entry number for the remote device. Local Port Displays the interface on the local system that received LLDP information from a remote system. Chassis ID Subtype Identifies the type of data displayed in the Chassis ID field on the remote system.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Port Details Local Port Displays the interface on the local system that received LLDP information from a remote system. MSAP Entry Displays the Media Service Access Point (MSAP) entry number for the remote device. Basic Details Chassis ID Subtype Identifies the type of data displayed in the Chassis ID field on the remote system. Chassis ID Identifies the remote 802 LAN device's chassis.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Address Specifies the advertised management address of the remote system. Interface SubType Specifies the port subtype. Interface Number Identifies the port on the remote device that sent the information. MAC/PHY Details Auto-Negotiation Supported Specifies whether the remote device supports port-speed auto-negotiation.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Asset ID Displays the asset ID advertised by the remote device. Location Information Civic Displays the physical location, such as the street address, the remote device has advertised in the location TLV. For example, 123 45th St. E. The field value length range is 6–160 characters. Coordinates Displays the location map coordinates the remote device has advertised in the location TLV, including latitude, longitude and altitude.
GS716Tv2 and GS724Tv3 Software Administration Manual Services — DHCP Filtering DHCP Filtering is a useful feature that can be employed as a security measure against unauthorized DHCP servers. A known attack is when an unauthorized DHCP server responds to a client that is requesting an IP address. The server configures the gateway for the client to be equal to the IP address of the server. At that point, the client sends all of its IP traffic destined to other networks to the unauthorized machine.
GS716Tv2 and GS724Tv3 Software Administration Manual Interface Configuration Use the DHCP Filtering Interface Configuration page to view and configure each port as a trusted or untrusted port. Any DHCP responses received on a trusted port are forwarded. If a port is configured as untrusted, any DHCP (or BootP) responses received on that port are discarded. To access the DHCP Filtering Interface Configuration page, click System Services DHCP Filtering Interface Configuration.
GS716Tv2 and GS724Tv3 Software Administration Manual 3. To configure DHCP filtering settings for both physical ports and LAGs, click ALL. 4. Select the check box next to the port or LAG to configure. You can select multiple ports and LAGs to apply the same setting to the selected interfaces. Select the check box in the heading row to apply the same settings to all interfaces. 5. Choose the trust mode for the selected port(s) or LAG(s). • Enable: Any DHCP responses received on this port are forwarded.
GS716Tv2 and GS724Tv3 Software Administration Manual 68 | Chapter 2: Configuring System Information
3. 3 Configuring Switching Information Use the features in the Switching tab to define Layer 2 features.
GS716Tv2 and GS724Tv3 Software Administration Manual Ports The pages on the Ports tab allow you to view and monitor the physical port information for the ports available on the switch. From the Ports link, you can access the following pages: • Port Configuration on page 70 • Flow Control on page 73 Port Configuration Use the Port Configuration page to configure the physical interfaces on the switch. To access the Port Configuration page, click Switching Ports Port Configuration.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure port settings: 1. To configure settings for a physical port, click PORTS. 2. To configure settings for a Link Aggregation Group (LAG), click LAGS.
GS716Tv2 and GS724Tv3 Software Administration Manual 3. To configure settings for both physical ports and LAGs, click ALL. 4. Select the check box next to the port or LAG to configure. You can select multiple ports and LAGs to apply the same setting to the selected interfaces. Select the check box in the heading row to apply the same settings to all interfaces. 5. Configure or view the settings: • Description. Enter the description string to be attached to a port.
GS716Tv2 and GS724Tv3 Software Administration Manual 6. Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch. 7. If you make any changes to the page, click Apply to apply the changes to the system. Flow Control IEEE 802.3x flow control works by pausing a port when the port becomes oversubscribed and dropping all traffic for small bursts of time during the congestion condition.
GS716Tv2 and GS724Tv3 Software Administration Manual Link Aggregation Groups Link aggregation groups (LAGs), which are also known as port-channels, allow you to combine multiple full-duplex Ethernet links into a single logical link. Network devices treat the aggregation as if it were a single link, which increases fault tolerance and provides load sharing. You assign the LAG VLAN membership after you create a LAG. The LAG by default becomes a member of the management VLAN.
GS716Tv2 and GS724Tv3 Software Administration Manual LAG Configuration Use the LAG (Port Channel) Configuration page to group one or more full-duplex Ethernet links to be aggregated together to form a link aggregation group, which is also known as a port-channel. The switch treats the LAG as if it were a single link. To access the LAG Configuration page, click Switching LAG Basic LAG Configuration. To configure LAG settings: 1. Select the check box next to the LAG to configure.
GS716Tv2 and GS724Tv3 Software Administration Manual • Active Ports. A listing of the ports that are actively participating members of this Port Channel. A maximum of 4 ports can be assigned to a port channel. • LAG State. Indicates whether the link is Up or Down. 3. Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch. 4. If you make any changes to this page, click Apply to send the updated configuration to the switch.
GS716Tv2 and GS724Tv3 Software Administration Manual 4. Click the box below each port to include in the LAG. The following figure shows an example of how to configure LAG1 with ports e1–e4 as members. 5. Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch. 6. If you make any changes to this page, click Apply to send the updated configuration to the switch. Configuration changes take effect immediately. 7.
GS716Tv2 and GS724Tv3 Software Administration Manual 3. Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch. 4. If you make any changes to this page, click Apply to send the updated configuration to the switch. Configuration changes take effect immediately. LACP Port Configuration To display the LACP Port Configuration page, click Switching LAG Advanced LACP Port Configuration. To configure LACP port priority settings: 1.
GS716Tv2 and GS724Tv3 Software Administration Manual Note: You cannot select ports that are not participating in a LAG 2. Configure the LACP Priority value for the selected port. The field range is 0–255. The default value is 128. 3. Configure the administrative LACP Timeout value. • Long. Specifies a long timeout value. • Short. Specifies a short timeout value. 4. Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch. 5.
GS716Tv2 and GS724Tv3 Software Administration Manual VLANs Adding Virtual LAN (VLAN) support to a Layer 2 switch offers some of the benefits of both bridging and routing. Like a bridge, a VLAN switch forwards traffic based on the Layer 2 header, which is fast, and like a router, it partitions the network into logical segments, which provides better administration, security and management of multicast traffic. By default, all ports on the switch are in the same broadcast domain.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure VLANs: 1. To add a VLAN, configure the VLAN ID, name, and type, and then click Add. • VLAN ID. Specify the VLAN Identifier for the new VLAN. (You can enter data in this field only when you are creating a new VLAN.) The range of the VLAN ID is 1–4093. • VLAN Name. Use this optional field to specify a name for the VLAN. It can be up to 32 alphanumeric characters long, including blanks. The default is blank. VLAN ID 1 is always named Default.
GS716Tv2 and GS724Tv3 Software Administration Manual To display the VLAN Membership Configuration page, click Switching VLAN Advanced VLAN Membership. To configure VLAN membership: 1. From the VLAN ID field, select the VLAN to which you want to add ports. 2. Click the orange bar below the VLAN Type field to display the physical ports on the switch. 3. Click the lower orange bar to display the LAGs on the switch. 4.
GS716Tv2 and GS724Tv3 Software Administration Manual • Tag All: Select the ports on which all frames transmitted for this VLAN will be tagged. All the ports will be included in the VLAN. • Remove All: This selection has the effect of excluding all ports from the selected VLAN. 6. Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch. 7. If you make any changes to this page, click Apply to send the updated configuration to the switch.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure PVID information: 1. To configure PVID settings for a physical port, click PORTS. 2. To configure PVID settings for a Link Aggregation Group (LAG), click LAGS. 3. To configure PVID settings for both physical ports and LAGs, click ALL. 4. Select the check box next to the interfaces to configure. You can select multiple interfaces to apply the same setting to the selected interfaces.
GS716Tv2 and GS724Tv3 Software Administration Manual 6. Specify how you want the port to handle untagged and priority tagged frames. Whichever you select, VLAN tagged frames will be forwarded in accordance with the IEEE 802.1Q VLAN standard. The factory default is Admit All. • VLAN Only: The port will discard any untagged or priority tagged frames it receives. • Admit All: Untagged and priority tagged frames received on the port will be accepted and assigned the value of the Port VLAN ID for this port.
GS716Tv2 and GS724Tv3 Software Administration Manual Voice VLAN Configure the Voice VLAN settings for ports that carry traffic from IP phones. The Voice VLAN feature can help ensure that the sound quality of an IP phone is safeguarded from deteriorating when the data traffic on the port is high.
GS716Tv2 and GS724Tv3 Software Administration Manual 5. From the Voice VLAN Aging Time field, specify the amount of time after the last IP phone’s OUI is aged out for a specific port. The port will age out after the bridge and voice aging time. 6. Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch. 7. If you make any changes to this page, click Apply to send the updated configuration to the switch.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure Voice VLAN port settings: 1. Select the check box next to the port to configure. You can select multiple check boxes to apply the same setting to all selected ports. 2. From the Voice VLAN Mode menu, specify whether to enable or disable Voice VLAN on the selected port. 3. From the Voice VLAN Security menu, specify whether to enable or disable Voice VLAN security on the selected port. 4.
GS716Tv2 and GS724Tv3 Software Administration Manual Chapter 3: Configuring Switching Information | 89
GS716Tv2 and GS724Tv3 Software Administration Manual Auto-VoIP The Auto-VoIP automatically makes sure that time-sensitive voice traffic is given priority over data traffic on ports that have this feature enabled. Auto-VoIP checks for packets carrying the following VoIP protocols: • Session Initiation Protocol (SIP) • H.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure Auto-VoIP settings: 1. Select the check box next to the port to configure. You can select multiple check boxes to apply the same setting to all selected ports. 2. From the Auto-VoIP Mode menu, specify whether to enable or disable Auto-VoIP on the selected port. 3. Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch. 4.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure OUI settings: 1. To add a new OUI prefix, type the VOIP OUI prefix in the Telephony OUI(s) field, provide a description of the prefix, and click Add. The OUI prefix must be in the format AA:BB:CC. 2. To delete an OUI prefix from the list, select the check box next to the OUI prefix and click Delete. 3.
GS716Tv2 and GS724Tv3 Software Administration Manual Spanning Tree Protocol The Spanning Tree Protocol (STP) provides a tree topology for any arrangement of bridges. STP also provides one path between end stations on a network, eliminating loops. Spanning tree versions supported include Common STP, Multiple STP, and Rapid STP. Classic STP provides a single path between end stations, avoiding and eliminating loops. For information on configuring Common STP, see CST Port Configuration on page 97.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure STP settings on the switch: 1. From the Spanning Tree State field, specify whether to enable or disable Spanning Tree operation on the switch. 2. From the STP Operation Mode field, Specifies the Force Protocol Version parameter for the switch. Options are: • STP (Spanning Tree Protocol): IEEE 802.1D • RSTP (Rapid Spanning Tree Protocol): IEEE 802.1w • MSTP (Multiple Spanning Tree Protocol): IEEE 802.1s 3.
GS716Tv2 and GS724Tv3 Software Administration Manual 6. If you make any configuration changes, click Apply to send the updated configuration to the switch. Configuration changes occur immediately. The following table describes the STP Status information displayed on the screen. Field Description Bridge Identifier The bridge identifier for the CST. It is made up using the bridge priority and the base MAC address of the bridge.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure CST settings: 1. Specify values for CST in the appropriate fields: • Bridge Priority. When switches or bridges are running STP, each is assigned a priority. After exchanging BPDUs, the switch with the lowest priority value becomes the root bridge. Specifies the bridge priority value for the Common and Internal Spanning Tree (CST). The valid range is 0–61440. The bridge priority is a multiple of 4096.
GS716Tv2 and GS724Tv3 Software Administration Manual 3. If you make any configuration changes, click Apply to send the updated configuration to the switch. Configuration changes take place immediately. The following table describes the MSTP status information displayed on the Spanning Tree CST Configuration page. Field Description MST ID Table consisting of the MST instances (including the CST) and the corresponding VLAN IDs associated with each of them.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure CST port settings: 1. To configure CST settings for a physical port, click PORTS. 2. To configure CST settings for a Link Aggregation Group (LAG), click LAGS. 3. To configure CST settings for both physical ports and LAGs, click ALL. 4. Select the check box next to the port or LAG to configure. You can select multiple ports and LAGs to apply the same setting to the selected interfaces.
GS716Tv2 and GS724Tv3 Software Administration Manual • Fast Link. Specifies if the specified port is an Edge Port with the CST. Possible values are Enable or Disable. The default is Disable. • Port State. The Forwarding state of this port. This field is read-only. • Path Cost. Set the Path Cost to a new value for the specified port in the common and internal spanning tree. It takes a value in the range of 1–200000000. • Priority. The priority for a particular port within the CST.
GS716Tv2 and GS724Tv3 Software Administration Manual The following table describes the CST Status information displayed on the screen.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Interface Select a physical or port channel interface to configure. The port is associated with the VLAN(s) associated with the CST. Port Role Each MST Bridge Port that is enabled is assigned a Port Role for each spanning tree. The port role will be one of the following values: Root Port, Designated Port, Alternate Port, Backup Port, Master Port, or Disabled Port. Designated Root Root Bridge for the CST.
GS716Tv2 and GS724Tv3 Software Administration Manual Rapid STP Use the Rapid STP page to view information about Rapid Spanning Tree (RSTP) port status. To display the Rapid STP page, click Switching > STP > Advanced RSTP. The following table describes the Rapid STP Status information displayed on the screen. Field Description Interface The physical or port channel interfaces associated with VLANs associated with the CST.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Fast Link Indicates whether the port is enabled as an edge port. Status The Forwarding State of this port. Click Refresh to update the information on the screen with the most current data. MST Configuration Use the Spanning Tree MST Configuration page to configure Multiple Spanning Tree (MST) on the switch. To display the Spanning Tree MST Configuration page, click Switching > STP > Advanced MST Configuration.
GS716Tv2 and GS724Tv3 Software Administration Manual • VLAN ID. The menu contains all VLANs configured on the switch. Select a VLAN to associate with the MST instance. 2. To delete an MST instance, select the check box next to the instance and click Delete. 3. To modify an MST instance, select the check box next to the instance to configure, update the values, and click Apply. You can select multiple check boxes to apply the same setting to all selected ports. 4.
GS716Tv2 and GS724Tv3 Software Administration Manual Chapter 3: Configuring Switching Information | 105
GS716Tv2 and GS724Tv3 Software Administration Manual Note: If no MST instances have been configured on the switch, the page displays a “No MSTs Available” message. To configure MST port settings: 1. To configure MST settings for a physical port, click PORTS. 2. To configure MST settings for a Link Aggregation Group (LAG), click LAGS. 3. To configure MST settings for both physical ports and LAGs, click ALL. 4. Select the check box next to the port or LAG to configure.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Port Mode Spanning Tree Protocol Administrative Mode associated with the port or port channel. Possible values are Enable or Disable. Port Forwarding State Indicates the current STP state of a port. If enabled, the port state determines what forwarding action is taken on traffic. Possible port states are: • Disabled: STP is currently disabled on the port. The port forwards traffic while learning MAC addresses.
GS716Tv2 and GS724Tv3 Software Administration Manual The following table describes the information available on the STP Statistics page. Field Description Interface Select a physical or port channel interface to view its statistics. STP BPDUs Received Number of STP BPDUs received at the selected port. STP BPDUs Transmitted Number of STP BPDUs transmitted from the selected port. RSTP BPDUs Received Number of RSTP BPDUs received at the selected port.
GS716Tv2 and GS724Tv3 Software Administration Manual Multicast Multicast IP traffic is traffic that is destined to a host group. Host groups are identified by class D IP addresses, which range from 224.0.0.0 to 239.255.255.255.
GS716Tv2 and GS724Tv3 Software Administration Manual IGMP Snooping Internet Group Management Protocol (IGMP) Snooping is a feature that allows a switch to forward multicast traffic intelligently on the switch. Multicast IP traffic is traffic that is destined to a host group. Host groups are identified by class D IP addresses, which range from 224.0.0.0 to 239.255.255.255. Based on the IGMP query and report messages, the switch forwards traffic only to the ports that request the multicast traffic.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure IGMP Snooping: 1. Enable or disable IGMP Snooping on the switch. • Enable. The switch snoops all IGMP packets it receives to determine which segments should receive packets directed to the group address. • Disable. The switch does not snoop IGMP packets. 2. Choose whether to validate the IGMP IP header. • Enable. The switch checks the IP header of all IGMP messages for the Router Alert option.
GS716Tv2 and GS724Tv3 Software Administration Manual The following table displays information about the global IGMP snooping status and statistics on the page. Field Description Multicast Control Frame Count Displays the number of multicast control frames that have been processed by the CPU. Interfaces Enabled for IGMP Snooping Lists the interfaces currently enabled for IGMP Snooping. To enable interfaces for IGMP snooping, see IGMP Snooping Interface Configuration on page 112.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure IGMP Snooping interface settings: 1. To configure IGMP Snooping settings for a physical port, click PORTS. 2. To configure IGMP Snooping settings for a Link Aggregation Group (LAG), click LAGS. 3. To configure IGMP Snooping settings for both physical ports and LAGs, click ALL. 4. Select the check box next to the port or LAG to configure. You can select multiple ports and LAGs to apply the same setting to the selected interfaces.
GS716Tv2 and GS724Tv3 Software Administration Manual • Fast Leave Admin Mode. Select the Fast Leave mode for a particular interface from the menu. The default is Disable. 6. Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch. 7. If you make any configuration changes, click Apply to apply the new settings to the switch. Configuration changes take effect immediately.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Description The text description of this multicast table entry. Possible values are Management Configured, Network Configured, and Network Assisted. Interface The list of interfaces that are designated for forwarding (Fwd) and filtering (Flt) for the associated address. Use the buttons at the bottom of the page to perform the following actions: • Click Clear to clear one or all of the IGMP Snooping entries.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description MAC Address The MAC Address to which the multicast MAC address is related. To search by MAC address, enter the address with the MFDB table entry you want displayed. Enter six two-digit hexadecimal numbers separated by colons, for example 00:0f:43:67:89:AB, and then click Go. If the address exists, that entry will be displayed. An exact match is required. VLAN ID The VLAN ID to which the multicast MAC address is related.
GS716Tv2 and GS724Tv3 Software Administration Manual The following table describes the information available on the MFDB Statistics page: Field Description Max MFDB Table Entries Displays the maximum number of entries that the Multicast Forwarding Database table can hold. Most MFDB Entries Since Last Reset The largest number of entries that have been present in the Multicast Forwarding Database table since the system was last reset. This value is also known as the MFDB high-water mark.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure IGMP snooping settings for VLANs: 1. To enable IGMP snooping on a VLAN, enter the VLAN ID in the appropriate field and configure the IGMP Snooping values: • Fast Leave Admin Mode. Enable or disable the IGMP Snooping Fast Leave Mode for the specified VLAN ID.
GS716Tv2 and GS724Tv3 Software Administration Manual 3. To disable IGMP snooping on a VLAN and remove it from the list, select the check box next to the VLAN ID and click Delete. 4. To modify IGMP snooping settings for a VLAN, select the check box next to the VLAN ID, update the desired values, and click Apply. 5. Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch.
GS716Tv2 and GS724Tv3 Software Administration Manual 1. From the Querier Admin Mode field, enable or disable the administrative mode for IGMP Snooping Querier. 2. In the Snooping Querier Address field, specify the IP address to be used as source address in periodic IGMP queries. This address is used when no address is configured on the VLAN on which the query is being sent. 3. In the IGMP Version field, specify the IGMP protocol version used in periodic IGMP queries. 4.
GS716Tv2 and GS724Tv3 Software Administration Manual • • Disabled. Upon seeing another querier of the same version in the VLAN, the snooping querier moves to the non-querier state. • Enabled. The snooping querier participates in querier election, in which the least IP address operates as the querier in that VLAN. The other querier moves to non-querier state. Snooping Querier VLAN Address.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description VLAN ID Specifies the VLAN ID on which the IGMP Snooping Querier is administratively enabled and for which VLAN exists in the VLAN database. Operational State Specifies the operational state of the IGMP Snooping Querier on a VLAN: • Querier: The snooping switch is the querier in the VLAN. The snooping switch will send out periodic queries with a time interval equal to the configured querier query interval.
GS716Tv2 and GS724Tv3 Software Administration Manual To access this page, click Switching Address Table Basic Address Table. To search for an entry in the MAC Address Table: 1. Use the Search By field to search for MAC Addresses by MAC Address, VLAN ID, or Interface. • MAC Address: Select MAC Address from the menu and enter a six-byte hexadecimal MAC address in two-digit groups separated by colons, then click Go. If the address exists, that entry will be displayed. An exact match is required.
GS716Tv2 and GS724Tv3 Software Administration Manual The following table describes the information available for each entry in the address table. Field Description VLAN ID Specifies the VLAN ID on which the IGMP Snooping Querier is administratively enabled and for which VLAN exists in the VLAN database. MAC Address A unicast MAC address for which the switch has forwarding and/or filtering information. The format is a six-byte MAC address with each byte separated by colons.
GS716Tv2 and GS724Tv3 Software Administration Manual Note: IEEE 802.1D recommends a default of 300 seconds, which is the factory default. 2. Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch. 3. Click Apply to apply to send the updated configuration to the switch. Configuration changes take effect immediately. Static MAC Address Use the Static MAC Address Configuration page to configure and view static MAC addresses on an interface.
GS716Tv2 and GS724Tv3 Software Administration Manual 126 | Chapter 3: Configuring Switching Information
4. 4 Configuring Quality of Service Use the features in the QoS tab to configure Quality of Service (QoS) settings on the switch. The QoS tab contains links to the following features: • Class of Service on page 128 • Differentiated Services on page 135 In a typical switch, each physical port consists of one or more queues for transmitting packets on the attached network. Multiple queues per port are often provided to give preference to certain packets over others based on user-defined criteria.
GS716Tv2 and GS724Tv3 Software Administration Manual Class of Service The Class of Service (CoS) queueing feature lets you directly configure certain aspects of switch queueing. This provides the desired QoS behavior for different types of network traffic when the complexities of DiffServ are not required. The priority of a packet arriving at an interface can be used to steer the packet to the appropriate outbound CoS queue through a mapping table.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure global CoS settings: 1. Select the Global radio button to configure the trust mode settings that apply to all interfaces. Alternatively, you can select the Interface radio button to apply trust mode settings to individual interfaces. The per-interface setting overrides the global settings. 2. Select the trust mode for all interfaces (Global Trust Mode) or the selected interface (Interface Trust Mode).
GS716Tv2 and GS724Tv3 Software Administration Manual To configure CoS settings for an interface: 1. To configure CoS settings for a physical port, click PORTS. 2. To configure CoS settings for a Link Aggregation Group (LAG), click LAGS. 3. To configure CoS settings for both physical ports and LAGs, click ALL. 4. Select the check box next to the port or LAG to configure. You can select multiple ports and LAGs to apply the same setting to the selected interfaces. 5.
GS716Tv2 and GS724Tv3 Software Administration Manual Interface Queue Configuration Use the Interface Queue Configuration page to define what a particular queue does by configuring switch egress queues. User-configurable parameters control the amount of bandwidth used by the queue, the queue depth during times of congestion, and the scheduling of packet transmission from the set of all queues on a port. Each port has its own CoS queue-related configuration.
GS716Tv2 and GS724Tv3 Software Administration Manual • Queue ID. Use the menu to select the queue to be configured. • Minimum Bandwidth. Enter a percentage of the maximum negotiated bandwidth for the selected queue on the interface. Specify a percentage from 0–100, in increments of 1. • Scheduler Type. Selects the type of queue processing from the drop down menu. Options are Weighted and Strict.
GS716Tv2 and GS724Tv3 Software Administration Manual If you map 802.1p priorities to individual interfaces, select the Interface radio button and then select the interface from the drop-down menu. The interface settings override the global settings for 802.1p priority mapping. 2. Select the queue to map to the predefined 802.1p priority values. The 802.1p Priority row contains traffic class selectors for each of the eight 802.1p priorities to be mapped. The priority goes from low (0) to high (3).
GS716Tv2 and GS724Tv3 Software Administration Manual To map DSCP values to queues: 1. For each DSCP value, select a hardware queue to associate with the value. The traffic class is the hardware queue for a port. Higher traffic class values indicate a higher queue position. Before traffic in a lower queue is sent, it must wait for traffic in higher queues to be sent. Valid range is 0–3. 2.
GS716Tv2 and GS724Tv3 Software Administration Manual Differentiated Services The QoS feature contains Differentiated Services (DiffServ) support that allows traffic to be classified into streams and given certain QoS treatment in accordance with defined per-hop behaviors. Standard IP-based networks are designed to provide “best effort” data delivery service. “Best effort” service implies that the network delivers the data in a timely fashion, although there is no guarantee that it will.
GS716Tv2 and GS724Tv3 Software Administration Manual Diffserv Configuration Use the Diffserv Configuration page to display DiffServ General Status Group information, which includes the current administrative mode setting as well as the current and maximum number of rows in each of the main DiffServ private MIB tables. To display the page, click QoS DiffServ Advanced Diffserv Configuration. To configure the global DiffServ mode: 1. Select the administrative mode for DiffServ: • Enable.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Policy Attributes Table Displays the current and maximum number of rows of the policy attributes table. Service Table Displays the current and maximum number of rows of the service table. Class Configuration Use the Class Configuration page to add a new DiffServ class name, or to rename or delete an existing class. The page also allows you to define the criteria to associate with a DiffServ class.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure the class match criteria: 1. Click the class name for an existing class. The class name is a hyperlink. The following figure shows the configuration fields for the class.
GS716Tv2 and GS724Tv3 Software Administration Manual 2. Define the criteria to associate with a DiffServ class: • Reference Class. Selects a class to start referencing for criteria. A specified class can reference at most one other class of the same type. • Class of Service. Select the field and enter a class of service 802.1p user priority value to be matched for the packets. The valid range is 0–7. • VLAN. Select the field and enter a VLAN ID to be matched for packets. The VLAN ID range is 1–4093.
GS716Tv2 and GS724Tv3 Software Administration Manual • Destination IP Address. Requires a packet’s destination port IP address to match the address listed here. In the IP Address field, enter a valid destination IP address in dotted decimal format. • Destination Mask. Enter a valid subnet mask to determine which bits in the IP address are significant. This is not a wildcard mask. • Destination L4 Port. Requires a packet’s TCP/UDP destination port to match the port you select.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure a DiffServ policy: 1. To create a new policy, enter a policy name in the Policy Selector field, select the existing DiffServ class to associate with the policy, and click Add. The available policy type is In, which indicates the type is specific to inbound traffic. This field is not configurable. 2.
GS716Tv2 and GS724Tv3 Software Administration Manual The policy name is a hyperlink. The following figure shows the configuration fields for the policy.
GS716Tv2 and GS724Tv3 Software Administration Manual 2. Select the queue to which packets will of this policy-class will be assigned. 3. Configure the policy attributes:. • Drop. Select this option to drop packets for this policy-class. • Mark CoS. Enter the specified Class of Service queue number to mark all packets for the associated traffic stream with the specified class of service value in the priority field of the 802.1p header. If the packet does not already contain this header, one is inserted.
GS716Tv2 and GS724Tv3 Software Administration Manual • Simple Policy. Use this attribute to establish the traffic policing style for the specified class. The simple form of the policy command uses a single data rate and burst size, resulting in two outcomes: confirm and violate. 4. If you select the Simple Policy attribute, you can configure the following fields: • Color Mode.
GS716Tv2 and GS724Tv3 Software Administration Manual • Mark IP DSCP. These packets are marked by DiffServ with the specified DSCP value before being presented to the system forwarding element. This selection requires that the DSCP value field be set. 5. Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch. 6. If you change any of the settings on the page, click Apply to send the updated configuration to the switch.
GS716Tv2 and GS724Tv3 Software Administration Manual 4. Select the check box next to the port or LAG to configure. You can select multiple ports and LAGs to apply the same setting to the selected interfaces. Select the check box in the heading row to apply the same settings to all interfaces. 5. To activate a policy for the selected interface(s) select the policy from the Policy In menu, and then click Apply. 6.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Discarded Packets Displays the total number of packets discarded for all class instances in this service policy for any reason due to DiffServ treatment. This is the overall count per-interface, per-direction. Member Classes Selects the member class for which octet statistics are to display. Click Refresh to update the page with the most current information.
GS716Tv2 and GS724Tv3 Software Administration Manual 148 | Chapter 4: Configuring Quality of Service
5. 5 Managing Device Security Use the features available from the Security tab to configure management security settings for port, user, and server security.
GS716Tv2 and GS724Tv3 Software Administration Manual Management Security Settings From the Management Security Settings page, you can configure the login password, Remote Authorization Dial-In User Service (RADIUS) settings, Terminal Access Controller Access Control System (TACACS+) settings, and authentication lists. To display the page, click the Security Management Security tab.
GS716Tv2 and GS724Tv3 Software Administration Manual Note: In the case of a lost password, press the Factory Default Reset button on the front panel for more than one second to restore the factory default. The reset button will only reboot the device. RADIUS Configuration RADIUS servers provide additional security for networks. The RADIUS server maintains a user database, which contains per-user authentication information.
GS716Tv2 and GS724Tv3 Software Administration Manual configured as the primary server. If no servers are configured as the primary server, the current server is the most recently added RADIUS server. To configure global RADIUS server settings: 1. In the Max Number of Retransmits field, specify the value of the maximum number of times a request packet is retransmitted to the RADIUS server. Consideration to maximum delay time should be given when configuring RADIUS max retransmit and RADIUS timeout.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure a RADIUS server: 1. To add a RADIUS server, specify the settings the following list describes, and click Add. • In the Server Address field, specify the IP address of the RADIUS server to add. • In the Authentication Port field, specify the UDP port number the server uses to verify the RADIUS server authentication. The valid range is 0–65535. • From the Secret Configured menu, select Yes to add a RADIUS secret in the next field.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Access Requests The number of RADIUS Access-Request packets sent to this server. This number does not include retransmissions. Access Retransmissions The number of RADIUS Access-Request packets retransmitted to this server. Access Accepts The number of RADIUS Access-Accept packets, including both valid and invalid packets, that were received from this server.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure the RADIUS accounting server: 1. In the Accounting Server Address field, specify the IP address of the RADIUS accounting server to add. 2. In the Port field, specify the UDP port number the server uses to verify the RADIUS accounting server authentication. The valid range is 0–65535. 3. From the Secret Configured menu, select Yes to add a RADIUS secret in the next field. You must select Yes before you can configure the RADIUS secret.
GS716Tv2 and GS724Tv3 Software Administration Manual The following table describes RADIUS accounting server statistics available on the page. Field Description Accounting Server Address Displays the IP address of the supported RADIUS accounting server. Round Trip Time (secs) Displays the time interval, in hundredths of a second, between the most recent Accounting-Response and the Accounting-Request that matched it from this RADIUS accounting server.
GS716Tv2 and GS724Tv3 Software Administration Manual The TACACS+ protocol ensures network security through encrypted protocol exchanges between the device and TACACS+ server. The TACACS+ folder contains links to the following features: • Configuring TACACS+ on page 156 • TACACS+ Server Configuration on page 157 TACACS+ Configuration The TACACS+ Configuration page contains the TACACS+ settings for communication between the switch and the TACACS+ server you configure via the inband management port.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure TACACS+ server settings: 1. To add a new TACACS+ server, select Add from the TACACS+ Server field, enter the IP address of the server to add, and click Apply. Note: The Add option is available if fewer than five TACACS+ servers are configured on the system, and the Server Address field is only available when Add is selected in the TACACS+ Server IP Address field.
GS716Tv2 and GS724Tv3 Software Administration Manual Authentication List Configuration Use the Authentication List page to configure the default login list. A login list specifies one or more authentication methods to validate switch or port access for the admin user. Note: Admin is the only user on the system and is assigned to a preconfigured list named defaultList, which you cannot delete.
GS716Tv2 and GS724Tv3 Software Administration Manual 3. Use the menu in the 2 column to select the authentication method, if any, that should appear second in the selected authentication login list. This is the method that will be used if the first method times out. If you select a method that does not time out as the second method, the third method will not be tried. This parameter will not appear when you first create a new login list. 4.
GS716Tv2 and GS724Tv3 Software Administration Manual Configuring Management Access From the Access page, you can configure HTTP and Secure HTTP access to the GS716T or GS724T management interface. You can also configure Access Control Profiles and Access Rules.
GS716Tv2 and GS724Tv3 Software Administration Manual This timeout is unaffected by the activity level of the session. The value must be in the range of (0–168) hours. A value of zero corresponds to an infinite timeout. The default value is 24 hours. The currently configured value is shown when the Web page is displayed. 4. In the Maximum Number of HTTP Sessions field, specify the maximum number of HTTP sessions that can exist at the same time. The value must be in the range of (0–16).
GS716Tv2 and GS724Tv3 Software Administration Manual The currently configured value is shown when the Web page is displayed. The default value is Disable. You can only download SSL certificates when the HTTPS Admin mode is disabled. 2. Use the radio buttons in the SSL Version 3 field to enable or disable Secure Sockets Layer Version 3.0. The currently configured value is shown when the Web page is displayed. The default value is Enable. 3.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure the certificate download settings for HTTPS sessions: 1. From the File Type menu, select the type of SSL certificate to download, which can be one of the following: • SSL Trusted Root Certificate PEM File. SSL Trusted Root Certificate File (PEM Encoded). • SSL Server Certificate PEM File. SSL Server Certificate File (PEM Encoded). • SSL DH Weak Encryption Parameter PEM File. SSL Diffie-Hellman Weak Encryption Parameter File (PEM Encoded).
GS716Tv2 and GS724Tv3 Software Administration Manual Access Profile Configuration Use the Access Profile Configuration page to configure settings that control management access to the switch. Access profile configuration requires three steps: 1. Use the Access Profile Configuration page to create an access profile. To add rules to the profile, the access profile must be deactivated, which is the default setting. 2. Use the Access Rule Configuration page to add one or more access rules to the profile. 3.
GS716Tv2 and GS724Tv3 Software Administration Manual The Profile Summary table shows the rules that are configured for the profile, as the following table describes. Field Description Rule Type Identifies the action the rule takes, which is either Permit or Deny. Service Type Displays the type of service to allow or prohibit from accessing the switch management interface: • SNMP • HTTP • HTTPS Source IP Address Displays the IP Address of the client that may or may not originate management traffic.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure access profile rules: 1. To add an access profile rule, configure the following settings and click Add. • Rule Type: Specify whether the rule permits or denies access to the GS716T or GS724T management interface. • • Select Permit to allow access to the management interface for traffic that meets the criteria you configure for the rule. Any traffic that does not meet the rules is denied.
GS716Tv2 and GS724Tv3 Software Administration Manual Port Authentication In port-based authentication mode, when 802.1X is enabled globally and on the port, successful authentication of any one supplicant attached to the port results in all users being able to use the port without restrictions. At any given time, only one supplicant is allowed to attempt authentication on a port in this mode. Ports in this mode are under bidirectional control. This is the default authentication mode. The 802.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure global 802.1X settings: 1. Select the appropriate radio button in the Port Based Authentication State field to enable or disable 802.1X administrative mode on the switch. • Enable. Port-based authentication is permitted on the switch. Note: If 802.1X is enabled, authentication is performed by a RADIUS server. This means the primary authentication method must be RADIUS.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure 802.
GS716Tv2 and GS724Tv3 Software Administration Manual 1. Select the check box next to the port to configure. You can also select multiple check boxes to apply the same settings to the select ports, or select the check box in the heading row to apply the same settings to all ports. 2. For the selected port(s), specify the following settings: • Port Control. Defines the port authorization state. The control mode is only set if the link status of the port is link up.
GS716Tv2 and GS724Tv3 Software Administration Manual • Supplicant Timeout. Defines the amount of time that lapses before EAP requests are resent to the user. The field value is in seconds. The field default is 30 seconds. • Server Timeout. Defines the amount of time that lapses before the switch resends a request to the authentication server. The field value is in seconds. The range is 1–65535, and the field default is 30 seconds. • Control Direction.
GS716Tv2 and GS724Tv3 Software Administration Manual 4. Click Initialize to begin the initialization sequence on the selected port(s). This button is only selectable if the control mode is auto. If the button is not selectable, it will be grayed out. When this button is clicked, the action is immediate. It is not required to click Apply for the action to occur. 5. Click Reauthenticate to begin the reauthentication sequence on the selected port. This button is only selectable if the control mode is auto.
GS716Tv2 and GS724Tv3 Software Administration Manual The following table describes the fields on the Port Summary page. Field Description Port The port whose settings are displayed in the current table row. Control Mode Defines the port authorization state. The control mode is only set if the link status of the port is link up. The possible field values are: • Auto: Automatically detects the mode of the interface.
GS716Tv2 and GS724Tv3 Software Administration Manual • • Security MAC Address on page 181 Protected Ports Membership on page 181 MAC Filter Configuration Use the MAC Filter Configuration page to create MAC filters that limit the traffic allowed into and out of specified ports on the system. To display the MAC Filter Configuration page, click Security Traffic Control, and then click the MAC Filter MAC Filter Configuration link. To configure MAC filter settings: 1. To configure a new MAC filter: a.
GS716Tv2 and GS724Tv3 Software Administration Manual e. Click the orange bar under the Destination Port Members heading to display the available ports. Select the port(s) to include in the outbound filter. Packets with the MAC address and VLAN ID you selected will be transmitted only out of ports that are in the list. Destination ports can be included only in the Multicast filter. 2. To delete a configured MAC Filter, select it from the menu, and then click Delete. 3.
GS716Tv2 and GS724Tv3 Software Administration Manual Storm Control A broadcast storm is the result of an excessive number of broadcast messages simultaneously transmitted across a network by a single port. Forwarded message responses can overload network resources and/or cause the network to time out. The switch measures the incoming broadcast/multicast/unknown unicast packet rate per port and discards packets when the rate exceeds the defined value.
GS716Tv2 and GS724Tv3 Software Administration Manual • Disable. Do not use storm control. • Unknown Unicast. If the rate of unknown L2 unicast (destination lookup failure) traffic ingressing on an interface increases beyond the configured threshold, the traffic will be dropped. • Multicast. If the rate of L2 multicast traffic ingressing on an interface increases beyond the configured threshold, the traffic will be dropped. • Broadcast.
GS716Tv2 and GS724Tv3 Software Administration Manual 3. If you change the mode, click Apply to apply the change to the system. The Port Security Violation table shows information about violations that occurred on ports that are enabled for port security. The following table describes the fields in the Port Security Violation table. Field Description Port Identifies the port where a violation occurred.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure port security settings: 1. To configure port security settings for a physical port, click PORTS. 2. To configure port security settings for a Link Aggregation Group (LAG), click LAGS. 3. To configure port security settings for both physical ports and LAGs, click ALL. 4. Select the check box next to the port or LAG to configure. Select multiple check boxes to apply the same setting to all selected interfaces.
GS716Tv2 and GS724Tv3 Software Administration Manual 7. If you make changes to the page, click Apply to apply the changes to the system. Security MAC Address Use the Security MAC Address page to convert a dynamically learned MAC address to a statically locked address. To display the Security MAC Address page, click Security Traffic Control, and then click the Port Security Security MAC Address link. To convert learned MAC addresses: 1. Select the Convert Dynamic Address to Static check box. 2.
GS716Tv2 and GS724Tv3 Software Administration Manual To display the Protected Ports Membership page, click the Security Traffic Control Protected Ports link. To configure protected ports: 1. Click the orange bar to display the available ports. 2. Click the box below each port to configure as a protected port. Protected ports are marked with an X. No traffic forwarding is possible between two protected ports. 3. Click Refresh to refresh the page with the most current data from the switch. 4.
GS716Tv2 and GS724Tv3 Software Administration Manual Configuring Access Control Lists Access Control Lists (ACLs) ensure that only authorized users have access to specific resources while blocking off any unwarranted attempts to reach network resources. ACLs are used to provide traffic flow control, restrict contents of routing updates, decide which types of traffic are forwarded or blocked, and above all provide security for the network. switch software supports IPv4 and MAC ACLs.
GS716Tv2 and GS724Tv3 Software Administration Manual To use the ACL Wizard: 1. Determine the type of ACL to configure and create a MAC ACL, standard IP ACL, or extended IP ACL. • To permit or deny traffic based on the Source MAC Address, create a MAC ACL. • To permit or deny traffic based on the Destination MAC Address, create a MAC ACL. • To permit or deny traffic based on the Source IP Address, create a Standard ACL.
GS716Tv2 and GS724Tv3 Software Administration Manual 1. Use the MAC ACL page to create the ACL ID. 2. Use the MAC Rules page to create rules for the ACL. 3. Use the MAC Binding Configuration page to assign the ACL by its ID number to a port. 4. Optionally, use the MAC Binding Table page to view the configurations. To display the MAC ACL page, click Security ACL. The MAC ACL page is under the Basic link.
GS716Tv2 and GS724Tv3 Software Administration Manual MAC Rules Use the MAC Rules page to define rules for MAC-based ACLs. The access list definition includes rules that specify whether traffic matching the criteria is forwarded normally or discarded. A default 'deny all' rule is the last rule of every list. To display the MAC Rules page, click Security ACL, then click the Basic MAC Rules link. To configure MAC ACL rules: 1.
GS716Tv2 and GS724Tv3 Software Administration Manual • Deny: Drops packets that meet the ACL criteria. • Assign Queue. Specifies the hardware egress queue identifier used to handle all packets matching this ACL rule. Enter an identifying number from 0–3 in this field. • Redirect Interface. Specifies the specific egress interface where the matching traffic stream is forced, bypassing any forwarding decision normally performed by the device. • Match Every.
GS716Tv2 and GS724Tv3 Software Administration Manual the value given for that bit. The valid format is xx:xx:xx:xx:xx:xx. A MAC mask of 00:00:00:00:00:00 matches a single MAC address. • VLAN. Requires a packet’s VLAN ID to match the ID listed here. Enter the VLAN ID to apply this criteria. The valid range is 1–4093. • Secondary VLAN. Requires a match on the value of the layer 2 secondary VLAN Identifier field (the inner 802.1Q tag of a double-VLAN tagged packet).
GS716Tv2 and GS724Tv3 Software Administration Manual A low number indicates high precedence order. If a sequence number is already in use for this interface and direction, the specified access list replaces the currently attached access list using that sequence number. If the sequence number is not specified by the user, a sequence number that is one greater than the highest sequence number currently in use for this interface and direction will be used. The valid range is 1–4294967295. 3.
GS716Tv2 and GS724Tv3 Software Administration Manual The following table describes the information displayed in the MAC Binding Table. Field Description Interface Displays the interface to which the MAC ACL is bound. Direction Specifies the packet filtering direction for ACL. The only valid direction is Inbound, which means the MAC ACL rules are applied to traffic entering the port. ACL Type Displays the type of ACL assigned to selected interface and direction.
GS716Tv2 and GS724Tv3 Software Administration Manual The IP ACL area shows the current size of the ACL table versus the maximum size of the ACL table. The current size is equal to the number of configured IPv4 plus the number of configured MAC ACLs. The maximum size is 100. To configure an IP ACL: 1. In the IP ACL ID field, specify the ACL ID. The ID is an integer in the following range: • 1–99: Creates an IP Standard ACL, which allows you to permit or deny traffic from a source IP address.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure rules for an IP ACL: 1. To add an IP ACL rule, select the ACL ID to add the rule to, complete the fields described in the following list, and click Add. • Rule ID. Specify a number from 1–10 to identify the IP ACL rule. You can create up to 10 rules for each ACL. • Action. Selects the ACL forwarding action, which is one of the following: • Permit. Forwards packets which meet the ACL criteria. • Deny.
GS716Tv2 and GS724Tv3 Software Administration Manual subnet mask. A wildcard mask is in essence the inverse of a subnet mask. For example, to apply the rule to all hosts in the 192.168.1.0/24 subnet, you type 0.0.0.255 in the Source IP Mask field. This field is required when you configure a source IP address. 2. To delete an IP ACL rule, select the check box associated with the rule, and then click Delete. 3.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure rules for an IP ACL: 1. To add an IP ACL rule to an extended IP ACL, select the ACL ID to add the rule to, select the check box in the Extended ACL Rule table, and click Add. Note: The ACL you select must have an ACL ID between 100 and 199. The page displays the extended ACL Rule Configuration fields. 2. Configure the new rule. • Rule ID. Specify a number from 1–10 to identify the IP ACL rule. You can create up to 10 rules for each ACL.
GS716Tv2 and GS724Tv3 Software Administration Manual • Protocol Type. Requires a packet’s protocol to match the protocol listed here. Select a type from the drop down menu or enter the protocol number in the available field. • Src IP Address. Requires a packet’s source IP address to match the address listed here. Type an IP Address in the appropriate field using dotted-decimal notation. The address you enter is compared to a packet's source IP Address. • Src IP Mask.
GS716Tv2 and GS724Tv3 Software Administration Manual DSCP value from the menu. To specify a numeric value in the available field, select Other from the menu and type an integer from 0 to 63 in the field. • IP Precedence: The IP Precedence field in a packet is defined as the high-order three bits of the Service Type octet in the IP header. This is an optional configuration. Enter an integer from 0 to 7. • IP TOS Bits: Matches on the Type of Service bits in the IP header when checked.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure IP ACL interface bindings: 1. Select an existing IP ACL from the ACL ID menu. The packet filtering direction for ACL is Inbound, which means the IP ACL rules are applied to traffic entering the port. 2. Specify an optional sequence number to indicate the order of this access list relative to other access lists already assigned to this interface and direction. A low number indicates high precedence order.
GS716Tv2 and GS724Tv3 Software Administration Manual IP Binding Table Use the IP Binding Table page to view or delete the IP ACL bindings. To display the IP Binding Table, click Security ACL, then click the Advanced Binding Table link. The following table describes the information displayed in the MAC Binding Table. Field Description Interface Displays the interface to which the IP ACL is bound. Direction Specifies the packet filtering direction for ACL.
6. 6 Monitoring the System Use the features available from the Monitoring tab to view a variety of information about the switch and its ports and to configure how the switch monitors events.
GS716Tv2 and GS724Tv3 Software Administration Manual Ports The pages available from the Ports link contain a variety of information about the number and type of traffic transmitted from and received on the switch.
GS716Tv2 and GS724Tv3 Software Administration Manual Switch Statistics The Switch Statistics page displays detailed statistical information about the traffic the switch handles. To access the Switch Statistics page, click Monitoring Ports Switch Statistics. The following table describes the Switch Statistics displayed on the screen. Field Description ifIndex This object indicates the ifIndex of the interface table entry associated with the processor of this switch.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Multicast Packets Received The total number of packets received that were directed to a multicast address. This number does not include packets directed to the broadcast address. Broadcast Packets Received The total number of packets received that were directed to the broadcast address. This does not include multicast packets.
GS716Tv2 and GS724Tv3 Software Administration Manual Use the buttons at the bottom of the page to perform the following actions: • Click Clear to clear all the statistics counters, resetting all switch summary and detailed statistics to default values. The discarded packets count cannot be cleared. • Click Refresh to refresh the page with the most current data from the switch. Port Statistics The Port Statistics page displays a summary of per-port traffic statistics on the switch.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Broadcast Packets Received The total number of good packets received that were directed to the broadcast address. This does not include multicast packets. Packets Transmitted Without The number of frames that have been transmitted by this port to its segment. Errors Transmit Packet Errors The number of outbound packets that could not be transmitted because of errors.
GS716Tv2 and GS724Tv3 Software Administration Manual Port Detailed Statistics The Port Detailed Statistics page displays a variety of per-port traffic statistics. To access the Port Detailed page, click the Monitoring Ports tab, and then click Port Detailed Statistics. (The Port Detailed Statistics figure shows some, but not all, of the fields on the page.) The following table describes the detailed port information displayed on the screen.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Port Channel ID If the port is a member of a port channel, the port channel's interface ID and name are shown. Otherwise, Disable is shown. Port Role Each MST Bridge Port that is enabled is assigned a Port Role for each spanning tree. The port role will be one of the following values: Root Port, Designated Port, Alternate Port, Backup Port, Master Port, or Disabled Port.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Packets RX and TX 128-255 Octets The total number of packets (including bad packets) received or transmitted that were between 128 and 255 octets in length inclusive (excluding framing bits but including FCS octets). Packets RX and TX 256-511 Octets The total number of packets (including bad packets) received or transmitted that were between 256 and 511 octets in length inclusive (excluding framing bits but including FCS octets).
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Unicast Packets Received The number of subnetwork-unicast packets delivered to a higher-layer protocol. Multicast Packets Received The total number of good packets received that were directed to a multicast address. This number does not include packets directed to the broadcast address. Broadcast Packets Received The total number of good packets received that were directed to the broadcast address.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Reserved Address Discards The number of frames discarded that are destined to an IEEE 802.1 reserved address and are not supported by the system. Broadcast Storm Recovery The number of frames discarded that are destined for FF:FF:FF:FF:FF:FF when Broadcast Storm Recovery is enabled. CFI Discards The number of frames discarded that have CFI bit set and the addresses in RIF are in non-canonical format.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Broadcast Packets Transmitted The total number of packets that higher-level protocols requested be transmitted to the Broadcast address, including those that were discarded or not sent. Total Transmit Errors The sum of Single, Multiple, and Excessive Collisions.
GS716Tv2 and GS724Tv3 Software Administration Manual Use the buttons at the bottom of the page to perform the following actions: • Click Clear to clear all the counters. This resets all statistics for this port to the default values. • Click Refresh to refresh the data on the screen and display the most current statistics. EAP Statistics Use the EAP Statistics page to display information about EAP packets received on a specific port.
GS716Tv2 and GS724Tv3 Software Administration Manual The following table describes the EAP statistics displayed on the screen. Field Description Ports Specifies the interface which is polled for statistics. Frames Received Displays the number of valid EAPOL frames received on the port. Frames Transmitted Displays the number of EAPOL frames transmitted through the port. Start Frames Received Displays the number of EAPOL Start frames received on the port.
GS716Tv2 and GS724Tv3 Software Administration Manual System Logs The switch may generate messages in response to events, faults, or errors occurring on the platform as well as changes in configuration or other occurrences. These messages are stored locally and can be forwarded to one or more centralized points of collection for monitoring purposes or long term archival storage.
GS716Tv2 and GS724Tv3 Software Administration Manual Memory Logs The in-memory log stores messages in memory based upon the settings for message component and severity. Use the Memory Logs page to set the administrative status and behavior of logs in the system buffer. These log messages are cleared when the switch reboots. To access the Memory Log page, click the Monitoring Logs tab, and then click the Memory Log link. T o configure the Memory Log settings: 1.
GS716Tv2 and GS724Tv3 Software Administration Manual The Memory Log table also appears on the Memory Log page. Field Description Total Number of Messages Displays the number of messages the system has logged in memory. Only the 64 most recent entries are displayed on the page. The rest of the page displays the Memory Log messages. The format of the log message is the same for messages that are displayed for the message log, persistent log, or console log.
GS716Tv2 and GS724Tv3 Software Administration Manual • The second log type is the system operation log. The system operation log stores the last N messages received during system operation. This log always has the log full operation attribute set to overwrite. This log can store up to 1000 messages. Either the system startup log or the system operation log stores a message received by the log subsystem that meets the storage criteria, but not both.
GS716Tv2 and GS724Tv3 Software Administration Manual • Critical (2): The third highest warning level. A critical log is saved if a critical device malfunction occurs, for example, two device ports are not functioning, while the rest of the device ports remain functional. • Error (3): A device error has occurred, such as if a port is offline. • Warning (4): The lowest level of a device warning. • Notice (5): Normal but significant conditions.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure local log server settings: 1. Use the radio buttons in the Admin Status field to determine whether to send log messages to the remote syslog hosts configured on the switch. • Enable: Messages will be sent to all configured hosts (syslog collectors or relays) using the values configured for each host. • Disable: Stops logging to all syslog hosts. Disable means no messages will be sent to any collector/relay. 2.
GS716Tv2 and GS724Tv3 Software Administration Manual 3. To modify the settings for an existing host, select the check box next to the host, change the desired information, and click Apply. 4. Click Cancel to cancel the configuration on the screen and reset the data on the screen to the latest value of the switch. The Status field in the Server Configuration table shows whether the remote logging host is currently active.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Log The sequence number of this trap. System Up Time The time at which this trap occurred, expressed in days, hours, minutes, and seconds since the last reboot of the switch. Trap Information identifying the trap. Click Clear Counters to clear all the counters. This resets all statistics for the trap logs to the default values.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Code The event code passed to the event log handler by the code reporting the event. Time The time the event occurred, measured from the previous reset. Use the buttons at the bottom of the page to perform the following actions: • Click Clear to clear the messages out of the Event Log. • Click Refresh to refresh the data on the screen and display the most current information.
GS716Tv2 and GS724Tv3 Software Administration Manual Port Mirroring The page under the Mirroring link allows you to view and configure port mirroring on the system. Multiple Port Mirroring Port mirroring selects the network traffic for analysis by a network analyzer. This is done for specific ports of the switch. As such, many switch ports are configured as source ports and one switch port is configured as a destination port. You have the ability to configure how traffic is mirrored on a source port.
GS716Tv2 and GS724Tv3 Software Administration Manual To configure Port Mirroring: 1. Select the check box next to a port to configure it as a source port. 2. In the Destination Port field, specify the port to which port traffic is be copied. Use the e1, e2,...format to specify the port. You can configure only one destination port on the system. 3. From the Session Mode menu, select the mode for port mirroring on the selected port: • Enable. Multiple Port Mirroring is active on the selected port.
GS716Tv2 and GS724Tv3 Software Administration Manual 224 | Chapter 6: Monitoring the System
7. 7 Maintenance Use the features available from the Maintenance tab to help you manage the switch.
GS716Tv2 and GS724Tv3 Software Administration Manual Reset The Reset menu contains links to the following options: • Device Reboot on page 226 • Factory Default on page 226 Device Reboot Use the Device Reboot page to reboot the GS716T or GS724T. To access the Device Reboot page, click Maintenance Reset Device Reboot. To reboot the switch: 1. Select the check box on the page. 2. Click Apply. The switch resets immediately.
GS716Tv2 and GS724Tv3 Software Administration Manual To reset the switch to the factory default settings: 1. Select the check box on the page. 2. Click Apply. The switch resets immediately.
GS716Tv2 and GS724Tv3 Software Administration Manual Upload File From Switch The switch supports system file uploads from the switch to a remote system by using TFTP. Use the File Upload page to upload configuration (ASCII), log (ASCII), and image (binary) files from the switch to an TFTP server on the network. To display the File Upload page, click Maintenance Upload File Upload. To upload a file from the switch to the TFTP server: 1.
GS716Tv2 and GS724Tv3 Software Administration Manual 5. In the Transfer File Path field, specify the path on the TFTP server where you want to put the file. You may enter up to 32 characters. Include the backslash at the end of the path. A path name with a space is not accepted. Leave this field blank to save the file to the root TFTP directory. 6. In the Transfer File Name field, specify a destination file name for the file to upload. You may enter up to 32 characters.
GS716Tv2 and GS724Tv3 Software Administration Manual Download File To Switch The switch supports system file downloads from a remote system to the switch by using either TFTP or HTTP. The Download menu contains links to the following options: • TFTP File Download on page 230 • HTTP File Download on page 232 TFTP File Download Use the Download File to Switch page to download device software, the image file, the configuration files and SSL files from a TFTP server to the switch.
GS716Tv2 and GS724Tv3 Software Administration Manual while the other image stores a second copy. The device boots and runs from the active image. If the active image is corrupt, the system automatically boots from the non-active image. This is a safety feature for faults occurring during the boot upgrade process.
GS716Tv2 and GS724Tv3 Software Administration Manual To activate a software image that you download to the switch, see File Management on page 234. HTTP File Download Use the HTTP File Download page to download files of various types to the switch using an HTTP session (for example, via your Web browser). To display this page, click Maintenance Download HTTP File Download. To download a file to the switch from by using HTTP: 1.
GS716Tv2 and GS724Tv3 Software Administration Manual • SSL DH Strong Encryption Parameter PEM File: SSL Diffie-Hellman Strong Encryption Parameter File (PEM Encoded). 2. If you are downloading an GS716T or GS724T image (Code), select the image on the switch to overwrite. This field is only visible when Code is selected as the File Type. Note: It is recommended that you not overwrite the active image. The system will display a warning that you are trying to overwrite the active image. 3.
GS716Tv2 and GS724Tv3 Software Administration Manual File Management The system maintains two versions of the GS716T or GS724T software in permanent storage. One image is the active image, and the second image is the backup image. The active image is loaded during subsequent switch restarts. This feature reduces switch down time when upgrading or downgrading the GS716T or GS724T software.
GS716Tv2 and GS724Tv3 Software Administration Manual Note: After activating an image, you must perform a system reset of the switch in order to run the new code. 4. To remove the selected image from permanent storage on the switch, select the Delete Image check box. You cannot delete the active image. 5. Click Cancel to cancel the operation on the screen and reset the data on the screen to the latest value of the switch. 6. Click Apply to apply the settings to the switch.
GS716Tv2 and GS724Tv3 Software Administration Manual Field Description Current-active Displays the currently active image on this switch. Next-active Displays the image to be used on the next restart of this switch. Image1 Description Displays the description associated with the image1 code file. Image2 Description Displays the description associated with the image2 code file. Click Refresh to display the latest information from the switch.
GS716Tv2 and GS724Tv3 Software Administration Manual Troubleshooting The Troubleshooting menu contains links to the following options: • Ping on page 237 • Traceroute on page 238 Ping Use the Ping page to tell the switch to send a Ping request to a specified IP address. You can use this feature to check whether the switch can communicate with a particular network host. To access the Ping page, click Maintenance Troubleshooting Ping. To configure the settings and ping a host on the network: 1.
GS716Tv2 and GS724Tv3 Software Administration Manual • If successful, you will see “Reply From IP/Host: icmp_seq = 0. time = xx usec. Tx = x, Rx = x Min/Max/Avg RTT = x/x/x msec.” • If a reply to the ping is not received, you will see “Reply From IP/Host: Destination Unreachable. Tx = x, Rx = 0 Min/Max/Avg RTT = 0/0/0 msec”. Traceroute Use the Traceroute utility to discover the paths that a packet takes to a remote destination. To display this page, click Maintenance Troubleshooting Traceroute.
GS716Tv2 and GS724Tv3 Software Administration Manual • MaxFail. Specify the maximum number of failures allowed in the session. The valid range is 0–255. • Interval. Specify the time between probes in seconds. The valid range is 1–60. • Port. Specify the UDP destination port in probe packets. The valid range is 1–65535. • Size. Specify the size of probe packets. The valid range is 0–65507. 3.
GS716Tv2 and GS724Tv3 Software Administration Manual 240 | Chapter 7: Maintenance
8. 8 Help Use the features available from the Help tab to connect to online resources for assistance. The Help tab contains a link to Online Help. Online Help The Online Help includes the following pages: • Support on page 241 • User Guide on page 242 Support Use the Support page to connect to the Online Support site at netgear.com. To access the Support page, click Help Support. To connect to the NETGEAR support site for the GS716T or GS724T, click Apply.
GS716Tv2 and GS724Tv3 Software Administration Manual User Guide Use the User Guide page to access the GS716Tv2 and GS724Tv3 Software Administration Manual (the guide you are now reading) that is available on the NETGEAR Website. To access the User Guide page, click Help User Guide. To access to the User Guide that is available online, click Apply.
GS716Tv2 and GS724Tv3 Software Administration Manual Chapter 8: Help | 243
A. Hardware Specifications and Default Values A GS716T and GS724T Gigabit Smart Switches Specifications The GS716T and GS724T Gigabit Smart Switches conform to the TCP/IP, UDP, HTTP, ICMP, TFTP, DHCP, IEEE 802.1D, IEEE 802.1p, and IEEE 802.1Q standards.
GS716Tv2 and GS724Tv3 Software Administration Manual GS716T and GS724T Switch Performance Feature Value Switching capacity Non-Blocking Full WireSpeed on all packet sizes Forwarding method Store and Forward Packet forwarding rate 10M:14,880 pps/ 100M:148,810 pps/ 1G:1,488,000 pps MAC addresses 4K Green Ethernet Power consumption savings by cable length (<10m) Automatic power down on port when link is down GS716T and GS724T Switch Features and Defaults Port Characteristics Feature Sets Supporte
GS716Tv2 and GS724Tv3 Software Administration Manual Traffic Control Feature Sets Supported Default Storm control All ports Disabled Jumbo frame All ports Disabled Max = 9216 bytes Feature Sets Supported Default Number of queues 4 N/A Port based N/A N/A 802.1p 1 Enabled DSCP 1 Disabled Rate limiting All ports Disabled Auto-QoS All ports Disabled Feature Sets Supported Default 802.
GS716Tv2 and GS724Tv3 Software Administration Manual System Setup Feature Sets Supported Default Boot code update 1 N/A DHCP/manual IP 1 DHCP enabled/192.168.0.239 Default gateway 1 192.168.0.
GS716Tv2 and GS724Tv3 Software Administration Manual Other Features Feature Sets Supported Default IGMP snooping v1/v2 All ports Disabled Configurations upload/download 1 N/A EAPoL flooding All ports Disabled BPDU flooding All ports Disabled Static multicast groups 8 Disabled Filter multicast control 1 Disabled 248 | Appendix A: Hardware Specifications and Default Values
B. B Configuration Examples This chapter contains information about how to configure the following features: • Virtual Local Area Networks (VLANs) on page 250 • Access Control Lists (ACLs) on page 252 • Differentiated Services (DiffServ) on page 255 • 802.
GS716Tv2 and GS724Tv3 Software Administration Manual Virtual Local Area Networks (VLANs) A local area network (LAN) can generally be defined as a broadcast domain. Hubs, bridges, or switches in the same physical segment or segments connect all end node devices. End nodes can communicate with each other without the need for a router. Routers connect LANs together, routing the traffic to the appropriate port.
GS716Tv2 and GS724Tv3 Software Administration Manual • Packets leaving the switch are either tagged or untagged, depending on the setting for that port’s VLAN membership properties. A U for a given port means that packets leaving the switch from that port are untagged. Inversely, a T for a given port means that packets leaving the switch from that port are tagged with the VLAN ID that is associated with the port.
GS716Tv2 and GS724Tv3 Software Administration Manual Access Control Lists (ACLs) ACLs ensure that only authorized users have access to specific resources while blocking off any unwarranted attempts to reach network resources. ACLs are used to provide traffic flow control, restrict contents of routing updates, decide which types of traffic are forwarded or blocked, and provide security for the network.
GS716Tv2 and GS724Tv3 Software Administration Manual • Destination MAC Mask: 00:00:00:00:FF:FF • Source MAC: 02:02:1A:BC:DE:EF • Source MAC Mask: 00:00:00:00:FF:FF • VLAN ID: 2 For more information about MAC ACL rules, see MAC Rules on page 186. 3. From the MAC Binding Configuration screen, assign the Sales_ACL to Ethernet ports 6, 7, and 8, and then click Apply (See MAC Binding Configuration on page 188).
GS716Tv2 and GS724Tv3 Software Administration Manual departments. Traffic from the Finance department is identified by each packet’s network IP address. 1. From the IP ACL screen, create a new IP ACL with an IP ACL ID of 1 (See IP ACL on page 190). 2. From the IP Rules screen, create a rule for IP ACL 1 with the following settings: • Rule ID: 1 • Action: Deny • Assign Queue ID: 0 (optional: 0 is the default value) • Match Every: False • Source IP Address: 192.168.187.0 • Source IP Mask: 255.255.
GS716Tv2 and GS724Tv3 Software Administration Manual Differentiated Services (DiffServ) Standard IP-based networks are designed to provide best effort data delivery service. Best effort service implies that the network deliver the data in a timely fashion, although there is no guarantee that it will. During times of congestion, packets may be delayed, sent sporadically, or dropped.
GS716Tv2 and GS724Tv3 Software Administration Manual • IP Service Type octet (also known as: ToS bits, Precedence value, DSCP value) • Layer 4 protocol (TCP, UDP etc.) • Layer 4 source/destination ports • Source/destination IP address From a DiffServ point of view, there are two types of classes: • DiffServ traffic classes • DiffServ service levels/forwarding classes DiffServ Traffic Classes With DiffServ, you define which traffic classes to track on an ingress interface.
GS716Tv2 and GS724Tv3 Software Administration Manual • Dropping: drop a packet upon arrival. This is useful for emulating access control list operation using DiffServ, especially when DiffServ and ACL cannot co-exist on the same interface. • Marking IP DSCP or IP Precedence: marking/re-marking the DiffServ code point in a packet with the DSCP value representing the service level associated with a particular DiffServ traffic class.
GS716Tv2 and GS724Tv3 Software Administration Manual DiffServ Example Configuration To create a DiffServ Class/Policy and attach it to a switch interface, follow these steps: 1. From the QoS Class Configuration screen, create a new class with the following settings: • Class Name: Class1 • Class Type: All For more information about this screen, see Class Configuration on page 137. 2. Click the Class1 hyperlink to view the DiffServ Class Configuration screen for this class. 3.
GS716Tv2 and GS724Tv3 Software Administration Manual All UDP packet flows destined to the 192.12.2.0 network with an IP source address from the 192.12.1.0 network that have a Layer 4 Source port of 4567 and Destination port of 4568 from this switch on ports 7 and 8 are assigned to hardware queue 3. On this network, traffic from streaming applications uses UDP port 4567 as the source and 4568 as the destination. This real-time traffic is time sensitive, so it is assigned to a high-priority hardware queue.
GS716Tv2 and GS724Tv3 Software Administration Manual 802.1X Local Area Networks (LANs) are often deployed in environments that permit unauthorized devices to be physically attached to the LAN infrastructure, or permit unauthorized users to attempt to access the LAN through equipment already attached. In such environments, it may be desirable to restrict access to the services offered by the LAN to those users and devices that are permitted to use those services.
GS716Tv2 and GS724Tv3 Software Administration Manual A Port Access Entity (PAE) is able to adopt one of two distinct roles within an access control interaction: 1. Authenticator: A Port that enforces authentication before allowing access to services available via that Port. 2. Supplicant: A Port that attempts to access services offered by the Authenticator. Additionally, there exists a third role: 3.
GS716Tv2 and GS724Tv3 Software Administration Manual 3. In the Guest VLAN field for ports e1–e8, enter 150 to assign these ports to the guest VLAN. You can configure additional settings to control access to the network through the ports. See Port Security Interface Configuration on page 179 for information about the settings. 4. Click Apply. 5. From the 802.
GS716Tv2 and GS724Tv3 Software Administration Manual MSTP Spanning Tree Protocol (STP) runs on bridged networks to help eliminate loops. If a bridge loop occurs, the network can become flooded with traffic. IEEE 802.1s Multiple Spanning Tree Protocol (MSTP) supports multiple instances of Spanning Tree to efficiently channel VLAN traffic over different interfaces. Each instance of the Spanning Tree behaves in the manner specified in IEEE 802.
GS716Tv2 and GS724Tv3 Software Administration Manual An MST Region comprises of one or more MSTP Bridges with the same MST Configuration Identifier, using the same MSTIs, and which have no Bridges attached that cannot receive and transmit MSTP BPDUs. The MST Configuration Identifier has the following components: 1. Configuration Identifier Format Selector 2. Configuration Name 3. Configuration Revision Level 4.
GS716Tv2 and GS724Tv3 Software Administration Manual Ports e1-e5 Connected to Hosts Ports e1-e5 Connected to Hosts Ports e6-e8 Connected to Switch 2 and 3 Switch 1 Root Bridge Switch 2 Ports e6-e8 Connected to Switch 1 and 2 Switch 3 Ports e1-e5 Connected to Hosts Perform the following procedures on each switch to configure MSTP: 1. Use the VLAN Configuration screen to create VLANs 300 and 500 (see VLAN Configuration on page 80). 2.
GS716Tv2 and GS724Tv3 Software Administration Manual Since the edge ports are not at risk for network loops, ports with Fast Link enabled transition directly to the Forwarding state. 8. Click Apply. You can use the CST Port Status screen to view spanning tree information about each port. 9. From the MST Configuration screen, create a MST instances with the following settings: • MST ID: 1 • Priority: Use the default (32768) • VLAN ID: 300 For more information, see MST Configuration on page 103. 10.
GS716Tv2 and GS724Tv3 Software Administration Manual Appendix B: Configuration Examples | 267
C. Notification of Compliance NETGEAR Wired Products C Certificate of the Manufacturer/Importer It is hereby certified that the ProSafe™ GS716T and 724T Gigabit Smart Switches has been suppressed in accordance with the conditions set out in the BMPT-AmtsblVfg 243/1991 and Vfg 46/1992. The operation of some equipment (for example, test transmitters) in accordance with the regulations may, however, be subject to certain restrictions. Please refer to the notes in the operating instructions.
GS716Tv2 and GS724Tv3 Software Administration Manual Europe – EU Declaration of Conformity Marking by the above symbol indicates compliance with the Essential Requirements of the R&TTE Directive of the European Union (1999/5/EC). This equipment meets the following conformance standards: EN300 328, EN301 489-17, EN60950 For complete DoC please visit the NETGEAR EU Declarations of Conformity website at: http://kb.netgear.
GS716Tv2 and GS724Tv3 Software Administration Manual EDOC in Languages of the European Community Malti [Maltese] Hawnhekk, NETGEAR Inc., jiddikjara li dan Radiolan jikkonforma mal-htigijiet essenzjali u ma provvedimenti ohrajn relevanti li hemm fid-Dirrettiva 1999/5/EC. Magyar [Hungarian] Alulírott, NETGEAR Inc. nyilatkozom, hogy a Radiolan megfelel a vonatkozó alapvetõ követelményeknek és az 1999/5/EC irányelv egyéb elõírásainak. Polski [Polish] Niniejszym NETGEAR Inc.
GS716Tv2 and GS724Tv3 Software Administration Manual FCC Radio Frequency Interference Warnings & Instructions This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation.
Index Numerics 802.1X 151, 168 example configuration 260 A access control ACL example configuration 252 ACLs 183 management interface 161 authentication 802.1X 168, 260 enable 28 list 159 port-based 168 RADIUS 151, 153 SNMP 28, 50, 51 TACACS+ 156 Auto-Video 109 C certificate 163 changing the password 19, 150 Configuration 802.
GS716Tv2 and GS724Tv3 Software Administration Manual E L EAP 211 EAPOL 212 LACP port configuration 78 LAG VLAN 74 LAGPDUs 74 LAGs 74 Membership 76 Static 74 LLDP 52 Local Information 57 neighbors information 60 packets 53 port settings 53 LLDP-MED 52 F file management 234 firmware 21 firmware download 230 G getting started 10 Green Ethernet 46, 72 guest VLAN configuration 261 H help, HTML-based 26 HTTP 161 management interface access 18 secure 161 using to download files 232 HTTPS 162 I ICMP 41 IEEE
GS716Tv2 and GS724Tv3 Software Administration Manual R RADIUS 150 server 151 statistics 153 reboot 19, 226 reset button 151 configuration to defaults 226 switch 226 RSTP 93 S Security MAC Address 181 server, HTTP 161 severity, log message 216 Simple Network Time Protocol 35 SNMP traps 49 using 28 v1, v2 47 v3 51 SNTP 35 Global Status 38 global status 38 server configuration 39 server status 40 specifications 244 SSL 162 storm control 177 STP 93 example configuration 263 Status 93 Stratum 0 35 1 35 2 35 T
GS716Tv2 and GS724Tv3 Software Administration Manual Index | 275
