Home » ZyXEL Manuals » Hubs & Switches » ZyXEL MES3500 Series » Manual Viewer

ZyXEL MES3500 Series User Guide - Page 294

Introduction to HTTPS

View all ZyXEL MES3500 Series manuals

Add to My Manuals
Save this manual to your list of manuals

Page 294 highlights

Chapter 38 Access Control 38.7.1 Requirements for Using SSH You must install an SSH client program on a client computer (Windows or Linux operating system) that is used to connect to the Switch over SSH. 38.8 Introduction to HTTPS HTTPS (HyperText Transfer Protocol over Secure Socket Layer, or HTTP over SSL) is a web protocol that encrypts and decrypts web pages. Secure Socket Layer (SSL) is an application-level protocol that enables secure transactions of data by ensuring confidentiality (an unauthorized party cannot read the transferred data), authentication (one party can identify the other party) and data integrity (you know if data has been changed). It relies upon certificates, public keys, and private keys. HTTPS on the Switch is used so that you may securely access the Switch using the web configurator. The SSL protocol specifies that the SSL server (the Switch) must always authenticate itself to the SSL client (the computer which requests the HTTPS connection with the Switch), whereas the SSL client only should authenticate itself when the SSL server requires it to do so. Authenticating client certificates is optional and if selected means the SSL-client must send the Switch a certificate. You must apply for a certificate for the browser from a CA that is a trusted CA on the Switch. Please refer to the following figure. 1 HTTPS connection requests from an SSL-aware web browser go to port 443 (by default) on the Switch's WS (web server). 2 HTTP connection requests from a web browser go to port 80 (by default) on the Switch's WS (web server). Figure 187 HTTPS Implementation Note: If you disable HTTP in the Service Access Control screen, then the Switch blocks all HTTP connection attempts. MES3500/MGS3520 Series User's Guide 294

Section	Page
MES3500/MGS3520 Series	1
Contents Overview	3
Table of Contents	5
User’s Guide	16
Getting to Know Your Switch	17
1.1 Introduction	17
1.1.1 Backbone Application	17
1.1.2 Bridging Example	18
1.1.3 High Performance Switching Example	18
1.1.4 IEEE 802.1Q VLAN Application Examples	19
1.1.5 IPv6 Support	20
1.2 Ways to Manage the Switch	20
1.3 Good Habits for Managing the Switch	21
Hardware Installation and Connection	22
2.1 Installation Scenarios	22
2.2 Desktop Installation Procedure	22
2.3 Mounting the Switch on a Rack	22
2.3.1 Rack-mounted Installation Requirements	22
2.3.2 Attaching the Mounting Brackets to the Switch	23
2.3.3 Mounting the Switch on a Rack	23
Hardware Overview	25
3.1 Front Panel	25
3.1.1 Console Port	27
3.1.2 Ethernet Ports	28
3.1.3 Transceiver Slots	29
3.1.4 Power Connector	30
3.1.5 Signal Slot	31
3.2 LEDs	33
The Web Configurator	35
4.1 Introduction	35
4.2 System Login	35
4.3 The Web Configurator Layout	36
4.3.1 Change Your Password	39
4.4 Saving Your Configuration	40
4.5 Switch Lockout	40
4.6 Resetting the Switch	41
4.6.1 Reload the Configuration File	41
4.7 Logging Out of the Web Configurator	42
4.8 Help	42
Initial Setup Example	43
5.1 Overview	43
5.1.1 Creating a VLAN	43
5.1.2 Setting Port VID	44
5.2 Configuring Switch Management IP Address	45
Tutorials	47
6.1 How to Use DHCP Snooping on the Switch	47
6.2 How to Use DHCP Relay on the Switch	50
6.2.1 DHCP Relay Tutorial Introduction	50
6.2.2 Creating a VLAN	51
6.2.3 Configuring DHCP Relay	53
6.2.4 Troubleshooting	54
6.3 How to Use PPPoE IA on the Switch	54
6.3.1 Configuring Switch A	55
6.3.2 Configuring Switch B	57
6.4 How to Use Error Disable and Recovery on the Switch	60
6.5 How to Set Up a Guest VLAN	62
6.5.1 Creating a Guest VLAN	62
6.5.2 Enabling IEEE 802.1x Port Authentication	65
6.5.3 Enabling Guest VLAN	66
6.6 How to Do Port Isolation in a VLAN	67
6.6.1 Creating a VLAN	68
6.6.2 Creating a Private VLAN Rule	70
Technical Reference	72
System Status and Port Statistics	73
7.1 Overview	73
7.2 Port Status Summary	73
7.2.1 Status: Port Details	74
Basic Setting	78
8.1 Overview	78
8.2 System Information	78
8.3 General Setup	79
8.4 Introduction to VLANs	81
8.4.1 Smart Isolation	82
8.5 Switch Setup	83
8.6 IP Setup	85
8.6.1 Management IP Addresses	85
8.7 Port Setup	87
VLAN	89
9.1 Introduction to IEEE 802.1Q Tagged VLANs	89
9.1.1 Forwarding Tagged and Untagged Frames	89
9.2 Automatic VLAN Registration	90
9.2.1 GARP	90
9.2.2 GVRP	90
9.3 Port VLAN Trunking	91
9.4 Select the VLAN Type	91
9.5 Static VLAN	91
9.5.1 VLAN Status	92
9.5.2 VLAN Details	92
9.5.3 Configure a Static VLAN	93
9.5.4 Configure VLAN Port Settings	95
9.6 Subnet Based VLANs	96
9.7 Configuring Subnet Based VLAN	97
9.8 Protocol Based VLANs	98
9.9 Configuring Protocol Based VLAN	99
9.10 Create an IP-based VLAN Example	100
9.11 Port-based VLAN Setup	101
9.11.1 Configure a Port-based VLAN	102
Static MAC Forward Setup	105
10.1 Overview	105
10.2 Configuring Static MAC Forwarding	105
Static Multicast Forward Setup	107
11.1 Static Multicast Forwarding Overview	107
11.2 Configuring Static Multicast Forwarding	108
Filtering	110
12.1 Configure a Filtering Rule	110
Spanning Tree Protocol	112
13.1 STP/RSTP Overview	112
13.1.1 STP Terminology	112
13.1.2 How STP Works	113
13.1.3 STP Port States	113
13.1.4 Multiple RSTP	113
13.1.5 Multiple STP	114
13.2 Spanning Tree Protocol Status Screen	117
13.3 Spanning Tree Configuration	117
13.4 Configure Rapid Spanning Tree Protocol	118
13.5 Rapid Spanning Tree Protocol Status	120
13.6 Configure Multiple Rapid Spanning Tree Protocol	121
13.7 Multiple Rapid Spanning Tree Protocol Status	123
13.8 Configure Multiple Spanning Tree Protocol	124
13.8.1 Multiple Spanning Tree Protocol Port Configuration	127
13.9 Multiple Spanning Tree Protocol Status	128
Bandwidth Control	131
14.1 Bandwidth Control Overview	131
14.1.1 CIR and PIR	131
14.2 Bandwidth Control Setup	131
Broadcast Storm Control	133
15.1 Broadcast Storm Control Setup	133
Mirroring	135
16.1 Port Mirroring Setup	135
Link Aggregation	137
17.1 Link Aggregation Overview	137
17.2 Dynamic Link Aggregation	137
17.2.1 Link Aggregation ID	138
17.3 Link Aggregation Status	138
17.4 Link Aggregation Setting	139
17.5 Link Aggregation Control Protocol	141
17.6 Static Trunking Example	142
Port Authentication	144
18.1 Port Authentication Overview	144
18.1.1 IEEE 802.1x Authentication	144
18.1.2 MAC Authentication	145
18.2 Port Authentication Configuration	146
18.2.1 Activate IEEE 802.1x Security	146
18.2.2 Guest VLAN	148
18.2.3 Activate MAC Authentication	150
Port Security	152
19.1 About Port Security	152
19.2 Port Security Setup	152
Classifier	154
20.1 About the Classifier and QoS	154
20.2 Configuring the Classifier	154
20.3 Viewing and Editing Classifier Configuration	157
20.4 Classifier Example	158
Policy Rule	160
21.1 Policy Rules Overview	160
21.1.1 DiffServ	160
21.1.2 DSCP and Per-Hop Behavior	160
21.2 Configuring Policy Rules	160
21.3 Viewing and Editing Policy Configuration	162
21.4 Policy Example	163
Queuing Method	165
22.1 Queuing Method Overview	165
22.1.1 Strictly Priority Queuing	165
22.1.2 Weighted Fair Queuing	165
22.1.3 Weighted Round Robin Scheduling (WRR)	166
22.2 Configuring Queuing	166
VLAN Stacking	168
23.1 VLAN Stacking Overview	168
23.1.1 VLAN Stacking Example	168
23.2 VLAN Stacking Port Roles	169
23.3 VLAN Tag Format	169
23.3.1 Frame Format	170
23.4 Configuring VLAN Stacking	170
23.4.1 Port-based Q-in-Q	172
23.4.2 Selective Q-in-Q	172
Multicast	175
24.1 Multicast Overview	175
24.1.1 IP Multicast Addresses	175
24.1.2 IGMP Filtering	175
24.1.3 IGMP Snooping	175
24.1.4 IGMP Snooping and VLANs	176
24.2 Multicast Status	176
24.3 Multicast Setting	176
24.4 IGMP Snooping VLAN	179
24.5 IGMP Filtering Profile	181
24.6 MVR Overview	182
24.6.1 Types of MVR Ports	182
24.6.2 MVR Modes	183
24.6.3 How MVR Works	183
24.7 General MVR Configuration	183
24.8 MVR Group Configuration	185
24.8.1 MVR Configuration Example	186
AAA	189
25.1 Authentication, Authorization and Accounting (AAA)	189
25.1.1 Local User Accounts	189
25.1.2 RADIUS and TACACS+	190
25.2 AAA Screens	190
25.2.1 RADIUS Server Setup	190
25.2.2 TACACS+ Server Setup	192
25.2.3 AAA Setup	194
25.2.4 Vendor Specific Attribute	197
25.2.5 Tunnel Protocol Attribute	198
25.3 Supported RADIUS Attributes	198
25.3.1 Attributes Used for Authentication	199
25.3.2 Attributes Used for Accounting	199
IP Source Guard	202
26.1 IP Source Guard Overview	202
26.1.1 DHCP Snooping Overview	202
26.1.2 ARP Inspection Overview	204
26.2 IP Source Guard	206
26.3 IP Source Guard Static Binding	206
26.4 DHCP Snooping	207
26.5 DHCP Snooping Configure	210
26.5.1 DHCP Snooping Port Configure	212
26.5.2 DHCP Snooping VLAN Configure	213
26.6 ARP Inspection Status	214
26.6.1 ARP Inspection VLAN Status	215
26.6.2 ARP Inspection Log Status	216
26.7 ARP Inspection Configure	217
26.7.1 ARP Inspection Port Configure	218
26.7.2 ARP Inspection VLAN Configure	219
Loop Guard	221
27.1 Loop Guard Overview	221
27.2 Loop Guard Setup	223
VLAN Mapping	224
28.1 VLAN Mapping Overview	224
28.1.1 VLAN Mapping Example	224
28.2 Enabling VLAN Mapping	224
28.3 Configuring VLAN Mapping	225
Layer 2 Protocol Tunneling	227
29.1 Layer 2 Protocol Tunneling Overview	227
29.1.1 Layer-2 Protocol Tunneling Mode	228
29.2 Configuring Layer 2 Protocol Tunneling	228
sFlow	231
30.1 sFlow Overview	231
30.2 sFlow Port Configuration	231
30.2.1 sFlow Collector Configuration	233
PPPoE	235
31.1 PPPoE Intermediate Agent Overview	235
31.1.1 PPPoE Intermediate Agent Tag Format	235
31.1.2 Sub-Option Format	235
31.1.3 Port State	236
31.2 The PPPoE Screen	237
31.3 PPPoE Intermediate Agent	237
31.3.1 PPPoE IA Per-Port	239
31.3.2 PPPoE IA Per-Port Per-VLAN	240
31.3.3 PPPoE IA for VLAN	242
Error Disable	243
32.1 CPU Protection Overview	243
32.2 Error-Disable Recovery Overview	243
32.3 The Error Disable Screen	243
32.4 CPU Protection Configuration	244
32.5 Error-Disable Detect Configuration	245
32.6 Error-Disable Recovery Configuration	246
Private VLAN	247
33.1 Private VLAN Overview	247
33.2 Configuring Private VLAN	247
Static Route	249
34.1 Static Routing Overview	249
34.2 Configuring Static Routing	249
Differentiated Services	252
35.1 DiffServ Overview	252
35.1.1 DSCP and Per-Hop Behavior	252
35.1.2 DiffServ Network Example	252
35.2 Two Rate Three Color Marker Traffic Policing	253
35.2.1 TRTCM-Color-blind Mode	254
35.2.2 TRTCM-Color-aware Mode	254
35.3 Activating DiffServ	254
35.3.1 Configuring 2-Rate 3 Color Marker Settings	255
35.3.2 Configuring DSCP Profiles	257
35.4 DSCP-to-IEEE 802.1p Priority Settings	258
35.4.1 Configuring DSCP Settings	258
DHCP	260
36.1 DHCP Overview	260
36.1.1 DHCP Modes	260
36.1.2 DHCP Configuration Options	260
36.2 DHCP Status	260
36.2.1 Option 82 Profile	261
36.3 DHCP Relay	262
36.3.1 DHCP Relay Agent Information	263
36.3.2 Configuring DHCP Global Relay	263
36.3.3 Global DHCP Relay Configuration Example	264
36.4 Configuring DHCP VLAN Settings	265
36.4.1 Example: DHCP Relay for Two VLANs	266
Maintenance	268
37.1 The Maintenance Screen	268
37.2 Load Factory Default	269
37.3 Save Configuration	269
37.4 Reboot System	269
37.5 Firmware Upgrade	270
37.6 Restore a Configuration File	270
37.7 Backup a Configuration File	271
37.8 FTP Command Line	271
37.8.1 Filename Conventions	272
37.8.2 FTP Command Line Procedure	272
37.8.3 GUI-based FTP Clients	273
37.8.4 FTP Restrictions	273
Access Control	274
38.1 Access Control Overview	274
38.2 The Access Control Main Screen	274
38.3 About SNMP	274
38.3.1 SNMP v3 and Security	275
38.3.2 Supported MIBs	276
38.3.3 SNMP Traps	276
38.3.4 Configuring SNMP	285
38.3.5 Configuring SNMP Trap Group	287
38.3.6 Enabling/Disabling Sending of SNMP Traps on a Port	288
38.3.7 Configuring SNMP User	289
38.4 Setting Up Login Accounts	291
38.5 SSH Overview	292
38.6 How SSH works	292
38.7 SSH Implementation on the Switch	293
38.7.1 Requirements for Using SSH	294
38.8 Introduction to HTTPS	294
38.9 HTTPS Example	295
38.9.1 Internet Explorer Warning Messages	295
38.9.2 Mozilla Firefox Warning Messages	296
38.9.3 The Main Screen	298
38.10 Service Port Access Control	298
38.11 Remote Management	299
Diagnostic	301
39.1 Diagnostic	301
Syslog	302
40.1 Syslog Overview	302
40.2 Syslog Setup	302
40.3 Syslog Server Setup	303
Cluster Management	305
41.1 Cluster Management Status Overview	305
41.2 Cluster Management Status	306
41.2.1 Cluster Member Switch Management	307
41.3 Clustering Management Configuration	308
MAC Table	311
42.1 MAC Table Overview	311
42.2 Viewing the MAC Table	312
ARP Table	314
43.1 ARP Table Overview	314
43.1.1 How ARP Works	314
43.2 The ARP Table Screen	314
Configure Clone	316
44.1 Configure Clone	316
Troubleshooting	318
45.1 Power, Hardware Connections, and LEDs	318
45.2 Switch Access and Login	319
45.3 Switch Configuration	321
Common Services	322
Legal Information	325

Match case Limit results 1 per page

Chapter 38 Access Control

MES3500/MGS3520 Series User’s Guide

294

38.7.1

Requirements for Using SSH

You must install an SSH client program on a client computer (Windows or Linux operating system)

that is used to connect to the Switch over SSH.

38.8

Introduction to HTTPS

HTTPS (HyperText Transfer Protocol over Secure Socket Layer, or HTTP over SSL) is a web protocol

that encrypts and decrypts web pages. Secure Socket Layer (SSL) is an application-level protocol

that enables secure transactions of data by ensuring confidentiality (an unauthorized party cannot

read the transferred data), authentication (one party can identify the other party) and data

integrity (you know if data has been changed).

It relies upon certificates, public keys, and private keys.

HTTPS on the Switch is used so that you may securely access the Switch using the web

configurator. The SSL protocol specifies that the SSL server (the Switch) must always authenticate

itself to the SSL client (the computer which requests the HTTPS connection with the Switch),

whereas the SSL client only should authenticate itself when the SSL server requires it to do so.

Authenticating client certificates is optional and if selected means the SSL-client must send the

Switch a certificate. You must apply for a certificate for the browser from a CA that is a trusted CA

on the Switch.

Please refer to the following figure.

HTTPS connection requests from an SSL-aware web browser go to port 443 (by default) on the

Switch’s WS (web server).

HTTP connection requests from a web browser go to port 80 (by default) on the Switch’s WS (web

server).

Figure 187

HTTPS Implementation

Note: If you disable

HTTP

in the

Service Access Control

screen, then the Switch

blocks

all HTTP connection attempts.