Home » Dell Manuals » Hubs & Switches » Dell PowerConnect 8100 » Manual Viewer

Dell PowerConnect 8100 User's Configuration Guide - Page 513

Configuring Access Control Lists, ACL Overview

View all Dell PowerConnect 8100 manuals

Add to My Manuals
Save this manual to your list of manuals

Page 513 highlights

21 Configuring Access Control Lists This chapter describes how to configure Access Control Lists (ACLs), including IPv4, IPv6, and MAC ACLs. This chapter also describes how to configure time ranges that can be applied to any of the ACL types. The topics covered in this chapter include: • ACL Overview • Configuring ACLs (Web) • Configuring ACLs (CLI) • ACL Configuration Examples ACL Overview Access Control Lists (ACLs) are a collection of permit and deny conditions, called rules, that provide security by blocking unauthorized users and allowing authorized users to access specific resources. ACLs can also provide traffic flow control, restrict contents of routing updates, and decide which types of traffic are forwarded or blocked. ACLs can reside in a firewall router, a router connecting two internal networks, or a Layer 3 switch, such as a PowerConnect 8000/8100-series switch. You can also create an ACL that limits access to the management interfaces based on the connection method (for example, Telnet or HTTP) and/or the source IP address. The PowerConnect 8000/8100-series switches support ACL configuration in both the ingress and egress direction. Egress ACLs provide the capability to implement security rules on the egress flows (traffic leaving a port) rather than the ingress flows (traffic entering a port). Ingress and egress ACLs can be applied to any physical port, port-channel (LAG), or VLAN routing port. Configuring Access Control Lists 513

Section	Page
Introduction	49
About This Document	49
Audience	50
Document Conventions	50
Additional Documentation	51
Switch Features	53
System Management Features	54
Multiple Management Options	54
System Time Management	54
Log Messages	55
Integrated DHCP Server	56
Management of Basic Network Information	56
IPv6 Management Features	56
Dual Software Images	56
File Management	57
Switch Database Management Templates	57
Automatic Installation of Firmware and Configuration	57
sFlow	58
SNMP Alarms and Trap Logs	58
CDP Interoperability through ISDP	58
Remote Monitoring (RMON)	58
Stacking Features	59
High Port Count	59
Single IP Management	59
Automatic Firmware Update for New Stack Members	59
Master Failover with Transparent Transition	60
Nonstop Forwarding on the Stack	60
Hot Add/Delete and Firmware Synchronization	60
Security Features	60
Configurable Access and Authentication Profiles	60
Password-Protected Management Access	61
Strong Password Enforcement	61
TACACS+ Client	61
RADIUS Support	61
SSH/SSL	62
Inbound Telnet Control	62
Denial of Service	62
Port Protection	62
Captive Portal	63
Dot1x Authentication (IEEE 802.1X)	63
MAC-Based 802.1X Authentication	63
Dot1x Monitor Mode	64
MAC-Based Port Security	64
Access Control Lists (ACL)	64
Time-Based ACLs	65
IP Source Guard (IPSG)	65
DHCP Snooping	65
Dynamic ARP Inspection	65
Protected Ports (Private VLAN Edge)	66
Switching Features	66
Flow Control Support (IEEE 802.3x)	66
Head of Line Blocking Prevention	66
Alternate Store and Forward (ASF)	66
Jumbo Frames Support	67
Auto-MDI/MDIX Support	67
VLAN-Aware MAC-based Switching	67
Back Pressure Support	67
Auto Negotiation	68
Broadcast Storm Control	68
Port Mirroring	68
Static and Dynamic MAC Address Tables	69
Link Layer Discovery Protocol (LLDP)	69
Link Layer Discovery Protocol (LLDP) for Media Endpoint Devices	69
Priority-based Flow Control (PFC)	69
Data Center Bridging Exchange (DBCx) Protocol	70
Enhanced Transmission Selection	70
Fibre Channel over Ethernet (FCoE) Initialization Protocol Snooping	70
Cisco Protocol Filtering	71
DHCP Layer 2 Relay	71
Virtual Local Area Network Supported Features	71
VLAN Support	71
Port-Based VLANs	71
IP Subnet-based VLAN	72
MAC-based VLAN	72
IEEE 802.1v Protocol-Based VLANs	72
GARP and GVRP Support	72
Voice VLAN	72
Guest VLAN	73
Double VLANs	73
Spanning Tree Protocol Features	74
Spanning Tree Protocol (STP)	74
Spanning Tree Port Settings	74
Rapid Spanning Tree	74
Multiple Spanning Tree	74
Bridge Protocol Data Unit (BPDU) Guard	75
BPDU Filtering	75
Link Aggregation Features	75
Link Aggregation	75
Link Aggregate Control Protocol (LACP)	75
Routing Features	77
Address Resolution Protocol (ARP) Table Management	77
VLAN Routing	77
IP Configuration	77
Open Shortest Path First (OSPF)	77
BOOTP/DHCP Relay Agent	78
IP Helper and UDP Relay	78
Routing Information Protocol	78
Router Discovery	78
Routing Table	78
Virtual Router Redundancy Protocol (VRRP)	79
Tunnel and Loopback Interfaces	79
IPv6 Routing Features	79
IPv6 Configuration	79
IPv6 Routes	80
OSPFv3	80
DHCPv6	80
Quality of Service (QoS) Features	81
Differentiated Services (DiffServ)	81
Class Of Service (CoS)	81
Auto Voice over IP (VoIP)	81
Internet Small Computer System Interface (iSCSI) Optimization	82
Layer 2 Multicast Features	82
MAC Multicast Support	82
IGMP Snooping	82
IGMP Snooping Querier	83
MLD Snooping	83
Multicast VLAN Registration	83
Layer 3 Multicast Features	84
Distance Vector Multicast Routing Protocol	84
Internet Group Management Protocol	84
IGMP Proxy	84
Protocol Independent Multicast—Dense Mode	84
Protocol Independent Multicast—Sparse Mode	85
Protocol Independent Multicast—Source Specific Multicast	85
Protocol Independent Multicast IPv6 Support	85
MLD/MLDv2 (RFC2710/RFC3810)	85
Hardware Overview	87
PowerConnect 8000-series and 8100-series Front Panel	87
PowerConnect 8024 Front Panel	87
PowerConnect 8024F Front Panel	88
PowerConnect 8132 Front Panel	89
PowerConnect 8132F Front Panel	89
PowerConnect 8164 Front Panel	90
PowerConnect 8164F Front Panel	91
Hot-Pluggable Interface Modules	92
USB Port (Power Connect 8100-series switches only)	94
Port and System LEDs	94
PowerConnect 8000-series and 8100-series Back Panel	94
Console Port	96
Out-of-Band Management Port	96
Power Supplies	96
Ventilation System	96
LED Definitions	97
Port LEDs	97
Module Bay LEDs	98
Out-of-Band Ethernet Management Port LEDs	99
System LEDs	99
Switch Addresses	100
Using Dell OpenManage Switch Administrator	103
About Dell OpenManage Switch Administrator	103
Starting the Application	104
Understanding the Interface	105
Defining Fields	107
Understanding the Device View	108
Using the Device View Port Features	108
Using the Command-Line Interface	109
Accessing the Switch Through the CLI	109
Console Connection	109
Telnet Connection	110
Understanding Command Modes	111
Entering CLI Commands	113
Using the Question Mark to Get Help	113
Using Command Completion	114
Entering Abbreviated Commands	114
Negating Commands	114
Understanding Error Messages	115
Recalling Commands from the History Buffer	115
Default Settings	117
Setting the IP Address and Other Basic Network Information	121
IP Address and Network Information Overview	121
What Is the Basic Network Information?	121
Why Is Basic Network Information Needed?	122
How Is Basic Network Information Configured?	123
What Is Out-of-Band Management and In-Band Management?	123
Default Network Information	125
Configuring Basic Network Information (Web)	126
Out-of-Band Interface	126
IP Interface Configuration (Default VLAN IP Address)	127
Route Entry Configuration (Switch Default Gateway)	128
Domain Name Server	130
Default Domain Name	131
Host Name Mapping	132
Dynamic Host Name Mapping	133
Configuring Basic Network Information (CLI)	134
Enabling the DHCP Client on the OOB Port	134
Enabling the DHCP Client on the Default VLAN	134
Managing DHCP Leases	135
Configuring Static Network Information on the OOB Port	136
Configuring Static Network Information on the Default VLAN	136
Configuring and Viewing Additional Network Information	137
Basic Network Information Configuration Example	138
Managing QSFP Ports	141
Managing a Switch Stack	143
Stacking Overview	143
Creating a PowerConnect 8000/8100 Series Stack	145
How is the Stack Master Selected?	146
Adding a Switch to the Stack	148
Removing a Switch from the Stack	148
How is the Firmware Updated on the Stack?	149
What is Stacking Standby?	149
What is Nonstop Forwarding?	150
Switch Stack MAC Addressing and Stack Design Considerations	153
NSF Network Design Considerations	153
Why is Stacking Needed?	154
Default Stacking Values	154
Managing and Monitoring the Stack (Web)	155
Unit Configuration	155
Stack Summary	157
Stack Firmware Synchronization	158
Supported Switches	159
Stack Port Summary	160
Stack Port Counters	161
Stack Port Diagnostics	161
NSF Summary	162
Checkpoint Statistics	163
Managing the Stack (CLI)	164
Configuring Stack Member, Stack Port, and NSF Settings	164
Viewing and Clearing Stacking and NSF Information	166
Stacking and NSF Usage Scenarios	166
Basic Failover	167
Preconfiguring a Stack Member	169
NSF in the Data Center	171
NSF and VoIP	172
NSF and DHCP Snooping	173
NSF and the Storage Access Network	174
NSF and Routed Access	176
Configuring Authentication, Authorization, and Accounting	179
AAA Overview	179
Methods	180
Access Lines	181
Authentication	181
Authorization	182
Exec Authorization Capabilities	183
Accounting	184
Authentication Examples	185
Local Authentication Example	185
TACACS+ Authentication Example	186
RADIUS Authentication Example	188
Authorization Examples	189
Local Authorization Example—Direct Login to Privileged EXEC Mode	189
TACACS+ Authorization Example—Direct Login to Privileged EXEC Mode	189
TACACS+ Authorization Example—Administrative Profiles	190
TACACS+ Authorization Example—Custom Administrative Profile	191
TACACS+ Authorization Example—Per-command Authorization	192
RADIUS Authorization Example—Direct Login to Privileged EXEC Mode	193
RADIUS Authorization Example—Administrative Profiles	193
Using RADIUS Servers to Control Management Access	194
How Does RADIUS Control Management Access?	194
Which RADIUS Attributes Does the Switch Support?	196
How Are RADIUS Attributes Processed on the Switch?	198
Using TACACS+ Servers to Control Management Access	199
Which TACACS+ Attributes Does the Switch Support?	200
Default Configurations	201
Method Lists	201
Access Lines (AAA)	201
Access Lines (Non-AAA)	202
Administrative Profiles	202
Monitoring and Logging System Information	205
System Monitoring Overview	205
What System Information Is Monitored?	205
Why Is System Information Needed?	206
Where Are Log Messages Sent?	206
What Are the Severity Levels?	207
What Are the System Startup and Operation Logs?	207
What Is the Log Message Format?	208
What Factors Should Be Considered When Configuring Logging?	209
Default Log Settings	209
Monitoring System Information and Configuring Logging (Web)	210
Device Information	210
System Health	211
System Resources	212
Integrated Cable Test for Copper Cables	213
Optical Transceiver Diagnostics	214
Log Global Settings	216
RAM Log	217
Log File	218
Remote Log Server	218
Email Alert Global Configuration	221
Email Alert Mail Server Configuration	222
Email Alert Subject Configuration	224
Email Alert To Address Configuration	225
Email Alert Statistics	226
Monitoring System Information and Configuring Logging (CLI)	227
Viewing System Information	227
Running Cable Diagnostics	227
Configuring Local Logging	228
Configuring Remote Logging	230
Configuring Mail Server Settings	231
Configuring Email Alerts for Log Messages	232
Logging Configuration Examples	234
Configuring Local and Remote Logging	234
Configuring Email Alerting	235
Managing General System Settings	239
System Settings Overview	239
Why Does System Information Need to Be Configured?	240
What Are SDM Templates?	241
Why is the System Time Needed?	242
How Does SNTP Work?	242
Default General System Information	242
Configuring General System Settings (Web)	243
System Information	243
CLI Banner	246
SDM Template Preference	247
Clock	248
SNTP Global Settings	249
SNTP Authentication	250
SNTP Server	252
Summer Time Configuration	256
Time Zone Configuration	257
Slot Summary	258
Supported Cards	259
Configuring System Settings (CLI)	260
Configuring System Information	260
Configuring the Banner	261
Managing the SDM Template	262
Configuring SNTP Authentication and an SNTP Server	262
Setting the System Time and Date Manually	264
Viewing Slot Information	265
General System Settings Configuration Examples	266
Configuring System and Banner Information	266
Configuring SNTP	269
Configuring the Time Manually	271
Configuring SNMP	273
SNMP Overview	273
What Is SNMP?	273
What Are SNMP Traps?	274
Why Is SNMP Needed?	275
Default SNMP Values	275
Configuring SNMP (Web)	277
SNMP Global Parameters	277
SNMP View Settings	278
Access Control Group	280
SNMPv3 User Security Model (USM)	282
Communities	285
Notification Filter	287
Notification Recipients	288
Trap Flags	291
OSPFv2 Trap Flags	292
OSPFv3 Trap Flags	293
Trap Log	294
Configuring SNMP (CLI)	295
Configuring the SNMPv3 Engine ID	295
Configuring SNMP Views, Groups, and Users	296
Configuring Communities	299
Configuring SNMP Notifications (Traps and Informs)	301
SNMP Configuration Examples	304
Configuring SNMPv1 and SNMPv2	304
Configuring SNMPv3	305
Managing Images and Files	309
Image and File Management Overview	309
What Files Can Be Managed?	309
Why Is File Management Needed?	311
What Methods Are Supported for File Management?	313
What Factors Should Be Considered When Managing Files?	313
How Is the Running Configuration Saved?	315
Managing Images and Files (Web)	316
File System	316
Active Images	317
USB Flash Drive	318
File Download	319
File Upload	321
Copy Files	323
Managing Images and Files (CLI)	324
Downloading and Activating a New Image (TFTP)	324
Managing Files in Internal Flash	326
Managing Files on a USB Flash Device (PowerConnect 8100-series switches only)	327
Uploading a Configuration File (SCP)	327
Managing Configuration Scripts (SFTP)	328
File and Image Management Configuration Examples	329
Upgrading the Firmware	329
Managing Configuration Scripts	332
Managing Files by Using the USB Flash Drive (PowerConnect 8100- series switches only)	334
Automatically Updating the Image and Configuration	337
Auto Configuration Overview	337
What Is USB Auto Configuration?	338
What Files Does USB Auto Configuration Use?	338
How Does USB Auto Configuration Use the Files on the USB Device?	340
What Is the Setup File Format?	341
What Is the DHCP Auto Configuration Process?	342
Monitoring and Completing the DHCP Auto Configuration Process	347
What Are the Dependencies for DHCP Auto Configuration?	348
Default Auto Configuration Values	349
Managing Auto Configuration (Web)	350
Auto-Install Configuration	350
Managing Auto Configuration (CLI)	351
Managing Auto Configuration	351
Auto Configuration Example	352
Enabling DHCP Auto Configuration and Auto Image Download	352
Monitoring Switch Traffic	355
Traffic Monitoring Overview	355
What is sFlow Technology?	355
What is RMON?	358
What is Port Mirroring?	359
Why is Traffic Monitoring Needed?	360
Default Traffic Monitoring Values	360
Monitoring Switch Traffic (Web)	361
sFlow Agent Summary	361
sFlow Receiver Configuration	362
sFlow Sampler Configuration	363
sFlow Poll Configuration	364
Interface Statistics	365
Etherlike Statistics	366
GVRP Statistics	367
EAP Statistics	368
Utilization Summary	369
Counter Summary	370
Switchport Statistics	371
RMON Statistics	372
RMON History Control Statistics	373
RMON History Table	375
RMON Event Control	376
RMON Event Log	378
RMON Alarms	379
Port Statistics	381
LAG Statistics	382
Port Mirroring	383
Monitoring Switch Traffic (CLI)	386
Configuring sFlow	386
Configuring RMON	388
Viewing Statistics	390
Configuring Port Mirroring	391
Traffic Monitoring Configuration Examples	392
Configuring sFlow	392
Configuring RMON	394
Configuring iSCSI Optimization	395
iSCSI Optimization Overview	395
What Does iSCSI Optimization Do?	396
How Does the Switch Detect iSCSI Traffic Flows?	396
How Is Quality of Service Applied to iSCSI Traffic Flows?	396
How Does iSCSI Optimization Use ACLs?	397
What Information Does the Switch Track in iSCSI Traffic Flows?	398
How Does iSCSI Optimization Interact With Dell EqualLogic Arrays?	399
What Occurs When iSCSI Optimization Is Enabled or Disabled?	399
How Does iSCSI Optimization Interact with DCBx?	400
How Does iSCSI Optimization Interact with Dell Compellent Arrays?	400
iSCSI CoS and Priority Flow Control/Enhanced Transmission Selection Interactions	401
Default iSCSI Optimization Values	402
Configuring iSCSI Optimization (Web)	403
iSCSI Global Configuration	403
iSCSI Targets Table	404
iSCSI Sessions Table	405
iSCSI Sessions Detailed	406
Configuring iSCSI Optimization (CLI)	407
iSCSI Optimization Configuration Examples	409
Configuring iSCSI Optimization Between Servers and a Disk Array	409
Configuring Captive Portal	413
Captive Portal Overview	413
What Does Captive Portal Do?	413
Is the Captive Portal Feature Dependent on Any Other Feature?	414
What Factors Should Be Considered When Designing and Configuring a Captive Portal?	415
How Does Captive Portal Work?	416
What Captive Portal Pages Can Be Customized?	417
Default Captive Portal Behavior and Settings	418
Configuring the Captive Portal (Web)	420
Captive Portal Global Configuration	420
Captive Portal Configuration	421
Local User	426
User Group	430
Interface Association	432
Captive Portal Global Status	433
Captive Portal Activation and Activity Status	434
Interface Activation Status	435
Interface Capability Status	436
Client Summary	437
Client Detail	438
Captive Portal Interface Client Status	439
Captive Portal Client Status	440
Configuring Captive Portal (CLI)	441
Configuring Global Captive Portal Settings	441
Creating and Configuring a Captive Portal	442
Configuring Captive Portal Groups and Users	445
Managing Captive Portal Clients	446
Captive Portal Configuration Example	447
Configuration Overview	448
Detailed Configuration Procedures	449
Configuring Port Characteristics	451
Port Overview	451
What Physical Port Characteristics Can Be Configured?	451
What is Link Dependency?	452
What Interface Types are Supported?	454
What is Interface Configuration Mode?	454
Default Port Values	456
Configuring Port Characteristics (Web)	457
Port Configuration	457
Link Dependency Configuration	460
Link Dependency Summary	462
Configuring Port Characteristics (CLI)	463
Configuring Port Settings	463
Configuring Link Dependencies	464
Port Configuration Examples	466
Configuring Port Settings	466
Configuring a Link Dependency Groups	467
Configuring Port and System Security	469
IEEE 802.1X	470
What is IEEE 802.1X?	470
What are the 802.1X Port States?	471
What is MAC-Based 802.1X Authentication?	472
What is the Role of 802.1X in VLAN Assignment?	473
What is Monitor Mode?	475
How Does the Authentication Server Assign DiffServ Filters?	477