Home » ZyXEL Manuals » Hubs & Switches » ZyXEL XS3700 Series » Manual Viewer

ZyXEL XS3700 Series User Guide - Page 373

Introduction to HTTPS

View all ZyXEL XS3700 Series manuals

Add to My Manuals
Save this manual to your list of manuals

Page 373 highlights

Chapter 43 Access Control 43.7.1 Requirements for Using SSH You must install an SSH client program on a client computer (Windows or Linux operating system) that is used to connect to the Switch over SSH. 43.8 Introduction to HTTPS HTTPS (HyperText Transfer Protocol over Secure Socket Layer, or HTTP over SSL) is a web protocol that encrypts and decrypts web pages. Secure Socket Layer (SSL) is an application-level protocol that enables secure transactions of data by ensuring confidentiality (an unauthorized party cannot read the transferred data), authentication (one party can identify the other party) and data integrity (you know if data has been changed). It relies upon certificates, public keys, and private keys. HTTPS on the Switch is used so that you may securely access the Switch using the web configurator. The SSL protocol specifies that the SSL server (the Switch) must always authenticate itself to the SSL client (the computer which requests the HTTPS connection with the Switch), whereas the SSL client only should authenticate itself when the SSL server requires it to do so. Authenticating client certificates is optional and if selected means the SSL-client must send the Switch a certificate. You must apply for a certificate for the browser from a Certificate Authority (CA) that is a trusted CA on the Switch. Please refer to the following figure. 1 HTTPS connection requests from an SSL-aware web browser go to port 443 (by default) on the Switch's WS (web server). 2 HTTP connection requests from a web browser go to port 80 (by default) on the Switch's WS (web server). Figure 259 HTTPS Implementation Note: If you disable HTTP in the Service Access Control screen, then the Switch blocks all HTTP connection attempts. XS3700 Series User's Guide 373

Section	Page
XS3700 Series	1
Contents Overview	3
Table of Contents	5
User’s Guide	18
Getting to Know Your Switch	19
1.1 Introduction	19
1.1.1 Bridging Example	19
1.1.2 High Performance Switching Example	20
1.1.3 Gigabit Ethernet to the Desktop	20
1.1.4 IEEE 802.1Q VLAN Application Example	21
1.1.5 IPv6 Support	22
1.2 Ways to Manage the Switch	22
1.3 Good Habits for Managing the Switch	23
Hardware Installation and Connection	24
2.1 Freestanding Installation	24
2.2 Mounting the Switch on a Rack	25
2.3 Installation Requirements	25
2.3.1 Precautions	25
2.4 Attaching the Brackets to the Switch	25
2.5 Mounting the Switch on a Rack	26
2.6 Power Module Installation	27
Hardware Overview	28
3.1 Front Panel Connections	28
3.1.1 Ethernet Ports	28
3.1.2 SFP/SFP+ Slots	29
3.1.3 Management Port	31
3.1.4 Console Port	31
3.2 Rear Panel	31
3.2.1 Removing and Installing the Fan Module	31
3.2.2 Power Connection	31
3.3 LEDs	33
The Web Configurator	35
4.1 Introduction	35
4.2 System Login	35
4.3 The Web Configurator Layout	36
4.3.1 Change Your Password	40
4.4 Saving Your Configuration	40
4.5 Switch Lockout	41
4.6 Resetting the Switch	41
4.6.1 Reload the Configuration File	41
4.7 Logging Out of the Web Configurator	42
4.8 Help	43
Technical Reference	44
ZON Utility, ZON Neighbor Management and Port Status	45
5.1 Overview	45
5.2 ZyXEL One Network (ZON) Utility Screen	45
5.3 ZON Neighbor Screen	46
5.4 Port Status Summary	47
5.4.1 Status: Port Details	48
Basic Setting	52
6.1 System Information	52
6.2 General Setup	54
6.3 Introduction to VLANs	55
6.4 Switch Setup	56
6.5 IP Setup	58
6.5.1 IP Status	58
6.5.2 IP Status Details	58
6.5.3 IP Configuration	60
6.6 Port Setup	63
6.7 Interface Setup	65
6.8 IPv6	66
6.8.1 IPv6 Interface Status	66
6.8.2 IPv6 Configuration	69
6.8.3 IPv6 Global Setup	70
6.8.4 IPv6 Interface Setup	70
6.8.5 IPv6 Link-Local Address Setup	71
6.8.6 IPv6 Global Address Setup	72
6.8.7 IPv6 Neighbor Discovery Setup	73
6.8.8 IPv6 Router Discovery Setup	74
6.8.9 IPv6 Prefix Setup	76
6.8.10 IPv6 Neighbor Setup	77
6.8.11 DHCPv6 Client Setup	78
VLAN	80
7.1 Overview	80
7.1.1 What You Can Do	80
7.2 Introduction to IEEE 802.1Q Tagged VLANs	80
7.2.1 Forwarding Tagged and Untagged Frames	81
7.2.2 Automatic VLAN Registration	81
7.2.3 Port VLAN Trunking	82
7.2.4 Select the VLAN Type	83
7.2.5 802.1Q Static VLAN	83
7.3 VLAN Status	83
7.3.1 VLAN Details	84
7.4 Private VLAN Status	86
7.5 VLAN Configuration	86
7.6 Configure a Static VLAN	87
7.7 Configure VLAN Port Settings	89
7.8 Subnet Based VLANs	91
7.8.1 Configuring Subnet Based VLAN	92
7.9 Protocol Based VLANs	93
7.9.1 Configuring Protocol Based VLAN	94
7.10 Voice VLAN	95
7.11 MAC-based VLAN	97
7.12 Port-based VLAN Setup	98
7.13 Port-based VLAN	99
Static MAC Forward Setup	101
8.1 Overview	101
8.2 Configuring Static MAC Forwarding	101
Static Multicast Forward Setup	103
9.1 Static Multicast Forwarding Overview	103
9.2 Configuring Static Multicast Forwarding	104
Filtering	106
10.1 Configure a Filtering Rule	106
Spanning Tree Protocol	108
11.1 STP/RSTP Overview	108
11.1.1 STP Terminology	108
11.1.2 How STP Works	109
11.1.3 STP Port States	109
11.1.4 Multiple RSTP	109
11.1.5 Multiple STP	110
11.2 Spanning Tree Protocol Status Screen	112
11.3 Spanning Tree Configuration	113
11.4 Configure Rapid Spanning Tree Protocol	114
11.5 Rapid Spanning Tree Protocol Status	115
11.6 Configure Multiple Rapid Spanning Tree Protocol	116
11.7 Multiple Rapid Spanning Tree Protocol Status	118
11.8 Configure Multiple Spanning Tree Protocol	119
11.8.1 Multiple Spanning Tree Protocol Port Configuration	122
11.9 Multiple Spanning Tree Protocol Status	124
Bandwidth Control	126
12.1 Bandwidth Control Overview	126
12.1.1 CIR and PIR	126
12.2 Bandwidth Control Setup	126
Broadcast Storm Control	128
13.1 Broadcast Storm Control Setup	128
Mirroring	130
14.1 Port Mirroring	130
14.1.1 Local Port Mirroring	133
14.1.2 Remote Port Mirroring	134
14.1.3 Source	135
14.1.4 Destination	136
14.1.5 Connected Port	137
Link Aggregation	140
15.1 Link Aggregation Overview	140
15.2 Dynamic Link Aggregation	140
15.2.1 Link Aggregation ID	141
15.3 Link Aggregation Status	141
15.4 Link Aggregation Setting	142
15.5 Link Aggregation Control Protocol	144
15.6 Static Trunking Example	146
Port Authentication	148
16.1 Port Authentication Overview	148
16.1.1 IEEE 802.1x Authentication	148
16.1.2 MAC Authentication	149
16.2 Port Authentication Configuration	150
16.2.1 Activate IEEE 802.1x Security	150
16.2.2 Guest VLAN	152
16.2.3 Activate MAC Authentication	154
Port Security	156
17.1 About Port Security	156
17.2 Port Security Setup	156
17.3 VLAN MAC Address Limit	157
Time Range	159
18.1 About Time Range	159
18.2 Time Range Setup	159
Classifier	161
19.1 Overview	161
19.1.1 What You Can Do	161
19.1.2 What You Need to Know	161
19.2 Classifier Status	161
19.3 Classifier Configuration	162
19.3.1 Viewing and Editing Classifier Configuration	165
19.3.2 Classifier Global Setting	167
19.4 Classifier Example	168
Policy Rule	170
20.1 Policy Rules Overview	170
20.1.1 DiffServ	170
20.1.2 DSCP and Per-Hop Behavior	170
20.2 Configuring Policy Rules	170
20.3 Viewing and Editing Policy Configuration	173
20.4 Policy Example	173
Queuing Method	175
21.1 Queuing Method Overview	175
21.1.1 Strictly Priority	175
21.1.2 Weighted Fair Queuing	175
21.1.3 Weighted Round Robin Scheduling (WRR)	176
21.2 Configuring Queuing	176
VLAN Stacking	178
22.1 VLAN Stacking Overview	178
22.1.1 VLAN Stacking Example	178
22.2 VLAN Stacking Port Roles	179
22.3 VLAN Tag Format	179
22.3.1 Frame Format	180
22.4 Configuring VLAN Stacking	180
22.4.1 Port-based Q-in-Q	182
22.4.2 Selective Q-in-Q	182
Multicast	185
23.1 Multicast Overview	185
23.1.1 IP Multicast Addresses	185
23.1.2 IGMP Filtering	185
23.1.3 IGMP Snooping	186
23.1.4 IGMP Snooping and VLANs	186
23.1.5 MLD Snooping-Proxy	186
23.1.6 MLD Messages	187
23.2 Multicast Setup	187
23.3 IPv4 Multicast Status	188
23.3.1 IGMP Snooping	188
23.3.2 IGMP Snooping VLAN	191
23.3.3 IGMP Filtering Profile	192
23.4 IPv6 Multicast Status	194
23.4.1 MLD Snooping-proxy	194
23.4.2 MLD Snooping-proxy VLAN	195
23.4.3 MLD Snooping-proxy VLAN Port Role Setting	196
23.4.4 MLD Snooping-proxy Filtering	198
23.4.5 MLD Snooping-proxy Filtering Profile	199
23.5 MVR Overview	200
23.5.1 Types of MVR Ports	201
23.5.2 MVR Modes	201
23.5.3 How MVR Works	201
23.6 General MVR Configuration	202
23.6.1 MVR Group Configuration	204
23.6.2 MVR Configuration Example	206
AAA	208
24.1 Authentication, Authorization and Accounting (AAA)	208
24.1.1 Local User Accounts	208
24.1.2 RADIUS and TACACS+	209
24.2 AAA Screens	209
24.2.1 RADIUS Server Setup	209
24.2.2 TACACS+ Server Setup	211
24.2.3 AAA Setup	213
24.2.4 Vendor Specific Attribute	216
24.2.5 Tunnel Protocol Attribute	217
24.3 Supported RADIUS Attributes	217
24.3.1 Attributes Used for Authentication	218
24.3.2 Attributes Used for Accounting	218
IP Source Guard	221
25.1 IP Source Guard Overview	221
25.1.1 DHCP Snooping Overview	221
25.1.2 ARP Inspection Overview	223
25.2 IP Source Guard	225
25.3 IP Source Guard Static Binding	225
25.4 DHCP Snooping	227
25.5 DHCP Snooping Configure	230
25.5.1 DHCP Snooping Port Configure	232
25.5.2 DHCP Snooping VLAN Configure	233
25.5.3 DHCP Snooping VLAN Port Configure	234
25.6 ARP Inspection Status	235
25.6.1 ARP Inspection VLAN Status	236
25.6.2 ARP Inspection Log Status	237
25.7 ARP Inspection Configure	239
25.7.1 ARP Inspection Port Configure	240
25.7.2 ARP Inspection VLAN Configure	241
Loop Guard	243
26.1 Loop Guard Overview	243
26.2 Loop Guard Setup	245
VLAN Mapping	246
27.1 VLAN Mapping Overview	246
27.1.1 VLAN Mapping Example	246
27.2 Enabling VLAN Mapping	246
27.3 Configuring VLAN Mapping	247
Layer 2 Protocol Tunneling	249
28.1 Layer 2 Protocol Tunneling Overview	249
28.1.1 Layer-2 Protocol Tunneling Mode	250
28.2 Configuring Layer 2 Protocol Tunneling	250
sFlow	253
29.1 sFlow Overview	253
29.2 sFlow Port Configuration	253
29.2.1 sFlow Collector Configuration	255
PPPoE	257
30.1 PPPoE Intermediate Agent Overview	257
30.1.1 PPPoE Intermediate Agent Tag Format	257
30.1.2 Sub-Option Format	257
30.1.3 Port State	258
30.2 The PPPoE Screen	259
30.3 PPPoE Intermediate Agent	259
30.3.1 PPPoE IA Per-Port	261
30.3.2 PPPoE IA Per-Port Per-VLAN	262
30.3.3 PPPoE IA for VLAN	264
Error Disable	265
31.1 CPU Protection Overview	265
31.2 Error-Disable Recovery Overview	265
31.3 The Error Disable Screen	265
31.4 Error-Disable Status	266
31.5 CPU Protection Configuration	267
31.6 Error-Disable Detect Configuration	268
31.7 Error-Disable Recovery Configuration	269
MAC Pinning	271
32.1 MAC Pinning Overview	271
32.2 MAC Pinning Configuration	271
Private VLAN	273
33.1 Private VLAN Overview	273
33.1.1 Configuration	275
Green Ethernet	277
34.1 Green Ethernet Overview	277
34.2 Configuring Green Ethernet	277
Link Layer Discovery Protocol (LLDP)	279
35.1 LLDP Overview	279
35.2 LLDP-MED Overview	280
35.3 LLDP Screens	281
35.4 LLDP Local Status	282
35.4.1 LLDP Local Port Status Detail	284
35.5 LLDP Remote Status	288
35.5.1 LLDP Remote Port Status Detail	289
35.6 LLDP Configuration	295
35.6.1 LLDP Configuration Basic TLV Setting	297
35.6.2 LLDP Configuration Basic Org-specific TLV Setting	298
35.7 LLDP-MED Configuration	299
35.8 LLDP-MED Network Policy	300
35.9 LLDP-MED Location	301
Static Route	305
36.1 Static Routing Overview	305
36.2 Static Routing	305
36.3 Configuring IPv4 Static Routing	306
36.4 Configuring IPv6 Static Routing	307
Policy Routing	309
37.1 Policy Route Overview	309
37.1.1 Benefits	309
37.2 Configuring Policy Routing Profile	309
37.2.1 Policy Routing Rule Configuration	310
Differentiated Services	313
38.1 DiffServ Overview	313
38.1.1 DSCP and Per-Hop Behavior	313
38.1.2 DiffServ Network Example	313
38.2 Two Rate Three Color Marker Traffic Policing	314
38.2.1 TRTCM - Color-blind Mode	315
38.2.2 TRTCM - Color-aware Mode	315
38.3 Activating DiffServ	315
38.3.1 Configuring 2-Rate 3 Color Marker Settings	316
38.3.2 DSCP Profile	318
38.4 DSCP-to-IEEE 802.1p Priority Settings	319
38.4.1 Configuring DSCP Settings	319
DHCP	321
39.1 DHCP Overview	321
39.1.1 DHCP Modes	321
39.1.2 DHCP Configuration Options	321
39.2 DHCP Configuration	321
39.3 DHCPv4 Status	322
39.3.1 DHCPv4 Server Status Detail	322
39.4 DHCPv4 Relay	323
39.4.1 DHCPv4 Relay Agent Information	324
39.4.2 DHCPv4 Option 82 Profile	324
39.4.3 Configuring DHCPv4 Global Relay	326
39.4.4 DHCPv4 Global Relay Port Configure	327
39.4.5 Global DHCP Relay Configuration Example	328
39.5 Configuring DHCP VLAN Settings	329
39.5.1 DHCPv4 VLAN Port Configure	330
39.5.2 Example: DHCP Relay for Two VLANs	332
39.6 DHCPv6 Relay	333
VRRP	335
40.1 VRRP Overview	335
40.2 VRRP Status	336
40.3 VRRP Configuration	336
40.3.1 IP Interface Setup	336
40.3.2 VRRP Parameters	338
40.3.3 Configuring VRRP Parameters	338
40.3.4 Viewing VRRP Summary	340
40.4 VRRP Configuration Examples	340
40.4.1 One Subnet Network Example	340
40.4.2 Two Subnets Example	342
ARP Setup	344
41.1 ARP Overview	344
41.1.1 How ARP Works	344
41.1.2 ARP Learning Mode	344
41.2 ARP Setup	346
41.2.1 ARP Learning	346
41.2.2 Static ARP	347
Maintenance	350
42.1 The Maintenance Screen	350
42.1.1 Firmware Upgrade	351
42.1.2 Restore a Configuration File	352
42.1.3 Backup a Configuration File	353
42.1.4 Erase Running-Configuration	353
42.1.5 Save Configuration	353
42.1.6 Reboot System	354
42.1.7 Factory Default	354
42.1.8 Tech-Support	355
42.2 FTP Command Line	356
42.2.1 Filename Conventions	356
42.2.2 FTP Command Line Procedure	357
42.2.3 GUI-based FTP Clients	358
42.2.4 FTP Restrictions	358
Access Control	359
43.1 Access Control Overview	359
43.2 The Access Control Main Screen	359
43.3 About SNMP	359
43.3.1 SNMP v3 and Security	360
43.3.2 Supported MIBs	361
43.3.3 SNMP Traps	361
43.3.4 Configuring SNMP	364
43.3.5 Configuring SNMP Trap Group	366
43.3.6 Enabling/Disabling Sending of SNMP Traps on a Port	367
43.3.7 Configuring SNMP User	367
43.4 Setting Up Login Accounts	369
43.5 SSH Overview	371
43.6 How SSH works	371
43.7 SSH Implementation on the Switch	372
43.7.1 Requirements for Using SSH	373
43.8 Introduction to HTTPS	373
43.9 HTTPS Example	374
43.9.1 Internet Explorer Warning Messages	374
43.9.2 Mozilla Firefox Warning Messages	375
43.9.3 The Main Screen	377
43.10 Service Access Control	377
43.11 Remote Management	378
Diagnostic	380
44.1 Diagnostic	380
Syslog	382
45.1 Syslog Overview	382
45.2 Syslog Setup	382
45.3 Syslog Server Setup	383
Cluster Management	385
46.1 Clustering Management Status Overview	385
46.2 Cluster Management Status	386
46.2.1 Cluster Member Switch Management	387
46.3 Clustering Management Configuration	389
MAC Table	391
47.1 MAC Table Overview	391
47.2 Viewing the MAC Table	392
IP Table	394
48.1 IP Table Overview	394
48.2 Viewing the IP Table	395
ARP Table	396
49.1 ARP Table Overview	396
49.1.1 How ARP Works	396
49.2 The ARP Table Screen	396
Routing Table	398
50.1 Overview	398
50.2 Viewing the Routing Table Status	398
Path MTU Table	399
51.1 Path MTU Overview	399
51.2 Viewing the Path MTU Table	399
Configure Clone	400
52.1 Configure Clone	400
Neighbor Table	402
53.1 IPv6 Neighbor Table Overview	402
53.2 Viewing the IPv6 Neighbor Table	402
Troubleshooting	404
54.1 Power, Hardware Connections, and LEDs	404
54.2 Switch Access and Login	405
54.3 Switch Configuration	407
Common Services	408
IPv6	411
Customer Support	420
Legal Information	426

Match case Limit results 1 per page

Chapter 43 Access Control

XS3700 Series User’s Guide

373

43.7.1

Requirements for Using SSH

You must install an SSH client program on a client computer (Windows or Linux operating system)

that is used to connect to the Switch over SSH.

43.8

Introduction to HTTPS

HTTPS (HyperText Transfer Protocol over Secure Socket Layer, or HTTP over SSL) is a web protocol

that encrypts and decrypts web pages. Secure Socket Layer (SSL) is an application-level protocol

that enables secure transactions of data by ensuring confidentiality (an unauthorized party cannot

read the transferred data), authentication (one party can identify the other party) and data

integrity (you know if data has been changed).

It relies upon certificates, public keys, and private keys.

HTTPS on the Switch is used so that you may securely access the Switch using the web

configurator. The SSL protocol specifies that the SSL server (the Switch) must always authenticate

itself to the SSL client (the computer which requests the HTTPS connection with the Switch),

whereas the SSL client only should authenticate itself when the SSL server requires it to do so.

Authenticating client certificates is optional and if selected means the SSL-client must send the

Switch a certificate. You must apply for a certificate for the browser from a Certificate Authority

(CA) that is a trusted CA on the Switch.

Please refer to the following figure.

HTTPS connection requests from an SSL-aware web browser go to port 443 (by default) on the

Switch’s WS (web server).

HTTP connection requests from a web browser go to port 80 (by default) on the Switch’s WS (web

server).

Figure 259

HTTPS Implementation

Note: If you disable

HTTP

in the

Service Access Control

screen, then the Switch blocks

all HTTP connection attempts.