Home » ZyXEL Manuals » Networking » ZyXEL ES-4124 » Manual Viewer

ZyXEL ES-4124 User Guide - Page 208

ARP Inspection and MAC Address Filters, 1.2.2, Trusted vs. Untrusted Ports, 1.2.3, Syslog, 1.

Get ZyXEL ES-4124 PDF manuals and user guides

Add to My Manuals
Save this manual to your list of manuals

Page 208 highlights

Chapter 24 IP Source Guard 24.1.2.1 ARP Inspection and MAC Address Filters When the Switch identifies an unauthorized ARP packet, it automatically creates a MAC address filter to block traffic from the source MAC address and source VLAN ID of the unauthorized ARP packet. You can configure how long the MAC address filter remains in the Switch. These MAC address filters are different than regular MAC address filters (Chapter 10 on page 109). • They are stored only in volatile memory. • They do not use the same space in memory that regular MAC address filters use. • They appear only in the ARP Inspection screens and commands, not in the MAC Address Filter screens and commands. 24.1.2.2 Trusted vs. Untrusted Ports Every port is either a trusted port or an untrusted port for ARP inspection. This setting is independent of the trusted/untrusted setting for DHCP snooping. You can also specify the maximum rate at which the Switch receives ARP packets on untrusted ports. The Switch does not discard ARP packets on trusted ports for any reason. The Switch discards ARP packets on untrusted ports in the following situations: • The sender's information in the ARP packet does not match any of the current bindings. • The rate at which ARP packets arrive is too high. 24.1.2.3 Syslog The Switch can send syslog messages to the specified syslog server (Chapter 38 on page 311) when it forwards or discards ARP packets. The Switch can consolidate log messages and send log messages in batches to make this mechanism more efficient. 24.1.2.4 Configuring ARP Inspection Follow these steps to configure ARP inspection on the Switch. 1 Configure DHCP snooping. See Section 24.1.1.4 on page 207. " It is recommended you enable DHCP snooping at least one day before you enable ARP inspection so that the Switch has enough time to build the binding table. 2 Enable ARP inspection on each VLAN. 3 Configure trusted and untrusted ports, and specify the maximum number of ARP packets that each port can receive per second. 208 ES-4124 User's Guide

Section	Page
User’s Guide	1
About This User's Guide	3
Document Conventions	4
Safety Warnings	6
Contents Overview	9
Table of Contents	11
List of Figures	25
List of Tables	31
Introduction	35
Getting to Know Your Switch	37
1.1 Introduction	37
1.1.1 Backbone Application	37
1.1.2 Bridging Example	38
1.1.3 High Performance Switching Example	38
1.1.4 IEEE 802.1Q VLAN Application Examples	39
1.2 Ways to Manage the Switch	39
1.3 Good Habits for Managing the Switch	40
Hardware Installation and Connection	41
2.1 Freestanding Installation	41
2.2 Mounting the Switch on a Rack	42
2.2.1 Rack-mounted Installation Requirements	42
2.2.2 Attaching the Mounting Brackets to the Switch	42
2.2.3 Mounting the Switch on a Rack	43
Hardware Overview	45
3.1 Panel Connections	45
3.1.1 Console Port	46
3.1.2 Ethernet Ports	46
3.1.3 Mini-GBIC Slots	46
3.2 Rear Panel	48
3.3 Power Connections Overview	48
3.3.1 AC Power Connection	49
3.3.2 DC Power Connection	49
3.3.3 External Backup Power Supply Connector	50
3.3.4 Powering on the Switch	51
3.4 LEDs	51
Basic Configuration	53
The Web Configurator	55
4.1 Introduction	55
4.2 System Login	55
4.3 The Status Screen	56
4.3.1 Change Your Password	61
4.4 Saving Your Configuration	61
4.5 Switch Lockout	61
4.6 Resetting the Switch	62
4.6.1 Reload the Configuration File	62
4.7 Logging Out of the Web Configurator	63
4.8 Help	63
Initial Setup Example	65
5.1 Overview	65
5.1.1 Configuring an IP Interface	65
5.1.2 Configuring DHCP Server Settings	66
5.1.3 Creating a VLAN	67
5.1.4 Setting Port VID	68
5.1.5 Enabling RIP	69
System Status and Port Statistics	71
6.1 Overview	71
6.2 Port Status Summary	71
6.2.1 Status: Port Details	72
Basic Setting	77
7.1 Overview	77
7.2 System Information	77
7.3 General Setup	79
7.4 Introduction to VLANs	81
7.5 Switch Setup Screen	81
7.6 IP Setup	83
7.6.1 IP Interfaces	83
7.7 Port Setup	85
Advanced Setup	89
VLAN	91
8.1 Introduction to IEEE 802.1Q Tagged VLANs	91
8.1.1 Forwarding Tagged and Untagged Frames	91
8.2 Automatic VLAN Registration	92
8.2.1 GARP	92
8.2.2 GVRP	92
8.3 Port VLAN Trunking	93
8.4 Select the VLAN Type	93
8.5 Static VLAN	93
8.5.1 Static VLAN Status	94
8.5.2 Static VLAN Details	94
8.5.3 Configure a Static VLAN	95
8.5.4 Configure VLAN Port Settings	96
8.6 Subnet Based VLANs	98
8.7 Configuring Subnet Based VLAN	99
8.8 Protocol Based VLANs	100
8.9 Configuring Protocol Based VLAN	101
8.10 Create an IP-based VLAN Example	102
8.11 Port-based VLAN Setup	103
8.11.1 Configure a Port-based VLAN	104
Static MAC Forward Setup	107
9.1 Overview	107
9.2 Configuring Static MAC Forwarding	107
Filtering	109
10.1 Configure a Filtering Rule	109
Spanning Tree Protocol	111
11.1 STP/RSTP Overview	111
11.1.1 STP Terminology	111
11.1.2 How STP Works	112
11.1.3 STP Port States	113
11.1.4 Multiple RSTP	113
11.1.5 Multiple STP	114
11.2 Spanning Tree Protocol Status Screen	116
11.3 Spanning Tree Configuration	117
11.4 Configure Rapid Spanning Tree Protocol	118
11.5 Rapid Spanning Tree Protocol Status	120
11.6 Configure Multiple Rapid Spanning Tree Protocol	121
11.7 Multiple Rapid Spanning Tree Protocol Status	123
11.8 Configure Multiple Spanning Tree Protocol	124
11.9 Multiple Spanning Tree Protocol Status	127
Bandwidth Control	131
12.1 Bandwidth Control Overview	131
12.1.1 CIR and PIR	131
12.2 Bandwidth Control Setup	131
Broadcast Storm Control	133
13.1 Broadcast Storm Control Setup	133
Mirroring	135
14.1 Port Mirroring Setup	135
Link Aggregation	137
15.1 Link Aggregation Overview	137
15.2 Dynamic Link Aggregation	137
15.2.1 Link Aggregation ID	138
15.3 Link Aggregation Status	138
15.4 Link Aggregation Setting	139
15.5 Link Aggregation Control Protocol	140
15.6 Static Trunking Example	142
Port Authentication	145
16.1 Port Authentication Overview	145
16.1.1 IEEE 802.1x Authentication	145
16.1.2 MAC Authentication	146
16.2 Port Authentication Configuration	147
16.2.1 Activate IEEE 802.1x Security	147
16.2.2 Activate MAC Authentication	148
Port Security	151
17.1 About Port Security	151
17.2 Port Security Setup	151
Classifier	155
18.1 About the Classifier and QoS	155
18.2 Configuring the Classifier	155
18.3 Viewing and Editing Classifier Configuration	158
18.4 Classifier Example	159
Policy Rule	161
19.1 Policy Rules Overview	161
19.1.1 DiffServ	161
19.1.2 DSCP and Per-Hop Behavior	161
19.2 Configuring Policy Rules	162
19.3 Viewing and Editing Policy Configuration	164
19.4 Policy Example	165
Queuing Method	167
20.1 Queuing Method Overview	167
20.1.1 Strictly Priority	167
20.1.2 Weighted Fair Queuing	167
20.1.3 Weighted Round Robin Scheduling (WRR)	168
20.2 Configuring Queuing	168
VLAN Stacking	171
21.1 VLAN Stacking Overview	171
21.1.1 VLAN Stacking Example	171
21.2 VLAN Stacking Port Roles	172
21.3 VLAN Tag Format	173
21.3.1 Frame Format	173
21.4 Configuring VLAN Stacking	174
Multicast	177
22.1 Multicast Overview	177
22.1.1 IP Multicast Addresses	177
22.1.2 IGMP Filtering	177
22.1.3 IGMP Snooping	177
22.1.4 IGMP Snooping and VLANs	178
22.2 Multicast Status	178
22.3 Multicast Setting	178
22.4 IGMP Snooping VLAN	180
22.5 IGMP Filtering Profile	182
22.6 MVR Overview	183
22.6.1 Types of MVR Ports	183
22.6.2 MVR Modes	184
22.6.3 How MVR Works	184
22.7 General MVR Configuration	184
22.8 MVR Group Configuration	186
22.8.1 MVR Configuration Example	187
Authentication & Accounting	191
23.1 Authentication, Authorization and Accounting	191
23.1.1 Local User Accounts	191
23.1.2 RADIUS and TACACS+	192
23.2 Authentication and Accounting Screens	192
23.2.1 RADIUS Server Setup	192
23.2.2 TACACS+ Server Setup	194
23.2.3 Authentication and Accounting Setup	196
23.2.4 Vendor Specific Attribute	199
23.3 Supported RADIUS Attributes	200
23.3.1 Attributes Used for Authentication	201
23.3.2 Attributes Used for Accounting	201
IP Source Guard	205
24.1 IP Source Guard Overview	205
24.1.1 DHCP Snooping Overview	205
24.1.2 ARP Inspection Overview	207
24.2 IP Source Guard	209
24.3 IP Source Guard Static Binding	209
24.4 DHCP Snooping	211
24.5 DHCP Snooping Configure	214
24.5.1 DHCP Snooping Port Configure	215
24.5.2 DHCP Snooping VLAN Configure	217
24.6 ARP Inspection Status	218
24.6.1 ARP Inspection VLAN Status	218
24.6.2 ARP Inspection Log Status	219
24.7 ARP Inspection Configure	221
24.7.1 ARP Inspection Port Configure	222
24.7.2 ARP Inspection VLAN Configure	223
Loop Guard	225
25.1 Loop Guard Overview	225
25.2 Loop Guard Setup	227
IP Application	229
Static Route	231
26.1 Configuring Static Routing	231
RIP	233
27.1 RIP Overview	233
27.2 Configuring RIP	233
OSPF	235
28.1 OSPF Overview	235
28.1.1 OSPF Autonomous Systems and Areas	235
28.1.2 How OSPF Works	236
28.1.3 Interfaces and Virtual Links	236
28.1.4 OSPF and Router Elections	236
28.1.5 Configuring OSPF	237
28.2 OSPF Status	237
28.3 OSPF Configuration	239
28.4 Configure OSPF Areas	241
28.4.1 View OSPF Area Information Table	242
28.5 Configuring OSPF Interfaces	242
28.6 OSPF Virtual-Links	244
IGMP	247
29.1 IGMP Overview	247
29.1.1 How IGMP Works	248
29.2 Port-based IGMP	249
29.3 Configuring IGMP	249
DVMRP	251
30.1 DVMRP Overview	251
30.2 How DVMRP Works	251
30.2.1 DVMRP Terminology	252
30.3 Configuring DVMRP	252
30.3.1 DVMRP Configuration Error Messages	253
30.4 Default DVMRP Timer Values	254
IP Multicast	255
31.1 IP Multicast Overview	255
31.2 Configuring Multicast	255
Differentiated Services	257
32.1 DiffServ Overview	257
32.1.1 DSCP and Per-Hop Behavior	257
32.1.2 DiffServ Network Example	258
32.2 Two Rate Three Color Marker Traffic Policing	258
32.2.1 TRTCM - Color-blind Mode	259
32.2.2 TRTCM - Color-aware Mode	259
32.3 Activating DiffServ	260
32.3.1 Configuring 2-Rate 3 Color Marker Settings	260
32.4 DSCP-to-IEEE 802.1p Priority Settings	262
32.4.1 Configuring DSCP Settings	262
DHCP	265
33.1 DHCP Overview	265
33.1.1 DHCP Modes	265
33.1.2 DHCP Configuration Options	265
33.2 DHCP Status	266
33.3 DHCP Server Status Detail	266
33.4 DHCP Relay	267
33.4.1 DHCP Relay Agent Information	267
33.4.2 Configuring DHCP Global Relay	268
33.4.3 Global DHCP Relay Configuration Example	269
33.5 Configuring DHCP VLAN Settings	270
33.5.1 Example: DHCP Relay for Two VLANs	272
VRRP	273
34.1 VRRP Overview	273
34.2 VRRP Status	274
34.3 VRRP Configuration	275
34.3.1 IP Interface Setup	275
34.3.2 VRRP Parameters	276
34.3.3 Configuring VRRP Parameters	277
34.3.4 Configuring VRRP Parameters	278
34.4 VRRP Configuration Examples	278
34.4.1 One Subnet Network Example	278
34.4.2 Two Subnets Example	280
Management	283
Maintenance	285
35.1 The Maintenance Screen	285
35.2 Load Factory Default	286
35.3 Save Configuration	286
35.4 Reboot System	287
35.5 Firmware Upgrade	287
35.6 Restore a Configuration File	288
35.7 Backup a Configuration File	288
35.8 FTP Command Line	289
35.8.1 Filename Conventions	289
35.8.2 FTP Command Line Procedure	289
35.8.3 GUI-based FTP Clients	290
35.8.4 FTP Restrictions	290
Access Control	291
36.1 Access Control Overview	291
36.2 The Access Control Main Screen	291
36.3 About SNMP	292
36.3.1 SNMP v3 and Security	293
36.3.2 Supported MIBs	293
36.3.3 SNMP Traps	293
36.3.4 Configuring SNMP	296
36.3.5 Configuring SNMP Trap Group	298
36.3.6 Setting Up Login Accounts	299
36.4 SSH Overview	301
36.5 How SSH works	301
36.6 SSH Implementation on the Switch	302
36.6.1 Requirements for Using SSH	302
36.7 Introduction to HTTPS	302
36.8 HTTPS Example	303
36.8.1 Internet Explorer Warning Messages	303
36.8.2 Netscape Navigator Warning Messages	304
36.8.3 The Main Screen	304
36.9 Service Port Access Control	305
36.10 Remote Management	306
Diagnostic	309
37.1 Diagnostic	309
Syslog	311
38.1 Syslog Overview	311
38.2 Syslog Setup	311
38.3 Syslog Server Setup	312
Cluster Management	315
39.1 Clustering Management Status Overview	315
39.2 Cluster Management Status	316
39.2.1 Cluster Member Switch Management	317
39.3 Clustering Management Configuration	318
MAC Table	321
40.1 MAC Table Overview	321
40.2 Viewing the MAC Table	322
IP Table	323
41.1 IP Table Overview	323
41.2 Viewing the IP Table	324
ARP Table	325
42.1 ARP Table Overview	325
42.1.1 How ARP Works	325
42.2 Viewing the ARP Table	325
Routing Table	327
43.1 Overview	327
43.2 Viewing the Routing Table Status	327
Configure Clone	329
44.1 Configure Clone	329
Commands and Troubleshooting	331
Introducing Commands	333
45.1 Overview	333
45.2 Accessing the CLI	333
45.2.1 The Console Port	333
45.3 The Login Screen	334
45.4 Command Syntax Conventions	334
45.5 Changing the Password	335
45.6 Creating a New IP Interface	335
45.7 Privilege Levels	336
45.8 Command Modes	336
45.9 Getting Help	337
45.9.1 List of Available Commands	338
45.10 Using Command History	339
45.11 Saving Your Configuration	339
45.11.1 Switch Configuration File	340
45.11.2 Logging Out	340
45.12 Command Summary	340
45.12.1 User Mode	340
45.12.2 Enable Mode	341
45.12.3 General Configuration Mode	351
45.12.4 interface port-channel Commands	377
45.12.5 interface route-domain Commands	382
45.12.6 config-vlan Commands	384
45.13 mvr Commands	385
User and Enable Mode Commands	387
46.1 Overview	387
46.2 show Commands	387
46.2.1 show system-information	387
46.2.2 show ip	388
46.2.3 show logging	388
46.2.4 show interface	388
46.2.5 show mac address-table	389
46.3 ping	390
46.4 traceroute	390
46.5 Copy Port Attributes	391
46.6 Configuration File Maintenance	391
46.6.1 Using a Different Configuration File	392
46.6.2 Resetting to the Factory Default	392
Configuration Mode Commands	393
47.1 Enabling IGMP Snooping	393
47.2 Configure IGMP Filter	394
47.3 Enabling STP	395
47.4 no Command Examples	396
47.4.1 Disable Commands	396
47.4.2 Resetting Commands	397
47.4.3 Re-enable commands	397
47.4.4 Other Examples of no Commands	397
47.5 Queuing Method Commands	399
47.6 Static Route Commands	400
47.7 Enabling MAC Filtering	400
47.8 Enabling Trunking	401
47.9 Enabling Port Authentication	402
47.9.1 RADIUS Server Settings	402
47.9.2 Port Authentication Settings	403
Interface Commands	405
48.1 Overview	405
48.2 Interface Command Examples	405
48.2.1 interface port-channel	405
48.2.2 IEEE 802.3ah Link Layer Ethernet OAM Implementation	405
48.2.3 bpdu-control	407
48.2.4 broadcast-limit	408
48.2.5 bandwidth-limit	408
48.2.6 mirror	409
48.2.7 gvrp	409
48.2.8 ingress-check	410
48.2.9 frame-type	410
48.2.10 weight	410
48.2.11 egress set	411
48.2.12 qos priority	411
48.2.13 name	412
48.2.14 speed-duplex	412
48.2.15 test	412
48.3 Interface no Command Examples	413
48.3.1 no bandwidth-limit	413
IEEE 802.1Q Tagged VLAN Commands	415
49.1 Configuring Tagged VLAN	415
49.2 Global VLAN1Q Tagged VLAN Configuration Commands	416
49.2.1 GARP Status	416
49.2.2 GARP Timer	416
49.2.3 GVRP Timer	417
49.2.4 Enable GVRP	417
49.2.5 Disable GVRP	417
49.3 Port VLAN Commands	417
49.3.1 Set Port VID	417
49.3.2 Set Acceptable Frame Type	418
49.3.3 Enable or Disable Port GVRP	418
49.3.4 Modify Static VLAN	418
49.3.5 Delete VLAN ID	420
49.4 Enable VLAN	420
49.5 Disable VLAN	420
49.6 Show VLAN Setting	420
Multicast VLAN Registration Commands	423
50.1 Overview	423
50.2 Create Multicast VLAN	423
Routing Domain Command Examples	425
51.0.1 interface route-domain	425
Troubleshooting	427
52.1 Problems Starting Up the Switch	427
52.2 Problems Accessing the Switch	427
52.2.1 Pop-up Windows, JavaScripts and Java Permissions	428
52.3 Problems with the Password	433
Appendices and Index	435
Product Specifications	437
Legal Information	443
Customer Support	447

Match case Limit results 1 per page

Chapter 24 IP Source Guard

ES-4124 User’s Guide

208

24.1.2.1

ARP Inspection and MAC Address Filters

When the Switch identifies an unauthorized ARP packet, it automatically creates a MAC

address filter to block traffic from the source MAC address and source VLAN ID of the

unauthorized ARP packet. You can configure how long the MAC address filter remains in the

Switch.

These MAC address filters are different than regular MAC address filters (

Chapter 10 on page

109

•

They are stored only in volatile memory.

•

They do not use the same space in memory that regular MAC address filters use.

•

They appear only in the

ARP Inspection

screens and commands, not in the

MAC

Address Filter

screens and commands.

24.1.2.2

Trusted vs. Untrusted Ports

Every port is either a trusted port or an untrusted port for ARP inspection. This setting is

independent of the trusted/untrusted setting for DHCP snooping. You can also specify the

maximum rate at which the Switch receives ARP packets on untrusted ports.

The Switch does not discard ARP packets on trusted ports for any reason.

The Switch discards ARP packets on untrusted ports in the following situations:

•

The sender’s information in the ARP packet does not match any of the current bindings.

•

The rate at which ARP packets arrive is too high.

24.1.2.3

Syslog

The Switch can send syslog messages to the specified syslog server (

Chapter 38 on page 311

)

when it forwards or discards ARP packets. The Switch can consolidate log messages and send

log messages in batches to make this mechanism more efficient.

24.1.2.4

Configuring ARP Inspection

Follow these steps to configure ARP inspection on the Switch.

Configure DHCP snooping. See

Section 24.1.1.4 on page 207

It is recommended you enable DHCP snooping at least one day before you

enable ARP inspection so that the Switch has enough time to build the binding

table.

Enable ARP inspection on each VLAN.

Configure trusted and untrusted ports, and specify the maximum number of ARP packets

that each port can receive per second.