Home » Dell Manuals » Hubs & Switches » Dell PowerConnect B-RX » Manual Viewer

Dell PowerConnect B-RX BigIron RX Series Configuration Guide v02.7.03 - Page 395

Displaying VLAN group information, Transparent firewall mode, Enabling a transparent firewall

View all Dell PowerConnect B-RX manuals

Add to My Manuals
Save this manual to your list of manuals

Page 395 highlights

Transparent firewall mode 11 TABLE 69 Output of show vlan detail (Continued) This field... Displays... Protocol State Protocol configured on the VLAN. Current state of the port such as disabled, blocking, forwarding, etc. Displaying VLAN group information To display information about VLAN groups, enter the following command. BigIron RX# show vlan-group 10 Configured VLAN-Group entries: 1 Maximum VLAN-Group entries : 32 VLAN-GROUP 10 Number of VLANs: 4 VLANs: 10 to 13 Tagged ports: ethe 3/1 Syntax: show vlan-group [vlan-group-id] [| [begin | exclude | include ] The output shows the following information. TABLE 70 Output of show vlan ethernet This field... Displays... Configured VLAN-Group entries Maximum VLAN-Group entries VLAN-Group # VLANs Tagged ports: Number of VLAN groups that have been configured on the device. Maximum number of VLAN groups that can be configured on the device. ID of the VLAN group VLANs that belong to the VLAN group. Type and ID of the tagged ports that are members of the VLAN group Transparent firewall mode The Transparent Firewall mode allows the device to switch self-originated control packets. By default, Brocade devices will drop control packets received with the device's MAC address as the packet's source MAC address (i.e. self originated packet from the switch or router). Under the Transparent Firewall mode, switching of self-originated packets is allowed. The Transparent Firewall mode feature is a per VLAN configuration and is disabled by default. Enabling a transparent firewall To set the mode to transparent, enter a command such as the following. BigIron RX(config-vlan-10)# transparent-fw-mode To set the mode to routed, enter a command such as the following. BigIron RX(config-vlan-10)# no transparent-fw-mode BigIron RX Series Configuration Guide 323 53-1001986-01

Section	Page
Contents	3
About This Document	41
Audience	41
Supported hardware and software	41
List of supported features	41
Unsupported features	44
What’s new in this document	45
Enhancements in release 02.7.03	45
Enhancements in release 02.7.02	46
Enhancements in release 02.7.00	47
Enhancements in release 02.6.00	48
Enhancements in patch release 02.5.00c	51
Enhancements in patch release 02.5.00b	51
Enhancements in release 02.5.00	51
Enhancements in patch release 02.4.00c	52
Enhancements in release 02.4.00	53
Enhancements in patch release 02.3.00a	57
Enhancements in release 02.3.00	58
Enhancements in release 02.2.01	63
Enhancements in release 02.2.00g	67
Enhancements in release 02.2.00	68
Document conventions	69
Text formatting	69
Command syntax conventions	69
Notes, cautions, and danger notices	69
Notice to the reader	70
Related publications	70
Getting technical help or reporting errors	70
Web access	71
E-mail and telephone access	71
Getting Started with the Command Line Interface	73
In this chapter	73
Logging on through the CLI	73
On-line help	74
Command completion	74
Scroll control	74
Line editing commands	75
EXEC commands	75
Global level	76
CONFIG commands	76
Accessing the CLI	79
Navigating among command levels	80
CLI command structure	80
Searching and filtering output	81
Allowable characters for LAG names	85
Syntax shortcuts	86
Saving configuration changes	86
Getting Familiar With the BigIron RX Series Switch Management Applications	87
How to manage BigIron RX Series switch	87
Logging on through the CLI	87
On-line help	88
Command completion	88
Scroll control	88
Line editing commands	88
Searching and filtering output from CLI commands	89
Allowable characters for LAG names	93
Logging on through the Web Management Interface	94
Web Management Interface	95
Logging on through IronView Network Manager	96
Using a Redundant Management Module	97
How management module redundancy works	97
Management module redundancy overview	97
Management module switchover	98
Switchover implications	99
Management module redundancy configuration	101
Changing the default active Chassis slot	101
Managing management module redundancy	101
File synchronization between the active and standby management modules	101
Manually switching over to the standby management module	104
Rebooting the active and standby management modules	104
Monitoring management module redundancy	105
Determining management module status	105
Displaying temperature information	106
Displaying switchover information	106
Flash memory and PCMCIA flash card file management commands	108
Management focus	109
Flash memory file system	110
PCMCIA flash card file system	111
Wildcards	112
Formatting a flash card	112
Determining the current management focus	113
Switching the management focus	113
Displaying a directory of the files	114
Displaying the contents of a file	116
Displaying the hexadecimal output of a file	117
Creating a subdirectory	117
Removing a subdirectory	119
Renaming a file	120
Changing the read-write attribute of a file	120
Deleting a file	121
Recovering (“undeleting”) a file	122
Appending a file to another file	123
Copying files using the copy command	123
Copying files using the cp command	127
Loading the software	128
Saving configuration changes	130
File management messages	131
System Monitoring Service	131
Securing Access to Management Functions	135
Securing access methods	135
Restricting remote access to management functions	137
Using ACLs to restrict remote access	137
Restricting remote access to the device to specific IP addresses	140
Specifying the maximum number of login attempts for Telnet access	141
Restricting remote access to the device to specific VLAN IDs	141
Disabling specific access methods	143
Setting passwords	144
Setting a Telnet password	144
Setting passwords for management privilege levels	145
Recovering from a lost password	147
Displaying the SNMP community string	147
Disabling password encryption	148
Specifying a minimum password length	148
Setting up local user accounts	148
Configuring a local user account	149
Username, password and login rules	151
Configuring the strict password feature	152
Configuring SSL security for the Web Management Interface	154
Enabling the SSL server on the device	155
Importing digital certificates and RSA private key files	155
Generating an SSL certificate	156
Configuring TACACS and TACACS+ security	156
How TACACS+ differs from TACACS	156
TACACS and TACACS+ authentication, authorization, and accounting	157
TACACS and TACACS+ configuration considerations	160
Enabling SNMP to configure TACACS and TACACS	161
Identifying the TACACS and TACACS+ servers	161
Specifying different servers for individual AAA functions	162
Setting optional TACACS and TACACS+ parameters	162
Configuring authentication-method lists for TACACS and TACACS+	164
Configuring TACACS+ authorization	166
Configuring TACACS+ accounting	169
Configuring an interface as the source for all TACACS and TACACS+ packets	170
Displaying TACACS and TACACS+ statistics and configuration information	170
Configuring RADIUS security	172
RADIUS authentication, authorization, and accounting	172
RADIUS configuration considerations	175
RADIUS configuration procedure	175
Configuring Brocade-specific attributes on the RADIUS server	176
Enabling SNMP to configure RADIUS	177
Identifying the RADIUS server to the BigIron RX	177
Specifying different servers for individual AAA functions	178
Setting RADIUS parameters	178
Configuring authentication-method lists for RADIUS	179
Configuring RADIUS authorization	180
Configuring RADIUS accounting	182
Configuring an interface as the source for all RADIUS packets	183
Displaying RADIUS configuration information	184
Configuring authentication-method lists	185
Configuration considerations for authentication- method lists	186
Examples of authentication-method lists	187
Configuring Basic Parameters	189
Entering system administration information	189
Configuring Simple Network Management Protocol traps	190
Specifying an SNMP trap receiver	190
Specifying a Single trap source	191
Setting the SNMP Trap holddown time	191
Disabling SNMP traps	192
Disabling Syslog messages and traps for CLI access	193
Configuring an interface as source for all Telnet packets	194
Cancelling an outbound Telnet session	195
Configuring an interface as the source for all TFTP packets	195
Configuring an interface as the source for Syslog packets	195
Specifying a Simple Network Time Protocol (SNTP) server	196
Setting the system clock	198
New Daylight Saving Time (DST)	199
Configuring CLI banners	200
Setting a message of the day banner	200
Setting a privileged EXEC CLI level banner	201
Displaying a message on the console when an incoming Telnet session is detected	201
Configuring terminal display	202
Checking the length of terminal displays	202
Enabling or disabling routing protocols	202
Displaying and modifying system parameter default settings	203
Enabling or disabling Layer 2 switching	205
CAM partitioning for the BigIron RX	206
Re-distributing CAM allocations	206
Nexthop table	207
Changing the MAC age time	208
Configuring static ARP entries	208
Pinging an IPv4 address	209
Configuring Interface Parameters	211
Assigning a port name	211
Assigning an IP address to a port	211
Speed/Duplex negotiation	212
Disabling or re-enabling a port	213
Changing the default Gigabit negotiation mode	213
Changing the negotiation mode	214
Disabling or re-enabling flow control	214
Specifying threshold values for flow control	214
Locking a port to restrict addresses	215
Wait for all cards feature	215
Port transition hold timer	216
Port flap dampening	216
Modifying port priority (QoS)	217
Assigning a mirror port and monitor ports	218
Configuration guidelines for monitoring traffic	218
Configuring port mirroring and monitoring	218
Monitoring an individual trunk port	219
Mirror ports for Policy-Based Routing (PBR) traffic	220
About hardware-based PBR	220
Configuring mirror ports for PBR traffic	221
Displaying mirror and monitor port configuration	221
Enabling WAN PHY mode support	222
Configuring IP	223
Overview of configuring IP	223
The IP packet flow	223
ARP cache table	224
Static ARP table	224
IP Route table	225
IP forwarding cache	226
Basic IP parameters and defaults	226
When parameter changes take effect	227
IP global parameters	227
IP interface parameters	230
Configuring IP parameters	231
Configuring IP addresses	231
Changing the network mask display to prefix format	234
Configuring the default gateway	234
GRE IP tunnel	235
IPv6 over IPv4 tunnels in hardware	240
Configuring Domain Name Server (DNS) resolver	244
Adding host names to the DNS cache table	245
Configuring packet parameters	249
Changing the encapsulation type	249
Setting maximum frame size per PPCR	250
Changing the MTU	251
Changing the router ID	252
Specifying a single source interface for Telnet, TACACS, TACACS+, or RADIUS packets	253
Configuring an interface as the source for Syslog packets	255
IP fragmentation protection	256
IP option attack protection	256
IP receive access list	256
Configuring ARP parameters	257
How ARP works	257
Rate limiting ARP packets	258
Applying a rate limit to ARP packets on an interface	259
Clearing the rate limit for ARP packets	260
Changing the ARP aging period	260
Creating a floating static ARP entry	262
Static route ARP validation check	263
Configuring forwarding parameters	264
Disabling ICMP messages	266
Disabling ICMP redirect messages	268
Configuring static routes	269
Static route tagging	273
Configuring a default network route	278
Configuring IP load sharing	279
Default route ECMP	282
IP receive access list	283
Configuring IRDP	284
Configuring UDP broadcast and IP helper parameters	286
Configuring BootP/DHCP forwarding parameters	288
Displaying IP information	290
Displaying IP interface information	293
Displaying interface name in Syslog	294
Displaying ARP entries	294
Displaying the forwarding cache	296
Displaying the IP route table	298
Clearing IP routes	301
Displaying IP traffic statistics	301
Displaying TCP traffic statistics	304
Link Aggregation	307
Link aggregation overview	307
LAG formation rules	307
LAG load sharing	310
Migration from a pre-02.6.00 trunk or LACP configuration	311
Configuration of a LAG	312
Creating a Link Aggregation Group (LAG)	312
Deploying a LAG	315
Commands available under LAG once it is deployed	316
Configuring ACL-based mirroring	316
Disabling ports within a LAG	316
Enabling ports within a LAG	317
Monitoring an individual LAG port	317
Assigning a name to a port within a LAG	318
Enabling sFlow forwarding on a port within a LAG	318
Setting the sFlow sampling rate for a port within a LAG	318
Displaying LAG information	319
Displaying LAG statistics	322
Configuring LLDP	325
Terms used in this chapter	325
LLDP overview	325
Benefits of LLDP	326
General operating principles	327
Operating modes	327
LLDP packets	327
TLV support	328
MIB support	331
Syslog messages	331
Configuring LLDP	331
Configuration notes and considerations	332
Enabling and disabling LLDP	332
Changing a port’s LLDP operating mode	333
Specifying the maximum number of LLDP neighbors	334
Enabling LLDP SNMP notifications and Syslog messages	335
Specifying the minimum time between SNMP traps and Syslog messages	335
Changing the minimum time between LLDP transmissions	336
Changing the interval between regular LLDP transmissions	336
Changing the holdtime multiplier for transmit TTL	337
Changing the minimum time between port reinitializations	337
LLDP TLVs advertised by the Brocade device	338
Displaying LLDP statistics and configuration settings	344
LLDP configuration summary	344
LLDP statistics	345
LLDP neighbors	346
LLDP neighbors detail	347
LLDP configuration details	349
Resetting LLDP statistics	349
Configuring Uni-Directional Link Detection (UDLD)	351
Configuration considerations	352
Configuring UDLD	352
Changing the keepalive interval	352
Changing the keepalive retries	352
Displaying UDLD information	353
Displaying information for all ports	353
Displaying link-keepalive information	353
Displaying information for a single port	354
Clearing UDLD statistics	356
VLANs	357
Overview of Virtual Local Area Networks (VLANs)	357
Tagged, untagged, and dual-mode ports	357
Protocol-based VLANs	359
VLAN configuration rules	360
VLAN ID range	360
Tagged VLANs	360
VLAN hierarchy	360
Multiple VLAN membership rules	360
Layer 2 control protocols on VLANs	361
Configuring port-based VLANs	361
VLAN byte accounting	362
Strictly or explicitly tagging a port	364
Assigning or changing a VLAN priority	364
Assigning a different ID to the default VLAN	364
Configuring protocol-based VLANs	365
Configuring an MSTP instance	366
Configuring virtual routing interfaces	366
Bridging and routing the same protocol simultaneously on the same device	367
Integrated Switch Routing (ISR)	368
VLAN groups	369
Configuring a VLAN group	369
Configuring super aggregated VLANs	371
Configuring aggregated VLANs	373
Complete CLI examples	374
Configuring 802.1q-in-q tagging	377
Configuration rules	378
Enabling 802.1Q-in-Q tagging	379
Example configuration	379
Configuring 802.1q tag-type translation	380
Configuration rules	382
Enabling 802.1q tag-type translation	383
Private VLANs	384
Implementation notes	385
Configuration notes	385
Configuring a private VLAN	386
Enabling broadcast, multicast or unknown unicast traffic to the private VLAN	388
CLI example for Figure 30	388
Other VLAN features	389
Allocating memory for more VLANs or virtual routing interfaces	389
Hardware flooding for Layer 2 multicast and broadcast packets	389
Unknown unicast flooding on VLAN ports	390
Flow based MAC learning	390
Configuring uplink ports within a port-based VLAN	391
Configuring control protocols in VLANs	391
Other configuration options	392
Displaying VLAN information	392
Displaying VLAN information	392
Displaying VLAN information for specific ports	393
Displaying VLAN status and port types	393
Displaying VLAN group information	395
Transparent firewall mode	395
Enabling a transparent firewall	395
Configuring Spanning Tree Protocol	397
IEEE 802.1D Spanning Tree Protocol (STP)	397
Enabling or disabling STP	397
Default STP bridge and port parameters	398
Changing STP bridge parameters	399
Changing STP port parameters	400
STP root guard	400
Spanning Tree Protocol (STP) BPDU guard	401
Displaying STP information	402
IEEE Single Spanning Tree (SSTP)	408
SSTP defaults	408
Enabling SSTP	409
Displaying SSTP information	410
PVST/PVST+ compatibility	410
Overview of PVST and PVST+	411
VLAN tags and dual mode	411
Enabling PVST+ support	412
Displaying PVST+ support information	412
Configuration examples	413
SuperSpan™	415
Customer ID	416
BPDU forwarding	416
Configuring SuperSpan	421
Configuring Rapid Spanning Tree Protocol	425
Overview of Rapid Spanning Tree Protocol	425
Bridges and bridge port roles	425
Assignment of port roles	426
Ports on Switch 1	427
Ports on Switch 2	427
Ports on Switch 3	427
Ports Switch 4	428
Edge ports and edge port roles	428
Point-to-point ports	429
Bridge port states	429
Edge port and non-edge port states	430
Changes to port roles and states	430
State machines	430
Handshake mechanisms	431
Convergence in a simple topology	441
Convergence at start up	442
Convergence after a link failure	444
Convergence at link restoration	445
Convergence in a complex RSTP topology	446
Propagation of topology change	449
Compatibility of RSTP with 802.1D	452
Configuring RSTP parameters	453
Enabling or disabling RSTP in a port-based VLAN	453
Enabling or disabling RSTP on a single spanning tree	454
Disabling or enabling RSTP on a port	454
Changing RSTP bridge parameters	454
Changing port parameters	455
Fast port span	456
Fast uplink span	458
Displaying RSTP information	460
Metro Ring Protocol (MRP) Phase 1 and 2	465
Metro Ring Protocol (MRP) phase 1	465
MRP rings without shared interfaces	466
Ring initialization	467
How ring breaks are detected and healed	470
Master VLANs and customer VLANs in a topology group	472
Configuring MRP	474
Adding an MRP ring to a VLAN	475
Changing the hello and preforwarding times	476
MRP phase 2	476
Ring initialization for shared interfaces	478
How ring breaks are detected and healed between shared interfaces	478
Selection of master node	479
RHP processing in rings with shared interfaces	479
Normal flow	480
Flow when a link breaks	481
Configuring MRP with shared interfaces	481
Using MRP diagnostics	482
Enabling MRP diagnostics	482
Displaying MRP diagnostics	483
Displaying MRP information	483
Displaying topology group information	483
Displaying ring information	484
MRP CLI example	485
Commands on switch A (master node)	486
Commands on switch B	486
Commands on switch C	487
Commands on switch D	487
Virtual Switch Redundancy Protocol (VSRP)	489
Overview of Virtual Switch Redundancy Protocol (VSRP)	489
Layer 2 and Layer 3 redundancy	490
Master election and failover	490
Configuring basic VSRP parameters	495
Enabling Layer 3 VSRP	496
Configuring optional VSRP parameters	496
Disabling VSRP on a VRID	496
Configuring authentication	496
Configuring a VRID IP address	497
VSRP fast start	498
Changing the backup priority	499
Saving the timer values received from the master	499
VSRP slow start	500
Changing the Time-To-Live (TTL)	500
Changing the hello interval	501
Changing the dead interval	501
Changing the backup hello state and interval	501
Changing the hold-down interval	502
Changing the default track priority	502
Specifying a track port	503
Disabling or re-enabling backup pre-emption	503
Port transition hold timer	503
Clearing VSRP information	504
VSRP and MRP signaling	504
Displaying VSRP information	506
Displaying VRID information	506
Displaying a summary of VSRP information	508
Displaying VSRP packet statistics for VSRP	509
Displaying the active interfaces for a VRID	510
Topology Groups	511
Topology overview	511
Master VLAN and member VLANs	511
Master VLANs and customer VLANs in MRP	512
Control ports and free ports	512
Configuration considerations	512
Configuring a topology group	513
Displaying topology group information	513
Displaying topology group information	513
Configuring VRRP and VRRPE	515
Overview of VRRP	515
Standard VRRP	515
Brocade enhancements of VRRP	517
Overview of VRRPE	519
VRRP and VRRPE parameters	522
Configuring parameters specific to VRRP	524