Home » ZyXEL Manuals » Networking » ZyXEL XGS-4528F » Manual Viewer

ZyXEL XGS-4528F User Guide - Page 197

Port Security

Get ZyXEL XGS-4528F PDF manuals and user guides

Add to My Manuals
Save this manual to your list of manuals

Page 197 highlights

CHAPTER 19 Port Security This chapter shows you how to set up port security. 19.1 About Port Security Port security allows only packets with dynamically learned MAC addresses and/or configured static MAC addresses to pass through a port on the Switch. The XGS4728F can learn up to 16K MAC addresses in total with no limit on individual ports other than the sum cannot exceed 16K. The XGS-4526 or XGS-4528F can learn up to 8K MAC addresses in total with no limit on individual ports other than the sum cannot exceed 8K. For maximum port security, enable this feature, disable MAC address learning and configure static MAC address(es) for a port. It is not recommended you disable port security together with MAC address learning as this will result in many broadcasts. By default, MAC address learning is still enabled even though the port security is not activated. XGS-4526/4528F/4728F User's Guide 197

Section	Page
XGS-4526/4528F/4728F	1
About This User's Guide	3
Document Conventions	5
Safety Warnings	7
Contents Overview	9
Table of Contents	11
User’s Guide	25
Getting to Know Your Switch	27
1.1 Introduction	27
1.1.1 Bridging Example	27
1.1.2 High Performance Switching Example	28
1.1.3 Gigabit Ethernet to the Desktop	29
1.1.4 IEEE 802.1Q VLAN Application Example	29
1.1.5 IPv6 Support	30
1.2 Ways to Manage the Switch	30
1.3 Good Habits for Managing the Switch	31
Hardware Installation and Connection	33
2.1 Freestanding Installation	33
2.2 Mounting the Switch on a Rack	34
2.2.1 Rack-mounted Installation Requirements	34
2.2.2 Attaching the Mounting Brackets to the Switch	34
2.2.3 Mounting the Switch on a Rack	35
Hardware Overview	37
3.1 Front Panel Connections	37
3.1.1 Dual Personality Interfaces	38
3.1.2 1000Base-T Ports	38
3.1.3 Mini-GBIC Slots	39
3.2 Rear Panel	41
3.2.1 XGS-4526	41
3.2.2 XGS-4528F or XGS-4728F	41
3.2.3 Uplink Module	42
3.2.4 Rear Panel Connections	42
3.2.5 Power Connector	43
3.2.6 External Backup Power Supply Connector	44
3.2.7 Console Port	44
3.3 LEDs	45
The Web Configurator	47
4.1 Introduction	47
4.2 System Login	47
4.3 The Web Configurator Layout	48
4.3.1 Change Your Password	53
4.4 Saving Your Configuration	54
4.5 Switch Lockout	54
4.6 Resetting the Switch	54
4.6.1 Reload the Configuration File	55
4.7 Logging Out of the Web Configurator	56
4.8 Help	56
Initial Setup Example	57
5.1 Overview	57
5.1.1 Configuring an IP Interface	57
5.1.2 Configuring DHCP Server Settings	59
5.1.3 Creating a VLAN	59
5.1.4 Setting Port VID	61
5.1.5 Enabling RIP	62
Tutorials	63
6.1 How to Use DHCP Snooping on the Switch	63
6.2 How to Use DHCP Relay on the Switch	67
6.2.1 DHCP Relay Tutorial Introduction	67
6.2.2 Creating a VLAN	68
6.2.3 Configuring DHCP Relay	71
6.2.4 Troubleshooting	71
6.3 How to Use PPPoE IA on the Switch	72
6.3.1 Configuring Switch A	73
6.3.2 Configuring Switch B	75
6.4 How to Use Error Disable and Recovery on the Switch	77
6.5 How to Set Up a Guest VLAN	80
6.5.1 Creating a Guest VLAN	81
6.5.2 Enabling IEEE 802.1x Port Authentication	83
6.5.3 Enabling Guest VLAN	84
6.6 How to Do Port Isolation in a VLAN	85
6.6.1 Creating a VLAN	86
6.6.2 Creating a Private VLAN Rule	89
6.7 How to Configure Routing Policy	90
6.7.1 Create a Layer-3 Classifier	90
6.7.2 Create a Policy Routing Rule	91
Technical Reference	93
System Status and Port Statistics	95
7.1 Overview	95
7.2 Port Status Summary	95
7.2.1 Status: Port Details	97
Basic Setting	101
8.1 Overview	101
8.2 System Information	102
8.3 General Setup	104
8.4 Introduction to VLANs	106
8.4.1 Smart Isolation	107
8.5 Switch Setup Screen	108
8.6 IP Setup	110
8.6.1 IP Interfaces	110
8.7 Port Setup	113
VLAN	117
9.1 Introduction to IEEE 802.1Q Tagged VLANs	117
9.1.1 Forwarding Tagged and Untagged Frames	117
9.2 Automatic VLAN Registration	118
9.2.1 GARP	118
9.2.2 GVRP	118
9.3 Port VLAN Trunking	119
9.4 Select the VLAN Type	120
9.5 Static VLAN	120
9.5.1 VLAN Status	121
9.5.2 VLAN Details	122
9.5.3 Configure a Static VLAN	122
9.5.4 Configure VLAN Port Settings	124
9.6 Subnet Based VLANs	126
9.7 Configuring Subnet Based VLAN	127
9.8 Protocol Based VLANs	128
9.9 Configuring Protocol Based VLAN	129
9.10 Create an IP-based VLAN Example	131
9.11 Port-based VLAN Setup	132
9.11.1 Configure a Port-based VLAN	132
Static MAC Forward Setup	137
10.1 Overview	137
10.2 Configuring Static MAC Forwarding	137
Static Multicast Forward Setup	141
11.1 Static Multicast Forwarding Overview	141
11.2 Configuring Static Multicast Forwarding	142
Filtering	145
12.1 Configure a Filtering Rule	145
Spanning Tree Protocol	147
13.1 STP/RSTP Overview	147
13.1.1 STP Terminology	147
13.1.2 How STP Works	148
13.1.3 STP Port States	149
13.1.4 Multiple RSTP	149
13.1.5 Multiple STP	150
13.2 Spanning Tree Protocol Status Screen	153
13.3 Spanning Tree Configuration	153
13.4 Configure Rapid Spanning Tree Protocol	154
13.5 Rapid Spanning Tree Protocol Status	156
13.6 Configure Multiple Rapid Spanning Tree Protocol	158
13.7 Multiple Rapid Spanning Tree Protocol Status	160
13.8 Configure Multiple Spanning Tree Protocol	162
13.8.1 Multiple Spanning Tree Protocol Port Configuration	165
13.9 Multiple Spanning Tree Protocol Status	166
Bandwidth Control	169
14.1 Bandwidth Control Overview	169
14.1.1 CIR and PIR	169
14.2 Bandwidth Control Setup	170
Broadcast Storm Control	173
15.1 Broadcast Storm Control Setup	173
Mirroring	175
16.1 Port Mirroring Setup	175
Link Aggregation	177
17.1 Link Aggregation Overview	177
17.2 Dynamic Link Aggregation	177
17.2.1 Link Aggregation ID	178
17.3 Link Aggregation Status	179
17.4 Link Aggregation Setting	181
17.5 Link Aggregation Control Protocol	183
17.6 Static Trunking Example	184
Port Authentication	187
18.1 Port Authentication Overview	187
18.1.1 IEEE 802.1x Authentication	187
18.1.2 MAC Authentication	188
18.2 Port Authentication Configuration	189
18.2.1 Activate IEEE 802.1x Security	190
18.2.2 Guest VLAN	191
18.2.3 Activate MAC Authentication	194
Port Security	197
19.1 About Port Security	197
19.2 Port Security Setup	198
19.3 VLAN MAC Address Limit	199
Classifier	201
20.1 About the Classifier and QoS	201
20.2 Configuring the Classifier	201
20.3 Viewing and Editing Classifier Configuration	204
20.4 Classifier Example	206
Policy Rule	207
21.1 Policy Rules Overview	207
21.1.1 DiffServ	207
21.1.2 DSCP and Per-Hop Behavior	207
21.2 Configuring Policy Rules	208
21.3 Viewing and Editing Policy Configuration	211
21.4 Policy Example	213
Queuing Method	215
22.1 Queuing Method Overview	215
22.1.1 Strictly Priority	215
22.1.2 Weighted Fair Queuing	215
22.1.3 Weighted Round Robin Scheduling (WRR)	216
22.2 Configuring Queuing	217
VLAN Stacking	219
23.1 VLAN Stacking Overview	219
23.1.1 VLAN Stacking Example	219
23.2 VLAN Stacking Port Roles	220
23.3 VLAN Tag Format	221
23.3.1 Frame Format	221
23.4 Configuring VLAN Stacking	222
23.4.1 Port-based Q-in-Q	223
23.4.2 Selective Q-in-Q	224
Multicast	227
24.1 Multicast Overview	227
24.1.1 IP Multicast Addresses	227
24.1.2 IGMP Filtering	227
24.1.3 IGMP Snooping	228
24.1.4 IGMP Snooping and VLANs	228
24.2 Multicast Status	228
24.3 Multicast Setting	229
24.4 IGMP Snooping VLAN	232
24.5 IGMP Filtering Profile	233
24.6 MVR Overview	235
24.6.1 Types of MVR Ports	235
24.6.2 MVR Modes	236
24.6.3 How MVR Works	236
24.7 General MVR Configuration	237
24.8 MVR Group Configuration	239
24.8.1 MVR Configuration Example	240
AAA	243
25.1 Authentication, Authorization and Accounting (AAA)	243
25.1.1 Local User Accounts	244
25.1.2 RADIUS and TACACS+	244
25.2 AAA Screens	244
25.2.1 RADIUS Server Setup	245
25.2.2 TACACS+ Server Setup	247
25.2.3 AAA Setup	249
25.2.4 Vendor Specific Attribute	252
25.2.5 Tunnel Protocol Attribute	253
25.3 Supported RADIUS Attributes	254
25.3.1 Attributes Used for Authentication	254
25.3.2 Attributes Used for Accounting	255
IP Source Guard	259
26.1 IP Source Guard Overview	259
26.1.1 DHCP Snooping Overview	260
26.1.2 ARP Inspection Overview	262
26.2 IP Source Guard	263
26.3 IP Source Guard Static Binding	264
26.4 DHCP Snooping	266
26.5 DHCP Snooping Configure	269
26.5.1 DHCP Snooping Port Configure	271
26.5.2 DHCP Snooping VLAN Configure	272
26.6 ARP Inspection Status	274
26.6.1 ARP Inspection VLAN Status	275
26.6.2 ARP Inspection Log Status	276
26.7 ARP Inspection Configure	277
26.7.1 ARP Inspection Port Configure	279
26.7.2 ARP Inspection VLAN Configure	280
Loop Guard	283
27.1 Loop Guard Overview	283
27.2 Loop Guard Setup	285
VLAN Mapping	287
28.1 VLAN Mapping Overview	287
28.1.1 VLAN Mapping Example	287
28.2 Enabling VLAN Mapping	288
28.3 Configuring VLAN Mapping	289
Layer 2 Protocol Tunneling	291
29.1 Layer 2 Protocol Tunneling Overview	291
29.1.1 Layer-2 Protocol Tunneling Mode	292
29.2 Configuring Layer 2 Protocol Tunneling	293
sFlow	295
30.1 sFlow Overview	295
30.2 sFlow Port Configuration	296
30.2.1 sFlow Collector Configuration	297
PPPoE	299
31.1 PPPoE Intermediate Agent Overview	299
31.1.1 PPPoE Intermediate Agent Tag Format	299
31.1.2 Sub-Option Format	300
31.1.3 Port State	301
31.2 The PPPoE Screen	302
31.3 PPPoE Intermediate Agent	302
31.3.1 PPPoE IA Per-Port	303
31.3.2 PPPoE IA Per-Port Per-VLAN	305
31.3.3 PPPoE IA for VLAN	307
Error Disable	309
32.1 CPU Protection Overview	309
32.2 Error-Disable Recovery Overview	309
32.3 The Error Disable Screen	310
32.4 CPU Protection Configuration	310
32.5 Error-Disable Detect Configuration	311
32.6 Error-Disable Recovery Configuration	313
Private VLAN	315
33.1 Private VLAN Overview	315
33.2 Configuring Private VLAN	316
Static Route	319
34.1 Static Routing Overview	319
34.2 Configuring Static Routing	320
Policy Routing	323
35.1 Policy Route Overview	323
35.1.1 Benefits	323
35.2 Configuring Policy Routing Profile	324
35.2.1 Policy Routing Rule Configuration	325
RIP	327
36.1 RIP Overview	327
36.1.1 Administrative Distance	327
36.2 Configuring RIP	328
OSPF	331
37.1 OSPF Overview	331
37.1.1 OSPF Autonomous Systems and Areas	331
37.1.2 How OSPF Works	332
37.1.3 Interfaces and Virtual Links	332
37.1.4 OSPF and Router Elections	333
37.1.5 Configuring OSPF	333
37.2 OSPF Status	334
37.3 OSPF Configuration	336
37.4 Configure OSPF Areas	337
37.4.1 View OSPF Area Information Table	339
37.5 Configuring OSPF Redistribution	339
37.6 Configuring OSPF Interfaces	341
37.7 OSPF Virtual-Links	343
IGMP	345
38.1 IGMP Overview	345
38.1.1 How IGMP Works	346
38.2 Port-based IGMP	347
38.3 Configuring IGMP	348
DVMRP	349
39.1 DVMRP Overview	349
39.2 How DVMRP Works	349
39.2.1 DVMRP Terminology	350
39.3 Configuring DVMRP	350
39.3.1 DVMRP Configuration Error Messages	351
39.4 Default DVMRP Timer Values	352
Differentiated Services	353
40.1 DiffServ Overview	353
40.1.1 DSCP and Per-Hop Behavior	353
40.1.2 DiffServ Network Example	354
40.2 Two Rate Three Color Marker Traffic Policing	354
40.2.1 TRTCM - Color-blind Mode	355
40.2.2 TRTCM - Color-aware Mode	355
40.3 Activating DiffServ	356
40.3.1 Configuring 2-Rate 3 Color Marker Settings	357
40.4 DSCP-to-IEEE 802.1p Priority Settings	359
40.4.1 Configuring DSCP Settings	360
DHCP	361
41.1 DHCP Overview	361
41.1.1 DHCP Modes	361
41.1.2 DHCP Configuration Options	361
41.2 DHCP Status	362
41.3 DHCP Server Status Detail	362
41.4 DHCP Relay	364
41.4.1 DHCP Relay Agent Information	364
41.4.2 Configuring DHCP Global Relay	365
41.4.3 Global DHCP Relay Configuration Example	366
41.5 Configuring DHCP VLAN Settings	367
41.5.1 Example: DHCP Relay for Two VLANs	369
VRRP	371
42.1 VRRP Overview	371
42.2 VRRP Status	372
42.3 VRRP Configuration	373
42.3.1 IP Interface Setup	373
42.3.2 VRRP Parameters	375
42.3.3 Configuring VRRP Parameters	376
42.3.4 Configuring VRRP Parameters	377
42.4 VRRP Configuration Examples	377
42.4.1 One Subnet Network Example	378
42.4.2 Two Subnets Example	379
ARP Learning	381
43.1 ARP Overview	381
43.1.1 How ARP Works	381
43.1.2 ARP Learning Mode	381
43.2 Configuring ARP Learning	384
Load Sharing	387
44.1 Load Sharing Overview	387
44.2 Configuring Load Sharing	387
Maintenance	389
45.1 The Maintenance Screen	389
45.2 Load Factory Default	390
45.3 Save Configuration	390
45.4 Reboot System	391
45.5 Firmware Upgrade	391
45.6 Restore a Configuration File	392
45.7 Backup a Configuration File	393
45.8 FTP Command Line	393
45.8.1 Filename Conventions	393
45.8.2 FTP Command Line Procedure	394
45.8.3 GUI-based FTP Clients	395
45.8.4 FTP Restrictions	395
Access Control	397
46.1 Access Control Overview	397
46.2 The Access Control Main Screen	397
46.3 About SNMP	398
46.3.1 SNMP v3 and Security	399
46.3.2 Supported MIBs	399
46.3.3 SNMP Traps	400
46.3.4 Configuring SNMP	407
46.3.5 Configuring SNMP Trap Group	409
46.3.6 Configuring SNMP User	410
46.4 Setting Up Login Accounts	412
46.5 SSH Overview	413
46.6 How SSH works	414
46.7 SSH Implementation on the Switch	415
46.7.1 Requirements for Using SSH	415
46.8 Introduction to HTTPS	415
46.9 HTTPS Example	416
46.9.1 Internet Explorer Warning Messages	416
46.9.2 Netscape Navigator Warning Messages	417
46.9.3 The Main Screen	419
46.10 Service Port Access Control	419
46.11 Remote Management	420
Diagnostic	423
47.1 Diagnostic	423
Syslog	425
48.1 Syslog Overview	425
48.2 Syslog Setup	426
48.3 Syslog Server Setup	427
48.4 Syslog Messages	428
Cluster Management	435
49.1 Clustering Management Status Overview	435
49.2 Cluster Management Status	436
49.2.1 Cluster Member Switch Management	437
49.3 Clustering Management Configuration	440
MAC Table	443
50.1 MAC Table Overview	443
50.2 Viewing the MAC Table	444
IP Table	447
51.1 IP Table Overview	447
51.2 Viewing the IP Table	448
ARP Table	451
52.1 ARP Table Overview	451
52.1.1 How ARP Works	451
52.2 The ARP Table Screen	452
Routing Table	453
53.1 Overview	453
53.2 Viewing the Routing Table Status	453
Configure Clone	455
54.1 Configure Clone	455
Troubleshooting	457
55.1 Power, Hardware Connections, and LEDs	457
55.2 Switch Access and Login	458
55.3 Switch Configuration	461
Product Specifications	463
Common Services	473
Legal Information	477