GS-5220-Series User Manual
Table Of Contents
- 1. INTRODUCTION
- 2. INSTALLATION
- 3. SWITCH MANAGEMENT
- 4. WEB CONFIGURATION
- 4.1 Main Web Page
- 4.2 System
- 4.2.1 System Information
- 4.2.2 IP Configuration
- 4.2.3 IP Status
- 4.2.4 Users Configuration
- 4.2.5 Privilege Levels
- 4.2.6 NTP Configuration
- 4.2.7 Time Configuration
- 4.2.8 UPnP
- 4.2.9 DHCP Relay
- 4.2.10 DHCP Relay Statistics
- 4.2.11 CPU Load
- 4.2.12 System Log
- 4.2.13 Detailed Log
- 4.2.14 Remote Syslog
- 4.2.15 SMTP Configuration
- 4.2.16 Web Firmware Upgrade
- 4.2.17 TFTP Firmware Upgrade
- 4.2.18 Save Startup Config
- 4.2.19 Configuration Download
- 4.2.20 Configuration Upload
- 4.2.21 Configure Activate
- 4.2.22 Configure Delete
- 4.2.23 Image Select
- 4.2.24 Factory Default
- 4.2.25 System Reboot
- 4.3 Simple Network Management Protocol
- 4.4 Port Management
- 4.5 Link Aggregation
- 4.6 VLAN
- 4.7 Spanning Tree Protocol
- 4.8 Multicast
- 4.8.1 IGMP Snooping
- 4.8.2 Profile Table
- 4.8.3 Address Entry
- 4.8.4 IGMP Snooping Configuration
- 4.8.5 IGMP Snooping VLAN Configuration
- 4.8.6 IGMP Snooping Port Group Filtering
- 4.8.7 IGMP Snooping Status
- 4.8.8 IGMP Group Information
- 4.8.9 IGMPv3 Information
- 4.8.10 MLD Snooping Configuration
- 4.8.11 MLD Snooping VLAN Configuration
- 4.8.12 MLD Snooping Port Group Filtering
- 4.8.13 MLD Snooping Status
- 4.8.14 MLD Group Information
- 4.8.15 MLDv2 Information
- 4.8.16 MVR (Multicast VLAN Registration)
- 4.8.17 MVR Status
- 4.8.18 MVR Groups Information
- 4.8.19 MVR SFM Information
- 4.9 Quality of Service
- 4.9.1 Understanding QoS
- 4.9.2 Port Policing
- 4.9.3 Port Classification
- 4.9.4 Port Scheduler
- 4.9.5 Port Shaping
- 4.9.6 Port Tag Remarking
- 4.9.7 Port DSCP
- 4.9.8 DSCP-based QoS
- 4.9.9 DSCP Translation
- 4.9.10 DSCP Classification
- 4.9.11 QoS Control List
- 4.9.12 QCL Status
- 4.9.13 Storm Control Configuration
- 4.9.14 WRED
- 4.9.15 QoS Statistics
- 4.9.16 Voice VLAN Configuration
- 4.9.17 Voice VLAN OUI Table
- 4.10 Access Control Lists
- 4.11 Authentication
- 4.11.1 Understanding IEEE 802.1X Port-based Authentication
- 4.11.2 Authentication Configuration
- 4.11.3 Network Access Server Configuration
- 4.11.4 Network Access Overview
- 4.11.5 Network Access Statistics
- 4.11.6 RADIUS
- 4.11.7 TACACS+
- 4.11.8 RADIUS Overview
- 4.11.9 RADIUS Details
- 4.11.10 Windows Platform RADIUS Server Configuration
- 4.11.11 802.1X Client Configuration
- 4.12 Security
- 4.12.1 Port Limit Control
- 4.12.2 Access Management
- 4.12.3 Access Management Statistics
- 4.12.4 HTTPs
- 4.12.5 SSH
- 4.12.6 Port Security Status
- 4.12.7 Port Security Detail
- 4.12.8 DHCP Snooping
- 4.12.9 Snooping Table
- 4.12.10 IP Source Guard Configuration
- 4.12.11 IP Source Guard Static Table
- 4.12.12 ARP Inspection
- 4.12.13 ARP Inspection Static Table
- 4.12.14 Dynamic ARP Inspection Table
- 4.13 Address Table
- 4.14 LLDP
- 4.15 Network Diagnostics
- 4.16 Power over Ethernet
- 4.17 Loop Protection
- 4.18 RMON
- 4.19 ONVIF
- 5. SWITCH OPERATION
- 6. TROUBLESHOOTING
- APPENDIX A: Networking Connection
- APPENDIX B : GLOSSARY
User’s Manual of GS-5220 Ultra PoE & PoE+ Series
257
Access-Accept packet transmitted by the RADIUS server when a supplicant is
successfully authenticated. If present and valid, the port's Port VLAN ID will be
changed to this VLAN ID, the port will be set to be a member of that VLAN ID,
and the port will be forced into VLAN unaware mode. Once assigned, all traffic
arriving on the port will be classified and switched on the RADIUS-assigned
VLAN ID.
If (re-)authentication fails or the RADIUS Access-Accept packet no longer carries
a VLAN ID or it's invalid, or the supplicant is otherwise no longer present on the
port, the port's VLAN ID is immediately reverted to the original VLAN ID (which
may be changed by the administrator in the meanwhile without affecting the
RADIUS-assigned).
This option is only available for single-client modes, i.e.
Port-based 802.1X
Single 802.1X
For troubleshooting VLAN assignments, refer to the "Monitor→VLANs→VLAN
Membership and VLAN Port" pages. These pages show which modules have
(temporarily) overridden the current Port VLAN configuration.
RADIUS attributes used in identifying a VLAN ID:
RFC2868 and RFC3580 form the basis for the attributes used in identifying a
VLAN ID in an Access-Accept packet. The following criteria are used:
The Tunnel-Medium-Type, Tunnel-Type, and Tunnel-Private-Group-ID
attributes must all be present at least once in the Access-Accept
packet.
The switch looks for the first set of these attributes that have the same
Tag value and fulfil the following requirements (if Tag == 0 is used, the
Tunnel-Private-Group-ID does not need to include a Tag):
Value of Tunnel-Medium-Type must be set to "IEEE-802" (ordinal 6).
Value of Tunnel-Type must be set to "VLAN" (ordinal 13).
Value of Tunnel-Private-Group-ID must be a string of ASCII chars in
the range '0' - '9', which is interpreted as a decimal string representing
the VLAN ID. Leading '0's are discarded. The final value must be in the
range [1; 4095].
• Guest VLAN Enabled
When Guest VLAN is both globally enabled and enabled (checked) for a given
port, the switch considers moving the port into the Guest VLAN according to the
rules outlined below.
This option is only available for EAPOL-based modes, i.e.: