Contents

• Preface

• Description

• Preface

• Part 1 Filter

  • 1 Filter

    • 1.1 Description

      • 1.1.1 Filter Overview

      • 1.1.2 Flow detection

      • 1.1.3 Receive-side flow detection mode

      • 1.1.4 Transmit-side flow detection mode

      • 1.1.5 Flow detection conditions

      • 1.1.6 Access list

      • 1.1.7 Implicit discard

      • 1.1.8 Notes on using filters

    • 1.2 Configuration

      • 1.2.1 List of configuration commands

      • 1.2.2 Setting the Receive-side Flow Detection Mode

      • 1.2.3 Setting the flow detection mode on the sending side

      • 1.2.4 Settings for forwarding and discarding in MAC headers

      • 1.2.5 Settings for forwarding and discarding in IP and TCP/UDP headers

      • 1.2.6 Configuring Multiple Interface Filters

    • 1.3 Operation

      • 1.3.1 List of operation commands

      • 1.3.2 Verifying the Filter

• PART 2: QoS

  • 2 Outline of QoS Control

    • 2.1 QoS control architecture

    • 2.2 Description of Common Processing

      • 2.2.1 User Priority Mapping

      • 2.2.2 User Priority Mapping Considerations

    • 2.3 Configuration common to QoS control

      • 2.3.1 List of configuration commands

    • 2.4 Operation common to QoS control

      • 2.4.1 List of operation commands

  • 3 Flow Control

    • 3.1 Description of flow detection

      • 3.1.1 Receive-side flow detection mode

      • 3.1.2 Flow detection conditions

      • 3.1.3 QoS flow list

      • 3.1.4 Notes on using flow detection

    • 3.2 Flow detection configuration

      • 3.2.1 Setting the Receive-side Flow Detection Mode

      • 3.2.2 Specifying QoS Control for Multiple Interfaces

      • 3.2.3 QoS control settings for TCP/UDP port-number

    • 3.3 Flow Detection Operations

      • 3.3.1 Checking the operation of QoS control using IPv4 packets as flow-detection conditions

    • 3.4 Description of bandwidth monitoring

      • 3.4.1 Bandwidth monitoring

      • 3.4.2 Bandwidth violation notification

      • 3.4.3 Statistical information that can be collected when bandwidth monitoring is used

      • 3.4.4 Notes on using bandwidth monitoring

    • 3.5 Configuration of bandwidth monitoring

      • 3.5.1 Configuring Maximum Bandwidth Control

      • 3.5.2 Setting the queuing priority when the minimum bandwidth monitoring is violated

      • 3.5.3 Setting of DSCP rewriting when minimum bandwidth monitoring is violated in units of frames

      • 3.5.4 Configuring a combination of maximum bandwidth control and minimum bandwidth monitoring

      • 3.5.5 Configuring aggregate bandwidth monitoring

      • 3.5.6 Configuring Bandwidth Violation Notification

    • 3.6 Bandwidth monitoring operation

      • 3.6.1 Checking Maximum Bandwidth Control

      • 3.6.2 Checking the queuing priority when the minimum bandwidth monitoring is violated

      • 3.6.3 Checking DSCP rewriting when the minimum monitoring bandwidth is violated in units of frames

      • 3.6.4 Checking the combination of maximum bandwidth control and minimum bandwidth monitoring

      • 3.6.5 Checking aggregate bandwidth monitoring

      • 3.6.6 Checking bandwidth violation notifications

    • 3.7 Marker Description

      • 3.7.1 Rewrite user priority

      • 3.7.2 User priority inheritance

      • 3.7.3 DSCP rewriting

    • 3.8 Marker configuration

      • 3.8.1 User priority rewrite setting

      • 3.8.2 Setting of user priority inheritance

      • 3.8.3 Setting of DSCP rewrite

    • 3.9 Marker Operations

      • 3.9.1 Confirmation of user priority rewrite

      • 3.9.2 Confirmation of user priority inheritance

      • 3.9.3 Checking DSCP rewrite

    • 3.10 Description of priority determination

      • 3.10.1 Frame subject to priority determination

      • 3.10.2 CoS and queuing priorities

      • 3.10.3 CoS Mapping Function

      • 3.10.4 Precautions when using priority determination

    • 3.11 Priority determination configuration

      • 3.11.1 CoS setting

    • 3.12 Priority operation

      • 3.12.1 Identifying priorities

  • 4 Transmit Control

    • 4.1 Description of shaper

      • 4.1.1 Legacy shaper overview

      • 4.1.2 Transmit queue length specification

      • 4.1.3 Scheduling

      • 4.1.4 Port bandwidth control

      • 4.1.5 Notes on using shaper

    • 4.2 Shaper configuration

      • 4.2.1 Scheduling settings

      • 4.2.2 Configuring Port Bandwidth Control

    • 4.3 Shaper operation

      • 4.3.1 Checking scheduling

      • 4.3.2 Checking Port Bandwidth Control

    • 4.4 Description of disposal control

      • 4.4.1 Disposal control

    • 4.5 Discard control configuration

      • 4.5.1 Setting the queuing priority

    • 4.6 Discard control operation

      • 4.6.1 Checking the queuing priority

• PART 3: Layer 2 authentication

  • 5 Layer 2 authentication

    • 5.1 Overview

      • 5.1.1 Layer 2 authentication type

      • 5.1.2 Authentication method

      • 5.1.3 MAC VLAN Dynamic VLAN Configuration and Layer 2 Authentication

    • 5.2 Coexistence of Layer 2 authentication and other functions

      • 5.2.1 Coexistence of Layer 2 authentication and other functions

      • 5.2.2 Coexistence in the same port

      • 5.2.3 Priority of authentication when Layer 2 authentication is used together

    • 5.3 Functionality common to Layer 2 authentication

      • 5.3.1 Authentication unit at the time of setting

      • 5.3.2 Permit communication of pre-authentication terminal

      • 5.3.3 Limiting the number of authentications

      • 5.3.4 Forced authentication

      • 5.3.5 Move authenticated terminals between ports

      • 5.3.6 Dead interval function of RADIUS servers communication

      • 5.3.7 Operation when dot1q is set to MAC

    • 5.4 Notes on using Layer 2 authentication

      • 5.4.1 Precautions When Setting and Changing the Status of the Switch

      • 5.4.2 Notes on using RADIUS servers

    • 5.5 Layer 2 authentication common configuration

      • 5.5.1 List of configuration commands

      • 5.5.2 Parameter setting of Layer 2 authentication common configuration command

  • 6 IEEE 802.1 X Description

    • 6.1 IEEE 802.1 X Overview

      • 6.1.1 Support function

    • 6.2 Overview of Extensions

      • 6.2.1 Authentication mode

      • 6.2.2 Terminal detection operation switching option

      • 6.2.3 Terminal request reauthentication suppression function

      • 6.2.4 RADIUS server-access function

      • 6.2.5 EAPOL forwarding function

      • 6.2.6 Limiting the number of authentications

      • 6.2.7 Move authenticated terminals between ports

      • 6.2.8 VLAN Per-Authentication (Dynamic) Operating Modes

      • 6.2.9 Communication restrictions on authenticated terminals

    • 6.3 IEEE 802.1 X important reminder for use

  • 7 IEEE802.1X configuration and operation

    • 7.1 IEEE802.1X configuration

      • 7.1.1 List of configuration commands

      • 7.1.2 Basic IEEE802.1X Settings

      • 7.1.3 Configuring Authentication Mode Options

      • 7.1.4 Settings related to authentication processing

      • 7.1.5 RADIUS server-related settings

    • 7.2 IEEE802.1X operation

      • 7.2.1 List of operation commands

      • 7.2.2 Viewing IEEE802.1X Status

      • 7.2.3 Changing IEEE802.1X Authorization Status

  • 8 Description of Web authentication

    • 8.1 Overview

    • 8.2 Sample system configuration

      • 8.2.1 Fixed VLAN

      • 8.2.2 Dynamic VLAN

      • 8.2.3 Legacy Mode

      • 8.2.4 Configuration using IP addressing

    • 8.3 Authentication function

      • 8.3.1 Permit communication of pre-authentication terminal

      • 8.3.2 Logging In to an Authentication Network

      • 8.3.3 Forced authentication

      • 8.3.4 Logging Out of the Authentication Network

      • 8.3.5 Limiting the number of authentications

      • 8.3.6 Move authenticated terminals between ports

      • 8.3.7 Account function

    • 8.4 Authentication procedure

    • 8.5 Preparing Embedded Web Authentication DB and RADIUS Servers

      • 8.5.1 Preparing the Embedded Web Authentication DB

      • 8.5.2 Preparing RADIUS Servers

    • 8.6 Authentication error messages

    • 8.7 Web authentication window change function

    • 8.8 Notes on Using Web authentication

    • 8.9 Operation of SSL certificates

      • 8.9.1 Logging in and out using HTTPS

      • 8.9.2 Support Specifications

      • 8.9.3 Operation flow

  • 9 Setting up and operating Web authentication

    • 9.1 Configuration

      • 9.1.1 List of configuration commands

      • 9.1.2 Configuration of Fixed VLAN

      • 9.1.3 Dynamic VLAN mode configuration

      • 9.1.4 Legacy mode configuration

      • 9.1.5 Web authentication Parameter Settings

      • 9.1.6 How to Configure Authentication Exceptions

    • 9.2 Operation

      • 9.2.1 List of operation commands

      • 9.2.2 View Web authentication settings

      • 9.2.3 Displaying the status of Web authentication

      • 9.2.4 Displaying the authentication status of Web authentication

      • 9.2.5 Creating an Embedded Web Authentication DB

      • 9.2.6 Backing Up the Embedded Web authentication DB

      • 9.2.7 Registering Web authentication display

      • 9.2.8 Deleting the Registered Web authentication Display

      • 9.2.9 Displaying Web authentication Screen

      • 9.2.10 Returning RADIUS server access by dead interval function to the first RADIUS server

    • 9.3 Web authentication Window Creation Guide

      • 9.3.1 Login Window (login.html)

      • 9.3.2 Logout window (logout.html)

      • 9.3.3 Authentication error message file (webauth.msg)

      • 9.3.4 Web authentication-specific tags

      • 9.3.5 Other screen samples

    • 9.4 Preparing SSL Certificate

      • 9.4.1 Environment for creating server certificates and keys

      • 9.4.2 Creating Server Certificates and Keys

      • 9.4.3 Registering Server Certificates and Keys

      • 9.4.4 Deleting Server Certificates and Keys

  • 10 Description of MAC Certification

    • 10.1 Overview

    • 10.2 Sample system configuration

      • 10.2.1 Fixed VLAN

      • 10.2.2 Dynamic VLAN

      • 10.2.3 Operation when dot1q is set to MAC

    • 10.3 Authentication function

      • 10.3.1 Operation after authentication failure

      • 10.3.2 Forced authentication

      • 10.3.3 Deauthorization method

      • 10.3.4 Limiting the number of authentications

      • 10.3.5 Move authenticated terminals between ports

      • 10.3.6 Account function

    • 10.4 Preparing Embedded MAC Authentication DB and RADIUS Servers

      • 10.4.1 Preparing the Embedded MAC Authentication DB

      • 10.4.2 Preparing RADIUS Servers

    • 10.5 Notes on Using MAC-based authentication

  • 11 Setting up and operating MAC authorization

    • 11.1 Configuration

      • 11.1.1 List of configuration commands

      • 11.1.2 Configuration of Fixed VLAN

      • 11.1.3 Dynamic VLAN mode configuration

      • 11.1.4 MAC Authorization Parameter Settings

      • 11.1.5 How to Configure Authentication Exceptions

    • 11.2 Operation

      • 11.2.1 List of operation commands

      • 11.2.2 View MAC credentials settings

      • 11.2.3 View MAC Credentials Statistics

      • 11.2.4 Displaying the Authorization Status of MAC Authorization

      • 11.2.5 Creating an Embedded MAC Authentication DB

      • 11.2.6 Backing Up the Embedded MAC Authorization DB

      • 11.2.7 Returning RADIUS server access by dead interval function to the first RADIUS server

• PART 4: Security

  • 12 DHCP snooping

    • 12.1 Description

      • 12.1.1 Overview

      • 12.1.2 Monitoring DHCP Packets

      • 12.1.3 Rate-limiting DHCP packets

      • 12.1.4 Terminal filter

      • 12.1.5 Dynamic ARP checking

      • 12.1.6 Rate-limiting ARP packets

      • 12.1.7 Notes on using DHCP snooping

    • 12.2 Configuration

      • 12.2.1 List of configuration commands

      • 12.2.2 Basic Settings

      • 12.2.3 Rate-limiting DHCP packets

      • 12.2.4 Terminal filter

      • 12.2.5 Dynamic ARP checking

      • 12.2.6 Rate-limiting ARP packets

      • 12.2.7 When a terminal with a fixed IP is connected

      • 12.2.8 When a DHCP relay is connected under the Switch

      • 12.2.9 When a DHCP relay that assigns Option82 to the Switch is connected

      • 12.2.10 Outputting to syslog Servers

    • 12.3 Operation

      • 12.3.1 List of operation commands

      • 12.3.2 Verifying DHCP snooping Binding Database

      • 12.3.3 Checking DHCP snooping Statistics

      • 12.3.4 Verifying Dynamic ARP Checks

      • 12.3.5 Checking DHCP snooping Log Messages

• PART 5: High Reliability with Redundant Configuration

  • 13 Description of GSRP

    • 13.1 Introduction to GSRP

      • 13.1.1 Overview

      • 13.1.2 Key Features

      • 13.1.3 Support Specifications

    • 13.2 Basic principles of GSRP

      • 13.2.1 Network Configuration

      • 13.2.2 GSRP administration VLAN

      • 13.2.3 GSRP Switching Control

      • 13.2.4 Selecting master and backup

    • 13.3 Summary of GSRP Operation

      • 13.3.1 GSRP status

      • 13.3.2 Operation in case of device failure

      • 13.3.3 Behavior in case of link failure

      • 13.3.4 Backup fixation function

      • 13.3.5 GSRP VLAN group-only control function

      • 13.3.6 Ports not subject to GSRP control

    • 13.4 Layer 3 redundancy switching function

      • 13.4.1 Overview

    • 13.5 GSRP networking design

      • 13.5.1 Load-Balancing Configuration for VLAN Groups

      • 13.5.2 Multi-stage configuration of GSRP study

      • 13.5.3 Switching due to an upstream network failure in Layer 3 redundancy switching

    • 13.6 Notes on using GSRP

  • 14 GSRP configuration and operation

    • 14.1 Configuration

      • 14.1.1 List of configuration commands

      • 14.1.2 Basic GSRP Settings

      • 14.1.3 Settings related to selection of master and backup

      • 14.1.4 Configuring the Layer 3 redundancy switching functionality

      • 14.1.5 Configuring GSRP VLAN group-only control functionality

      • 14.1.6 Configuring ports not subject to GSRP control

      • 14.1.7 Setting GSRP Parameters

      • 14.1.8 Configuring the port reset function

      • 14.1.9 Configuring direct link failure detection

    • 14.2 Operation

      • 14.2.1 List of operation commands

      • 14.2.2 Checking GSRP Status

      • 14.2.3 State transition by command

      • 14.2.4 Immediate reflection of active ports on ports in the delayed state

  • 15 VRRP

    • 15.1 Description

      • 15.1.1 MAC and IP addresses of the virtual routers

      • 15.1.2 How Fault Discovery Works in VRRP

      • 15.1.3 How to select a master

      • 15.1.4 Authenticating ADVERTISEMENT packets

      • 15.1.5 Accept mode

      • 15.1.6 Tracking function

      • 15.1.7 Supported VRRP Standards

      • 15.1.8 Group switching function

      • 15.1.9 Notes on using VRRP

    • 15.2 Configuration

      • 15.2.1 List of configuration commands

      • 15.2.2 Flow of VRRP configuration

      • 15.2.3 Configuring IPv4 Addressing for a Virtual Router

      • 15.2.4 Configuring IPv6 Addressing for a Virtual Router

      • 15.2.5 Priority setting

      • 15.2.6 Setting ADVERTISEMENT Packet-Send Interval

      • 15.2.7 Configuring automatic switch-back suppression

      • 15.2.8 Setting the automatic switch-back suppression time

      • 15.2.9 Configuring Fault Monitoring Interfaces and VRRP Polling

      • 15.2.10 Grouping virtual routers

      • 15.2.11 Changing the Group Configuration

    • 15.3 Operation

      • 15.3.1 List of operation commands

      • 15.3.2 Verifying Virtual Router Configuration

      • 15.3.3 Checking track settings

      • 15.3.4 Performing a switchback operation

  • 16 Uplink redundant

    • 16.1 Description

      • 16.1.1 Overview

      • 16.1.2 Support Specifications

      • 16.1.3 Overview of Uplink and Redundant Operation

      • 16.1.4 Toggle-back operation

      • 16.1.5 Automatic switch-back function

      • 16.1.6 Auxiliary function for communication restoration

      • 16.1.7 Flash control frame transmission/reception function

      • 16.1.8 MAC address update function

      • 16.1.9 Port reset function

      • 16.1.10 Fixed Active Port Function at Switch Startup

      • 16.1.11 Notes on using uplink redundant

    • 16.2 Configuration

      • 16.2.1 List of configuration commands

      • 16.2.2 Configuring Uplink Redundant

      • 16.2.3 Configuring the port reset function

    • 16.3 Operation

      • 16.3.1 List of operation commands

      • 16.3.2 Displaying Uplink Redundant Status

      • 16.3.3 Manually Changing the Active Port

• PART 6: Network Monitoring Functions

  • 17 L2 Loop Detection

    • 17.1 Description

      • 17.1.1 Overview

      • 17.1.2 Operating specifications

      • 17.1.3 Applications

      • 17.1.4 Precautions when using L2 loop detection

    • 17.2 Configuration

      • 17.2.1 List of configuration commands

      • 17.2.2 Configuring L2 Loop Detection

    • 17.3 Operation

      • 17.3.1 List of operation commands

      • 17.3.2 Checking L2 Looping Status

  • 18 Storm Control

    • 18.1 Description

      • 18.1.1 Storm Control Overview

      • 18.1.2 Notes on using storm control

    • 18.2 Configuration

      • 18.2.1 List of configuration commands

      • 18.2.2 Configuring Storm Control

• PART 7: Managing Networks

  • 19 Port mirroring

    • 19.1 Description

      • 19.1.1 Port Mirroring Overview

      • 19.1.2 Operation Specifications for Port Mirroring

      • 19.1.3 802.1Q Tag assignment function

      • 19.1.4 Notes on using port mirroring

    • 19.2 Configuration

      • 19.2.1 List of configuration commands

      • 19.2.2 Port mirroring settings

  • 20 Policy-Based Mirroring

    • 20.1 Description

      • 20.1.1 Overview

      • 20.1.2 Policy-Based Mirroring Behavior Specifications

      • 20.1.3 Notes on using policy-based mirroring

    • 20.2 Configuration

      • 20.2.1 List of configuration commands

      • 20.2.2 Configuring Policy-Based Mirroring

    • 20.3 Operation

      • 20.3.1 List of operation commands

      • 20.3.2 Verifying Policy-Based Mirroring

  • 21 sFlow statistics (flow statistics) function

    • 21.1 Description

      • 21.1.1 Introduction to sFlow Stats

      • 21.1.2 sFlow Statistical Agent Feature

      • 21.1.3 sFlow packet-format

      • 21.1.4 sFlow statistical operation of the Switch

      • 21.1.5 Notes on Using sFlow Statistics

    • 21.2 Configuration

      • 21.2.1 List of configuration commands

      • 21.2.2 Basic Settings for sFlow Statistics

      • 21.2.3 Sample setting of sFlow statistical configuration parameter

    • 21.3 Operation

      • 21.3.1 List of operation commands

      • 21.3.2 Verifying Communication with the Collector

      • 21.3.3 Checking sFlow statistical facility during operation

      • 21.3.4 How to adjust the sample rate of sFlow statistic

  • 22 IEEE802.3ah/UDLD

    • 22.1 Description

      • 22.1.1 Overview

      • 22.1.2 Support Specifications

      • 22.1.3 IEEE 802.3 ah/UDLD important reminder for use

    • 22.2 Configuration

      • 22.2.1 List of configuration commands

      • 22.2.2 IEEE 802.3 ah/UDLD Setting

    • 22.3 Operation

      • 22.3.1 List of operation commands

      • 22.3.2 Viewing IEEE802.3ah/OAM Info

  • 23 CFM

    • 23.1 Description

      • 23.1.1 Overview

      • 23.1.2 Components of CFM

      • 23.1.3 Design of the domain

      • 23.1.4 Continuity Check

      • 23.1.5 Loopback

      • 23.1.6 Linktrace

      • 23.1.7 Common operation specifications

      • 23.1.8 Databases Used by CFM

      • 23.1.9 Notes on using CFM

    • 23.2 Configuration

      • 23.2.1 List of configuration commands

      • 23.2.2 Configuring CFM (multi-domain)

      • 23.2.3 CFM settings (same domain/multiple MA)

    • 23.3 Operation

      • 23.3.1 List of operation commands

      • 23.3.2 Verifying Connectivity Between MP

      • 23.3.3 Route checking between MP

      • 23.3.4 Checking the Status of MP on a Route

      • 23.3.5 Checking CFM Status

      • 23.3.6 Checking detailed fault information

  • 24 LLDP

    • 24.1 Description

      • 24.1.1 Overview

      • 24.1.2 Support Specifications

      • 24.1.3 Notes on using LLDP

    • 24.2 Configuration

      • 24.2.1 List of configuration commands

      • 24.2.2 Configuring LLDP

    • 24.3 Operation

      • 24.3.1 List of operation commands

      • 24.3.2 Viewing LLDP Info

  • 25 OADP

    • 25.1 Description

      • 25.1.1 Overview

      • 25.1.2 Support Specifications

      • 25.1.3 Notes on using OADP

    • 25.2 Configuration

      • 25.2.1 List of configuration commands

      • 25.2.2 Configuring OADP

    • 25.3 Operation

      • 25.3.1 List of operation commands

      • 25.3.2 Viewing OADP Info

  • 26 PTP

    • 26.1 Description

      • 26.1.1 Overview

      • 26.1.2 Support function

      • 26.1.3 E2E-TC operation

      • 26.1.4 Notes on using PTP

    • 26.2 Configuration

      • 26.2.1 List of configuration commands

      • 26.2.2 E 2 E-TC Setting

    • 26.3 Operation

      • 26.3.1 List of operation commands

      • 26.3.2 Checking PTP status

• Appendix

  • Appendix A Compliance standards

    • Appendix A.1 Diff-serv

    • Appendix A.2 IEEE 802.1 X

    • Appendix A.3 Web authentication

    • Appendix A.4 MAC certification

    • Appendix A.5 DHCP snooping

    • Appendix A.6 VRRP

    • Appendix A.7 sFlow

    • Appendix A.8 IEEE 802.3 ah/UDLD

    • Appendix A.9 CFM

    • Appendix A.10 LLDP

    • Appendix A.11 PTP

• Index